RuleChanges < Main

alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET WEB SPECIFIC APPS Possible APC Network Management Card Cross Site Scripting Attempt"; flow:established ...

2010903

alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB SPECIFIC APPS phpMyAdmin Remote Code Execution Proof of Concept (c )"; flow:established,to server ...

2010902

alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB SPECIFIC APPS phpMyAdmin Remote Code Execution Proof of Concept (p )"; flow:established,to server ...

2010463

alert tcp $HOME NET 1024: $EXTERNAL NET $HTTP PORTS (msg:"ET CURRENT EVENTS RFI Scanner Success (Fx29ID)"; flow:established,from server; content:"FeeLCoMzFeeLCoMz ...

2010884

#alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET POLICY .pdf File Possibly Containing Basic Hex Obfuscation"; flow:established,from server; content: ...

2010931

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET CURRENT EVENTS Possible Microsoft Internet Explorer iepeers.dll Remote Code Execution Attempt (CVE 2010 ...

2010863

NEW - 11 Mar 2010 - 19:00

alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET WEB SERVER LANDesk Command Injection Attempt"; content:"POST "; flow:established,to server; depth ...

EricLien

TWikiRegistrationAgent

NEW - 11 Mar 2010 - 13:34

My Links .ATasteOfTWiki view a short introductory presentation on TWiki for beginners .WelcomeGuest starting points on TWiki .TWikiUsersGuide ...

2010917

NEW - 10 Mar 2010 - 20:15

alert tcp $EXTERNAL NET any $HOME NET 7777 (msg:"ET TROJAN Arucer DEL FILE Command"; flow:established; content:" C2 E5 E5 E5 9E D1 A3 D1 A3 D5 A1 DD DD C8 A0 D2 ...

2010926

alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET WEB SPECIFIC APPS Joomla com perchagallery Component id Parameter UNION SELECT SQL Injection Attempt ...

2010921

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET WEB SPECIFIC APPS Ask.com Toolbar askBar.dll ActiveX ShortFormat Buffer Overflow Attempt"; flow:established ...

2010924

alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET WEB SPECIFIC APPS Joomla com perchagallery Component id Parameter SELECT FROM SQL Injection Attempt ...

2001810

alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET WEB SERVER PHP remote file include exploit attempt"; flow: to server,established; content:"GET " ...

2010930

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any ( msg:"ET WEB CLIENT Foxit Reader ActiveX OpenFile method Remote Code Execution Function Call"; flow:to client ...

2010928

alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET WEB SPECIFIC APPS Joomla com perchagallery Component id Parameter UPDATE SET SQL Injection Attempt ...

2010925

alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET WEB SPECIFIC APPS Joomla com perchagallery Component id Parameter DELETE FROM SQL Injection Attempt ...

2002133

alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET WEB SERVER Oracle Reports OS Command Injection Attempt"; flow:established,to server; content:"GET ...

2001621

alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET WEB SERVER Exploit Suspected PHP Injection Attack (name )"; flow:to server,established; content: ...

2010923

alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET WEB SPECIFIC APPS SaurusCMS class.writeexcel worksheet.inc.php class path Remote File Inclusion Attempt ...

2010922

alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET WEB SPECIFIC APPS SaurusCMS class.writeexcel workbook.inc.php class path Remote File Inclusion Attempt ...

2010920

alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET WEB SERVER Exploit Suspected PHP Injection Attack (cmd )"; flow:to server,established; content:"GET ...

2010929

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET WEB CLIENT Foxit Reader ActiveX control OpenFile method Heap Overflow Attempt"; flow:established,to client ...

2010927

alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET WEB SPECIFIC APPS Joomla com perchagallery Component id Parameter INSERT INTO SQL Injection Attempt ...

2010912

alert tcp $EXTERNAL NET any $HOME NET 7777 (msg:"ET TROJAN Arucer READ FILE Command"; flow:established; content:" C2 E5 E5 E5 9E A3 D3 A6 D1 D6 A0 D4 A4 C8 D4 D0 ...

2010918

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Paymilon A HTTP POST"; flow:established,to server; content:"POST http\://"; depth:12; content ...

2010916

alert tcp $EXTERNAL NET any $HOME NET 7777 (msg:"ET TROJAN Arucer ADD RUN ONCE Command"; flow:established; content:" C2 E5 E5 E5 9E D6 DD D1 A0 A7 A0 D7 A6 C8 A3 ...

2010453

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Potential Fake AV GET installer 1.exe"; flow:established,to server; content:"GET "; depth:4 ...

2009701

alert udp any any any 53 (msg:"ET CURRENT EVENTS DNS BIND 9 Dynamic Update DoS attempt"; byte test:1, ,40,2; byte test:1, ,0,5; byte test:1, ,0,1; content:" 00 ...

2010913

alert tcp $EXTERNAL NET any $HOME NET 7777 (msg:"ET TROJAN Arucer NOP Command"; flow:established; content:" C2 E5 E5 E5 9E D2 DD D6 A0 A4 A6 A7 A3 C8 A0 A3 DD A7 ...

2010909

alert tcp $EXTERNAL NET any $HOME NET 7777 (msg:"ET TROJAN Arucer Command Execution"; flow:established; content:" C2 E5 E5 E5 9E DD A4 A3 D4 A6 D4 D3 D1 C8 A0 A7 ...

2010910

alert tcp $EXTERNAL NET any $HOME NET 7777 (msg:"ET TROJAN Arucer DIR Listing"; flow:established; content:" C2 E5 E5 E5 9E D5 D4 D2 D1 A1 D7 A3 A6 C8 D2 A6 A7 D3 ...

2010911

alert tcp $EXTERNAL NET any $HOME NET 7777 (msg:"ET TROJAN Arucer WRITE FILE command"; flow: established; content:" C2 E5 E5 E5 9E DC DD A1 DC D0 DD A3 A6 C8 A1 ...

2010452

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Potential Fake AV GET installer.1.exe"; flow:established,to server; content:"GET "; depth:4 ...

2010915

alert tcp $EXTERNAL NET any $HOME NET 7777 (msg:"ET TROJAN Arucer YES Command"; flow:established; content:" C2 E5 E5 E5 9E A0 D7 A4 A6 D0 D5 DD DC C8 D6 DD D7 D5 ...

2010919

alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB SERVER HP LaserJet Printer Cross Site Scripting Attempt"; flow:established,to server; uricontent ...

2010914

alert tcp $EXTERNAL NET any $HOME NET 7777 (msg:"ET TROJAN Arucer FIND FILE Command"; flow:established; content:" C2 E5 E5 E5 9E A0 A4 D2 A4 D7 A0 A7 D2 C8 D4 A0 ...

2010505

NEW - 10 Mar 2010 - 17:30

alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB SPECIFIC APPS Cisco Adaptive Security Appliance WebVPN Cross Site Scripting Attempt"; flow:established ...

AndrewSmith

TWikiRegistrationAgent

NEW - 10 Mar 2010 - 06:52

My Links .ATasteOfTWiki view a short introductory presentation on TWiki for beginners .WelcomeGuest starting points on TWiki .TWikiUsersGuide ...

2003313

AllanKlein

r2 - 09 Mar 2010 - 18:46

alert udp $EXTERNAL NET 1024:65535 $HOME NET 1024:65535 (msg:"ET P2P Edonkey Connect Reply and Server List"; dsize: 200; content:" e3 0b "; depth:2; classtype:policy ...

2010899

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB SPECIFIC APPS phpBB3 multiple login attempts"; flow:to server,established; content:"POST "; depth ...

2003641

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Downloader.Small 5ser Agent Detected (NetScafe)"; flow:established,to server; content:" 0d 0a ...

2006387

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Downloader User Agent Detected (Windows Updates Manager 3.12 ...)"; flow:established,to server ...

2010897

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB SPECIFIC APPS phpBB3 Brute Force reg attempt (Bad flow 2)"; flowbits:isset,ET.phpBB3 test; flowbits ...

2010890

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB SPECIFIC APPS phpBB3 registration (Step1 GET)"; flow:to server,established; content:"GET "; depth ...

2010906

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET USER AGENTS badly formatted User Agent string (no closing parenthesis)"; flow:established,to server; ...

2010896

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB SPECIFIC APPS phpBB3 Brute Force reg attempt (Bad flow 2)"; flowbits:isnotset,ET.phpBB3 register ...

2010895

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB SPECIFIC APPS phpBB3 Brute Force reg attempt (Bad pf XXXXX)"; flowbits:isset,ET.phpBB3 test; flow ...

2007778

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN User agent DownloadNetFile Win32.small.hsh downloader"; flow:established,to server; content:"GET ...

2001850

#alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Likely Trojan/Spyware Installer Requested (1)"; flow: established,to server; uricontent:".scr ...

2010900

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB SPECIFIC APPS phpBB3 possible spammer posting attempts"; flow:to server,established; content:"POST ...

2003648

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Clicker.BC User Agent Detected (linkrunner)"; flow:established,to server; content:" 0d 0a User ...

2002093

#alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Likely Trojan/Spyware Installer Requested (2)"; flow: established,to server; uricontent:".exe ...

2010893

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB SPECIFIC APPS phpBB3 registration (Step4 POST)"; flow:to server,established; content:"POST "; depth ...

2010892

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB SPECIFIC APPS phpBB3 registration (Step3 GET)"; flow:to server,established; content:"GET "; depth ...

2010891

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB SPECIFIC APPS phpBB3 registration (Step2 POST)"; flow:to server,established; content:"POST "; depth ...

2010905

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET USER AGENTS Fake Mozilla UA on Forum Registration Spambot Outbound"; flow:established,to server; content ...

2003647

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN MFV User Agent Detected (IRC U)"; flow:established,to server; content:" 0d 0a User Agent\: IRC ...

2010898

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB SPECIFIC APPS phpBB3 registration (Bogus Stage3 GET)"; flow:to server,established; content:"GET ...

2010901

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET CURRENT EVENTS Potential FakeAV download ASetup 2009.exe variant"; flow:established,to server; content ...

2010889

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Win32.Tdss User Agent Detected (Mozzila)"; flow:established,to server; content:" 0d 0a User Agent ...

2003171

alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET SCAN IBM NSA User Agent"; flow:established,to server; content:" 0d 0a User Agent\: "; nocase; content ...

2010904

alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET USER AGENTS Fake Mozilla UA on Forum Registration Spambot Inbound"; flow:established,to server; content ...

2010908

alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET USER AGENTS Suspicious Mozilla User Agent Inbound Likely Fake (Mozilla/5.0)"; flow:to server,established ...

2007633

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Suspicious User Agent Matcash related Trojan Downloader (Ismazo Advanced Loader)"; flow:established ...

2010894

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB SPECIFIC APPS phpBB3 Brute Force reg attempt (Bad pf XXXXX)"; flowbits:isset,ET.phpBB3 test; flow ...

2010885

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN BlackEnergy v2.x HTTP Request with Encrypted Variables"; flow:to server,established; content: ...

2010888

alert tcp $HOME NET 1024: $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Generic Downloader checkin (3)"; flow:established,to server; uricontent:".php?"; uricontent ...

2010886

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN BlackEnergy v2.x Plugin Download Request"; flow:to server,established; content:"POST "; depth ...

2010877

alert tcp $EXTERNAL NET any $HOME NET 25 (msg:"ET EXPLOIT Possible SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt"; flow:established,to server ...

2002830

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET POLICY msnbot User Agent"; flow:established,to server; content:" 0d 0a User Agent\: "; content:"msnbot ...

2010878

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET EXPLOIT Possible Foxit PDF Reader Authentication Bypass Attempt"; flow:established,to client; content ...

2010872

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET TROJAN Pragma\: hack Detected Outbound Likely Infected Source"; flow:established,to client; content ...

2002943

alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET POLICY python.urllib User Agent Web Crawl"; flow:established,to server; content:" 0d 0a User Agent\: ...

2002823

alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET POLICY POSSIBLE Web Crawl using Wget"; flow:established,to server; content:" 0d 0a User Agent 3A "; ...

2002828

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET POLICY googlebot User Agent"; flow:established,to server; content:" 0d 0a User Agent\: "; content:"googlebot ...

2010876

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET WEB CLIENT Foxit PDF Reader Buffer Overflow Attempt"; flow:established,to client; content:"PDF "; nocase ...

2002935

alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET POLICY libwww perl User Agent"; flow:established,to server; content:" 0d 0a User Agent\: "; nocase; content ...

2010875

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Blackenergy Bot Checkin to C C (2)"; flow:to server,established; content:"POST "; depth:5; content ...

2002826

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET POLICY fetch User Agent"; flow:established,to server; content:" 0d 0a User Agent\: "; nocase; content ...

2010881

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET POLICY .pdf File Download With Unescape Method Defined Possibly Hostile"; flow:established,to client ...

2002829

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET POLICY Googlebot Crawl"; flow:established,to server; content:" 0d 0a User Agent\: "; content:"googlebot ...

2002945

alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET POLICY Java Url Lib User Agent Web Crawl"; flow:established,to server; content:" 0d 0a User Agent\:" ...

2002946

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET POLICY Java Url Lib User Agent"; flow:established,to server; content:" 0d 0a User Agent\:"; nocase; ...

2002824

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET POLICY CURL User Agent"; flow:established,to server; content:" 0d 0a User Agent\: "; nocase; content ...

2002831

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET POLICY Msnbot Crawl"; flow:established,to server; content:" 0d 0a User Agent\: "; content:"msnbot"; ...

2009076

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET CURRENT EVENTS Nginx Serving PDF Possible hostile content (PDF)"; flow:established,from server; content ...

2002833

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET POLICY Yahoo Crawler Crawl"; flow:established,to server; content:" 0d 0a User Agent\: "; content:"Yahoo ...

2010879

#alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET POLICY Hex Obfuscated arguments.callee Javascript Method in PDF Possibly Hostile PDF"; flow:established ...

2002825

alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET POLICY POSSIBLE Web Crawl using Curl"; flow:established,to server; content:" 0d 0a User Agent\: "; nocase ...

2002944

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET POLICY python.urllib User Agent"; flow:established,to server; content:" 0d 0a User Agent\: "; nocase ...

2002934

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET POLICY libwww perl User Agent"; flow:established,to server; content:" 0d 0a User Agent\: "; nocase; ...

2010883

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET POLICY .pdf File Containing arguments.callee in Cleartext Likely Hostile"; flow:established,to client ...

2010882

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET POLICY .pdf File Containing Javascript"; flow:established,to client; content:"PDF "; nocase; depth:300 ...

2003870

alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET SCAN ProxyReconBot POST method to Mail"; content:"POST "; depth:5; content:" 3A 25 HTTP/"; within:200 ...

2002832

#alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET POLICY Yahoo Crawler User Agent"; flow:established,to server; content:" 0d 0a User Agent\: "; content ...

2010495

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET CURRENT EVENTS Possible Adobe Multimedia Doc.media.newPlayer Memory Corruption Attempt"; flow:to client ...

2010880

#alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET POLICY Possible Hex Obfuscation of Javascript Declaration Within PDF File Likely Hostile"; flow:established ...

2002827