Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Snort-Signatures
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [Snort-sigs] Emerging Threats Daily Signature Changes

from [Joel Esler] Network Security [Permanent Link]
Subject: Re: [Snort-sigs] Emerging Threats Daily Signature Changes
Date: Sun, 30 Dec 2007 17:16:47 -0500 
Are we going to have emerging threats and bleeding commits on the list  
now?

--
Joel Esler
Sent from the iRoad.

On Dec 30, 2007, at 5:00 PM, emerging@emergingthreats.net wrote:



[***] Results from Oinkmaster started Sun Dec 30 17:00:06 2007 [***]

[+++]          Added rules:          [+++]

2007711 - BLEEDING-EDGE TROJAN Srizbi registering with controller  
(bleeding-virus.rules)
2007712 - BLEEDING-EDGE TROJAN Srizbi requesting template (bleeding- 
virus.rules)


[///]     Modified active rules:     [///]

2406004 - BLEEDING-EDGE RBN Known Russian Business Network Monitored  
Domains (1) (bleeding-rbn.rules)
2406005 - BLEEDING-EDGE RBN Known Russian Business Network Monitored  
Domains (2) (bleeding-rbn.rules)
2406006 - BLEEDING-EDGE RBN Known Russian Business Network Monitored  
Domains (3) (bleeding-rbn.rules)
2406007 - BLEEDING-EDGE RBN Known Russian Business Network Monitored  
Domains (4) (bleeding-rbn.rules)
2407004 - BLEEDING-EDGE RBN Known Russian Business Network Monitored  
Domains - BLOCKING (1) (bleeding-rbn-BLOCK.rules)
2407005 - BLEEDING-EDGE RBN Known Russian Business Network Monitored  
Domains - BLOCKING (2) (bleeding-rbn-BLOCK.rules)
2407006 - BLEEDING-EDGE RBN Known Russian Business Network Monitored  
Domains - BLOCKING (3) (bleeding-rbn-BLOCK.rules)
2407007 - BLEEDING-EDGE RBN Known Russian Business Network Monitored  
Domains - BLOCKING (4) (bleeding-rbn-BLOCK.rules)


[+++]      Added non-rule lines:     [+++]

    -> Added to bleeding-attack_response.rules (1):
       # $Id: bleeding-attack_response.rules $

    -> Added to bleeding-dos.rules (1):
       # $Id: bleeding-dos.rules $

    -> Added to bleeding-exploit.rules (1):
       # $Id: bleeding-exploit.rules $

    -> Added to bleeding-game.rules (1):
       # $Id: bleeding-game.rules $

    -> Added to bleeding-inappropriate.rules (1):
       # $Id: bleeding-inappropriate.rules $

    -> Added to bleeding-malware.rules (1):
       # $Id: bleeding-malware.rules $

    -> Added to bleeding-p2p.rules (1):
       # $Id: bleeding-p2p.rules $

    -> Added to bleeding-policy.rules (1):
       # $Id: bleeding-policy.rules $

    -> Added to bleeding-rbn-BLOCK.rules (2):
       #  VERSION 21
       #  Updated 2007-12-29 22:48:42

    -> Added to bleeding-rbn.rules (2):
       #  VERSION 21
       #  Updated 2007-12-29 22:48:42

    -> Added to bleeding-scan.rules (1):
       # $Id: bleeding-scan.rules $

    -> Added to bleeding-sid-msg.map (66):
       2007711 || BLEEDING-EDGE TROJAN Srizbi registering with  
controller || url,www.secureworks.com/research/threats/ronpaul/
       2007712 || BLEEDING-EDGE TROJAN Srizbi requesting template ||  
url,www.secureworks.com/research/threats/ronpaul/
       2400000 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound || url,www.spamhaus.org/drop/drop.lasso
       2400001 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound || url,www.spamhaus.org/drop/drop.lasso
       2400002 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound || url,www.spamhaus.org/drop/drop.lasso
       2400003 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound || url,www.spamhaus.org/drop/drop.lasso
       2400004 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound || url,www.spamhaus.org/drop/drop.lasso
       2401000 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound - BLOCKING SOURCE || url,www.spamhaus.org/drop/drop.lasso
       2401001 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound - BLOCKING SOURCE || url,www.spamhaus.org/drop/drop.lasso
       2401002 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound - BLOCKING SOURCE || url,www.spamhaus.org/drop/drop.lasso
       2401003 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound - BLOCKING SOURCE || url,www.spamhaus.org/drop/drop.lasso
       2401004 || BLEEDING-EDGE DROP Spamhaus DROP Listed Traffic  
Inbound - BLOCKING SOURCE || url,www.spamhaus.org/drop/drop.lasso
       2402000 || BLEEDING-EDGE DROP Dshield Block Listed Source ||  
url,feeds.dshield.org/block.txt
       2403000 || BLEEDING-EDGE DROP Dshield Block Listed Source -  
BLOCKING || url,feeds.dshield.org/block.txt
       2404000 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 1)  || url,www.shadowserver.org
       2404001 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 2)  || url,www.shadowserver.org
       2404002 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 3)  || url,www.shadowserver.org
       2404003 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 4)  || url,www.shadowserver.org
       2404004 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 5)  || url,www.shadowserver.org
       2404005 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 6)  || url,www.shadowserver.org
       2404006 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 7)  || url,www.shadowserver.org
       2404007 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 8)  || url,www.shadowserver.org
       2404008 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 9)  || url,www.shadowserver.org
       2404009 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 10)  || url,www.shadowserver.org
       2404010 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 11)  || url,www.shadowserver.org
       2404011 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 12)  || url,www.shadowserver.org
       2404012 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 13)  || url,www.shadowserver.org
       2404013 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 14)  || url,www.shadowserver.org
       2404014 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 15)  || url,www.shadowserver.org
       2404015 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 16)  || url,www.shadowserver.org
       2404016 || BLEEDING-EDGE DROP Known Bot C&C Server Traffic  
(group 17)  || url,www.shadowserver.org
       2405000 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405001 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405002 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405003 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405004 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405005 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 6)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405006 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 7)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405007 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 8)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405008 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group 9)  
- BLOCKING SOURCE || url,www.shadowserver.org
       2405009 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group  
10) - BLOCKING SOURCE || url,www.shadowserver.org
       2405010 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group  
11) - BLOCKING SOURCE || url,www.shadowserver.org
       2405011 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group  
12) - BLOCKING SOURCE || url,www.shadowserver.org
       2405012 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group  
13) - BLOCKING SOURCE || url,www.shadowserver.org
       2405013 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group  
14) - BLOCKING SOURCE || url,www.shadowserver.org
       2405014 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group  
15) - BLOCKING SOURCE || url,www.shadowserver.org
       2405015 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group  
16) - BLOCKING SOURCE || url,www.shadowserver.org
       2405016 || BLEEDING-EDGE DROP Known Bot C&C Traffic (group  
17) - BLOCKING SOURCE || url,www.shadowserver.org
       2406000 || BLEEDING-EDGE RBN Known Russian Business Network  
Traffic - Hosting Nets || url,doc.bleedingthreats.net/bin/view/Main/ 
RussianBusinessNetwork
       2406001 || BLEEDING-EDGE RBN Known Russian Business Network  
Traffic - Individual Hosts || url,doc.bleedingthreats.net/bin/view/ 
Main/RussianBusinessNetwork
       2406002 || BLEEDING-EDGE RBN Known Russian Business Network  
Traffic - Chinese Nets || url,doc.bleedingthreats.net/bin/view/Main/ 
RussianBusinessNetwork
       2406003 || BLEEDING-EDGE RBN Known Russian Business Network  
Traffic - Known Trojan C&Cs || url,doc.bleedingthreats.net/bin/view/ 
Main/RussianBusinessNetwork
       2406004 || BLEEDING-EDGE RBN Known Russian Business Network  
Monitored Domains (1) || url,doc.bleedingthreats.net/bin/view/Main/ 
RussianBusinessNetwork
       2406005 || BLEEDING-EDGE RBN Known Russian Business Network  
Monitored Domains (2) || url,doc.bleedingthreats.net/bin/view/Main/ 
RussianBusinessNetwork
       2406006 || BLEEDING-EDGE RBN Known Russian Business Network  
Monitored Domains (3) || url,doc.bleedingthreats.net/bin/view/Main/ 
RussianBusinessNetwork
       2406007 || BLEEDING-EDGE RBN Known Russian Business Network  
Monitored Domains (4) || url,doc.bleedingthreats.net/bin/view/Main/ 
RussianBusinessNetwork
       2407000 || BLEEDING-EDGE RBN Known Russian Business Network  
Traffic - Hosting Nets - BLOCKING || url,doc.bleedingthreats.net/bin/ 
view/Main/RussianBusinessNetwork
       2407001 || BLEEDING-EDGE RBN Known Russian Business Network  
Traffic - Individual Hosts - BLOCKING || url,doc.bleedingthreats.net/ 
bin/view/Main/RussianBusinessNetwork
       2407002 || BLEEDING-EDGE RBN Known Russian Business Network  
Traffic - Chinese Nets - BLOCKING || url,doc.bleedingthreats.net/bin/ 
view/Main/RussianBusinessNetwork
       2407003 || BLEEDING-EDGE RBN Known Russian Business Network  
Traffic - Known Trojan C&Cs - BLOCKING ||  
url,doc.bleedingthreats.net/bin/view/Main/RussianBusinessNetwork
       2407004 || BLEEDING-EDGE RBN Known Russian Business Network  
Monitored Domains - BLOCKING (1) || url,doc.bleedingthreats.net/bin/ 
view/Main/RussianBusinessNetwork
       2407005 || BLEEDING-EDGE RBN Known Russian Business Network  
Monitored Domains - BLOCKING (2) || url,doc.bleedingthreats.net/bin/ 
view/Main/RussianBusinessNetwork
       2407006 || BLEEDING-EDGE RBN Known Russian Business Network  
Monitored Domains - BLOCKING (3) || url,doc.bleedingthreats.net/bin/ 
view/Main/RussianBusinessNetwork
       2407007 || BLEEDING-EDGE RBN Known Russian Business Network  
Monitored Domains - BLOCKING (4) || url,doc.bleedingthreats.net/bin/ 
view/Main/RussianBusinessNetwork
       2500000 || BLEEDING-EDGE COMPROMISED Known Compromised or  
Hostile Host Traffic (1) || url,doc.bleedingthreats.net/bin/view/ 
Main/CompromisedHosts
       2510000 || BLEEDING-EDGE COMPROMISED Known Compromised or  
Hostile Host Traffic - BLOCKING (1) || url,doc.bleedingthreats.net/ 
bin/view/Main/CompromisedHosts

    -> Added to bleeding-virus.rules (2):
       # $Id: bleeding-virus.rules $
       #from Secureworks research

    -> Added to bleeding-voip.rules (1):
       # $Id: bleeding-voip.rules $

    -> Added to bleeding-web.rules (1):
       # $Id: bleeding-web.rules $

    -> Added to bleeding-web_sql_injection.rules (1):
       # $Id: bleeding-web_sql_injection.rules $

    -> Added to bleeding.rules (1):
       # $Id: bleeding.rules $

[---]     Removed non-rule lines:    [---]

    -> Removed from bleeding-rbn-BLOCK.rules (2):
       #  VERSION 8
       #  Updated 2007-11-12 23:25:12

    -> Removed from bleeding-rbn.rules (2):
       #  VERSION 8
       #  Updated 2007-11-12 23:25:12


--- 
----------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs



-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  [Snort-sigs] Emerging Threats Daily Signature Changes, emerging
Next by Date:  Re: [Snort-sigs] Emerging Threats Daily Signature Changes, Matt Jonkman
Previous by Thread:  [Snort-sigs] Emerging Threats Daily Signature Changes, emerging
Next by Thread:  Re: [Snort-sigs] Emerging Threats Daily Signature Changes, Matt Jonkman
Indexes:  [Date] [Thread] [Top] [All Lists]