alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"Windows 98"; http_user_agent; content:!"X-Trend-ActiveUpdate"; http_header; content:!"HTTrack"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; classtype:policy-violation; sid:2007695; rev:21;)

Added 2016-10-18 11:42:26 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"Windows 98"; http_user_agent; content:!"X-Trend-ActiveUpdate"; http_header; content:!"HTTrack"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; classtype:policy-violation; sid:2007695; rev:21;)

Added 2016-10-18 11:39:20 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"Windows 98"; http_user_agent; content:!"X-Trend-ActiveUpdate"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; classtype:policy-violation; sid:2007695; rev:20;)

Added 2016-05-23 19:52:22 UTC

This sig will trigger on Dell machines reaching out to Akamai Technologies IPs as they use the Win98 UA for those requests.

-- AmandaDeason - 2016-07-20


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"Windows 98"; http_user_agent; content:!"X-Trend-ActiveUpdate"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; classtype:policy-violation; sid:2007695; rev:20;)

Added 2016-05-23 17:42:38 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"Windows 98"; http_user_agent; content:!"X-Trend-ActiveUpdate"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; classtype:policy-violation; sid:2007695; rev:20;)

Added 2016-05-23 17:41:12 UTC


alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"Windows 98"; http_user_agent; content:!"X-Trend-ActiveUpdate"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; classtype:policy-violation; sid:2007695; rev:20;)

Added 2016-05-23 17:33:10 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"Windows 98"; fast_pattern:only; http_header; pcre:"/^User-Agent\x3a[^\n]+Windows 98/Hmi"; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; classtype:policy-violation; sid:2007695; rev:19;)

Added 2013-12-04 20:35:25 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"Windows 98"; fast_pattern:only; http_header; pcre:"/^User-Agent\x3a[^\n]+Windows 98/Hmi"; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; classtype:policy-violation; sid:2007695; rev:17;)

Added 2012-07-17 20:03:32 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"User-Agent|3a| "; http_header; content:"Windows 98"; fast_pattern; http_header; pcre:"/User-Agent\x3a[^\n]+Windows 98/Hi"; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; classtype:policy-violation; sid:2007695; rev:16;)

Added 2011-10-12 19:23:41 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"User-Agent|3a| "; http_header; content:"Windows 98"; fast_pattern; http_header; pcre:"/User-Agent\x3a[^\n]+Windows 98/Hi"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:16;)

Added 2011-09-14 22:37:12 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"User-Agent|3a| "; http_header; content:"Windows 98"; fast_pattern; http_header; pcre:"/User-Agent\x3a[^\n]+Windows 98/Hi"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/POLICY/POLICY_Windows_98; sid:2007695; rev:16;)

Added 2011-05-25 19:28:47 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"User-Agent|3a| "; http_header; content:"Windows 98"; fast_pattern; http_header; pcre:"/User-Agent\x3a[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/POLICY/POLICY_Windows_98; sid:2007695; rev:15;)

Added 2011-02-04 17:26:49 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98"; within:200; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/POLICY/POLICY_Windows_98; sid:2007695; rev:10;)

Added 2009-02-11 19:24:43 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98"; within:200; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/POLICY/POLICY_Windows_98; sid:2007695; rev:10;)

Added 2009-02-11 19:24:43 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98"; within:200; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:9;)

Added 2008-07-11 19:00:22 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98"; within:200; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:9;)

Added 2008-07-11 19:00:22 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98"; within:200; content:!"GtekClient"; within:50; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:8;)

Added 2008-03-21 12:52:14 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98"; within:200; content:!"GtekClient"; within:50; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:8;)

Added 2008-03-21 12:52:14 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98"; within:200; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:7;)

Added 2008-03-04 19:25:59 UTC

The trailing semicolon after 98 was causing false negatives. Removed...

-- MattJonkman - 05 Mar 2008


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98"; within:200; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:7;)

Added 2008-03-04 19:25:59 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:200; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:6;)

Added 2008-02-28 19:02:43 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:200; pcre:"/User-Agent\:[^\n]+Windows 98/i"; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:6;)

Added 2008-02-28 19:02:43 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:100; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:4;)

Added 2008-02-09 22:28:23 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:100; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:4;)

Added 2008-02-09 22:28:23 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:3;)

Added 2008-01-31 18:48:10 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:3;)

Added 2008-01-31 18:48:10 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:2;)

Added 2008-01-09 17:42:41 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:2;)

Added 2008-01-09 17:42:41 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:2;)

Added 2008-01-09 15:15:19 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:2;)

Added 2008-01-09 15:15:19 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:2;)

Added 2008-01-08 20:25:20 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url,doc.emergingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:2;)

Added 2008-01-08 20:25:20 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url.doc.bleedingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:1;)

Added 2007-11-13 02:32:17 UTC


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"BLEEDING-EDGE POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System"; flow:established,to_server; content:"|0d 0a|User-Agent\: "; content:"Windows 98\;"; within:50; threshold:type limit, count 1, seconds 60, track by_src; classtype:policy-violation; reference:url.doc.bleedingthreats.net/bin/view/Main/Windows98UA; sid:2007695; rev:1;)

Added 2007-11-13 02:29:18 UTC


Topic revision: r3 - 2016-07-20 - AmandaDeason
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats