RuleChanges < Main

NEW - 20 Aug 2008 - 04:30

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN AZG Checkin"; flow:established,to server; content:"GET "; depth:4; nocase; content:" 0d 0a User ...

2008514

NEW - 19 Aug 2008 - 22:30

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (AVP2006IE)"; flow:established,to server; content:" 0d 0a User Agent\: ...

2008513

NEW - 19 Aug 2008 - 22:30

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (msIE 7.0)"; flow:established,to server; content:" 0d 0a User Agent\: msIE ...

2008512

NEW - 19 Aug 2008 - 22:13

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (C\:\\)"; flow:established,to server; content:" 0d 0a User Agent\: C\: ...

2008511

NEW - 19 Aug 2008 - 20:45

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Win32/Antivirus2008 Fake AV Install Report"; flow:established,to server; uricontent:"?type scanner ...

2008510

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent Possible Trojan Downloader (\xa2\xa2HttpClient)"; flow:established,to ...

2008341

alert tcp $EXTERNAL NET any $HOME NET any (msg:"ET TROJAN Themida Packed Binary Likely Hostile"; flow:established,from server; content:" 2E 69 64 61 74 61 20 ...

2008315

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET CURRENT EVENTS Iframe in Purported Image Download (png) Likely SQL Injection Attacks Related"; flow ...

2008314

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET CURRENT EVENTS Iframe in Purported Image Download (gif) Likely SQL Injection Attacks Related"; flow ...

2008421

alert tcp $HOME NET any $EXTERNAL NET 53 (msg:"ET TROJAN HTTP POST Request on port 53 Very Likely Hostile"; flow:established,to server; content:"POST "; nocase ...

2008420

alert tcp $HOME NET any $EXTERNAL NET 53 (msg:"ET TROJAN HTTP GET Request on port 53 Very Likely Hostile"; flow:established,to server; content:"GET "; nocase ...

2008509

alert tcp $EXTERNAL NET any $HOME NET any (msg:"ET TROJAN VirtualProtect Packed Binary Likely Hostile"; flow:established,from server; content:" 2E 72 73 72 63 ...

2008313

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET CURRENT EVENTS Iframe in Purported Image Download (jpeg) Likely SQL Injection Attacks Related"; flow ...

2008508

NEW - 19 Aug 2008 - 18:00

alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET CURRENT EVENTS Internal User may have Visited an ASPROX Infected Site"; content:""; within:40; nocase ...

ScottBlayney

NEW - 19 Aug 2008 - 12:51

My Links .ATasteOfTWiki view a short introductory presentation on TWiki for beginners .WelcomeGuest starting points on TWiki .TWikiUsersGuide ...

RussianBusinessNetwork

JamesMcQuaid

r21 - 18 Aug 2008 - 21:58

Emerging Threats Russian Business Network (RBN) Snort Intrusion Detection Rules : http://www.emergingthreats.net/rules/emerging rbn.rules http://www.emergingthreats ...

HoneywallSamples

JamesMcQuaid

r8 - 18 Aug 2008 - 01:22

Honeywall and Smoothwall Configuration Samples UsingHoneywall.pdf: UsingHoneywall.pdf (as presented at Berkman Center, Harvard Law School, May 16th) ...

2008507

r2 - 17 Aug 2008 - 04:02

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN Backdoor.Win32.VB.fdi Bot Reporting to Controller"; flow:established,to server; content:"state\: 0 ...

2008506

NEW - 16 Aug 2008 - 00:15

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Trojan PWS.Win32.VB.tr Checkin Detected"; flow:established,to server; content:"POST"; depth:5 ...

2008453

r3 - 14 Aug 2008 - 12:34

alert tcp $EXTERNAL NET any $HTTP SERVERS 8080 (msg:"ET SCAN Tomcat Auth Brute Force attempt (admin)"; flow:to server,established; content:"Authorization\: Basic ...

2008454

NEW - 14 Aug 2008 - 12:30

alert tcp $EXTERNAL NET any $HTTP SERVERS 8080 (msg:"ET SCAN Tomcat Auth Brute Force attempt (tomcat)"; flow:to server,established; content:"Authorization\: Basic ...

2008455

NEW - 14 Aug 2008 - 12:30

alert tcp $EXTERNAL NET any $HTTP SERVERS 8080 (msg:"ET SCAN Tomcat Auth Brute Force attempt (manager)"; flow:to server,established; content:"Authorization\: Basic ...

RussellFulton

NEW - 14 Aug 2008 - 04:14

My Links .ATasteOfTWiki view a short introductory presentation on TWiki for beginners .WelcomeGuest starting points on TWiki .TWikiUsersGuide ...

2008504

NEW - 12 Aug 2008 - 16:45

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (SUiCiDE/1.5)"; flow:established,to server; content:" 0d 0a User Agent ...

2008505

NEW - 12 Aug 2008 - 16:45

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE BarACE Checkin and Update"; flow:established,to server; content:"GET "; depth:4; uricontent: ...

2008503

NEW - 12 Aug 2008 - 16:00

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE ZCOM Adware/Spyware User Agent (ZCOM Software)"; flow:established,to server; content:" 0d 0a ...

2008502

NEW - 12 Aug 2008 - 15:15

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Antispywareexpert.com Fake AS Install Checkin"; flow:established,to server; uricontent:"/?action ...

2008279

NEW - 12 Aug 2008 - 14:51

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE ZenoSearch Spyware User Agent"; flow:to server,established; content:" 0d 0a User Agent\: "; ...

2008501

NEW - 12 Aug 2008 - 14:39

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Peed Report to Controller"; flow:established,to server; uricontent:"/controller.php?action "; ...

2008500

NEW - 12 Aug 2008 - 14:39

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Sogoul.com Spyware User Agent (SogouIMEMiniSetup)"; flow:established,to server; content:" 0d ...

PerlScreenCaptureProggie

r2 - 12 Aug 2008 - 00:08

Ever have issues trying to get management to try and understand log files from your proxy server, showing inappropriate user activity? As they say a picture is worth ...

WilliamMetcalf

NEW - 11 Aug 2008 - 22:54

My Links .ATasteOfTWiki view a short introductory presentation on TWiki for beginners .WelcomeGuest starting points on TWiki .TWikiUsersGuide ...

2008499

NEW - 11 Aug 2008 - 18:00

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET CURRENT EVENTS Fake CNN alert Malware download (adobe flash.exe)"; flow:to server,established; content ...

2008498

NEW - 08 Aug 2008 - 15:00

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET CURRENT EVENTS Likely Facebook Malware Download (picture dl.exe)"; flow:to server,established; content ...

SnortConfSamples

JamesMcQuaid

r109 - 08 Aug 2008 - 01:19

Snort.Conf Samples The goal of this page is to make a set of sample snort.conf files, and some samples for using other common tools with data from Emerging Threats ...

2008497

NEW - 07 Aug 2008 - 14:00

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN Unknown Checkin"; flowbits:isset,ET.unknid; flow:established,to server; dsize:100200; content:" idate ...

2008496

NEW - 07 Aug 2008 - 14:00

alert tcp $HOME NET any $EXTERNAL NET 1024: (msg:"ET TROJAN Unknown Initial Checkin"; flow:established,to server; dsize: Added 2008 08 07 10:00:21 UTC

PedroMarinho

PedroMarinho

r2 - 07 Aug 2008 - 13:04

My Links .ATasteOfTWiki view a short introductory presentation on TWiki for beginners .WelcomeGuest starting points on TWiki .TWikiUsersGuide ...

SidReporterInstall

r2 - 06 Aug 2008 - 21:40

SidReporter Install Instructions SidReporter Readme INTRODUCTION SidReporter is a tool that will help feedback information to the community about a number of things ...

2008495

NEW - 05 Aug 2008 - 20:00

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (antispyprogram)"; flow:established,to server; content:" 0d 0a User Agent ...

2008494

NEW - 05 Aug 2008 - 19:00

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (ieagent)"; flow:established,to server; content:" 0d 0a User Agent\: ieagent ...

SidReporter

r2 - 05 Aug 2008 - 14:43

SidReporter SidReporter is the Emerging Threats Data Sharing Tool that allows users to report anonymously their local IDS/IPS event data. In return you will (soon ...

2008493

NEW - 05 Aug 2008 - 13:00

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Cutwail/W32.Small.avu Dropper"; flow:established,to server; content:"GET "; depth:4; uricontent ...

2008077

NEW - 04 Aug 2008 - 19:00

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET CURRENT EVENTS Possible Storm Worm EXE Request (postcard.exe)"; flow:established,to server; content: ...

LoganHobdey

NEW - 04 Aug 2008 - 17:09

My Links .ATasteOfTWiki view a short introductory presentation on TWiki for beginners .WelcomeGuest starting points on TWiki .TWikiUsersGuide ...

2008492

NEW - 03 Aug 2008 - 17:23

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Win32.Downloader.pgp Checkin"; flow:established,to server; uricontent:"?id "; uricontent:" e ...

2008491

NEW - 03 Aug 2008 - 17:23

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Banker.OT Checkin (2 packet)"; flow:established,to server; content:"praquem "; depth:8; content ...

2008490

NEW - 02 Aug 2008 - 21:00

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Dialer.Win32.E Group.n Checkin"; flow:to server,established; uricontent:"login "; nocase; uricontent ...

2008486

alert tcp $EXTERNAL NET any $HOME NET 25 (msg:"CURRENT EVENTS Fake Airline E ticket Email Inbound"; flow:established,to server; content:" 0d 0a Subject\: E Ticket ...

2008489

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (dwplayer)"; flow:established,to server; content:" 0d 0a User Agent\: dwplayer ...

2008488

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (NULL)"; flow:established,to server; content:" 0d 0a User Agent\: NULL ...

2008487

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Trojan Downloader.Win32.Delf.bsy Checkin"; flow:established,to server; uricontent:"dn "; nocase ...

SongLei

NEW - 01 Aug 2008 - 04:41

My Links .ATasteOfTWiki view a short introductory presentation on TWiki for beginners .WelcomeGuest starting points on TWiki .TWikiUsersGuide ...

2008485

NEW - 31 Jul 2008 - 16:00

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Searchtool.co.kr Fake Product User Agent (searchtoolup)"; flow:established,to server; content ...

2008483

NEW - 30 Jul 2008 - 23:00

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Win32/Antivirus2008"; flow:established,to server; uricontent:" nick "; nocase; uricontent:" group ...

2008484

NEW - 30 Jul 2008 - 18:00

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Cleancop.co.kr Fake AV User Agent (CleancopUpdate)"; flow:established,to server; content:" 0d ...

2001810

NEW - 30 Jul 2008 - 17:00

alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET EXPLOIT WEB PHP remote file include exploit attempt"; flow: to server,established; content:"GET ...

SamuelJebamani

NEW - 30 Jul 2008 - 11:03

My Links .ATasteOfTWiki view a short introductory presentation on TWiki for beginners .WelcomeGuest starting points on TWiki .TWikiUsersGuide ...

2008482

NEW - 30 Jul 2008 - 04:00

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN thespybot.com installation download detected"; flow:established,to server; content:"GET "; depth ...

2008481

NEW - 29 Jul 2008 - 15:00

alert tcp $HOME NET any $EXTERNAL NET 2227 (msg:"ET TROJAN Trojan PSW.Win32.Nilage.crg Checkin"; flow:established,to server; dsize:32; content:" 00 c0 a8 01 f4 ...

2008478

NEW - 29 Jul 2008 - 04:00

alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET WEB convert SQL Injection Attempt"; flow:established,to server; uricontent:"1 convert("; nocase; ...

2008479

NEW - 29 Jul 2008 - 04:00

alert tcp $EXTERNAL NET any $HTTP SERVERS $HTTP PORTS (msg:"ET WEB query information schema SQL Injection Attempt"; flow:established,to server; uricontent:"information ...

2008480

NEW - 29 Jul 2008 - 04:00

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Win32.Adload.agq Checkin"; flow:established,to server; uricontent:"pubid "; nocase; uricontent ...

2008477

NEW - 28 Jul 2008 - 16:00

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Banload POST Checkin (dados)";flow:established,to server; content: "POST "; depth:5; content: ...

2008034

NEW - 26 Jul 2008 - 14:08

alert tcp $HOME NET any $EXTERNAL NET 25 (msg:"ET TROJAN LDPinch SMTP Password Report"; flow:established,to server; content:"Subject 3a Passes from "; depth:21 ...

2008411

NEW - 26 Jul 2008 - 14:08

alert tcp $HOME NET any $EXTERNAL NET 25 (msg:"ET TROJAN LDPinch SMTP Password Report with mail client The Bat!"; flow:established,to server; content:"X Mailer ...

2008447

alert udp any 53 $HOME NET any (msg:"ET CURRENT EVENTS DNS Query Responses with 3 RR's set (50 in 2 seconds) possible NS RR Cache Poisoning Attempt"; content ...

2008475

alert udp any 53 $HOME NET any (msg:"ET CURRENT EVENTS DNS Query Responses with 3 RR's set (50 in 2 seconds) possible A RR Cache Poisoning Attempt"; content ...

2008476

alert tcp any any $HOME NET 139:445 (msg:"ET EXPLOIT Foofus.net Password dumping, dll injection"; flow:to server,established; content:" 6c 00 73 00 72 00 65 00 ...

2008470

#alert udp any 53 $HOME NET any (msg:"ET CURRENT EVENTS Excessive NXDOMAIN responses Possible DNS Poisoning Attempt Backscatter"; byte test:1, ,128,2; byte test ...

2008471

NEW - 25 Jul 2008 - 18:22

alert tcp $EXTERNAL NET any $HOME NET any (msg:"ET TROJAN HotLan.C Spambot C C download command"; flow:established,from server; content:" 3B URL 3A http 3A 2F 2F ...

2008473

NEW - 25 Jul 2008 - 18:22

alert tcp $HOME NET 1024: $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN HotLan.C Spambot Trojan Activity"; flow:to server,established; content:"GET 20 "; offset:0; ...

2008474

NEW - 25 Jul 2008 - 17:00

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Look2Me Activity"; flow:established,to server; uricontent:"?B "; uricontent:" V "; uricontent ...

2008472

NEW - 25 Jul 2008 - 15:13

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET POLICY Netviewer.com Remote Control Proxy Test"; flow:established,to server; content:"POST /nvserver ...

2008468

NEW - 24 Jul 2008 - 19:05

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN LDPinch Checkin Flowbit set"; flow:established,to server; content:"POST "; depth:5; uricontent ...

2008469

NEW - 24 Jul 2008 - 19:05

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN LDPinch Checkin v2"; flowbits:isset,ET.PINCH; flow:established,to server; content:"a "; nocase ...

2008446

NEW - 24 Jul 2008 - 16:19

alert udp any 53 $DNS SERVERS any (msg:"ET CURRENT EVENTS Excessive DNS Responses with 1 or more RR's (100 in 10 seconds) possible Cache Poisoning Attempt"; ...

2008466

NEW - 24 Jul 2008 - 15:52

alert udp any 53 $HOME NET any (msg:"ET CURRENT EVENTS Excessive NXDOMAIN Responses (not authoritative)"; byte test:1, ,128,2; byte test:1, ,3, 1,relative; threshold ...

2008467

NEW - 24 Jul 2008 - 13:48

alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB Possible SQL Injection Attempt Danmec related (declare)"; flow:established,to server; uricontent ...

2008176

NEW - 24 Jul 2008 - 13:48

alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB Possible SQL Injection (exec)"; flow:established,to server; uricontent:"exec("; nocase; classtype ...

2008175

NEW - 24 Jul 2008 - 13:48

alert tcp $EXTERNAL NET any $HOME NET $HTTP PORTS (msg:"ET WEB Possible SQL Injection (varchar)"; flow:established,to server; uricontent:"varchar("; nocase; classtype ...

2008465

NEW - 23 Jul 2008 - 17:17

alert udp $HOME NET 1024: $EXTERNAL NET 1024: (msg:"ET TROJAN Backdoor Possible Backdoor.Cow Varient (Backdoor.Win32.Agent.lam) C C traffic"; content:" 6C 3C " ...

2001854

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE EZULA Spyware User Agent"; flow: established,to server; content:"User Agent\: ezula"; classtype ...

2008372

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Adsincontext.com Related Spyware User Agent (Connector v1.2)"; flow: established; content:"User ...

2001852

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE 404Search Spyware User Agent"; flow:established,to server; content:"User Agent\: 404search"; ...

2008457

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Deepdo Toolbar User Agent (FavUpdate)"; flow:established,to server; content:" 0d 0a User Agent ...

2008371

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Likely Ad ware installation phoning home (success and NSISDL User Agent)"; flow: established ...

2008423

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (CFS Agent)"; flow:established,to server; content:" 0d 0a User Agent\: ...

2008440

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (Download App)"; flow:established,to server; content:" 0d 0a User Agent ...

2008428

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (HTTP Downloader)"; flow: established,to server; content:" 0d 0a User Agent ...

2008422

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (Inet read)"; flow:established,to server; content:" 0d 0a User Agent\: ...

2001853

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Easy Search Bar Spyware User Agent"; flow: established,to server; content:"User Agent\: ESB" ...

2008374

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (InetURL)"; flow:established,to server; content:!"www.dell.com"; content ...

2008460

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (hacker)"; flow:established,to server; content:" 0d 0a User Agent\: hacker ...

2008429

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (HttpDownload)"; flow:established,to server; content:" 0d 0a User Agent ...

2001869

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Sidesearch Spyware User Agent"; flow: established,to server; content:"User Agent\: Sidesearch ...

2008413

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (PcPcUpdater)"; flow:established,to server; content:" 0d 0a User Agent ...

2008424

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (CFS DOWNLOAD)"; flow:established,to server; content:" 0d 0a User Agent ...

2008400

alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (ReadFileURL)"; flow:established,to server; content:" 0d 0a User Agent ...

2008463