http://docs.emergingthreats.net/bin/view/Main The web for users, groups and offices. TWiki is an Enterprise Collaboration Platform. en-us Copyright 2008 Emerging Threats and Contributing Authors Emerging Admin [jonkman@emergingthreats.net] The contributing authors of TWiki TWiki http://docs.emergingthreats.net/bin/view/Main http://docs.emergingthreats.net/pub/TWiki/TWikiLogos/T-logo-140x40-t.gif http://docs.emergingthreats.net/bin/view/Main/2008515 alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN AZG Checkin"; flow:established,to server; content:"GET "; depth:4; nocase; content:" 0d 0a User ... (last changed by TWikiGuest) 2008-08-20T04:30:23Z guest http://docs.emergingthreats.net/bin/view/Main/2008514 alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (AVP2006IE)"; flow:established,to server; content:" 0d 0a User Agent\: ... (last changed by TWikiGuest) 2008-08-19T22:30:21Z guest http://docs.emergingthreats.net/bin/view/Main/2008513 alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (msIE 7.0)"; flow:established,to server; content:" 0d 0a User Agent\: msIE ... (last changed by TWikiGuest) 2008-08-19T22:30:21Z guest http://docs.emergingthreats.net/bin/view/Main/2008512 alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent (C\:\\)"; flow:established,to server; content:" 0d 0a User Agent\: C\: ... (last changed by TWikiGuest) 2008-08-19T22:13:45Z guest http://docs.emergingthreats.net/bin/view/Main/2008511 alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET TROJAN Win32/Antivirus2008 Fake AV Install Report"; flow:established,to server; uricontent:"?type scanner ... (last changed by TWikiGuest) 2008-08-19T20:45:21Z guest http://docs.emergingthreats.net/bin/view/Main/2008510 alert tcp $HOME NET any $EXTERNAL NET $HTTP PORTS (msg:"ET MALWARE Suspicious User Agent Possible Trojan Downloader (\xa2\xa2HttpClient)"; flow:established,to ... (last changed by TWikiGuest) 2008-08-19T19:00:22Z guest http://docs.emergingthreats.net/bin/view/Main/2008341 alert tcp $EXTERNAL NET any $HOME NET any (msg:"ET TROJAN Themida Packed Binary Likely Hostile"; flow:established,from server; content:" 2E 69 64 61 74 61 20 ... (last changed by TWikiGuest) 2008-08-19T19:00:22Z guest http://docs.emergingthreats.net/bin/view/Main/2008315 alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET CURRENT EVENTS Iframe in Purported Image Download (png) Likely SQL Injection Attacks Related"; flow ... (last changed by TWikiGuest) 2008-08-19T19:00:22Z guest http://docs.emergingthreats.net/bin/view/Main/2008314 alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET CURRENT EVENTS Iframe in Purported Image Download (gif) Likely SQL Injection Attacks Related"; flow ... (last changed by TWikiGuest) 2008-08-19T19:00:22Z guest http://docs.emergingthreats.net/bin/view/Main/2008421 alert tcp $HOME NET any $EXTERNAL NET 53 (msg:"ET TROJAN HTTP POST Request on port 53 Very Likely Hostile"; flow:established,to server; content:"POST "; nocase ... (last changed by TWikiGuest) 2008-08-19T19:00:22Z guest http://docs.emergingthreats.net/bin/view/Main/2008420 alert tcp $HOME NET any $EXTERNAL NET 53 (msg:"ET TROJAN HTTP GET Request on port 53 Very Likely Hostile"; flow:established,to server; content:"GET "; nocase ... (last changed by TWikiGuest) 2008-08-19T19:00:22Z guest http://docs.emergingthreats.net/bin/view/Main/2008509 alert tcp $EXTERNAL NET any $HOME NET any (msg:"ET TROJAN VirtualProtect Packed Binary Likely Hostile"; flow:established,from server; content:" 2E 72 73 72 63 ... (last changed by TWikiGuest) 2008-08-19T19:00:22Z guest http://docs.emergingthreats.net/bin/view/Main/2008313 alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET CURRENT EVENTS Iframe in Purported Image Download (jpeg) Likely SQL Injection Attacks Related"; flow ... (last changed by TWikiGuest) 2008-08-19T19:00:22Z guest http://docs.emergingthreats.net/bin/view/Main/2008508 alert tcp $EXTERNAL NET $HTTP PORTS $HOME NET any (msg:"ET CURRENT EVENTS Internal User may have Visited an ASPROX Infected Site"; content:""; within:40; nocase ... (last changed by TWikiGuest) 2008-08-19T18:00:21Z guest http://docs.emergingthreats.net/bin/view/Main/ScottBlayney My Links .ATasteOfTWiki view a short introductory presentation on TWiki for beginners .WelcomeGuest starting points on TWiki .TWikiUsersGuide ... (last changed by TWikiRegistrationAgent) 2008-08-19T12:51:06Z TWikiRegistrationAgent http://docs.emergingthreats.net/bin/view/Main/RussianBusinessNetwork Emerging Threats Russian Business Network (RBN) Snort Intrusion Detection Rules : http://www.emergingthreats.net/rules/emerging rbn.rules http://www.emergingthreats ... (last changed by JamesMcQuaid) 2008-08-18T21:58:43Z JamesMcQuaid