Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | [Snort-sigs] Emerging Threats Daily Signature Changes |
|---|---|
| Date: | Sun, 3 Feb 2008 17:00:09 -0500 (EST) |
[***] Results from Oinkmaster started Sun Feb 3 17:00:09 2008 [***]
[///] Modified active rules: [///]
2000419 - ET POLICY PE EXE or DLL Windows file download (bleeding-policy.rules)
2000427 - ET POLICY PE EXE Install Windows file download
(bleeding-policy.rules)
2000559 - ET WEB THCIISLame IIS SSL Exploit Attempt (bleeding-web.rules)
2000575 - ET SCAN ICMP PING IPTools (bleeding-scan.rules)
2001066 - ET TROJAN IE Ilookup Trojan (bleeding-virus.rules)
2001595 - ET POLICY Skype VOIP Checking Version (Startup)
(bleeding-policy.rules)
2001596 - ET POLICY Skype VOIP Reporting Install (bleeding-policy.rules)
2001609 - ET SCAN F5 BIG-IP 3DNS TCP Probe 1 (bleeding-scan.rules)
2001610 - ET SCAN F5 BIG-IP 3DNS TCP Probe 2 (bleeding-scan.rules)
2001611 - ET SCAN F5 BIG-IP 3DNS TCP Probe 3 (bleeding-scan.rules)
2001682 - ET POLICY MSN IM Poll via HTTP (bleeding-policy.rules)
2001812 - ET P2P KazaaClient P2P Traffic (bleeding-p2p.rules)
2002376 - ET WEB IBM Lotus Domino BaseTarget XSS attempt (bleeding-web.rules)
2002377 - ET WEB IBM Lotus Domino Src XSS attempt (bleeding-web.rules)
2002730 - ET WEB PHPGedView Remote Script Code Execution attempt
(bleeding-web.rules)
2002861 - ET EXPLOIT Danim.dll and Dxtmsft.dll COM Objects
(bleeding-exploit.rules)
2002971 - ET EXPLOIT Wmm2fxa.dll COM Object Instantiation Memory Corruption
(bleeding-exploit.rules)
2002973 - ET SCAN Behavioral Unusual Port 3127 traffic, Potential Scan or
Backdoor (bleeding-scan.rules)
2003475 - ET P2P ABC Torrent User-Agent (ABC/ABC-3.1.0) (bleeding-p2p.rules)
2007639 - ET POLICY FOX,ABC On-demand UA (bleeding-policy.rules)
2406005 - ET RBN Known Russian Business Network Monitored Domains (1)
(bleeding-rbn.rules)
2406006 - ET RBN Known Russian Business Network Monitored Domains (2)
(bleeding-rbn.rules)
2406007 - ET RBN Known Russian Business Network Monitored Domains (3)
(bleeding-rbn.rules)
2406008 - ET RBN Known Russian Business Network Monitored Domains (4)
(bleeding-rbn.rules)
2407005 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(1) (bleeding-rbn-BLOCK.rules)
2407006 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(2) (bleeding-rbn-BLOCK.rules)
2407007 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(3) (bleeding-rbn-BLOCK.rules)
2407008 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(4) (bleeding-rbn-BLOCK.rules)
[///] Modified inactive rules: [///]
2000418 - ET POLICY Executable and linking format (ELF) file download
(bleeding-policy.rules)
2000420 - ET POLICY REG files version 4 download (bleeding-policy.rules)
2000421 - ET POLICY REG files version 5 download (bleeding-policy.rules)
2000422 - ET POLICY REG files version 5 Unicode download
(bleeding-policy.rules)
2000423 - ET POLICY NE EXE OS2 file download (bleeding-policy.rules)
2000424 - ET POLICY LX EXE OS2 file download (bleeding-policy.rules)
2000425 - ET POLICY NE EXE Windows 3.x file download (bleeding-policy.rules)
2000426 - ET POLICY EXE compressed PKWARE Windows file download
(bleeding-policy.rules)
2000428 - ET POLICY ZIP file download (bleeding-policy.rules)
2000429 - ET POLICY Download Windows Help File CHM 2 (bleeding-policy.rules)
2000489 - ET POLICY Download Windows Help File CHM (bleeding-policy.rules)
2001114 - ET POLICY Mozilla XPI install files download (bleeding-policy.rules)
2001115 - ET POLICY MSI (microsoft installer file) download
(bleeding-policy.rules)
2001449 - ET POLICY Proxy Connection detected (bleeding-policy.rules)
[+++] Added non-rule lines: [+++]
-> Added to bleeding-rbn-BLOCK.rules (2):
# VERSION 28
# Updated 2008-02-03 12:53:15
-> Added to bleeding-rbn.rules (2):
# VERSION 28
# Updated 2008-02-03 12:53:15
-> Added to bleeding-sid-msg.map (36):
2000418 || ET POLICY Executable and linking format (ELF) file download
|| url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm
2000419 || ET POLICY PE EXE or DLL Windows file download
2000420 || ET POLICY REG files version 4 download ||
url,www.ss64.com/nt/regedit.html
2000421 || ET POLICY REG files version 5 download ||
url,www.ss64.com/nt/regedit.html
2000422 || ET POLICY REG files version 5 Unicode download ||
url,www.ss64.com/nt/regedit.html
2000423 || ET POLICY NE EXE OS2 file download ||
url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm
2000424 || ET POLICY LX EXE OS2 file download ||
url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm
2000425 || ET POLICY NE EXE Windows 3.x file download ||
url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm
2000426 || ET POLICY EXE compressed PKWARE Windows file download ||
url,www.program-transformation.org/Transform/PcExeFormat
2000427 || ET POLICY PE EXE Install Windows file download ||
url,www.program-transformation.org/Transform/PcExeFormat
2000428 || ET POLICY ZIP file download ||
url,zziplib.sourceforge.net/zzip-parse.print.html
2000429 || ET POLICY Download Windows Help File CHM 2 ||
url,www.securiteam.com/windowsntfocus/6V00N000AU.html ||
url,www.speakeasy.org/~russotto/chm/chmformat.html
2000489 || ET POLICY Download Windows Help File CHM ||
url,www.securiteam.com/windowsntfocus/6V00N000AU.html ||
url,www.speakeasy.org/~russotto/chm/chmformat.html
2000559 || ET WEB THCIISLame IIS SSL Exploit Attempt ||
url,isc.sans.org/diary.php?date=2004-07-17 ||
url,www.thc.org/exploits/THCIISSLame.c
2000575 || ET SCAN ICMP PING IPTools ||
url,www.ks-soft.net/ip-tools.eng/index.htm || url,www.ks-soft.net/ip-tools.eng
2001066 || ET TROJAN IE Ilookup Trojan || url,62.131.86.111/analysis.htm
2001114 || ET POLICY Mozilla XPI install files download
2001115 || ET POLICY MSI (microsoft installer file) download
2001449 || ET POLICY Proxy Connection detected
2001595 || ET POLICY Skype VOIP Checking Version (Startup) ||
url,www1.cs.columbia.edu/~library/TR-repository/reports/reports-2004/cucs-039-04.pdf
2001596 || ET POLICY Skype VOIP Reporting Install ||
url,www1.cs.columbia.edu/~library/TR-repository/reports/reports-2004/cucs-039-04.pdf
2001609 || ET SCAN F5 BIG-IP 3DNS TCP Probe 1 ||
url,www.f5.com/f5products/v9intro/index.html
2001610 || ET SCAN F5 BIG-IP 3DNS TCP Probe 2 ||
url,www.f5.com/f5products/v9intro/index.html
2001611 || ET SCAN F5 BIG-IP 3DNS TCP Probe 3 ||
url,www.f5.com/f5products/v9intro/index.html
2001682 || ET POLICY MSN IM Poll via HTTP
2001812 || ET P2P KazaaClient P2P Traffic ||
url,www.kazaa.com/us/index.htm
2002376 || ET WEB IBM Lotus Domino BaseTarget XSS attempt ||
bugtraq,14845
2002377 || ET WEB IBM Lotus Domino Src XSS attempt || bugtraq,14846
2002730 || ET WEB PHPGedView Remote Script Code Execution attempt ||
bugtraq,15983
2002861 || ET EXPLOIT Danim.dll and Dxtmsft.dll COM Objects ||
url,www.microsoft.com/technet/security/bulletin/ms06-013.mspx || cve,2006-1186
2002971 || ET EXPLOIT Wmm2fxa.dll COM Object Instantiation Memory
Corruption || url,www.microsoft.com/technet/security/bulletin/ms06-021.mspx ||
bugtraq,18328 || cve,2006-1303
2002973 || ET SCAN Behavioral Unusual Port 3127 traffic, Potential Scan
or Backdoor
2003475 || ET P2P ABC Torrent User-Agent (ABC/ABC-3.1.0) ||
url,pingpong-abc.sourceforge.net
2007639 || ET POLICY FOX,ABC On-demand UA
2402000 || ET DROP Dshield Block Listed Source ||
url,feeds.dshield.org/block.txt
2403000 || ET DROP Dshield Block Listed Source - BLOCKING ||
url,feeds.dshield.org/block.txt
-> Added to bleeding-sid-msg.map.txt (36):
2000418 || ET POLICY Executable and linking format (ELF) file download
|| url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm
2000419 || ET POLICY PE EXE or DLL Windows file download
2000420 || ET POLICY REG files version 4 download ||
url,www.ss64.com/nt/regedit.html
2000421 || ET POLICY REG files version 5 download ||
url,www.ss64.com/nt/regedit.html
2000422 || ET POLICY REG files version 5 Unicode download ||
url,www.ss64.com/nt/regedit.html
2000423 || ET POLICY NE EXE OS2 file download ||
url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm
2000424 || ET POLICY LX EXE OS2 file download ||
url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm
2000425 || ET POLICY NE EXE Windows 3.x file download ||
url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm
2000426 || ET POLICY EXE compressed PKWARE Windows file download ||
url,www.program-transformation.org/Transform/PcExeFormat
2000427 || ET POLICY PE EXE Install Windows file download ||
url,www.program-transformation.org/Transform/PcExeFormat
2000428 || ET POLICY ZIP file download ||
url,zziplib.sourceforge.net/zzip-parse.print.html
2000429 || ET POLICY Download Windows Help File CHM 2 ||
url,www.securiteam.com/windowsntfocus/6V00N000AU.html ||
url,www.speakeasy.org/~russotto/chm/chmformat.html
2000489 || ET POLICY Download Windows Help File CHM ||
url,www.securiteam.com/windowsntfocus/6V00N000AU.html ||
url,www.speakeasy.org/~russotto/chm/chmformat.html
2000559 || ET WEB THCIISLame IIS SSL Exploit Attempt ||
url,isc.sans.org/diary.php?date=2004-07-17 ||
url,www.thc.org/exploits/THCIISSLame.c
2000575 || ET SCAN ICMP PING IPTools ||
url,www.ks-soft.net/ip-tools.eng/index.htm || url,www.ks-soft.net/ip-tools.eng
2001066 || ET TROJAN IE Ilookup Trojan || url,62.131.86.111/analysis.htm
2001114 || ET POLICY Mozilla XPI install files download
2001115 || ET POLICY MSI (microsoft installer file) download
2001449 || ET POLICY Proxy Connection detected
2001595 || ET POLICY Skype VOIP Checking Version (Startup) ||
url,www1.cs.columbia.edu/~library/TR-repository/reports/reports-2004/cucs-039-04.pdf
2001596 || ET POLICY Skype VOIP Reporting Install ||
url,www1.cs.columbia.edu/~library/TR-repository/reports/reports-2004/cucs-039-04.pdf
2001609 || ET SCAN F5 BIG-IP 3DNS TCP Probe 1 ||
url,www.f5.com/f5products/v9intro/index.html
2001610 || ET SCAN F5 BIG-IP 3DNS TCP Probe 2 ||
url,www.f5.com/f5products/v9intro/index.html
2001611 || ET SCAN F5 BIG-IP 3DNS TCP Probe 3 ||
url,www.f5.com/f5products/v9intro/index.html
2001682 || ET POLICY MSN IM Poll via HTTP
2001812 || ET P2P KazaaClient P2P Traffic ||
url,www.kazaa.com/us/index.htm
2002376 || ET WEB IBM Lotus Domino BaseTarget XSS attempt ||
bugtraq,14845
2002377 || ET WEB IBM Lotus Domino Src XSS attempt || bugtraq,14846
2002730 || ET WEB PHPGedView Remote Script Code Execution attempt ||
bugtraq,15983
2002861 || ET EXPLOIT Danim.dll and Dxtmsft.dll COM Objects ||
url,www.microsoft.com/technet/security/bulletin/ms06-013.mspx || cve,2006-1186
2002971 || ET EXPLOIT Wmm2fxa.dll COM Object Instantiation Memory
Corruption || url,www.microsoft.com/technet/security/bulletin/ms06-021.mspx ||
bugtraq,18328 || cve,2006-1303
2002973 || ET SCAN Behavioral Unusual Port 3127 traffic, Potential Scan
or Backdoor
2003475 || ET P2P ABC Torrent User-Agent (ABC/ABC-3.1.0) ||
url,pingpong-abc.sourceforge.net
2007639 || ET POLICY FOX,ABC On-demand UA
2402000 || ET DROP Dshield Block Listed Source ||
url,feeds.dshield.org/block.txt
2403000 || ET DROP Dshield Block Listed Source - BLOCKING ||
url,feeds.dshield.org/block.txt
[---] Removed non-rule lines: [---]
-> Removed from bleeding-rbn-BLOCK.rules (2):
# VERSION 27
# Updated 2008-02-01 14:13:15
-> Removed from bleeding-rbn.rules (2):
# VERSION 27
# Updated 2008-02-01 14:13:15
-> Removed from bleeding-sid-msg.map (34):
2000418 || ET Executable and linking format (ELF) file download ||
url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm
2000419 || ET PE EXE or DLL Windows file download
2000420 || ET REG files version 4 download ||
url,www.ss64.com/nt/regedit.html
2000421 || ET REG files version 5 download ||
url,www.ss64.com/nt/regedit.html
2000422 || ET REG files version 5 Unicode download ||
url,www.ss64.com/nt/regedit.html
2000423 || ET NE EXE OS2 file download ||
url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm
2000424 || ET LX EXE OS2 file download ||
url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm
2000425 || ET NE EXE Windows 3.x file download ||
url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm
2000426 || ET EXE compressed PKWARE Windows file download ||
url,www.program-transformation.org/Transform/PcExeFormat
2000427 || ET PE EXE Install Windows file download ||
url,www.program-transformation.org/Transform/PcExeFormat
2000428 || ET ZIP file download ||
url,zziplib.sourceforge.net/zzip-parse.print.html
2000429 || ET Download Windows Help File CHM 2 ||
url,www.securiteam.com/windowsntfocus/6V00N000AU.html ||
url,www.speakeasy.org/~russotto/chm/chmformat.html
2000489 || ET Download Windows Help File CHM ||
url,www.securiteam.com/windowsntfocus/6V00N000AU.html ||
url,www.speakeasy.org/~russotto/chm/chmformat.html
2000559 || ET THCIISLame IIS SSL Exploit Attempt ||
url,isc.sans.org/diary.php?date=2004-07-17 ||
url,www.thc.org/exploits/THCIISSLame.c
2000575 || ET ICMP PING IPTools ||
url,www.ks-soft.net/ip-tools.eng/index.htm || url,www.ks-soft.net/ip-tools.eng
2001066 || ET IE Ilookup Trojan || url,62.131.86.111/analysis.htm
2001114 || ET Policy Mozilla XPI install files download
2001115 || ET MSI (microsoft installer file) download
2001449 || ET Policy Proxy Connection detected
2001595 || ET Policy Skype VOIP Checking Version (Startup) ||
url,www1.cs.columbia.edu/~library/TR-repository/reports/reports-2004/cucs-039-04.pdf
2001596 || ET Policy Skype VOIP Reporting Install ||
url,www1.cs.columbia.edu/~library/TR-repository/reports/reports-2004/cucs-039-04.pdf
2001609 || ET F5 BIG-IP 3DNS TCP Probe 1 ||
url,www.f5.com/f5products/v9intro/index.html
2001610 || ET F5 BIG-IP 3DNS TCP Probe 2 ||
url,www.f5.com/f5products/v9intro/index.html
2001611 || ET F5 BIG-IP 3DNS TCP Probe 3 ||
url,www.f5.com/f5products/v9intro/index.html
2001682 || ET Policy MSN IM Poll via HTTP
2001812 || ET KazaaClient P2P Traffic || url,www.kazaa.com/us/index.htm
2002376 || ET IBM Lotus Domino BaseTarget XSS attempt || bugtraq,14845
2002377 || ET IBM Lotus Domino Src XSS attempt || bugtraq,14846
2002730 || ET PHPGedView Remote Script Code Execution attempt ||
bugtraq,15983
2002861 || ET WEB CLIENT Danim.dll and Dxtmsft.dll COM Objects ||
url,www.microsoft.com/technet/security/bulletin/ms06-013.mspx || cve,2006-1186
2002971 || ET WEB CLIENT Wmm2fxa.dll COM Object Instantiation Memory
Corruption || url,www.microsoft.com/technet/security/bulletin/ms06-021.mspx ||
bugtraq,18328 || cve,2006-1303
2002973 || ET Behavioral Unusual Port 3127 traffic, Potential Scan or
Backdoor
2003475 || ET ABC Torrent User-Agent (ABC/ABC-3.1.0) ||
url,pingpong-abc.sourceforge.net
2007639 || ET Policy FOX,ABC On-demand UA
-> Removed from bleeding-sid-msg.map.txt (34):
2000418 || ET Executable and linking format (ELF) file download ||
url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm
2000419 || ET PE EXE or DLL Windows file download
2000420 || ET REG files version 4 download ||
url,www.ss64.com/nt/regedit.html
2000421 || ET REG files version 5 download ||
url,www.ss64.com/nt/regedit.html
2000422 || ET REG files version 5 Unicode download ||
url,www.ss64.com/nt/regedit.html
2000423 || ET NE EXE OS2 file download ||
url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm
2000424 || ET LX EXE OS2 file download ||
url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm
2000425 || ET NE EXE Windows 3.x file download ||
url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm
2000426 || ET EXE compressed PKWARE Windows file download ||
url,www.program-transformation.org/Transform/PcExeFormat
2000427 || ET PE EXE Install Windows file download ||
url,www.program-transformation.org/Transform/PcExeFormat
2000428 || ET ZIP file download ||
url,zziplib.sourceforge.net/zzip-parse.print.html
2000429 || ET Download Windows Help File CHM 2 ||
url,www.securiteam.com/windowsntfocus/6V00N000AU.html ||
url,www.speakeasy.org/~russotto/chm/chmformat.html
2000489 || ET Download Windows Help File CHM ||
url,www.securiteam.com/windowsntfocus/6V00N000AU.html ||
url,www.speakeasy.org/~russotto/chm/chmformat.html
2000559 || ET THCIISLame IIS SSL Exploit Attempt ||
url,isc.sans.org/diary.php?date=2004-07-17 ||
url,www.thc.org/exploits/THCIISSLame.c
2000575 || ET ICMP PING IPTools ||
url,www.ks-soft.net/ip-tools.eng/index.htm || url,www.ks-soft.net/ip-tools.eng
2001066 || ET IE Ilookup Trojan || url,62.131.86.111/analysis.htm
2001114 || ET Policy Mozilla XPI install files download
2001115 || ET MSI (microsoft installer file) download
2001449 || ET Policy Proxy Connection detected
2001595 || ET Policy Skype VOIP Checking Version (Startup) ||
url,www1.cs.columbia.edu/~library/TR-repository/reports/reports-2004/cucs-039-04.pdf
2001596 || ET Policy Skype VOIP Reporting Install ||
url,www1.cs.columbia.edu/~library/TR-repository/reports/reports-2004/cucs-039-04.pdf
2001609 || ET F5 BIG-IP 3DNS TCP Probe 1 ||
url,www.f5.com/f5products/v9intro/index.html
2001610 || ET F5 BIG-IP 3DNS TCP Probe 2 ||
url,www.f5.com/f5products/v9intro/index.html
2001611 || ET F5 BIG-IP 3DNS TCP Probe 3 ||
url,www.f5.com/f5products/v9intro/index.html
2001682 || ET Policy MSN IM Poll via HTTP
2001812 || ET KazaaClient P2P Traffic || url,www.kazaa.com/us/index.htm
2002376 || ET IBM Lotus Domino BaseTarget XSS attempt || bugtraq,14845
2002377 || ET IBM Lotus Domino Src XSS attempt || bugtraq,14846
2002730 || ET PHPGedView Remote Script Code Execution attempt ||
bugtraq,15983
2002861 || ET WEB CLIENT Danim.dll and Dxtmsft.dll COM Objects ||
url,www.microsoft.com/technet/security/bulletin/ms06-013.mspx || cve,2006-1186
2002971 || ET WEB CLIENT Wmm2fxa.dll COM Object Instantiation Memory
Corruption || url,www.microsoft.com/technet/security/bulletin/ms06-021.mspx ||
bugtraq,18328 || cve,2006-1303
2002973 || ET Behavioral Unusual Port 3127 traffic, Potential Scan or
Backdoor
2003475 || ET ABC Torrent User-Agent (ABC/ABC-3.1.0) ||
url,pingpong-abc.sourceforge.net
2007639 || ET Policy FOX,ABC On-demand UA
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Next by Date: | [Snort-sigs] Emerging Threats Daily Signature Changes, emerging |
|---|---|
| Next by Thread: | [Snort-sigs] Emerging Threats Daily Signature Changes, emerging |
| Indexes: | [Date] [Thread] [Top] [All Lists] |