[***] Results from Oinkmaster started Tue Oct 17 21:00:10 2006 [***]
[+++] Added rules: [+++]
2003118 - BLEEDING-EDGE VIRUS SHELLCODE Shikata Ga Nai polymorphic payload
(bleeding-virus.rules)
2003119 - BLEEDING-EDGE VIRUS SHELLCODE ADMutate polymorphic payload
(bleeding-virus.rules)
2003120 - BLEEDING-EDGE POLICY Possible Image Spam Inbound (3)
(bleeding-policy.rules)
2003121 - BLEEDING-EDGE docs.google.com Activity (bleeding-policy.rules)
2003122 - BLEEDING-EDGE Possible docs.google.com Activity
(bleeding-policy.rules)
[///] Modified active rules: [///]
2402000 - BLEEDING-EDGE DROP Dshield Block Listed Source
(bleeding-dshield.rules)
2403000 - BLEEDING-EDGE DROP Dshield Block Listed Source - BLOCKING
(bleeding-dshield-BLOCK.rules)
2410000 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 1)
(bleeding-botcc.rules)
2410001 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 2)
(bleeding-botcc.rules)
2410002 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 3)
(bleeding-botcc.rules)
2410003 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 4)
(bleeding-botcc.rules)
2410004 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 5)
(bleeding-botcc.rules)
2411000 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2411001 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2411002 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2411003 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2411004 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
[---] Removed rules: [---]
2003118 - BLEEDING-EDGE POLICY Possible Image Spam Inbound (3)
(bleeding-policy.rules)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-policy.rules (1):
# Submitted 2006-10-17 by Adam Nunn
-> Added to bleeding-sid-msg.map (5):
2003118 || BLEEDING-EDGE VIRUS SHELLCODE Shikata Ga Nai polymorphic
payload || url,toorcon.org/2006/conference.html?id=29
2003119 || BLEEDING-EDGE VIRUS SHELLCODE ADMutate polymorphic payload
|| url,toorcon.org/2006/conference.html?id=29
2003120 || BLEEDING-EDGE POLICY Possible Image Spam Inbound (3)
2003121 || BLEEDING-EDGE docs.google.com Activity || url,docs.google.com
2003122 || BLEEDING-EDGE Possible docs.google.com Activity ||
url,docs.google.com
[---] Removed non-rule lines: [---]
-> Removed from bleeding-sid-msg.map (1):
2003118 || BLEEDING-EDGE POLICY Possible Image Spam Inbound (3)
-> Removed from bleeding-virus.rules (2):
#alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE VIRUS
SHELLCODE Shikata Ga Nai polymorphic payload"; classtype:shellcode-detect;
dsize: >26; content: "|d9 74 24 f4|"; pcre: "/[\x29\x2b\x31\x33]\xc9/sm"; pcre:
"/[\xd9-\xdb\xdd].{1,11}\xd9\x74\x24\xf4.{0,10}[\x58\x5a\x5b\x5d-\x5f]/sm";
pcre:
"/([\x29\x2b\x31\x33\xb8\xba\xbb\xbe\xbf\xd9-\xdb\xdd][^\x00\xff][^\x00\xff][^\x00][^\x00\xff][^\x00][^\x00\xff][^\x00\xff][^\x00][^\x00][^\x00][^\x00\xff][^\x00\xff][^\x00\xff][^\x00][^\x00][\x31\x83][\x42\x43\x46\x47\x50\x53\x56-\x58\x5a\x5e\x5f\x70\x72\x73\x77\x78\x7a\x7b\x7e\xc0\xc2\xc3\xc6\xc7\xe8\xea\xeb\xee\xef][\x04\x0e\x10\x12\x13\x15\x17\xfc][\x03\x31\x83][\x42\x43\x46\x47\x50\x53\x56-\x58\x5a\x5e\x5f\x70\x72\x73\x77\x78\x7a\x7b\x7e\xc0\xc2\xc3\xc6\xc7\xe8\xea\xeb\xee\xef][\x04\x0a\x0c\x0e-\x13\x15\x17\xfc][\x03\x83]..[^\x1d\xe2][^\x0a\xf5])|([\x29\x2b\x31\x33\xb8\xba\xbb\xbd-\xbf\xd9-\xdb\xdd][^\x00][^\x00][^\x00][^\x00][^\x00][^\x00][^\x00][^\x00][\x24\
xb1\xd9-\xdb\xdd][^\x00][\x58\x5a\x5b\x5d-\x5f\xb8\xba\xbb\xbd-\xbf\xd9][^\x00][^\x00][^\x00][^\x00][\x31\x83][\x42\x43\x45-\x47\x50\x53\x55-\x58\x5a\x5d-\x5f\x68\x6a\x6b\x6e-\x70\x72\x73\x75\x77\x78\x7a\x7b\x7d\x7e\xc0\xc2\xc3\xc5-\xc7\xe8\xea\xeb\xed-\xef][\x04\x0e\x12\x17\xfc][\x03\x31\x83][\x42\x43\x45-\x47\x50\x53\x55-\x58\x5a\x5d-\x5f\x68\x6a\x6b\x6e-\x70\x72\x73\x75\x77\x78\x7a\x7b\x7d\x7e\xc0\xc2\xc3\xc5-\xc7\xe8\xea\xeb\xed-\xef][\x04\x0a\x0e\x12\x13\x17\xfc][\x03\x83]..[^\xe2][^\xf5])/sm";
reference:url,toorcon.org/2006/conference.html?id=29; sid;2003118; rev:1;)
#alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"BLEEDING-EDGE VIRUS
SHELLCODE ADMutate polymorphic payload"; classtype:shellcode-detect; dsize:
45; content: "|e8|"; content: "|ff ff ff|"; distance: 1; within: 3; pcre:
"/\xeb[\x26-\x7a].{0,20}(\x5e|\x58\x96|\x58\x89\xc6|\x8b\x34\x24\x83\xec\x04).{0,20}(((\xbb....|\x68....\x5b).{0,20}(\x31\xc9|\x31\xc0\x91))|((\x31\xc9|\x31\xc0\x91).{0,20}(\xbb....|\x68....\x5b))).{0,20}(\xb1.|\x6a.\x58\x89\xc1|\x6a.\x66\x59).{0,20}(\x31\x1e|\x93\x31\x06\x93|\x8b\x06\x09\xd8\x21\x1e\xf7\x16\x21\x06).{0,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}(\x46|\x83\xc6\x01|\x96\x40\x96).{0,20}\xe2[\xa0-\xf9].{0,20}\xeb[\x06-\x20].{0,20}\xe8[\x7f-\xff]\xff\xff\xff/sm";
reference:url,toorcon.org/2006/conference.html?id=29; sid;2003119; rev:1;)
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
