[***] Results from Oinkmaster started Sat Jul 5 18:00:09 2008 [***]
[+++] Added rules: [+++]
2008358 - ET TROJAN Pakes/Cutwall/Kobcka Checkin Detected High Ports
(emerging-virus.rules)
2008359 - ET TROJAN Unnamed - kuaiche.com related (emerging.rules)
2008360 - ET TROJAN Steam Steal0r (emerging-virus.rules)
2008361 - ET MALWARE Suspicious User-Agent (Accessing) (emerging-malware.rules)
2008362 - ET SCAN bsqlbf Brute Force SQL Injection (emerging-scan.rules)
2008363 - ET MALWARE Suspicious User-Agent (ISMYIE) (emerging-malware.rules)
2008364 - ET TROJAN Donkeyp2p Update Detected (emerging-virus.rules)
2008365 - ET MALWARE Suspicious User-Agent (Playtech Downloader)
(emerging-malware.rules)
2008366 - ET TROJAN LD Pinch Checkin (HTTP POST on port 82)
(emerging-virus.rules)
2008367 - ET MALWARE Possible Windows executable sent when remote host claims
to send Javascript (emerging-malware.rules)
2008368 - ET TROJAN Unknown Keylogger checkin (emerging.rules)
2008369 - ET TROJAN Keylogger Crack by bahman (emerging-virus.rules)
[///] Modified active rules: [///]
2001684 - ET MALWARE Windows executable sent when remote host claims to send
image, Win32 (emerging-malware.rules)
2001685 - ET MALWARE Possible Windows executable sent when remote host claims
to send an image (emerging-malware.rules)
2003636 - ET VIRUS Sality Virus User Agent Detected (KUKU)
(emerging-virus.rules)
2008061 - ET TROJAN LDPinch Checkin (4) (emerging-virus.rules)
2008072 - ET TROJAN LDPinch Checkin (5) (emerging-virus.rules)
2008077 - ET CURRENT_EVENTS Possible Storm Worm EXE Request (fireworks.exe)
(emerging.rules)
2008185 - ET TROJAN Win32 Cloaker Related Post Infection Checkin
(emerging-virus.rules)
2008288 - ET CURRENT_EVENTS Possible Storm Worm URL Request (mylove.exe)
(emerging.rules)
2008319 - ET TROJAN Win32.Small.wpx or Related Downloader Posting Data
(emerging-virus.rules)
2400000 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
2400001 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
2400002 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
2400003 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
2400004 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
2401000 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE
(emerging-drop-BLOCK.rules)
2401001 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE
(emerging-drop-BLOCK.rules)
2401002 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE
(emerging-drop-BLOCK.rules)
2401003 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE
(emerging-drop-BLOCK.rules)
2401004 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE
(emerging-drop-BLOCK.rules)
2402000 - ET DROP Dshield Block Listed Source (emerging-dshield.rules)
2403000 - ET DROP Dshield Block Listed Source - BLOCKING
(emerging-dshield-BLOCK.rules)
2404000 - ET DROP Known Bot C&C Server Traffic (group 1)
(emerging-botcc.rules)
2404001 - ET DROP Known Bot C&C Server Traffic (group 2)
(emerging-botcc.rules)
2404002 - ET DROP Known Bot C&C Server Traffic (group 3)
(emerging-botcc.rules)
2404003 - ET DROP Known Bot C&C Server Traffic (group 4)
(emerging-botcc.rules)
2404004 - ET DROP Known Bot C&C Server Traffic (group 5)
(emerging-botcc.rules)
2404005 - ET DROP Known Bot C&C Server Traffic (group 6)
(emerging-botcc.rules)
2404006 - ET DROP Known Bot C&C Server Traffic (group 7)
(emerging-botcc.rules)
2404007 - ET DROP Known Bot C&C Server Traffic (group 8)
(emerging-botcc.rules)
2404008 - ET DROP Known Bot C&C Server Traffic (group 9)
(emerging-botcc.rules)
2404009 - ET DROP Known Bot C&C Server Traffic (group 10)
(emerging-botcc.rules)
2404010 - ET DROP Known Bot C&C Server Traffic (group 11)
(emerging-botcc.rules)
2404011 - ET DROP Known Bot C&C Server Traffic (group 12)
(emerging-botcc.rules)
2404012 - ET DROP Known Bot C&C Server Traffic (group 13)
(emerging-botcc.rules)
2404013 - ET DROP Known Bot C&C Server Traffic (group 14)
(emerging-botcc.rules)
2404014 - ET DROP Known Bot C&C Server Traffic (group 15)
(emerging-botcc.rules)
2404015 - ET DROP Known Bot C&C Server Traffic (group 16)
(emerging-botcc.rules)
2404016 - ET DROP Known Bot C&C Server Traffic (group 17)
(emerging-botcc.rules)
2404017 - ET DROP Known Bot C&C Server Traffic (group 18)
(emerging-botcc.rules)
2404018 - ET DROP Known Bot C&C Server Traffic (group 19)
(emerging-botcc.rules)
2404019 - ET DROP Known Bot C&C Server Traffic (group 20)
(emerging-botcc.rules)
2404020 - ET DROP Known Bot C&C Server Traffic (group 21)
(emerging-botcc.rules)
2405000 - ET DROP Known Bot C&C Traffic (group 1) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405001 - ET DROP Known Bot C&C Traffic (group 2) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405002 - ET DROP Known Bot C&C Traffic (group 3) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405003 - ET DROP Known Bot C&C Traffic (group 4) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405004 - ET DROP Known Bot C&C Traffic (group 5) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405005 - ET DROP Known Bot C&C Traffic (group 6) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405006 - ET DROP Known Bot C&C Traffic (group 7) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405007 - ET DROP Known Bot C&C Traffic (group 8) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405008 - ET DROP Known Bot C&C Traffic (group 9) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405009 - ET DROP Known Bot C&C Traffic (group 10) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405010 - ET DROP Known Bot C&C Traffic (group 11) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405011 - ET DROP Known Bot C&C Traffic (group 12) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405012 - ET DROP Known Bot C&C Traffic (group 13) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405013 - ET DROP Known Bot C&C Traffic (group 14) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405014 - ET DROP Known Bot C&C Traffic (group 15) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405015 - ET DROP Known Bot C&C Traffic (group 16) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405016 - ET DROP Known Bot C&C Traffic (group 17) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405017 - ET DROP Known Bot C&C Traffic (group 18) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405018 - ET DROP Known Bot C&C Traffic (group 19) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405019 - ET DROP Known Bot C&C Traffic (group 20) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2405020 - ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE
(emerging-botcc-BLOCK.rules)
2406005 - ET RBN Known Russian Business Network Monitored Domains (1)
(emerging-rbn.rules)
2406006 - ET RBN Known Russian Business Network Monitored Domains (2)
(emerging-rbn.rules)
2406007 - ET RBN Known Russian Business Network Monitored Domains (3)
(emerging-rbn.rules)
2406008 - ET RBN Known Russian Business Network Monitored Domains (4)
(emerging-rbn.rules)
2406009 - ET RBN Known Russian Business Network Monitored Domains (5)
(emerging-rbn.rules)
2406010 - ET RBN Known Russian Business Network Monitored Domains (6)
(emerging-rbn.rules)
2406011 - ET RBN Known Russian Business Network Monitored Domains (7)
(emerging-rbn.rules)
2406012 - ET RBN Known Russian Business Network Monitored Domains (8)
(emerging-rbn.rules)
2406013 - ET RBN Known Russian Business Network Monitored Domains (9)
(emerging-rbn.rules)
2406014 - ET RBN Known Russian Business Network Monitored Domains (10)
(emerging-rbn.rules)
2406015 - ET RBN Known Russian Business Network Monitored Domains (11)
(emerging-rbn.rules)
2406016 - ET RBN Known Russian Business Network Monitored Domains (12)
(emerging-rbn.rules)
2406017 - ET RBN Known Russian Business Network Monitored Domains (13)
(emerging-rbn.rules)
2406018 - ET RBN Known Russian Business Network Monitored Domains (14)
(emerging-rbn.rules)
2406019 - ET RBN Known Russian Business Network Monitored Domains (15)
(emerging-rbn.rules)
2406020 - ET RBN Known Russian Business Network Monitored Domains (16)
(emerging-rbn.rules)
2406021 - ET RBN Known Russian Business Network Monitored Domains (17)
(emerging-rbn.rules)
2406022 - ET RBN Known Russian Business Network Monitored Domains (18)
(emerging-rbn.rules)
2406023 - ET RBN Known Russian Business Network Monitored Domains (19)
(emerging-rbn.rules)
2406024 - ET RBN Known Russian Business Network Monitored Domains (20)
(emerging-rbn.rules)
2406025 - ET RBN Known Russian Business Network Monitored Domains (21)
(emerging-rbn.rules)
2406026 - ET RBN Known Russian Business Network Monitored Domains (22)
(emerging-rbn.rules)
2406027 - ET RBN Known Russian Business Network Monitored Domains (23)
(emerging-rbn.rules)
2406028 - ET RBN Known Russian Business Network Monitored Domains (24)
(emerging-rbn.rules)
2406029 - ET RBN Known Russian Business Network Monitored Domains (25)
(emerging-rbn.rules)
2406030 - ET RBN Known Russian Business Network Monitored Domains (26)
(emerging-rbn.rules)
2406031 - ET RBN Known Russian Business Network Monitored Domains (27)
(emerging-rbn.rules)
2406032 - ET RBN Known Russian Business Network Monitored Domains (28)
(emerging-rbn.rules)
2406033 - ET RBN Known Russian Business Network Monitored Domains (29)
(emerging-rbn.rules)
2406034 - ET RBN Known Russian Business Network Monitored Domains (30)
(emerging-rbn.rules)
2406035 - ET RBN Known Russian Business Network Monitored Domains (31)
(emerging-rbn.rules)
2406036 - ET RBN Known Russian Business Network Monitored Domains (32)
(emerging-rbn.rules)
2406037 - ET RBN Known Russian Business Network Monitored Domains (33)
(emerging-rbn.rules)
2406038 - ET RBN Known Russian Business Network Monitored Domains (34)
(emerging-rbn.rules)
2407005 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(1) (emerging-rbn-BLOCK.rules)
2407006 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(2) (emerging-rbn-BLOCK.rules)
2407007 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(3) (emerging-rbn-BLOCK.rules)
2407008 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(4) (emerging-rbn-BLOCK.rules)
2407009 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(5) (emerging-rbn-BLOCK.rules)
2407010 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(6) (emerging-rbn-BLOCK.rules)
2407011 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(7) (emerging-rbn-BLOCK.rules)
2407012 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(8) (emerging-rbn-BLOCK.rules)
2407013 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(9) (emerging-rbn-BLOCK.rules)
2407014 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(10) (emerging-rbn-BLOCK.rules)
2407015 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(11) (emerging-rbn-BLOCK.rules)
2407016 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(12) (emerging-rbn-BLOCK.rules)
2407017 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(13) (emerging-rbn-BLOCK.rules)
2407018 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(14) (emerging-rbn-BLOCK.rules)
2407019 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(15) (emerging-rbn-BLOCK.rules)
2407020 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(16) (emerging-rbn-BLOCK.rules)
2407021 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(17) (emerging-rbn-BLOCK.rules)
2407022 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(18) (emerging-rbn-BLOCK.rules)
2407023 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(19) (emerging-rbn-BLOCK.rules)
2407024 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(20) (emerging-rbn-BLOCK.rules)
2407025 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(21) (emerging-rbn-BLOCK.rules)
2407026 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(22) (emerging-rbn-BLOCK.rules)
2407027 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(23) (emerging-rbn-BLOCK.rules)
2407028 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(24) (emerging-rbn-BLOCK.rules)
2407029 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(25) (emerging-rbn-BLOCK.rules)
2407030 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(26) (emerging-rbn-BLOCK.rules)
2407031 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(27) (emerging-rbn-BLOCK.rules)
2407032 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(28) (emerging-rbn-BLOCK.rules)
2407033 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(29) (emerging-rbn-BLOCK.rules)
2407034 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(30) (emerging-rbn-BLOCK.rules)
2407035 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(31) (emerging-rbn-BLOCK.rules)
2407036 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(32) (emerging-rbn-BLOCK.rules)
2407037 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(33) (emerging-rbn-BLOCK.rules)
2407038 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING
(34) (emerging-rbn-BLOCK.rules)
[///] Modified inactive rules: [///]
2000560 - ET POLICY HTTP CONNECT Tunnel Attempt Inbound (emerging-policy.rules)
2008330 - ET POLICY HTTP CONNECT Tunnel Attempt Outbound
(emerging-policy.rules)
[---] Removed rules: [---]
2406003 - ET RBN Known Russian Business Network Traffic - Known Trojan C&Cs
(emerging-rbn.rules)
2407003 - ET RBN Known Russian Business Network Traffic - Known Trojan C&Cs -
BLOCKING (emerging-rbn-BLOCK.rules)
[+++] Added non-rule lines: [+++]
-> Added to emerging-drop-BLOCK.rules (3):
# $Id: emerging-drop.rules $
# VERSION 1218
# Generated 2008-07-04 00:03:02 EDT
-> Added to emerging-drop.rules (3):
# $Id: emerging-drop.rules $
# VERSION 1218
# Generated 2008-07-04 00:03:02 EDT
-> Added to emerging-dshield-BLOCK.rules (1):
# $Id: emerging-dshield.rules $
-> Added to emerging-dshield.rules (1):
# $Id: emerging-dshield.rules $
-> Added to emerging-malware.rules (1):
#re f39d0a669ad98b95370a4f525d7d79ec, by Marcus at unsober
-> Added to emerging-rbn-BLOCK.rules (2):
# VERSION 57
# Updated 2008-07-01 12:14:45
-> Added to emerging-rbn.rules (2):
# VERSION 57
# Updated 2008-07-01 12:14:45
-> Added to emerging-scan.rules (1):
#by Michael Sconzo of ERCOT
-> Added to emerging-sid-msg.map (18):
2000560 || ET POLICY HTTP CONNECT Tunnel Attempt Inbound
2003636 || ET VIRUS Sality Virus User Agent Detected (KUKU)
2008077 || ET CURRENT_EVENTS Possible Storm Worm EXE Request
(fireworks.exe) || url,www.sudosecure.net/archives/119
2008288 || ET CURRENT_EVENTS Possible Storm Worm URL Request
(mylove.exe)
2008319 || ET TROJAN Win32.Small.wpx or Related Downloader Posting Data
2008330 || ET POLICY HTTP CONNECT Tunnel Attempt Outbound
2008358 || ET TROJAN Pakes/Cutwall/Kobcka Checkin Detected High Ports
2008359 || ET TROJAN Unnamed - kuaiche.com related
2008360 || ET TROJAN Steam Steal0r
2008361 || ET MALWARE Suspicious User-Agent (Accessing)
2008362 || ET SCAN bsqlbf Brute Force SQL Injection ||
url,code.google.com/p/bsqlbf-v2/
2008363 || ET MALWARE Suspicious User-Agent (ISMYIE)
2008364 || ET TROJAN Donkeyp2p Update Detected
2008365 || ET MALWARE Suspicious User-Agent (Playtech Downloader)
2008366 || ET TROJAN LD Pinch Checkin (HTTP POST on port 82)
2008367 || ET MALWARE Possible Windows executable sent when remote host
claims to send Javascript
2008368 || ET TROJAN Unknown Keylogger checkin
2008369 || ET TROJAN Keylogger Crack by bahman
-> Added to emerging-sid-msg.map.txt (18):
2000560 || ET POLICY HTTP CONNECT Tunnel Attempt Inbound
2003636 || ET VIRUS Sality Virus User Agent Detected (KUKU)
2008077 || ET CURRENT_EVENTS Possible Storm Worm EXE Request
(fireworks.exe) || url,www.sudosecure.net/archives/119
2008288 || ET CURRENT_EVENTS Possible Storm Worm URL Request
(mylove.exe)
2008319 || ET TROJAN Win32.Small.wpx or Related Downloader Posting Data
2008330 || ET POLICY HTTP CONNECT Tunnel Attempt Outbound
2008358 || ET TROJAN Pakes/Cutwall/Kobcka Checkin Detected High Ports
2008359 || ET TROJAN Unnamed - kuaiche.com related
2008360 || ET TROJAN Steam Steal0r
2008361 || ET MALWARE Suspicious User-Agent (Accessing)
2008362 || ET SCAN bsqlbf Brute Force SQL Injection ||
url,code.google.com/p/bsqlbf-v2/
2008363 || ET MALWARE Suspicious User-Agent (ISMYIE)
2008364 || ET TROJAN Donkeyp2p Update Detected
2008365 || ET MALWARE Suspicious User-Agent (Playtech Downloader)
2008366 || ET TROJAN LD Pinch Checkin (HTTP POST on port 82)
2008367 || ET MALWARE Possible Windows executable sent when remote host
claims to send Javascript
2008368 || ET TROJAN Unknown Keylogger checkin
2008369 || ET TROJAN Keylogger Crack by bahman
-> Added to emerging-virus.rules (3):
#by marcus at unsober
#by Pedro Marinho, re d2d5bf2669edce3c71dc16c46e8a67f7
#ref: b957da5c0bc6f21341795a6ead9eddd9
-> Added to emerging.conf (2):
# include $RULE_PATH/emerging.conf
# the emerging-sigs mailing list
-> Added to emerging.rules (2):
#by Pedro Marinho, re 58816f781154bda381fdcb1e3fab7bdd
#different trojan, by marcus at unsober
[---] Removed non-rule lines: [---]
-> Removed from emerging-dos.rules (1):
# Only basic testing has been done. At this point all we guarantee is
that they won't crash a recent snort release.
-> Removed from emerging-drop-BLOCK.rules (3):
# $Id: bleeding-drop.rules $
# VERSION 1211
# Generated 2008-06-28 00:03:02 EDT
-> Removed from emerging-drop.rules (3):
# $Id: bleeding-drop.rules $
# VERSION 1211
# Generated 2008-06-28 00:03:02 EDT
-> Removed from emerging-dshield-BLOCK.rules (1):
# $Id: bleeding-dshield.rules $
-> Removed from emerging-dshield.rules (1):
# $Id: bleeding-dshield.rules $
-> Removed from emerging-exploit.rules (1):
# Only basic testing has been done. At this point all we guarantee is
that they won't crash a recent snort release.
-> Removed from emerging-game.rules (1):
# Only basic testing has been done. At this point all we guarantee is
that they won't crash a recent snort release.
-> Removed from emerging-inappropriate.rules (1):
# Only basic testing has been done. At this point all we guarantee is
that they won't crash a recent snort release.
-> Removed from emerging-malware.rules (1):
# Only basic testing has been done. At this point all we guarantee is
that they won't crash a recent snort release.
-> Removed from emerging-p2p.rules (1):
# Only basic testing has been done. At this point all we guarantee is
that they won't crash a recent snort release.
-> Removed from emerging-policy.rules (1):
# Only basic testing has been done. At this point all we guarantee is
that they won't crash a recent snort release.
-> Removed from emerging-rbn-BLOCK.rules (3):
#Anserin/Torpig/Sinowal hosts
# VERSION 56
# Updated 2008-06-25 23:53:20
-> Removed from emerging-rbn.rules (3):
#Anserin/Torpig/Sinowal hosts
# VERSION 56
# Updated 2008-06-25 23:53:20
-> Removed from emerging-scan.rules (1):
# Only basic testing has been done. At this point all we guarantee is
that they won't crash a recent snort release.
-> Removed from emerging-sid-msg.map (8):
2000560 || ET HTTP CONNECT Tunnel Attempt Inbound
2003636 || ET VIRUS Sality Virus User Agent Detected (KUKU v3.09)
2008077 || ET CURRENT_EVENTS Possible Storm Worm EXE Request
(beijing.exe) || url,www.sudosecure.net/archives/119
2008288 || ET CURRENT_EVENTS Possible Storm Worm URL Request (video.exe)
2008319 || TROJAN Win32.Small.wpx or Related Downloader Posting Data
2008330 || ET HTTP CONNECT Tunnel Attempt Outbound
2406003 || ET RBN Known Russian Business Network Traffic - Known Trojan
C&Cs || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
2407003 || ET RBN Known Russian Business Network Traffic - Known Trojan
C&Cs - BLOCKING ||
url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
-> Removed from emerging-sid-msg.map.txt (8):
2000560 || ET HTTP CONNECT Tunnel Attempt Inbound
2003636 || ET VIRUS Sality Virus User Agent Detected (KUKU v3.09)
2008077 || ET CURRENT_EVENTS Possible Storm Worm EXE Request
(beijing.exe) || url,www.sudosecure.net/archives/119
2008288 || ET CURRENT_EVENTS Possible Storm Worm URL Request (video.exe)
2008319 || TROJAN Win32.Small.wpx or Related Downloader Posting Data
2008330 || ET HTTP CONNECT Tunnel Attempt Outbound
2406003 || ET RBN Known Russian Business Network Traffic - Known Trojan
C&Cs || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
2407003 || ET RBN Known Russian Business Network Traffic - Known Trojan
C&Cs - BLOCKING ||
url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
-> Removed from emerging-virus.rules (1):
# Only basic testing has been done. At this point all we guarantee is
that they won't crash a recent snort release.
-> Removed from emerging-voip.rules (1):
# Only basic testing has been done. At this point all we guarantee is
that they won't crash a recent snort release.
-> Removed from emerging-web.rules (1):
# Only basic testing has been done. At this point all we guarantee is
that they won't crash a recent snort release.
-> Removed from emerging-web_sql_injection.rules (1):
# Only basic testing has been done. At this point all we guarantee is
that they won't crash a recent snort release.
-> Removed from emerging.conf (2):
# include $RULE_PATH/bleeding.conf
# the bleeding-sigs mailing list
-> Removed from emerging.rules (1):
#Jack Pepper
-------------------------------------------------------------------------
Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
Studies have shown that voting for your favorite open source project,
along with a healthy diet, reduces your potential for chronic lameness
and boredom. Vote Now at http://www.sourceforge.net/community/cca08
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
