[***] Results from Oinkmaster started Wed Feb 7 18:00:08 2007 [***]
[+++] Added rules: [+++]
2003400 - BLEEDING-EDGE EXPLOIT US-ASCII Obfuscated script
(bleeding-exploit.rules)
2003401 - BLEEDING-EDGE EXPLOIT US-ASCII Obfuscated VBScript download file
(bleeding-exploit.rules)
2003402 - BLEEDING-EDGE EXPLOIT US-ASCII Obfuscated VBScript execute command
(bleeding-exploit.rules)
2003403 - BLEEDING-EDGE EXPLOIT US-ASCII Obfuscated VBScript
(bleeding-exploit.rules)
2003404 - BLEEDING-EDGE Malware WhenUClick.com WhenUSave Data Retrieval
(DataChunksGZ) (bleeding-malware.rules)
[///] Modified active rules: [///]
2001306 - BLEEDING-EDGE Malware Gator/Clarian Agent (bleeding-malware.rules)
2400000 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound
(bleeding-drop.rules)
2400001 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound
(bleeding-drop.rules)
2400002 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound
(bleeding-drop.rules)
2400003 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound
(bleeding-drop.rules)
2400004 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound
(bleeding-drop.rules)
2401000 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING
SOURCE (bleeding-drop-BLOCK.rules)
2401001 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING
SOURCE (bleeding-drop-BLOCK.rules)
2401002 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING
SOURCE (bleeding-drop-BLOCK.rules)
2401003 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING
SOURCE (bleeding-drop-BLOCK.rules)
2401004 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING
SOURCE (bleeding-drop-BLOCK.rules)
2402000 - BLEEDING-EDGE DROP Dshield Block Listed Source
(bleeding-dshield.rules)
2403000 - BLEEDING-EDGE DROP Dshield Block Listed Source - BLOCKING
(bleeding-dshield-BLOCK.rules)
2404000 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 1)
(bleeding-botcc.rules)
2404001 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 2)
(bleeding-botcc.rules)
2404002 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 3)
(bleeding-botcc.rules)
2404003 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 4)
(bleeding-botcc.rules)
2404004 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 5)
(bleeding-botcc.rules)
2404005 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 6)
(bleeding-botcc.rules)
2404006 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 7)
(bleeding-botcc.rules)
2404007 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 8)
(bleeding-botcc.rules)
2405000 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2405001 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2405002 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2405003 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2405004 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2405005 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 6) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2405006 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 7) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2405007 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 8) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-drop-BLOCK.rules (1):
# VERSION 79
-> Added to bleeding-drop.rules (1):
# VERSION 79
-> Added to bleeding-exploit.rules (10):
#by Fabien Bourdaire of ECSC Security
# Re: http://www.internetdefence.net/2007/02/06/Javascript-payload
# bc d3 c3 d2 c9 d0 d4 <SCRIPT
# bc f3 e3 f2 e9 f0 f4 <script
# ae ef f0 e5 ee a0 a2 e7 e5 f4 a2 .open "get"
# ae cf d0 c5 ce a0 a2 c7 c5 d4 a2 .OPEN "GET"
# f3 e8 e5 ec ec e5 f8 e5 e3 f5 f4 e5 shellexecute
# d3 c8 c5 cc cc c5 d8 c5 c3 d5 d4 c5
# f6 e2 f3 e3 f2 e9 f0 f4
# d6 c2 d3 c3 d2 c9 d0 d4 VBSCRIPT
-> Added to bleeding-sid-msg.map (5):
2003400 || BLEEDING-EDGE EXPLOIT US-ASCII Obfuscated script ||
url,www.securityfocus.com/archive/1/437948/30/0/threaded || cve,2006-3227 ||
url,www.internetdefence.net/2007/02/06/Javascript-payload
2003401 || BLEEDING-EDGE EXPLOIT US-ASCII Obfuscated VBScript download
file || url,www.securityfocus.com/archive/1/437948/30/0/threaded ||
cve,2006-3227 || url,www.internetdefence.net/2007/02/06/Javascript-payload
2003402 || BLEEDING-EDGE EXPLOIT US-ASCII Obfuscated VBScript execute
command || url,www.securityfocus.com/archive/1/437948/30/0/threaded ||
cve,2006-3227 || url,www.internetdefence.net/2007/02/06/Javascript-payload
2003403 || BLEEDING-EDGE EXPLOIT US-ASCII Obfuscated VBScript ||
url,www.securityfocus.com/archive/1/437948/30/0/threaded || cve,2006-3227 ||
url,www.internetdefence.net/2007/02/06/Javascript-payload
2003404 || BLEEDING-EDGE Malware WhenUClick.com WhenUSave Data
Retrieval (DataChunksGZ) ||
url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml ||
url,www.whenusearch.com
[---] Removed non-rule lines: [---]
-> Removed from bleeding-drop-BLOCK.rules (1):
# VERSION 78
-> Removed from bleeding-drop.rules (1):
# VERSION 78
-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier.
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
