Main WebEmerging Threats Rule Documentation Wiki
This wiki contains all current rules, added as each is put into the main tarball and cvs repository. The rule author if available is primarily responsible for the documentation of a rule, however the entire community is encouraged and welcomed to contribute or document any rule. You may attach pcaps, packet text, and even code samples to any entry relevant. This is particularly useful for future troubleshooting. Please document if possible where the sample was captured. If you have a sample that's not suitable for posting publicly please contact emerging@emergingthreats.net and it can be archived privately, available to any vetted researcher. AllRulesets | RulesFAQ | AllProjectsOpenInfosec
Feature development discussions around the Open Information Security Foundation's new projects! ( http://www.openinfosecfoundation.org )SidReporter
Try out SidReporter, the newest project at Emerging Threats!! Help improve the accuracy and reliability of the Emerging Threats Rulesets anonymously!What Every Snort Install Should Do
Tips on what to add to your local ruleset that's not in the main rulesets: WhatEverySnortUserShouldDoLast 10 Signature Documentation Changes
Results from Main web retrieved at 07:05 (GMT)
alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Downloader Possible AV KILLER HTTP GET"; flow:established,to server; content:"GET "; depth:4 ...
alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious Downloader User Agent (Windows NT 5.1)"; flow:established,to server; content:" 0D ...
alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB Cpanel lastvisit.html Arbitary file disclosure"; flow:to server,established; content:"GET "; depth ...
alert tcp $HTTP SERVERS $HTTP PORTS $EXTERNAL NET any (msg:"ET ATTACK RESPONSE /etc/shadow Detected in URI"; flow:to server,established; uricontent:"/etc/shadow ...
alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET SCAN Asp Audit Web Scan Detected"; flow:to server,established; content:"GET /?"; depth:80; classtype ...
alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET SCAN Possible jBroFuzz Fuzzer Detected"; flow:to server,established; content:" 0d 0a Host\: localhost ...
alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET SCAN SQLix SQL Injection Vector Scan"; flow:established,to server; content:"GET "; depth:4; content ...
alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET SCAN WSFuzzer Web Application Fuzzing"; flow:to server,established; content:"/ServiceDefinition HTTP ...
alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Generic Info Stealer HTTP POST"; flow:established,to server; content:"POST "; depth:5; content ...
alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET POLICY TeamViewer Dyngate User Agent"; flow:established,to server; content:" 0d 0a User Agent\: Mozilla ...
Number of topics: 10
All additions will be reviewed by the documentation team at Emerging Threats, a volunteer group. Please report any inaccuracies or wikispam to emerging@emergingthreats.net.
To post please register. -- Registration
Follow documentation updates via WebRss or WebAtom
Conventions
All rules are available by accessing the following URL format:Main Utilities
Main Web
Create New Topic
Index
Search
Changes
Preferences- User Reference
- ATasteOfTWiki
- TextFormattingRules
- Signature Reference
- WebRss Feed
- EmergingFAQ
 |
|
Copyright © by the contributing authors. All material on this collaboration platform is the property of the contributing authors. Ideas, requests, problems regarding TWiki? Send feedback