[***] Results from Oinkmaster started Tue Sep 14 20:00:04 2004 [***]
[///] Modified active rules: [///]
-> Modified active in bleeding.rules (5):
old: alert tcp any any -> any any (msg:"BLEEDING-EDGE P2P ed2k file
request answer"; content:"|e3|"; offset:0; depth:1; content:"|00000059|";
offset:2; depth:4; classtype:policy-violation;
reference:url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; rev: 1;
sid:2000333;)
new: alert tcp any any -> any 4660:4799 (msg:"BLEEDING-EDGE P2P ed2k
file request answer"; content:"|e3|"; offset:0; depth:1; content:"|00000059|";
offset:2; depth:4; classtype:policy-violation;
reference:url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; rev: 2;
sid:2000333;)
old: alert tcp any any -> any any (msg:"BLEEDING-EDGE P2P ed2k file
search"; content:"|e3|"; offset:0; depth:1; content:"|00000016|"; offset:2;
depth:4; classtype:policy-violation;
reference:url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; rev: 1;
sid:2000331;)
new: alert tcp any any -> any 4660:4799 (msg:"BLEEDING-EDGE P2P ed2k
file search"; content:"|e3|"; offset:0; depth:1; content:"|00000016|";
offset:2; depth:4; classtype:policy-violation;
reference:url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; rev: 2;
sid:2000331;)
old: alert tcp any any -> any any (msg:"BLEEDING-EDGE P2P ed2k request
part"; content:"|e3|"; offset:0; depth:1; content:"|00000047|"; offset:2;
depth:4; classtype:policy-violation;
reference:url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; rev: 1;
sid:2000332;)
new: alert tcp any any -> any 4660:4799 (msg:"BLEEDING-EDGE P2P ed2k
request part"; content:"|e3|"; offset:0; depth:1; content:"|00000047|";
offset:2; depth:4; classtype:policy-violation;
reference:url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; rev: 2;
sid:2000332;)
old: alert tcp any any -> any any (msg:"BLEEDING-EDGE P2P ed2k
connection to server"; content:"|e3|"; offset:0; depth:1; content:"|00000001|";
offset:2; depth:4; classtype:policy-violation;
reference:url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; rev: 1;
sid:2000330;)
new: alert tcp any any -> any 4660:4799 (msg:"BLEEDING-EDGE P2P ed2k
connection to server"; content:"|e3|"; offset:0; depth:1; content:"|00000001|";
offset:2; depth:4; classtype:policy-violation;
reference:url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; rev: 2;
sid:2000330;)
old: alert tcp !$SMTP_SERVERS any -> !$SMTP_SERVERS 25
(msg:"BLEEDING-EDGE Multiple Non-SMTP Server Emails";flags: S; threshold: type
threshold, track by_src,count 10, seconds 60; classtype:misc-activity; rev:2;
sid:2000328;)
new: alert tcp !$SMTP_SERVERS any -> !$SMTP_SERVERS 25
(msg:"BLEEDING-EDGE Multiple Non-SMTP Server Emails";flags: S; threshold: type
threshold, track by_src,count 10, seconds 120; classtype:misc-activity; rev:3;
sid:2000328;)
[---] Disabled rules: [---]
-> Disabled in bleeding.rules (1):
#alert tcp any any <> any any (msg:"BLEEDING-EDGE CHAT Yahoo IM
message"; flow:established; content:"YMSG"; depth:4;
classtype:policy-violation; priority:1; sid:2001260; rev:1;)
[---] Removed non-rule lines: [---]
-> Removed from bleeding-sid-msg.map (1):
2001260 || BLEEDING-EDGE CHAT Yahoo IM message
[*] Added files: [*]
None.
-------------------------------------------------------
This SF.Net email is sponsored by: thawte's Crypto Challenge Vl
Crack the code and win a Sony DCRHC40 MiniDV Digital Handycam
Camcorder. More prizes in the weekly Lunch Hour Challenge.
Sign up NOW http://ad.doubleclick.net/clk;10740251;10262165;m
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
