The web for users, groups and offices. TWiki is an Enterprise Collaboration Platform. http://doc.emergingthreats.net/bin/view/Main Copyright 2012 Emerging Threats and Contributing Authors 2012-02-09T01:36:41Z http://doc.emergingthreats.net/bin/view/Main/2014198 2012-02-09T01:36:41Z

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN ZeuS ICE IX cid in cookie"; content:"POST"; http method; content:" 0D 0A Cookie 3a cid "; pcre: ... (last changed by TWikiGuest)

TWikiGuest http://doc.emergingthreats.net/bin/view/Main/2013836 2012-02-09T01:36:41Z

#alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET DELETED HTTP Request to a .cz.tf domain"; flow:to server,established; content:".cz.tf 0D 0A "; fast ... (last changed by TWikiGuest)

TWikiGuest http://doc.emergingthreats.net/bin/view/Main/2011923 2012-02-09T01:36:41Z

##alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET DELETED FAKEAV CryptMEN inst.exe Payload Download"; flow:established,from server; content:"Content ... (last changed by TWikiGuest)

TWikiGuest http://doc.emergingthreats.net/bin/view/Main/WebStatistics 2012-02-08T21:51:30Z

Statistics for Main Web Month: Topic views: Topic saves: File uploads: Most popular topic views: Top contributors for topic save and uploads ... (last changed by TWikiGuest)

TWikiGuest http://doc.emergingthreats.net/bin/view/Main/2014217 2012-02-07T03:00:20Z

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET TROJAN Delf/Troxen/Zema controller delivering clickfraud instructions"; flow:established,to client; file ... (last changed by TWikiGuest)

TWikiGuest http://doc.emergingthreats.net/bin/view/Main/2014212 2012-02-07T03:00:19Z

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN MSUpdater POST checkin to CnC"; flow:established,to server; content:"/microsoft/errorpost/default ... (last changed by TWikiGuest)

TWikiGuest http://doc.emergingthreats.net/bin/view/Main/2014214 2012-02-07T03:00:19Z

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN MSUpdater post auth checkin"; flow:established,to server; content:"/search6"; http uri; fast pattern ... (last changed by TWikiGuest)

TWikiGuest http://doc.emergingthreats.net/bin/view/Main/2014216 2012-02-07T03:00:19Z

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET TROJAN Delf/Troxen/Zema controller responding to client"; flow:established,to client; file data; content ... (last changed by TWikiGuest)

TWikiGuest http://doc.emergingthreats.net/bin/view/Main/2014209 2012-02-07T03:00:19Z

alert tcp $EXTERNAL NET 443 $HOME NET any (msg:"ET TROJAN Sykipot SSL Certificate serial number detected"; flow:established,to client; content:" 16 "; content: ... (last changed by TWikiGuest)

TWikiGuest http://doc.emergingthreats.net/bin/view/Main/2014213 2012-02-07T03:00:19Z

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN MSUpdater Connectivity Check to Google"; flow:established,to server; content:"/search?qu "; http ... (last changed by TWikiGuest)

TWikiGuest http://doc.emergingthreats.net/bin/view/Main/2014215 2012-02-07T03:00:19Z

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MOBILE MALWARE Android/Plankton.P Commands Request to CnC Server"; flow:established,to server; content ... (last changed by TWikiGuest)

TWikiGuest http://doc.emergingthreats.net/bin/view/Main/2014211 2012-02-07T03:00:19Z

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN MSUpdater alt checkin to CnC"; flow:established,to server; content:"/microsoft/errorpost/default ... (last changed by TWikiGuest)

TWikiGuest http://doc.emergingthreats.net/bin/view/Main/2014204 2012-02-07T03:00:18Z

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET CURRENT EVENTS CutePack Exploit Kit JavaScript Variable Detected"; flow:established,to client; content ... (last changed by TWikiGuest)

TWikiGuest http://doc.emergingthreats.net/bin/view/Main/2014207 2012-02-07T03:00:18Z

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET CURRENT EVENTS Likely MS12 004 midiOutPlayNextPolyEvent Heap Overflow Midi Filename Requested baby.mid ... (last changed by TWikiGuest)

TWikiGuest http://doc.emergingthreats.net/bin/view/Main/2014203 2012-02-07T03:00:18Z

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET CURRENT EVENTS CUTE IE.html CutePack Exploit Kit Landing Page Request"; flow:established,to server; content ... (last changed by TWikiGuest)

TWikiGuest http://doc.emergingthreats.net/bin/view/Main/2014206 2012-02-07T03:00:18Z

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET CURRENT EVENTS CutePack Exploit Kit Landing Page Detected"; flow:established,to client; content:"button ... (last changed by TWikiGuest)

TWikiGuest