[***] Results from Oinkmaster started Tue Oct 10 21:00:08 2006 [***]
[+++] Added rules: [+++]
2003117 - BLEEDING-EDGE VIRUS SHELLCODE CLET polymorphic payload
(bleeding-virus.rules)
[///] Modified active rules: [///]
2002750 - BLEEDING-EDGE POLICY Reserved IP Space Traffic - Bogon Nets 2
(bleeding-policy.rules)
2402000 - BLEEDING-EDGE DROP Dshield Block Listed Source
(bleeding-dshield.rules)
2403000 - BLEEDING-EDGE DROP Dshield Block Listed Source - BLOCKING
(bleeding-dshield-BLOCK.rules)
2410000 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 1)
(bleeding-botcc.rules)
2410001 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 2)
(bleeding-botcc.rules)
2410002 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 3)
(bleeding-botcc.rules)
2410003 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 4)
(bleeding-botcc.rules)
2410004 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 5)
(bleeding-botcc.rules)
2410005 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 6)
(bleeding-botcc.rules)
2411000 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2411001 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2411002 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2411003 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2411004 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2411005 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 6) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
[---] Disabled rules: [---]
2001834 - BLEEDING-EDGE DNS lookup attempt to hostile, poisoning DNS server -
ISC Diary (bleeding.rules)
2001835 - BLEEDING-EDGE Sites trying to infect PCs with malware - ISC Diary
(bleeding.rules)
2001836 - BLEEDING-EDGE Web page trying to infect PCs with malware - ISC Diary
(bleeding.rules)
2001837 - BLEEDING-EDGE Suspicious DNS server answer\: 218.38.13.108
(bleeding.rules)
2001838 - BLEEDING-EDGE Suspicious DNS server answer\: 217.16.26.148
(bleeding.rules)
2001839 - BLEEDING-EDGE Suspicious DNS server answer\: 205.162.201.11
(bleeding.rules)
2001840 - BLEEDING-EDGE Suspicious DNS server answer\: besthost.co.kr
(bleeding.rules)
2001842 - BLEEDING-EDGE Possible DNS Lookup for DNS Poisoning Domain 7sir7.com
(bleeding.rules)
2001843 - BLEEDING-EDGE Possible DNS Lookup for DNS Poisoning Domain
123xxl.com (bleeding.rules)
2001844 - BLEEDING-EDGE Possible DNS Lookup for DNS Poisoning Domain abx4.com
(bleeding.rules)
2002670 - BLEEDING-EDGE CURRENT EVENTS Malware Altered Host - DNS to Malicious
DNS Server (tcp) (bleeding.rules)
2002672 - BLEEDING-EDGE CURRENT EVENTS Malware Altered Host - DNS to Malicious
DNS Server (udp) (bleeding.rules)
2002813 - BLEEDING-EDGE CURRENT Mac OS/X MIME Header x-unix-mode Tag
(bleeding.rules)
2003001 - BLEEDING-EDGE TROJAN Unknown Trojan Communication (bleeding.rules)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-sid-msg.map (1):
2003117 || BLEEDING-EDGE VIRUS SHELLCODE CLET polymorphic payload ||
url,toorcon.org/2006/conference.html?id=29
-> Added to bleeding-virus.rules (5):
#These are by Vlad Tsyrklevich during presentation at Toorcon 06.
These are experimental and will likely be high load.
#more information at http://toorcon.org/2006/conference.html?id=29
#These are disabled by default until we learn more about them.
#alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE VIRUS
SHELLCODE Shikata Ga Nai polymorphic payload"; classtype:shellcode-detect;
dsize: >26; content: "|d9 74 24 f4|"; pcre: "/[\x29\x2b\x31\x33]\xc9/sm"; pcre:
"/[\xd9-\xdb\xdd].{1,11}\xd9\x74\x24\xf4.{0,10}[\x58\x5a\x5b\x5d-\x5f]/sm";
pcre:
"/([\x29\x2b\x31\x33\xb8\xba\xbb\xbe\xbf\xd9-\xdb\xdd][^\x00\xff][^\x00\xff][^\x00][^\x00\xff][^\x00][^\x00\xff][^\x00\xff][^\x00][^\x00][^\x00][^\x00\xff][^\x00\xff][^\x00\xff][^\x00][^\x00][\x31\x83][\x42\x43\x46\x47\x50\x53\x56-\x58\x5a\x5e\x5f\x70\x72\x73\x77\x78\x7a\x7b\x7e\xc0\xc2\xc3\xc6\xc7\xe8\xea\xeb\xee\xef][\x04\x0e\x10\x12\x13\x15\x17\xfc][\x03\x31\x83][\x42\x43\x46\x47\x50\x53\x56-\x58\x5a\x5e\x5f\x70\x72\x73\x77\x78\x7a\x7b\x7e\xc0\xc2\xc3\xc6\xc7\xe8\xea\xeb\xee\xef][\x04\x0a\x0c\x0e-\x13\x15\x17\xfc][\x03\x83]..[^\x1d\xe2][^\x0a\xf5])|([\x29\x2b\x31\x33\xb8\xba\xbb\xbd-\xbf\xd9-\xdb\xdd][^\x00][^\x00][^\x00][^\x00][^\x00][^\x00][^\x00][^\x00][\x24\
xb1\xd9-\xdb\xdd][^\x00][\x58\x5a\x5b\x5d-\x5f\xb8\xba\xbb\xbd-\xbf\xd9][^\x00][^\x00][^\x00][^\x00][\x31\x83][\x42\x43\x45-\x47\x50\x53\x55-\x58\x5a\x5d-\x5f\x68\x6a\x6b\x6e-\x70\x72\x73\x75\x77\x78\x7a\x7b\x7d\x7e\xc0\xc2\xc3\xc5-\xc7\xe8\xea\xeb\xed-\xef][\x04\x0e\x12\x17\xfc][\x03\x31\x83][\x42\x43\x45-\x47\x50\x53\x55-\x58\x5a\x5d-\x5f\x68\x6a\x6b\x6e-\x70\x72\x73\x75\x77\x78\x7a\x7b\x7d\x7e\xc0\xc2\xc3\xc5-\xc7\xe8\xea\xeb\xed-\xef][\x04\x0a\x0e\x12\x13\x17\xfc][\x03\x83]..[^\xe2][^\xf5])/sm";
reference:url,toorcon.org/2006/conference.html?id=29; sid;2003118; rev:1;)
#alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE VIRUS
SHELLCODE ADMutate polymorphic payload"; classtype:shellcode-detect; dsize:
45; content: "|e8|"; content: "|ff ff ff|"; distance: 1; within: 3; pcre:
"/\xeb[\x26-\x7a].{0,20}(\x5e|\x58\x96|\x58\x89\xc6|\x8b\x34\x24\x83\xec\x04).{0,20}(((\xbb....|\x68....\x5b).{0,20}(\x31\xc9|\x31\xc0\x91))|((\x31\xc9|\x31\xc0\x91).{0,20}(\xbb....|\x68....\x5b))).{0,20}(\xb1.|\x6a.\x58\x89\xc1|\x6a.\x66\x59).{0,20}(\x31\x1e|\x93\x31\x06\x93|\x8b\x06\x09\xd8\x21\x1e\xf7\x16\x21\x06).{0,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}\xe2[\xa0-\xf9].{0,20}\xeb[\x06-\x20].{0,20}\xe8[\x7f-\xff]\xff\xff\xff/sm";
reference:url,toorcon.org/2006/conference.html?id=29; sid;2003119; rev:1;)
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
