EmergingThreats> Main Web>2002032 (revision 1)EditAttach

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN BOT - potential DDoS? command (1)"; flowbits:isset,is_proto_irc; flow: established; tag: host,300,seconds,dst; content:"."; distance:1; content:"."; distance:1; within:3; content:"."; distance:1; within:3; pcre:"/floodnet ([0-9]{1,3}\.){3}[0-9]{1,3}|(syn|udp) ([0-9]{1,3}\.){3}[0-9]{1,3}|(tcp|syn|udp|ack|ping|icmp)(flood)? ([0-9]{1,3}\.){3}[0-9]{1,3}/i"; classtype: trojan-activity; reference:url,doc.emergingthreats.net/2002032; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_IRC_Bots; sid: 2002032; rev:9;)

Added 2009-02-13 19:15:24 UTC


alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN BOT - potential DDoS? command (1)"; flowbits:isset,is_proto_irc; flow: established; tag: host,300,seconds,dst; content:"."; distance:1; content:"."; distance:1; within:3; content:"."; distance:1; within:3; pcre:"/floodnet ([0-9]{1,3}\.){3}[0-9]{1,3}|(syn|udp) ([0-9]{1,3}\.){3}[0-9]{1,3}|(tcp|syn|udp|ack|ping|icmp)(flood)? ([0-9]{1,3}\.){3}[0-9]{1,3}/i"; classtype: trojan-activity; reference:url,doc.emergingthreats.net/2002032; reference:url,www.emergingthreats.net/cgi-bin/cvsweb.cgi/sigs/VIRUS/TROJAN_IRC_Bots; sid: 2002032; rev:9;)

Added 2009-02-13 19:15:24 UTC


alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN BOT - potential DDoS? command (1)"; flowbits:isset,is_proto_irc; flow: established; tag: host,300,seconds,dst; content:"."; distance:1; content:"."; distance:1; within:3; content:"."; distance:1; within:3; pcre:"/floodnet ([0-9]{1,3}\.){3}[0-9]{1,3}|(syn|udp) ([0-9]{1,3}\.){3}[0-9]{1,3}|(tcp|syn|udp|ack|ping|icmp)(flood)? ([0-9]{1,3}\.){3}[0-9]{1,3}/i"; classtype: trojan-activity; sid: 2002032; rev:8;)

Added 2008-08-27 11:15:21 UTC


alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN BOT - potential DDoS? command (1)"; flowbits:isset,is_proto_irc; flow: established; tag: host,300,seconds,dst; content:"."; distance:1; content:"."; distance:1; within:3; content:"."; distance:1; within:3; pcre:"/floodnet ([0-9]{1,3}\.){3}[0-9]{1,3}|(syn|udp) ([0-9]{1,3}\.){3}[0-9]{1,3}|(tcp|syn|udp|ack|ping|icmp)(flood)? ([0-9]{1,3}\.){3}[0-9]{1,3}/i"; classtype: trojan-activity; sid: 2002032; rev:8;)

Added 2008-08-27 11:15:21 UTC


alert tcp any any -> any any (msg:"ET TROJAN BOT - potential DDoS? command (1)"; flowbits:isset,is_proto_irc; flow: established; tag: host,300,seconds,dst; content:"."; distance:1; content:"."; distance:1; within:3; content:"."; distance:1; within:3; pcre:"/floodnet ([0-9]{1,3}\.){3}[0-9]{1,3}|(syn|udp) ([0-9]{1,3}\.){3}[0-9]{1,3}|(tcp|syn|udp|ack|ping|icmp)(flood)? ([0-9]{1,3}\.){3}[0-9]{1,3}/i"; classtype: trojan-activity; sid: 2002032; rev:7;)

Added 2008-03-09 19:05:29 UTC


alert tcp any any -> any any (msg:"ET TROJAN BOT - potential DDoS? command (1)"; flowbits:isset,is_proto_irc; flow: established; tag: host,300,seconds,dst; content:"."; distance:1; content:"."; distance:1; within:3; content:"."; distance:1; within:3; pcre:"/floodnet ([0-9]{1,3}\.){3}[0-9]{1,3}|(syn|udp) ([0-9]{1,3}\.){3}[0-9]{1,3}|(tcp|syn|udp|ack|ping|icmp)(flood)? ([0-9]{1,3}\.){3}[0-9]{1,3}/i"; classtype: trojan-activity; sid: 2002032; rev:7;)

Added 2008-03-09 19:05:29 UTC


alert tcp any any -> any any (msg:"ET TROJAN BOT - potential DDoS? command (1)"; flowbits:isset,is_proto_irc; flow: established; tag: host,300,seconds,dst; content:"."; distance:1; content:"."; distance:1; within:3; content:"."; distance:1; within:3; pcre:"/floodnet ([0-9]{1,3}\.){3}[0-9]{1,3}|(syn|udp) ([0-9]{1,3}\.){3}[0-9]{1,3}|(tcp|syn|udp|ack|ping|icmp)(flood)? ([0-9]{1,3}\.){3}[0-9]{1,3}/i"; flowbits: set,trojan; classtype: trojan-activity; sid: 2002032; rev:6;)

Added 2008-01-31 10:12:23 UTC


alert tcp any any -> any any (msg:"ET TROJAN BOT - potential DDoS? command (1)"; flowbits:isset,is_proto_irc; flow: established; tag: host,300,seconds,dst; content:"."; distance:1; content:"."; distance:1; within:3; content:"."; distance:1; within:3; pcre:"/floodnet ([0-9]{1,3}\.){3}[0-9]{1,3}|(syn|udp) ([0-9]{1,3}\.){3}[0-9]{1,3}|(tcp|syn|udp|ack|ping|icmp)(flood)? ([0-9]{1,3}\.){3}[0-9]{1,3}/i"; flowbits: set,trojan; classtype: trojan-activity; sid: 2002032; rev:6;)

Added 2008-01-31 10:12:23 UTC


alert tcp any any -> any any (msg: "BLEEDING-EDGE TROJAN BOT - potential DDoS? command (1)"; flowbits:isset,is_proto_irc; flow: established; tag: host,300,seconds,dst; content:"."; distance:1; content:"."; distance:1; within:3; content:"."; distance:1; within:3; pcre:"/floodnet ([0-9]{1,3}\.){3}[0-9]{1,3}|(syn|udp) ([0-9]{1,3}\.){3}[0-9]{1,3}|(tcp|syn|udp|ack|ping|icmp)(flood)? ([0-9]{1,3}\.){3}[0-9]{1,3}/i"; flowbits: set,trojan; classtype: trojan-activity; sid: 2002032; rev:5; )



Edit | Attach | Print version | History: r2 < r1 | Backlinks | Raw View | Raw edit | More topic actions...
Topic revision: r1 - 2009-05-12 - MattJonkman
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats