#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX InstanGet? v2.08 Activex Control DOS clsid access attempt"; flow:established,to_client; file_data; content:"clsid"; nocase; distance:0; content:"98C92840-EB1C-40BD-B6A5-395EC9CD6510D"; nocase; distance:0; content:"ShowBar"; nocase; distance:0; pcre:"/<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510/si"; reference:url,www.packetstormsecurity.org/0909-exploits/instantget-dos.txt; reference:url,doc.emergingthreats.net/2010279; classtype:web-application-attack; sid:2010279; rev:7;)

Added 2011-10-12 19:29:23 UTC

#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX InstanGet? v2.08 Activex Control DOS clsid access attempt"; flow:established,to_client; file_data; content:"clsid"; nocase; distance:0; content:"98C92840-EB1C-40BD-B6A5-395EC9CD6510D"; nocase; distance:0; content:"ShowBar"; nocase; distance:0; pcre:"/<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510/si"; classtype:web-application-attack; reference:url,www.packetstormsecurity.org/0909-exploits/instantget-dos.txt; reference:url,doc.emergingthreats.net/2010279; sid:2010279; rev:7;)

Added 2011-09-14 22:42:36 UTC

#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX InstanGet? v2.08 Activex Control DOS clsid access attempt"; flow:established,to_client; file_data; content:"clsid"; nocase; distance:0; content:"98C92840-EB1C-40BD-B6A5-395EC9CD6510D"; nocase; distance:0; content:"ShowBar"; nocase; distance:0; pcre:"/<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510/si"; classtype:web-application-attack; reference:url,www.packetstormsecurity.org/0909-exploits/instantget-dos.txt; reference:url,doc.emergingthreats.net/2010279; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_CLIENT/WEB_InstanGet; sid:2010279; rev:7;)

Added 2011-02-04 17:29:46 UTC

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_CLIENT InstanGet? v2.08 Activex Control DOS clsid access attempt"; flow:established,to_client; content:"clsid"; nocase; content:"98C92840-EB1C-40BD-B6A5-395EC9CD6510D"; nocase; distance:0; content:"ShowBar"; nocase; pcre:"/<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510/si"; classtype:web-application-attack; reference:url,www.packetstormsecurity.org/0909-exploits/instantget-dos.txt; reference:url,doc.emergingthreats.net/2010279; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_CLIENT/WEB_InstanGet; sid:2010279; rev:3;)

Added 2010-07-29 15:02:20 UTC

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_CLIENT InstanGet? v2.08 Activex Control DOS clsid access attempt"; flow:established,to_client; content:"clsid"; nocase; content:"98C92840-EB1C-40BD-B6A5-395EC9CD6510D"; nocase; distance:0; content:"ShowBar"; nocase; pcre:"/<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510/si"; classtype:web-application-attack; reference:url,www.packetstormsecurity.org/0909-exploits/instantget-dos.txt; reference:url,doc.emergingthreats.net/2010279; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_CLIENT/WEB_InstanGet; sid:2010279; rev:3;)

Added 2010-07-29 15:02:20 UTC

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-ATTACKS InstanGet? v2.08 Activex Control DOS clsid access attempt"; flow:established,to_client; content:"clsid"; nocase; content:"98C92840-EB1C-40BD-B6A5-395EC9CD6510D"; nocase; distance:0; content:"ShowBar"; nocase; pcre:"/<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510/si"; classtype:web-application-attack; reference:url,www.packetstormsecurity.org/0909-exploits/instantget-dos.txt; reference:url,doc.emergingthreats.net/2010279; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_CLIENT/WEB_InstanGet; sid:2010279; rev:2;)

Added 2009-11-18 21:00:43 UTC

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-ATTACKS InstanGet? v2.08 Activex Control DOS clsid access attempt"; flow:established,to_client; content:"clsid"; nocase; content:"98C92840-EB1C-40BD-B6A5-395EC9CD6510D"; nocase; distance:0; content:"ShowBar"; nocase; pcre:"/<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510/si"; classtype:web-application-attack; reference:url,www.packetstormsecurity.org/0909-exploits/instantget-dos.txt; reference:url,doc.emergingthreats.net/2010279; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/WEB_CLIENT/WEB_InstanGet; sid:2010279; rev:2;)

Added 2009-11-18 21:00:43 UTC

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"WEB-ATTACKS InstanGet? v2.08 Activex Control DOS clsid access attempt"; flow:established,to_client; content:"clsid"; nocase; content:"98C92840-EB1C-40BD-B6A5-395EC9CD6510D"; nocase; distance:0; content:"ShowBar"; nocase; pcre:"/<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510/si"; classtype:web-application-attack; reference:url,www.packetstormsecurity.org/0909-exploits/instantget-dos.txt; sid:2010279; rev:1;)

Added 2009-11-10 07:23:12 UTC