Emerging Threats Rule Documentation Wiki
This wiki contains all current rules, added as each is put into the main tarball and cvs repository. The rule author if available is primarily responsible for the documentation of a rule, however the entire community is encouraged and welcomed to contribute or document any rule. You may attach pcaps, packet text, and even code samples to any entry relevant. This is particularly useful for future troubleshooting. Please document if possible where the sample was captured. If you have a sample that's not suitable for posting publicly please contact emerging@emergingthreats.net and it can be archived privately, available to any vetted researcher. UserDocs | AllRulesets | EmergingFAQ | AllProjectsStart Here
Want some guidance on using the Emerging Threats Rulesets for the first time? NewUserGuide Some tips on writing rules? SnortSigs101? Tips on what to add to your local ruleset that's not in the main rulesets: WhatEverySnortUserShouldDo?OpenInfosec
Feature development discussions around the Open Information Security Foundation's new projects! ( http://www.openinfosecfoundation.org )SidReporter
Try out SidReporter, the newest project at Emerging Threats!! Help improve the accuracy and reliability of the Emerging Threats Rulesets anonymously!Last 10 Signature Documentation Changes
Results from Main web retrieved at 20:42 (GMT)
##alert tcp $HOME NET any $EXTERNAL NET 443 (msg:`ET DELETED Win32.Inject.ajq Initial Checkin to CnC packet 2 port 443`; flow:established,to server; content:` 07 ...
##alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:`ET DELETED Blackhole Java applet with obfuscated URL 23 Aug 2012`; flow:established,from server; file ...
##alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:`ET DELETED Blackhole 2.0 PDF GET request`; flow:established,to server; content:`.php?`; http uri; content ...
alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:`ET TROJAN Opachki Link Hijacker HTTP Header Injection`; flow:established,to server; content:`.php?l `; fast ...
alert udp any any $HOME NET 27901 (msg:`ET GAMES Alien Arena 7.30 Remote Code Execution Attempt`; content:`print 0A 5C `; isdataat:257,relative; pcre:`/\x5C ^\x5C ...
alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:`ET TROJAN FakeAV FakeSmoke HTTP POST check in`; flow:established,to server; content:`POST`; nocase; http ...
#alert tcp $EXTERNAL NET any $HOME NET 1723 (msg:`ET EXPLOIT Siemens Gigaset SE361 WLAN Data Flood Denial of Service Vulnerability`; flow:to server; content:` 90 ...
#alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:`ET WEB SPECIFIC APPS JMweb MP3 src Multiple Local File Inclusion`; flow:established,to server; content ...
alert udp $EXTERNAL NET any $HOME NET 14000 (msg:`ET EXPLOIT Borland VisiBroker Smart Agent Heap Overflow`; content:` 44 53 52 65 71 75 65 73 74 `; pcre:`/ 0 9a ...
alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:`ET WEB SPECIFIC APPS Joomla Pro Desk Component include file Local File Inclusion`; flow:to server,established ...
Number of topics: 10
All additions will be reviewed by the documentation team at Emerging Threats, a volunteer group. Please report any inaccuracies or wikispam to emerging@emergingthreats.net.
To post please register. -- Registration
Follow documentation updates via WebRss or WebAtom
Conventions
All rules are available by accessing the following URL format:
Main Utilities
Topic revision: r62 - 2011-06-06 - MattJonkman
Main Web
Create New Topic
Index
Search
Changes
Preferences- User Reference
- ATasteOfTWiki
- TextFormattingRules
- Signature Reference
- WebRss Feed
- EmergingFAQ
 |
|
Copyright © Emerging Threats