Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Signatures
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

[Snort-sigs] Bleedingsnort.com Daily Update

from [matt] Network Security [Permanent Link]
Subject: [Snort-sigs] Bleedingsnort.com Daily Update
Date: Mon, 4 Oct 2004 20:00:01 -0500 

[***] Results from Oinkmaster started Mon Oct  4 20:00:01 2004 [***]

[///]     Modified active rules:     [///]

     -> Modified active in bleeding-malware.rules (40):
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Gator/Clarian Agent"; 
uricontent:"/gbsf/gd/ne/new.net.gtrg2ze"; nocase; classtype:trojan-activity; 
sid:2001306; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Gator/Clarian Agent"; 
uricontent:"/gbsf/gd/ne/new.net.gtrg2ze"; nocase; classtype:policy-violation; 
sid:2001306; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Ebates Install"; 
reference:url,www.pestpatrol.com/PestInfo/e/ebates_moneymaker.asp; 
uricontent:"/ebates.exe"; sid:2001038; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Ebates Install"; 
reference:url,www.pestpatrol.com/PestInfo/e/ebates_moneymaker.asp; 
uricontent:"/ebates.exe"; classtype:policy-violation; sid:2001038; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com Clock Sync App Checkin"; 
classtype:trojan-activity; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/heartbeat?program=clock"; nocase; sid:2000910; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com Clock Sync App Checkin"; 
classtype:policy-violation; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/heartbeat?program=clock"; nocase; sid:2000910; rev:2;)
        old: alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"BLEEDING-EDGE 
CometSystems Spyware"; uricontent:"/comet/request"; nocase; 
classtype:trojan-activity; 
reference:url,www.pestpatrol.com/pestinfo/c/cometsystems.asp; sid:2001050; 
rev:1;)
        new: alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"BLEEDING-EDGE 
CometSystems Spyware"; uricontent:"/comet/request"; nocase; 
classtype:policy-violation; 
reference:url,www.pestpatrol.com/pestinfo/c/cometsystems.asp; sid:2001050; 
rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware MyWebSearch Toolbar Receiving Configuration"; 
classtype:trojan-activity; uricontent:"/myspeedbarcfg2.jsp?"; sid:2000600; 
rev:2;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware MyWebSearch Toolbar Receiving Configuration"; 
classtype:policy-violation; uricontent:"/myspeedbarcfg2.jsp?"; sid:2000600; 
rev:3;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware EUniverse-thunderdownloads Update Engine"; 
flow:to_server,established; content:"POST"; depth:4; content:"mgmt.svr HTTP"; 
within:50; content:"|0d0a|Host|3a|update.thunderdownloads.com"; nocase; 
within:300; classtype:trojan-activity; 
reference:url,www.pestpatrol.com/pestinfo/e/euniverse.asp; sid:2000935; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware EUniverse-thunderdownloads Update Engine"; 
flow:to_server,established; content:"POST"; depth:4; content:"mgmt.svr HTTP"; 
within:50; content:"|0d0a|Host|3a|update.thunderdownloads.com"; nocase; 
within:300; classtype:policy-violation; 
reference:url,www.pestpatrol.com/pestinfo/e/euniverse.asp; sid:2000935; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com App and Search Bar Install"; 
classtype:trojan-activity; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/Appinstall?app=VVSN"; nocase; sid:2000909; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com App and Search Bar Install"; 
classtype:policy-violation; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/Appinstall?app=VVSN"; nocase; sid:2000909; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Traffic Syndicate Add/Remove"; 
uricontent:"/Support/AddRemove.aspx?id="; nocase; classtype:trojan-activity; 
sid:2001313; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Traffic Syndicate Add/Remove"; 
uricontent:"/Support/AddRemove.aspx?id="; nocase; classtype:policy-violation; 
sid:2001313; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com Weather App Checkin"; 
classtype:trojan-activity; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/weatherDB"; nocase; sid:2000914; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com Weather App Checkin"; 
classtype:policy-violation; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/weatherDB"; nocase; sid:2000914; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Unknown Advertising.com Data Post"; 
classtype:trojan-activity; uricontent:"/Games/cakedeal.aspx"; nocase; nocase; 
sid:2001230; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Unknown Advertising.com Data Post"; 
classtype:policy-violation; uricontent:"/Games/cakedeal.aspx"; nocase; nocase; 
sid:2001230; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Popuptraffic.com Bot Reporting"; 
reference:url,popuptraffic.com; uricontent:"/scripts/click.php?hid="; 
classtype:trojan-activity; sid:2000577; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Popuptraffic.com Bot Reporting"; 
reference:url,popuptraffic.com; uricontent:"/scripts/click.php?hid="; 
classtype:policy-violation; sid:2000577; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Internet Optomizer Reporting Data"; 
uricontent:"/io/downloads/"; nocase; content:"/wsi8/optimize"; nocase; 
classtype:trojan-activity; sid:2001308; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Internet Optomizer Reporting Data"; 
uricontent:"/io/downloads/"; nocase; content:"/wsi8/optimize"; nocase; 
classtype:policy-violation; sid:2001308; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com Desktop Bar Install"; 
classtype:trojan-activity; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/Appinstall?app=desktop"; nocase; sid:2000918; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com Desktop Bar Install"; 
classtype:policy-violation; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/Appinstall?app=desktop"; nocase; sid:2000918; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware My Search Bar Install"; 
reference:url,www.2-spyware.com/parasite-my-search-bar.html; 
uricontent:"/mysetp.exe"; nocase; sid:2001040; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware My Search Bar Install"; 
reference:url,www.2-spyware.com/parasite-my-search-bar.html; 
uricontent:"/mysetp.exe"; nocase; classtype:policy-violation; sid:2001040; 
rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Internet Optimizer Spyware Agent Upload"; 
uricontent:"/conf/xml/"; nocase; classtype:trojan-activity; sid:2001336; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Internet Optimizer Spyware Agent Upload"; 
uricontent:"/conf/xml/"; nocase; classtype:policy-violation; sid:2001336; 
rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com WhenUSave Data Retrieval"; 
classtype:trojan-activity; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/SearchDB?update="; nocase; sid:2000919; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com WhenUSave Data Retrieval"; 
classtype:policy-violation; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/SearchDB?update="; nocase; sid:2000919; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Gator Agent Traffic"; content:"User-Agent\: Gator"; 
nocase; classtype:trojan-activity; sid:2000026; rev:2; )
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Gator Agent Traffic"; content:"User-Agent\: Gator"; 
nocase; classtype:policy-violation; sid:2000026; rev:3; )
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Traffic Syndicate Agent Updating"; 
uricontent:"/TbLinkConfig.asmx"; nocase; classtype:trojan-activity; 
sid:2001315; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Traffic Syndicate Agent Updating"; 
uricontent:"/TbLinkConfig.asmx"; nocase; classtype:policy-violation; 
sid:2001315; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com WhenUSave App Checkin"; 
classtype:trojan-activity; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/heartbeat?program=whenusave"; nocase; sid:2000916; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com WhenUSave App Checkin"; 
classtype:policy-violation; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/heartbeat?program=whenusave"; nocase; sid:2000916; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Cometsystems Update Engine"; 
flow:to_server,established; content:"GET /cc/"; depth:8;content:"Host|3a|"; 
within:300; content:"update.cc.cometsystems.com"; within:40; 
classtype:trojan-activity; 
reference:url,www.pestpatrol.com/PestInfo/c/cometsystems.asp; sid:2000931; 
rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Cometsystems Update Engine"; 
flow:to_server,established; content:"GET /cc/"; depth:8;content:"Host|3a|"; 
within:300; content:"update.cc.cometsystems.com"; within:40; 
classtype:policy-violation; 
reference:url,www.pestpatrol.com/PestInfo/c/cometsystems.asp; sid:2000931; 
rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com App and Search Bar Install"; 
classtype:trojan-activity;  reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/vsn/ISA/save"; nocase; sid:2000908; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com App and Search Bar Install"; 
classtype:policy-violation;  reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/vsn/ISA/save"; nocase; sid:2000908; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com Weather App Checkin"; 
classtype:trojan-activity; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/heartbeat?program=weather"; nocase; sid:2000911; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com Weather App Checkin"; 
classtype:policy-violation; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/heartbeat?program=weather"; nocase; sid:2000911; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com WhenUSave Data Retrieval"; 
classtype:trojan-activity; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/OffersDataGZ?update="; nocase; sid:2000917; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com WhenUSave Data Retrieval"; 
classtype:policy-violation; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/OffersDataGZ?update="; nocase; sid:2000917; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Fun Web Products Install"; 
classtype:trojan-activity; reference:url,www.funwebproducts.com; 
uricontent:"/install_ie.jsp?product="; sid:2000599; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Fun Web Products Install"; 
classtype:policy-violation; reference:url,www.funwebproducts.com; 
uricontent:"/install_ie.jsp?product="; sid:2000599; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com Clock Sync App Checkin"; 
classtype:trojan-activity; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/clock?id="; nocase; sid:2000912; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com Clock Sync App Checkin"; 
classtype:policy-violation; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/clock?id="; nocase; sid:2000912; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Gator New Code Download"; uricontent:"/gatorcme/"; 
nocase; classtype:trojan-activity; sid:2000597; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Gator New Code Download"; uricontent:"/gatorcme/"; 
nocase; classtype:policy-violation; sid:2000597; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Fun Web Products Agent Traffic"; threshold:type 
limit, track by_src, count 10, seconds 60; classtype:trojan-activity; 
reference:url,www.funwebproducts.com; content:"FunWebProducts\;"; nocase; 
sid:2001034; rev:5;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Fun Web Products Agent Traffic"; threshold:type 
limit, track by_src, count 10, seconds 60; classtype:policy-violation; 
reference:url,www.funwebproducts.com; content:"FunWebProducts\;"; nocase; 
sid:2001034; rev:6;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Fun Web Products MyWay Agent Traffic"; 
threshold:type limit, track by_src, count 10, seconds 60; 
classtype:trojan-activity; reference:url,www.funwebproducts.com; 
content:"FunWebProducts-MyWay\;"; nocase; sid:2001043; rev:3;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Fun Web Products MyWay Agent Traffic"; 
threshold:type limit, track by_src, count 10, seconds 60; 
classtype:policy-violation; reference:url,www.funwebproducts.com; 
content:"FunWebProducts-MyWay\;"; nocase; sid:2001043; rev:4;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Gator Cookie"; 
content:"webpdpcookie";content:".gator.com"; nocase; classtype:trojan-activity; 
sid:2000025; rev:3;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Gator Cookie"; 
content:"webpdpcookie";content:".gator.com"; nocase; 
classtype:policy-violation; sid:2000025; rev:4;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Fun Web Products SmileyCentral"; 
classtype:trojan-activity; reference:url,www.funwebproducts.com; 
uricontent:"/images/smileycentral/"; nocase; content:"FunWebProducts"; nocase; 
sid:2001013; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Fun Web Products SmileyCentral"; 
classtype:policy-violation; reference:url,www.funwebproducts.com; 
uricontent:"/images/smileycentral/"; nocase; content:"FunWebProducts"; nocase; 
sid:2001013; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Unknown Advertising.com Agent"; 
classtype:trojan-activity; uricontent:"/pops=1/site="; nocase; 
uricontent:"/bnum="; nocase; sid:2001226; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Unknown Advertising.com Agent"; 
classtype:policy-violation; uricontent:"/pops=1/site="; nocase; 
uricontent:"/bnum="; nocase; sid:2001226; rev:2;)
        old: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any 
(msg:"BLEEDING-EDGE Malware Gator Data Submission"; content:"POST 
/gs_trickler"; nocase; classtype:trojan-activity; sid:2000596; rev:1;)
        new: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any 
(msg:"BLEEDING-EDGE Malware Gator Data Submission"; content:"POST 
/gs_trickler"; nocase; classtype:policy-violation; sid:2000596; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Gator Agent Installed"; content:"|5573 65 72 2d 41 
67 65 6e 74 3a 20 47 61 74 6f 
72|";reference:url,pestpatrol.com/pestinfo/g/gain.asp; 
classtype:trojan-activity; sid:2000368; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Gator Agent Installed"; content:"|5573 65 72 2d 41 
67 65 6e 74 3a 20 47 61 74 6f 
72|";reference:url,pestpatrol.com/pestinfo/g/gain.asp; 
classtype:policy-violation; sid:2000368; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com Weather App Checkin"; 
classtype:trojan-activity; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/weather?id="; nocase; sid:2000915; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com Weather App Checkin"; 
classtype:policy-violation; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/weather?id="; nocase; sid:2000915; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Traffic Syndicate Agent Updating"; 
uricontent:"/TbInstConfig.asmx"; nocase; classtype:trojan-activity; 
sid:2001316; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Traffic Syndicate Agent Updating"; 
uricontent:"/TbInstConfig.asmx"; nocase; classtype:policy-violation; 
sid:2001316; rev:2;)
        old: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any 
(msg:"BLEEDING-EDGE Comet Cursor spyware detection"; content:"|53 65 72 76 65 
72|"; content:"|43 6F 6D 65 74|"; reference: 
url,simplythebest.net/info/spyware/comet_cursor_spyware.html; 
classtype:trojan-activity; sid:2000551; rev:4;)
        new: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any 
(msg:"BLEEDING-EDGE Comet Cursor spyware detection"; content:"|53 65 72 76 65 
72|"; content:"|43 6F 6D 65 74|"; reference: 
url,simplythebest.net/info/spyware/comet_cursor_spyware.html; 
classtype:policy-violation; sid:2000551; rev:5;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com Clock Sync App Checkin"; 
classtype:trojan-activity; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/clockDB"; nocase; sid:2000913; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware WhenUClick.com Clock Sync App Checkin"; 
classtype:policy-violation; reference:url,www.whenusearch.com; 
reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; 
uricontent:"/clockDB"; nocase; sid:2000913; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Statblaster Receiving New configuration"; 
classtype:trojan-activity; uricontent:"/updatestats/update"; nocase; 
uricontent:".xml"; nocase; sid:2001225; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Statblaster Receiving New configuration"; 
classtype:policy-violation; uricontent:"/updatestats/update"; nocase; 
uricontent:".xml"; nocase; sid:2001225; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Unknown Advertising.com Data Post"; 
classtype:trojan-activity; uricontent:"/Games/villains.aspx"; nocase; nocase; 
sid:2001228; rev:1;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Unknown Advertising.com Data Post"; 
classtype:policy-violation; uricontent:"/Games/villains.aspx"; nocase; nocase; 
sid:2001228; rev:2;)
        old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Gator Checkin"; uricontent:"/gbsf/"; nocase; 
classtype:trojan-activity; sid:2000595; rev:2;)
        new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Gator Checkin"; uricontent:"/gbsf/"; nocase; 
classtype:policy-violation; sid:2000595; rev:3;)

[///]    Modified inactive rules:    [///]

     -> Modified inactive in bleeding-malware.rules (1):
        old: #alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Gator Ad Retrieval"; content:"Host\: 
webpdp.gator.com"; nocase; classtype:trojan-activity; sid:2001014; rev:1;)
        new: #alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS 
(msg:"BLEEDING-EDGE Malware Gator Ad Retrieval"; content:"Host\: 
webpdp.gator.com"; nocase; classtype:policy-violation; sid:2001014; rev:2;)

[*] Non-rule line modifications: [*]
    None.

[*] Added files: [*]
    None.



-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: [Snort-sigs] can any one help me ?, Jose Maria Lopez
Next by Date:  [Snort-users] grupo de snort en espaņol, CAPRA, Claudio Alberto
Previous by Thread:  [Snort-sigs] Bleedingsnort.com Daily Update, matt
Next by Thread:  [Snort-sigs] Bleedingsnort.com Daily Update, matt
Indexes:  [Date] [Thread] [Top] [All Lists]