[***] Results from Oinkmaster started Sun Nov 14 20:00:08 2004 [***]
[+++] Added rules: [+++]
-> Added to bleeding-malware.rules (2):
alert tcp $EXTERNAL_NET 20 -> $HOME_NET any (msg:"BLEEDING-EDGE Malware
Abox Download"; flow:established,to_server; content:"|5c 00 43 00 61 00 72 00
6d 00 65 00 6e 00 00 00 16 00 00 00 73 00 75 00 63|"; offset:160; depth:26;
nocase; flowbits:isnotset,tagged; flowbits:set,tagged; tag:host,1,packets,src;
reference:url,www.giantcompany.com/antispyware/
research/spyware/spyware-ABox.aspx; classtype:trojan-activity; sid:2001440;
rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE
Malware Abox Install Report"; content:"GET /new_install?id="; nocase;
content:"&time="; classtype:trojan-activity; sid:2001441; rev:1;)
[///] Modified active rules: [///]
-> Modified active in bleeding.rules (1):
old: alert tcp any any -> $HOME_NET 22 (msg:"BLEEDING-EDGE Potential
SSH Brute Force Attack"; flags:S; threshold:type threshold, track by_src, count
5, seconds 120; classtype:attempted-dos; sid:2001219; rev:5;)
new: alert tcp any any -> $HOME_NET 22 (msg:"BLEEDING-EDGE Potential
SSH Scan"; flags:S; threshold:type threshold, track by_src, count 5, seconds
120; classtype:attempted-dos; sid:2001219; rev:6;)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-malware.rules (1):
#Submitted by cooljay
-> Added to bleeding-sid-msg.map (3):
2001219 || BLEEDING-EDGE Potential SSH Scan
2001440 || BLEEDING-EDGE Malware Abox Download ||
url,www.giantcompany.com/antispyware/ research/spyware/spyware-ABox.aspx
2001441 || BLEEDING-EDGE Malware Abox Install Report
[---] Removed non-rule lines: [---]
-> Removed from bleeding-sid-msg.map (1):
2001219 || BLEEDING-EDGE Potential SSH Brute Force Attack
[*] Added files: [*]
None.
-------------------------------------------------------
This SF.Net email is sponsored by: InterSystems CACHE
FREE OODBMS DOWNLOAD - A multidimensional database that combines
robust object and relational technologies, making it a perfect match
for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
