[***] Results from Oinkmaster started Thu Sep 16 20:00:03 2004 [***]
[+++] Added rules: [+++]
-> Added to bleeding-malware.rules (1):
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Websearch.com Spyware";
uricontent:"/sitereview.asmx/GetReview"; nocase; classtype:trojan-activity;
sid:2001325; rev:2;)
[---] Removed rules: [---]
-> Removed from bleeding-malware.rules (1):
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Unknown Spyware Agent Traffic";
uricontent:"/sitereview.asmx/GetReview"; nocase; classtype:trojan-activity;
sid:2001323; rev:1;)
-> Removed from bleeding.rules (4):
#alert udp any any -> $HOME_NET 1434 (msg:"BLEEDING-EDGE MS-SQL ping
attempt (06)"; content:"|06|"; depth:1; reference:
url,http.www.nextgenss.com/papers/tp-SQL2000.pdf; classtype:misc-activity;
sid:2000385; rev:1;)
#alert udp any any -> $HOME_NET 1434 (msg:"BLEEDING-EDGE MS-SQL ping
attempt (03)"; content:"|03|"; depth:1; reference:
url,http.www.nextgenss.com/papers/tp-SQL2000.pdf; classtype:misc-activity;
sid:2000382; rev:1;)
#alert udp any any -> $HOME_NET 1434 (msg:"BLEEDING-EDGE MS-SQL ping
attempt (05)"; content:"|05|"; depth:1; reference:
url,http.www.nextgenss.com/papers/tp-SQL2000.pdf; classtype:misc-activity;
sid:2000384; rev:1;)
alert udp any any -> $HOME_NET 1434 (msg:"BLEEDING-EDGE MS-SQL buffer
overflow attempt (04)"; content:"|04|"; depth:1; reference:
url,http.www.nextgenss.com/papers/tp-SQL2000.pdf; classtype:misc-activity;
sid:2000383; rev:1;)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-sid-msg.map (1):
2001325 || BLEEDING-EDGE Malware Websearch.com Spyware
[---] Removed non-rule lines: [---]
-> Removed from bleeding-sid-msg.map (2):
2000383 || BLEEDING-EDGE MS-SQL buffer overflow attempt (04) ||
url,http.www.nextgenss.com/papers/tp-SQL2000.pdf
2001323 || BLEEDING-EDGE Malware Unknown Spyware Agent Traffic
[*] Added files: [*]
None.
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
