[***] Results from Oinkmaster started Tue Oct 12 20:00:02 2004 [***]
[+++] Added rules: [+++]
-> Added to bleeding-malware.rules (1):
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Bonziportal Traffic"; classtype:trojan-activity;
reference:url,www.bonzibuddy.com; uricontent:"/bonziportal/bin/"; sid:2001345;
rev:1;)
-> Added to bleeding-policy.rules (3):
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Kiddy Porn pre-teen"; content:"pre-teen"; nocase;
threshold: type threshold, track by_dst,count 5, seconds 360; sid:2001347;
rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Kiddy Porn early teen"; content:"early teen"; nocase;
threshold: type threshold, track by_dst,count 5, seconds 360; sid:2001348;
rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Kiddy Porn preteen"; content:"preteen"; nocase; threshold:
type threshold, track by_dst,count 5, seconds 360; sid:2001346; rev:1;)
[///] Modified active rules: [///]
-> Modified active in bleeding-policy.rules (1):
old: alert tcp $HOME_NET any -> 66.151.158.177 any (msg:"BLEEDING-EDGE
GotoMyPC Polling Client"; rev:1; sid:2000309;)
new: alert ip $HOME_NET any -> 66.151.158.177 any (msg:"BLEEDING-EDGE
GotoMyPC Polling Client"; rev:2; sid:2000309;)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-malware.rules (1):
#Submitted by Allison MacFarlan
-> Added to bleeding-policy.rules (1):
#Info for these sigs from Gary Kalbfleisch
-> Added to bleeding-sid-msg.map (4):
2001345 || BLEEDING-EDGE Malware Bonziportal Traffic ||
url,www.bonzibuddy.com
2001346 || BLEEDING-EDGE Kiddy Porn preteen
2001347 || BLEEDING-EDGE Kiddy Porn pre-teen
2001348 || BLEEDING-EDGE Kiddy Porn early teen
[*] Added files: [*]
None.
-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
