[***] Results from Oinkmaster started Tue May 3 20:00:04 2005 [***]
[+++] Added rules: [+++]
2001905 - BLEEDING-EDGE VIRUS AIM Bot im.exe Activity (bleeding-virus.rules)
2001906 - BLEEDING-EDGE SCAN MYSQL 4.0 brute force root login attempt
(bleeding-scan.rules)
2001907 - BLEEDING-EDGE POLICY eBay Placing Item for sale
(bleeding-policy.rules)
2001908 - BLEEDING-EDGE POLICY eBay View Item (bleeding-policy.rules)
2001909 - BLEEDING-EDGE POLICY eBay Watch This Item (bleeding-policy.rules)
[///] Modified active rules: [///]
2000008 - BLEEDING-EDGE EXPLOIT Catalyst 3500 arbitrary command
(bleeding-exploit.rules)
2000369 - BLEEDING-EDGE P2P BitTorrent Announce (bleeding-p2p.rules)
2000934 - BLEEDING-EDGE MALWARE 2020search Update Engine
(bleeding-malware.rules)
2001055 - BLEEDING-EDGE MISC HP Web JetAdmin ExecuteFile admin access
(bleeding-policy.rules)
2001528 - BLEEDING-EDGE MALWARE ak-networks.com Access, Likely Spyware
(bleeding-malware.rules)
2001530 - BLEEDING-EDGE MALWARE ak-networks.com Spyware Code Download
(bleeding-malware.rules)
2001702 - BLEEDING-EDGE Malware Shop at Home Select Spyware Activity
(bleeding-malware.rules)
2001707 - BLEEDING-EDGE Malware Shop at Home Select Spyware Activity
(bleeding-malware.rules)
2001708 - BLEEDING-EDGE Malware Shop at Home Select Spyware Heartbeat
(bleeding-malware.rules)
2001709 - BLEEDING-EDGE Malware Shop at Home Select Spyware Config Download
(bleeding-malware.rules)
2001737 - BLEEDING-EDGE MALWARE ak-networks.com Spyware Code Install
(bleeding-malware.rules)
2001879 - BLEEDING-EDGE VIRUS Sober-style Ehlo - noalert (bleeding-virus.rules)
2001902 - BLEEDING-EDGE WORM Sober.O Attachment Outbound (bleeding-virus.rules)
[///] Modified inactive rules: [///]
2001903 - BLEEDING-EDGE WORM Sober.O Attachment Inbound (bleeding-virus.rules)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-policy.rules (6):
# All form elements are encoded before they are sent to the server
# This makes things a bit more complicated to decode via snort at least
# for me. This rule will trigger when a user is starting to place
# an item for sale on the ebay site.
# Look for a single item
# Mark an item to watch
-> Added to bleeding-scan.rules (1):
#By Jeff Kell
-> Added to bleeding-sid-msg.map (7):
2001902 || BLEEDING-EDGE WORM Sober.O Attachment Outbound ||
url,secunia.com/virus_information/17692/
2001903 || BLEEDING-EDGE WORM Sober.O Attachment Inbound ||
url,secunia.com/virus_information/17692/
2001905 || BLEEDING-EDGE VIRUS AIM Bot im.exe Activity
2001906 || BLEEDING-EDGE SCAN MYSQL 4.0 brute force root login attempt
2001907 || BLEEDING-EDGE POLICY eBay Placing Item for sale
2001908 || BLEEDING-EDGE POLICY eBay View Item
2001909 || BLEEDING-EDGE POLICY eBay Watch This Item
-> Added to bleeding-virus.rules (1):
#by phear
[---] Removed non-rule lines: [---]
-> Removed from bleeding-sid-msg.map (2):
2001902 || BLEEDING-EDGE WORM Sober.O Attachment Outbound
2001903 || BLEEDING-EDGE WORM Sober.O Attachment Inbound
-------------------------------------------------------
This SF.Net email is sponsored by: NEC IT Guy Games.
Get your fingers limbered up and give it your best shot. 4 great events, 4
opportunities to win big! Highest score wins.NEC IT Guy Games. Play to
win an NEC 61 plasma display. Visit http://www.necitguy.com/?r=20
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
