[***] Results from Oinkmaster started Wed Nov 10 19:01:46 2004 [***]
[+++] Added rules: [+++]
-> Added to bleeding-virus.rules (1):
alert tcp any any ->
[194.68.45.50,194.134.7.195,193.109.122.67,213.48.150.13,213.48.150.1,129.27.9.248]
6667 (msg:"BLEEDING-EDGE WORM Mydoom.ah/i Infection IRC Activity"; threshold:
type limit, track by_src, count 1, seconds 1800; sid:2001439; rev:1;)
[///] Modified active rules: [///]
-> Modified active in bleeding-malware.rules (17):
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware SideStep Bar Update Reporting";
classtype:trojan-activity; reference:url,www.sidestep.com;
reference:url,www.spyany.com/program/article_spw_rm_SideStep.html;
uricontent:"/wutrack.bin?PUID="; nocase; sid:2001020; rev:1;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware SideStep Bar Update Reporting";
classtype:policy-violation; reference:url,www.sidestep.com;
reference:url,www.spyany.com/program/article_spw_rm_SideStep.html;
uricontent:"/wutrack.bin?PUID="; nocase; sid:2001020; rev:2;)
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Salongas Infetcion"; classtype:trojan-activity;
uricontent:"/sp.htm?id="; sid:2000601; rev:1;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Salongas Infection"; classtype:trojan-activity;
uricontent:"/sp.htm?id="; sid:2000601; rev:1;)
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware MarketScore.com Spyware Configuration Access";
classtype:trojan-activity; reference:url,www.marketscore.com;
reference:url,www.spysweeper.com/remove-marketscore.html;
uricontent:"/oss/remoteconfig.asp"; sid:2000902; rev:1;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware MarketScore.com Spyware Configuration Access";
classtype:policy-violation; reference:url,www.marketscore.com;
reference:url,www.spysweeper.com/remove-marketscore.html;
uricontent:"/oss/remoteconfig.asp"; sid:2000902; rev:2;)
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware MarketScore.com Spyware Access";
classtype:trojan-activity; reference:url,www.marketscore.com;
reference:url,www.spysweeper.com/remove-marketscore.html;
uricontent:"proxyhttp|0b|marketscore|03|com"; sid:2001359; rev:1;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware MarketScore.com Spyware Access";
classtype:policy-violation; reference:url,www.marketscore.com;
reference:url,www.spysweeper.com/remove-marketscore.html;
uricontent:"proxyhttp|0b|marketscore|03|com"; sid:2001359; rev:2;)
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware SideStep Bar Autoupdate";
classtype:trojan-activity; reference:url,www.sidestep.com;
reference:url,www.spyany.com/program/article_spw_rm_SideStep.html;
uricontent:"/autoupd/rel"; nocase; sid:2001019; rev:1;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware SideStep Bar Autoupdate";
classtype:policy-violation; reference:url,www.sidestep.com;
reference:url,www.spyany.com/program/article_spw_rm_SideStep.html;
uricontent:"/autoupd/rel"; nocase; sid:2001019; rev:2;)
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Bfast.com Spyware";
uricontent:"/bfast/serve?bfmid"; nocase; classtype:trojan-activity;
reference:url,www.giantcompany.com/antispyware/research/spyware/spyware-BFast.com.aspx;
sid:2001398; rev:1;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Bfast.com Spyware";
uricontent:"/bfast/serve?bfmid"; nocase; classtype:policy-violation;
reference:url,www.giantcompany.com/antispyware/research/spyware/spyware-BFast.com.aspx;
sid:2001398; rev:2;)
old: alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"BLEEDING-EDGE
Bargain Buddy"; uricontent:"/download/bargin_buddy/data"; nocase;
classtype:trojan-activity;
reference:url,www.doxdesk.com/parasite/BargainBuddy.html; sid:2000574; rev:2;)
new: alert tcp $HOME_NET any -> any $HTTP_PORTS (msg:"BLEEDING-EDGE
Bargain Buddy"; uricontent:"/download/bargin_buddy"; nocase;
classtype:trojan-activity;
reference:url,www.doxdesk.com/parasite/BargainBuddy.html; sid:2000574; rev:3;)
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE MALWARE Altnet PeerPoints Manager Data Submission";
uricontent:"/backoffice.net/stats/Add.aspx"; nocase; classtype:trojan-activity;
sid:2000598; rev:1;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE MALWARE Altnet PeerPoints Manager Data Submission";
uricontent:"/backoffice.net/stats/Add.aspx"; nocase;
classtype:policy-violation; sid:2000598; rev:2;)
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware OfferOptimizer.com Spyware";
uricontent:"/ctx/keyword_context.php?urlContext=http"; nocase;
classtype:trojan-activity; reference:url,www.offeroptimizer.com; sid:2001341;
rev:2;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware OfferOptimizer.com Spyware";
uricontent:"/ctx/keyword_context.php?urlContext=http"; nocase;
classtype:policy-violation; reference:url,www.offeroptimizer.com; sid:2001341;
rev:3;)
old: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Malware Shop At Home Select.com Install Download";
reference:url,www.spywareguide.com/product_show.php?id=700;
reference:url,www.shopathomeselect.com; content:"|ab 3b d4 97 d4 a7 b4 1d da 6e
6d 0f f4 aa 4f|"; content:"|46 b3 3b 8b 38 cc 2c 2a a4 c3 07 67 67 df 65 41|";
classtype:trojan-activity; sid:2000581; rev:1;)
new: alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Malware Shop At Home Select.com Install Download";
reference:url,www.spywareguide.com/product_show.php?id=700;
reference:url,www.shopathomeselect.com; content:"|ab 3b d4 97 d4 a7 b4 1d da 6e
6d 0f f4 aa 4f|"; content:"|46 b3 3b 8b 38 cc 2c 2a a4 c3 07 67 67 df 65 41|";
classtype:policy-violation; sid:2000581; rev:2;)
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware SideStep Bar Activity"; classtype:trojan-activity;
reference:url,www.sidestep.com;
reference:url,www.spyany.com/program/article_spw_rm_SideStep.html;
uricontent:"/servlet6/jsp/mvc"; nocase; sid:2001018; rev:1;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware SideStep Bar Activity"; classtype:policy-violation;
reference:url,www.sidestep.com;
reference:url,www.spyany.com/program/article_spw_rm_SideStep.html;
uricontent:"/servlet6/jsp/mvc"; nocase; sid:2001018; rev:2;)
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware SideStep Bar Reporting Data";
classtype:trojan-activity; reference:url,www.sidestep.com;
reference:url,www.spyany.com/program/article_spw_rm_SideStep.html;
uricontent:"/servlet6/servlet/sblogservlet"; nocase; sid:2001017; rev:1;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware SideStep Bar Reporting Data";
classtype:policy-violation; reference:url,www.sidestep.com;
reference:url,www.spyany.com/program/article_spw_rm_SideStep.html;
uricontent:"/servlet6/servlet/sblogservlet"; nocase; sid:2001017; rev:2;)
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE MALWARE Altnet PeerPoints Manager Start";
uricontent:"/pm/start.asp"; nocase; classtype:trojan-activity; sid:2000906;
rev:1;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE MALWARE Altnet PeerPoints Manager Start";
uricontent:"/pm/start.asp"; nocase; classtype:policy-violation; sid:2000906;
rev:2;)
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware SideStep Bar Install"; classtype:trojan-activity;
reference:url,www.sidestep.com;
reference:url,www.spyany.com/program/article_spw_rm_SideStep.html;
uricontent:"/servlet6/servlet/sbinstservlet"; nocase; sid:2001016; rev:1;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware SideStep Bar Install"; classtype:policy-violation;
reference:url,www.sidestep.com;
reference:url,www.spyany.com/program/article_spw_rm_SideStep.html;
uricontent:"/servlet6/servlet/sbinstservlet"; nocase; sid:2001016; rev:2;)
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Shop At Home Select.com Install Attempt";
reference:url,www.spywareguide.com/product_show.php?id=700;
reference:url,www.shopathomeselect.com; uricontent:"/mindset/bunsetup.cab";
nocase; classtype:trojan-activity; sid:2000580; rev:1;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Shop At Home Select.com Install Attempt";
reference:url,www.spywareguide.com/product_show.php?id=700;
reference:url,www.shopathomeselect.com; uricontent:"/mindset/bunsetup.cab";
nocase; classtype:policy-violation; sid:2000580; rev:2;)
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Adwave Agent Access";
uricontent:"/search_404.aspx?aff="; nocase; classtype:trojan-activity;
sid:2001318; rev:1;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Malware Adwave Agent Access";
uricontent:"/search_404.aspx?aff="; nocase; classtype:policy-violation;
sid:2001318; rev:2;)
old: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE MALWARE Altnet PeerPoints Manager Settings Download";
uricontent:"/pointsmanager/seettings.cab?"; nocase; classtype:trojan-activity;
sid:2000907; rev:1;)
new: alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE MALWARE Altnet PeerPoints Manager Settings Download";
uricontent:"/pointsmanager/seettings.cab?"; nocase; classtype:policy-violation;
sid:2000907; rev:2;)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-sid-msg.map (2):
2000601 || BLEEDING-EDGE Malware Salongas Infection
2001439 || BLEEDING-EDGE WORM Mydoom.ah/i Infection IRC Activity
-> Added to bleeding-virus.rules (1):
#Submitted by colforbin5
[---] Removed non-rule lines: [---]
-> Removed from bleeding-sid-msg.map (1):
2000601 || BLEEDING-EDGE Malware Salongas Infetcion
[*] Added files: [*]
None.
-------------------------------------------------------
This SF.Net email is sponsored by:
Sybase ASE Linux Express Edition - download now for FREE
LinuxWorld Reader's Choice Award Winner for best database on Linux.
http://ads.osdn.com/?ad_id=5588&alloc_id=12065&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
