[***] Results from Oinkmaster started Tue Mar 13 14:00:04 2007 [***]
[+++] Added rules: [+++]
2003474 - BLEEDING-EDGE VOIP Asterisk Register with no URI or Version DOS
Attempt (bleeding-voip.rules)
2003475 - BLEEDING-EDGE ABC Torrent User-Agent (ABC/ABC-3.1.0)
(bleeding-p2p.rules)
2003476 - BLEEDING-EDGE MALWARE Virusblast.com Fake AV/Anti-Spyware User-Agent
(ad-protect) (bleeding-malware.rules)
2003477 - BLEEDING-EDGE MALWARE Terminexor.com Spyware User-Agent
(DInstaller2) (bleeding-malware.rules)
2003478 - BLEEDING-EDGE MALWARE Errornuker.com Fake Anti-Spyware User-Agent
(ERRORNUKER) (bleeding-malware.rules)
[///] Modified active rules: [///]
2000328 - BLEEDING-EDGE POLICY Outbound Multiple Non-SMTP Server Emails
(bleeding-policy.rules)
2001669 - BLEEDING-EDGE WEB Proxy GET Request (bleeding-web.rules)
2001670 - BLEEDING-EDGE WEB Proxy HEAD Request (bleeding-web.rules)
2001674 - BLEEDING-EDGE WEB Proxy POST Request (bleeding-web.rules)
2001675 - BLEEDING-EDGE WEB Proxy CONNECT Request (bleeding-web.rules)
2002087 - BLEEDING-EDGE POLICY Inbound Frequent Emails - Possible Spambot
Inbound (bleeding-policy.rules)
2002398 - BLEEDING-EDGE MALWARE DelFin Project User Agent
(bleeding-malware.rules)
2003470 - BLEEDING-EDGE MALWARE Winsoftware.com Spyware User-Agent (Updater)
(bleeding-malware.rules)
2400000 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound
(bleeding-drop.rules)
2400001 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound
(bleeding-drop.rules)
2400002 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound
(bleeding-drop.rules)
2400003 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound
(bleeding-drop.rules)
2400004 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound
(bleeding-drop.rules)
2401000 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING
SOURCE (bleeding-drop-BLOCK.rules)
2401001 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING
SOURCE (bleeding-drop-BLOCK.rules)
2401002 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING
SOURCE (bleeding-drop-BLOCK.rules)
2401003 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING
SOURCE (bleeding-drop-BLOCK.rules)
2401004 - BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING
SOURCE (bleeding-drop-BLOCK.rules)
2402000 - BLEEDING-EDGE DROP Dshield Block Listed Source
(bleeding-dshield.rules)
2403000 - BLEEDING-EDGE DROP Dshield Block Listed Source - BLOCKING
(bleeding-dshield-BLOCK.rules)
2404000 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 1)
(bleeding-botcc.rules)
2404001 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 2)
(bleeding-botcc.rules)
2404002 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 3)
(bleeding-botcc.rules)
2404003 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 4)
(bleeding-botcc.rules)
2404004 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 5)
(bleeding-botcc.rules)
2404005 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 6)
(bleeding-botcc.rules)
2405000 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2405001 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2405002 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2405003 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2405004 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
2405005 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 6) - BLOCKING SOURCE
(bleeding-botcc-BLOCK.rules)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-drop-BLOCK.rules (1):
# VERSION 121
-> Added to bleeding-drop.rules (1):
# VERSION 121
-> Added to bleeding-p2p.rules (1):
#Matt Jonkman, from spywarelp data
-> Added to bleeding-sid-msg.map (9):
2001669 || BLEEDING-EDGE WEB Proxy GET Request
2001670 || BLEEDING-EDGE WEB Proxy HEAD Request
2001674 || BLEEDING-EDGE WEB Proxy POST Request
2001675 || BLEEDING-EDGE WEB Proxy CONNECT Request
2003474 || BLEEDING-EDGE VOIP Asterisk Register with no URI or Version
DOS Attempt || url,tools.ietf.org/html/rfc3261 ||
url,labs.musecurity.com/advisories/MU-200703-01.txt
2003475 || BLEEDING-EDGE ABC Torrent User-Agent (ABC/ABC-3.1.0) ||
url,pingpong-abc.sourceforge.net
2003476 || BLEEDING-EDGE MALWARE Virusblast.com Fake AV/Anti-Spyware
User-Agent (ad-protect) || url,www.virusblast.com ||
url,spywarewarrior.com/rogue_anti-spyware.htm
2003477 || BLEEDING-EDGE MALWARE Terminexor.com Spyware User-Agent
(DInstaller2) ||
url,netrn.net/spywareblog/archives/2004/12/23/more-rip-off-ware-terminexor ||
url,www.terminexor.com
2003478 || BLEEDING-EDGE MALWARE Errornuker.com Fake Anti-Spyware
User-Agent (ERRORNUKER) || url,www.errornuker.com ||
url,www.spywarewarrior.com/rogue_anti-spyware.htm
-> Added to bleeding-voip.rules (1):
#by Blake Hartstein
[---] Removed non-rule lines: [---]
-> Removed from bleeding-drop-BLOCK.rules (1):
# VERSION 120
-> Removed from bleeding-drop.rules (1):
# VERSION 120
-> Removed from bleeding-sid-msg.map (4):
2001669 || BLEEDING-EDGE Web Proxy GET Request
2001670 || BLEEDING-EDGE Web Proxy HEAD Request
2001674 || BLEEDING-EDGE Proxy POST Request
2001675 || BLEEDING-EDGE Proxy CONNECT Request
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys-and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
