#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET DELETED Possible Attempt to Create MSSQL SOAP/HTTP Endpoint in URI to Allow for Operating System Interaction"; flow:established,to_server; content:"CREATE"; nocase; http_uri; content:"ENDPOINT"; nocase; http_uri; pcre:"/CREATE.+ENDPOINT/Ui"; reference:url,msdn.microsoft.com/en-us/library/ms345123.aspx; classtype:web-application-attack; sid:2011425; rev:4; metadata:created_at 2010_09_28, updated_at 2010_09_28;)

Added 2017-08-07 21:04:35 UTC


##alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED Possible Attempt to Create MSSQL SOAP/HTTP Endpoint in URI to Allow for Operating System Interaction"; flow:established,to_server; content:"CREATE"; http_uri; nocase; content:"ENDPOINT"; http_uri; nocase; pcre:"/CREATE.+ENDPOINT/Ui"; reference:url,msdn.microsoft.com/en-us/library/ms345123.aspx; classtype:web-application-attack; sid:2011425; rev:3;)

Added 2012-03-12 19:45:41 UTC


##alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED Possible Attempt to Create MSSQL SOAP/HTTP Endpoint in URI to Allow for Operating System Interaction"; flow:established,to_server; content:"CREATE"; http_uri; nocase; content:"ENDPOINT"; http_uri; nocase; pcre:"/CREATE.+ENDPOINT/Ui"; reference:url,msdn.microsoft.com/en-us/library/ms345123.aspx; classtype:web-application-attack; sid:2011425; rev:3;)

Added 2012-03-12 19:44:19 UTC


alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible Attempt to Create MSSQL SOAP/HTTP Endpoint in URI to Allow for Operating System Interaction"; flow:established,to_server; content:"CREATE"; http_uri; nocase; content:"ENDPOINT"; http_uri; nocase; pcre:"/CREATE.+ENDPOINT/Ui"; reference:url,msdn.microsoft.com/en-us/library/ms345123.aspx; classtype:web-application-attack; sid:2011425; rev:3;)

Added 2011-10-12 19:31:59 UTC


alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible Attempt to Create MSSQL SOAP/HTTP Endpoint in URI to Allow for Operating System Interaction"; flow:established,to_server; content:"CREATE"; http_uri; nocase; content:"ENDPOINT"; http_uri; nocase; pcre:"/CREATE.+ENDPOINT/Ui"; classtype:web-application-attack; reference:url,msdn.microsoft.com/en-us/library/ms345123.aspx; reference:url,www.studentacad.com/post/2010/04/07/How-to-create-HTTP-Endpoint-in-SQL-Server-2005.aspx; sid:2011425; rev:2;)

Added 2011-02-04 17:31:14 UTC


alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible Attempt to Create MSSQL SOAP/HTTP Endpoint in URI to Allow for Operating System Interaction"; flow:established,to_server; uricontent:"CREATE"; nocase; uricontent:"ENDPOINT"; nocase; pcre:"/CREATE.+ENDPOINT/Ui"; classtype:web-application-attack; reference:url,msdn.microsoft.com/en-us/library/ms345123.aspx; reference:url,www.studentacad.com/post/2010/04/07/How-to-create-HTTP-Endpoint-in-SQL-Server-2005.aspx; sid:2011425; rev:1;)

Added 2010-09-04 16:53:13 UTC


Topic revision: r1 - 2017-08-08 - TWikiGuest
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats