RuleChanges < Main

NEW - 06 Jul 2008 - 20:19

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Shopcenter.co.kr Spyware Install Report"; flow:established,to server; uricontent:"/RewardInstall ...

2001891

NEW - 06 Jul 2008 - 20:19

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (agent)"; flow: to server,established; content:" 0d 0a User Agent\: agent ...

2008077

NEW - 04 Jul 2008 - 13:35

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET CURRENT EVENTS Possible Storm Worm EXE Request (fireworks.exe)"; flow:established,to server; content ...

SandnetAnalystsGroup

r19 - 03 Jul 2008 - 19:55

SandnetAnalystsGroup Member list (comma separated list): Set GROUP MattJonkman, DeapeshMisra, BlakeHartstein, JamesMcQuaid, AndreDiMino, DavidBianco, TeresaGarner ...

WillForte

NEW - 03 Jul 2008 - 19:37

My Links .ATasteOfTWiki view a short introductory presentation on TWiki for beginners .WelcomeGuest starting points on TWiki .TWikiUsersGuide ...

2008367

NEW - 03 Jul 2008 - 19:30

alert tcp any 20 $HOME NET 25 (msg:"ET MALWARE Possible Windows executable sent when remote host claims to send Javascript"; flow: established; content:" 0d 0a ...

2008368

NEW - 03 Jul 2008 - 19:30

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Unknown Keylogger checkin"; flow:established; content:"GET"; depth:4; uricontent:"?mail "; uricontent ...

2001685

NEW - 03 Jul 2008 - 19:24

alert tcp any 20 $HOME NET 25 (msg:"ET MALWARE Possible Windows executable sent when remote host claims to send an image"; flow: established; content:"Content ...

2001684

NEW - 03 Jul 2008 - 19:24

alert tcp any $HTTP PORTS $HOME NET any (msg:"ET MALWARE Windows executable sent when remote host claims to send image, Win32"; flow: established; content:"Content ...

2008369

NEW - 03 Jul 2008 - 19:24

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Keylogger Crack by bahman"; flow:established; content:"POST"; depth:5; content:" message 2b keylogger ...

2008366

NEW - 03 Jul 2008 - 15:12

alert tcp $HOME NET any $EXTERNAL NET 82 (msg:"ET TROJAN LD Pinch Checkin (HTTP POST on port 82)"; flow:established,to server; content:"POST "; depth:5; content ...

2008185

NEW - 03 Jul 2008 - 14:34

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Win32 Cloaker Related Post Infection Checkin"; flow:established,to server; uricontent:"/log/proc ...

2008365

NEW - 03 Jul 2008 - 04:30

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (Playtech Downloader)"; flow:to server,established; content:" 0d 0a User ...

2008363

NEW - 03 Jul 2008 - 04:30

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (ISMYIE)"; flow:to server,established; content:" 0d 0a User Agent\: ISMYIE ...

2008364

NEW - 03 Jul 2008 - 04:30

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Donkeyp2p Update Detected"; flow:established,to server; content:"GET "; depth:4; uricontent:"donkeyp2p ...

SifuKurt

NEW - 01 Jul 2008 - 23:16

My Links .ATasteOfTWiki view a short introductory presentation on TWiki for beginners .WelcomeGuest starting points on TWiki .TWikiUsersGuide ...

2008288

NEW - 01 Jul 2008 - 18:48

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET CURRENT EVENTS Possible Storm Worm URL Request (mylove.exe)"; flow:established,to server; content:"GET ...

AllRulesets

r14 - 01 Jul 2008 - 16:39

Ruleset Downloads All Emerging Threats Signatures http://www.emergingthreats.net/rules/ Browseable Web Directory Format Web Directory Daily Change ...

EmergingBro

r3 - 01 Jul 2008 - 16:18

Emerging Bro Signatures Bro is an Open Source IDS similar to Snort, but with a different philosophy. Bro is not primarily intended to do byte wise signature matching ...

2008362

NEW - 01 Jul 2008 - 15:33

alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET SCAN bsqlbf Brute Force SQL Injection"; flow:established,to server; content:" 0d 0a User Agent\: bsqlbf ...

2008330

NEW - 01 Jul 2008 - 15:33

#alert tcp $HOME NET any $EXTERNAL NET any (msg:"ET POLICY HTTP CONNECT Tunnel Attempt Outbound"; flow: to server,established; content:"CONNECT "; nocase; content ...

2000560

NEW - 01 Jul 2008 - 15:33

#alert tcp $EXTERNAL NET any $HOME NET any (msg:"ET POLICY HTTP CONNECT Tunnel Attempt Inbound"; flow: to server,established; content:"CONNECT "; nocase; content ...

2007962

r4 - 01 Jul 2008 - 12:25

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN Vipdataend C C Traffic Checkin"; flow:established,to server; dsize: Added 2008 06 24 23:26:43 UTC ...

2008359

NEW - 01 Jul 2008 - 11:29

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Unnamed kuaiche.com related"; flow:established,to server; content:"GET "; depth:4; uricontent ...

2003394

r2 - 01 Jul 2008 - 02:45

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE User Agent Containing http\:// Suspicious Likely Spyware/Trojan"; flow:to server,established ...

2008361

NEW - 30 Jun 2008 - 20:34

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (Accessing)"; flow:to server,established; content:" 0d 0a User Agent\: ...

2003636

NEW - 30 Jun 2008 - 20:34

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET VIRUS Sality Virus User Agent Detected (KUKU)"; flow:established,to server; content:"User Agent\: KUKU ...

2008360

NEW - 30 Jun 2008 - 20:34

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Steam Steal0r"; flow:established,to server; uricontent:"info Steam 20 Steal0r 20 "; uricontent ...

2008072

NEW - 30 Jun 2008 - 18:18

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN LDPinch Checkin (5)"; flow:established,to server; uricontent:".php"; nocase; content:"a "; content ...

2008335

r2 - 30 Jun 2008 - 18:17

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN Beizhu/Womble/Vipdataend Controller Keepalive"; flow:established,to server; dsize:1; content:"d"; classtype ...

2002117

r3 - 30 Jun 2008 - 18:15

alert tcp $EXTERNAL NET 6112 $HOME NET any (msg:"ET GAMES Battle.net connection reset (possible IP Ban)"; flags:R,12; classtype: policy violation; sid:2002117; ...

2008061

NEW - 30 Jun 2008 - 14:28

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN LDPinch Checkin (4)"; flow:established,to server; content:"a "; offset:0; depth:2; content:" b ...

2008358

NEW - 30 Jun 2008 - 14:28

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN Pakes/Cutwall/Kobcka Checkin Detected High Ports"; flow:established,to server; dsize: Added 2008 06 ...

2008319

NEW - 29 Jun 2008 - 04:14

alert tcp $HOME NET any $EXTERNAL NET any (msg:"ET TROJAN Win32.Small.wpx or Related Downloader Posting Data"; flow:to server,established; content:"POST "; depth ...

2008357

NEW - 28 Jun 2008 - 16:29

alert tcp $EXTERNAL NET any $HOME NET any (msg:"ET SCAN Amap Scannner Traffic Inbound"; flow:to server; content:" 79 08 00 00 00 01 00 00 00 00 00 00 20 43 4B 41 ...

2002773

NEW - 27 Jun 2008 - 20:15

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET TROJAN FSG Packed Binary via HTTP Inbound"; flow:from server,established; content:" 4D 5A "; content ...

2008328

NEW - 27 Jun 2008 - 20:15

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Banload iLLBrain Trojan Activity"; flow:to server,established; content:"GET"; depth:4; content ...

2008354

NEW - 27 Jun 2008 - 14:35

alert tcp $HOME NET any $EXTERNAL NET 82 (msg:"ET TROJAN LDPinch Checkin on Port 82"; flow:established,to server; uricontent:".php"; nocase; content:"a "; content ...

2008355

NEW - 27 Jun 2008 - 14:35

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (angel)"; flow:to server,established; content:" 0d 0a User Agent\: angel ...

2008356

NEW - 27 Jun 2008 - 14:35

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Seekmo.com Spyware Data Upload"; flow:established,to server; uricontent:".aspx?"; uricontent ...

2008012

NEW - 27 Jun 2008 - 14:10

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Winquickupdates.com/Mycashloads.com Related Trojan Install Report"; flow:established,to server ...

CsLee

NEW - 26 Jun 2008 - 21:08

My Links .ATasteOfTWiki view a short introductory presentation on TWiki for beginners .WelcomeGuest starting points on TWiki .TWikiUsersGuide ...

SpamHausDROPList

NEW - 26 Jun 2008 - 18:46

Spamhaus.org DROP List This ruleset takes a daily list of known spammers and spam networks as researched by Spamhaus and converts them into Snort signatures, Bro Signatures ...

DshieldTopAttackers

NEW - 26 Jun 2008 - 18:45

Dshield Top Attackers This ruleset takes a daily list of the top attackers reported to Dshield and converts them into Snort signatures, Bro Signatures, and Firewall ...

ShadowServerCC

NEW - 26 Jun 2008 - 18:41

Shadowserver.org Known Command and Control Rules This ruleset takes a daily list of the known CnC Servers as researched by Shadowserver.org and converts them into ...

EmergingFirewallRules

r4 - 26 Jun 2008 - 18:38

Using the Emerging Threats Firewall Rules The firewall rulesets are versions of the IP Block lists in a format easily imported into IPF, IPTables, PF, and PIX firewalls ...

2008341

NEW - 26 Jun 2008 - 17:11

alert tcp $EXTERNAL NET any $HOME NET any (msg:"ET TROJAN Themida Packed Binary Likely Hostile"; flow:established,from server; content:" 2E 69 64 61 74 61 20 ...

2008347

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Swizzor Checkin"; flow:established,to server; content:"GET "; depth:4; uricontent:"c "; uricontent ...

2008352

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET VIRUS CoreFlooder.Q Data Posting"; flow:established,to server; content:"POST"; depth:4; uricontent:" ...

2002838

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET Google Search Appliance browsing the Internet"; flow:to server,established; content:"GET "; depth:4; ...

2007778

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN User agent DownloadNetFile Win32.small.hsh downloader"; flow:established,to server; content:"GET ...

2007705

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET WEB Neosploit 1.5.x URL Loader"; flow:to server,established; content:"GET "; depth:4; pcre:"/\?u\d \d ...

2008349

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Injecter Checkin"; flow:established,to server; content:"GET"; depth:4; uricontent:"mod "; uricontent ...

2003051

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET BOTNET IP Discovery via whatismyip.com"; flow:to server,established; content:"GET "; depth:4; content ...

2008353

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET VIRUS CoreFlooder.Q C C Checkin"; flow:established,to server; content:"POST"; depth:4; uricontent:"/a ...

2008351

NEW - 26 Jun 2008 - 15:29

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET POLICY ICP Email Send via HTTP Often Trojan Install Reports"; flow:established,to server; uricontent ...

2008346

NEW - 26 Jun 2008 - 15:29

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Mitglieder Checkin"; flow:established,to server; content:"GET "; depth:4; uricontent:"p "; uricontent ...

2008350

NEW - 26 Jun 2008 - 15:14

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET POLICY Autoit Windows Automation tool User Agent in HTTP Request Possibly Hostile"; flow:established ...

2008348

NEW - 26 Jun 2008 - 14:39

alert tcp $HOME NET any $EXTERNAL NET 25 (msg:"ET POLICY SC KeyLog Keylogger Installed Sending Log Email Report"; flow:established,to server; content:"SC KeyLog ...

2002979

NEW - 26 Jun 2008 - 14:39

alert tcp $HOME NET any $EXTERNAL NET 25 (msg:"ET POLICY SC KeyLog Keylogger Installed Sending Initial Email Report"; flow:established,to server; content:"Installation ...

2008334

r2 - 26 Jun 2008 - 14:19

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN Beizhu/Womble/Vipdataend Checking with Controller"; flow:established,to server; dsize: Added 2008 06 ...

DigiAngel

NEW - 26 Jun 2008 - 14:18

My Links .ATasteOfTWiki view a short introductory presentation on TWiki for beginners .WelcomeGuest starting points on TWiki .TWikiUsersGuide ...

2008345

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Dialer.Trojan Activity"; flow: to server,established; uricontent:"/dialer min/getnum.asp?nip" ...

2008342

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (ld)"; flow:to server,established; content:" 0d 0a User Agent\: ld 0d 0a ...

2008343

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (123)"; flow:to server,established; content:" 0d 0a User Agent\: 123 0d ...

2008344

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (DownloadNetFile)"; flow:to server,established; content:" 0d 0a User Agent ...

JartArmin

NEW - 26 Jun 2008 - 12:13

My Links .ATasteOfTWiki view a short introductory presentation on TWiki for beginners .WelcomeGuest starting points on TWiki .TWikiUsersGuide ...

2007728

NEW - 26 Jun 2008 - 03:54

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN AFV POST"; flow:to server,established; content:"POST "; nocase; depth:5; uricontent:".php"; nocase ...

2008340

NEW - 25 Jun 2008 - 19:19

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Lost Door Checkin"; flow:established,to server; content:"GET"; depth:4; uricontent:"subject Lost ...

2008339

NEW - 25 Jun 2008 - 19:19

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Keypack.co.kr Related Trojan User Agent Detected"; flow:established,to server; content:" 0d 0a ...

2008338

NEW - 25 Jun 2008 - 19:19

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN KLog Nick Keylogger Checkin"; flow:established,to server; content:"POST"; depth:5; uricontent ...

PhilWallisch

NEW - 25 Jun 2008 - 19:13

My Links .ATasteOfTWiki view a short introductory presentation on TWiki for beginners .WelcomeGuest starting points on TWiki .TWikiUsersGuide ...

2008337

NEW - 25 Jun 2008 - 18:25

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Win32.Small.dvs or Related DDOS Checkin"; flow:established,to server; content:"GET ?ddos x"; depth ...

2008336

NEW - 25 Jun 2008 - 16:36

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET POLICY Eurobarre.us Setup User Agent"; flow:established,to server; content:" 0d 0a User Agent\: eurobarre ...

2008333

NEW - 25 Jun 2008 - 16:25

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Lop.gfr/Swizzor HTTP Update/Checkin (usually host domain lookup.com related)"; flow:established ...

2008332

NEW - 25 Jun 2008 - 14:55

alert tcp $HOME NET any $EXTERNAL NET any (msg:"ET TROJAN Steam Pass Stealer FTP Upload"; flow:established,to server; dsize:33; content:"STEAM nicht eingespeichert ...

2008317

NEW - 25 Jun 2008 - 14:16

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Hitpop.AG/Pophot.az HTTP Checkin"; flow:to server,established; content:"GET "; depth:4; uricontent ...

2008331

NEW - 25 Jun 2008 - 14:16

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Banker/Banbra Variant POST via x www form urlencoded"; flow:established,to server; content:"POST ...

2008329

NEW - 25 Jun 2008 - 03:50

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN xpsecuritycenter.com Fake AntiVirus GET Install Checkin"; flow:established,to server; content ...

2008327

NEW - 25 Jun 2008 - 03:50

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN Perfect Keylogger FTP Initial Install Log Upload (Null obfuscated)"; flow:established,to server; content ...

2008307

alert tcp $HOME NET any $EXTERNAL NET 8074 (msg:"ET POLICY GaduGadu Chat File Send Details"; flowbits:isset,ET.gadu.loggedin; flow:established,to server; content ...

2008306

alert tcp $HOME NET any $EXTERNAL NET 8074 (msg:"ET POLICY GaduGadu Chat File Send Request"; flowbits:isset,ET.gadu.loggedin; flow:established,to server; content ...

2008305

alert tcp $EXTERNAL NET 8074 $HOME NET any (msg:"ET POLICY GaduGadu Chat Keepalive PONG"; flowbits:isset,ET.gadu.loggedin; flow:established,from server; content ...

2008309

alert tcp $EXTERNAL NET 8074 $HOME NET any (msg:"ET POLICY GaduGadu Chat File Send Begin"; flowbits:isset,ET.gadu.loggedin; flow:established,from server; content ...

2008308

alert tcp $EXTERNAL NET 8074 $HOME NET any (msg:"ET POLICY GaduGadu Chat File Send Accept"; flowbits:isset,ET.gadu.loggedin; flow:established,from server; content ...

2008042

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN Hupigon CnC Data Post (variant abb)"; flow:established,to server; dsize: 200; flowbits:isset,ET.hupa ...

2008245

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN Juicopotomous to Controller"; flow:established,to server; dsize:1; content:" 7c "; flowbits:set,ET.unknown ...

2003936

alert tcp $HOME NET any $EXTERNAL NET 1024:65535 (msg:"ET TROJAN Bandok phoning home (xor by 0xe9 to decode)"; flow:established,to server; content:" CF 8F 80 9B ...

2007979

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN Backdoor.Win32.VB.brg C C Reporting Version"; flow:established,to server; content:"Version 28 2a "; ...

2008041

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN Hupigon CnC init (variant abb)"; flow:established,to server; dsize:4; flowbits:isnotset,ET.hupa.init ...

2008274

alert tcp $EXTERNAL NET 81 $HOME NET any (msg:"ET TROJAN Bifrose Response from Controller"; flow:established,from server; dsize:9; content:" 05 00 00 00 BC "; depth ...

2008292

alert tcp $EXTERNAL NET 443 $HOME NET any (msg:"ET TROJAN Win32.Onlinegames.ajok CnC Packet from Server"; flow:established,from server; flowbits:isset,ET.onlinegames ...

2008298

alert tcp $HOME NET any $EXTERNAL NET 8074 (msg:"ET POLICY GaduGadu Chat Client Login Packet"; flowbits:isset,ET.gadu.welcome; flow:established,to server; dsize ...

2008254

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN Vipdataend/Ceckno C C Traffic Checkin"; flow:established,to server; dsize: Added 2008 06 24 23:26 ...

2008031

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN Dorf/Win32.Inject.adt C C Communication Outbound"; flow:established,to server; dsize:16; content:"1SCD ...

2008177

r2 - 29 Apr 2008 - 14:05

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN Ceckno Reporting to Controller"; flow:established,to server; dsize: Added 2008 06 24 23:26:43 UTC ...

2008027

r2 - 19 Mar 2008 - 13:21

alert tcp $EXTERNAL NET 1024: $HOME NET any (msg:"ET TROJAN Turkojan C C Browse Drive Command (BROWSC)"; flow:established,from server; dsize: Added 2008 06 24 23 ...

2008026

r2 - 19 Mar 2008 - 13:21

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN Turkojan C C Keepalive (BAGLANTI)"; flow:established,to server; dsize:9; content:"BAGLANTI?"; classtype ...

2008006

r2 - 17 Mar 2008 - 17:50

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN Delf CnC Channel Packet 1"; flowbits:isnotset,ET.unk.1; flow:established,to server; dsize: Added 2008 ...

2008007