This rule is in deleted.rules for a reason.
On 0, "McKenzie, Omar" <Omar.McKenzie@frx.com> allegedly wrote:
<<snort-sid-template.txt>>
Regards,
Omar McKenzie, CISSP
Information Security Engineer
Forest Laboratories, Inc.
Omar.McKenzie@frx.com
(631) 858-7629
Content-Description: snort-sid-template.txt
# This is a template for submitting snort signature descriptions to
# the snort.org website
#
# Ensure that your descriptions are your own
# and not the work of others. References in the rules themselves
# should be used for linking to other's work.
#
# If you are unsure of some part of a rule, use that as a commentary
# and someone else perhaps will be able to fix it.
#
# $Id$
#
#
Rule:
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WEB-ATTACKS rm
command attempt"; flow:to_server,established; content:"rm%20"; nocase;
classtype:web-application-attack; sid:1365; rev:5;)
--
Sid:
1365
--
Summary:
Attempted rm command access via web
--
Impact:
--
Detailed Information:
--
Affected Systems:
--
Attack Scenarios:
--
Ease of Attack:
--
False Positives:
This rules seems to fire on legitimate that contain *rm%20; For example I
have a web page that contains the phrase "LIBRARY FCRM EDOCS" and this rule
fires each time the webpage is access. The rule may need to be modified to
include a space before rm.
--
False Negatives:
--
Corrective Action:
--
Contributors:
--
Additional References:
+-----------------------------------------------------------------+
Nigel Houghton Research Engineer Sourcefire Inc.
Vulnerability Research Team
You know, I rather like this God fellow. Very theatrical,
you know. Pestilence here, a plague there. Omnipotence
...gotta get me some of that. - Stewart Griffin
-------------------------------------------------------
This SF.Net email is sponsored by: InterSystems CACHE
FREE OODBMS DOWNLOAD - A multidimensional database that combines
robust object and relational technologies, making it a perfect match
for Java, C++,COM, XML, ODBC and JDBC. www.intersystems.com/match8
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
