From pepperjack at afferentsecurity.com  Mon Sep  1 09:31:36 2008
From: pepperjack at afferentsecurity.com (Jack Pepper)
Date: Mon, 01 Sep 2008 08:31:36 -0500
Subject: [Emerging-Sigs] rule for successful danmec
In-Reply-To: <48BB3E7A.608@jonkmans.com>
References: <20080829114710.va6805h8xwkwoosc@mail.afferentsecurity.com>
	<48BB3E7A.608@jonkmans.com>
Message-ID: <20080901083136.ed0e001auckk0oco@mail.afferentsecurity.com>

Quoting Matt Jonkman <jonkman at jonkmans.com>:

> Good idea, seen a lot of these. Will throw it into current events for a bit.
>

I would expect it to last no more than a week.  I will keep monitoring  
for a change.  A writer on another forum pointed out to me that this  
is not danmec, but is a "chinese malware" attack that ripped off the  
danmec code.

jp



-- 

Framework?  I don't need no stinking framework!

----------------------------------------------------------------
@fferent Security Labs:  Isolate/Insulate/Innovate  
http://www.afferentsecurity.com


From pepperjack at afferentsecurity.com  Mon Sep  1 10:17:04 2008
From: pepperjack at afferentsecurity.com (Jack Pepper)
Date: Mon, 01 Sep 2008 09:17:04 -0500
Subject: [Emerging-Sigs] updates for danmec rules
Message-ID: <20080901091704.rea15865w8ogo4cw@mail.afferentsecurity.com>


Joe Stewart has pointed out that the only filenames active on danmec are:

/b.js
/script.js
/ngg.js
/add.js
/lle.js
/portal.js
/che.js
/js.js
/fgg.js

So lets change 2008508:

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET  
CURRENT_EVENTS Internal User may have Visited an ASPROX Infected Site";
  content:"<script "; nocase; content:"src=http\://"; within:10;  
nocase; content:".js>"; within:40;
  nocase; pcre:"/script  
*src=http\:\/\/.*\/(ngg|js|b|fgg|che|script|add|lle|portal)\.js/i";  
classtype:trojan-activity; sid:2008508; rev:4;)

And 2008387 has become illogical.  Let's change the msg to correctly  
state that it's the XSS that's on the local sever, and enumerate JS  
file names:

alert tcp $HOME_NET $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ET  
CURRENT_EVENTS Possible ASPROX Hostile XSS Being Served by a Local  
Webserver";
  flow:established,from_server; content:"<script "; nocase;  
content:"src=http\://"; within:10; nocase; content:".js>"; within:40;
  nocase; pcre:"/script  
*src=http\:\/\/.*\/(ngg|js|b|fgg|che|script|add|lle|portal)\.js/i";  
classtype:trojan-activity; sid:2008387; rev:3;)



-- 

Framework?  I don't need no stinking framework!

----------------------------------------------------------------
@fferent Security Labs:  Isolate/Insulate/Innovate  
http://www.afferentsecurity.com


From emerging at emergingthreats.net  Mon Sep  1 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Mon,  1 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080901200008.307154502B@goliath.jonkmans.com>


[***] Results from Oinkmaster started Mon Sep  1 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008530 - ET CURRENT_EVENTS Danmec Infected machine Looking up CnC Server (emerging.rules)
 2008531 - ET CURRENT_EVENTS Infected System Looking up chr.santa-inbox.com CnC Server (emerging.rules)
 2008532 - ET TROJAN Bifrose Connect to Controller (variant 2) (emerging-virus.rules)


[///]     Modified active rules:     [///]

 2008402 - ET MALWARE Realtimegaming.com Online Casino Spyware Gaming Checkin (emerging-malware.rules)


[---]         Removed rules:         [---]

 2008403 - ET MALWARE Realtimegaming.com/Windows Casino Online Gaming Checkin (emerging-malware.rules)
 2008486 - CURRENT_EVENTS Fake Airline E-ticket Email Inbound (emerging.rules)
 2008499 - ET CURRENT_EVENTS Fake CNN alert Malware download (adobe_flash.exe) (emerging.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-sid-msg.map (3):
        2008530 || ET CURRENT_EVENTS Danmec Infected machine Looking up CnC Server
        2008531 || ET CURRENT_EVENTS Infected System Looking up chr.santa-inbox.com CnC Server
        2008532 || ET TROJAN Bifrose Connect to Controller (variant 2)

     -> Added to emerging-sid-msg.map.txt (3):
        2008530 || ET CURRENT_EVENTS Danmec Infected machine Looking up CnC Server
        2008531 || ET CURRENT_EVENTS Infected System Looking up chr.santa-inbox.com CnC Server
        2008532 || ET TROJAN Bifrose Connect to Controller (variant 2)

     -> Added to emerging.rules (2):
        #by Jack Pepper. Should be removed in a week or so
        #by matt jonkman

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-sid-msg.map (3):
        2008403 || ET MALWARE Realtimegaming.com/Windows Casino Online Gaming Checkin
        2008486 || CURRENT_EVENTS Fake Airline E-ticket Email Inbound || url,www.sophos.com/security/blog/2008/07/1604.html || url,www.us-cert.gov/current/archive/2008/07/31/archive.html#airline_e_ticket_email_attack
        2008499 || ET CURRENT_EVENTS Fake CNN alert Malware download (adobe_flash.exe) || url,info.prevx.com/aboutprogramtext.asp?PX5=8F3D24A4003F66983457019EED05CB00A97B99D5

     -> Removed from emerging-sid-msg.map.txt (3):
        2008403 || ET MALWARE Realtimegaming.com/Windows Casino Online Gaming Checkin
        2008486 || CURRENT_EVENTS Fake Airline E-ticket Email Inbound || url,www.sophos.com/security/blog/2008/07/1604.html || url,www.us-cert.gov/current/archive/2008/07/31/archive.html#airline_e_ticket_email_attack
        2008499 || ET CURRENT_EVENTS Fake CNN alert Malware download (adobe_flash.exe) || url,info.prevx.com/aboutprogramtext.asp?PX5=8F3D24A4003F66983457019EED05CB00A97B99D5

     -> Removed from emerging.rules (3):
        #by Will Metcalf, regarding the fake CNN alerts out there
        #by Chandan at secpod.com
        # 01/08/2008 E-Ticket


From spooker at gmail.com  Mon Sep  1 19:58:23 2008
From: spooker at gmail.com (Rodrigo Montoro(Sp0oKeR))
Date: Mon, 1 Sep 2008 20:58:23 -0300
Subject: [Emerging-Sigs] Ultrasurf Rules
Message-ID: <9255886c0809011658v3b3896e8u314f3000c830615f@mail.gmail.com>

I didn't see any rule about that and last week some guys from
brazilian snort group sent those rules about Ultrasurf (
http://www.ultrareach.com/about_en.htm ) Detection.

# Rule by SERPRO-Recife Security Team
alert udp $HOME_NET any -> $EXTERNAL_NET  53 (msg:"Possible External
Ultrasurf  DNS Query"; content:"|00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00|"; classtype:
policy-violation;threshold:type limit, track by_src,count 1, seconds
5; sid: 1000059; rev:2; )

# IP POOL by Augusto Ferronato

var ULTRASURF_POOL
[205.196.136.9,210.21.31.114,118.171.251.158,202.75.48.227,61.197.186.36,202.99.10.38,131.107.100.158,66.249.93.102,218.169.186.93,203.13.134.161,59.117.240.222,72.246.89.133,114.45.22.115,
198.22.236.38,70.85.195.236,220.138.148.35,59.117.240.222,118.161.206.194,67.137.230.73,220.136.233.18,
208.96.32.3,65.49.14.12,61.197.186.36,64.62.138.28,195.39.222.218,202.67.56.65,65.49.14.12,114.44.44.158,
210.208.94.226,203.30.164.150,64.38.220.186,202.99.10.38,219.85.5.60]

alert tcp $HOME_NET any -> $ULTRASURF_POOL 443 (msg:"Ultrasurf
Connection Detected"; flow:established;classtype:policy-violation;
sid:5000000; rev:3;)

Hope it helps!

Regards,

-- 
===========================
Rodrigo Montoro (Sp0oKeR)
Security Analyst
SnortCP / RHCE / LPIC-I / MCSO
http://www.spooker.com.br
http://www.snort.org.br
http://www.linkedin.com/in/spooker
===========================

From eslerj at gmail.com  Tue Sep  2 09:07:54 2008
From: eslerj at gmail.com (Joel Esler)
Date: Tue, 2 Sep 2008 09:07:54 -0400
Subject: [Emerging-Sigs] Ultrasurf Rules
In-Reply-To: <9255886c0809011658v3b3896e8u314f3000c830615f@mail.gmail.com>
References: <9255886c0809011658v3b3896e8u314f3000c830615f@mail.gmail.com>
Message-ID: <F1F217B1-89E5-4F31-AD7C-79800C42595E@gmail.com>

Sounds like a good list of IP's to block at the proxy/firewall points  
as well.

J

On Sep 1, 2008, at 7:58 PM, Rodrigo Montoro(Sp0oKeR) wrote:

> I didn't see any rule about that and last week some guys from
> brazilian snort group sent those rules about Ultrasurf (
> http://www.ultrareach.com/about_en.htm ) Detection.
>
> # Rule by SERPRO-Recife Security Team
> alert udp $HOME_NET any -> $EXTERNAL_NET  53 (msg:"Possible External
> Ultrasurf  DNS Query"; content:"|00 00 00 00 00 00 00 00 00 00 00 00
> 00 00 00 00 00 00 00 00 00 00|"; classtype:
> policy-violation;threshold:type limit, track by_src,count 1, seconds
> 5; sid: 1000059; rev:2; )
>
> # IP POOL by Augusto Ferronato
>
> var ULTRASURF_POOL
> [205.196.136.9,210.21.31.114,118.171.251.158,202.75.48.227,61.197.186.36,202.99.10.38,131.107.100.158,66.249.93.102,218.169.186.93,203.13.134.161,59.117.240.222,72.246.89.133,114.45.22.115 
> ,
> 198.22.236.38,70.85.195.236,220.138.148.35,59.117.240.222,118.161.206.194,67.137.230.73,220.136.233.18 
> ,
> 208.96.32.3,65.49.14.12,61.197.186.36,64.62.138.28,195.39.222.218,202.67.56.65,65.49.14.12,114.44.44.158 
> ,
> 210.208.94.226,203.30.164.150,64.38.220.186,202.99.10.38,219.85.5.60]
>
> alert tcp $HOME_NET any -> $ULTRASURF_POOL 443 (msg:"Ultrasurf
> Connection Detected"; flow:established;classtype:policy-violation;
> sid:5000000; rev:3;)
>
> Hope it helps!
>
> Regards,
>
> -- 
> ===========================
> Rodrigo Montoro (Sp0oKeR)
> Security Analyst
> SnortCP / RHCE / LPIC-I / MCSO
> http://www.spooker.com.br
> http://www.snort.org.br
> http://www.linkedin.com/in/spooker
> ===========================
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs


--
Joel Esler
?  http://blog.joelesler.net
?  http://www.dearcupertino.com
[m]



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080902/82379bc3/attachment.html

From jonkman at jonkmans.com  Tue Sep  2 09:20:08 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Tue, 02 Sep 2008 09:20:08 -0400
Subject: [Emerging-Sigs] Ultrasurf Rules
In-Reply-To: <F1F217B1-89E5-4F31-AD7C-79800C42595E@gmail.com>
References: <9255886c0809011658v3b3896e8u314f3000c830615f@mail.gmail.com>
	<F1F217B1-89E5-4F31-AD7C-79800C42595E@gmail.com>
Message-ID: <48BD3D88.8030304@jonkmans.com>

Posting the first rule now. Adding a new var is something I try to
avoid, causes issues in new configs. How about we put those IPs into the
rule itself? Easier to update them down the road.

As for blocking, not sure I would. No hostile activity necessarily. But
it'll be very interesting to know who's surfing you via this tool!

Will be in the ruleset momentarily. Great research Rodrigo!

Matt

Joel Esler wrote:
> Sounds like a good list of IP's to block at the proxy/firewall points as
> well.
> 
> J
> 
> On Sep 1, 2008, at 7:58 PM, Rodrigo Montoro(Sp0oKeR) wrote:
> 
>> I didn't see any rule about that and last week some guys from
>> brazilian snort group sent those rules about Ultrasurf (
>> http://www.ultrareach.com/about_en.htm ) Detection.
>>
>> # Rule by SERPRO-Recife Security Team
>> alert udp $HOME_NET any -> $EXTERNAL_NET  53 (msg:"Possible External
>> Ultrasurf  DNS Query"; content:"|00 00 00 00 00 00 00 00 00 00 00 00
>> 00 00 00 00 00 00 00 00 00 00|"; classtype:
>> policy-violation;threshold:type limit, track by_src,count 1, seconds
>> 5; sid: 1000059; rev:2; )
>>
>> # IP POOL by Augusto Ferronato
>>
>> var ULTRASURF_POOL
>> [205.196.136.9,210.21.31.114,118.171.251.158,202.75.48.227,61.197.186.36,202.99.10.38,131.107.100.158,66.249.93.102,218.169.186.93,203.13.134.161,59.117.240.222,72.246.89.133,114.45.22.115,
>> 198.22.236.38,70.85.195.236,220.138.148.35,59.117.240.222,118.161.206.194,67.137.230.73,220.136.233.18,
>> 208.96.32.3,65.49.14.12,61.197.186.36,64.62.138.28,195.39.222.218,202.67.56.65,65.49.14.12,114.44.44.158,
>> 210.208.94.226,203.30.164.150,64.38.220.186,202.99.10.38,219.85.5.60]
>>
>> alert tcp $HOME_NET any -> $ULTRASURF_POOL 443 (msg:"Ultrasurf
>> Connection Detected"; flow:established;classtype:policy-violation;
>> sid:5000000; rev:3;)
>>
>> Hope it helps!
>>
>> Regards,
>>
>> -- 
>> ===========================
>> Rodrigo Montoro (Sp0oKeR)
>> Security Analyst
>> SnortCP / RHCE / LPIC-I / MCSO
>> http://www.spooker.com.br
>> http://www.snort.org.br
>> http://www.linkedin.com/in/spooker
>> ===========================
>> _______________________________________________
>> Emerging-sigs mailing list
>> Emerging-sigs at emergingthreats.net
>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
> 
> 
> --
> Joel Esler
> ?  http://blog.joelesler.net
> ?  http://www.dearcupertino.com
> [m]
> 
> 
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From spooker at gmail.com  Tue Sep  2 09:28:40 2008
From: spooker at gmail.com (Rodrigo Montoro(Sp0oKeR))
Date: Tue, 2 Sep 2008 10:28:40 -0300
Subject: [Emerging-Sigs] Ultrasurf Rules
In-Reply-To: <F1F217B1-89E5-4F31-AD7C-79800C42595E@gmail.com>
References: <9255886c0809011658v3b3896e8u314f3000c830615f@mail.gmail.com>
	<F1F217B1-89E5-4F31-AD7C-79800C42595E@gmail.com>
Message-ID: <9255886c0809020628n5763ef74t7d23ccb19a61d82d@mail.gmail.com>

I agree with you !

But it's good to see if your firewall is really working because it
will only alert on established connections =)

Regards,

On Tue, Sep 2, 2008 at 10:07 AM, Joel Esler <eslerj at gmail.com> wrote:
> Sounds like a good list of IP's to block at the proxy/firewall points as
> well.
> J
> On Sep 1, 2008, at 7:58 PM, Rodrigo Montoro(Sp0oKeR) wrote:
>
> I didn't see any rule about that and last week some guys from
> brazilian snort group sent those rules about Ultrasurf (
> http://www.ultrareach.com/about_en.htm ) Detection.
>
> # Rule by SERPRO-Recife Security Team
> alert udp $HOME_NET any -> $EXTERNAL_NET  53 (msg:"Possible External
> Ultrasurf  DNS Query"; content:"|00 00 00 00 00 00 00 00 00 00 00 00
> 00 00 00 00 00 00 00 00 00 00|"; classtype:
> policy-violation;threshold:type limit, track by_src,count 1, seconds
> 5; sid: 1000059; rev:2; )
>
> # IP POOL by Augusto Ferronato
>
> var ULTRASURF_POOL
> [205.196.136.9,210.21.31.114,118.171.251.158,202.75.48.227,61.197.186.36,202.99.10.38,131.107.100.158,66.249.93.102,218.169.186.93,203.13.134.161,59.117.240.222,72.246.89.133,114.45.22.115,
> 198.22.236.38,70.85.195.236,220.138.148.35,59.117.240.222,118.161.206.194,67.137.230.73,220.136.233.18,
> 208.96.32.3,65.49.14.12,61.197.186.36,64.62.138.28,195.39.222.218,202.67.56.65,65.49.14.12,114.44.44.158,
> 210.208.94.226,203.30.164.150,64.38.220.186,202.99.10.38,219.85.5.60]
>
> alert tcp $HOME_NET any -> $ULTRASURF_POOL 443 (msg:"Ultrasurf
> Connection Detected"; flow:established;classtype:policy-violation;
> sid:5000000; rev:3;)
>
> Hope it helps!
>
> Regards,
>
> --
> ===========================
> Rodrigo Montoro (Sp0oKeR)
> Security Analyst
> SnortCP / RHCE / LPIC-I / MCSO
> http://www.spooker.com.br
> http://www.snort.org.br
> http://www.linkedin.com/in/spooker
> ===========================
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>
>
> --
> Joel Esler
> ?  http://blog.joelesler.net
> ?  http://www.dearcupertino.com
> [m]
>
>
>



-- 
===========================
Rodrigo Montoro (Sp0oKeR)
Security Analyst
SnortCP / RHCE / LPIC-I / MCSO
http://www.spooker.com.br
http://www.snort.org.br
http://www.linkedin.com/in/spooker
===========================

From spooker at gmail.com  Tue Sep  2 09:34:36 2008
From: spooker at gmail.com (Rodrigo Montoro(Sp0oKeR))
Date: Tue, 2 Sep 2008 10:34:36 -0300
Subject: [Emerging-Sigs] Ultrasurf Rules
In-Reply-To: <48BD3D88.8030304@jonkmans.com>
References: <9255886c0809011658v3b3896e8u314f3000c830615f@mail.gmail.com>
	<F1F217B1-89E5-4F31-AD7C-79800C42595E@gmail.com>
	<48BD3D88.8030304@jonkmans.com>
Message-ID: <9255886c0809020634j57fe8cf9g59a7c9b4bae6a762@mail.gmail.com>

You are right! I just forwarded what Augusto posted but for sure it's
easier in this way .

BTW it's not my research ! It's Serpro's Security Team and Augusto
Ferronato work I'm justing sharing them =)

Regards,

Rodrigo Montoro (Sp0oKeR)

On Tue, Sep 2, 2008 at 10:20 AM, Matt Jonkman <jonkman at jonkmans.com> wrote:
> Posting the first rule now. Adding a new var is something I try to
> avoid, causes issues in new configs. How about we put those IPs into the
> rule itself? Easier to update them down the road.
>
> As for blocking, not sure I would. No hostile activity necessarily. But
> it'll be very interesting to know who's surfing you via this tool!
>
> Will be in the ruleset momentarily. Great research Rodrigo!
>
> Matt
>
> Joel Esler wrote:
>> Sounds like a good list of IP's to block at the proxy/firewall points as
>> well.
>>
>> J
>>
>> On Sep 1, 2008, at 7:58 PM, Rodrigo Montoro(Sp0oKeR) wrote:
>>
>>> I didn't see any rule about that and last week some guys from
>>> brazilian snort group sent those rules about Ultrasurf (
>>> http://www.ultrareach.com/about_en.htm ) Detection.
>>>
>>> # Rule by SERPRO-Recife Security Team
>>> alert udp $HOME_NET any -> $EXTERNAL_NET  53 (msg:"Possible External
>>> Ultrasurf  DNS Query"; content:"|00 00 00 00 00 00 00 00 00 00 00 00
>>> 00 00 00 00 00 00 00 00 00 00|"; classtype:
>>> policy-violation;threshold:type limit, track by_src,count 1, seconds
>>> 5; sid: 1000059; rev:2; )
>>>
>>> # IP POOL by Augusto Ferronato
>>>
>>> var ULTRASURF_POOL
>>> [205.196.136.9,210.21.31.114,118.171.251.158,202.75.48.227,61.197.186.36,202.99.10.38,131.107.100.158,66.249.93.102,218.169.186.93,203.13.134.161,59.117.240.222,72.246.89.133,114.45.22.115,
>>> 198.22.236.38,70.85.195.236,220.138.148.35,59.117.240.222,118.161.206.194,67.137.230.73,220.136.233.18,
>>> 208.96.32.3,65.49.14.12,61.197.186.36,64.62.138.28,195.39.222.218,202.67.56.65,65.49.14.12,114.44.44.158,
>>> 210.208.94.226,203.30.164.150,64.38.220.186,202.99.10.38,219.85.5.60]
>>>
>>> alert tcp $HOME_NET any -> $ULTRASURF_POOL 443 (msg:"Ultrasurf
>>> Connection Detected"; flow:established;classtype:policy-violation;
>>> sid:5000000; rev:3;)
>>>
>>> Hope it helps!
>>>
>>> Regards,
>>>
>>> --
>>> ===========================
>>> Rodrigo Montoro (Sp0oKeR)
>>> Security Analyst
>>> SnortCP / RHCE / LPIC-I / MCSO
>>> http://www.spooker.com.br
>>> http://www.snort.org.br
>>> http://www.linkedin.com/in/spooker
>>> ===========================
>>> _______________________________________________
>>> Emerging-sigs mailing list
>>> Emerging-sigs at emergingthreats.net
>>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>>
>>
>> --
>> Joel Esler
>> ?  http://blog.joelesler.net
>> ?  http://www.dearcupertino.com
>> [m]
>>
>>
>>
>>
>> ------------------------------------------------------------------------
>>
>> _______________________________________________
>> Emerging-sigs mailing list
>> Emerging-sigs at emergingthreats.net
>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>
> --
> --------------------------------------------
> Matthew Jonkman
> Emerging Threats
> Phone 765-429-0398
> Fax 312-264-0205
> http://www.emergingthreats.net
> --------------------------------------------
>
> PGP: http://www.jonkmans.com/mattjonkman.asc
>
>
>



-- 
===========================
Rodrigo Montoro (Sp0oKeR)
Security Analyst
SnortCP / RHCE / LPIC-I / MCSO
http://www.spooker.com.br
http://www.snort.org.br
http://www.linkedin.com/in/spooker
===========================

From eslerj at gmail.com  Tue Sep  2 09:34:50 2008
From: eslerj at gmail.com (Joel Esler)
Date: Tue, 2 Sep 2008 09:34:50 -0400
Subject: [Emerging-Sigs] Ultrasurf Rules
In-Reply-To: <9255886c0809020628n5763ef74t7d23ccb19a61d82d@mail.gmail.com>
References: <9255886c0809011658v3b3896e8u314f3000c830615f@mail.gmail.com>
	<F1F217B1-89E5-4F31-AD7C-79800C42595E@gmail.com>
	<9255886c0809020628n5763ef74t7d23ccb19a61d82d@mail.gmail.com>
Message-ID: <4091419E-121E-4F69-8B24-CA9A8B1E4AAB@gmail.com>

Depending on where your IDS is sitting, yes, I agree.

J

On Sep 2, 2008, at 9:28 AM, Rodrigo Montoro(Sp0oKeR) wrote:

> I agree with you !
>
> But it's good to see if your firewall is really working because it
> will only alert on established connections =)
>
> Regards,
>
> On Tue, Sep 2, 2008 at 10:07 AM, Joel Esler <eslerj at gmail.com> wrote:
>> Sounds like a good list of IP's to block at the proxy/firewall  
>> points as
>> well.
>> J
>> On Sep 1, 2008, at 7:58 PM, Rodrigo Montoro(Sp0oKeR) wrote:
>>
>> I didn't see any rule about that and last week some guys from
>> brazilian snort group sent those rules about Ultrasurf (
>> http://www.ultrareach.com/about_en.htm ) Detection.
>>
>> # Rule by SERPRO-Recife Security Team
>> alert udp $HOME_NET any -> $EXTERNAL_NET  53 (msg:"Possible External
>> Ultrasurf  DNS Query"; content:"|00 00 00 00 00 00 00 00 00 00 00 00
>> 00 00 00 00 00 00 00 00 00 00|"; classtype:
>> policy-violation;threshold:type limit, track by_src,count 1, seconds
>> 5; sid: 1000059; rev:2; )
>>
>> # IP POOL by Augusto Ferronato
>>
>> var ULTRASURF_POOL
>> [205.196.136.9,210.21.31.114,118.171.251.158,202.75.48.227,61.197.186.36,202.99.10.38,131.107.100.158,66.249.93.102,218.169.186.93,203.13.134.161,59.117.240.222,72.246.89.133,114.45.22.115 
>> ,
>> 198.22.236.38,70.85.195.236,220.138.148.35,59.117.240.222,118.161.206.194,67.137.230.73,220.136.233.18 
>> ,
>> 208.96.32.3,65.49.14.12,61.197.186.36,64.62.138.28,195.39.222.218,202.67.56.65,65.49.14.12,114.44.44.158 
>> ,
>> 210.208.94.226,203.30.164.150,64.38.220.186,202.99.10.38,219.85.5.60]
>>
>> alert tcp $HOME_NET any -> $ULTRASURF_POOL 443 (msg:"Ultrasurf
>> Connection Detected"; flow:established;classtype:policy-violation;
>> sid:5000000; rev:3;)
>>
>> Hope it helps!
>>
>> Regards,
>>
>> --
>> ===========================
>> Rodrigo Montoro (Sp0oKeR)
>> Security Analyst
>> SnortCP / RHCE / LPIC-I / MCSO
>> http://www.spooker.com.br
>> http://www.snort.org.br
>> http://www.linkedin.com/in/spooker
>> ===========================
>> _______________________________________________
>> Emerging-sigs mailing list
>> Emerging-sigs at emergingthreats.net
>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>>
>>
>> --
>> Joel Esler
>> ?  http://blog.joelesler.net
>> ?  http://www.dearcupertino.com
>> [m]
>>
>>
>>
>
>
>
> -- 
> ===========================
> Rodrigo Montoro (Sp0oKeR)
> Security Analyst
> SnortCP / RHCE / LPIC-I / MCSO
> http://www.spooker.com.br
> http://www.snort.org.br
> http://www.linkedin.com/in/spooker
> ===========================


--
Joel Esler
?  http://blog.joelesler.net
?  http://www.dearcupertino.com
[m]



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080902/5a8def93/attachment.html

From jonkman at jonkmans.com  Tue Sep  2 09:36:34 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Tue, 02 Sep 2008 09:36:34 -0400
Subject: [Emerging-Sigs] Ultrasurf Rules
In-Reply-To: <48BD3D88.8030304@jonkmans.com>
References: <9255886c0809011658v3b3896e8u314f3000c830615f@mail.gmail.com>	<F1F217B1-89E5-4F31-AD7C-79800C42595E@gmail.com>
	<48BD3D88.8030304@jonkmans.com>
Message-ID: <48BD4162.7080706@jonkmans.com>

I did this:

# Rule by SERPRO-Recife Security Team
alert udp $HOME_NET any -> $EXTERNAL_NET  53 (msg:"ET POLICY Possible
External Ultrasurf Anonymizer DNS Query"; content:"|00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|";
classtype:policy-violation; threshold:type limit, track by_src,count 1,
seconds 60; sid:2008533; rev:1;)

# IP POOL by Augusto Ferronato
alert tcp $HOME_NET any ->
[205.196.136.9,210.21.31.114,118.171.251.158,202.75.48.227,61.197.186.36,202.99.10.38,131.107.100.158,66.249.93.102,218.169.186.93,203.13.134.161,59.117.240.222,72.246.89.133,114.45.22.115,198.22.236.38,70.85.195.236,220.138.148.35,59.117.240.222,118.161.206.194,67.137.230.73,220.136.233.18,
208.96.32.3,65.49.14.12,61.197.186.36,64.62.138.28,195.39.222.218,202.67.56.65,65.49.14.12,114.44.44.158,
210.208.94.226,203.30.164.150,64.38.220.186,202.99.10.38,219.85.5.60]
443 (msg:"ET POLICY Ultrasurf Anonymizer Connection Outbound";
flow:established; threshold:type both, count 1, track by_dst, seconds
60; classtype:policy-violation; sid:2008534; rev:1;)
alert tcp
[205.196.136.9,210.21.31.114,118.171.251.158,202.75.48.227,61.197.186.36,202.99.10.38,131.107.100.158,66.249.93.102,218.169.186.93,203.13.134.161,59.117.240.222,72.246.89.133,114.45.22.115,198.22.236.38,70.85.195.236,220.138.148.35,59.117.240.222,118.161.206.194,67.137.230.73,220.136.233.18,
208.96.32.3,65.49.14.12,61.197.186.36,64.62.138.28,195.39.222.218,202.67.56.65,65.49.14.12,114.44.44.158,
210.208.94.226,203.30.164.150,64.38.220.186,202.99.10.38,219.85.5.60]
any -> $HOME_NET any (msg:"ET POLICY Ultrasurf Anonymizer Connection
Inbound"; flow:established; threshold:type both, count 1, track by_src,
seconds 60; classtype:policy-violation; sid:2008535; rev:1;)


Added an in and outbound rule for the IP pool. I think it'll be most
interesting to know if you are being surfed by anonymized users. But
you'll also know if you have internal users using the service, a likely
sign of a porn habit. :)

matt

Matt Jonkman wrote:
> Posting the first rule now. Adding a new var is something I try to
> avoid, causes issues in new configs. How about we put those IPs into the
> rule itself? Easier to update them down the road.
> 
> As for blocking, not sure I would. No hostile activity necessarily. But
> it'll be very interesting to know who's surfing you via this tool!
> 
> Will be in the ruleset momentarily. Great research Rodrigo!
> 
> Matt
> 
> Joel Esler wrote:
>> Sounds like a good list of IP's to block at the proxy/firewall points as
>> well.
>>
>> J
>>
>> On Sep 1, 2008, at 7:58 PM, Rodrigo Montoro(Sp0oKeR) wrote:
>>
>>> I didn't see any rule about that and last week some guys from
>>> brazilian snort group sent those rules about Ultrasurf (
>>> http://www.ultrareach.com/about_en.htm ) Detection.
>>>
>>> # Rule by SERPRO-Recife Security Team
>>> alert udp $HOME_NET any -> $EXTERNAL_NET  53 (msg:"Possible External
>>> Ultrasurf  DNS Query"; content:"|00 00 00 00 00 00 00 00 00 00 00 00
>>> 00 00 00 00 00 00 00 00 00 00|"; classtype:
>>> policy-violation;threshold:type limit, track by_src,count 1, seconds
>>> 5; sid: 1000059; rev:2; )
>>>
>>> # IP POOL by Augusto Ferronato
>>>
>>> var ULTRASURF_POOL
>>> [205.196.136.9,210.21.31.114,118.171.251.158,202.75.48.227,61.197.186.36,202.99.10.38,131.107.100.158,66.249.93.102,218.169.186.93,203.13.134.161,59.117.240.222,72.246.89.133,114.45.22.115,
>>> 198.22.236.38,70.85.195.236,220.138.148.35,59.117.240.222,118.161.206.194,67.137.230.73,220.136.233.18,
>>> 208.96.32.3,65.49.14.12,61.197.186.36,64.62.138.28,195.39.222.218,202.67.56.65,65.49.14.12,114.44.44.158,
>>> 210.208.94.226,203.30.164.150,64.38.220.186,202.99.10.38,219.85.5.60]
>>>
>>> alert tcp $HOME_NET any -> $ULTRASURF_POOL 443 (msg:"Ultrasurf
>>> Connection Detected"; flow:established;classtype:policy-violation;
>>> sid:5000000; rev:3;)
>>>
>>> Hope it helps!
>>>
>>> Regards,
>>>
>>> -- 
>>> ===========================
>>> Rodrigo Montoro (Sp0oKeR)
>>> Security Analyst
>>> SnortCP / RHCE / LPIC-I / MCSO
>>> http://www.spooker.com.br
>>> http://www.snort.org.br
>>> http://www.linkedin.com/in/spooker
>>> ===========================
>>> _______________________________________________
>>> Emerging-sigs mailing list
>>> Emerging-sigs at emergingthreats.net
>>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>>
>> --
>> Joel Esler
>> ?  http://blog.joelesler.net
>> ?  http://www.dearcupertino.com
>> [m]
>>
>>
>>
>>
>> ------------------------------------------------------------------------
>>
>> _______________________________________________
>> Emerging-sigs mailing list
>> Emerging-sigs at emergingthreats.net
>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
> 

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From spooker at gmail.com  Tue Sep  2 09:44:16 2008
From: spooker at gmail.com (Rodrigo Montoro(Sp0oKeR))
Date: Tue, 2 Sep 2008 10:44:16 -0300
Subject: [Emerging-Sigs] Ultrasurf Rules
In-Reply-To: <48BD4162.7080706@jonkmans.com>
References: <9255886c0809011658v3b3896e8u314f3000c830615f@mail.gmail.com>
	<F1F217B1-89E5-4F31-AD7C-79800C42595E@gmail.com>
	<48BD3D88.8030304@jonkmans.com> <48BD4162.7080706@jonkmans.com>
Message-ID: <9255886c0809020644o5ce3012dw1fcde05fe1795b7e@mail.gmail.com>

Great Matt! =)

Regards,

On Tue, Sep 2, 2008 at 10:36 AM, Matt Jonkman <jonkman at jonkmans.com> wrote:
> I did this:
>
> # Rule by SERPRO-Recife Security Team
> alert udp $HOME_NET any -> $EXTERNAL_NET  53 (msg:"ET POLICY Possible
> External Ultrasurf Anonymizer DNS Query"; content:"|00 00 00 00 00 00 00
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|";
> classtype:policy-violation; threshold:type limit, track by_src,count 1,
> seconds 60; sid:2008533; rev:1;)
>
> # IP POOL by Augusto Ferronato
> alert tcp $HOME_NET any ->
> [205.196.136.9,210.21.31.114,118.171.251.158,202.75.48.227,61.197.186.36,202.99.10.38,131.107.100.158,66.249.93.102,218.169.186.93,203.13.134.161,59.117.240.222,72.246.89.133,114.45.22.115,198.22.236.38,70.85.195.236,220.138.148.35,59.117.240.222,118.161.206.194,67.137.230.73,220.136.233.18,
> 208.96.32.3,65.49.14.12,61.197.186.36,64.62.138.28,195.39.222.218,202.67.56.65,65.49.14.12,114.44.44.158,
> 210.208.94.226,203.30.164.150,64.38.220.186,202.99.10.38,219.85.5.60]
> 443 (msg:"ET POLICY Ultrasurf Anonymizer Connection Outbound";
> flow:established; threshold:type both, count 1, track by_dst, seconds
> 60; classtype:policy-violation; sid:2008534; rev:1;)
> alert tcp
> [205.196.136.9,210.21.31.114,118.171.251.158,202.75.48.227,61.197.186.36,202.99.10.38,131.107.100.158,66.249.93.102,218.169.186.93,203.13.134.161,59.117.240.222,72.246.89.133,114.45.22.115,198.22.236.38,70.85.195.236,220.138.148.35,59.117.240.222,118.161.206.194,67.137.230.73,220.136.233.18,
> 208.96.32.3,65.49.14.12,61.197.186.36,64.62.138.28,195.39.222.218,202.67.56.65,65.49.14.12,114.44.44.158,
> 210.208.94.226,203.30.164.150,64.38.220.186,202.99.10.38,219.85.5.60]
> any -> $HOME_NET any (msg:"ET POLICY Ultrasurf Anonymizer Connection
> Inbound"; flow:established; threshold:type both, count 1, track by_src,
> seconds 60; classtype:policy-violation; sid:2008535; rev:1;)
>
>
> Added an in and outbound rule for the IP pool. I think it'll be most
> interesting to know if you are being surfed by anonymized users. But
> you'll also know if you have internal users using the service, a likely
> sign of a porn habit. :)
>
> matt
>
> Matt Jonkman wrote:
>> Posting the first rule now. Adding a new var is something I try to
>> avoid, causes issues in new configs. How about we put those IPs into the
>> rule itself? Easier to update them down the road.
>>
>> As for blocking, not sure I would. No hostile activity necessarily. But
>> it'll be very interesting to know who's surfing you via this tool!
>>
>> Will be in the ruleset momentarily. Great research Rodrigo!
>>
>> Matt
>>
>> Joel Esler wrote:
>>> Sounds like a good list of IP's to block at the proxy/firewall points as
>>> well.
>>>
>>> J
>>>
>>> On Sep 1, 2008, at 7:58 PM, Rodrigo Montoro(Sp0oKeR) wrote:
>>>
>>>> I didn't see any rule about that and last week some guys from
>>>> brazilian snort group sent those rules about Ultrasurf (
>>>> http://www.ultrareach.com/about_en.htm ) Detection.
>>>>
>>>> # Rule by SERPRO-Recife Security Team
>>>> alert udp $HOME_NET any -> $EXTERNAL_NET  53 (msg:"Possible External
>>>> Ultrasurf  DNS Query"; content:"|00 00 00 00 00 00 00 00 00 00 00 00
>>>> 00 00 00 00 00 00 00 00 00 00|"; classtype:
>>>> policy-violation;threshold:type limit, track by_src,count 1, seconds
>>>> 5; sid: 1000059; rev:2; )
>>>>
>>>> # IP POOL by Augusto Ferronato
>>>>
>>>> var ULTRASURF_POOL
>>>> [205.196.136.9,210.21.31.114,118.171.251.158,202.75.48.227,61.197.186.36,202.99.10.38,131.107.100.158,66.249.93.102,218.169.186.93,203.13.134.161,59.117.240.222,72.246.89.133,114.45.22.115,
>>>> 198.22.236.38,70.85.195.236,220.138.148.35,59.117.240.222,118.161.206.194,67.137.230.73,220.136.233.18,
>>>> 208.96.32.3,65.49.14.12,61.197.186.36,64.62.138.28,195.39.222.218,202.67.56.65,65.49.14.12,114.44.44.158,
>>>> 210.208.94.226,203.30.164.150,64.38.220.186,202.99.10.38,219.85.5.60]
>>>>
>>>> alert tcp $HOME_NET any -> $ULTRASURF_POOL 443 (msg:"Ultrasurf
>>>> Connection Detected"; flow:established;classtype:policy-violation;
>>>> sid:5000000; rev:3;)
>>>>
>>>> Hope it helps!
>>>>
>>>> Regards,
>>>>
>>>> --
>>>> ===========================
>>>> Rodrigo Montoro (Sp0oKeR)
>>>> Security Analyst
>>>> SnortCP / RHCE / LPIC-I / MCSO
>>>> http://www.spooker.com.br
>>>> http://www.snort.org.br
>>>> http://www.linkedin.com/in/spooker
>>>> ===========================
>>>> _______________________________________________
>>>> Emerging-sigs mailing list
>>>> Emerging-sigs at emergingthreats.net
>>>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>>>
>>> --
>>> Joel Esler
>>> ?  http://blog.joelesler.net
>>> ?  http://www.dearcupertino.com
>>> [m]
>>>
>>>
>>>
>>>
>>> ------------------------------------------------------------------------
>>>
>>> _______________________________________________
>>> Emerging-sigs mailing list
>>> Emerging-sigs at emergingthreats.net
>>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>>
>
> --
> --------------------------------------------
> Matthew Jonkman
> Emerging Threats
> Phone 765-429-0398
> Fax 312-264-0205
> http://www.emergingthreats.net
> --------------------------------------------
>
> PGP: http://www.jonkmans.com/mattjonkman.asc
>
>
>



-- 
===========================
Rodrigo Montoro (Sp0oKeR)
Security Analyst
SnortCP / RHCE / LPIC-I / MCSO
http://www.spooker.com.br
http://www.snort.org.br
http://www.linkedin.com/in/spooker
===========================

From rullric at utah.gov  Tue Sep  2 12:14:38 2008
From: rullric at utah.gov (Richard Ullrich)
Date: Tue, 02 Sep 2008 10:14:38 -0600
Subject: [Emerging-Sigs] Extra space in sid:2008533;
Message-ID: <48BD124D.8924.00FD.0@utah.gov>

Snort crashes...  <G>




From jonkman at jonkmans.com  Tue Sep  2 14:12:15 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Tue, 02 Sep 2008 14:12:15 -0400
Subject: [Emerging-Sigs] Extra space in sid:2008533;
In-Reply-To: <48BD124D.8924.00FD.0@utah.gov>
References: <48BD124D.8924.00FD.0@utah.gov>
Message-ID: <48BD81FF.50706@jonkmans.com>

Fixed, thanks for the note.

You'd think the parser would improve, not digress as we go along... a
spare space is definitely a new problem.

Matt

Richard Ullrich wrote:
> Snort crashes...  <G>
> 
> 
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Tue Sep  2 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Tue,  2 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080902200008.2D7E04502D@goliath.jonkmans.com>


[***] Results from Oinkmaster started Tue Sep  2 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008533 - ET POLICY Possible External Ultrasurf Anonymizer DNS Query (emerging-policy.rules)
 2008534 - ET POLICY Ultrasurf Anonymizer Connection Outbound (emerging-policy.rules)
 2008535 - ET POLICY Ultrasurf Anonymizer Connection Inbound (emerging-policy.rules)
 2008536 - ET SCAN Halberd Load Balanced Webserver Detection Scan (emerging-scan.rules)
 2008537 - ET SCAN Hmap Webserver Fingerprint Scan (emerging-scan.rules)


[///]     Modified active rules:     [///]

 2003578 - ET MALWARE Baidu.com Spyware Bar Pulling Data (emerging-malware.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-policy.rules (3):
        # from Rodrigo Montoro(Sp0oKeR). This isn't a hostile app, but may be interesting to know who's using it
        # Rule by SERPRO-Recife Security Team
        # IP POOL by Augusto Ferronato

     -> Added to emerging-sid-msg.map (5):
        2008533 || ET POLICY Possible External Ultrasurf Anonymizer DNS Query
        2008534 || ET POLICY Ultrasurf Anonymizer Connection Outbound
        2008535 || ET POLICY Ultrasurf Anonymizer Connection Inbound
        2008536 || ET SCAN Halberd Load Balanced Webserver Detection Scan || url,www.halberd.superadditive.com
        2008537 || ET SCAN Hmap Webserver Fingerprint Scan || url,www.ujeni.murkyroc.com/hmap/

     -> Added to emerging-sid-msg.map.txt (5):
        2008533 || ET POLICY Possible External Ultrasurf Anonymizer DNS Query
        2008534 || ET POLICY Ultrasurf Anonymizer Connection Outbound
        2008535 || ET POLICY Ultrasurf Anonymizer Connection Inbound
        2008536 || ET SCAN Halberd Load Balanced Webserver Detection Scan || url,www.halberd.superadditive.com
        2008537 || ET SCAN Hmap Webserver Fingerprint Scan || url,www.ujeni.murkyroc.com/hmap/


From markus.lude at gmx.de  Wed Sep  3 00:45:08 2008
From: markus.lude at gmx.de (Markus Lude)
Date: Wed, 3 Sep 2008 06:45:08 +0200
Subject: [Emerging-Sigs] unescaped ":" in sids 2008536, 2008537
Message-ID: <20080903044508.GA29450@fuseki.my.domain>

Hello,
there are unescaped ":" in sids 2008536, 2008537:

sid 2008536
  content:"Pragma: no-cache"; 
                 ^
sid 2008537
  content:"User-Agent: Mozilla";
                     ^

Regards,
Markus


From jonkman at jonkmans.com  Wed Sep  3 14:11:49 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Wed, 03 Sep 2008 14:11:49 -0400
Subject: [Emerging-Sigs] unescaped ":" in sids 2008536, 2008537
In-Reply-To: <20080903044508.GA29450@fuseki.my.domain>
References: <20080903044508.GA29450@fuseki.my.domain>
Message-ID: <48BED365.50308@jonkmans.com>

Got em, thanks Markus!

Matt

Markus Lude wrote:
> Hello,
> there are unescaped ":" in sids 2008536, 2008537:
> 
> sid 2008536
>   content:"Pragma: no-cache"; 
>                  ^
> sid 2008537
>   content:"User-Agent: Mozilla";
>                      ^
> 
> Regards,
> Markus
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Wed Sep  3 16:00:09 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Wed,  3 Sep 2008 16:00:09 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080903200009.374564502B@goliath.jonkmans.com>


[***] Results from Oinkmaster started Wed Sep  3 16:00:09 2008 [***]

[///]     Modified active rules:     [///]

 2008536 - ET SCAN Halberd Load Balanced Webserver Detection Scan (emerging-scan.rules)
 2008537 - ET SCAN Hmap Webserver Fingerprint Scan (emerging-scan.rules)


[*] Non-rule line modifications: [*]
    None.


From msconzo at ercot.com  Wed Sep  3 16:10:52 2008
From: msconzo at ercot.com (Sconzo, Michael)
Date: Wed, 3 Sep 2008 15:10:52 -0500
Subject: [Emerging-Sigs] Couple of sigs
Message-ID: <789A6CF2A624E54184956F80CCCAE8600143F984@CPWP016I.ercot.com>

We saw some odd first stage downloads prior to a "ET TROJAN
Downloader-1355 Checking In"

Here's a couple of rules that will flag it

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"b2b Trojan
redirect"; flow:established,to_server; uricontent:"/b2b/load/"; nocase;
classtype:trojan-activity; sid:0000000; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"b2b Trojan
checkin"; flow:established,to_server; uricontent:"/b2b/bots.cgi";
nocase; classtype:trojan-activity; sid:0000000; rev:1;)


For those of you that are interested the full URLs are (in order)
Hxxp://loading-nso.net/b2b/
Hxxp://files938421.net/b2b/load/
Hxxp://files938421.net/b2b/bots.cgi
Hxxp://files938421.net/b2b/load/bkdrns.exe
Hxxp://files938421.net/b2b/load/mlarda.exe

So it hit the first one and got bounced through the others before
downloading the exes.


---
Mike Sconzo <msconzo at ercot.com>
ERCOT Security Operations

From jonkman at jonkmans.com  Wed Sep  3 16:17:37 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Wed, 03 Sep 2008 16:17:37 -0400
Subject: [Emerging-Sigs] Couple of sigs
In-Reply-To: <789A6CF2A624E54184956F80CCCAE8600143F984@CPWP016I.ercot.com>
References: <789A6CF2A624E54184956F80CCCAE8600143F984@CPWP016I.ercot.com>
Message-ID: <48BEF0E1.6030300@jonkmans.com>

Is /b2b/ part of the kit, or just a dir they'd compromised?

Hate to make a sig if it's just the path they happen to be using on this
particular run.

Matt

Sconzo, Michael wrote:
> We saw some odd first stage downloads prior to a "ET TROJAN
> Downloader-1355 Checking In"
> 
> Here's a couple of rules that will flag it
> 
> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"b2b Trojan
> redirect"; flow:established,to_server; uricontent:"/b2b/load/"; nocase;
> classtype:trojan-activity; sid:0000000; rev:1;)
> 
> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"b2b Trojan
> checkin"; flow:established,to_server; uricontent:"/b2b/bots.cgi";
> nocase; classtype:trojan-activity; sid:0000000; rev:1;)
> 
> 
> For those of you that are interested the full URLs are (in order)
> Hxxp://loading-nso.net/b2b/
> Hxxp://files938421.net/b2b/load/
> Hxxp://files938421.net/b2b/bots.cgi
> Hxxp://files938421.net/b2b/load/bkdrns.exe
> Hxxp://files938421.net/b2b/load/mlarda.exe
> 
> So it hit the first one and got bounced through the others before
> downloading the exes.
> 
> 
> ---
> Mike Sconzo <msconzo at ercot.com>
> ERCOT Security Operations
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From msconzo at ercot.com  Wed Sep  3 16:20:51 2008
From: msconzo at ercot.com (Sconzo, Michael)
Date: Wed, 3 Sep 2008 15:20:51 -0500
Subject: [Emerging-Sigs] Couple of sigs
In-Reply-To: <48BEF0E1.6030300@jonkmans.com>
Message-ID: <789A6CF2A624E54184956F80CCCAE8600143F985@CPWP016I.ercot.com>

It's part of the path they were using on this run.  Haven't gotten a
chance to pull apart the malware, but it seems pretty new as 5 of the
files only flagged 3 hits on virustotal.com.  So this was my
quick-n-dirty(tm) attempt to get something up and monitoring on our end.

-=Mike

-----Original Message-----
From: Matt Jonkman [mailto:jonkman at jonkmans.com] 
Sent: Wednesday, September 03, 2008 3:18 PM
To: Sconzo, Michael
Cc: Emerging Threats Signatures
Subject: Re: [Emerging-Sigs] Couple of sigs

Is /b2b/ part of the kit, or just a dir they'd compromised?

Hate to make a sig if it's just the path they happen to be using on this
particular run.

Matt

Sconzo, Michael wrote:
> We saw some odd first stage downloads prior to a "ET TROJAN
> Downloader-1355 Checking In"
> 
> Here's a couple of rules that will flag it
> 
> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"b2b Trojan
> redirect"; flow:established,to_server; uricontent:"/b2b/load/";
nocase;
> classtype:trojan-activity; sid:0000000; rev:1;)
> 
> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"b2b Trojan
> checkin"; flow:established,to_server; uricontent:"/b2b/bots.cgi";
> nocase; classtype:trojan-activity; sid:0000000; rev:1;)
> 
> 
> For those of you that are interested the full URLs are (in order)
> Hxxp://loading-nso.net/b2b/
> Hxxp://files938421.net/b2b/load/
> Hxxp://files938421.net/b2b/bots.cgi
> Hxxp://files938421.net/b2b/load/bkdrns.exe
> Hxxp://files938421.net/b2b/load/mlarda.exe
> 
> So it hit the first one and got bounced through the others before
> downloading the exes.
> 
> 
> ---
> Mike Sconzo <msconzo at ercot.com>
> ERCOT Security Operations
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From jonkman at jonkmans.com  Wed Sep  3 16:47:09 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Wed, 03 Sep 2008 16:47:09 -0400
Subject: [Emerging-Sigs] Couple of sigs
In-Reply-To: <789A6CF2A624E54184956F80CCCAE8600143F985@CPWP016I.ercot.com>
References: <789A6CF2A624E54184956F80CCCAE8600143F985@CPWP016I.ercot.com>
Message-ID: <48BEF7CD.5050800@jonkmans.com>

Let me know what you see when you do pull it apart. Hopefully there's
something more reliable we could use for the longer term in a sig. If
not we could drop these in current events for a week or two. Rather find
a long term sig though.

Thanks Michael!

Matt

Sconzo, Michael wrote:
> It's part of the path they were using on this run.  Haven't gotten a
> chance to pull apart the malware, but it seems pretty new as 5 of the
> files only flagged 3 hits on virustotal.com.  So this was my
> quick-n-dirty(tm) attempt to get something up and monitoring on our end.
> 
> -=Mike
> 
> -----Original Message-----
> From: Matt Jonkman [mailto:jonkman at jonkmans.com] 
> Sent: Wednesday, September 03, 2008 3:18 PM
> To: Sconzo, Michael
> Cc: Emerging Threats Signatures
> Subject: Re: [Emerging-Sigs] Couple of sigs
> 
> Is /b2b/ part of the kit, or just a dir they'd compromised?
> 
> Hate to make a sig if it's just the path they happen to be using on this
> particular run.
> 
> Matt
> 
> Sconzo, Michael wrote:
>> We saw some odd first stage downloads prior to a "ET TROJAN
>> Downloader-1355 Checking In"
>>
>> Here's a couple of rules that will flag it
>>
>> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"b2b Trojan
>> redirect"; flow:established,to_server; uricontent:"/b2b/load/";
> nocase;
>> classtype:trojan-activity; sid:0000000; rev:1;)
>>
>> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"b2b Trojan
>> checkin"; flow:established,to_server; uricontent:"/b2b/bots.cgi";
>> nocase; classtype:trojan-activity; sid:0000000; rev:1;)
>>
>>
>> For those of you that are interested the full URLs are (in order)
>> Hxxp://loading-nso.net/b2b/
>> Hxxp://files938421.net/b2b/load/
>> Hxxp://files938421.net/b2b/bots.cgi
>> Hxxp://files938421.net/b2b/load/bkdrns.exe
>> Hxxp://files938421.net/b2b/load/mlarda.exe
>>
>> So it hit the first one and got bounced through the others before
>> downloading the exes.
>>
>>
>> ---
>> Mike Sconzo <msconzo at ercot.com>
>> ERCOT Security Operations
>> _______________________________________________
>> Emerging-sigs mailing list
>> Emerging-sigs at emergingthreats.net
>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
> 

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From veerendragg at secpod.com  Thu Sep  4 09:05:36 2008
From: veerendragg at secpod.com (Veerendra GG)
Date: Thu, 04 Sep 2008 18:35:36 +0530
Subject: [Emerging-Sigs] Airmail Express Trojan Signature
Message-ID: <48BFDD20.7040408@secpod.com>


Rules for Airmail Express Trojan.

alert tcp $EXTERNAL_NET 110 -> $HOME_NET any (msg:"Airmail Express
Malware Attack (POP) - Trojan"; flow:established,to_client; content:"|0d
0a|Subject\: Airmail Tracking number #"; pcre:"/#\d{6,}\.zip/i";
classtype:trojan-activity;
reference:url,www.sophos.com/blogs/gc/g/2008/09/01/email-with-the-subject-airmail;
reference:url,www.news.portalit.net/fullnews_airmail-express-delivers-fresh-trojan_1506.html;
sid:9025; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"Airmail Express
Malware Attack (SMTP) - Trojan"; flow:established,to_server;
content:"|0d 0a|Subject\: Airmail Tracking number #";
pcre:"/#\d{6,}\.zip/i"; classtype:trojan-activity;
reference:url,www.sophos.com/blogs/gc/g/2008/09/01/email-with-the-subject-airmail;
reference:url,www.news.portalit.net/fullnews_airmail-express-delivers-fresh-trojan_1506.html;
sid:9026; rev:1;)


Thanks,
Veerendra GG
www.secpod.com

From pppmarinho at gmail.com  Thu Sep  4 11:28:44 2008
From: pppmarinho at gmail.com (Pedro Marinho)
Date: Thu, 4 Sep 2008 12:28:44 -0300
Subject: [Emerging-Sigs] frontpage attacks
Message-ID: <ae49404b0809040828h51bd74d9ubc61d0cc0c68043f@mail.gmail.com>

Hello Guys,

I am seeing some ips from Asia like these two 163.17.153.131 and
218.146.255.60 which is beeing catch by the WEB-FRONTPAGE posting rule..
someone knows what it is trying to do ?



ps: there is a sid two catch this user agent already..

ps: i am a newbie


comprimento = 1224

000 : 50 4F 53 54 20 2F 5F 76 74 69 5F 62 69 6E 2F 5F   POST /_vti_bin/_
010 : 76 74 69 5F 61 75 74 2F 61 75 74 68 6F 72 2E 64   vti_aut/author.d
020 : 6C 6C 20 48 54 54 50 2F 31 2E 31 0D 0A 4D 49 4D   ll HTTP/1.1..MIM
030 : 45 2D 56 65 72 73 69 6F 6E 3A 20 31 2E 30 0D 0A   E-Version: 1.0..
040 : 55 73 65 72 2D 41 67 65 6E 74 3A 20 63 6F 72 65   User-Agent: core
050 : 2D 70 72 6F 6A 65 63 74 2F 31 2E 30 0D 0A 48 6F   -project/1.0..Ho
060 : 73 74 3A 20 ** ** ** ** ** ** ** ** ** ** ** **                  st:
070 : 33 0D 0A 41 63 63 65 70 74 3A 20 61 75 74 68 2F   3..Accept: auth/
080 : 73 69 63 69 6C 79 0D 0A 43 6F 6E 74 65 6E 74 2D   sicily..Content-
090 : 4C 65 6E 67 74 68 3A 20 39 31 35 0D 0A 43 6F 6E   Length: 915..Con
0a0 : 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C 69   tent-Type: appli
0b0 : 63 61 74 69 6F 6E 2F 78 2D 76 65 72 6D 65 65 72   cation/x-vermeer
0c0 : 2D 75 72 6C 65 6E 63 6F 64 65 64 0D 0A 58 2D 56   -urlencoded..X-V
0d0 : 65 72 6D 65 65 72 2D 43 6F 6E 74 65 6E 74 2D 54   ermeer-Content-T
0e0 : 79 70 65 3A 20 61 70 70 6C 69 63 61 74 69 6F 6E   ype: application
0f0 : 2F 78 2D 76 65 72 6D 65 65 72 2D 75 72 6C 65 6E   /x-vermeer-urlen
100 : 63 6F 64 65 64 0D 0A 43 6F 6E 6E 65 63 74 69 6F   coded..Connectio
110 : 6E 3A 20 63 6C 6F 73 65 0D 0A 43 61 63 68 65 2D   n: close..Cache-
120 : 43 6F 6E 74 72 6F 6C 3A 20 6E 6F 2D 63 61 63 68   Control: no-cach
130 : 65 0D 0A 0D 0A 6D 65 74 68 6F 64 3D 70 75 74 2B   e....method=put+
140 : 64 6F 63 75 6D 65 6E 74 25 33 61 34 25 32 65 30   document%3a4%2e0
150 : 25 32 65 32 25 32 65 34 37 31 35 26 73 65 72 76   %2e2%2e4715&serv
160 : 69 63 65 25 35 66 6E 61 6D 65 3D 26 64 6F 63 75   ice%5fname=&docu
170 : 6D 65 6E 74 3D 25 35 62 64 6F 63 75 6D 65 6E 74   ment=%5bdocument
180 : 25 35 66 6E 61 6D 65 25 33 64 66 69 25 32 65 61   %5fname%3dfi%2ea
190 : 73 70 25 33 62 6D 65 74 61 25 35 66 69 6E 66 6F   sp%3bmeta%5finfo
1a0 : 25 33 64 25 35 62 25 35 64 25 35 64 26 70 75 74   %3d%5b%5d%5d&put
1b0 : 25 35 66 6F 70 74 69 6F 6E 3D 6F 76 65 72 77 72   %5foption=overwr
1c0 : 69 74 65 26 63 6F 6D 6D 65 6E 74 3D 26 6B 65 65   ite&comment=&kee
1d0 : 70 25 35 66 63 68 65 63 6B 65 64 25 35 66 6F 75   p%5fchecked%5fou
1e0 : 74 3D 66 61 6C 73 65 0A 3C 25 40 20 4C 41 4E 47   t=false.<%@ LANG
1f0 : 55 41 47 45 20 3D 20 56 42 53 63 72 69 70 74 2E   UAGE = VBScript.
200 : 45 6E 63 6F 64 65 20 25 3E 0A 3C 68 65 61 64 3E   Encode %>.<head>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080904/3f83ca7f/attachment-0001.html

From pepperjack at afferentsecurity.com  Thu Sep  4 11:38:27 2008
From: pepperjack at afferentsecurity.com (Jack Pepper)
Date: Thu, 04 Sep 2008 10:38:27 -0500
Subject: [Emerging-Sigs] frontpage attacks
In-Reply-To: <ae49404b0809040828h51bd74d9ubc61d0cc0c68043f@mail.gmail.com>
References: <ae49404b0809040828h51bd74d9ubc61d0cc0c68043f@mail.gmail.com>
Message-ID: <20080904103827.pbcfih1g080og88w@mail.afferentsecurity.com>

Quoting Pedro Marinho <pppmarinho at gmail.com>:

> Hello Guys,
>
> I am seeing some ips from Asia like these two 163.17.153.131 and
> 218.146.255.60 which is beeing catch by the WEB-FRONTPAGE posting rule..
> someone knows what it is trying to do ?

this appears to be a reconnaissance bot.  It doesn't seems to be  
really trying to do much, just feel things out on your network.  It  
consistently tries a few antiquated frontpage attacks and a few basic  
recon things.

I figure it's the recon phase for something far worse to follow.  I am  
blocking all traffic with that user agent.

>
> ps: i am a newbie

Ah HAH!  Let's get him!


-- 

Framework?  I don't need no stinking framework!

----------------------------------------------------------------
@fferent Security Labs:  Isolate/Insulate/Innovate  
http://www.afferentsecurity.com


From jonkman at jonkmans.com  Thu Sep  4 11:39:36 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Thu, 04 Sep 2008 11:39:36 -0400
Subject: [Emerging-Sigs] frontpage attacks
In-Reply-To: <ae49404b0809040828h51bd74d9ubc61d0cc0c68043f@mail.gmail.com>
References: <ae49404b0809040828h51bd74d9ubc61d0cc0c68043f@mail.gmail.com>
Message-ID: <48C00138.80000@jonkmans.com>

SCAN/SCAN_Coreproject:alert tcp $EXTERNAL_NET any -> $HOME_NET
$HTTP_PORTS (msg:"ET SCAN Core-Project Scanning Bot UA Detected";
flow:established,to_server; content:"|0d 0a|User-Agent\:
core-project/1.0"; classtype:web-application-activity; sid:2008529; rev:1;)

That rule (added yesterday or so) will catch those.

It's a scanner apparently, looking for bad frontpage versions or
misconfigured frontpage extensions. Not much to worry about if you have
yourself config'd right or aren't running them.

Good to know who's knocking on the door. Good enough reason for me to
block an IP (which I do)

Matt

Pedro Marinho wrote:
> Hello Guys,
>  
> I am seeing some ips from Asia like these two 163.17.153.131
> <http://163.17.153.131> and 218.146.255.60 <http://218.146.255.60> which
> is beeing catch by the WEB-FRONTPAGE posting rule.. someone knows what
> it is trying to do ?  
>  
>  
>  
> ps: there is a sid two catch this user agent already..
>  
> ps: i am a newbie
>  
> 
> comprimento = 1224
> 
> 000 : 50 4F 53 54 20 2F 5F 76 74 69 5F 62 69 6E 2F 5F   POST /_vti_bin/_
> 010 : 76 74 69 5F 61 75 74 2F 61 75 74 68 6F 72 2E 64   vti_aut/author.d
> 020 : 6C 6C 20 48 54 54 50 2F 31 2E 31 0D 0A 4D 49 4D   ll HTTP/1.1..MIM
> 030 : 45 2D 56 65 72 73 69 6F 6E 3A 20 31 2E 30 0D 0A   E-Version: 1.0..
> 040 : 55 73 65 72 2D 41 67 65 6E 74 3A 20 63 6F 72 65   User-Agent: core
> 050 : 2D 70 72 6F 6A 65 63 74 2F 31 2E 30 0D 0A 48 6F   -project/1.0..Ho
> 060 : 73 74 3A 20 ** ** ** ** ** ** ** ** ** ** ** **                  st:
> 070 : 33 0D 0A 41 63 63 65 70 74 3A 20 61 75 74 68 2F   3..Accept: auth/
> 080 : 73 69 63 69 6C 79 0D 0A 43 6F 6E 74 65 6E 74 2D   sicily..Content-
> 090 : 4C 65 6E 67 74 68 3A 20 39 31 35 0D 0A 43 6F 6E   Length: 915..Con
> 0a0 : 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C 69   tent-Type: appli
> 0b0 : 63 61 74 69 6F 6E 2F 78 2D 76 65 72 6D 65 65 72   cation/x-vermeer
> 0c0 : 2D 75 72 6C 65 6E 63 6F 64 65 64 0D 0A 58 2D 56   -urlencoded..X-V
> 0d0 : 65 72 6D 65 65 72 2D 43 6F 6E 74 65 6E 74 2D 54   ermeer-Content-T
> 0e0 : 79 70 65 3A 20 61 70 70 6C 69 63 61 74 69 6F 6E   ype: application
> 0f0 : 2F 78 2D 76 65 72 6D 65 65 72 2D 75 72 6C 65 6E   /x-vermeer-urlen
> 100 : 63 6F 64 65 64 0D 0A 43 6F 6E 6E 65 63 74 69 6F   coded..Connectio
> 110 : 6E 3A 20 63 6C 6F 73 65 0D 0A 43 61 63 68 65 2D   n: close..Cache-
> 120 : 43 6F 6E 74 72 6F 6C 3A 20 6E 6F 2D 63 61 63 68   Control: no-cach
> 130 : 65 0D 0A 0D 0A 6D 65 74 68 6F 64 3D 70 75 74 2B   e....method=put+
> 140 : 64 6F 63 75 6D 65 6E 74 25 33 61 34 25 32 65 30   document%3a4%2e0
> 150 : 25 32 65 32 25 32 65 34 37 31 35 26 73 65 72 76   %2e2%2e4715&serv
> 160 : 69 63 65 25 35 66 6E 61 6D 65 3D 26 64 6F 63 75   ice%5fname=&docu
> 170 : 6D 65 6E 74 3D 25 35 62 64 6F 63 75 6D 65 6E 74   ment=%5bdocument
> 180 : 25 35 66 6E 61 6D 65 25 33 64 66 69 25 32 65 61   %5fname%3dfi%2ea
> 190 : 73 70 25 33 62 6D 65 74 61 25 35 66 69 6E 66 6F   sp%3bmeta%5finfo
> 1a0 : 25 33 64 25 35 62 25 35 64 25 35 64 26 70 75 74   %3d%5b%5d%5d&put
> 1b0 : 25 35 66 6F 70 74 69 6F 6E 3D 6F 76 65 72 77 72   %5foption=overwr
> 1c0 : 69 74 65 26 63 6F 6D 6D 65 6E 74 3D 26 6B 65 65   ite&comment=&kee
> 1d0 : 70 25 35 66 63 68 65 63 6B 65 64 25 35 66 6F 75   p%5fchecked%5fou
> 1e0 : 74 3D 66 61 6C 73 65 0A 3C 25 40 20 4C 41 4E 47   t=false.<%@ LANG
> 1f0 : 55 41 47 45 20 3D 20 56 42 53 63 72 69 70 74 2E   UAGE = VBScript.
> 200 : 45 6E 63 6F 64 65 20 25 3E 0A 3C 68 65 61 64 3E   Encode %>.<head>
> 
>  
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From frank at knobbe.us  Thu Sep  4 11:51:02 2008
From: frank at knobbe.us (Frank Knobbe)
Date: Thu, 04 Sep 2008 10:51:02 -0500
Subject: [Emerging-Sigs] Ultrasurf Rules
In-Reply-To: <F1F217B1-89E5-4F31-AD7C-79800C42595E@gmail.com>
References: <9255886c0809011658v3b3896e8u314f3000c830615f@mail.gmail.com>
	<F1F217B1-89E5-4F31-AD7C-79800C42595E@gmail.com>
Message-ID: <1220543462.13367.0.camel@localhost>

On Tue, 2008-09-02 at 09:07 -0400, Joel Esler wrote:
> Sounds like a good list of IP's to block at the proxy/firewall points
> as well.

Actually it doesn't. There are legitimate web sites in that range.
www.fotosearch.com being one of them. 

-Frank

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
Url : http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080904/5fd7bfdd/attachment.bin

From jonkman at jonkmans.com  Thu Sep  4 12:25:04 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Thu, 04 Sep 2008 12:25:04 -0400
Subject: [Emerging-Sigs] Airmail Express Trojan Signature
In-Reply-To: <48BFDD20.7040408@secpod.com>
References: <48BFDD20.7040408@secpod.com>
Message-ID: <48C00BE0.6070907@jonkmans.com>

How about we just do the port 25 one, and I'll expand the pcre to get
the full line.

Putting into current events for a while. These will likely pass in a
week or so.

Thanks Veerendra!

Matt

Veerendra GG wrote:
> Rules for Airmail Express Trojan.
> 
> alert tcp $EXTERNAL_NET 110 -> $HOME_NET any (msg:"Airmail Express
> Malware Attack (POP) - Trojan"; flow:established,to_client; content:"|0d
> 0a|Subject\: Airmail Tracking number #"; pcre:"/#\d{6,}\.zip/i";
> classtype:trojan-activity;
> reference:url,www.sophos.com/blogs/gc/g/2008/09/01/email-with-the-subject-airmail;
> reference:url,www.news.portalit.net/fullnews_airmail-express-delivers-fresh-trojan_1506.html;
> sid:9025; rev:1;)
> 
> alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"Airmail Express
> Malware Attack (SMTP) - Trojan"; flow:established,to_server;
> content:"|0d 0a|Subject\: Airmail Tracking number #";
> pcre:"/#\d{6,}\.zip/i"; classtype:trojan-activity;
> reference:url,www.sophos.com/blogs/gc/g/2008/09/01/email-with-the-subject-airmail;
> reference:url,www.news.portalit.net/fullnews_airmail-express-delivers-fresh-trojan_1506.html;
> sid:9026; rev:1;)
> 
> 
> Thanks,
> Veerendra GG
> www.secpod.com
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Thu Sep  4 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Thu,  4 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080904200008.66F4A4502D@goliath.jonkmans.com>


[***] Results from Oinkmaster started Thu Sep  4 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008538 - ET SCAN Sqlmap SQL Injection Scan (emerging-scan.rules)
 2008539 - ET CURRENT_EVENTS Airmail Express Malware-Laden Email Inbound (emerging.rules)


[///]     Modified active rules:     [///]

 2003607 - ET MALWARE Cnzz.com/Baidu Related Spyware Stat Reporting (emerging-malware.rules)


[---]         Removed rules:         [---]

 2008534 - ET POLICY Ultrasurf Anonymizer Connection Outbound (emerging-policy.rules)
 2008535 - ET POLICY Ultrasurf Anonymizer Connection Inbound (emerging-policy.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-sid-msg.map (2):
        2008538 || ET SCAN Sqlmap SQL Injection Scan || url,sqlmap.sourceforge.net
        2008539 || ET CURRENT_EVENTS Airmail Express Malware-Laden Email Inbound || url,www.news.portalit.net/fullnews_airmail-express-delivers-fresh-trojan_1506.html || url,www.sophos.com/blogs/gc/g/2008/09/01/email-with-the-subject-airmail

     -> Added to emerging-sid-msg.map.txt (2):
        2008538 || ET SCAN Sqlmap SQL Injection Scan || url,sqlmap.sourceforge.net
        2008539 || ET CURRENT_EVENTS Airmail Express Malware-Laden Email Inbound || url,www.news.portalit.net/fullnews_airmail-express-delivers-fresh-trojan_1506.html || url,www.sophos.com/blogs/gc/g/2008/09/01/email-with-the-subject-airmail

     -> Added to emerging.rules (2):
        #by Veerendra GG
        # To be removed about sep 15 if the attacks have passed

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-policy.rules (1):
        # IP POOL by Augusto Ferronato

     -> Removed from emerging-sid-msg.map (2):
        2008534 || ET POLICY Ultrasurf Anonymizer Connection Outbound
        2008535 || ET POLICY Ultrasurf Anonymizer Connection Inbound

     -> Removed from emerging-sid-msg.map.txt (2):
        2008534 || ET POLICY Ultrasurf Anonymizer Connection Outbound
        2008535 || ET POLICY Ultrasurf Anonymizer Connection Inbound


From pepperjack at afferentsecurity.com  Fri Sep  5 08:30:06 2008
From: pepperjack at afferentsecurity.com (Jack Pepper)
Date: Fri, 05 Sep 2008 07:30:06 -0500
Subject: [Emerging-Sigs] frontpage attacks + core project
In-Reply-To: <48C00138.80000@jonkmans.com>
References: <ae49404b0809040828h51bd74d9ubc61d0cc0c68043f@mail.gmail.com>
	<48C00138.80000@jonkmans.com>
Message-ID: <20080905073006.fcsoxvyx9sswgss0@mail.afferentsecurity.com>

This is being run by a brazilian hack team, linuXploit_crew.  Running  
up counters on zone-h.  That is just soooo last year.

anyway here is a packet dump of the frontpage upload, and you can  
google for them to see their handiwork.  So wierd to think that  
author.dll still works on so many websites.

  I'll be blocking this user agent everywhere.

jp

	0x0030:  0000 0000 504f 5354 202f 5f76 7469 5f62  ....POST./_vti_b
	0x0040:  696e 2f5f 7674 695f 6175 742f 6175 7468  in/_vti_aut/auth
	0x0050:  6f72 2e64 6c6c 2048 5454 502f 312e 310d  or.dll.HTTP/1.1.
	0x0060:  0a4d 494d 452d 5665 7273 696f 6e3a 2031  .MIME-Version:.1
	0x0070:  2e30 0d0a 5573 6572 2d41 6765 6e74 3a20  .0..User-Agent:.
	0x0080:  636f 7265 2d70 726f 6a65 6374 2f31 2e30  core-project/1.0
	0x0090:  0d0a 486f 7374 3a20 7777 7777 2e61 6161  ..Host:.wwww.aaa
	0x00a0:  6161 612e 6564 750d 0a41 6363 6570 743a  aaa.edu..Accept:
	0x00b0:  2061 7574 682f 7369 6369 6c79 0d0a 436f  .auth/sicily..Co
	0x00c0:  6e74 656e 742d 4c65 6e67 7468 3a20 3132  ntent-Length:.12
	0x00d0:  3037 0d0a 436f 6e74 656e 742d 5479 7065  07..Content-Type
	0x00e0:  3a20 6170 706c 6963 6174 696f 6e2f 782d  :.application/x-
	0x00f0:  7665 726d 6565 722d 7572 6c65 6e63 6f64  vermeer-urlencod
	0x0100:  6564 0d0a 582d 5665 726d 6565 722d 436f  ed..X-Vermeer-Co
	0x0110:  6e74 656e 742d 5479 7065 3a20 6170 706c  ntent-Type:.appl
	0x0120:  6963 6174 696f 6e2f 782d 7665 726d 6565  ication/x-vermee
	0x0130:  722d 7572 6c65 6e63 6f64 6564 0d0a 436f  r-urlencoded..Co
	0x0140:  6e6e 6563 7469 6f6e 3a20 636c 6f73 650d  nnection:.close.
	0x0150:  0a43 6163 6865 2d43 6f6e 7472 6f6c 3a20  .Cache-Control:.
	0x0160:  6e6f 2d63 6163 6865 0d0a 0d0a 6d65 7468  no-cache....meth
	0x0170:  6f64 3d70 7574 2b64 6f63 756d 656e 7425  od=put+document%
	0x0180:  3361 3425 3265 3025 3265 3225 3265 3437  3a4%2e0%2e2%2e47
	0x0190:  3135 2673 6572 7669 6365 2535 666e 616d  15&service%5fnam
	0x01a0:  653d 2664 6f63 756d 656e 743d 2535 6264  e=&document=%5bd
	0x01b0:  6f63 756d 656e 7425 3566 6e61 6d65 2533  ocument%5fname%3
	0x01c0:  6469 2532 6568 746d 2533 626d 6574 6125  di%2ehtm%3bmeta%
	0x01d0:  3566 696e 666f 2533 6425 3562 2535 6425  5finfo%3d%5b%5d%
	0x01e0:  3564 2670 7574 2535 666f 7074 696f 6e3d  5d&put%5foption=
	0x01f0:  6f76 6572 7772 6974 6526 636f 6d6d 656e  overwrite&commen
	0x0200:  743d 266b 6565 7025 3566 6368 6563 6b65  t=&keep%5fchecke
	0x0210:  6425 3566 6f75 743d 6661 6c73 650a 3c68  d%5fout=false.<h
	0x0220:  746d 6c3e 0d0a 3c68 6561 643e 0d0a 3c74  tml>..<head>..<t
	0x0230:  6974 6c65 3e6c 696e 7558 706c 6f69 745f  itle>linuXploit_
	0x0240:  6372 6577 3c2f 7469 746c 653e 0d0a 3c6d  crew</title>..<m
	0x0250:  6574 6120 6874 7470 2d65 7175 6976 3d22  eta.http-equiv="
	0x0260:  436f 6e74 656e 742d 5479 7065 2220 636f  Content-Type".co
	0x0270:  6e74 656e 743d 2274 6578 742f 6874 6d6c  ntent="text/html
	0x0280:  3b20 6368 6172 7365 743d 6973 6f2d 3838  ;.charset=iso-88
	0x0290:  3539 2d31 223e 0d0a 3c2f 6865 6164 3e0d  59-1">..</head>.
	0x02a0:  0a0d 0a3c 626f 6479 2062 6763 6f6c 6f72  ...<body.bgcolor
	0x02b0:  3d22 2346 4646 4646 4622 3e0d 0a3c 6469  ="#FFFFFF">..<di
	0x02c0:  7620 616c 6967 6e3d 2263 656e 7465 7222  v.align="center"
	0x02d0:  3e0d 0a20 203c 703e 3c66 6f6e 7420 7369  >....<p><font.si
	0x02e0:  7a65 3d22 3522 2066 6163 653d 2256 6572  ze="5".face="Ver
	0x02f0:  6461 6e61 2c20 4172 6961 6c2c 2048 656c  dana,.Arial,.Hel
	0x0300:  7665 7469 6361 2c20 7361 6e73 2d73 6572  vetica,.sans-ser
	0x0310:  6966 223e 3c73 7472 6f6e 673e 3c66 6f6e  if"><strong><fon
	0x0320:  7420 636f 6c6f 723d 2223 4646 3030 3030  t.color="#FF0000
	0x0330:  223e 6c69 6e75 5870 6c6f 6974 5f63 7265  ">linuXploit_cre
	0x0340:  773c 2f66 6f6e 743e 3c2f 7374 726f 6e67  w</font></strong
	0x0350:  3e3c 2f66 6f6e 743e 3c2f 703e 0d0a 2020  ></font></p>....
	0x0360:  3c70 3e3c 666f 6e74 2063 6f6c 6f72 3d22  <p><font.color="
	0x0370:  2346 4630 3030 3022 3e48 4143 4b20 4953  #FF0000">HACK.IS
	0x0380:  204e 4f54 2041 2043 5249 4d45 203c 2f66  .NOT.A.CRIME.</f
	0x0390:  6f6e 743e 3c66 6f6e 7420 636f 6c6f 723d  ont><font.color=
	0x03a0:  2223 4646 3030 3030 223e 4953 200d 0a20  "#FF0000">IS....
	0x03b0:  2020 2042 5245 414b 494e 4720 594f 5552  ...BREAKING.YOUR
	0x03c0:  2022 5345 4355 5249 5459 223c 2f66 6f6e  ."SECURITY"</fon
	0x03d0:  743e 3c2f 703e 0d0a 2020 3c70 3e3c 696d  t></p>....<p><im
	0x03e0:  6720 7372 633d 2268 7474 703a 2f2f 7777  g.src="http://ww
	0x03f0:  772e 6361 6e74 6569 726f 2e63 6f6d 2e62  w.canteiro.com.b
	0x0400:  722f 6172 7175 6976 6f73 2f6c 6f67 6f2e  r/arquivos/logo.
	0x0410:  6a70 6722 2077 6964 7468 3d22 3236 3022  jpg".width="260"
	0x0420:  2068 6569 6768 743d 2233 3234 223e 3c2f  .height="324"></
	0x0430:  703e 0d0a 2020 3c70 3e3c 666f 6e74 2063  p>....<p><font.c
	0x0440:  6f6c 6f72 3d22 2346 4630 3030 3022 3e3c  olor="#FF0000"><
	0x0450:  7374 726f 6e67 3e3c 666f 6e74 2073 697a  strong><font.siz
	0x0460:  653d 2233 2220 6661 6365 3d22 5665 7264  e="3".face="Verd
	0x0470:  616e 612c 2041 7269 616c 2c20 4865 6c76  ana,.Arial,.Helv
	0x0480:  6574 6963 612c 2073 616e 732d 7365 7269  etica,.sans-seri
	0x0490:  6622 3e3a 3a20 0d0a 2020 2020 4d65 6d62  f">::.......Memb
	0x04a0:  6572 733a 3a3c 6272 3e0d 0a20 2020 203c  ers::<br>......<
	0x04b0:  2f66 6f6e 743e 3c2f 7374 726f 6e67 3e3c  /font></strong><
	0x04c0:  666f 6e74 2073 697a 653d 2233 2220 6661  font.size="3".fa
	0x04d0:  6365 3d22 5665 7264 616e 612c 2041 7269  ce="Verdana,.Ari
	0x04e0:  616c 2c20 4865 6c76 6574 6963 612c 2073  al,.Helvetica,.s
	0x04f0:  616e 732d 7365 7269 6622 3e3c 623e 3c66  ans-serif"><b><f
	0x0500:  6f6e 7420 7369 7a65 3d22 3222 3e48 7561  ont.size="2">Hua
	0x0510:  6c64 6f20 0d0a 2020 2020 2d20 5f53 6572  ldo.......-._Ser
	0x0520:  6934 6c5f 4b69 6c6c 3372 5f20 2d20 4465  i4l_Kill3r_.-.De
	0x0530:  5266 2d20 2d20 4e69 636b 7669 7263 3c2f  Rf-.-.Nickvirc</
	0x0540:  666f 6e74 3e3c 2f62 3e3c 2f66 6f6e 743e  font></b></font>
	0x0550:  3c2f 666f 6e74 3e3c 2f70 3e0d 0a20 203c  </font></p>....<
	0x0560:  7020 616c 6967 6e3d 2263 656e 7465 7222  p.align="center"
	0x0570:  3e3c 666f 6e74 2073 697a 653d 2233 2220  ><font.size="3".
	0x0580:  636f 6c6f 723d 2223 4646 3030            color="#FF00




-- 

Framework?  I don't need no stinking framework!

----------------------------------------------------------------
@fferent Security Labs:  Isolate/Insulate/Innovate  
http://www.afferentsecurity.com


From emerging at emergingthreats.net  Fri Sep  5 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Fri,  5 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080905200008.A08154502B@goliath.jonkmans.com>


[***] Results from Oinkmaster started Fri Sep  5 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008540 - ET TROJAN Hupigon.dkxh Checkin to CnC (emerging-virus.rules)
 2008541 - ET TROJAN Bravix Checkin (emerging-virus.rules)


[///]     Modified active rules:     [///]

 2008375 - ET MALWARE Gooochi Related Spyware Ad pull (emerging-malware.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-sid-msg.map (2):
        2008540 || ET TROJAN Hupigon.dkxh Checkin to CnC
        2008541 || ET TROJAN Bravix Checkin

     -> Added to emerging-sid-msg.map.txt (2):
        2008540 || ET TROJAN Hupigon.dkxh Checkin to CnC
        2008541 || ET TROJAN Bravix Checkin

     -> Added to emerging-virus.rules (1):
        #by Jeffrey Brown,  re 33f56ffda981afa725d530be3d1e1cfb


From jonkman at jonkmans.com  Sat Sep  6 09:43:27 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Sat, 06 Sep 2008 09:43:27 -0400
Subject: [Emerging-Sigs] DDOS
Message-ID: <48C288FF.1020909@jonkmans.com>

Our Atrivo/RBN/Intercage report last week has started to bring the
expected DDOS attacks.

We just had a short one, about 10meg UDP attack. I was able to get the
sources shutdown through their providers (all seemed to be compromised
managed hosting boxes).

Surely there are more coming. If you have difficulty getting to us for
rulesets the mirrors are all up to date. If we do take a long term hit
on the main site we'll alter dns to round-robin you through the mirrors
for ruleset updates. That should keep you online. But if by change you
don't get a dns update in a timely manner you can hit
mirror.emergingthreats.net for updates directly.

Thanks for your patience. The positive results of that report are far
outweighed by a few DDOS's.

Matt

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Sat Sep  6 18:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Sat,  6 Sep 2008 18:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Weekly Signature Changes
Message-ID: <20080906220008.EC0D94502B@goliath.jonkmans.com>


[***] Results from Oinkmaster started Sat Sep  6 18:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008530 - ET CURRENT_EVENTS Danmec Infected machine Looking up CnC Server (emerging.rules)
 2008531 - ET CURRENT_EVENTS Infected System Looking up chr.santa-inbox.com CnC Server (emerging.rules)
 2008532 - ET TROJAN Bifrose Connect to Controller (variant 2) (emerging-virus.rules)
 2008533 - ET POLICY Possible External Ultrasurf Anonymizer DNS Query (emerging-policy.rules)
 2008536 - ET SCAN Halberd Load Balanced Webserver Detection Scan (emerging-scan.rules)
 2008537 - ET SCAN Hmap Webserver Fingerprint Scan (emerging-scan.rules)
 2008538 - ET SCAN Sqlmap SQL Injection Scan (emerging-scan.rules)
 2008539 - ET CURRENT_EVENTS Airmail Express Malware-Laden Email Inbound (emerging.rules)
 2008540 - ET TROJAN Hupigon.dkxh Checkin to CnC (emerging-virus.rules)
 2008541 - ET TROJAN Bravix Checkin (emerging-virus.rules)


[///]     Modified active rules:     [///]

 2003578 - ET MALWARE Baidu.com Spyware Bar Pulling Data (emerging-malware.rules)
 2003607 - ET MALWARE Cnzz.com/Baidu Related Spyware Stat Reporting (emerging-malware.rules)
 2008375 - ET MALWARE Gooochi Related Spyware Ad pull (emerging-malware.rules)
 2008402 - ET MALWARE Realtimegaming.com Online Casino Spyware Gaming Checkin (emerging-malware.rules)
 2400000 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400001 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400002 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400003 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400004 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400005 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400006 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400007 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2401000 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401001 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401002 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401003 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401004 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401005 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401006 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401007 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2402000 - ET DROP Dshield Block Listed Source (emerging-dshield.rules)
 2403000 - ET DROP Dshield Block Listed Source - BLOCKING (emerging-dshield-BLOCK.rules)
 2404000 - ET DROP Known Bot C&C Server Traffic (group 1)  (emerging-botcc.rules)
 2404001 - ET DROP Known Bot C&C Server Traffic (group 2)  (emerging-botcc.rules)
 2404002 - ET DROP Known Bot C&C Server Traffic (group 3)  (emerging-botcc.rules)
 2404003 - ET DROP Known Bot C&C Server Traffic (group 4)  (emerging-botcc.rules)
 2404004 - ET DROP Known Bot C&C Server Traffic (group 5)  (emerging-botcc.rules)
 2404005 - ET DROP Known Bot C&C Server Traffic (group 6)  (emerging-botcc.rules)
 2404006 - ET DROP Known Bot C&C Server Traffic (group 7)  (emerging-botcc.rules)
 2404007 - ET DROP Known Bot C&C Server Traffic (group 8)  (emerging-botcc.rules)
 2404008 - ET DROP Known Bot C&C Server Traffic (group 9)  (emerging-botcc.rules)
 2404009 - ET DROP Known Bot C&C Server Traffic (group 10)  (emerging-botcc.rules)
 2404010 - ET DROP Known Bot C&C Server Traffic (group 11)  (emerging-botcc.rules)
 2404011 - ET DROP Known Bot C&C Server Traffic (group 12)  (emerging-botcc.rules)
 2404012 - ET DROP Known Bot C&C Server Traffic (group 13)  (emerging-botcc.rules)
 2404013 - ET DROP Known Bot C&C Server Traffic (group 14)  (emerging-botcc.rules)
 2404014 - ET DROP Known Bot C&C Server Traffic (group 15)  (emerging-botcc.rules)
 2404015 - ET DROP Known Bot C&C Server Traffic (group 16)  (emerging-botcc.rules)
 2404016 - ET DROP Known Bot C&C Server Traffic (group 17)  (emerging-botcc.rules)
 2404017 - ET DROP Known Bot C&C Server Traffic (group 18)  (emerging-botcc.rules)
 2404018 - ET DROP Known Bot C&C Server Traffic (group 19)  (emerging-botcc.rules)
 2404019 - ET DROP Known Bot C&C Server Traffic (group 20)  (emerging-botcc.rules)
 2404020 - ET DROP Known Bot C&C Server Traffic (group 21)  (emerging-botcc.rules)
 2405000 - ET DROP Known Bot C&C Traffic (group 1) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405001 - ET DROP Known Bot C&C Traffic (group 2) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405002 - ET DROP Known Bot C&C Traffic (group 3) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405003 - ET DROP Known Bot C&C Traffic (group 4) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405004 - ET DROP Known Bot C&C Traffic (group 5) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405005 - ET DROP Known Bot C&C Traffic (group 6) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405006 - ET DROP Known Bot C&C Traffic (group 7) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405007 - ET DROP Known Bot C&C Traffic (group 8) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405008 - ET DROP Known Bot C&C Traffic (group 9) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405009 - ET DROP Known Bot C&C Traffic (group 10) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405010 - ET DROP Known Bot C&C Traffic (group 11) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405011 - ET DROP Known Bot C&C Traffic (group 12) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405012 - ET DROP Known Bot C&C Traffic (group 13) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405013 - ET DROP Known Bot C&C Traffic (group 14) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405014 - ET DROP Known Bot C&C Traffic (group 15) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405015 - ET DROP Known Bot C&C Traffic (group 16) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405016 - ET DROP Known Bot C&C Traffic (group 17) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405017 - ET DROP Known Bot C&C Traffic (group 18) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405018 - ET DROP Known Bot C&C Traffic (group 19) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405019 - ET DROP Known Bot C&C Traffic (group 20) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405020 - ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)


[---]         Removed rules:         [---]

 2008403 - ET MALWARE Realtimegaming.com/Windows Casino Online Gaming Checkin (emerging-malware.rules)
 2008486 - CURRENT_EVENTS Fake Airline E-ticket Email Inbound (emerging.rules)
 2008499 - ET CURRENT_EVENTS Fake CNN alert Malware download (adobe_flash.exe) (emerging.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-drop-BLOCK.rules (2):
        #  VERSION 1288
        #  Generated 2008-09-06 00:03:02 EDT

     -> Added to emerging-drop.rules (2):
        #  VERSION 1288
        #  Generated 2008-09-06 00:03:02 EDT

     -> Added to emerging-policy.rules (2):
        # from Rodrigo Montoro(Sp0oKeR). This isn't a hostile app, but may be interesting to know who's using it
        # Rule by SERPRO-Recife Security Team

     -> Added to emerging-sid-msg.map (10):
        2008530 || ET CURRENT_EVENTS Danmec Infected machine Looking up CnC Server
        2008531 || ET CURRENT_EVENTS Infected System Looking up chr.santa-inbox.com CnC Server
        2008532 || ET TROJAN Bifrose Connect to Controller (variant 2)
        2008533 || ET POLICY Possible External Ultrasurf Anonymizer DNS Query
        2008536 || ET SCAN Halberd Load Balanced Webserver Detection Scan || url,www.halberd.superadditive.com
        2008537 || ET SCAN Hmap Webserver Fingerprint Scan || url,www.ujeni.murkyroc.com/hmap/
        2008538 || ET SCAN Sqlmap SQL Injection Scan || url,sqlmap.sourceforge.net
        2008539 || ET CURRENT_EVENTS Airmail Express Malware-Laden Email Inbound || url,www.news.portalit.net/fullnews_airmail-express-delivers-fresh-trojan_1506.html || url,www.sophos.com/blogs/gc/g/2008/09/01/email-with-the-subject-airmail
        2008540 || ET TROJAN Hupigon.dkxh Checkin to CnC
        2008541 || ET TROJAN Bravix Checkin

     -> Added to emerging-sid-msg.map.txt (10):
        2008530 || ET CURRENT_EVENTS Danmec Infected machine Looking up CnC Server
        2008531 || ET CURRENT_EVENTS Infected System Looking up chr.santa-inbox.com CnC Server
        2008532 || ET TROJAN Bifrose Connect to Controller (variant 2)
        2008533 || ET POLICY Possible External Ultrasurf Anonymizer DNS Query
        2008536 || ET SCAN Halberd Load Balanced Webserver Detection Scan || url,www.halberd.superadditive.com
        2008537 || ET SCAN Hmap Webserver Fingerprint Scan || url,www.ujeni.murkyroc.com/hmap/
        2008538 || ET SCAN Sqlmap SQL Injection Scan || url,sqlmap.sourceforge.net
        2008539 || ET CURRENT_EVENTS Airmail Express Malware-Laden Email Inbound || url,www.news.portalit.net/fullnews_airmail-express-delivers-fresh-trojan_1506.html || url,www.sophos.com/blogs/gc/g/2008/09/01/email-with-the-subject-airmail
        2008540 || ET TROJAN Hupigon.dkxh Checkin to CnC
        2008541 || ET TROJAN Bravix Checkin

     -> Added to emerging-virus.rules (1):
        #by Jeffrey Brown,  re 33f56ffda981afa725d530be3d1e1cfb

     -> Added to emerging.rules (4):
        #by Veerendra GG
        # To be removed about sep 15 if the attacks have passed
        #by Jack Pepper. Should be removed in a week or so
        #by matt jonkman

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-drop-BLOCK.rules (2):
        #  VERSION 1281
        #  Generated 2008-08-30 00:03:02 EDT

     -> Removed from emerging-drop.rules (2):
        #  VERSION 1281
        #  Generated 2008-08-30 00:03:02 EDT

     -> Removed from emerging-sid-msg.map (3):
        2008403 || ET MALWARE Realtimegaming.com/Windows Casino Online Gaming Checkin
        2008486 || CURRENT_EVENTS Fake Airline E-ticket Email Inbound || url,www.sophos.com/security/blog/2008/07/1604.html || url,www.us-cert.gov/current/archive/2008/07/31/archive.html#airline_e_ticket_email_attack
        2008499 || ET CURRENT_EVENTS Fake CNN alert Malware download (adobe_flash.exe) || url,info.prevx.com/aboutprogramtext.asp?PX5=8F3D24A4003F66983457019EED05CB00A97B99D5

     -> Removed from emerging-sid-msg.map.txt (3):
        2008403 || ET MALWARE Realtimegaming.com/Windows Casino Online Gaming Checkin
        2008486 || CURRENT_EVENTS Fake Airline E-ticket Email Inbound || url,www.sophos.com/security/blog/2008/07/1604.html || url,www.us-cert.gov/current/archive/2008/07/31/archive.html#airline_e_ticket_email_attack
        2008499 || ET CURRENT_EVENTS Fake CNN alert Malware download (adobe_flash.exe) || url,info.prevx.com/aboutprogramtext.asp?PX5=8F3D24A4003F66983457019EED05CB00A97B99D5

     -> Removed from emerging.rules (3):
        #by Will Metcalf, regarding the fake CNN alerts out there
        #by Chandan at secpod.com
        # 01/08/2008 E-Ticket


From jonkman at jonkmans.com  Mon Sep  8 13:55:32 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Mon, 08 Sep 2008 13:55:32 -0400
Subject: [Emerging-Sigs] Loads of Great News!!
Message-ID: <48C56714.4050209@jonkmans.com>

http://voices.washingtonpost.com/securityfix/2008/09/estdomains.html

A new article up about ESTDomains by Brian Krebs at the Washington Post,
data contributions from our sandnet and other members of the emerging
community helped out in this. On the heels of the last Atrivo article
again built partly on our data. Lets hope it has a similar effect as did
the Atrivo research!


An update as well on the Atrivo story originally here:
http://voices.washingtonpost.com/securityfix/2008/08/report_slams_us_host_as_major.html


Update:
http://voices.washingtonpost.com/securityfix/2008/09/scam-heavy_us_isp_grows_more_i.html

Note that Broadcon was the only provider still willing to continue to
provide connectivity to Atrivo.

snip

Update, Monday, Sept 8, 12:00 p.m. ET: Todd Braning, vice president of
BandCon, just e-mailed me to say that BandCon also has stopped providing
connectivity to Atrivo/Intercage. From his e-mail: "Intercage, a new
customer, was connected to the BandCon Network for total of about a
week. Once we recognized and issue with Intercage, BandCon took
immediate action and terminated services. We are no longer providing
services to AS27595. This can be confirmed here."

WVFiber is the only company still providing direct connectivity to
Atrivo, and as stated before they plan to pull the plug by Thursday at
the latest, so it appears that Atrivo will have to find another network
provider or it will very soon cease to be reachable on the Internet.

snip

All good news. Atrivo/Intercage have been a huge malware problem for a
long time. This takes a good chunk of bad out of the Internet. Not a
major chunk, there are many other hosts like Atrivo, but this is a step
in the right direction. I'm VERY reassured to see some positive action
by the responsible bandwidth providers and by nLayer who've discontinued
business with a known bad entity, and in nLayer's case taken back their
IP space.

We CAN make a difference, and it doesn't have to be via law enforcement
action, which as we all know can be difficult to initiate in the light
of how this kind of crime works across global jurisdiction.


-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Mon Sep  8 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Mon,  8 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080908200008.BCFB24502B@goliath.jonkmans.com>


[***] Results from Oinkmaster started Mon Sep  8 16:00:08 2008 [***]

[*] Rules modifications: [*]
    None.

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-sid-msg.map (2):
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org

     -> Removed from emerging-sid-msg.map.txt (2):
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org


From jonkman at jonkmans.com  Mon Sep  8 18:52:56 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Mon, 08 Sep 2008 18:52:56 -0400
Subject: [Emerging-Sigs] Citect SCADA Sig
Message-ID: <48C5ACC8.8070804@jonkmans.com>

>From Dale Peterson at DigitalBond.com.

Vulnerability in the Citect Scada agent. If you're aware of scada and
how widespread Citect is then you'll understand the significance of the
issue.

Some background:
http://www.coresecurity.com/content/citect-scada-odbc-service-vulnerability
http://www.milw0rm.com/exploits/6387
http://www.milw0rm.com/papers/221
http://www.digitalbond.com/index.php/2008/09/08/ids-signature-for-citect-vuln/

Very big deal, if you have any of these devices be sure to take note.

#by Dale Peterson of digitalbond.com
alert tcp any any -> $HOME_NET 20222 (msg:?ET EXPLOIT CitectSCADA ODBC
Overflowflow Attempt?; flow:established,to_server; byte_test:4,>,399,0;
dsize:4; reference:cve,2008-2639;
reference:url,www.digitalbond.com/index.php/2008/09/08/ids-signature-for-citect-vuln/;
sid:2008542; rev:1;)



-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From ddpbsd at gmail.com  Tue Sep  9 09:30:28 2008
From: ddpbsd at gmail.com (ddp)
Date: Tue, 9 Sep 2008 09:30:28 -0400
Subject: [Emerging-Sigs] duplicates in rbn signatures
Message-ID: <ad3aaa740809090630g7e32df4cpa5a55c68f93a4a01@mail.gmail.com>

Howdy,
It looks like there are a number of duplicate IP addresses in the rbn
signaturs. I think the following list should be accurate(ish). I
apologize in advance for what will probably be a long and poorly
formatted email. Advice on how to report things like this in the
future is appreciated.

193.33.128.0/23
alert ip [91.196.232.0/22,91.194.140.0/23,91.198.71.0/24,91.193.40.0/22,91.193.56.0/22,193.33.128.0/23,194.110.69.0/24,91.195.116.
0/23] any -> $HOME_NET any (msg:"ET RBN Known Russian Business Network
Traffic - Chinese Nets"; reference:url,doc.emergingthreats.
net/bin/view/Main/RussianBusinessNetwork; threshold:type limit, track
by_src, seconds 60, count 1; sid:2406002; rev:7;)
alert ip [116.50.9.0/24,124.217.240.0/20,190.15.72.0/21,193.138.232.0/22,193.19.138.0/24,193.33.128.0/23,194.110.69.0/24,194.126.1
74.124,194.135.105.203,194.135.22.0/24] any -> $HOME_NET any (msg:"ET
RBN Known Russian Business Network Monitored Domains (1)"; r
eference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count
1; classtype:misc-attack; sid:2406005; rev:59;)
194.110.69.0/24
alert ip [91.196.232.0/22,91.194.140.0/23,91.198.71.0/24,91.193.40.0/22,91.193.56.0/22,193.33.128.0/23,194.110.69.0/24,91.195.116.
0/23] any -> $HOME_NET any (msg:"ET RBN Known Russian Business Network
Traffic - Chinese Nets"; reference:url,doc.emergingthreats.
net/bin/view/Main/RussianBusinessNetwork; threshold:type limit, track
by_src, seconds 60, count 1; sid:2406002; rev:7;)
alert ip [116.50.9.0/24,124.217.240.0/20,190.15.72.0/21,193.138.232.0/22,193.19.138.0/24,193.33.128.0/23,194.110.69.0/24,194.126.1
74.124,194.135.105.203,194.135.22.0/24] any -> $HOME_NET any (msg:"ET
RBN Known Russian Business Network Monitored Domains (1)"; r
eference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count
1; classtype:misc-attack; sid:2406005; rev:59;)
194.146.204.0/22
alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
ess Network Traffic - Hosting Nets";
reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold:type li
mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
alert ip [194.146.204.0/22,194.226.64.0/20,194.67.0.0/18,195.114.16.0/23,195.225.177.0/24,195.3.144.0/22,195.5.116.233,195.5.117.2
33,195.5.117.234,195.64.140.0/23] any -> $HOME_NET any (msg:"ET RBN
Known Russian Business Network Monitored Domains (2)"; referen
ce:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count 1; cla
sstype:misc-attack; sid:2406006; rev:59;)
194.226.64.0/20
alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
ess Network Traffic - Hosting Nets";
reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold:type li
mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
alert ip [194.146.204.0/22,194.226.64.0/20,194.67.0.0/18,195.114.16.0/23,195.225.177.0/24,195.3.144.0/22,195.5.116.233,195.5.117.2
33,195.5.117.234,195.64.140.0/23] any -> $HOME_NET any (msg:"ET RBN
Known Russian Business Network Monitored Domains (2)"; referen
ce:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count 1;
classtype:misc-attack; sid:2406006; rev:59;)
195.114.16.0/23
alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
ess Network Traffic - Hosting Nets";
reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold:type li
mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
alert ip [194.146.204.0/22,194.226.64.0/20,194.67.0.0/18,195.114.16.0/23,195.225.177.0/24,195.3.144.0/22,195.5.116.233,195.5.117.2
33,195.5.117.234,195.64.140.0/23] any -> $HOME_NET any (msg:"ET RBN
Known Russian Business Network Monitored Domains (2)"; referen
ce:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count 1; cla
sstype:misc-attack; sid:2406006; rev:59;)
195.64.140.0/23
alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
ess Network Traffic - Hosting Nets";
reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold:type li
mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
alert ip [194.146.204.0/22,194.226.64.0/20,194.67.0.0/18,195.114.16.0/23,195.225.177.0/24,195.3.144.0/22,195.5.116.233,195.5.117.2
33,195.5.117.234,195.64.140.0/23] any -> $HOME_NET any (msg:"ET RBN
Known Russian Business Network Monitored Domains (2)"; referen
ce:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count 1; cla
sstype:misc-attack; sid:2406006; rev:59;)
195.64.162.0/23
alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
ess Network Traffic - Hosting Nets";
reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold:type li
mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
alert ip [195.64.162.0/23,195.66.132.0/24,195.95.218.0/23,200.115.160.0/20,202.71.102.0/24,203.117.0.0/16,203.121.0.0/17,206.161.1
26.0/24,206.161.200.0/24,207.176.7.0/24] any -> $HOME_NET any (msg:"ET
RBN Known Russian Business Network Monitored Domains (3)";
reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count
 1; classtype:misc-attack; sid:2406007; rev:59;)
200.115.160.0/20
alert ip [200.115.160.0/20] any -> $HOME_NET any (msg:"ET RBN Known
Russian Business Network Traffic - Central American Nets"; ref
erence:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold:type limit, track by_src, seconds 60, count 1;
sid:2406004; rev:4;)
alert ip [195.64.162.0/23,195.66.132.0/24,195.95.218.0/23,200.115.160.0/20,202.71.102.0/24,203.117.0.0/16,203.121.0.0/17,206.161.1
26.0/24,206.161.200.0/24,207.176.7.0/24] any -> $HOME_NET any (msg:"ET
RBN Known Russian Business Network Monitored Domains (3)";
reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count
 1; classtype:misc-attack; sid:2406007; rev:59;)
208.72.160.0/20
alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
ess Network Traffic - Hosting Nets";
reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold:type li
mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
alert ip [207.210.85.61,207.226.173.0/24,207.226.175.0/24,207.226.179.0/24,207.226.182.0/24,208.43.41.0/24,208.72.160.0/20,208.73.
210.32,208.79.82.0/24,208.87.148.0/23] any -> $HOME_NET any (msg:"ET
RBN Known Russian Business Network Monitored Domains (4)"; re
ference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count 1
; classtype:misc-attack; sid:2406008; rev:59;)
65.254.54.178
alert ip [62.140.208.131,62.140.208.197,62.154.15.154,65.254.54.178,66.252.1.255,67.18.179.15,67.19.24.168,67.19.24.169,67.19.24.1
70,67.19.24.171,67.19.24.172,67.19.24.173,67.19.24.174,67.19.24.175,67.19.72.205,67.19.72.206,67.137.217.219,72.10.164.69,72.20.14
.3,72.20.25.134,74.54.31.196,80.70.239.253,84.45.24.53,84.45.47.130,84.45.90.141,85.133.4.138,89.149.186.77,89.149.186.81,89.149.1
86.89,193.93.232.6,195.66.226.151,213.200.78.66,213.200.79.194,213.200.80.46,216.180.244.179,217.118.119.26]
any -> $HOME_NET any
(msg:"ET RBN Known Russian Business Network Traffic - Individual
Hosts"; reference:url,doc.emergingthreats.net/bin/view/Main/Russi
anBusinessNetwork; threshold:type limit, track by_src, seconds 60,
count 1; sid:2406001; rev:9;)
alert ip [64.191.78.0/24,64.28.176.0/20,64.32.5.0/24,64.69.68.0/24,65.243.103.55,65.254.54.178,65.254.54.179,66.197.170.5,66.199.2
42.18,66.199.242.19] any -> $HOME_NET any (msg:"ET RBN Known Russian
Business Network Monitored Domains (8)"; reference:url,doc.em
ergingthreats.net/bin/view/Main/RussianBusinessNetwork; threshold:
type limit, track by_src, seconds 60, count 1; classtype:misc-a
ttack; sid:2406012; rev:59;)
66.252.0.0/19
alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
ess Network Traffic - Hosting Nets";
reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold:type li
mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
alert ip [66.244.254.0/24,66.249.5.0/24,66.252.0.0/19,66.29.15.140,66.29.15.141,67.130.99.0/24,67.137.217.219,67.15.47.0/24,67.18.
179.0/24,67.19.24.170] any -> $HOME_NET any (msg:"ET RBN Known Russian
Business Network Monitored Domains (9)"; reference:url,doc.
emergingthreats.net/bin/view/Main/RussianBusinessNetwork; threshold:
type limit, track by_src, seconds 60, count 1; classtype:misc
-attack; sid:2406013; rev:59;)
67.137.217.219
alert ip [62.140.208.131,62.140.208.197,62.154.15.154,65.254.54.178,66.252.1.255,67.18.179.15,67.19.24.168,67.19.24.169,67.19.24.1
70,67.19.24.171,67.19.24.172,67.19.24.173,67.19.24.174,67.19.24.175,67.19.72.205,67.19.72.206,67.137.217.219,72.10.164.69,72.20.14
.3,72.20.25.134,74.54.31.196,80.70.239.253,84.45.24.53,84.45.47.130,84.45.90.141,85.133.4.138,89.149.186.77,89.149.186.81,89.149.1
86.89,193.93.232.6,195.66.226.151,213.200.78.66,213.200.79.194,213.200.80.46,216.180.244.179,217.118.119.26]
any -> $HOME_NET any
(msg:"ET RBN Known Russian Business Network Traffic - Individual
Hosts"; reference:url,doc.emergingthreats.net/bin/view/Main/Russi
anBusinessNetwork; threshold:type limit, track by_src, seconds 60,
count 1; sid:2406001; rev:9;)
alert ip [66.244.254.0/24,66.249.5.0/24,66.252.0.0/19,66.29.15.140,66.29.15.141,67.130.99.0/24,67.137.217.219,67.15.47.0/24,67.18.
179.0/24,67.19.24.170] any -> $HOME_NET any (msg:"ET RBN Known Russian
Business Network Monitored Domains (9)"; reference:url,doc.
emergingthreats.net/bin/view/Main/RussianBusinessNetwork; threshold:
type limit, track by_src, seconds 60, count 1; classtype:misc
-attack; sid:2406013; rev:59;)
67.19.24.170
alert ip [62.140.208.131,62.140.208.197,62.154.15.154,65.254.54.178,66.252.1.255,67.18.179.15,67.19.24.168,67.19.24.169,67.19.24.1
70,67.19.24.171,67.19.24.172,67.19.24.173,67.19.24.174,67.19.24.175,67.19.72.205,67.19.72.206,67.137.217.219,72.10.164.69,72.20.14
.3,72.20.25.134,74.54.31.196,80.70.239.253,84.45.24.53,84.45.47.130,84.45.90.141,85.133.4.138,89.149.186.77,89.149.186.81,89.149.1
86.89,193.93.232.6,195.66.226.151,213.200.78.66,213.200.79.194,213.200.80.46,216.180.244.179,217.118.119.26]
any -> $HOME_NET any
(msg:"ET RBN Known Russian Business Network Traffic - Individual
Hosts"; reference:url,doc.emergingthreats.net/bin/view/Main/Russi
anBusinessNetwork; threshold:type limit, track by_src, seconds 60,
count 1; sid:2406001; rev:9;)
alert ip [66.244.254.0/24,66.249.5.0/24,66.252.0.0/19,66.29.15.140,66.29.15.141,67.130.99.0/24,67.137.217.219,67.15.47.0/24,67.18.
179.0/24,67.19.24.170] any -> $HOME_NET any (msg:"ET RBN Known Russian
Business Network Monitored Domains (9)"; reference:url,doc.
emergingthreats.net/bin/view/Main/RussianBusinessNetwork; threshold:
type limit, track by_src, seconds 60, count 1; classtype:misc
-attack; sid:2406013; rev:59;)
69.50.160.0/19
alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
ess Network Traffic - Hosting Nets";
reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold:type li
mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
alert ip [69.22.168.0/21,69.22.184.0/22,69.31.128.0/24,69.31.40.0/21,69.31.64.0/20,69.31.80.0/21,69.39.224.0/24,69.41.183.0/24,69.
42.216.0/24,69.50.160.0/19] any -> $HOME_NET any (msg:"ET RBN Known
Russian Business Network Monitored Domains (11)"; reference:ur
l,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count 1; classtyp
e:misc-attack; sid:2406015; rev:59;)
81.94.16.0/20
alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
ess Network Traffic - Hosting Nets";
reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold:type li
mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
alert ip [78.157.143.0/24,78.47.168.82,79.135.160.0/19,79.135.167.0/24,79.143.176.0/22,80.70.224.0/20,80.77.80.0/20,80.91.76.150,8
1.94.16.0/20,81.95.128.0/19] any -> $HOME_NET any (msg:"ET RBN Known
Russian Business Network Monitored Domains (15)"; reference:u
rl,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count 1; classty
pe:misc-attack; sid:2406019; rev:59;)
81.95.128.0/19
alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
ess Network Traffic - Hosting Nets";
reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold:type li
mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
alert ip [78.157.143.0/24,78.47.168.82,79.135.160.0/19,79.135.167.0/24,79.143.176.0/22,80.70.224.0/20,80.77.80.0/20,80.91.76.150,8
1.94.16.0/20,81.95.128.0/19] any -> $HOME_NET any (msg:"ET RBN Known
Russian Business Network Monitored Domains (15)"; reference:u
rl,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count 1; classty
pe:misc-attack; sid:2406019; rev:59;)
85.255.121.0/24
alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
ess Network Traffic - Hosting Nets";
reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold:type li
mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
alert ip [85.255.121.0/24,88.201.208.0/20,88.214.192.0/18,88.214.202.0/24,88.255.0.0/17,88.255.90.0/24,88.255.94.0/24,89.149.206.5
6,89.149.208.179,89.149.220.0/24] any -> $HOME_NET any (msg:"ET RBN
Known Russian Business Network Monitored Domains (17)"; refere
nce:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count 1; cl
asstype:misc-attack; sid:2406021; rev:59;)
88.201.208.0/20
alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
ess Network Traffic - Hosting Nets";
reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold:type li
mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
alert ip [85.255.121.0/24,88.201.208.0/20,88.214.192.0/18,88.214.202.0/24,88.255.0.0/17,88.255.90.0/24,88.255.94.0/24,89.149.206.5
6,89.149.208.179,89.149.220.0/24] any -> $HOME_NET any (msg:"ET RBN
Known Russian Business Network Monitored Domains (17)";
reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count 1; cl
asstype:misc-attack; sid:2406021; rev:59;)
91.193.40.0/22
alert ip [91.196.232.0/22,91.194.140.0/23,91.198.71.0/24,91.193.40.0/22,91.193.56.0/22,193.33.128.0/23,194.110.69.0/24,91.195.116.
0/23] any -> $HOME_NET any (msg:"ET RBN Known Russian Business Network
Traffic - Chinese Nets"; reference:url,doc.emergingthreats.
net/bin/view/Main/RussianBusinessNetwork; threshold:type limit, track
by_src, seconds 60, count 1; sid:2406002; rev:7;)
alert ip [89.149.226.0/24,89.149.227.0/24,89.149.235.235,89.18.181.0/24,89.187.48.0/24,89.188.112.0/24,91.192.106.0/23,91.193.40.0
/22,91.193.56.0/22,91.194.140.0/23] any -> $HOME_NET any (msg:"ET RBN
Known Russian Business Network Monitored Domains (18)"; refe
rence:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count 1;
classtype:misc-attack; sid:2406022; rev:59;)
91.193.56.0/22
alert ip [91.196.232.0/22,91.194.140.0/23,91.198.71.0/24,91.193.40.0/22,91.193.56.0/22,193.33.128.0/23,194.110.69.0/24,91.195.116.
0/23] any -> $HOME_NET any (msg:"ET RBN Known Russian Business Network
Traffic - Chinese Nets"; reference:url,doc.emergingthreats.
net/bin/view/Main/RussianBusinessNetwork; threshold:type limit, track
by_src, seconds 60, count 1; sid:2406002; rev:7;)
alert ip [89.149.226.0/24,89.149.227.0/24,89.149.235.235,89.18.181.0/24,89.187.48.0/24,89.188.112.0/24,91.192.106.0/23,91.193.40.0
/22,91.193.56.0/22,91.194.140.0/23] any -> $HOME_NET any (msg:"ET RBN
Known Russian Business Network Monitored Domains (18)"; refe
rence:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count 1;
classtype:misc-attack; sid:2406022; rev:59;)
91.194.140.0/23
alert ip [91.196.232.0/22,91.194.140.0/23,91.198.71.0/24,91.193.40.0/22,91.193.56.0/22,193.33.128.0/23,194.110.69.0/24,91.195.116.
0/23] any -> $HOME_NET any (msg:"ET RBN Known Russian Business Network
Traffic - Chinese Nets"; reference:url,doc.emergingthreats.
net/bin/view/Main/RussianBusinessNetwork; threshold:type limit, track
by_src, seconds 60, count 1; sid:2406002; rev:7;)
alert ip [89.149.226.0/24,89.149.227.0/24,89.149.235.235,89.18.181.0/24,89.187.48.0/24,89.188.112.0/24,91.192.106.0/23,91.193.40.0
/22,91.193.56.0/22,91.194.140.0/23] any -> $HOME_NET any (msg:"ET RBN
Known Russian Business Network Monitored Domains (18)"; refe
rence:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count 1;
classtype:misc-attack; sid:2406022; rev:59;)
91.195.116.0/23
alert ip [91.196.232.0/22,91.194.140.0/23,91.198.71.0/24,91.193.40.0/22,91.193.56.0/22,193.33.128.0/23,194.110.69.0/24,91.195.116.
0/23] any -> $HOME_NET any (msg:"ET RBN Known Russian Business Network
Traffic - Chinese Nets"; reference:url,doc.emergingthreats.
net/bin/view/Main/RussianBusinessNetwork; threshold:type limit, track
by_src, seconds 60, count 1; sid:2406002; rev:7;)
alert ip [91.194.76.0/23,91.195.116.0/23,91.196.232.0/22,91.198.71.0/24,91.203.92.0/22,91.203.92.0/24,91.208.0.0/24,92.241.170.130
,92.62.100.0/24,92.62.101.0/24] any -> $HOME_NET any (msg:"ET RBN
Known Russian Business Network Monitored Domains (19)"; referenc
e:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count 1; clas
stype:misc-attack; sid:2406023; rev:59;)
91.196.232.0/22
alert ip [91.196.232.0/22,91.194.140.0/23,91.198.71.0/24,91.193.40.0/22,91.193.56.0/22,193.33.128.0/23,194.110.69.0/24,91.195.116.
0/23] any -> $HOME_NET any (msg:"ET RBN Known Russian Business Network
Traffic - Chinese Nets"; reference:url,doc.emergingthreats.
net/bin/view/Main/RussianBusinessNetwork; threshold:type limit, track
by_src, seconds 60, count 1; sid:2406002; rev:7;)
alert ip [91.194.76.0/23,91.195.116.0/23,91.196.232.0/22,91.198.71.0/24,91.203.92.0/22,91.203.92.0/24,91.208.0.0/24,92.241.170.130
,92.62.100.0/24,92.62.101.0/24] any -> $HOME_NET any (msg:"ET RBN
Known Russian Business Network Monitored Domains (19)"; referenc
e:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count 1; clas
stype:misc-attack; sid:2406023; rev:59;)
91.198.71.0/24
alert ip [91.196.232.0/22,91.194.140.0/23,91.198.71.0/24,91.193.40.0/22,91.193.56.0/22,193.33.128.0/23,194.110.69.0/24,91.195.116.
0/23] any -> $HOME_NET any (msg:"ET RBN Known Russian Business Network
Traffic - Chinese Nets"; reference:url,doc.emergingthreats.
net/bin/view/Main/RussianBusinessNetwork; threshold:type limit, track
by_src, seconds 60, count 1; sid:2406002; rev:7;)
alert ip [91.194.76.0/23,91.195.116.0/23,91.196.232.0/22,91.198.71.0/24,91.203.92.0/22,91.203.92.0/24,91.208.0.0/24,92.241.170.130
,92.62.100.0/24,92.62.101.0/24] any -> $HOME_NET any (msg:"ET RBN
Known Russian Business Network Monitored Domains (19)"; referenc
e:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
threshold: type limit, track by_src, seconds 60, count 1; clas
stype:misc-attack; sid:2406023; rev:59;)

From jonkman at jonkmans.com  Tue Sep  9 11:21:28 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Tue, 09 Sep 2008 11:21:28 -0400
Subject: [Emerging-Sigs] duplicates in rbn signatures
In-Reply-To: <ad3aaa740809090630g7e32df4cpa5a55c68f93a4a01@mail.gmail.com>
References: <ad3aaa740809090630g7e32df4cpa5a55c68f93a4a01@mail.gmail.com>
Message-ID: <48C69478.6010903@jonkmans.com>

Appreciate the note. Those rules are auto-generated, so if you still
have the info around can you let me know which IP ranges are dupes? I
didn't think there were any in the source list I use, so keen on finding
where it's coming from.

And ya, this is the perfect place to report issues, please continue to
do so!

Thanks

Matt

ddp wrote:
> Howdy,
> It looks like there are a number of duplicate IP addresses in the rbn
> signaturs. I think the following list should be accurate(ish). I
> apologize in advance for what will probably be a long and poorly
> formatted email. Advice on how to report things like this in the
> future is appreciated.
> 
> 193.33.128.0/23
> alert ip [91.196.232.0/22,91.194.140.0/23,91.198.71.0/24,91.193.40.0/22,91.193.56.0/22,193.33.128.0/23,194.110.69.0/24,91.195.116.
> 0/23] any -> $HOME_NET any (msg:"ET RBN Known Russian Business Network
> Traffic - Chinese Nets"; reference:url,doc.emergingthreats.
> net/bin/view/Main/RussianBusinessNetwork; threshold:type limit, track
> by_src, seconds 60, count 1; sid:2406002; rev:7;)
> alert ip [116.50.9.0/24,124.217.240.0/20,190.15.72.0/21,193.138.232.0/22,193.19.138.0/24,193.33.128.0/23,194.110.69.0/24,194.126.1
> 74.124,194.135.105.203,194.135.22.0/24] any -> $HOME_NET any (msg:"ET
> RBN Known Russian Business Network Monitored Domains (1)"; r
> eference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count
> 1; classtype:misc-attack; sid:2406005; rev:59;)
> 194.110.69.0/24
> alert ip [91.196.232.0/22,91.194.140.0/23,91.198.71.0/24,91.193.40.0/22,91.193.56.0/22,193.33.128.0/23,194.110.69.0/24,91.195.116.
> 0/23] any -> $HOME_NET any (msg:"ET RBN Known Russian Business Network
> Traffic - Chinese Nets"; reference:url,doc.emergingthreats.
> net/bin/view/Main/RussianBusinessNetwork; threshold:type limit, track
> by_src, seconds 60, count 1; sid:2406002; rev:7;)
> alert ip [116.50.9.0/24,124.217.240.0/20,190.15.72.0/21,193.138.232.0/22,193.19.138.0/24,193.33.128.0/23,194.110.69.0/24,194.126.1
> 74.124,194.135.105.203,194.135.22.0/24] any -> $HOME_NET any (msg:"ET
> RBN Known Russian Business Network Monitored Domains (1)"; r
> eference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count
> 1; classtype:misc-attack; sid:2406005; rev:59;)
> 194.146.204.0/22
> alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
> 1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
> 226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
> any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
> ess Network Traffic - Hosting Nets";
> reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold:type li
> mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
> alert ip [194.146.204.0/22,194.226.64.0/20,194.67.0.0/18,195.114.16.0/23,195.225.177.0/24,195.3.144.0/22,195.5.116.233,195.5.117.2
> 33,195.5.117.234,195.64.140.0/23] any -> $HOME_NET any (msg:"ET RBN
> Known Russian Business Network Monitored Domains (2)"; referen
> ce:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count 1; cla
> sstype:misc-attack; sid:2406006; rev:59;)
> 194.226.64.0/20
> alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
> 1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
> 226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
> any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
> ess Network Traffic - Hosting Nets";
> reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold:type li
> mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
> alert ip [194.146.204.0/22,194.226.64.0/20,194.67.0.0/18,195.114.16.0/23,195.225.177.0/24,195.3.144.0/22,195.5.116.233,195.5.117.2
> 33,195.5.117.234,195.64.140.0/23] any -> $HOME_NET any (msg:"ET RBN
> Known Russian Business Network Monitored Domains (2)"; referen
> ce:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count 1;
> classtype:misc-attack; sid:2406006; rev:59;)
> 195.114.16.0/23
> alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
> 1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
> 226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
> any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
> ess Network Traffic - Hosting Nets";
> reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold:type li
> mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
> alert ip [194.146.204.0/22,194.226.64.0/20,194.67.0.0/18,195.114.16.0/23,195.225.177.0/24,195.3.144.0/22,195.5.116.233,195.5.117.2
> 33,195.5.117.234,195.64.140.0/23] any -> $HOME_NET any (msg:"ET RBN
> Known Russian Business Network Monitored Domains (2)"; referen
> ce:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count 1; cla
> sstype:misc-attack; sid:2406006; rev:59;)
> 195.64.140.0/23
> alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
> 1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
> 226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
> any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
> ess Network Traffic - Hosting Nets";
> reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold:type li
> mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
> alert ip [194.146.204.0/22,194.226.64.0/20,194.67.0.0/18,195.114.16.0/23,195.225.177.0/24,195.3.144.0/22,195.5.116.233,195.5.117.2
> 33,195.5.117.234,195.64.140.0/23] any -> $HOME_NET any (msg:"ET RBN
> Known Russian Business Network Monitored Domains (2)"; referen
> ce:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count 1; cla
> sstype:misc-attack; sid:2406006; rev:59;)
> 195.64.162.0/23
> alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
> 1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
> 226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
> any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
> ess Network Traffic - Hosting Nets";
> reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold:type li
> mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
> alert ip [195.64.162.0/23,195.66.132.0/24,195.95.218.0/23,200.115.160.0/20,202.71.102.0/24,203.117.0.0/16,203.121.0.0/17,206.161.1
> 26.0/24,206.161.200.0/24,207.176.7.0/24] any -> $HOME_NET any (msg:"ET
> RBN Known Russian Business Network Monitored Domains (3)";
> reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count
>  1; classtype:misc-attack; sid:2406007; rev:59;)
> 200.115.160.0/20
> alert ip [200.115.160.0/20] any -> $HOME_NET any (msg:"ET RBN Known
> Russian Business Network Traffic - Central American Nets"; ref
> erence:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold:type limit, track by_src, seconds 60, count 1;
> sid:2406004; rev:4;)
> alert ip [195.64.162.0/23,195.66.132.0/24,195.95.218.0/23,200.115.160.0/20,202.71.102.0/24,203.117.0.0/16,203.121.0.0/17,206.161.1
> 26.0/24,206.161.200.0/24,207.176.7.0/24] any -> $HOME_NET any (msg:"ET
> RBN Known Russian Business Network Monitored Domains (3)";
> reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count
>  1; classtype:misc-attack; sid:2406007; rev:59;)
> 208.72.160.0/20
> alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
> 1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
> 226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
> any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
> ess Network Traffic - Hosting Nets";
> reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold:type li
> mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
> alert ip [207.210.85.61,207.226.173.0/24,207.226.175.0/24,207.226.179.0/24,207.226.182.0/24,208.43.41.0/24,208.72.160.0/20,208.73.
> 210.32,208.79.82.0/24,208.87.148.0/23] any -> $HOME_NET any (msg:"ET
> RBN Known Russian Business Network Monitored Domains (4)"; re
> ference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count 1
> ; classtype:misc-attack; sid:2406008; rev:59;)
> 65.254.54.178
> alert ip [62.140.208.131,62.140.208.197,62.154.15.154,65.254.54.178,66.252.1.255,67.18.179.15,67.19.24.168,67.19.24.169,67.19.24.1
> 70,67.19.24.171,67.19.24.172,67.19.24.173,67.19.24.174,67.19.24.175,67.19.72.205,67.19.72.206,67.137.217.219,72.10.164.69,72.20.14
> .3,72.20.25.134,74.54.31.196,80.70.239.253,84.45.24.53,84.45.47.130,84.45.90.141,85.133.4.138,89.149.186.77,89.149.186.81,89.149.1
> 86.89,193.93.232.6,195.66.226.151,213.200.78.66,213.200.79.194,213.200.80.46,216.180.244.179,217.118.119.26]
> any -> $HOME_NET any
> (msg:"ET RBN Known Russian Business Network Traffic - Individual
> Hosts"; reference:url,doc.emergingthreats.net/bin/view/Main/Russi
> anBusinessNetwork; threshold:type limit, track by_src, seconds 60,
> count 1; sid:2406001; rev:9;)
> alert ip [64.191.78.0/24,64.28.176.0/20,64.32.5.0/24,64.69.68.0/24,65.243.103.55,65.254.54.178,65.254.54.179,66.197.170.5,66.199.2
> 42.18,66.199.242.19] any -> $HOME_NET any (msg:"ET RBN Known Russian
> Business Network Monitored Domains (8)"; reference:url,doc.em
> ergingthreats.net/bin/view/Main/RussianBusinessNetwork; threshold:
> type limit, track by_src, seconds 60, count 1; classtype:misc-a
> ttack; sid:2406012; rev:59;)
> 66.252.0.0/19
> alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
> 1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
> 226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
> any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
> ess Network Traffic - Hosting Nets";
> reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold:type li
> mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
> alert ip [66.244.254.0/24,66.249.5.0/24,66.252.0.0/19,66.29.15.140,66.29.15.141,67.130.99.0/24,67.137.217.219,67.15.47.0/24,67.18.
> 179.0/24,67.19.24.170] any -> $HOME_NET any (msg:"ET RBN Known Russian
> Business Network Monitored Domains (9)"; reference:url,doc.
> emergingthreats.net/bin/view/Main/RussianBusinessNetwork; threshold:
> type limit, track by_src, seconds 60, count 1; classtype:misc
> -attack; sid:2406013; rev:59;)
> 67.137.217.219
> alert ip [62.140.208.131,62.140.208.197,62.154.15.154,65.254.54.178,66.252.1.255,67.18.179.15,67.19.24.168,67.19.24.169,67.19.24.1
> 70,67.19.24.171,67.19.24.172,67.19.24.173,67.19.24.174,67.19.24.175,67.19.72.205,67.19.72.206,67.137.217.219,72.10.164.69,72.20.14
> .3,72.20.25.134,74.54.31.196,80.70.239.253,84.45.24.53,84.45.47.130,84.45.90.141,85.133.4.138,89.149.186.77,89.149.186.81,89.149.1
> 86.89,193.93.232.6,195.66.226.151,213.200.78.66,213.200.79.194,213.200.80.46,216.180.244.179,217.118.119.26]
> any -> $HOME_NET any
> (msg:"ET RBN Known Russian Business Network Traffic - Individual
> Hosts"; reference:url,doc.emergingthreats.net/bin/view/Main/Russi
> anBusinessNetwork; threshold:type limit, track by_src, seconds 60,
> count 1; sid:2406001; rev:9;)
> alert ip [66.244.254.0/24,66.249.5.0/24,66.252.0.0/19,66.29.15.140,66.29.15.141,67.130.99.0/24,67.137.217.219,67.15.47.0/24,67.18.
> 179.0/24,67.19.24.170] any -> $HOME_NET any (msg:"ET RBN Known Russian
> Business Network Monitored Domains (9)"; reference:url,doc.
> emergingthreats.net/bin/view/Main/RussianBusinessNetwork; threshold:
> type limit, track by_src, seconds 60, count 1; classtype:misc
> -attack; sid:2406013; rev:59;)
> 67.19.24.170
> alert ip [62.140.208.131,62.140.208.197,62.154.15.154,65.254.54.178,66.252.1.255,67.18.179.15,67.19.24.168,67.19.24.169,67.19.24.1
> 70,67.19.24.171,67.19.24.172,67.19.24.173,67.19.24.174,67.19.24.175,67.19.72.205,67.19.72.206,67.137.217.219,72.10.164.69,72.20.14
> .3,72.20.25.134,74.54.31.196,80.70.239.253,84.45.24.53,84.45.47.130,84.45.90.141,85.133.4.138,89.149.186.77,89.149.186.81,89.149.1
> 86.89,193.93.232.6,195.66.226.151,213.200.78.66,213.200.79.194,213.200.80.46,216.180.244.179,217.118.119.26]
> any -> $HOME_NET any
> (msg:"ET RBN Known Russian Business Network Traffic - Individual
> Hosts"; reference:url,doc.emergingthreats.net/bin/view/Main/Russi
> anBusinessNetwork; threshold:type limit, track by_src, seconds 60,
> count 1; sid:2406001; rev:9;)
> alert ip [66.244.254.0/24,66.249.5.0/24,66.252.0.0/19,66.29.15.140,66.29.15.141,67.130.99.0/24,67.137.217.219,67.15.47.0/24,67.18.
> 179.0/24,67.19.24.170] any -> $HOME_NET any (msg:"ET RBN Known Russian
> Business Network Monitored Domains (9)"; reference:url,doc.
> emergingthreats.net/bin/view/Main/RussianBusinessNetwork; threshold:
> type limit, track by_src, seconds 60, count 1; classtype:misc
> -attack; sid:2406013; rev:59;)
> 69.50.160.0/19
> alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
> 1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
> 226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
> any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
> ess Network Traffic - Hosting Nets";
> reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold:type li
> mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
> alert ip [69.22.168.0/21,69.22.184.0/22,69.31.128.0/24,69.31.40.0/21,69.31.64.0/20,69.31.80.0/21,69.39.224.0/24,69.41.183.0/24,69.
> 42.216.0/24,69.50.160.0/19] any -> $HOME_NET any (msg:"ET RBN Known
> Russian Business Network Monitored Domains (11)"; reference:ur
> l,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count 1; classtyp
> e:misc-attack; sid:2406015; rev:59;)
> 81.94.16.0/20
> alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
> 1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
> any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
> ess Network Traffic - Hosting Nets";
> reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold:type li
> mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
> alert ip [78.157.143.0/24,78.47.168.82,79.135.160.0/19,79.135.167.0/24,79.143.176.0/22,80.70.224.0/20,80.77.80.0/20,80.91.76.150,8
> 1.94.16.0/20,81.95.128.0/19] any -> $HOME_NET any (msg:"ET RBN Known
> Russian Business Network Monitored Domains (15)"; reference:u
> rl,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count 1; classty
> pe:misc-attack; sid:2406019; rev:59;)
> 81.95.128.0/19
> alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
> 1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
> 226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
> any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
> ess Network Traffic - Hosting Nets";
> reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold:type li
> mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
> alert ip [78.157.143.0/24,78.47.168.82,79.135.160.0/19,79.135.167.0/24,79.143.176.0/22,80.70.224.0/20,80.77.80.0/20,80.91.76.150,8
> 1.94.16.0/20,81.95.128.0/19] any -> $HOME_NET any (msg:"ET RBN Known
> Russian Business Network Monitored Domains (15)"; reference:u
> rl,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count 1; classty
> pe:misc-attack; sid:2406019; rev:59;)
> 85.255.121.0/24
> alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
> 1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
> 226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
> any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
> ess Network Traffic - Hosting Nets";
> reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold:type li
> mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
> alert ip [85.255.121.0/24,88.201.208.0/20,88.214.192.0/18,88.214.202.0/24,88.255.0.0/17,88.255.90.0/24,88.255.94.0/24,89.149.206.5
> 6,89.149.208.179,89.149.220.0/24] any -> $HOME_NET any (msg:"ET RBN
> Known Russian Business Network Monitored Domains (17)"; refere
> nce:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count 1; cl
> asstype:misc-attack; sid:2406021; rev:59;)
> 88.201.208.0/20
> alert ip [58.65.233.0/24,58.65.239.66/31,65.99.192.0/20,65.254.48.0/20,66.232.96.0/19,66.252.0.0/19,69.50.160.0/19,81.94.16.0/20,8
> 1.95.128.0/19,85.249.23.0/24,85.255.112.0/24,85.255.116.0/24,85.255.121.0/24,88.201.208.0/20,194.146.204.0/22,194.226.64.0/20,194.
> 226.96.0/24,195.114.16.0/23,195.64.140.0/23,195.64.162.0/23,208.72.160.0/20]
> any -> $HOME_NET any (msg:"ET RBN Known Russian Busin
> ess Network Traffic - Hosting Nets";
> reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold:type li
> mit, track by_src, seconds 60, count 1; sid:2406000; rev:7;)
> alert ip [85.255.121.0/24,88.201.208.0/20,88.214.192.0/18,88.214.202.0/24,88.255.0.0/17,88.255.90.0/24,88.255.94.0/24,89.149.206.5
> 6,89.149.208.179,89.149.220.0/24] any -> $HOME_NET any (msg:"ET RBN
> Known Russian Business Network Monitored Domains (17)";
> reference:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count 1; cl
> asstype:misc-attack; sid:2406021; rev:59;)
> 91.193.40.0/22
> alert ip [91.196.232.0/22,91.194.140.0/23,91.198.71.0/24,91.193.40.0/22,91.193.56.0/22,193.33.128.0/23,194.110.69.0/24,91.195.116.
> 0/23] any -> $HOME_NET any (msg:"ET RBN Known Russian Business Network
> Traffic - Chinese Nets"; reference:url,doc.emergingthreats.
> net/bin/view/Main/RussianBusinessNetwork; threshold:type limit, track
> by_src, seconds 60, count 1; sid:2406002; rev:7;)
> alert ip [89.149.226.0/24,89.149.227.0/24,89.149.235.235,89.18.181.0/24,89.187.48.0/24,89.188.112.0/24,91.192.106.0/23,91.193.40.0
> /22,91.193.56.0/22,91.194.140.0/23] any -> $HOME_NET any (msg:"ET RBN
> Known Russian Business Network Monitored Domains (18)"; refe
> rence:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count 1;
> classtype:misc-attack; sid:2406022; rev:59;)
> 91.193.56.0/22
> alert ip [91.196.232.0/22,91.194.140.0/23,91.198.71.0/24,91.193.40.0/22,91.193.56.0/22,193.33.128.0/23,194.110.69.0/24,91.195.116.
> 0/23] any -> $HOME_NET any (msg:"ET RBN Known Russian Business Network
> Traffic - Chinese Nets"; reference:url,doc.emergingthreats.
> net/bin/view/Main/RussianBusinessNetwork; threshold:type limit, track
> by_src, seconds 60, count 1; sid:2406002; rev:7;)
> alert ip [89.149.226.0/24,89.149.227.0/24,89.149.235.235,89.18.181.0/24,89.187.48.0/24,89.188.112.0/24,91.192.106.0/23,91.193.40.0
> /22,91.193.56.0/22,91.194.140.0/23] any -> $HOME_NET any (msg:"ET RBN
> Known Russian Business Network Monitored Domains (18)"; refe
> rence:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count 1;
> classtype:misc-attack; sid:2406022; rev:59;)
> 91.194.140.0/23
> alert ip [91.196.232.0/22,91.194.140.0/23,91.198.71.0/24,91.193.40.0/22,91.193.56.0/22,193.33.128.0/23,194.110.69.0/24,91.195.116.
> 0/23] any -> $HOME_NET any (msg:"ET RBN Known Russian Business Network
> Traffic - Chinese Nets"; reference:url,doc.emergingthreats.
> net/bin/view/Main/RussianBusinessNetwork; threshold:type limit, track
> by_src, seconds 60, count 1; sid:2406002; rev:7;)
> alert ip [89.149.226.0/24,89.149.227.0/24,89.149.235.235,89.18.181.0/24,89.187.48.0/24,89.188.112.0/24,91.192.106.0/23,91.193.40.0
> /22,91.193.56.0/22,91.194.140.0/23] any -> $HOME_NET any (msg:"ET RBN
> Known Russian Business Network Monitored Domains (18)"; refe
> rence:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count 1;
> classtype:misc-attack; sid:2406022; rev:59;)
> 91.195.116.0/23
> alert ip [91.196.232.0/22,91.194.140.0/23,91.198.71.0/24,91.193.40.0/22,91.193.56.0/22,193.33.128.0/23,194.110.69.0/24,91.195.116.
> 0/23] any -> $HOME_NET any (msg:"ET RBN Known Russian Business Network
> Traffic - Chinese Nets"; reference:url,doc.emergingthreats.
> net/bin/view/Main/RussianBusinessNetwork; threshold:type limit, track
> by_src, seconds 60, count 1; sid:2406002; rev:7;)
> alert ip [91.194.76.0/23,91.195.116.0/23,91.196.232.0/22,91.198.71.0/24,91.203.92.0/22,91.203.92.0/24,91.208.0.0/24,92.241.170.130
> ,92.62.100.0/24,92.62.101.0/24] any -> $HOME_NET any (msg:"ET RBN
> Known Russian Business Network Monitored Domains (19)"; referenc
> e:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count 1; clas
> stype:misc-attack; sid:2406023; rev:59;)
> 91.196.232.0/22
> alert ip [91.196.232.0/22,91.194.140.0/23,91.198.71.0/24,91.193.40.0/22,91.193.56.0/22,193.33.128.0/23,194.110.69.0/24,91.195.116.
> 0/23] any -> $HOME_NET any (msg:"ET RBN Known Russian Business Network
> Traffic - Chinese Nets"; reference:url,doc.emergingthreats.
> net/bin/view/Main/RussianBusinessNetwork; threshold:type limit, track
> by_src, seconds 60, count 1; sid:2406002; rev:7;)
> alert ip [91.194.76.0/23,91.195.116.0/23,91.196.232.0/22,91.198.71.0/24,91.203.92.0/22,91.203.92.0/24,91.208.0.0/24,92.241.170.130
> ,92.62.100.0/24,92.62.101.0/24] any -> $HOME_NET any (msg:"ET RBN
> Known Russian Business Network Monitored Domains (19)"; referenc
> e:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count 1; clas
> stype:misc-attack; sid:2406023; rev:59;)
> 91.198.71.0/24
> alert ip [91.196.232.0/22,91.194.140.0/23,91.198.71.0/24,91.193.40.0/22,91.193.56.0/22,193.33.128.0/23,194.110.69.0/24,91.195.116.
> 0/23] any -> $HOME_NET any (msg:"ET RBN Known Russian Business Network
> Traffic - Chinese Nets"; reference:url,doc.emergingthreats.
> net/bin/view/Main/RussianBusinessNetwork; threshold:type limit, track
> by_src, seconds 60, count 1; sid:2406002; rev:7;)
> alert ip [91.194.76.0/23,91.195.116.0/23,91.196.232.0/22,91.198.71.0/24,91.203.92.0/22,91.203.92.0/24,91.208.0.0/24,92.241.170.130
> ,92.62.100.0/24,92.62.101.0/24] any -> $HOME_NET any (msg:"ET RBN
> Known Russian Business Network Monitored Domains (19)"; referenc
> e:url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork;
> threshold: type limit, track by_src, seconds 60, count 1; clas
> stype:misc-attack; sid:2406023; rev:59;)
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From ddpbsd at gmail.com  Tue Sep  9 12:22:37 2008
From: ddpbsd at gmail.com (ddp)
Date: Tue, 9 Sep 2008 12:22:37 -0400
Subject: [Emerging-Sigs] duplicates in rbn signatures
In-Reply-To: <48C69478.6010903@jonkmans.com>
References: <ad3aaa740809090630g7e32df4cpa5a55c68f93a4a01@mail.gmail.com>
	<48C69478.6010903@jonkmans.com>
Message-ID: <ad3aaa740809090922o7f8dde2bi9f5e8fe12409876e@mail.gmail.com>

I found the following in multiple rules:
193.33.128.0/23
194.110.69.0/24
194.146.204.0/22
194.226.64.0/20
195.114.16.0/23
195.64.140.0/23
195.64.162.0/23
200.115.160.0/20
208.72.160.0/20
65.254.54.178
66.252.0.0/19
67.137.217.219
67.19.24.170
69.50.160.0/19
81.94.16.0/20
81.95.128.0/19
85.255.121.0/24
88.201.208.0/20
91.193.40.0/22
91.193.56.0/22
91.194.140.0/23
91.195.116.0/23
91.196.232.0/22
91.198.71.0/24

From jonkman at jonkmans.com  Tue Sep  9 12:44:12 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Tue, 09 Sep 2008 12:44:12 -0400
Subject: [Emerging-Sigs] duplicates in rbn signatures
In-Reply-To: <ad3aaa740809090922o7f8dde2bi9f5e8fe12409876e@mail.gmail.com>
References: <ad3aaa740809090630g7e32df4cpa5a55c68f93a4a01@mail.gmail.com>	<48C69478.6010903@jonkmans.com>
	<ad3aaa740809090922o7f8dde2bi9f5e8fe12409876e@mail.gmail.com>
Message-ID: <48C6A7DC.5070805@jonkmans.com>

Ahhh, I found the issue. I rolled some of the IPs from the static rules
into the auto-list.

All fixed up. Glad you noticed! Looking better now?

Thanks

Matt

ddp wrote:
> I found the following in multiple rules:
> 193.33.128.0/23
> 194.110.69.0/24
> 194.146.204.0/22
> 194.226.64.0/20
> 195.114.16.0/23
> 195.64.140.0/23
> 195.64.162.0/23
> 200.115.160.0/20
> 208.72.160.0/20
> 65.254.54.178
> 66.252.0.0/19
> 67.137.217.219
> 67.19.24.170
> 69.50.160.0/19
> 81.94.16.0/20
> 81.95.128.0/19
> 85.255.121.0/24
> 88.201.208.0/20
> 91.193.40.0/22
> 91.193.56.0/22
> 91.194.140.0/23
> 91.195.116.0/23
> 91.196.232.0/22
> 91.198.71.0/24
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Tue Sep  9 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Tue,  9 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080909200008.03FA145026@goliath.jonkmans.com>


[***] Results from Oinkmaster started Tue Sep  9 16:00:07 2008 [***]

[+++]          Added rules:          [+++]

 2008542 - ET EXPLOIT CitectSCADA ODBC Overflowflow Attempt (emerging-exploit.rules)
 2406003 - ET RBN Known Russian Business Network Monitored Domains (4) (emerging-rbn.rules)
 2407003 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (4) (emerging-rbn-BLOCK.rules)


[///]     Modified active rules:     [///]

 2406000 - ET RBN Known Russian Business Network Monitored Domains (1) (emerging-rbn.rules)
 2406001 - ET RBN Known Russian Business Network Monitored Domains (2) (emerging-rbn.rules)
 2406002 - ET RBN Known Russian Business Network Monitored Domains (3) (emerging-rbn.rules)
 2406004 - ET RBN Known Russian Business Network Monitored Domains (5) (emerging-rbn.rules)
 2406005 - ET RBN Known Russian Business Network Monitored Domains (6) (emerging-rbn.rules)
 2406006 - ET RBN Known Russian Business Network Monitored Domains (7) (emerging-rbn.rules)
 2406007 - ET RBN Known Russian Business Network Monitored Domains (8) (emerging-rbn.rules)
 2406008 - ET RBN Known Russian Business Network Monitored Domains (9) (emerging-rbn.rules)
 2406009 - ET RBN Known Russian Business Network Monitored Domains (10) (emerging-rbn.rules)
 2406010 - ET RBN Known Russian Business Network Monitored Domains (11) (emerging-rbn.rules)
 2406011 - ET RBN Known Russian Business Network Monitored Domains (12) (emerging-rbn.rules)
 2406012 - ET RBN Known Russian Business Network Monitored Domains (13) (emerging-rbn.rules)
 2406013 - ET RBN Known Russian Business Network Monitored Domains (14) (emerging-rbn.rules)
 2406014 - ET RBN Known Russian Business Network Monitored Domains (15) (emerging-rbn.rules)
 2406015 - ET RBN Known Russian Business Network Monitored Domains (16) (emerging-rbn.rules)
 2406016 - ET RBN Known Russian Business Network Monitored Domains (17) (emerging-rbn.rules)
 2406017 - ET RBN Known Russian Business Network Monitored Domains (18) (emerging-rbn.rules)
 2406018 - ET RBN Known Russian Business Network Monitored Domains (19) (emerging-rbn.rules)
 2406019 - ET RBN Known Russian Business Network Monitored Domains (20) (emerging-rbn.rules)
 2407000 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (1) (emerging-rbn-BLOCK.rules)
 2407001 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (2) (emerging-rbn-BLOCK.rules)
 2407002 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (3) (emerging-rbn-BLOCK.rules)
 2407004 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (5) (emerging-rbn-BLOCK.rules)
 2407005 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (6) (emerging-rbn-BLOCK.rules)
 2407006 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (7) (emerging-rbn-BLOCK.rules)
 2407007 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (8) (emerging-rbn-BLOCK.rules)
 2407008 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (9) (emerging-rbn-BLOCK.rules)
 2407009 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (10) (emerging-rbn-BLOCK.rules)
 2407010 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (11) (emerging-rbn-BLOCK.rules)
 2407011 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (12) (emerging-rbn-BLOCK.rules)
 2407012 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (13) (emerging-rbn-BLOCK.rules)
 2407013 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (14) (emerging-rbn-BLOCK.rules)
 2407014 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (15) (emerging-rbn-BLOCK.rules)
 2407015 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) (emerging-rbn-BLOCK.rules)
 2407016 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) (emerging-rbn-BLOCK.rules)
 2407017 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) (emerging-rbn-BLOCK.rules)
 2407018 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) (emerging-rbn-BLOCK.rules)
 2407019 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) (emerging-rbn-BLOCK.rules)


[---]         Removed rules:         [---]

 2406020 - ET RBN Known Russian Business Network Monitored Domains (16) (emerging-rbn.rules)
 2406021 - ET RBN Known Russian Business Network Monitored Domains (17) (emerging-rbn.rules)
 2406022 - ET RBN Known Russian Business Network Monitored Domains (18) (emerging-rbn.rules)
 2406023 - ET RBN Known Russian Business Network Monitored Domains (19) (emerging-rbn.rules)
 2406024 - ET RBN Known Russian Business Network Monitored Domains (20) (emerging-rbn.rules)
 2407020 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) (emerging-rbn-BLOCK.rules)
 2407021 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) (emerging-rbn-BLOCK.rules)
 2407022 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) (emerging-rbn-BLOCK.rules)
 2407023 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) (emerging-rbn-BLOCK.rules)
 2407024 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) (emerging-rbn-BLOCK.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-exploit.rules (1):
        #by Dale Peterson of digitalbond.com

     -> Added to emerging-rbn-BLOCK.rules (2):
        #  VERSION 60
        #  Updated 2008-09-09 12:41:40

     -> Added to emerging-rbn.rules (2):
        #  VERSION 60
        #  Updated 2008-09-09 12:41:40

     -> Added to emerging-sid-msg.map (43):
        2008542 || ET EXPLOIT CitectSCADA ODBC Overflowflow Attempt || url,www.digitalbond.com/index.php/2008/09/08/ids-signature-for-citect-vuln/ || cve,2008-2639
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org
        2406000 || ET RBN Known Russian Business Network Monitored Domains (1) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406001 || ET RBN Known Russian Business Network Monitored Domains (2) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406002 || ET RBN Known Russian Business Network Monitored Domains (3) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406003 || ET RBN Known Russian Business Network Monitored Domains (4) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406004 || ET RBN Known Russian Business Network Monitored Domains (5) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406005 || ET RBN Known Russian Business Network Monitored Domains (6) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406006 || ET RBN Known Russian Business Network Monitored Domains (7) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406007 || ET RBN Known Russian Business Network Monitored Domains (8) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406008 || ET RBN Known Russian Business Network Monitored Domains (9) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406009 || ET RBN Known Russian Business Network Monitored Domains (10) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406010 || ET RBN Known Russian Business Network Monitored Domains (11) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406011 || ET RBN Known Russian Business Network Monitored Domains (12) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406012 || ET RBN Known Russian Business Network Monitored Domains (13) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406013 || ET RBN Known Russian Business Network Monitored Domains (14) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406014 || ET RBN Known Russian Business Network Monitored Domains (15) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406015 || ET RBN Known Russian Business Network Monitored Domains (16) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406016 || ET RBN Known Russian Business Network Monitored Domains (17) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406017 || ET RBN Known Russian Business Network Monitored Domains (18) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406018 || ET RBN Known Russian Business Network Monitored Domains (19) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406019 || ET RBN Known Russian Business Network Monitored Domains (20) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407000 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (1) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407001 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (2) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407002 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (3) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407003 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (4) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407004 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (5) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407005 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (6) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407006 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (7) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407007 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (8) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407008 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (9) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407009 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (10) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407010 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (11) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407011 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (12) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407012 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (13) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407013 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (14) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407014 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (15) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407015 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407016 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407017 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407018 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407019 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork

     -> Added to emerging-sid-msg.map.txt (43):
        2008542 || ET EXPLOIT CitectSCADA ODBC Overflowflow Attempt || url,www.digitalbond.com/index.php/2008/09/08/ids-signature-for-citect-vuln/ || cve,2008-2639
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org
        2406000 || ET RBN Known Russian Business Network Monitored Domains (1) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406001 || ET RBN Known Russian Business Network Monitored Domains (2) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406002 || ET RBN Known Russian Business Network Monitored Domains (3) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406003 || ET RBN Known Russian Business Network Monitored Domains (4) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406004 || ET RBN Known Russian Business Network Monitored Domains (5) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406005 || ET RBN Known Russian Business Network Monitored Domains (6) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406006 || ET RBN Known Russian Business Network Monitored Domains (7) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406007 || ET RBN Known Russian Business Network Monitored Domains (8) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406008 || ET RBN Known Russian Business Network Monitored Domains (9) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406009 || ET RBN Known Russian Business Network Monitored Domains (10) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406010 || ET RBN Known Russian Business Network Monitored Domains (11) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406011 || ET RBN Known Russian Business Network Monitored Domains (12) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406012 || ET RBN Known Russian Business Network Monitored Domains (13) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406013 || ET RBN Known Russian Business Network Monitored Domains (14) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406014 || ET RBN Known Russian Business Network Monitored Domains (15) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406015 || ET RBN Known Russian Business Network Monitored Domains (16) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406016 || ET RBN Known Russian Business Network Monitored Domains (17) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406017 || ET RBN Known Russian Business Network Monitored Domains (18) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406018 || ET RBN Known Russian Business Network Monitored Domains (19) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406019 || ET RBN Known Russian Business Network Monitored Domains (20) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407000 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (1) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407001 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (2) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407002 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (3) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407003 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (4) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407004 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (5) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407005 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (6) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407006 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (7) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407007 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (8) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407008 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (9) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407009 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (10) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407010 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (11) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407011 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (12) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407012 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (13) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407013 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (14) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407014 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (15) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407015 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407016 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407017 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407018 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407019 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-rbn-BLOCK.rules (6):
        #general hosts
        #individual general hosts
        #chinese
        #Panamanian/Central America
        #  VERSION 59
        #  Updated 2008-08-27 16:34:55

     -> Removed from emerging-rbn.rules (6):
        #general hosts
        #individual general hosts
        #chinese
        #Panamanian/Central America
        #  VERSION 59
        #  Updated 2008-08-27 16:34:55

     -> Removed from emerging-sid-msg.map (48):
        2406000 || ET RBN Known Russian Business Network Traffic - Hosting Nets || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406001 || ET RBN Known Russian Business Network Traffic - Individual Hosts || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406002 || ET RBN Known Russian Business Network Traffic - Chinese Nets || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406004 || ET RBN Known Russian Business Network Traffic - Central American Nets || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406005 || ET RBN Known Russian Business Network Monitored Domains (1) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406006 || ET RBN Known Russian Business Network Monitored Domains (2) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406007 || ET RBN Known Russian Business Network Monitored Domains (3) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406008 || ET RBN Known Russian Business Network Monitored Domains (4) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406009 || ET RBN Known Russian Business Network Monitored Domains (5) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406010 || ET RBN Known Russian Business Network Monitored Domains (6) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406011 || ET RBN Known Russian Business Network Monitored Domains (7) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406012 || ET RBN Known Russian Business Network Monitored Domains (8) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406013 || ET RBN Known Russian Business Network Monitored Domains (9) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406014 || ET RBN Known Russian Business Network Monitored Domains (10) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406015 || ET RBN Known Russian Business Network Monitored Domains (11) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406016 || ET RBN Known Russian Business Network Monitored Domains (12) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406017 || ET RBN Known Russian Business Network Monitored Domains (13) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406018 || ET RBN Known Russian Business Network Monitored Domains (14) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406019 || ET RBN Known Russian Business Network Monitored Domains (15) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406020 || ET RBN Known Russian Business Network Monitored Domains (16) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406021 || ET RBN Known Russian Business Network Monitored Domains (17) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406022 || ET RBN Known Russian Business Network Monitored Domains (18) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406023 || ET RBN Known Russian Business Network Monitored Domains (19) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406024 || ET RBN Known Russian Business Network Monitored Domains (20) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407000 || ET RBN Known Russian Business Network Traffic - Hosting Nets - BLOCKING || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407001 || ET RBN Known Russian Business Network Traffic - Individual Hosts - BLOCKING || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407002 || ET RBN Known Russian Business Network Traffic - Chinese Nets - BLOCKING || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407004 || ET RBN Known Russian Business Network Traffic - Central American Nets || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407005 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (1) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407006 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (2) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407007 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (3) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407008 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (4) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407009 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (5) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407010 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (6) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407011 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (7) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407012 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (8) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407013 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (9) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407014 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (10) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407015 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (11) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407016 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (12) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407017 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (13) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407018 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (14) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407019 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (15) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407020 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407021 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407022 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407023 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407024 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork

     -> Removed from emerging-sid-msg.map.txt (48):
        2406000 || ET RBN Known Russian Business Network Traffic - Hosting Nets || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406001 || ET RBN Known Russian Business Network Traffic - Individual Hosts || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406002 || ET RBN Known Russian Business Network Traffic - Chinese Nets || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406004 || ET RBN Known Russian Business Network Traffic - Central American Nets || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406005 || ET RBN Known Russian Business Network Monitored Domains (1) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406006 || ET RBN Known Russian Business Network Monitored Domains (2) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406007 || ET RBN Known Russian Business Network Monitored Domains (3) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406008 || ET RBN Known Russian Business Network Monitored Domains (4) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406009 || ET RBN Known Russian Business Network Monitored Domains (5) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406010 || ET RBN Known Russian Business Network Monitored Domains (6) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406011 || ET RBN Known Russian Business Network Monitored Domains (7) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406012 || ET RBN Known Russian Business Network Monitored Domains (8) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406013 || ET RBN Known Russian Business Network Monitored Domains (9) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406014 || ET RBN Known Russian Business Network Monitored Domains (10) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406015 || ET RBN Known Russian Business Network Monitored Domains (11) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406016 || ET RBN Known Russian Business Network Monitored Domains (12) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406017 || ET RBN Known Russian Business Network Monitored Domains (13) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406018 || ET RBN Known Russian Business Network Monitored Domains (14) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406019 || ET RBN Known Russian Business Network Monitored Domains (15) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406020 || ET RBN Known Russian Business Network Monitored Domains (16) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406021 || ET RBN Known Russian Business Network Monitored Domains (17) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406022 || ET RBN Known Russian Business Network Monitored Domains (18) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406023 || ET RBN Known Russian Business Network Monitored Domains (19) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406024 || ET RBN Known Russian Business Network Monitored Domains (20) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407000 || ET RBN Known Russian Business Network Traffic - Hosting Nets - BLOCKING || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407001 || ET RBN Known Russian Business Network Traffic - Individual Hosts - BLOCKING || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407002 || ET RBN Known Russian Business Network Traffic - Chinese Nets - BLOCKING || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407004 || ET RBN Known Russian Business Network Traffic - Central American Nets || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407005 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (1) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407006 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (2) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407007 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (3) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407008 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (4) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407009 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (5) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407010 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (6) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407011 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (7) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407012 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (8) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407013 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (9) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407014 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (10) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407015 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (11) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407016 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (12) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407017 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (13) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407018 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (14) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407019 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (15) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407020 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407021 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407022 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407023 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407024 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork


From thierry.chich at ac-clermont.fr  Wed Sep 10 11:00:38 2008
From: thierry.chich at ac-clermont.fr (Thierry CHICH)
Date: Wed, 10 Sep 2008 17:00:38 +0200
Subject: [Emerging-Sigs] lot of FP with 2003020
Message-ID: <200809101700.38554.thierry.chich@ac-clermont.fr>


alert tcp any any -> any 1024:65535 (msg:"ET POLICY TLS/SSL Encrypted 
Application Data on Unusual Port"; flowbits:isset,BS.SSL.Established; 
flow:established,from_server; content:"|17 03 01|"; depth:4; threshold:type 
limit, count 1, seconds 120, track by_src; 
classtype:unusual-client-port-connection; sid:2003020; rev:6;)


I don't understand this rule. Where is the server ? At the left or at the 
right side ? from "from_server", I believe that it was the at left side, but 
it doesn't make sense. 

I have clients connecting to their pops server that are trigging an alert, 
with this rule.


For instance: 

[**] [1:2003020:6] ET POLICY TLS/SSL Encrypted Application Data on Unusual 
Port [**]
[Classification: A client was using an unusual port] [Priority: 2]
09/10-16:48:54.121283 209.85.135.111:995 -> x.x.x.x:2776
TCP TTL:53 TOS:0x0 ID:62625 IpLen:20 DgmLen:75
***AP*** Seq: 0x3D3DB401  Ack: 0x97BC3C2B  Win: 0x1D50  TcpLen: 20

Other point, there is a p2p trafic that triger that alerts too, and I can't 
efficiently block it. Is it someone that know what kind of p2p is it ?
I belivied it was emule, but I am not sure anymore...


-- 
Thierry CHICH

From eslerj at gmail.com  Wed Sep 10 11:06:03 2008
From: eslerj at gmail.com (Joel Esler)
Date: Wed, 10 Sep 2008 11:06:03 -0400
Subject: [Emerging-Sigs] lot of FP with 2003020
In-Reply-To: <200809101700.38554.thierry.chich@ac-clermont.fr>
References: <200809101700.38554.thierry.chich@ac-clermont.fr>
Message-ID: <8c643a500809100806y341857c1h9c81c85d2beeafda@mail.gmail.com>

This is a connection from an IMAP SSL port.  The rule needs to be rewritten
to be EXTERNAL_NET -> HOME_NET, which is, I am assuming catching people on
your network using encryption on high ports.  I guess that's the point.
But, yes, any any should not be used, as it will result in FP's like you
have below.

J

On Wed, Sep 10, 2008 at 11:00 AM, Thierry CHICH <
thierry.chich at ac-clermont.fr> wrote:

>
> alert tcp any any -> any 1024:65535 (msg:"ET POLICY TLS/SSL Encrypted
> Application Data on Unusual Port"; flowbits:isset,BS.SSL.Established;
> flow:established,from_server; content:"|17 03 01|"; depth:4; threshold:type
> limit, count 1, seconds 120, track by_src;
> classtype:unusual-client-port-connection; sid:2003020; rev:6;)
>
>
> I don't understand this rule. Where is the server ? At the left or at the
> right side ? from "from_server", I believe that it was the at left side,
> but
> it doesn't make sense.
>
> I have clients connecting to their pops server that are trigging an alert,
> with this rule.
>
>
> For instance:
>
> [**] [1:2003020:6] ET POLICY TLS/SSL Encrypted Application Data on Unusual
> Port [**]
> [Classification: A client was using an unusual port] [Priority: 2]
> 09/10-16:48:54.121283 209.85.135.111:995 -> x.x.x.x:2776
> TCP TTL:53 TOS:0x0 ID:62625 IpLen:20 DgmLen:75
> ***AP*** Seq: 0x3D3DB401  Ack: 0x97BC3C2B  Win: 0x1D50  TcpLen: 20
>
> Other point, there is a p2p trafic that triger that alerts too, and I can't
> efficiently block it. Is it someone that know what kind of p2p is it ?
> I belivied it was emule, but I am not sure anymore...
>
>
> --
> Thierry CHICH
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080910/c2e086be/attachment.html

From jonkman at jonkmans.com  Wed Sep 10 11:24:19 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Wed, 10 Sep 2008 11:24:19 -0400
Subject: [Emerging-Sigs] lot of FP with 2003020
In-Reply-To: <200809101700.38554.thierry.chich@ac-clermont.fr>
References: <200809101700.38554.thierry.chich@ac-clermont.fr>
Message-ID: <48C7E6A3.8080109@jonkmans.com>

That is a good hit, but one we should exclude. I've added:

alert tcp $HOME_NET any -> $EXTERNAL_NET 995 (msg:"ET POLICY Known SSL
traffic on port 995 (imaps) being excluded from SSL Alerts";
flow:established,to_server; flowbits:noalert;
flowbits:set,BS.SSL.Known.Port; classtype:not-suspicious; sid:2008543;
rev:1;)

Tot he list of rules excluding normal ports. That will fix the initial
issue.

Making these home_net to external_net is also a good way to go.
originally I left them any any hoping to catch inbound ssl connections.
That hasn't turned out to be that useful as far as I've seen. I'll add
the home/external net stuff to get the performance gain and accuracy.

Let me know if that does the trick!

Thanks

Matt

Thierry CHICH wrote:
> alert tcp any any -> any 1024:65535 (msg:"ET POLICY TLS/SSL Encrypted 
> Application Data on Unusual Port"; flowbits:isset,BS.SSL.Established; 
> flow:established,from_server; content:"|17 03 01|"; depth:4; threshold:type 
> limit, count 1, seconds 120, track by_src; 
> classtype:unusual-client-port-connection; sid:2003020; rev:6;)
> 
> 
> I don't understand this rule. Where is the server ? At the left or at the 
> right side ? from "from_server", I believe that it was the at left side, but 
> it doesn't make sense. 
> 
> I have clients connecting to their pops server that are trigging an alert, 
> with this rule.
> 
> 
> For instance: 
> 
> [**] [1:2003020:6] ET POLICY TLS/SSL Encrypted Application Data on Unusual 
> Port [**]
> [Classification: A client was using an unusual port] [Priority: 2]
> 09/10-16:48:54.121283 209.85.135.111:995 -> x.x.x.x:2776
> TCP TTL:53 TOS:0x0 ID:62625 IpLen:20 DgmLen:75
> ***AP*** Seq: 0x3D3DB401  Ack: 0x97BC3C2B  Win: 0x1D50  TcpLen: 20
> 
> Other point, there is a p2p trafic that triger that alerts too, and I can't 
> efficiently block it. Is it someone that know what kind of p2p is it ?
> I belivied it was emule, but I am not sure anymore...
> 
> 

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From chris.a.libby at gmail.com  Wed Sep 10 11:56:18 2008
From: chris.a.libby at gmail.com (Chris Libby)
Date: Wed, 10 Sep 2008 11:56:18 -0400
Subject: [Emerging-Sigs] Problems with sid 2404020
Message-ID: <a95559690809100856l1da241f5xf791026ddcecee7c@mail.gmail.com>

Snort is failing on 2404020 with "Empty IP used either as source IP or as
destination IP in a rule. IP list: []".  Is this an error in the rule or did
IDSPM munge something?  Here's what I have for the rule:  alert ip $HOME_NET
any -> [] any (msg:"ET DROP Known Bot C&C Server Traffic (group 21)";
threshold: type limit, track by_src, seconds 3600, count 1;
classtype:trojan-activity; sid:2404020; rev:1282; reference:url,
www.shadowserver.org;)

TIA for the help - Chris
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080910/7d4bb553/attachment.html

From jonkman at jonkmans.com  Wed Sep 10 12:25:13 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Wed, 10 Sep 2008 12:25:13 -0400
Subject: [Emerging-Sigs] Problems with sid 2404020
In-Reply-To: <a95559690809100856l1da241f5xf791026ddcecee7c@mail.gmail.com>
References: <a95559690809100856l1da241f5xf791026ddcecee7c@mail.gmail.com>
Message-ID: <48C7F4E9.9040501@jonkmans.com>

Fixed up, Script issue with a blank line in the source file.

Better now?

Matt

Chris Libby wrote:
> Snort is failing on 2404020 with "Empty IP used either as source IP or
> as destination IP in a rule. IP list: []".  Is this an error in the rule
> or did IDSPM munge something?  Here's what I have for the rule:  alert
> ip $HOME_NET any -> [] any (msg:"ET DROP Known Bot C&C Server Traffic
> (group 21)"; threshold: type limit, track by_src, seconds 3600, count 1;
> classtype:trojan-activity; sid:2404020; rev:1282;
> reference:url,www.shadowserver.org <http://www.shadowserver.org>;)
>  
> TIA for the help - Chris
> 
>  
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Wed Sep 10 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Wed, 10 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080910200008.1549B4502E@goliath.jonkmans.com>


[***] Results from Oinkmaster started Wed Sep 10 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008543 - ET POLICY Known SSL traffic on port 995 (imaps) being excluded from SSL Alerts (emerging-policy.rules)


[///]     Modified active rules:     [///]

 2003002 - ET POLICY TLS/SSL Client Hello on Unusual Port TLS (emerging-policy.rules)
 2003003 - ET POLICY TLS/SSL Client Hello on Unusual Port SSLv3 (emerging-policy.rules)
 2003004 - ET POLICY TLS/SSL Client Hello on Unusual Port Case 2 (emerging-policy.rules)
 2003005 - ET POLICY TLS/SSL Client Hello on Unusual Port SSLv3 (emerging-policy.rules)
 2003006 - ET POLICY TLS/SSL Client Key Exchange on Unusual Port (emerging-policy.rules)
 2003007 - ET POLICY TLS/SSL Client Key Exchange on Unusual Port SSLv3 (emerging-policy.rules)
 2003008 - ET POLICY TLS/SSL Client Cipher Set on Unusual Port (emerging-policy.rules)
 2003009 - ET POLICY TLS/SSL Client Cipher Set on Unusual Port SSLv3 (emerging-policy.rules)
 2003010 - ET POLICY TLS/SSL Server Hello on Unusual Port (emerging-policy.rules)
 2003011 - ET POLICY TLS/SSL Server Hello on Unusual Port SSLv3 (emerging-policy.rules)
 2003012 - ET POLICY TLS/SSL Server Certificate Exchange on Unusual Port (emerging-policy.rules)
 2003013 - ET POLICY TLS/SSL Server Certificate Exchange on Unusual Port SSLv3 (emerging-policy.rules)
 2003014 - ET POLICY TLS/SSL Server Key Exchange on Unusual Port (emerging-policy.rules)
 2003015 - ET POLICY TLS/SSL Server Key Exchange on Unusual Port SSLv3 (emerging-policy.rules)
 2003016 - ET POLICY TLS/SSL Server Hello Done on Unusual Port (emerging-policy.rules)
 2003017 - ET POLICY TLS/SSL Server Hello Done on Unusual Port SSLv3 (emerging-policy.rules)
 2003018 - ET POLICY TLS/SSL Server Cipher Set on Unusual Port (emerging-policy.rules)
 2003019 - ET POLICY TLS/SSL Server Cipher Set on Unusual Port SSLv3 (emerging-policy.rules)
 2003020 - ET POLICY TLS/SSL Encrypted Application Data on Unusual Port (emerging-policy.rules)
 2003021 - ET POLICY TLS/SSL Encrypted Application Data on Unusual Port SSLv3 (emerging-policy.rules)
 2003026 - ET POLICY Known SSL traffic on port 443 being excluded from SSL Alerts (emerging-policy.rules)
 2003027 - ET POLICY Known SSL traffic on port 8000 being excluded from SSL Alerts (emerging-policy.rules)
 2003028 - ET POLICY Known SSL traffic on port 8080 being excluded from SSL Alerts (emerging-policy.rules)
 2003029 - ET POLICY Known SSL traffic on port 8200 being excluded from SSL Alerts (emerging-policy.rules)
 2003030 - ET POLICY Known SSL traffic on port 8443 being excluded from SSL Alerts (emerging-policy.rules)
 2003031 - ET POLICY Known SSL traffic on port 5222 (Jabber) being excluded from SSL Alerts (emerging-policy.rules)
 2003032 - ET POLICY Known SSL traffic on port 5223 (Jabber) being excluded from SSL Alerts (emerging-policy.rules)
 2003033 - ET POLICY Known SSL traffic on port 2967 (Symantec) being excluded from SSL Alerts (emerging-policy.rules)
 2003035 - ET POLICY Known SSL traffic on port 3128 (proxy) being excluded from SSL Alerts (emerging-policy.rules)
 2003036 - ET POLICY Known SSL traffic on port 8080 (proxy) being excluded from SSL Alerts (emerging-policy.rules)
 2003037 - ET POLICY Known SSL traffic on port 8292 (Bloomberg) being excluded from SSL Alerts (emerging-policy.rules)
 2003038 - ET POLICY Known SSL traffic on port 8294 (Bloomberg) being excluded from SSL Alerts (emerging-policy.rules)
 2003934 - ET POLICY Known SSL traffic on port 1521 (Oracle) being excluded from SSL Alerts (emerging-policy.rules)
 2004598 - ET POLICY Known SSL traffic on port 9001 (aol) being excluded from SSL Alerts (emerging-policy.rules)
 2008276 - ET MALWARE Suspicious User-Agent (contains loader) (emerging-malware.rules)
 2008490 - ET TROJAN Dialer.Win32.E-Group.n Checkin (emerging-virus.rules)
 2008542 - ET EXPLOIT CitectSCADA ODBC Overflowflow Attempt (emerging-exploit.rules)


[---]         Removed rules:         [---]

 2008053 - ET MALWARE InternetSpeedMonitor Related Spyware User-Agent (parchmnt loader v1.8) (emerging-malware.rules)
 2008252 - ET MALWARE Suspicious User-Agent (max loader) (emerging-malware.rules)
 2008265 - ET MALWARE Suspicious User-Agent (creativesmover loader vnr2.2) (emerging-malware.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-sid-msg.map (1):
        2008543 || ET POLICY Known SSL traffic on port 995 (imaps) being excluded from SSL Alerts

     -> Added to emerging-sid-msg.map.txt (1):
        2008543 || ET POLICY Known SSL traffic on port 995 (imaps) being excluded from SSL Alerts

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-sid-msg.map (5):
        2008053 || ET MALWARE InternetSpeedMonitor Related Spyware User-Agent (parchmnt loader v1.8)
        2008252 || ET MALWARE Suspicious User-Agent (max loader)
        2008265 || ET MALWARE Suspicious User-Agent (creativesmover loader vnr2.2)
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org

     -> Removed from emerging-sid-msg.map.txt (5):
        2008053 || ET MALWARE InternetSpeedMonitor Related Spyware User-Agent (parchmnt loader v1.8)
        2008252 || ET MALWARE Suspicious User-Agent (max loader)
        2008265 || ET MALWARE Suspicious User-Agent (creativesmover loader vnr2.2)
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org


From thierry.chich at ac-clermont.fr  Thu Sep 11 03:40:55 2008
From: thierry.chich at ac-clermont.fr (Thierry CHICH)
Date: Thu, 11 Sep 2008 09:40:55 +0200
Subject: [Emerging-Sigs] lot of FP with 2003020
In-Reply-To: <48C7E6A3.8080109@jonkmans.com>
References: <200809101700.38554.thierry.chich@ac-clermont.fr>
	<48C7E6A3.8080109@jonkmans.com>
Message-ID: <200809110940.55435.thierry.chich@ac-clermont.fr>

Le mercredi 10 septembre 2008, vous avez ?crit :
> That is a good hit, but one we should exclude. I've added:
>
> alert tcp $HOME_NET any -> $EXTERNAL_NET 995 (msg:"ET POLICY Known SSL
> traffic on port 995 (imaps) being excluded from SSL Alerts";
> flow:established,to_server; flowbits:noalert;
> flowbits:set,BS.SSL.Known.Port; classtype:not-suspicious; sid:2008543;
> rev:1;)
>
> Tot he list of rules excluding normal ports. That will fix the initial
> issue.
>
> Making these home_net to external_net is also a good way to go.
> originally I left them any any hoping to catch inbound ssl connections.
> That hasn't turned out to be that useful as far as I've seen. I'll add
> the home/external net stuff to get the performance gain and accuracy.
>
> Let me know if that does the trick!
>

Hello Matt,

Thanks for your answer. However I am not sure it will do anything in this 
case. If you look the alert that have been triggered by the imaps connexion,
it is in the other direction. I mean that my client was x.x.x.x, using 2776 as 
source port and was connected to a server imaps. 

There is nothing wrong with this, but the alert was here anyway.  
And my question is : why ?

> Thierry CHICH wrote:
> > alert tcp any any -> any 1024:65535 (msg:"ET POLICY TLS/SSL Encrypted
> > Application Data on Unusual Port"; flowbits:isset,BS.SSL.Established;
> > flow:established,from_server; content:"|17 03 01|"; depth:4;
> > threshold:type limit, count 1, seconds 120, track by_src;
> > classtype:unusual-client-port-connection; sid:2003020; rev:6;)
> >
> >
> > I don't understand this rule. Where is the server ? At the left or at the
> > right side ? from "from_server", I believe that it was the at left side,
> > but it doesn't make sense.
> >
> > I have clients connecting to their pops server that are trigging an
> > alert, with this rule.
> >
> >
> > For instance:
> >
> > [**] [1:2003020:6] ET POLICY TLS/SSL Encrypted Application Data on
> > Unusual Port [**]
> > [Classification: A client was using an unusual port] [Priority: 2]
> > 09/10-16:48:54.121283 209.85.135.111:995 -> x.x.x.x:2776
> > TCP TTL:53 TOS:0x0 ID:62625 IpLen:20 DgmLen:75
> > ***AP*** Seq: 0x3D3DB401  Ack: 0x97BC3C2B  Win: 0x1D50  TcpLen: 20
> >
> > Other point, there is a p2p trafic that triger that alerts too, and I
> > can't efficiently block it. Is it someone that know what kind of p2p is
> > it ? I belivied it was emule, but I am not sure anymore...



From jonkman at jonkmans.com  Thu Sep 11 11:59:08 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Thu, 11 Sep 2008 11:59:08 -0400
Subject: [Emerging-Sigs] lot of FP with 2003020
In-Reply-To: <200809110940.55435.thierry.chich@ac-clermont.fr>
References: <200809101700.38554.thierry.chich@ac-clermont.fr>	<48C7E6A3.8080109@jonkmans.com>
	<200809110940.55435.thierry.chich@ac-clermont.fr>
Message-ID: <48C9404C.4070602@jonkmans.com>


Thierry CHICH wrote:
> 
> Thanks for your answer. However I am not sure it will do anything in this 
> case. If you look the alert that have been triggered by the imaps connexion,
> it is in the other direction. I mean that my client was x.x.x.x, using 2776 as 
> source port and was connected to a server imaps. 
> 
> There is nothing wrong with this, but the alert was here anyway.  
> And my question is : why ?

The idea of these rules is to catch possible CnC connections using SSL
on an unusual port. We've seen this in a number of samples over the
years. It'll also catch an insider trying to possibly smuggle
information out, etc.

If you aren't interested in those it'll save you some cpu cycles to bot
run that set of rules. But they can be interesting now and then.

Matt

> 
>> Thierry CHICH wrote:
>>> alert tcp any any -> any 1024:65535 (msg:"ET POLICY TLS/SSL Encrypted
>>> Application Data on Unusual Port"; flowbits:isset,BS.SSL.Established;
>>> flow:established,from_server; content:"|17 03 01|"; depth:4;
>>> threshold:type limit, count 1, seconds 120, track by_src;
>>> classtype:unusual-client-port-connection; sid:2003020; rev:6;)
>>>
>>>
>>> I don't understand this rule. Where is the server ? At the left or at the
>>> right side ? from "from_server", I believe that it was the at left side,
>>> but it doesn't make sense.
>>>
>>> I have clients connecting to their pops server that are trigging an
>>> alert, with this rule.
>>>
>>>
>>> For instance:
>>>
>>> [**] [1:2003020:6] ET POLICY TLS/SSL Encrypted Application Data on
>>> Unusual Port [**]
>>> [Classification: A client was using an unusual port] [Priority: 2]
>>> 09/10-16:48:54.121283 209.85.135.111:995 -> x.x.x.x:2776
>>> TCP TTL:53 TOS:0x0 ID:62625 IpLen:20 DgmLen:75
>>> ***AP*** Seq: 0x3D3DB401  Ack: 0x97BC3C2B  Win: 0x1D50  TcpLen: 20
>>>
>>> Other point, there is a p2p trafic that triger that alerts too, and I
>>> can't efficiently block it. Is it someone that know what kind of p2p is
>>> it ? I belivied it was emule, but I am not sure anymore...
> 
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From jonkman at jonkmans.com  Thu Sep 11 16:39:27 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Thu, 11 Sep 2008 16:39:27 -0400
Subject: [Emerging-Sigs] SIDReporter 1.0 Available!
Message-ID: <48C981FF.8050500@jonkmans.com>

Thanks to all our beta testers. SIDReporter version 1.0 is now available:

http://www.emergingthreats.net/sidreporter/sidreporter-1.0.tar.gz

SIDReporter allows you to anonymously report information about snort
hits in your environment. No payload information is uploaded, all data
is PGP encrypted in transit, you may obfuscate your local IP ranges, and
you may include or exclude any data you choose.

This information will be used exclusively by the Emerging Threats team
to do a number of things. Initially we'll use this to tune the rulesets.
Over time we expect to be able to identify signatures that are no longer
relevant or no longer hitting. We can then tune or remove these signatures.

We also expect to be able to begin to assign a 'confidence' rating to
the rulesets, allowing you to make decisions as to which rules you need
and which you could drop based on data such as how often they're hitting
at other sites. More factors will be available soon!

We also will begin to distribute information about trends in attack
types and attackers. This we hope will culminate in a top attackers list
that we can then redistribute in a signature and firewall ruleset format.

Most importantly though, we'll soon be able to give you as the submitter
a page to login and see your local hits in a geo-ip style map, and with
some correlation as to how much badness and what types of attacks your
net is seeing vs the global picture.

So please take a moment and try out SIDReporter. The data collected is
anonymous and will allow us to take the Emerging and Snort rulesets to
the next level of maturity, as well as generate a great deal of new
information for general use!

Matt


-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From thierry.chich at ac-clermont.fr  Fri Sep 12 03:11:12 2008
From: thierry.chich at ac-clermont.fr (Thierry CHICH)
Date: Fri, 12 Sep 2008 09:11:12 +0200
Subject: [Emerging-Sigs] lot of FP with 2003020
In-Reply-To: <48C9404C.4070602@jonkmans.com>
References: <200809101700.38554.thierry.chich@ac-clermont.fr>
	<200809110940.55435.thierry.chich@ac-clermont.fr>
	<48C9404C.4070602@jonkmans.com>
Message-ID: <200809120911.13051.thierry.chich@ac-clermont.fr>

Le jeudi 11 septembre 2008, vous avez ?crit :
> Thierry CHICH wrote:
> > Thanks for your answer. However I am not sure it will do anything in this
> > case. If you look the alert that have been triggered by the imaps
> > connexion, it is in the other direction. I mean that my client was
> > x.x.x.x, using 2776 as source port and was connected to a server imaps.
> >
> > There is nothing wrong with this, but the alert was here anyway.
> > And my question is : why ?
>
> The idea of these rules is to catch possible CnC connections using SSL
> on an unusual port. We've seen this in a number of samples over the
> years. It'll also catch an insider trying to possibly smuggle
> information out, etc.
>
> If you aren't interested in those it'll save you some cpu cycles to bot
> run that set of rules. But they can be interesting now and then.
>
> Matt

I am sorry to appear this rude. But I I have to say:

1) I perfectly understand why it is interesting to catch ssl connections on 
unusual port

2) I know how to disable a set rule, and even change it , thanks to 
oinkmaster.

3) Now, with this new revision, there is no more false positives. I had well 
read the idea of the rule. It is looking for ssl connections to servers using 
port > 1024. And it wasn't what the previous version was doing. 

Thanks for your help anyway. 




From thierry.chich at ac-clermont.fr  Fri Sep 12 05:53:14 2008
From: thierry.chich at ac-clermont.fr (Thierry CHICH)
Date: Fri, 12 Sep 2008 11:53:14 +0200
Subject: [Emerging-Sigs] RUHERE ?
Message-ID: <200809121153.15011.thierry.chich@ac-clermont.fr>

Hi 

I have found some new SMTP keywords :-D : 
 T xxxx:2157 -> yyyy:25 [AP]
  001 RUTHERE..
#
T yyyy:25 -> xxxx:2157 [AP]
  701 IMHERE..

Somebody know something about that ?
Is the software RUTHERE that have been installed to listen the port 25, or is 
it something worse.


-- 
Thierry CHICH

From pepperjack at afferentsecurity.com  Fri Sep 12 08:18:19 2008
From: pepperjack at afferentsecurity.com (Jack Pepper)
Date: Fri, 12 Sep 2008 07:18:19 -0500
Subject: [Emerging-Sigs] RUHERE ?
In-Reply-To: <200809121153.15011.thierry.chich@ac-clermont.fr>
References: <200809121153.15011.thierry.chich@ac-clermont.fr>
Message-ID: <20080912071819.et4i6f5bsw48sw08@mail.afferentsecurity.com>

Quoting Thierry CHICH <thierry.chich at ac-clermont.fr>:

> I have found some new SMTP keywords :-D :
> T yyyy:25 -> xxxx:2157 [AP]
>   701 IMHERE..
>
> Is the software RUTHERE that have been installed to listen the port 25, or is
> it something worse.

A few months ago I found the keyword SNIPER in a log.  I set up a rule  
to watch for it again, but it hasn't come back.  This one is  
extra-interesting because your mail server gave a response code.



-- 

Framework?  I don't need no stinking framework!

----------------------------------------------------------------
@fferent Security Labs:  Isolate/Insulate/Innovate  
http://www.afferentsecurity.com


From jonkman at jonkmans.com  Fri Sep 12 08:39:59 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Fri, 12 Sep 2008 08:39:59 -0400
Subject: [Emerging-Sigs] RUHERE ?
In-Reply-To: <200809121153.15011.thierry.chich@ac-clermont.fr>
References: <200809121153.15011.thierry.chich@ac-clermont.fr>
Message-ID: <48CA631F.7040001@jonkmans.com>

What mail server do you run on that box?

Curious.

Matt

Thierry CHICH wrote:
> Hi 
> 
> I have found some new SMTP keywords :-D : 
>  T xxxx:2157 -> yyyy:25 [AP]
>   001 RUTHERE..
> #
> T yyyy:25 -> xxxx:2157 [AP]
>   701 IMHERE..
> 
> Somebody know something about that ?
> Is the software RUTHERE that have been installed to listen the port 25, or is 
> it something worse.
> 
> 

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From thierry.chich at ac-clermont.fr  Fri Sep 12 09:25:13 2008
From: thierry.chich at ac-clermont.fr (Thierry CHICH)
Date: Fri, 12 Sep 2008 15:25:13 +0200
Subject: [Emerging-Sigs] RUHERE ?
In-Reply-To: <48CA631F.7040001@jonkmans.com>
References: <200809121153.15011.thierry.chich@ac-clermont.fr>
	<48CA631F.7040001@jonkmans.com>
Message-ID: <200809121525.13389.thierry.chich@ac-clermont.fr>

Le vendredi 12 septembre 2008, Matt Jonkman a ?crit :
> What mail server do you run on that box?
>
> Curious.
>
> Matt
>

I don't know. It is xxxx that is in my "home" net. 
And it is really curious. I can't connect from my own host.
If I go in the good place,  I have something like


telnet yyyy 25
Trying yyyy...
Connected to yyyy
Escape character is '^]'.
EHLO
998 PROTOCOLERROR


When you look for "998 PROTOCOLERROR" with google, you find four messages 
about that, on spanish forum. The port that was used is the case reported 
then was FTP. yyyy is spanish, and is an ip of the same provider.


> Thierry CHICH wrote:
> > Hi
> >
> > I have found some new SMTP keywords :-D :
> >  T xxxx:2157 -> yyyy:25 [AP]
> >   001 RUTHERE..
> > #
> > T yyyy:25 -> xxxx:2157 [AP]
> >   701 IMHERE..
> >
> > Somebody know something about that ?
> > Is the software RUTHERE that have been installed to listen the port 25,
> > or is it something worse.



From dxp2532 at gmail.com  Fri Sep 12 15:25:36 2008
From: dxp2532 at gmail.com (dxp)
Date: Fri, 12 Sep 2008 15:25:36 -0400
Subject: [Emerging-Sigs] UAs on infected hosts
In-Reply-To: <20080829113426.oalcfeh3k8c8o000@mail.afferentsecurity.com>
References: <20080829113426.oalcfeh3k8c8o000@mail.afferentsecurity.com>
Message-ID: <1221247536.6282.11.camel@kinta>

From what I've seen these strings are appended to the end of UAS and a
lot of them are a lot longer then 50 bytes.
The sigs below will definitely have False Negatives.
-- 

-=[ dxp ]=-
0xA3F3C6E3

On Fri, 2008-08-29 at 11:34 -0500, Jack Pepper wrote:

> These user agent fragments are being attached to the UA strings on  
> infected machines (XPAntivirus):
>         AntivirXP08
>          3P_UVRM
>          3P_UASE
>          3P_PCPC
>          3P_UPCPC
>          3P_UAMG
> 
> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
>   (msg:"ET WEB XPAV infected machine"; flow:established,to_server;
>   content:"User-Agent\: ";nocase;content: "AntivirXP08"; within: 50;  
> nocase; classtype:trojan-activity; sid:1010111; rev:1;)
> 
> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
>   (msg:"ET WEB XPAV infected machine"; flow:established,to_server;
>   content:"User-Agent\: ";nocase; content: "3P_"; within: 50; nocase;  
> pcre: "/3P_UVRM|3P_UASE|3P_PCPC|3P_UPCPC|3P_UAMG/smi";  
> classtype:trojan-activity; sid:1010112; rev:1;)
> 
> 
> jp
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080912/72a91dde/attachment.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080912/72a91dde/attachment.bin

From pepperjack at afferentsecurity.com  Fri Sep 12 15:55:02 2008
From: pepperjack at afferentsecurity.com (Jack Pepper)
Date: Fri, 12 Sep 2008 14:55:02 -0500
Subject: [Emerging-Sigs] UAs on infected hosts
In-Reply-To: <1221247536.6282.11.camel@kinta>
References: <20080829113426.oalcfeh3k8c8o000@mail.afferentsecurity.com>
	<1221247536.6282.11.camel@kinta>
Message-ID: <20080912145502.ozk4ndlb4g8g8ccw@mail.afferentsecurity.com>

Quoting dxp <dxp2532 at gmail.com>:

> From what I've seen these strings are appended to the end of UAS and a
> lot of them are a lot longer then 50 bytes.
> The sigs below will definitely have False Negatives.

please post some of the captured UAs.  Perhaps there is a better way  
than this.  Or do we increase it to some larger value?

jp


-- 

Framework?  I don't need no stinking framework!

----------------------------------------------------------------
@fferent Security Labs:  Isolate/Insulate/Innovate  
http://www.afferentsecurity.com


From emerging at emergingthreats.net  Fri Sep 12 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Fri, 12 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080912200008.E91724502D@goliath.jonkmans.com>


[***] Results from Oinkmaster started Fri Sep 12 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008544 - ET MALWARE Suspicious User-Agent (winlogon) (emerging-malware.rules)
 2008545 - ET TROJAN Social-bos.biz related trojan checkin (trackid=hex) (emerging-virus.rules)
 2008546 - ET CURRENT_EVENTS Unknown Downloader Checkin part 1 of 2 (emerging.rules)


[---]         Disabled rules:        [---]

 2002765 - ET MALWARE Corpsespyware.net BlackListed Malicious Domain - google.vc (emerging-malware.rules)
 2002766 - ET MALWARE Corpsespyware.net BlackList - pcpeek (emerging-malware.rules)
 2002767 - ET MALWARE Corpsespyware.net Distribution - bos.biz (emerging-malware.rules)
 2002768 - ET MALWARE Corpsespyware.net Distribution - fesexy (emerging-malware.rules)
 2002769 - ET MALWARE Corpsespyware.net Distribution - studiolacase (emerging-malware.rules)
 2002770 - ET MALWARE Corpsespyware.net - msits.exe access (emerging-malware.rules)
 2002771 - ET MALWARE Corpsespyware.net - msys.exe access (emerging-malware.rules)
 2002774 - ET MALWARE Corpsespyware.net Blind Data Upload (emerging-malware.rules)


[---]         Removed rules:         [---]

 2008234 - ET MALWARE Suspicious User-Agent (winlogon) (emerging-malware.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-malware.rules (2):
        #too many falses...
        #Dennis Distler

     -> Added to emerging-sid-msg.map (5):
        2008544 || ET MALWARE Suspicious User-Agent (winlogon)
        2008545 || ET TROJAN Social-bos.biz related trojan checkin (trackid=hex)
        2008546 || ET CURRENT_EVENTS Unknown Downloader Checkin part 1 of 2
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org

     -> Added to emerging-sid-msg.map.txt (5):
        2008544 || ET MALWARE Suspicious User-Agent (winlogon)
        2008545 || ET TROJAN Social-bos.biz related trojan checkin (trackid=hex)
        2008546 || ET CURRENT_EVENTS Unknown Downloader Checkin part 1 of 2
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org

     -> Added to emerging-virus.rules (1):
        #data from nalbright

     -> Added to emerging.rules (1):
        #another unknown, soo to be IDd. Sig by Daniel Clemens

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-sid-msg.map (1):
        2008234 || ET MALWARE Suspicious User-Agent (winlogon)

     -> Removed from emerging-sid-msg.map.txt (1):
        2008234 || ET MALWARE Suspicious User-Agent (winlogon)


From dxp2532 at gmail.com  Fri Sep 12 16:06:21 2008
From: dxp2532 at gmail.com (dxp)
Date: Fri, 12 Sep 2008 16:06:21 -0400
Subject: [Emerging-Sigs] UAs on infected hosts
In-Reply-To: <20080912145502.ozk4ndlb4g8g8ccw@mail.afferentsecurity.com>
References: <20080829113426.oalcfeh3k8c8o000@mail.afferentsecurity.com>
	<1221247536.6282.11.camel@kinta>
	<20080912145502.ozk4ndlb4g8g8ccw@mail.afferentsecurity.com>
Message-ID: <1221249981.6282.19.camel@kinta>

Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11)
Gecko/20071127 3P_UVRM/1.0.11.1 Firefox/2.0.0.11
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR
2.0.50727; InfoPath.1; 3P_UVRM 1.0.11.1)

I think a pcre match should do it.  Something like "/\RUser-Agent\:
\w{5,255}3P_\R/".

-- 

-=[ dxp ]=-
0xA3F3C6E3

On Fri, 2008-09-12 at 14:55 -0500, Jack Pepper wrote:

> Quoting dxp <dxp2532 at gmail.com>:
> 
> > From what I've seen these strings are appended to the end of UAS and a
> > lot of them are a lot longer then 50 bytes.
> > The sigs below will definitely have False Negatives.
> 
> please post some of the captured UAs.  Perhaps there is a better way  
> than this.  Or do we increase it to some larger value?
> 
> jp
> 
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080912/1b942670/attachment.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080912/1b942670/attachment.bin

From dxp2532 at gmail.com  Sat Sep 13 10:16:20 2008
From: dxp2532 at gmail.com (dxp)
Date: Sat, 13 Sep 2008 10:16:20 -0400
Subject: [Emerging-Sigs] UAs on infected hosts
In-Reply-To: <1221249981.6282.19.camel@kinta>
References: <20080829113426.oalcfeh3k8c8o000@mail.afferentsecurity.com>
	<1221247536.6282.11.camel@kinta>
	<20080912145502.ozk4ndlb4g8g8ccw@mail.afferentsecurity.com>
	<1221249981.6282.19.camel@kinta>
Message-ID: <1221315380.6667.9.camel@kinta>

After some more web searches more "3P_" based strings have been
uncovered.  So, for now it looks like the following are used as initials
chars: 3P_U, 3P_A, 3P_V, 3P_P.

This example sig works for me reliably:

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"LOCAL Fake
Spyware UAS"; flow:established,to_server; content:" HTTP/1.";
pcre:"/User-Agent\: .*(AntivirXP08|3P_)/"; sid:2532; rev:1;)

-- 

-=[ dxp ]=-
0xA3F3C6E3

On Fri, 2008-09-12 at 16:06 -0400, dxp wrote:

> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11)
> Gecko/20071127 3P_UVRM/1.0.11.1 Firefox/2.0.0.11
> Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR
> 2.0.50727; InfoPath.1; 3P_UVRM 1.0.11.1)
> 
> I think a pcre match should do it.  Something like "/\RUser-Agent\:
> \w{5,255}3P_\R/".
> 
> -- 
> 
> -=[ dxp ]=-
> 0xA3F3C6E3
> 
> On Fri, 2008-09-12 at 14:55 -0500, Jack Pepper wrote: 
> 
> > Quoting dxp <dxp2532 at gmail.com>:
> > 
> > > From what I've seen these strings are appended to the end of UAS and a
> > > lot of them are a lot longer then 50 bytes.
> > > The sigs below will definitely have False Negatives.
> > 
> > please post some of the captured UAs.  Perhaps there is a better way  
> > than this.  Or do we increase it to some larger value?
> > 
> > jp
> > 
> > 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080913/74c7e593/attachment.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080913/74c7e593/attachment.bin

From jonkman at jonkmans.com  Sat Sep 13 11:55:03 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Sat, 13 Sep 2008 11:55:03 -0400
Subject: [Emerging-Sigs] UAs on infected hosts
In-Reply-To: <1221315380.6667.9.camel@kinta>
References: <20080829113426.oalcfeh3k8c8o000@mail.afferentsecurity.com>	<1221247536.6282.11.camel@kinta>	<20080912145502.ozk4ndlb4g8g8ccw@mail.afferentsecurity.com>	<1221249981.6282.19.camel@kinta>
	<1221315380.6667.9.camel@kinta>
Message-ID: <48CBE257.8040205@jonkmans.com>

I've found a number of similar in the sandnet with UA's like:

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; 3P_UASE 1.0.20.0)

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; 3P 1.0.15.0)

So I think it worth splitting this to 2 sigs, like:


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE
Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (3P and
version num)"; flow:established,to_server; content:"GET "; depth:4;
content:"|0d 0a|User-Agent\: "; content:"3P";
pcre:"/User-Agent\:[^\n]+\;\s3P(\s\d|_)/"; classtype:trojan-activity;
sid:something; rev:1;)


alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE
Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent
(AntivirXP)"; flow:established,to_server; content:"GET "; depth:4;
content:"|0d 0a|User-Agent\: "; content:"Antivir";
pcre:"/User-Agent\:[^\n]+\;\sAntivir/"; classtype:trojan-activity;
sid:something; rev:1;)


If no objections will get these posted momentarily!

Thanks for the data guys!

Matt

dxp wrote:
> After some more web searches more "3P_" based strings have been
> uncovered.  So, for now it looks like the following are used as initials
> chars: 3P_U, 3P_A, 3P_V, 3P_P.
> 
> This example sig works for me reliably:
> 
> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"LOCAL Fake
> Spyware UAS"; flow:established,to_server; content:" HTTP/1.";
> pcre:"/User-Agent\: .*(AntivirXP08|3P_)/"; sid:2532; rev:1;)
> 
> -- 
> 
> -=[ dxp ]=-
> 0xA3F3C6E3
> 
> 
> On Fri, 2008-09-12 at 16:06 -0400, dxp wrote:
>> Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.11)
>> Gecko/20071127 3P_UVRM/1.0.11.1 Firefox/2.0.0.11
>> Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR
>> 2.0.50727; InfoPath.1; 3P_UVRM 1.0.11.1)
>>
>> I think a pcre match should do it.  Something like "/\RUser-Agent\:
>> \w{5,255}3P_\R/".
>>
>> -- 
>>
>> -=[ dxp ]=-
>> 0xA3F3C6E3
>>
>>
>> On Fri, 2008-09-12 at 14:55 -0500, Jack Pepper wrote:
>>> Quoting dxp <dxp2532 at gmail.com <mailto:dxp2532 at gmail.com>>:
>>>
>>> > From what I've seen these strings are appended to the end of UAS and a
>>> > lot of them are a lot longer then 50 bytes.
>>> > The sigs below will definitely have False Negatives.
>>>
>>> please post some of the captured UAs.  Perhaps there is a better way  
>>> than this.  Or do we increase it to some larger value?
>>>
>>> jp
>>>
>>>
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Sat Sep 13 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Sat, 13 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080913200008.1C3844502B@goliath.jonkmans.com>


[***] Results from Oinkmaster started Sat Sep 13 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008547 - ET TROJAN PECompact2 Packed Binary - Likely Hostile (emerging-virus.rules)
 2008548 - ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (3P and version num) (emerging-malware.rules)
 2008549 - ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (AntivirXP) (emerging-malware.rules)
 2008550 - ET TROJAN General Bot HTTP CnC Pattern (emerging-virus.rules)


[///]     Modified active rules:     [///]

 2008233 - ET TROJAN Common Downloader Install Report URL (farfly checkin) (emerging-virus.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-malware.rules (1):
        #data by dxp and jpepper

     -> Added to emerging-sid-msg.map (4):
        2008547 || ET TROJAN PECompact2 Packed Binary - Likely Hostile || url,bits.packetninjas.org/eblog/?p=306 || url,www.bitsum.com/pecompact.shtml
        2008548 || ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (3P and version num)
        2008549 || ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (AntivirXP)
        2008550 || ET TROJAN General Bot HTTP CnC Pattern

     -> Added to emerging-sid-msg.map.txt (4):
        2008547 || ET TROJAN PECompact2 Packed Binary - Likely Hostile || url,bits.packetninjas.org/eblog/?p=306 || url,www.bitsum.com/pecompact.shtml
        2008548 || ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (3P and version num)
        2008549 || ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (AntivirXP)
        2008550 || ET TROJAN General Bot HTTP CnC Pattern

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-sid-msg.map (2):
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org

     -> Removed from emerging-sid-msg.map.txt (2):
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org


From emerging at emergingthreats.net  Sat Sep 13 18:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Sat, 13 Sep 2008 18:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Weekly Signature Changes
Message-ID: <20080913220008.BD4614502B@goliath.jonkmans.com>


[***] Results from Oinkmaster started Sat Sep 13 18:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008542 - ET EXPLOIT CitectSCADA ODBC Overflowflow Attempt (emerging-exploit.rules)
 2008543 - ET POLICY Known SSL traffic on port 995 (imaps) being excluded from SSL Alerts (emerging-policy.rules)
 2008544 - ET MALWARE Suspicious User-Agent (winlogon) (emerging-malware.rules)
 2008545 - ET TROJAN Social-bos.biz related trojan checkin (trackid=hex) (emerging-virus.rules)
 2008546 - ET CURRENT_EVENTS Unknown Downloader Checkin part 1 of 2 (emerging.rules)
 2008547 - ET TROJAN PECompact2 Packed Binary - Likely Hostile (emerging-virus.rules)
 2008548 - ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (3P and version num) (emerging-malware.rules)
 2008549 - ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (AntivirXP) (emerging-malware.rules)
 2008550 - ET TROJAN General Bot HTTP CnC Pattern (emerging-virus.rules)
 2406003 - ET RBN Known Russian Business Network Monitored Domains (4) (emerging-rbn.rules)
 2407003 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (4) (emerging-rbn-BLOCK.rules)


[///]     Modified active rules:     [///]

 2003002 - ET POLICY TLS/SSL Client Hello on Unusual Port TLS (emerging-policy.rules)
 2003003 - ET POLICY TLS/SSL Client Hello on Unusual Port SSLv3 (emerging-policy.rules)
 2003004 - ET POLICY TLS/SSL Client Hello on Unusual Port Case 2 (emerging-policy.rules)
 2003005 - ET POLICY TLS/SSL Client Hello on Unusual Port SSLv3 (emerging-policy.rules)
 2003006 - ET POLICY TLS/SSL Client Key Exchange on Unusual Port (emerging-policy.rules)
 2003007 - ET POLICY TLS/SSL Client Key Exchange on Unusual Port SSLv3 (emerging-policy.rules)
 2003008 - ET POLICY TLS/SSL Client Cipher Set on Unusual Port (emerging-policy.rules)
 2003009 - ET POLICY TLS/SSL Client Cipher Set on Unusual Port SSLv3 (emerging-policy.rules)
 2003010 - ET POLICY TLS/SSL Server Hello on Unusual Port (emerging-policy.rules)
 2003011 - ET POLICY TLS/SSL Server Hello on Unusual Port SSLv3 (emerging-policy.rules)
 2003012 - ET POLICY TLS/SSL Server Certificate Exchange on Unusual Port (emerging-policy.rules)
 2003013 - ET POLICY TLS/SSL Server Certificate Exchange on Unusual Port SSLv3 (emerging-policy.rules)
 2003014 - ET POLICY TLS/SSL Server Key Exchange on Unusual Port (emerging-policy.rules)
 2003015 - ET POLICY TLS/SSL Server Key Exchange on Unusual Port SSLv3 (emerging-policy.rules)
 2003016 - ET POLICY TLS/SSL Server Hello Done on Unusual Port (emerging-policy.rules)
 2003017 - ET POLICY TLS/SSL Server Hello Done on Unusual Port SSLv3 (emerging-policy.rules)
 2003018 - ET POLICY TLS/SSL Server Cipher Set on Unusual Port (emerging-policy.rules)
 2003019 - ET POLICY TLS/SSL Server Cipher Set on Unusual Port SSLv3 (emerging-policy.rules)
 2003020 - ET POLICY TLS/SSL Encrypted Application Data on Unusual Port (emerging-policy.rules)
 2003021 - ET POLICY TLS/SSL Encrypted Application Data on Unusual Port SSLv3 (emerging-policy.rules)
 2003026 - ET POLICY Known SSL traffic on port 443 being excluded from SSL Alerts (emerging-policy.rules)
 2003027 - ET POLICY Known SSL traffic on port 8000 being excluded from SSL Alerts (emerging-policy.rules)
 2003028 - ET POLICY Known SSL traffic on port 8080 being excluded from SSL Alerts (emerging-policy.rules)
 2003029 - ET POLICY Known SSL traffic on port 8200 being excluded from SSL Alerts (emerging-policy.rules)
 2003030 - ET POLICY Known SSL traffic on port 8443 being excluded from SSL Alerts (emerging-policy.rules)
 2003031 - ET POLICY Known SSL traffic on port 5222 (Jabber) being excluded from SSL Alerts (emerging-policy.rules)
 2003032 - ET POLICY Known SSL traffic on port 5223 (Jabber) being excluded from SSL Alerts (emerging-policy.rules)
 2003033 - ET POLICY Known SSL traffic on port 2967 (Symantec) being excluded from SSL Alerts (emerging-policy.rules)
 2003035 - ET POLICY Known SSL traffic on port 3128 (proxy) being excluded from SSL Alerts (emerging-policy.rules)
 2003036 - ET POLICY Known SSL traffic on port 8080 (proxy) being excluded from SSL Alerts (emerging-policy.rules)
 2003037 - ET POLICY Known SSL traffic on port 8292 (Bloomberg) being excluded from SSL Alerts (emerging-policy.rules)
 2003038 - ET POLICY Known SSL traffic on port 8294 (Bloomberg) being excluded from SSL Alerts (emerging-policy.rules)
 2003934 - ET POLICY Known SSL traffic on port 1521 (Oracle) being excluded from SSL Alerts (emerging-policy.rules)
 2004598 - ET POLICY Known SSL traffic on port 9001 (aol) being excluded from SSL Alerts (emerging-policy.rules)
 2008233 - ET TROJAN Common Downloader Install Report URL (farfly checkin) (emerging-virus.rules)
 2008276 - ET MALWARE Suspicious User-Agent (contains loader) (emerging-malware.rules)
 2008490 - ET TROJAN Dialer.Win32.E-Group.n Checkin (emerging-virus.rules)
 2400000 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400001 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400002 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400003 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400004 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400005 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400006 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400007 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2401000 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401001 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401002 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401003 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401004 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401005 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401006 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401007 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2402000 - ET DROP Dshield Block Listed Source (emerging-dshield.rules)
 2403000 - ET DROP Dshield Block Listed Source - BLOCKING (emerging-dshield-BLOCK.rules)
 2404000 - ET DROP Known Bot C&C Server Traffic (group 1)  (emerging-botcc.rules)
 2404001 - ET DROP Known Bot C&C Server Traffic (group 2)  (emerging-botcc.rules)
 2404002 - ET DROP Known Bot C&C Server Traffic (group 3)  (emerging-botcc.rules)
 2404003 - ET DROP Known Bot C&C Server Traffic (group 4)  (emerging-botcc.rules)
 2404004 - ET DROP Known Bot C&C Server Traffic (group 5)  (emerging-botcc.rules)
 2404005 - ET DROP Known Bot C&C Server Traffic (group 6)  (emerging-botcc.rules)
 2404006 - ET DROP Known Bot C&C Server Traffic (group 7)  (emerging-botcc.rules)
 2404007 - ET DROP Known Bot C&C Server Traffic (group 8)  (emerging-botcc.rules)
 2404008 - ET DROP Known Bot C&C Server Traffic (group 9)  (emerging-botcc.rules)
 2404009 - ET DROP Known Bot C&C Server Traffic (group 10)  (emerging-botcc.rules)
 2404010 - ET DROP Known Bot C&C Server Traffic (group 11)  (emerging-botcc.rules)
 2404011 - ET DROP Known Bot C&C Server Traffic (group 12)  (emerging-botcc.rules)
 2404012 - ET DROP Known Bot C&C Server Traffic (group 13)  (emerging-botcc.rules)
 2404013 - ET DROP Known Bot C&C Server Traffic (group 14)  (emerging-botcc.rules)
 2404014 - ET DROP Known Bot C&C Server Traffic (group 15)  (emerging-botcc.rules)
 2404015 - ET DROP Known Bot C&C Server Traffic (group 16)  (emerging-botcc.rules)
 2404016 - ET DROP Known Bot C&C Server Traffic (group 17)  (emerging-botcc.rules)
 2404017 - ET DROP Known Bot C&C Server Traffic (group 18)  (emerging-botcc.rules)
 2404018 - ET DROP Known Bot C&C Server Traffic (group 19)  (emerging-botcc.rules)
 2404019 - ET DROP Known Bot C&C Server Traffic (group 20)  (emerging-botcc.rules)
 2405000 - ET DROP Known Bot C&C Traffic (group 1) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405001 - ET DROP Known Bot C&C Traffic (group 2) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405002 - ET DROP Known Bot C&C Traffic (group 3) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405003 - ET DROP Known Bot C&C Traffic (group 4) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405004 - ET DROP Known Bot C&C Traffic (group 5) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405005 - ET DROP Known Bot C&C Traffic (group 6) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405006 - ET DROP Known Bot C&C Traffic (group 7) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405007 - ET DROP Known Bot C&C Traffic (group 8) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405008 - ET DROP Known Bot C&C Traffic (group 9) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405009 - ET DROP Known Bot C&C Traffic (group 10) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405010 - ET DROP Known Bot C&C Traffic (group 11) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405011 - ET DROP Known Bot C&C Traffic (group 12) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405012 - ET DROP Known Bot C&C Traffic (group 13) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405013 - ET DROP Known Bot C&C Traffic (group 14) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405014 - ET DROP Known Bot C&C Traffic (group 15) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405015 - ET DROP Known Bot C&C Traffic (group 16) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405016 - ET DROP Known Bot C&C Traffic (group 17) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405017 - ET DROP Known Bot C&C Traffic (group 18) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405018 - ET DROP Known Bot C&C Traffic (group 19) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405019 - ET DROP Known Bot C&C Traffic (group 20) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2406000 - ET RBN Known Russian Business Network Monitored Domains (1) (emerging-rbn.rules)
 2406001 - ET RBN Known Russian Business Network Monitored Domains (2) (emerging-rbn.rules)
 2406002 - ET RBN Known Russian Business Network Monitored Domains (3) (emerging-rbn.rules)
 2406004 - ET RBN Known Russian Business Network Monitored Domains (5) (emerging-rbn.rules)
 2406005 - ET RBN Known Russian Business Network Monitored Domains (6) (emerging-rbn.rules)
 2406006 - ET RBN Known Russian Business Network Monitored Domains (7) (emerging-rbn.rules)
 2406007 - ET RBN Known Russian Business Network Monitored Domains (8) (emerging-rbn.rules)
 2406008 - ET RBN Known Russian Business Network Monitored Domains (9) (emerging-rbn.rules)
 2406009 - ET RBN Known Russian Business Network Monitored Domains (10) (emerging-rbn.rules)
 2406010 - ET RBN Known Russian Business Network Monitored Domains (11) (emerging-rbn.rules)
 2406011 - ET RBN Known Russian Business Network Monitored Domains (12) (emerging-rbn.rules)
 2406012 - ET RBN Known Russian Business Network Monitored Domains (13) (emerging-rbn.rules)
 2406013 - ET RBN Known Russian Business Network Monitored Domains (14) (emerging-rbn.rules)
 2406014 - ET RBN Known Russian Business Network Monitored Domains (15) (emerging-rbn.rules)
 2406015 - ET RBN Known Russian Business Network Monitored Domains (16) (emerging-rbn.rules)
 2406016 - ET RBN Known Russian Business Network Monitored Domains (17) (emerging-rbn.rules)
 2406017 - ET RBN Known Russian Business Network Monitored Domains (18) (emerging-rbn.rules)
 2406018 - ET RBN Known Russian Business Network Monitored Domains (19) (emerging-rbn.rules)
 2406019 - ET RBN Known Russian Business Network Monitored Domains (20) (emerging-rbn.rules)
 2407000 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (1) (emerging-rbn-BLOCK.rules)
 2407001 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (2) (emerging-rbn-BLOCK.rules)
 2407002 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (3) (emerging-rbn-BLOCK.rules)
 2407004 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (5) (emerging-rbn-BLOCK.rules)
 2407005 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (6) (emerging-rbn-BLOCK.rules)
 2407006 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (7) (emerging-rbn-BLOCK.rules)
 2407007 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (8) (emerging-rbn-BLOCK.rules)
 2407008 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (9) (emerging-rbn-BLOCK.rules)
 2407009 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (10) (emerging-rbn-BLOCK.rules)
 2407010 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (11) (emerging-rbn-BLOCK.rules)
 2407011 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (12) (emerging-rbn-BLOCK.rules)
 2407012 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (13) (emerging-rbn-BLOCK.rules)
 2407013 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (14) (emerging-rbn-BLOCK.rules)
 2407014 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (15) (emerging-rbn-BLOCK.rules)
 2407015 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) (emerging-rbn-BLOCK.rules)
 2407016 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) (emerging-rbn-BLOCK.rules)
 2407017 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) (emerging-rbn-BLOCK.rules)
 2407018 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) (emerging-rbn-BLOCK.rules)
 2407019 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) (emerging-rbn-BLOCK.rules)


[---]         Disabled rules:        [---]

 2002765 - ET MALWARE Corpsespyware.net BlackListed Malicious Domain - google.vc (emerging-malware.rules)
 2002766 - ET MALWARE Corpsespyware.net BlackList - pcpeek (emerging-malware.rules)
 2002767 - ET MALWARE Corpsespyware.net Distribution - bos.biz (emerging-malware.rules)
 2002768 - ET MALWARE Corpsespyware.net Distribution - fesexy (emerging-malware.rules)
 2002769 - ET MALWARE Corpsespyware.net Distribution - studiolacase (emerging-malware.rules)
 2002770 - ET MALWARE Corpsespyware.net - msits.exe access (emerging-malware.rules)
 2002771 - ET MALWARE Corpsespyware.net - msys.exe access (emerging-malware.rules)
 2002774 - ET MALWARE Corpsespyware.net Blind Data Upload (emerging-malware.rules)


[---]         Removed rules:         [---]

 2008053 - ET MALWARE InternetSpeedMonitor Related Spyware User-Agent (parchmnt loader v1.8) (emerging-malware.rules)
 2008234 - ET MALWARE Suspicious User-Agent (winlogon) (emerging-malware.rules)
 2008252 - ET MALWARE Suspicious User-Agent (max loader) (emerging-malware.rules)
 2008265 - ET MALWARE Suspicious User-Agent (creativesmover loader vnr2.2) (emerging-malware.rules)
 2404020 - ET DROP Known Bot C&C Server Traffic (group 21)  (emerging-botcc.rules)
 2405020 - ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2406020 - ET RBN Known Russian Business Network Monitored Domains (16) (emerging-rbn.rules)
 2406021 - ET RBN Known Russian Business Network Monitored Domains (17) (emerging-rbn.rules)
 2406022 - ET RBN Known Russian Business Network Monitored Domains (18) (emerging-rbn.rules)
 2406023 - ET RBN Known Russian Business Network Monitored Domains (19) (emerging-rbn.rules)
 2406024 - ET RBN Known Russian Business Network Monitored Domains (20) (emerging-rbn.rules)
 2407020 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) (emerging-rbn-BLOCK.rules)
 2407021 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) (emerging-rbn-BLOCK.rules)
 2407022 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) (emerging-rbn-BLOCK.rules)
 2407023 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) (emerging-rbn-BLOCK.rules)
 2407024 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) (emerging-rbn-BLOCK.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-drop-BLOCK.rules (2):
        #  VERSION 1295
        #  Generated 2008-09-13 00:03:02 EDT

     -> Added to emerging-drop.rules (2):
        #  VERSION 1295
        #  Generated 2008-09-13 00:03:02 EDT

     -> Added to emerging-exploit.rules (1):
        #by Dale Peterson of digitalbond.com

     -> Added to emerging-malware.rules (3):
        #too many falses...
        #Dennis Distler
        #data by dxp and jpepper

     -> Added to emerging-rbn-BLOCK.rules (2):
        #  VERSION 60
        #  Updated 2008-09-09 12:41:40

     -> Added to emerging-rbn.rules (2):
        #  VERSION 60
        #  Updated 2008-09-09 12:41:40

     -> Added to emerging-sid-msg.map (49):
        2008542 || ET EXPLOIT CitectSCADA ODBC Overflowflow Attempt || url,www.digitalbond.com/index.php/2008/09/08/ids-signature-for-citect-vuln/ || cve,2008-2639
        2008543 || ET POLICY Known SSL traffic on port 995 (imaps) being excluded from SSL Alerts
        2008544 || ET MALWARE Suspicious User-Agent (winlogon)
        2008545 || ET TROJAN Social-bos.biz related trojan checkin (trackid=hex)
        2008546 || ET CURRENT_EVENTS Unknown Downloader Checkin part 1 of 2
        2008547 || ET TROJAN PECompact2 Packed Binary - Likely Hostile || url,bits.packetninjas.org/eblog/?p=306 || url,www.bitsum.com/pecompact.shtml
        2008548 || ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (3P and version num)
        2008549 || ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (AntivirXP)
        2008550 || ET TROJAN General Bot HTTP CnC Pattern
        2406000 || ET RBN Known Russian Business Network Monitored Domains (1) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406001 || ET RBN Known Russian Business Network Monitored Domains (2) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406002 || ET RBN Known Russian Business Network Monitored Domains (3) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406003 || ET RBN Known Russian Business Network Monitored Domains (4) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406004 || ET RBN Known Russian Business Network Monitored Domains (5) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406005 || ET RBN Known Russian Business Network Monitored Domains (6) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406006 || ET RBN Known Russian Business Network Monitored Domains (7) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406007 || ET RBN Known Russian Business Network Monitored Domains (8) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406008 || ET RBN Known Russian Business Network Monitored Domains (9) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406009 || ET RBN Known Russian Business Network Monitored Domains (10) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406010 || ET RBN Known Russian Business Network Monitored Domains (11) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406011 || ET RBN Known Russian Business Network Monitored Domains (12) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406012 || ET RBN Known Russian Business Network Monitored Domains (13) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406013 || ET RBN Known Russian Business Network Monitored Domains (14) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406014 || ET RBN Known Russian Business Network Monitored Domains (15) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406015 || ET RBN Known Russian Business Network Monitored Domains (16) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406016 || ET RBN Known Russian Business Network Monitored Domains (17) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406017 || ET RBN Known Russian Business Network Monitored Domains (18) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406018 || ET RBN Known Russian Business Network Monitored Domains (19) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406019 || ET RBN Known Russian Business Network Monitored Domains (20) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407000 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (1) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407001 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (2) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407002 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (3) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407003 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (4) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407004 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (5) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407005 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (6) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407006 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (7) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407007 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (8) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407008 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (9) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407009 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (10) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407010 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (11) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407011 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (12) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407012 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (13) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407013 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (14) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407014 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (15) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407015 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407016 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407017 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407018 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407019 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork

     -> Added to emerging-sid-msg.map.txt (49):
        2008542 || ET EXPLOIT CitectSCADA ODBC Overflowflow Attempt || url,www.digitalbond.com/index.php/2008/09/08/ids-signature-for-citect-vuln/ || cve,2008-2639
        2008543 || ET POLICY Known SSL traffic on port 995 (imaps) being excluded from SSL Alerts
        2008544 || ET MALWARE Suspicious User-Agent (winlogon)
        2008545 || ET TROJAN Social-bos.biz related trojan checkin (trackid=hex)
        2008546 || ET CURRENT_EVENTS Unknown Downloader Checkin part 1 of 2
        2008547 || ET TROJAN PECompact2 Packed Binary - Likely Hostile || url,bits.packetninjas.org/eblog/?p=306 || url,www.bitsum.com/pecompact.shtml
        2008548 || ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (3P and version num)
        2008549 || ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (AntivirXP)
        2008550 || ET TROJAN General Bot HTTP CnC Pattern
        2406000 || ET RBN Known Russian Business Network Monitored Domains (1) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406001 || ET RBN Known Russian Business Network Monitored Domains (2) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406002 || ET RBN Known Russian Business Network Monitored Domains (3) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406003 || ET RBN Known Russian Business Network Monitored Domains (4) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406004 || ET RBN Known Russian Business Network Monitored Domains (5) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406005 || ET RBN Known Russian Business Network Monitored Domains (6) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406006 || ET RBN Known Russian Business Network Monitored Domains (7) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406007 || ET RBN Known Russian Business Network Monitored Domains (8) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406008 || ET RBN Known Russian Business Network Monitored Domains (9) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406009 || ET RBN Known Russian Business Network Monitored Domains (10) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406010 || ET RBN Known Russian Business Network Monitored Domains (11) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406011 || ET RBN Known Russian Business Network Monitored Domains (12) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406012 || ET RBN Known Russian Business Network Monitored Domains (13) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406013 || ET RBN Known Russian Business Network Monitored Domains (14) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406014 || ET RBN Known Russian Business Network Monitored Domains (15) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406015 || ET RBN Known Russian Business Network Monitored Domains (16) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406016 || ET RBN Known Russian Business Network Monitored Domains (17) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406017 || ET RBN Known Russian Business Network Monitored Domains (18) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406018 || ET RBN Known Russian Business Network Monitored Domains (19) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406019 || ET RBN Known Russian Business Network Monitored Domains (20) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407000 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (1) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407001 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (2) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407002 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (3) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407003 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (4) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407004 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (5) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407005 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (6) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407006 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (7) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407007 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (8) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407008 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (9) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407009 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (10) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407010 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (11) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407011 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (12) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407012 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (13) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407013 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (14) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407014 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (15) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407015 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407016 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407017 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407018 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407019 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork

     -> Added to emerging-virus.rules (1):
        #data from nalbright

     -> Added to emerging.rules (1):
        #another unknown, soo to be IDd. Sig by Daniel Clemens

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-drop-BLOCK.rules (2):
        #  VERSION 1288
        #  Generated 2008-09-06 00:03:02 EDT

     -> Removed from emerging-drop.rules (2):
        #  VERSION 1288
        #  Generated 2008-09-06 00:03:02 EDT

     -> Removed from emerging-rbn-BLOCK.rules (6):
        #general hosts
        #individual general hosts
        #chinese
        #Panamanian/Central America
        #  VERSION 59
        #  Updated 2008-08-27 16:34:55

     -> Removed from emerging-rbn.rules (6):
        #general hosts
        #individual general hosts
        #chinese
        #Panamanian/Central America
        #  VERSION 59
        #  Updated 2008-08-27 16:34:55

     -> Removed from emerging-sid-msg.map (54):
        2008053 || ET MALWARE InternetSpeedMonitor Related Spyware User-Agent (parchmnt loader v1.8)
        2008234 || ET MALWARE Suspicious User-Agent (winlogon)
        2008252 || ET MALWARE Suspicious User-Agent (max loader)
        2008265 || ET MALWARE Suspicious User-Agent (creativesmover loader vnr2.2)
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org
        2406000 || ET RBN Known Russian Business Network Traffic - Hosting Nets || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406001 || ET RBN Known Russian Business Network Traffic - Individual Hosts || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406002 || ET RBN Known Russian Business Network Traffic - Chinese Nets || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406004 || ET RBN Known Russian Business Network Traffic - Central American Nets || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406005 || ET RBN Known Russian Business Network Monitored Domains (1) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406006 || ET RBN Known Russian Business Network Monitored Domains (2) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406007 || ET RBN Known Russian Business Network Monitored Domains (3) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406008 || ET RBN Known Russian Business Network Monitored Domains (4) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406009 || ET RBN Known Russian Business Network Monitored Domains (5) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406010 || ET RBN Known Russian Business Network Monitored Domains (6) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406011 || ET RBN Known Russian Business Network Monitored Domains (7) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406012 || ET RBN Known Russian Business Network Monitored Domains (8) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406013 || ET RBN Known Russian Business Network Monitored Domains (9) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406014 || ET RBN Known Russian Business Network Monitored Domains (10) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406015 || ET RBN Known Russian Business Network Monitored Domains (11) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406016 || ET RBN Known Russian Business Network Monitored Domains (12) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406017 || ET RBN Known Russian Business Network Monitored Domains (13) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406018 || ET RBN Known Russian Business Network Monitored Domains (14) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406019 || ET RBN Known Russian Business Network Monitored Domains (15) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406020 || ET RBN Known Russian Business Network Monitored Domains (16) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406021 || ET RBN Known Russian Business Network Monitored Domains (17) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406022 || ET RBN Known Russian Business Network Monitored Domains (18) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406023 || ET RBN Known Russian Business Network Monitored Domains (19) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406024 || ET RBN Known Russian Business Network Monitored Domains (20) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407000 || ET RBN Known Russian Business Network Traffic - Hosting Nets - BLOCKING || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407001 || ET RBN Known Russian Business Network Traffic - Individual Hosts - BLOCKING || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407002 || ET RBN Known Russian Business Network Traffic - Chinese Nets - BLOCKING || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407004 || ET RBN Known Russian Business Network Traffic - Central American Nets || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407005 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (1) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407006 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (2) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407007 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (3) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407008 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (4) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407009 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (5) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407010 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (6) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407011 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (7) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407012 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (8) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407013 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (9) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407014 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (10) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407015 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (11) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407016 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (12) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407017 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (13) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407018 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (14) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407019 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (15) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407020 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407021 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407022 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407023 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407024 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork

     -> Removed from emerging-sid-msg.map.txt (54):
        2008053 || ET MALWARE InternetSpeedMonitor Related Spyware User-Agent (parchmnt loader v1.8)
        2008234 || ET MALWARE Suspicious User-Agent (winlogon)
        2008252 || ET MALWARE Suspicious User-Agent (max loader)
        2008265 || ET MALWARE Suspicious User-Agent (creativesmover loader vnr2.2)
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org
        2406000 || ET RBN Known Russian Business Network Traffic - Hosting Nets || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406001 || ET RBN Known Russian Business Network Traffic - Individual Hosts || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406002 || ET RBN Known Russian Business Network Traffic - Chinese Nets || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406004 || ET RBN Known Russian Business Network Traffic - Central American Nets || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406005 || ET RBN Known Russian Business Network Monitored Domains (1) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406006 || ET RBN Known Russian Business Network Monitored Domains (2) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406007 || ET RBN Known Russian Business Network Monitored Domains (3) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406008 || ET RBN Known Russian Business Network Monitored Domains (4) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406009 || ET RBN Known Russian Business Network Monitored Domains (5) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406010 || ET RBN Known Russian Business Network Monitored Domains (6) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406011 || ET RBN Known Russian Business Network Monitored Domains (7) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406012 || ET RBN Known Russian Business Network Monitored Domains (8) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406013 || ET RBN Known Russian Business Network Monitored Domains (9) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406014 || ET RBN Known Russian Business Network Monitored Domains (10) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406015 || ET RBN Known Russian Business Network Monitored Domains (11) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406016 || ET RBN Known Russian Business Network Monitored Domains (12) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406017 || ET RBN Known Russian Business Network Monitored Domains (13) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406018 || ET RBN Known Russian Business Network Monitored Domains (14) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406019 || ET RBN Known Russian Business Network Monitored Domains (15) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406020 || ET RBN Known Russian Business Network Monitored Domains (16) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406021 || ET RBN Known Russian Business Network Monitored Domains (17) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406022 || ET RBN Known Russian Business Network Monitored Domains (18) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406023 || ET RBN Known Russian Business Network Monitored Domains (19) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406024 || ET RBN Known Russian Business Network Monitored Domains (20) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407000 || ET RBN Known Russian Business Network Traffic - Hosting Nets - BLOCKING || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407001 || ET RBN Known Russian Business Network Traffic - Individual Hosts - BLOCKING || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407002 || ET RBN Known Russian Business Network Traffic - Chinese Nets - BLOCKING || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407004 || ET RBN Known Russian Business Network Traffic - Central American Nets || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407005 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (1) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407006 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (2) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407007 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (3) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407008 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (4) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407009 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (5) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407010 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (6) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407011 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (7) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407012 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (8) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407013 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (9) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407014 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (10) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407015 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (11) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407016 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (12) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407017 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (13) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407018 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (14) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407019 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (15) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407020 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407021 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407022 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407023 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407024 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork


From emerging at emergingthreats.net  Sun Sep 14 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Sun, 14 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080914200008.C2F994502B@goliath.jonkmans.com>


[***] Results from Oinkmaster started Sun Sep 14 16:00:08 2008 [***]

[*] Rules modifications: [*]
    None.

[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-sid-msg.map (2):
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org

     -> Added to emerging-sid-msg.map.txt (2):
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org


From schandan at secpod.com  Mon Sep 15 09:52:32 2008
From: schandan at secpod.com (chandan)
Date: Mon, 15 Sep 2008 19:22:32 +0530
Subject: [Emerging-Sigs] Sig's on Malware word doc and Wordpress
Message-ID: <48CE68A0.7020707@secpod.com>


Signatures for Malware word doc and Wordpress Random password generator.

# 15/09/2008 Malware Word doc
alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"Malware Word doc Email
- Trojan"; flow:established,to_server; content:"|0d 0a|Subject\:
Rechnung"; pcre:"/Rechnung\.(zip|doc)/i"; classtype:trojan-activity;
reference:url,www.virustotal.com/analisis/0fc3a70eff0b9ec447794acbda2402e7;
reference:url,isc.sans.org/diary.html?storyid=5029&rss; sid:9028; rev:1;)

# 15/09/2008 Wordpress
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WordPress
Random Password Generation Insufficient Entropy";
flow:to_server,established; content:"POST "; depth:5;
uricontent:"/wp-login.php?"; nocase; uricontent:"action="; nocase;
pcre:"/\w+(%20){60,}/Bi"; reference:bugtraq,31115;
reference:url,downloads.securityfocus.com/vulnerabilities/exploits/31115.php;
classtype:web-application-attack; sid:9027; rev:1;)

Thanks!!
Chandan
www.secpod.com


From jonkman at jonkmans.com  Mon Sep 15 11:42:04 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Mon, 15 Sep 2008 11:42:04 -0400
Subject: [Emerging-Sigs] Sig's on Malware word doc and Wordpress
In-Reply-To: <48CE68A0.7020707@secpod.com>
References: <48CE68A0.7020707@secpod.com>
Message-ID: <48CE824C.8060900@jonkmans.com>

Good sigs Chandan, will post them asap.

Putting the first into current events, this will surely pass in a few days.

Thanks!

Matt

chandan wrote:
> Signatures for Malware word doc and Wordpress Random password generator.
> 
> # 15/09/2008 Malware Word doc
> alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"Malware Word doc Email
> - Trojan"; flow:established,to_server; content:"|0d 0a|Subject\:
> Rechnung"; pcre:"/Rechnung\.(zip|doc)/i"; classtype:trojan-activity;
> reference:url,www.virustotal.com/analisis/0fc3a70eff0b9ec447794acbda2402e7;
> reference:url,isc.sans.org/diary.html?storyid=5029&rss; sid:9028; rev:1;)
> 
> # 15/09/2008 Wordpress
> alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"WordPress
> Random Password Generation Insufficient Entropy";
> flow:to_server,established; content:"POST "; depth:5;
> uricontent:"/wp-login.php?"; nocase; uricontent:"action="; nocase;
> pcre:"/\w+(%20){60,}/Bi"; reference:bugtraq,31115;
> reference:url,downloads.securityfocus.com/vulnerabilities/exploits/31115.php;
> classtype:web-application-attack; sid:9027; rev:1;)
> 
> Thanks!!
> Chandan
> www.secpod.com
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Mon Sep 15 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Mon, 15 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080915200008.CD0164502B@goliath.jonkmans.com>


[***] Results from Oinkmaster started Mon Sep 15 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008551 - ET TROJAN Banito/Agent.pb Pass Stealer Email Report Outbound (emerging-virus.rules)
 2008552 - ET CURRENT_EVENTS Malware Word doc Email - Fordo Trojan Likely (emerging.rules)
 2008553 - ET WEB WordPress Random Password Generation Insufficient Entropy Attack (emerging-web.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-sid-msg.map (3):
        2008551 || ET TROJAN Banito/Agent.pb Pass Stealer Email Report Outbound
        2008552 || ET CURRENT_EVENTS Malware Word doc Email - Fordo Trojan Likely || url,isc.sans.org/diary.html?storyid=5029 || url,www.virustotal.com/analisis/0fc3a70eff0b9ec447794acbda2402e7
        2008553 || ET WEB WordPress Random Password Generation Insufficient Entropy Attack || url,downloads.securityfocus.com/vulnerabilities/exploits/31115.php || bugtraq,31115

     -> Added to emerging-sid-msg.map.txt (3):
        2008551 || ET TROJAN Banito/Agent.pb Pass Stealer Email Report Outbound
        2008552 || ET CURRENT_EVENTS Malware Word doc Email - Fordo Trojan Likely || url,isc.sans.org/diary.html?storyid=5029 || url,www.virustotal.com/analisis/0fc3a70eff0b9ec447794acbda2402e7
        2008553 || ET WEB WordPress Random Password Generation Insufficient Entropy Attack || url,downloads.securityfocus.com/vulnerabilities/exploits/31115.php || bugtraq,31115

     -> Added to emerging-web.rules (2):
        #by Chandan at secpod
        # 15/09/2008 Wordpress

     -> Added to emerging.rules (2):
        #by Chandan at secpod
        # 15/09/2008 Malware Word doc


From veerendragg at secpod.com  Tue Sep 16 09:14:34 2008
From: veerendragg at secpod.com (Veerendra GG)
Date: Tue, 16 Sep 2008 18:44:34 +0530
Subject: [Emerging-Sigs] Signatures on Malware E-mail Attacks
Message-ID: <48CFB13A.4020804@secpod.com>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

# 16/09/2008 Nuclear Email Malware Attack
alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"Nuclear Email Malware
attack - Trojan"; flow:established,to_server; content:"|0d 0a|Subject\:
Reply\: A report on radiation contamination of Canada"; nocase;
content:"victims.zip"; nocase; classtype:trojan-activity;
reference:url,www.sophos.com/blogs/gc/g/2008/09/11/nuclear-email;
reference:url,www.computerweekly.com/Articles/2008/09/12/232290/london-nuclear-explosion-in-malware-spam-campaign.htm;
sid:2029; rev:1;)


# 16/09/2008 Internet Trojan
alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"Your internet access
is going to get suspended - Trojan"; flow:established,to_server;
content:"|0d 0a|Subject\: Your internet access"; nocase;
content:"suspended"; nocase; pcre:"/[\w\d]+activities.zip/i";
classtype:trojan-activity;
reference:url,www.sophos.com/blogs/gc/g/2008/09/12/your-internet-access;
reference:url,blog.mxlab.be/2008/09/11/your-internet-access-is-going-to-get-suspended-virus/;
reference:url,blog.threatfire.com/2008/09/your-internet-access-is-going-to-get.html;
reference:url,forum.bitdefender.com/index.php?showtopic=7861 ;sid:2030;
rev:1;)

- --
regards,
Veerendra GG
http://www.secpod.com/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQIVAwUBSM+xOeEQO76B7pCmAQK3GRAAmjGoU49eYwrRCIfQRsxpXzXSuqHo5IUP
FvrzQ3yjOk7+3BAYIxaOrXPKt+ypBkF8snxRojZhTRkkJHG+80haqZgeTxsngVIs
VqBK7hxsutiHGx3tPblx1sy8yBtPOqfbSzk04JJn9xstvvqPHyexVStlVaS+6Pvd
i4GsjWZaQr+x6Ove6x6MZWz2VXaqzZLzCXyObt93LDHm1rAe2H6+O6ukZMR6m9zX
w7k9jaQdLmTDVZHvfr+kTr3H6tFRD8VarePXtGIh9AH7217B4ONT9YPIz1sbopyx
kcpwWADf0u1u2yh44hYehvkvAFW4dyIJ0yr6gJQLa1d+1vzJNV7iWnL1LOXLO6Z2
fF/3dQ7GWixyeoNqQbCaQDYVGX9s+BfCoMwG0q+CK3La+b6eNC1B+4pe4AeHQuwH
FPc3HtLWezy7J0t74MvHs/D9vNss819GeUy0XYPotA51v0HSEQ+IqUG+7NM2QG4I
Zms1f3SyIrl+wH44Lv+Bc/IOQKm6iiW+XGpNKd/E/r3l4pEe2Ki2wJal3ELRsXzh
58UM2uUO3ZaKs1iYN1zQuzirIgx6JRWfHtXfHgzbYiD8PK9rYdTp/gzOihiLeUkT
iHx+7LllCJKqVVFmfOwvd+lsKq3Un96N1RdiT+7LvBU/hvyPMvAM/uXuBku9Dq/2
995lZQbv8FQ=
=WFfD
-----END PGP SIGNATURE-----

From jonkman at jonkmans.com  Tue Sep 16 09:36:24 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Tue, 16 Sep 2008 09:36:24 -0400
Subject: [Emerging-Sigs] Signatures on Malware E-mail Attacks
In-Reply-To: <48CFB13A.4020804@secpod.com>
References: <48CFB13A.4020804@secpod.com>
Message-ID: <48CFB658.6020602@jonkmans.com>

Good sigs, should be useful for a while. Posting now!

Veerendra GG wrote:
> # 16/09/2008 Nuclear Email Malware Attack
> alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"Nuclear Email Malware
> attack - Trojan"; flow:established,to_server; content:"|0d 0a|Subject\:
> Reply\: A report on radiation contamination of Canada"; nocase;
> content:"victims.zip"; nocase; classtype:trojan-activity;
> reference:url,www.sophos.com/blogs/gc/g/2008/09/11/nuclear-email;
> reference:url,www.computerweekly.com/Articles/2008/09/12/232290/london-nuclear-explosion-in-malware-spam-campaign.htm;
> sid:2029; rev:1;)
> 
> 
> # 16/09/2008 Internet Trojan
> alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"Your internet access
> is going to get suspended - Trojan"; flow:established,to_server;
> content:"|0d 0a|Subject\: Your internet access"; nocase;
> content:"suspended"; nocase; pcre:"/[\w\d]+activities.zip/i";
> classtype:trojan-activity;
> reference:url,www.sophos.com/blogs/gc/g/2008/09/12/your-internet-access;
> reference:url,blog.mxlab.be/2008/09/11/your-internet-access-is-going-to-get-suspended-virus/;
> reference:url,blog.threatfire.com/2008/09/your-internet-access-is-going-to-get.html;
> reference:url,forum.bitdefender.com/index.php?showtopic=7861 ;sid:2030;
> rev:1;)
> 
_______________________________________________
Emerging-sigs mailing list
Emerging-sigs at emergingthreats.net
http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Tue Sep 16 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Tue, 16 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080916200008.0442945026@goliath.jonkmans.com>


[***] Results from Oinkmaster started Tue Sep 16 16:00:07 2008 [***]

[+++]          Added rules:          [+++]

  200858 - ET MALWARE iwin.com Games/Spyware User-Agent (iWin GameInfo Installer Helper) (emerging-malware.rules)
 2008554 - ET CURRENT_EVENTS Nuclear Email Malware Inbound - Likely Trojan (emerging.rules)
 2008555 - ET CURRENT_EVENTS Your internet access is going to get suspended Email Inbound - Likely Trojan (emerging.rules)
 2008556 - ET ATTACK_RESPONSE FTP CWD to windows system32 - Suspicious (emerging-attack_response.rules)
 2008557 - ET TROJAN Likely EXE Cryptor Packed Binary - Likely Malware (emerging-virus.rules)
 2008559 - ET ATTACK_RESPONSE Windows LMHosts File Download - Likely DNSChanger Infection (emerging-attack_response.rules)


[///]     Modified active rules:     [///]

 2008334 - ET TROJAN Beizhu/Womble/Vipdataend Checking with Controller (emerging-virus.rules)
 2008335 - ET TROJAN Beizhu/Womble/Vipdataend Controller Keepalive (emerging-virus.rules)
 2008549 - ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (AntivirXP) (emerging-malware.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-attack_response.rules (1):
        #matt jonkman, info from qru

     -> Added to emerging-sid-msg.map (6):
        200858 || ET MALWARE iwin.com Games/Spyware User-Agent (iWin GameInfo Installer Helper)
        2008554 || ET CURRENT_EVENTS Nuclear Email Malware Inbound - Likely Trojan || url,www.computerweekly.com/Articles/2008/09/12/232290/london-nuclear-explosion-in-malware-spam-campaign.htm || url,www.sophos.com/blogs/gc/g/2008/09/11/nuclear-email
        2008555 || ET CURRENT_EVENTS Your internet access is going to get suspended Email Inbound - Likely Trojan || url,forum.bitdefender.com/index.php?showtopic=7861 || url,blog.threatfire.com/2008/09/your-internet-access-is-going-to-get.html || url,blog.mxlab.be/2008/09/11/your-internet-access-is-going-to-get-suspended-virus/ || url,www.sophos.com/blogs/gc/g/2008/09/12/your-internet-access
        2008556 || ET ATTACK_RESPONSE FTP CWD to windows system32 - Suspicious
        2008557 || ET TROJAN Likely EXE Cryptor Packed Binary - Likely Malware || url,bits.packetninjas.org
        2008559 || ET ATTACK_RESPONSE Windows LMHosts File Download - Likely DNSChanger Infection

     -> Added to emerging-sid-msg.map.txt (6):
        200858 || ET MALWARE iwin.com Games/Spyware User-Agent (iWin GameInfo Installer Helper)
        2008554 || ET CURRENT_EVENTS Nuclear Email Malware Inbound - Likely Trojan || url,www.computerweekly.com/Articles/2008/09/12/232290/london-nuclear-explosion-in-malware-spam-campaign.htm || url,www.sophos.com/blogs/gc/g/2008/09/11/nuclear-email
        2008555 || ET CURRENT_EVENTS Your internet access is going to get suspended Email Inbound - Likely Trojan || url,forum.bitdefender.com/index.php?showtopic=7861 || url,blog.threatfire.com/2008/09/your-internet-access-is-going-to-get.html || url,blog.mxlab.be/2008/09/11/your-internet-access-is-going-to-get-suspended-virus/ || url,www.sophos.com/blogs/gc/g/2008/09/12/your-internet-access
        2008556 || ET ATTACK_RESPONSE FTP CWD to windows system32 - Suspicious
        2008557 || ET TROJAN Likely EXE Cryptor Packed Binary - Likely Malware || url,bits.packetninjas.org
        2008559 || ET ATTACK_RESPONSE Windows LMHosts File Download - Likely DNSChanger Infection

     -> Added to emerging.rules (3):
        #by Veerendra at secpod.org
        # 16/09/2008 Nuclear Email Malware Attack
        # 16/09/2008 Internet Trojan


From emerging at emergingthreats.net  Wed Sep 17 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Wed, 17 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080917200008.2351B45026@goliath.jonkmans.com>


[***] Results from Oinkmaster started Wed Sep 17 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008558 - ET MALWARE iwin.com Games/Spyware User-Agent (iWin GameInfo Installer Helper) (emerging-malware.rules)


[---]         Removed rules:         [---]

  200858 - ET MALWARE iwin.com Games/Spyware User-Agent (iWin GameInfo Installer Helper) (emerging-malware.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-sid-msg.map (1):
        2008558 || ET MALWARE iwin.com Games/Spyware User-Agent (iWin GameInfo Installer Helper)

     -> Added to emerging-sid-msg.map.txt (1):
        2008558 || ET MALWARE iwin.com Games/Spyware User-Agent (iWin GameInfo Installer Helper)

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-sid-msg.map (3):
        200858 || ET MALWARE iwin.com Games/Spyware User-Agent (iWin GameInfo Installer Helper)
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org

     -> Removed from emerging-sid-msg.map.txt (3):
        200858 || ET MALWARE iwin.com Games/Spyware User-Agent (iWin GameInfo Installer Helper)
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org


From frank at knobbe.us  Wed Sep 17 17:43:11 2008
From: frank at knobbe.us (Frank Knobbe)
Date: Wed, 17 Sep 2008 16:43:11 -0500
Subject: [Emerging-Sigs] RUHERE ?
In-Reply-To: <20080912071819.et4i6f5bsw48sw08@mail.afferentsecurity.com>
References: <200809121153.15011.thierry.chich@ac-clermont.fr>
	<20080912071819.et4i6f5bsw48sw08@mail.afferentsecurity.com>
Message-ID: <1221687791.47732.21.camel@localhost>

On Fri, 2008-09-12 at 07:18 -0500, Jack Pepper wrote:
> Quoting Thierry CHICH <thierry.chich at ac-clermont.fr>:
> 
> > I have found some new SMTP keywords :-D :
> > T yyyy:25 -> xxxx:2157 [AP]
> >   701 IMHERE..
> >
> > Is the software RUTHERE that have been installed to listen the port 25, or is
> > it something worse.
> 
> A few months ago I found the keyword SNIPER in a log.  I set up a rule  
> to watch for it again, but it hasn't come back.  This one is  
> extra-interesting because your mail server gave a response code.


Well, he said XXXX was his home net, so he has something that's
connecting out to port 25. Could be a some bot doing it's handshaking
(though I hope for Thierry that's not the case :)

Might be worthwhile to create a sig for outbound RUTHERE and inbound
IMHERE responses. Considering the short packet and including the number
is should generate few FP's.

I'll get to it later, unless Matt beats me to it. :)

-Frank


-- 
It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part
Url : http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080917/18d8ac01/attachment.bin

From emerging at emergingthreats.net  Thu Sep 18 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Thu, 18 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080918200008.18DD545026@goliath.jonkmans.com>


[***] Results from Oinkmaster started Thu Sep 18 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008560 - ET SCAN NNG MS02-039 Exploit False Positive Generator - May Conceal A Genuine Attack (emerging-scan.rules)
 2008561 - ET POLICY External Unencrypted Connection To Aanval Console (emerging-policy.rules)
 2008562 - ET Suspicious SMTP handshake outbound (emerging.rules)
 2008563 - ET Suspicious SMTP handshake reply (emerging.rules)
 2008564 - ET MALWARE Suspicious User-Agent (Internet HTTP Request) (emerging-malware.rules)
 2008565 - ET MALWARE Macrovision.com Spyware Related User-Agent (Macrovision_DM_2.19) (emerging-malware.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-sid-msg.map (6):
        2008560 || ET SCAN NNG MS02-039 Exploit False Positive Generator - May Conceal A Genuine Attack || url,packetstormsecurity.nl/filedesc/nng-4.13r-public.rar.html
        2008561 || ET POLICY External Unencrypted Connection To Aanval Console || url,www.aanval.com
        2008562 || ET Suspicious SMTP handshake outbound
        2008563 || ET Suspicious SMTP handshake reply
        2008564 || ET MALWARE Suspicious User-Agent (Internet HTTP Request)
        2008565 || ET MALWARE Macrovision.com Spyware Related User-Agent (Macrovision_DM_2.19)

     -> Added to emerging-sid-msg.map.txt (6):
        2008560 || ET SCAN NNG MS02-039 Exploit False Positive Generator - May Conceal A Genuine Attack || url,packetstormsecurity.nl/filedesc/nng-4.13r-public.rar.html
        2008561 || ET POLICY External Unencrypted Connection To Aanval Console || url,www.aanval.com
        2008562 || ET Suspicious SMTP handshake outbound
        2008563 || ET Suspicious SMTP handshake reply
        2008564 || ET MALWARE Suspicious User-Agent (Internet HTTP Request)
        2008565 || ET MALWARE Macrovision.com Spyware Related User-Agent (Macrovision_DM_2.19)

     -> Added to emerging.rules (1):
        # Unknown handshake over SMTP discovered by Thierry Chich and reported on mail list. Added by Frank Knobbe 2008-09-17.


From jonkman at jonkmans.com  Fri Sep 19 10:05:37 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Fri, 19 Sep 2008 10:05:37 -0400
Subject: [Emerging-Sigs] Microsoft BITS Sig
Message-ID: <48D3B1B1.2070005@jonkmans.com>

Cees and Bojan have sent in a sig related to Bojan's ISC entry of yesterday:

http://isc.sans.org/diary.html?storyid=5054

Related to the numbers of malware using the MS BITS download tools, or
at least their user-agent string, to avoid detection. Indeed we've seen
this technique in samples in the sandnet for a long time now, thousands
of instances.

But before we post this sig to the main ruleset I'd like to ask a few
sites to run it for 24 hours and let us know about any other sites we
should whitelist. Here's the sig so far:

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Microsoft
BIT's User-Agent to an unknown domain - Likely Malware";
flow:established,to_server; content:"|0d 0a|User-Agent\: Microsoft
BITS"; content:!"|0d 0a|Host\: au.download.windowsupdate.com";
content:!"|0d 0a|Host\: cache.pack.google.com"; content:!"|0d 0a|Host\:
origin.onecare.live.com"; content:!"|0d 0a|Host\: dl.google.com";
content:"|0d 0a|Host\:"; content:!"sun.com"; within:20;
classtype:trojan-activity; sid:2008566; rev:1;)

Can a few folks give this a whirl to test the whitelisting?

Thanks!!

Matt

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From jonkman at jonkmans.com  Fri Sep 19 10:59:19 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Fri, 19 Sep 2008 10:59:19 -0400
Subject: [Emerging-Sigs] Voiper Sig
Message-ID: <48D3BE47.3090000@jonkmans.com>

By Kevin Ross. Interesting tool, thankfully easily fingerprinted:

#by Kevin Ross
alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET SCAN Voiper
Toolkit Torturer Scan"; content:"interesting-Method";
content:"sip\:1_unusual.URI"; content:"to-be!sure"; offset:20; depth:60;
classtype:attempted-recon;
reference:url,sourceforge.net/projects/voiper; sid:2008568; rev:1;)

Matt
-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From jonkman at jonkmans.com  Fri Sep 19 11:05:28 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Fri, 19 Sep 2008 11:05:28 -0400
Subject: [Emerging-Sigs] BASE and OSSEC
Message-ID: <48D3BFB8.9000307@jonkmans.com>

A couple other interesting sigs from Kevin. Detecting unencrypted
external connection attempts to the ossec and BASE consoles.

#by Kevin Ross
alert tcp $EXTERNAL_NET any ->$HTTP_SERVERS $HTTP_PORTS (msg:"ET POLICY
External Unencrypted Connection to BASE Console";
flow:to_server,established; uricontent:"/base_main.php";
classtype:misc-activity; reference:url,base.secureideas.net;
sid:2008570; rev:1;)

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET POLICY
External Unencrypted Connection to Ossec WUI";
flow:established,to_server; uricontent:"/ossec/";
uricontent:"js/calendar-setup.js"; classtype:misc-activity;
reference:url,www.ossec.net; sid:2008569; rev:1;)

Thanks Kevin!

Matt

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From jonkman at jonkmans.com  Fri Sep 19 15:12:06 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Fri, 19 Sep 2008 15:12:06 -0400
Subject: [Emerging-Sigs] Mysql CnC!!
Message-ID: <48D3F986.9000009@jonkmans.com>

Here's an interesting one from the sandbox. It makes an external Mysql
connection, logs in, and then downloads the sites and binaries it's
supposed to download.

How's that for ballsy?

These sigs will catch it, the first is just general for any outbound
mysql connection. Oughtn't happen, especially unencrypted:

alert tcp $EXTERNAL_NET 3306 -> $HOME_NET any (msg:"ET POLICY External
MYSQL Server Connection"; flow:from_server,established; content:"|00|";
depth:1; offset:3; flowbits:set,EText.mysql.greeting;
classtype:trojan-activity; sid:2008572; rev:1;)

Sets the flowbit as well, which is checked here:

alert tcp $HOME_NET any -> $EXTERNAL_NET 3306 (msg:"ET TROJAN
Viruscatch.co.kr/Win32.Small.hvd Mysql Command and Control Connection
(user viruscatch)"; flow:established,to_server; dsize:<40;
flowbits:isset,EText.mysql.greeting; content:"viruscatch|00|";
classtype:trojan-activity; sid:2008573; rev:1;)

Interesting one. Please let me know about any false positives!

Matt


-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From jonkman at jonkmans.com  Fri Sep 19 15:30:58 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Fri, 19 Sep 2008 15:30:58 -0400
Subject: [Emerging-Sigs] AutoIt!
Message-ID: <48D3FDF2.2060806@jonkmans.com>

Autoit is a free windows scripting tool. Allows a great deal of
automation and the like.

We've had some samples in the past that used autoit to download and
execute code. It uses a distinct user-agent for http requests (AutoIt).
Till now there were only a few so I've resisted putting up a sig for
that UA. There may be some legitimate applications or local uses that'd
trip the sig.

In the last few days though we've had at least 40 unique samples come
through that are using autoit. This has pushed me over that fence to
think we do need a sig for this. Those samples didn't for the most part
do anything else unique enough to get a signature for.

So I'll be posting a sig for the autoit useragent, but just calling it
suspicious. Hope no one takes this as us thinking autoit is an evil
tool. It's certainly not, but beeing misused too often to ignore it on
the network.

Matt

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Fri Sep 19 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Fri, 19 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080919200008.218B24502E@goliath.jonkmans.com>


[***] Results from Oinkmaster started Fri Sep 19 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008567 - ET TROJAN Win32.Crypt.nc Checkin (emerging-virus.rules)
 2008568 - ET SCAN Voiper Toolkit Torturer Scan (emerging-scan.rules)
 2008569 - ET POLICY External Unencrypted Connection to Ossec WUI (emerging-policy.rules)
 2008570 - ET POLICY External Unencrypted Connection to BASE Console (emerging-policy.rules)
 2008571 - ET SCAN Acunetix Web Vulnerability Scan (emerging-scan.rules)
 2008572 - ET POLICY External MYSQL Server Connection (emerging-policy.rules)
 2008573 - ET TROJAN Viruscatch.co.kr/Win32.Small.hvd Mysql Command and Control Connection (user viruscatch) (emerging-virus.rules)
 2008574 - ET MALWARE AutoIt User-Agent Detected - Often used by Malware (AutoIt) (emerging-malware.rules)


[///]     Modified active rules:     [///]

 2001219 - ET SCAN Potential SSH Scan (emerging-scan.rules)
 2003068 - ET SCAN Potential SSH Scan OUTBOUND (emerging-scan.rules)
 2008276 - ET MALWARE Suspicious User-Agent (contains loader) (emerging-malware.rules)
 2008547 - ET TROJAN PECompact2 Packed Binary - Likely Hostile (emerging-virus.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-policy.rules (1):
        # sets a flowbit for viruscatch.co.kr related, win32.small.hvd and others

     -> Added to emerging-sid-msg.map (8):
        2008567 || ET TROJAN Win32.Crypt.nc Checkin
        2008568 || ET SCAN Voiper Toolkit Torturer Scan || url,sourceforge.net/projects/voiper
        2008569 || ET POLICY External Unencrypted Connection to Ossec WUI || url,www.ossec.net
        2008570 || ET POLICY External Unencrypted Connection to BASE Console || url,base.secureideas.net
        2008571 || ET SCAN Acunetix Web Vulnerability Scan || url,www.acunetix.com/vulnerability-scanner/
        2008572 || ET POLICY External MYSQL Server Connection
        2008573 || ET TROJAN Viruscatch.co.kr/Win32.Small.hvd Mysql Command and Control Connection (user viruscatch)
        2008574 || ET MALWARE AutoIt User-Agent Detected - Often used by Malware (AutoIt) || url,www.autoitscript.com/autoit3

     -> Added to emerging-sid-msg.map.txt (8):
        2008567 || ET TROJAN Win32.Crypt.nc Checkin
        2008568 || ET SCAN Voiper Toolkit Torturer Scan || url,sourceforge.net/projects/voiper
        2008569 || ET POLICY External Unencrypted Connection to Ossec WUI || url,www.ossec.net
        2008570 || ET POLICY External Unencrypted Connection to BASE Console || url,base.secureideas.net
        2008571 || ET SCAN Acunetix Web Vulnerability Scan || url,www.acunetix.com/vulnerability-scanner/
        2008572 || ET POLICY External MYSQL Server Connection
        2008573 || ET TROJAN Viruscatch.co.kr/Win32.Small.hvd Mysql Command and Control Connection (user viruscatch)
        2008574 || ET MALWARE AutoIt User-Agent Detected - Often used by Malware (AutoIt) || url,www.autoitscript.com/autoit3

     -> Added to emerging-virus.rules (2):
        #by Jeffrey Brown, re 35546d9972aed2a5fec2c4e1136730a3
        #flowbit set by 2008572 in policy ruleset


From emerging at emergingthreats.net  Sat Sep 20 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Sat, 20 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080920200008.C8F3945026@goliath.jonkmans.com>


[***] Results from Oinkmaster started Sat Sep 20 16:00:08 2008 [***]

[///]     Modified active rules:     [///]

 2008549 - ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (AntivirXP) (emerging-malware.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-sid-msg.map (3):
        2008549 || ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (AntivirXP) || url,www.wiki-security.com/wiki/Parasite/Antivirus2008
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org

     -> Added to emerging-sid-msg.map.txt (3):
        2008549 || ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (AntivirXP) || url,www.wiki-security.com/wiki/Parasite/Antivirus2008
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-sid-msg.map (1):
        2008549 || ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (AntivirXP)

     -> Removed from emerging-sid-msg.map.txt (1):
        2008549 || ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (AntivirXP)


From jonkman at jonkmans.com  Sat Sep 20 16:50:06 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Sat, 20 Sep 2008 16:50:06 -0400
Subject: [Emerging-Sigs] ASPack/ASProtect Packed
Message-ID: <48D561FE.5040309@jonkmans.com>

Great new sig from Daniel Clemens for ASPack/ASProtect packed binaries.
If you're not familiar, there's virtually no legitimate use of this
packer. It's just an AV evasion and counter-debugging packer.

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN
ASProtect/ASPack Packed Binary - Likely Hostile";
floe:from_server,established; content:"|2E 72 73 72 63|"; content:"|2E
61 73 70 61 63 6B|"; within: 50;
reference:url,www.aspack.com/downloads.aspx;
reference:url,bits.packetninjas.org/eblog/; classtype:trojan-activity;
sid:2008575; rev:1;)

Please report any issues!

Matt

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Sat Sep 20 18:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Sat, 20 Sep 2008 18:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Weekly Signature Changes
Message-ID: <20080920220008.9126545026@goliath.jonkmans.com>


[***] Results from Oinkmaster started Sat Sep 20 18:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008551 - ET TROJAN Banito/Agent.pb Pass Stealer Email Report Outbound (emerging-virus.rules)
 2008552 - ET CURRENT_EVENTS Malware Word doc Email - Fordo Trojan Likely (emerging.rules)
 2008553 - ET WEB WordPress Random Password Generation Insufficient Entropy Attack (emerging-web.rules)
 2008554 - ET CURRENT_EVENTS Nuclear Email Malware Inbound - Likely Trojan (emerging.rules)
 2008555 - ET CURRENT_EVENTS Your internet access is going to get suspended Email Inbound - Likely Trojan (emerging.rules)
 2008556 - ET ATTACK_RESPONSE FTP CWD to windows system32 - Suspicious (emerging-attack_response.rules)
 2008557 - ET TROJAN Likely EXE Cryptor Packed Binary - Likely Malware (emerging-virus.rules)
 2008558 - ET MALWARE iwin.com Games/Spyware User-Agent (iWin GameInfo Installer Helper) (emerging-malware.rules)
 2008559 - ET ATTACK_RESPONSE Windows LMHosts File Download - Likely DNSChanger Infection (emerging-attack_response.rules)
 2008560 - ET SCAN NNG MS02-039 Exploit False Positive Generator - May Conceal A Genuine Attack (emerging-scan.rules)
 2008561 - ET POLICY External Unencrypted Connection To Aanval Console (emerging-policy.rules)
 2008562 - ET Suspicious SMTP handshake outbound (emerging.rules)
 2008563 - ET Suspicious SMTP handshake reply (emerging.rules)
 2008564 - ET MALWARE Suspicious User-Agent (Internet HTTP Request) (emerging-malware.rules)
 2008565 - ET MALWARE Macrovision.com Spyware Related User-Agent (Macrovision_DM_2.19) (emerging-malware.rules)
 2008567 - ET TROJAN Win32.Crypt.nc Checkin (emerging-virus.rules)
 2008568 - ET SCAN Voiper Toolkit Torturer Scan (emerging-scan.rules)
 2008569 - ET POLICY External Unencrypted Connection to Ossec WUI (emerging-policy.rules)
 2008570 - ET POLICY External Unencrypted Connection to BASE Console (emerging-policy.rules)
 2008571 - ET SCAN Acunetix Web Vulnerability Scan (emerging-scan.rules)
 2008572 - ET POLICY External MYSQL Server Connection (emerging-policy.rules)
 2008573 - ET TROJAN Viruscatch.co.kr/Win32.Small.hvd Mysql Command and Control Connection (user viruscatch) (emerging-virus.rules)
 2008574 - ET MALWARE AutoIt User-Agent Detected - Often used by Malware (AutoIt) (emerging-malware.rules)
 2008575 - ET TROJAN ASProtect/ASPack Packed Binary - Likely Hostile (emerging-virus.rules)
 2008576 - ET TROJAN TinyPE Binary - Possibly Hostile (emerging-virus.rules)
 2404020 - ET DROP Known Bot C&C Server Traffic (group 21)  (emerging-botcc.rules)
 2405020 - ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)


[///]     Modified active rules:     [///]

 2001219 - ET SCAN Potential SSH Scan (emerging-scan.rules)
 2003068 - ET SCAN Potential SSH Scan OUTBOUND (emerging-scan.rules)
 2008276 - ET MALWARE Suspicious User-Agent (contains loader) (emerging-malware.rules)
 2008334 - ET TROJAN Beizhu/Womble/Vipdataend Checking with Controller (emerging-virus.rules)
 2008335 - ET TROJAN Beizhu/Womble/Vipdataend Controller Keepalive (emerging-virus.rules)
 2008547 - ET TROJAN PECompact2 Packed Binary - Likely Hostile (emerging-virus.rules)
 2008549 - ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (AntivirXP) (emerging-malware.rules)
 2400000 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400001 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400002 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400003 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400004 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400005 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400006 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400007 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2401000 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401001 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401002 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401003 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401004 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401005 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401006 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401007 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2402000 - ET DROP Dshield Block Listed Source (emerging-dshield.rules)
 2403000 - ET DROP Dshield Block Listed Source - BLOCKING (emerging-dshield-BLOCK.rules)
 2404000 - ET DROP Known Bot C&C Server Traffic (group 1)  (emerging-botcc.rules)
 2404001 - ET DROP Known Bot C&C Server Traffic (group 2)  (emerging-botcc.rules)
 2404002 - ET DROP Known Bot C&C Server Traffic (group 3)  (emerging-botcc.rules)
 2404003 - ET DROP Known Bot C&C Server Traffic (group 4)  (emerging-botcc.rules)
 2404004 - ET DROP Known Bot C&C Server Traffic (group 5)  (emerging-botcc.rules)
 2404005 - ET DROP Known Bot C&C Server Traffic (group 6)  (emerging-botcc.rules)
 2404006 - ET DROP Known Bot C&C Server Traffic (group 7)  (emerging-botcc.rules)
 2404007 - ET DROP Known Bot C&C Server Traffic (group 8)  (emerging-botcc.rules)
 2404008 - ET DROP Known Bot C&C Server Traffic (group 9)  (emerging-botcc.rules)
 2404009 - ET DROP Known Bot C&C Server Traffic (group 10)  (emerging-botcc.rules)
 2404010 - ET DROP Known Bot C&C Server Traffic (group 11)  (emerging-botcc.rules)
 2404011 - ET DROP Known Bot C&C Server Traffic (group 12)  (emerging-botcc.rules)
 2404012 - ET DROP Known Bot C&C Server Traffic (group 13)  (emerging-botcc.rules)
 2404013 - ET DROP Known Bot C&C Server Traffic (group 14)  (emerging-botcc.rules)
 2404014 - ET DROP Known Bot C&C Server Traffic (group 15)  (emerging-botcc.rules)
 2404015 - ET DROP Known Bot C&C Server Traffic (group 16)  (emerging-botcc.rules)
 2404016 - ET DROP Known Bot C&C Server Traffic (group 17)  (emerging-botcc.rules)
 2404017 - ET DROP Known Bot C&C Server Traffic (group 18)  (emerging-botcc.rules)
 2404018 - ET DROP Known Bot C&C Server Traffic (group 19)  (emerging-botcc.rules)
 2404019 - ET DROP Known Bot C&C Server Traffic (group 20)  (emerging-botcc.rules)
 2405000 - ET DROP Known Bot C&C Traffic (group 1) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405001 - ET DROP Known Bot C&C Traffic (group 2) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405002 - ET DROP Known Bot C&C Traffic (group 3) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405003 - ET DROP Known Bot C&C Traffic (group 4) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405004 - ET DROP Known Bot C&C Traffic (group 5) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405005 - ET DROP Known Bot C&C Traffic (group 6) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405006 - ET DROP Known Bot C&C Traffic (group 7) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405007 - ET DROP Known Bot C&C Traffic (group 8) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405008 - ET DROP Known Bot C&C Traffic (group 9) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405009 - ET DROP Known Bot C&C Traffic (group 10) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405010 - ET DROP Known Bot C&C Traffic (group 11) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405011 - ET DROP Known Bot C&C Traffic (group 12) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405012 - ET DROP Known Bot C&C Traffic (group 13) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405013 - ET DROP Known Bot C&C Traffic (group 14) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405014 - ET DROP Known Bot C&C Traffic (group 15) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405015 - ET DROP Known Bot C&C Traffic (group 16) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405016 - ET DROP Known Bot C&C Traffic (group 17) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405017 - ET DROP Known Bot C&C Traffic (group 18) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405018 - ET DROP Known Bot C&C Traffic (group 19) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405019 - ET DROP Known Bot C&C Traffic (group 20) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-attack_response.rules (1):
        #matt jonkman, info from qru

     -> Added to emerging-drop-BLOCK.rules (2):
        #  VERSION 1302
        #  Generated 2008-09-20 00:03:02 EDT

     -> Added to emerging-drop.rules (2):
        #  VERSION 1302
        #  Generated 2008-09-20 00:03:02 EDT

     -> Added to emerging-policy.rules (1):
        # sets a flowbit for viruscatch.co.kr related, win32.small.hvd and others

     -> Added to emerging-sid-msg.map (28):
        2008549 || ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (AntivirXP) || url,www.wiki-security.com/wiki/Parasite/Antivirus2008
        2008551 || ET TROJAN Banito/Agent.pb Pass Stealer Email Report Outbound
        2008552 || ET CURRENT_EVENTS Malware Word doc Email - Fordo Trojan Likely || url,isc.sans.org/diary.html?storyid=5029 || url,www.virustotal.com/analisis/0fc3a70eff0b9ec447794acbda2402e7
        2008553 || ET WEB WordPress Random Password Generation Insufficient Entropy Attack || url,downloads.securityfocus.com/vulnerabilities/exploits/31115.php || bugtraq,31115
        2008554 || ET CURRENT_EVENTS Nuclear Email Malware Inbound - Likely Trojan || url,www.computerweekly.com/Articles/2008/09/12/232290/london-nuclear-explosion-in-malware-spam-campaign.htm || url,www.sophos.com/blogs/gc/g/2008/09/11/nuclear-email
        2008555 || ET CURRENT_EVENTS Your internet access is going to get suspended Email Inbound - Likely Trojan || url,forum.bitdefender.com/index.php?showtopic=7861 || url,blog.threatfire.com/2008/09/your-internet-access-is-going-to-get.html || url,blog.mxlab.be/2008/09/11/your-internet-access-is-going-to-get-suspended-virus/ || url,www.sophos.com/blogs/gc/g/2008/09/12/your-internet-access
        2008556 || ET ATTACK_RESPONSE FTP CWD to windows system32 - Suspicious
        2008557 || ET TROJAN Likely EXE Cryptor Packed Binary - Likely Malware || url,bits.packetninjas.org
        2008558 || ET MALWARE iwin.com Games/Spyware User-Agent (iWin GameInfo Installer Helper)
        2008559 || ET ATTACK_RESPONSE Windows LMHosts File Download - Likely DNSChanger Infection
        2008560 || ET SCAN NNG MS02-039 Exploit False Positive Generator - May Conceal A Genuine Attack || url,packetstormsecurity.nl/filedesc/nng-4.13r-public.rar.html
        2008561 || ET POLICY External Unencrypted Connection To Aanval Console || url,www.aanval.com
        2008562 || ET Suspicious SMTP handshake outbound
        2008563 || ET Suspicious SMTP handshake reply
        2008564 || ET MALWARE Suspicious User-Agent (Internet HTTP Request)
        2008565 || ET MALWARE Macrovision.com Spyware Related User-Agent (Macrovision_DM_2.19)
        2008567 || ET TROJAN Win32.Crypt.nc Checkin
        2008568 || ET SCAN Voiper Toolkit Torturer Scan || url,sourceforge.net/projects/voiper
        2008569 || ET POLICY External Unencrypted Connection to Ossec WUI || url,www.ossec.net
        2008570 || ET POLICY External Unencrypted Connection to BASE Console || url,base.secureideas.net
        2008571 || ET SCAN Acunetix Web Vulnerability Scan || url,www.acunetix.com/vulnerability-scanner/
        2008572 || ET POLICY External MYSQL Server Connection
        2008573 || ET TROJAN Viruscatch.co.kr/Win32.Small.hvd Mysql Command and Control Connection (user viruscatch)
        2008574 || ET MALWARE AutoIt User-Agent Detected - Often used by Malware (AutoIt) || url,www.autoitscript.com/autoit3
        2008575 || ET TROJAN ASProtect/ASPack Packed Binary - Likely Hostile || url,bits.packetninjas.org/eblog/ || url,www.aspack.com/downloads.aspx
        2008576 || ET TROJAN TinyPE Binary - Possibly Hostile || url,bits.packetninjas.org/eblog/?p=316 || url,www.phreedom.org/solar/code/tinype/
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org

     -> Added to emerging-sid-msg.map.txt (28):
        2008549 || ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (AntivirXP) || url,www.wiki-security.com/wiki/Parasite/Antivirus2008
        2008551 || ET TROJAN Banito/Agent.pb Pass Stealer Email Report Outbound
        2008552 || ET CURRENT_EVENTS Malware Word doc Email - Fordo Trojan Likely || url,isc.sans.org/diary.html?storyid=5029 || url,www.virustotal.com/analisis/0fc3a70eff0b9ec447794acbda2402e7
        2008553 || ET WEB WordPress Random Password Generation Insufficient Entropy Attack || url,downloads.securityfocus.com/vulnerabilities/exploits/31115.php || bugtraq,31115
        2008554 || ET CURRENT_EVENTS Nuclear Email Malware Inbound - Likely Trojan || url,www.computerweekly.com/Articles/2008/09/12/232290/london-nuclear-explosion-in-malware-spam-campaign.htm || url,www.sophos.com/blogs/gc/g/2008/09/11/nuclear-email
        2008555 || ET CURRENT_EVENTS Your internet access is going to get suspended Email Inbound - Likely Trojan || url,forum.bitdefender.com/index.php?showtopic=7861 || url,blog.threatfire.com/2008/09/your-internet-access-is-going-to-get.html || url,blog.mxlab.be/2008/09/11/your-internet-access-is-going-to-get-suspended-virus/ || url,www.sophos.com/blogs/gc/g/2008/09/12/your-internet-access
        2008556 || ET ATTACK_RESPONSE FTP CWD to windows system32 - Suspicious
        2008557 || ET TROJAN Likely EXE Cryptor Packed Binary - Likely Malware || url,bits.packetninjas.org
        2008558 || ET MALWARE iwin.com Games/Spyware User-Agent (iWin GameInfo Installer Helper)
        2008559 || ET ATTACK_RESPONSE Windows LMHosts File Download - Likely DNSChanger Infection
        2008560 || ET SCAN NNG MS02-039 Exploit False Positive Generator - May Conceal A Genuine Attack || url,packetstormsecurity.nl/filedesc/nng-4.13r-public.rar.html
        2008561 || ET POLICY External Unencrypted Connection To Aanval Console || url,www.aanval.com
        2008562 || ET Suspicious SMTP handshake outbound
        2008563 || ET Suspicious SMTP handshake reply
        2008564 || ET MALWARE Suspicious User-Agent (Internet HTTP Request)
        2008565 || ET MALWARE Macrovision.com Spyware Related User-Agent (Macrovision_DM_2.19)
        2008567 || ET TROJAN Win32.Crypt.nc Checkin
        2008568 || ET SCAN Voiper Toolkit Torturer Scan || url,sourceforge.net/projects/voiper
        2008569 || ET POLICY External Unencrypted Connection to Ossec WUI || url,www.ossec.net
        2008570 || ET POLICY External Unencrypted Connection to BASE Console || url,base.secureideas.net
        2008571 || ET SCAN Acunetix Web Vulnerability Scan || url,www.acunetix.com/vulnerability-scanner/
        2008572 || ET POLICY External MYSQL Server Connection
        2008573 || ET TROJAN Viruscatch.co.kr/Win32.Small.hvd Mysql Command and Control Connection (user viruscatch)
        2008574 || ET MALWARE AutoIt User-Agent Detected - Often used by Malware (AutoIt) || url,www.autoitscript.com/autoit3
        2008575 || ET TROJAN ASProtect/ASPack Packed Binary - Likely Hostile || url,bits.packetninjas.org/eblog/ || url,www.aspack.com/downloads.aspx
        2008576 || ET TROJAN TinyPE Binary - Possibly Hostile || url,bits.packetninjas.org/eblog/?p=316 || url,www.phreedom.org/solar/code/tinype/
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org

     -> Added to emerging-virus.rules (2):
        #by Jeffrey Brown, re 35546d9972aed2a5fec2c4e1136730a3
        #flowbit set by 2008572 in policy ruleset

     -> Added to emerging-web.rules (2):
        #by Chandan at secpod
        # 15/09/2008 Wordpress

     -> Added to emerging.rules (6):
        #by Veerendra at secpod.org
        # 16/09/2008 Nuclear Email Malware Attack
        # 16/09/2008 Internet Trojan
        #by Chandan at secpod
        # 15/09/2008 Malware Word doc
        # Unknown handshake over SMTP discovered by Thierry Chich and reported on mail list. Added by Frank Knobbe 2008-09-17.

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-drop-BLOCK.rules (2):
        #  VERSION 1295
        #  Generated 2008-09-13 00:03:02 EDT

     -> Removed from emerging-drop.rules (2):
        #  VERSION 1295
        #  Generated 2008-09-13 00:03:02 EDT

     -> Removed from emerging-sid-msg.map (1):
        2008549 || ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (AntivirXP)

     -> Removed from emerging-sid-msg.map.txt (1):
        2008549 || ET MALWARE Systemdoctor.com/Antivir2008 related Fake Anti-Virus User-Agent (AntivirXP)


From jonkman at jonkmans.com  Sun Sep 21 13:22:43 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Sun, 21 Sep 2008 13:22:43 -0400
Subject: [Emerging-Sigs] SIPVicious
Message-ID: <48D682E3.4030402@jonkmans.com>

Another good voip scanner sig from Kevin Ross:

#by Kevin Ross
alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET SCAN Sipvicious
Scan"; content:"Via\: SIP/2.0/UDP"; content:"sipvicious"; offset:40;
depth:60; distance:40; classtype:attempted-recon;
reference:url,sipvicious.org/blog/; sid:2008575; rev:1;)

Matt

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From jonkman at jonkmans.com  Sun Sep 21 13:38:39 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Sun, 21 Sep 2008 13:38:39 -0400
Subject: [Emerging-Sigs] Microsoft BITS Sig
In-Reply-To: <48D3B1B1.2070005@jonkmans.com>
References: <48D3B1B1.2070005@jonkmans.com>
Message-ID: <48D6869F.1010906@jonkmans.com>

Haven't had as many reports of other BITS using legitimate sites as I
expected. Anyone else that's tested it seen hits on more than:

"Autobahn" software to "swarmcast.net".
"PDFcomplete" enterprise sfw to "pdfcomplete.com"

Matt

Matt Jonkman wrote:
> Cees and Bojan have sent in a sig related to Bojan's ISC entry of yesterday:
> 
> http://isc.sans.org/diary.html?storyid=5054
> 
> Related to the numbers of malware using the MS BITS download tools, or
> at least their user-agent string, to avoid detection. Indeed we've seen
> this technique in samples in the sandnet for a long time now, thousands
> of instances.
> 
> But before we post this sig to the main ruleset I'd like to ask a few
> sites to run it for 24 hours and let us know about any other sites we
> should whitelist. Here's the sig so far:
> 
> alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Microsoft
> BIT's User-Agent to an unknown domain - Likely Malware";
> flow:established,to_server; content:"|0d 0a|User-Agent\: Microsoft
> BITS"; content:!"|0d 0a|Host\: au.download.windowsupdate.com";
> content:!"|0d 0a|Host\: cache.pack.google.com"; content:!"|0d 0a|Host\:
> origin.onecare.live.com"; content:!"|0d 0a|Host\: dl.google.com";
> content:"|0d 0a|Host\:"; content:!"sun.com"; within:20;
> classtype:trojan-activity; sid:2008566; rev:1;)
> 
> Can a few folks give this a whirl to test the whitelisting?
> 
> Thanks!!
> 
> Matt
> 

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Sun Sep 21 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Sun, 21 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080921200008.123EF45026@goliath.jonkmans.com>


[***] Results from Oinkmaster started Sun Sep 21 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008575 - ET TROJAN ASProtect/ASPack Packed Binary - Likely Hostile (emerging-virus.rules)
 2008576 - ET TROJAN TinyPE Binary - Possibly Hostile (emerging-virus.rules)
 2008577 - ET SCAN Voiper Fuzzing Scan (emerging-scan.rules)
 2008578 - ET SCAN Sipvicious Scan (emerging-scan.rules)


[///]     Modified active rules:     [///]

 2008571 - ET SCAN Acunetix Web Vulnerability Scan (emerging-scan.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-sid-msg.map (4):
        2008575 || ET TROJAN ASProtect/ASPack Packed Binary - Likely Hostile || url,bits.packetninjas.org/eblog/ || url,www.aspack.com/downloads.aspx
        2008576 || ET TROJAN TinyPE Binary - Possibly Hostile || url,bits.packetninjas.org/eblog/?p=316 || url,www.phreedom.org/solar/code/tinype/
        2008577 || ET SCAN Voiper Fuzzing Scan || url,sourceforge.net/projects/voiper
        2008578 || ET SCAN Sipvicious Scan || url,sipvicious.org/blog/

     -> Added to emerging-sid-msg.map.txt (4):
        2008575 || ET TROJAN ASProtect/ASPack Packed Binary - Likely Hostile || url,bits.packetninjas.org/eblog/ || url,www.aspack.com/downloads.aspx
        2008576 || ET TROJAN TinyPE Binary - Possibly Hostile || url,bits.packetninjas.org/eblog/?p=316 || url,www.phreedom.org/solar/code/tinype/
        2008577 || ET SCAN Voiper Fuzzing Scan || url,sourceforge.net/projects/voiper
        2008578 || ET SCAN Sipvicious Scan || url,sipvicious.org/blog/


From jonkman at jonkmans.com  Sun Sep 21 17:52:42 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Sun, 21 Sep 2008 17:52:42 -0400
Subject: [Emerging-Sigs] Atrivo Offline!!
Message-ID: <48D6C22A.8030801@jonkmans.com>

Atrivo, everyone's favorite source for malware, fake antivirus, spam and
botnet controllers, is OFFLINE!!

Great news for sure! A very positive routing report is available here:

http://cidr-report.org/cgi-bin/as-report?as=AS27595

I think I'll print and frame that one... and go have a beer to celebrate!

Related stories:
http://www.emergingthreats.net/content/view/101/9/
http://www.emergingthreats.net/content/view/103/9/
http://www.emergingthreats.net/content/view/105/9/


Matt

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Mon Sep 22 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Mon, 22 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080922200008.C580C45044@goliath.jonkmans.com>


[***] Results from Oinkmaster started Mon Sep 22 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008579 - ET SCAN Sipp SIP Stress Test Detected (emerging-scan.rules)
 2008580 - ET TROJAN Trojan Sinowal Phoning Home (emerging-virus.rules)


[///]     Modified active rules:     [///]

 2003484 - ET WORM Allaple Unique HTTP Request - Possibly part of DDOS (emerging-virus.rules)
 2008576 - ET TROJAN TinyPE Binary - Possibly Hostile (emerging-virus.rules)
 2406000 - ET RBN Known Russian Business Network Monitored Domains (1) (emerging-rbn.rules)
 2406001 - ET RBN Known Russian Business Network Monitored Domains (2) (emerging-rbn.rules)
 2406002 - ET RBN Known Russian Business Network Monitored Domains (3) (emerging-rbn.rules)
 2406003 - ET RBN Known Russian Business Network Monitored Domains (4) (emerging-rbn.rules)
 2406004 - ET RBN Known Russian Business Network Monitored Domains (5) (emerging-rbn.rules)
 2406005 - ET RBN Known Russian Business Network Monitored Domains (6) (emerging-rbn.rules)
 2406006 - ET RBN Known Russian Business Network Monitored Domains (7) (emerging-rbn.rules)
 2406007 - ET RBN Known Russian Business Network Monitored Domains (8) (emerging-rbn.rules)
 2406008 - ET RBN Known Russian Business Network Monitored Domains (9) (emerging-rbn.rules)
 2406009 - ET RBN Known Russian Business Network Monitored Domains (10) (emerging-rbn.rules)
 2406010 - ET RBN Known Russian Business Network Monitored Domains (11) (emerging-rbn.rules)
 2406011 - ET RBN Known Russian Business Network Monitored Domains (12) (emerging-rbn.rules)
 2406012 - ET RBN Known Russian Business Network Monitored Domains (13) (emerging-rbn.rules)
 2406013 - ET RBN Known Russian Business Network Monitored Domains (14) (emerging-rbn.rules)
 2406014 - ET RBN Known Russian Business Network Monitored Domains (15) (emerging-rbn.rules)
 2406015 - ET RBN Known Russian Business Network Monitored Domains (16) (emerging-rbn.rules)
 2406016 - ET RBN Known Russian Business Network Monitored Domains (17) (emerging-rbn.rules)
 2406017 - ET RBN Known Russian Business Network Monitored Domains (18) (emerging-rbn.rules)
 2406018 - ET RBN Known Russian Business Network Monitored Domains (19) (emerging-rbn.rules)
 2406019 - ET RBN Known Russian Business Network Monitored Domains (20) (emerging-rbn.rules)
 2407000 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (1) (emerging-rbn-BLOCK.rules)
 2407001 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (2) (emerging-rbn-BLOCK.rules)
 2407002 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (3) (emerging-rbn-BLOCK.rules)
 2407003 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (4) (emerging-rbn-BLOCK.rules)
 2407004 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (5) (emerging-rbn-BLOCK.rules)
 2407005 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (6) (emerging-rbn-BLOCK.rules)
 2407006 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (7) (emerging-rbn-BLOCK.rules)
 2407007 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (8) (emerging-rbn-BLOCK.rules)
 2407008 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (9) (emerging-rbn-BLOCK.rules)
 2407009 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (10) (emerging-rbn-BLOCK.rules)
 2407010 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (11) (emerging-rbn-BLOCK.rules)
 2407011 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (12) (emerging-rbn-BLOCK.rules)
 2407012 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (13) (emerging-rbn-BLOCK.rules)
 2407013 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (14) (emerging-rbn-BLOCK.rules)
 2407014 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (15) (emerging-rbn-BLOCK.rules)
 2407015 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) (emerging-rbn-BLOCK.rules)
 2407016 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) (emerging-rbn-BLOCK.rules)
 2407017 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) (emerging-rbn-BLOCK.rules)
 2407018 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) (emerging-rbn-BLOCK.rules)
 2407019 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) (emerging-rbn-BLOCK.rules)


[---]         Removed rules:         [---]

 2002969 - ET POLICY Microsoft BITS User Agent (emerging-policy.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-rbn-BLOCK.rules (2):
        #  VERSION 61
        #  Updated 2008-09-21 13:52:54

     -> Added to emerging-rbn.rules (2):
        #  VERSION 61
        #  Updated 2008-09-21 13:52:54

     -> Added to emerging-sid-msg.map (3):
        2003484 || ET WORM Allaple Unique HTTP Request - Possibly part of DDOS || url,isc.sans.org/diary.html?storyid=2451 || url,doc.emergingthreats.net/2003484
        2008579 || ET SCAN Sipp SIP Stress Test Detected || url,sourceforge.net/projects/sipp/
        2008580 || ET TROJAN Trojan Sinowal Phoning Home

     -> Added to emerging-sid-msg.map.txt (3):
        2003484 || ET WORM Allaple Unique HTTP Request - Possibly part of DDOS || url,isc.sans.org/diary.html?storyid=2451 || url,doc.emergingthreats.net/2003484
        2008579 || ET SCAN Sipp SIP Stress Test Detected || url,sourceforge.net/projects/sipp/
        2008580 || ET TROJAN Trojan Sinowal Phoning Home

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-policy.rules (2):
        #Microsoft BITS (Background Intelligent Transfer Agent) user agent sig
        #Thresholded like the Windows-User-Agent user agent sig (after suggestion from Eduardo)

     -> Removed from emerging-rbn-BLOCK.rules (2):
        #  VERSION 60
        #  Updated 2008-09-09 12:41:40

     -> Removed from emerging-rbn.rules (2):
        #  VERSION 60
        #  Updated 2008-09-09 12:41:40

     -> Removed from emerging-sid-msg.map (2):
        2002969 || ET POLICY Microsoft BITS User Agent || url,au.download.windowsupdate.com
        2003484 || ET WORM Allaple Unique HTTP Request - Possibly part of DDOS || url,isc.sans.org/diary.html?storyid=2451 || url,doc.emergingthreats.net/2003483

     -> Removed from emerging-sid-msg.map.txt (2):
        2002969 || ET POLICY Microsoft BITS User Agent || url,au.download.windowsupdate.com
        2003484 || ET WORM Allaple Unique HTTP Request - Possibly part of DDOS || url,isc.sans.org/diary.html?storyid=2451 || url,doc.emergingthreats.net/2003483


From david at vorant.com  Mon Sep 22 11:55:15 2008
From: david at vorant.com (David J. Bianco)
Date: Mon, 22 Sep 2008 11:55:15 -0400
Subject: [Emerging-Sigs] BitTorrent DHT "trackerless" torrent signatures
Message-ID: <48D7BFE3.1000003@vorant.com>

I noticed last week that the existing BitTorrent rules weren't picking up a
lot of the so-called "trackerless" torrent activity, so I wrote up a few new
rules that should be good for that.

In case you're not familiar with the concept of DHT and "trackerless"
torrents, check out the URL listed in the reference: section.  That explains
things pretty clearly.

	David

alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT ping
request"; content:"d1:ad2:id20:"; nocase; depth:12; content:"e1:q4:ping1:";
nocase; distance:20; depth:12; nocase;   threshold: type both, count 1,
seconds 300, track by_src; classtype:policy-violation;
reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000000; rev:1;)


alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT
find_node request"; content:"d1:ad2:id20:"; nocase; depth:12;
content:"6:target20:"; nocase; distance:20; depth:11;
content:"e1:q9:find_node1:"; distance:20; depth:17; nocase;   threshold: type
both, count 1, seconds 300, track by_src; classtype:policy-violation;
reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000001; rev:1;)

alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT nodes
reply"; content:"d1:rd2:id20:"; nocase; depth:12; content:"5:nodes"; nocase;
distance:20; depth:7;  threshold: type both, count 1, seconds 300, track
by_src; classtype:policy-violation;
reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000002; rev:1;)

alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT
get_peers request"; content:"d1:ad2:id20:"; nocase; depth:12;
content:"9:info_hash20:"; nocase; distance:20; depth:14;
content:"e1:q9:get_peers1:"; nocase; distance:20; depth:17; threshold: type
both, count 1, seconds 300, track by_src; classtype:policy-violation;
reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000003; rev:1;)

alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT
announce_peers request"; content:"d1:ad2:id20:"; nocase; depth:12;
content:"9:info_hash20:"; nocase; distance:20; depth:14;
content:"e1:q13:announce_peer1:"; nocase; distance:55; threshold: type both,
count 1, seconds 300, track by_src; classtype:policy-violation;
reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000004; rev:1;)


From david.glosser at gmail.com  Mon Sep 22 23:19:02 2008
From: david.glosser at gmail.com (David Glosser)
Date: Mon, 22 Sep 2008 23:19:02 -0400
Subject: [Emerging-Sigs] PHAS
Message-ID: <ac597e6e0809222019n1236725bv1dee514d6777a653@mail.gmail.com>

Read about this on the nanog mailing list..

http://www.cs.ucla.edu/~mohit/cameraReady/ladSecurity06.pdf

Prefix Hijack Alert System.

Could any sigs come from this?

From jonkman at jonkmans.com  Tue Sep 23 08:57:58 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Tue, 23 Sep 2008 08:57:58 -0400
Subject: [Emerging-Sigs] PHAS
In-Reply-To: <ac597e6e0809222019n1236725bv1dee514d6777a653@mail.gmail.com>
References: <ac597e6e0809222019n1236725bv1dee514d6777a653@mail.gmail.com>
Message-ID: <48D8E7D6.4060001@jonkmans.com>

Good paper, very interesting way to solve the problem. Not sure how we
could sig it though. We could monitor bgp traffic, but we don't have a
reliable way in snort I don't think to identify if there's a duplicate
announcement, or a bad route.

Anyone else have ideas? Good paper, worth the read.

Matt

David Glosser wrote:
> Read about this on the nanog mailing list..
> 
> http://www.cs.ucla.edu/~mohit/cameraReady/ladSecurity06.pdf
> 
> Prefix Hijack Alert System.
> 
> Could any sigs come from this?
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From jonkman at jonkmans.com  Tue Sep 23 09:00:04 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Tue, 23 Sep 2008 09:00:04 -0400
Subject: [Emerging-Sigs] BitTorrent DHT "trackerless" torrent signatures
In-Reply-To: <48D7BFE3.1000003@vorant.com>
References: <48D7BFE3.1000003@vorant.com>
Message-ID: <48D8E854.5000706@jonkmans.com>

Very nice David! Great sigs. I'll get them posted momentarily.

Are you seeing a lot of trackerless stuff, or just the beginnings of a
change?

Matt

David J. Bianco wrote:
> I noticed last week that the existing BitTorrent rules weren't picking up a
> lot of the so-called "trackerless" torrent activity, so I wrote up a few new
> rules that should be good for that.
> 
> In case you're not familiar with the concept of DHT and "trackerless"
> torrents, check out the URL listed in the reference: section.  That explains
> things pretty clearly.
> 
> 	David
> 
> alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT ping
> request"; content:"d1:ad2:id20:"; nocase; depth:12; content:"e1:q4:ping1:";
> nocase; distance:20; depth:12; nocase;   threshold: type both, count 1,
> seconds 300, track by_src; classtype:policy-violation;
> reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000000; rev:1;)
> 
> 
> alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT
> find_node request"; content:"d1:ad2:id20:"; nocase; depth:12;
> content:"6:target20:"; nocase; distance:20; depth:11;
> content:"e1:q9:find_node1:"; distance:20; depth:17; nocase;   threshold: type
> both, count 1, seconds 300, track by_src; classtype:policy-violation;
> reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000001; rev:1;)
> 
> alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT nodes
> reply"; content:"d1:rd2:id20:"; nocase; depth:12; content:"5:nodes"; nocase;
> distance:20; depth:7;  threshold: type both, count 1, seconds 300, track
> by_src; classtype:policy-violation;
> reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000002; rev:1;)
> 
> alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT
> get_peers request"; content:"d1:ad2:id20:"; nocase; depth:12;
> content:"9:info_hash20:"; nocase; distance:20; depth:14;
> content:"e1:q9:get_peers1:"; nocase; distance:20; depth:17; threshold: type
> both, count 1, seconds 300, track by_src; classtype:policy-violation;
> reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000003; rev:1;)
> 
> alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT
> announce_peers request"; content:"d1:ad2:id20:"; nocase; depth:12;
> content:"9:info_hash20:"; nocase; distance:20; depth:14;
> content:"e1:q13:announce_peer1:"; nocase; distance:55; threshold: type both,
> count 1, seconds 300, track by_src; classtype:policy-violation;
> reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000004; rev:1;)
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From campesic at centenarycollege.edu  Tue Sep 23 09:54:46 2008
From: campesic at centenarycollege.edu (Campesi, Christopher)
Date: Tue, 23 Sep 2008 09:54:46 -0400
Subject: [Emerging-Sigs] BitTorrent DHT "trackerless" torrent signatures
In-Reply-To: <48D8E854.5000706@jonkmans.com>
References: <48D7BFE3.1000003@vorant.com> <48D8E854.5000706@jonkmans.com>
Message-ID: <54125DA6FB3A3249B874A94D39E9E6D90353D847@BENDER.centenarycollege.edu>

Nice sigs. I noticed the same thing happening and created similar rules
to yours

I do have a lot of hits on the ping request sig.

Chris


-----Original Message-----
From: emerging-sigs-bounces at emergingthreats.net
[mailto:emerging-sigs-bounces at emergingthreats.net] On Behalf Of Matt
Jonkman
Sent: Tuesday, September 23, 2008 9:00 AM
To: David J. Bianco
Cc: 'Emerging Threats Signatures'
Subject: Re: [Emerging-Sigs] BitTorrent DHT "trackerless" torrent
signatures

Very nice David! Great sigs. I'll get them posted momentarily.

Are you seeing a lot of trackerless stuff, or just the beginnings of a
change?

Matt

David J. Bianco wrote:
> I noticed last week that the existing BitTorrent rules weren't picking
up a
> lot of the so-called "trackerless" torrent activity, so I wrote up a
few new
> rules that should be good for that.
> 
> In case you're not familiar with the concept of DHT and "trackerless"
> torrents, check out the URL listed in the reference: section.  That
explains
> things pretty clearly.
> 
> 	David
> 
> alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT
ping
> request"; content:"d1:ad2:id20:"; nocase; depth:12;
content:"e1:q4:ping1:";
> nocase; distance:20; depth:12; nocase;   threshold: type both, count
1,
> seconds 300, track by_src; classtype:policy-violation;
> reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000000;
rev:1;)
> 
> 
> alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT
> find_node request"; content:"d1:ad2:id20:"; nocase; depth:12;
> content:"6:target20:"; nocase; distance:20; depth:11;
> content:"e1:q9:find_node1:"; distance:20; depth:17; nocase;
threshold: type
> both, count 1, seconds 300, track by_src; classtype:policy-violation;
> reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000001;
rev:1;)
> 
> alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT
nodes
> reply"; content:"d1:rd2:id20:"; nocase; depth:12; content:"5:nodes";
nocase;
> distance:20; depth:7;  threshold: type both, count 1, seconds 300,
track
> by_src; classtype:policy-violation;
> reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000002;
rev:1;)
> 
> alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT
> get_peers request"; content:"d1:ad2:id20:"; nocase; depth:12;
> content:"9:info_hash20:"; nocase; distance:20; depth:14;
> content:"e1:q9:get_peers1:"; nocase; distance:20; depth:17; threshold:
type
> both, count 1, seconds 300, track by_src; classtype:policy-violation;
> reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000003;
rev:1;)
> 
> alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT
> announce_peers request"; content:"d1:ad2:id20:"; nocase; depth:12;
> content:"9:info_hash20:"; nocase; distance:20; depth:14;
> content:"e1:q13:announce_peer1:"; nocase; distance:55; threshold: type
both,
> count 1, seconds 300, track by_src; classtype:policy-violation;
> reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000004;
rev:1;)
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc


_______________________________________________
Emerging-sigs mailing list
Emerging-sigs at emergingthreats.net
http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

From jlewis at packetnexus.com  Tue Sep 23 09:59:47 2008
From: jlewis at packetnexus.com (Jason Lewis)
Date: Tue, 23 Sep 2008 09:59:47 -0400
Subject: [Emerging-Sigs] Rule source question
Message-ID: <48D8F653.6040000@packetnexus.com>

The PHAS paper got me thinking about other data sources for sigs.  I
read about the dronebl (http://www.dronebl.org/), because it was
mentioned on NANOG.  Lists like that seem like they would be perfect for
drop or block rules for those that might manage their networks more
aggressively.  Do blocklists and whitelists like that have a place at
emerging threats?


jas

From jonkman at jonkmans.com  Tue Sep 23 11:04:10 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Tue, 23 Sep 2008 11:04:10 -0400
Subject: [Emerging-Sigs] BitTorrent DHT "trackerless" torrent signatures
In-Reply-To: <54125DA6FB3A3249B874A94D39E9E6D90353D847@BENDER.centenarycollege.edu>
References: <48D7BFE3.1000003@vorant.com> <48D8E854.5000706@jonkmans.com>
	<54125DA6FB3A3249B874A94D39E9E6D90353D847@BENDER.centenarycollege.edu>
Message-ID: <48D9056A.2050308@jonkmans.com>

Any improvements from yours to add to these?

Matt

Campesi, Christopher wrote:
> Nice sigs. I noticed the same thing happening and created similar rules
> to yours
> 
> I do have a lot of hits on the ping request sig.
> 
> Chris
> 
> 
> -----Original Message-----
> From: emerging-sigs-bounces at emergingthreats.net
> [mailto:emerging-sigs-bounces at emergingthreats.net] On Behalf Of Matt
> Jonkman
> Sent: Tuesday, September 23, 2008 9:00 AM
> To: David J. Bianco
> Cc: 'Emerging Threats Signatures'
> Subject: Re: [Emerging-Sigs] BitTorrent DHT "trackerless" torrent
> signatures
> 
> Very nice David! Great sigs. I'll get them posted momentarily.
> 
> Are you seeing a lot of trackerless stuff, or just the beginnings of a
> change?
> 
> Matt
> 
> David J. Bianco wrote:
>> I noticed last week that the existing BitTorrent rules weren't picking
> up a
>> lot of the so-called "trackerless" torrent activity, so I wrote up a
> few new
>> rules that should be good for that.
>>
>> In case you're not familiar with the concept of DHT and "trackerless"
>> torrents, check out the URL listed in the reference: section.  That
> explains
>> things pretty clearly.
>>
>> 	David
>>
>> alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT
> ping
>> request"; content:"d1:ad2:id20:"; nocase; depth:12;
> content:"e1:q4:ping1:";
>> nocase; distance:20; depth:12; nocase;   threshold: type both, count
> 1,
>> seconds 300, track by_src; classtype:policy-violation;
>> reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000000;
> rev:1;)
>>
>> alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT
>> find_node request"; content:"d1:ad2:id20:"; nocase; depth:12;
>> content:"6:target20:"; nocase; distance:20; depth:11;
>> content:"e1:q9:find_node1:"; distance:20; depth:17; nocase;
> threshold: type
>> both, count 1, seconds 300, track by_src; classtype:policy-violation;
>> reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000001;
> rev:1;)
>> alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT
> nodes
>> reply"; content:"d1:rd2:id20:"; nocase; depth:12; content:"5:nodes";
> nocase;
>> distance:20; depth:7;  threshold: type both, count 1, seconds 300,
> track
>> by_src; classtype:policy-violation;
>> reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000002;
> rev:1;)
>> alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT
>> get_peers request"; content:"d1:ad2:id20:"; nocase; depth:12;
>> content:"9:info_hash20:"; nocase; distance:20; depth:14;
>> content:"e1:q9:get_peers1:"; nocase; distance:20; depth:17; threshold:
> type
>> both, count 1, seconds 300, track by_src; classtype:policy-violation;
>> reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000003;
> rev:1;)
>> alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"P2P BitTorrent DHT
>> announce_peers request"; content:"d1:ad2:id20:"; nocase; depth:12;
>> content:"9:info_hash20:"; nocase; distance:20; depth:14;
>> content:"e1:q13:announce_peer1:"; nocase; distance:55; threshold: type
> both,
>> count 1, seconds 300, track by_src; classtype:policy-violation;
>> reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; sid:4000004;
> rev:1;)
>> _______________________________________________
>> Emerging-sigs mailing list
>> Emerging-sigs at emergingthreats.net
>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
> 

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From jonkman at jonkmans.com  Tue Sep 23 11:11:31 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Tue, 23 Sep 2008 11:11:31 -0400
Subject: [Emerging-Sigs] Rule source question
In-Reply-To: <48D8F653.6040000@packetnexus.com>
References: <48D8F653.6040000@packetnexus.com>
Message-ID: <48D90723.5040803@jonkmans.com>

Absolutely there is. I was just looking into dronebl as well. I'll reach
out to the guys there and see what we could do to collaborate. At the
minimum we can contribute our sandnet data to them.

We do have a fwe other blacklist style lists. The Botnet CnC list, the
Dshield Top 20, the spamhaus DROP list, compromised hosts, etc. You can
see these in http://www.emergingthreats.net/rules/

For the top20 and the bot cnc I'd recommend at least twice a week
updates. Spamhaus is less dynamic. Compromised is where we dump lists of
the latest outbreak of the day. Used to have a lot of storm supernodes,
but it's gotten smaller lately.

Any other sources you all see out there let me know. We'll definitely
add anything good!

Matt

Jason Lewis wrote:
> The PHAS paper got me thinking about other data sources for sigs.  I
> read about the dronebl (http://www.dronebl.org/), because it was
> mentioned on NANOG.  Lists like that seem like they would be perfect for
> drop or block rules for those that might manage their networks more
> aggressively.  Do blocklists and whitelists like that have a place at
> emerging threats?
> 
> 
> jas
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From david at vorant.com  Tue Sep 23 11:24:35 2008
From: david at vorant.com (David J. Bianco)
Date: Tue, 23 Sep 2008 11:24:35 -0400
Subject: [Emerging-Sigs] BitTorrent DHT "trackerless" torrent signatures
In-Reply-To: <48D8E854.5000706@jonkmans.com>
References: <48D7BFE3.1000003@vorant.com> <48D8E854.5000706@jonkmans.com>
Message-ID: <48D90A33.9020705@vorant.com>

Matt Jonkman wrote:
> Very nice David! Great sigs. I'll get them posted momentarily.
> 
> Are you seeing a lot of trackerless stuff, or just the beginnings of a
> change?
> 

Actually, the DHT stuff has been around for quite a while.  We've been
tracking regular BitTorrent for a while, but I recently happened to notice
some DHT protocol torrents while I was chasing down something else.  I
don't really have any data to answer your question, but I can say that I'm
seeing some right now, but not a whole lot.

	David

From jlewis at packetnexus.com  Tue Sep 23 11:29:59 2008
From: jlewis at packetnexus.com (Jason Lewis)
Date: Tue, 23 Sep 2008 11:29:59 -0400
Subject: [Emerging-Sigs] Rule source question
In-Reply-To: <48D90723.5040803@jonkmans.com>
References: <48D8F653.6040000@packetnexus.com> <48D90723.5040803@jonkmans.com>
Message-ID: <48D90B77.8090607@packetnexus.com>

Just to summarize things I've been looking at lately for me to
contribute to, as well as pull info from.

Applications that block hosts on your network and let you share the data
are interesting to me.  There is a trust issue and a possible attack
vector, but it's interesting data.

BruteForceBlocker:  http://danger.rulez.sk/index.php/bruteforceblocker/
Blocked IPs are here:
http://danger.rulez.sk/projects/bruteforceblocker/blist.php

DenyHosts is another, but I haven't seen a way to download the blocklist.

UCEProtect blocks IPs that send spam to spamtraps, depending on how many
hosts in a CIDR, they have a list that contains bad CIDRs and then
another list that has bad ASN.  http://www.uceprotect.net/en/index.php
Policy breakdown is here: http://www.uceprotect.net/en/index.php?m=3&s=0
Blacklists are here: http://wget-mirrors.uceprotect.net/

And on a side note... I'm interested in setting up a honeypot or two.  I
have bandwidth and IP space and would be willing to host a listening
post.  Is there a process for helping ET in that manner?  I'm interested
in collecting the data myself, but I figured I would share if there was
a need.

jas

Matt Jonkman wrote:
> Absolutely there is. I was just looking into dronebl as well. I'll reach
> out to the guys there and see what we could do to collaborate. At the
> minimum we can contribute our sandnet data to them.
>
> We do have a fwe other blacklist style lists. The Botnet CnC list, the
> Dshield Top 20, the spamhaus DROP list, compromised hosts, etc. You can
> see these in http://www.emergingthreats.net/rules/
>
> For the top20 and the bot cnc I'd recommend at least twice a week
> updates. Spamhaus is less dynamic. Compromised is where we dump lists of
> the latest outbreak of the day. Used to have a lot of storm supernodes,
> but it's gotten smaller lately.
>
> Any other sources you all see out there let me know. We'll definitely
> add anything good!
>
> Matt
>
> Jason Lewis wrote:
>   
>> The PHAS paper got me thinking about other data sources for sigs.  I
>> read about the dronebl (http://www.dronebl.org/), because it was
>> mentioned on NANOG.  Lists like that seem like they would be perfect for
>> drop or block rules for those that might manage their networks more
>> aggressively.  Do blocklists and whitelists like that have a place at
>> emerging threats?
>>
>>
>> jas
>> _______________________________________________
>> Emerging-sigs mailing list
>> Emerging-sigs at emergingthreats.net
>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>>     
>
>   


From david at vorant.com  Tue Sep 23 11:30:03 2008
From: david at vorant.com (David J. Bianco)
Date: Tue, 23 Sep 2008 11:30:03 -0400
Subject: [Emerging-Sigs] BitTorrent DHT "trackerless" torrent signatures
In-Reply-To: <54125DA6FB3A3249B874A94D39E9E6D90353D847@BENDER.centenarycollege.edu>
References: <48D7BFE3.1000003@vorant.com> <48D8E854.5000706@jonkmans.com>
	<54125DA6FB3A3249B874A94D39E9E6D90353D847@BENDER.centenarycollege.edu>
Message-ID: <48D90B7B.5040702@vorant.com>

Yeah, from reading the protocol description, I think "ping" is probably the
most common request by far, as your client has to ping all the other nodes
participating in the torrent on a regular basis.

I'm curious to know if your sigs were significantly different?  Did they
cover anything I missed?

	David

Campesi, Christopher wrote:
> Nice sigs. I noticed the same thing happening and created similar rules
> to yours
> 
> I do have a lot of hits on the ping request sig.
> 

From campesic at centenarycollege.edu  Tue Sep 23 11:37:14 2008
From: campesic at centenarycollege.edu (Campesi, Christopher)
Date: Tue, 23 Sep 2008 11:37:14 -0400
Subject: [Emerging-Sigs] BitTorrent DHT "trackerless" torrent signatures
In-Reply-To: <48D90B7B.5040702@vorant.com>
References: <48D7BFE3.1000003@vorant.com> <48D8E854.5000706@jonkmans.com>
	<54125DA6FB3A3249B874A94D39E9E6D90353D847@BENDER.centenarycollege.edu>
	<48D90B7B.5040702@vorant.com>
Message-ID: <54125DA6FB3A3249B874A94D39E9E6D90353D89E@BENDER.centenarycollege.edu>

Nope my rules weren't as granular as yours were. I just had the content
for ping1 in there but you added stuff that was at the beginning of the
packet and did offsets and what not.

I just rolled out your ping rule and got hits immediately, however I did
need to change the colon in the content match, I think those have to be
escaped? I just replaced : with |3a| instead

Chris


-----Original Message-----
From: David J. Bianco [mailto:david at vorant.com] 
Sent: Tuesday, September 23, 2008 11:30 AM
To: Campesi, Christopher
Cc: Emerging Threats Signatures
Subject: Re: [Emerging-Sigs] BitTorrent DHT "trackerless" torrent
signatures

Yeah, from reading the protocol description, I think "ping" is probably
the
most common request by far, as your client has to ping all the other
nodes
participating in the torrent on a regular basis.

I'm curious to know if your sigs were significantly different?  Did they
cover anything I missed?

	David

Campesi, Christopher wrote:
> Nice sigs. I noticed the same thing happening and created similar
rules
> to yours
> 
> I do have a lot of hits on the ping request sig.
> 

From jonkman at jonkmans.com  Tue Sep 23 12:41:37 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Tue, 23 Sep 2008 12:41:37 -0400
Subject: [Emerging-Sigs] Rule source question
In-Reply-To: <48D90B77.8090607@packetnexus.com>
References: <48D8F653.6040000@packetnexus.com> <48D90723.5040803@jonkmans.com>
	<48D90B77.8090607@packetnexus.com>
Message-ID: <48D91C41.6070205@jonkmans.com>

Jason Lewis wrote:
> BruteForceBlocker:  http://danger.rulez.sk/index.php/bruteforceblocker/
> Blocked IPs are here:
> http://danger.rulez.sk/projects/bruteforceblocker/blist.php

Will ping him to see if he's ok with that. Will add these to the
compromised list.

> 
> DenyHosts is another, but I haven't seen a way to download the blocklist.
> 
> UCEProtect blocks IPs that send spam to spamtraps, depending on how many
> hosts in a CIDR, they have a list that contains bad CIDRs and then
> another list that has bad ASN.  http://www.uceprotect.net/en/index.php
> Policy breakdown is here: http://www.uceprotect.net/en/index.php?m=3&s=0
> Blacklists are here: http://wget-mirrors.uceprotect.net/
> 

This is a great project, I use it myself. I think the scale of the list
is far too great for snort though. I don't see a way to get the most
bad, or most prolific from their lists, so we may have to pass there,
just recommend folks use it on their mta's. (does wonders for me!)

> And on a side note... I'm interested in setting up a honeypot or two.  I
> have bandwidth and IP space and would be willing to host a listening
> post.  Is there a process for helping ET in that manner?  I'm interested
> in collecting the data myself, but I figured I would share if there was
> a need.

The listening post isn't in need of nodes, but we can always use
nepenthes boxes!

If you can setup a listening nepenthes and have it submit samples our
way they'll go right into the sandnet, and we'll get them analyzed and
rules created if required!

I'll put up a page (been meaning to do so) on easy ways to automate
sending nep binaries to our sandnet.

We can also use analysts to help go through samples in the sandnet.
Great fun, and you're really contributing directly to the community as a
whole!

Matt




> 
> jas
> 
> Matt Jonkman wrote:
>> Absolutely there is. I was just looking into dronebl as well. I'll reach
>> out to the guys there and see what we could do to collaborate. At the
>> minimum we can contribute our sandnet data to them.
>>
>> We do have a fwe other blacklist style lists. The Botnet CnC list, the
>> Dshield Top 20, the spamhaus DROP list, compromised hosts, etc. You can
>> see these in http://www.emergingthreats.net/rules/
>>
>> For the top20 and the bot cnc I'd recommend at least twice a week
>> updates. Spamhaus is less dynamic. Compromised is where we dump lists of
>> the latest outbreak of the day. Used to have a lot of storm supernodes,
>> but it's gotten smaller lately.
>>
>> Any other sources you all see out there let me know. We'll definitely
>> add anything good!
>>
>> Matt
>>
>> Jason Lewis wrote:
>>   
>>> The PHAS paper got me thinking about other data sources for sigs.  I
>>> read about the dronebl (http://www.dronebl.org/), because it was
>>> mentioned on NANOG.  Lists like that seem like they would be perfect for
>>> drop or block rules for those that might manage their networks more
>>> aggressively.  Do blocklists and whitelists like that have a place at
>>> emerging threats?
>>>
>>>
>>> jas
>>> _______________________________________________
>>> Emerging-sigs mailing list
>>> Emerging-sigs at emergingthreats.net
>>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>>>     
>>   
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From jlewis at packetnexus.com  Tue Sep 23 13:05:45 2008
From: jlewis at packetnexus.com (Jason Lewis)
Date: Tue, 23 Sep 2008 13:05:45 -0400
Subject: [Emerging-Sigs] Rule source question
In-Reply-To: <48D91C41.6070205@jonkmans.com>
References: <48D8F653.6040000@packetnexus.com> <48D90723.5040803@jonkmans.com>
	<48D90B77.8090607@packetnexus.com> <48D91C41.6070205@jonkmans.com>
Message-ID: <48D921E9.9030606@packetnexus.com>

I've actually been looking for a VM for nepenthes, SPARSA had one, but
the image seems to be down.

jas
> The listening post isn't in need of nodes, but we can always use
> nepenthes boxes!
>
> If you can setup a listening nepenthes and have it submit samples our
> way they'll go right into the sandnet, and we'll get them analyzed and
> rules created if required!
>
> I'll put up a page (been meaning to do so) on easy ways to automate
> sending nep binaries to our sandnet.
>
> We can also use analysts to help go through samples in the sandnet.
> Great fun, and you're really contributing directly to the community as a
> whole!
>
> Matt
>
>
>   


From jonkman at jonkmans.com  Tue Sep 23 14:08:38 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Tue, 23 Sep 2008 14:08:38 -0400
Subject: [Emerging-Sigs] Rule source question
In-Reply-To: <48D921E9.9030606@packetnexus.com>
References: <48D8F653.6040000@packetnexus.com>
	<48D90723.5040803@jonkmans.com>	<48D90B77.8090607@packetnexus.com>
	<48D91C41.6070205@jonkmans.com> <48D921E9.9030606@packetnexus.com>
Message-ID: <48D930A6.4010909@jonkmans.com>

I put up a script a lot of folks are using to send samples in. Use it to
send anything, not just nepenthes binaries:

http://doc.emergingthreats.net/bin/view/Main/SubmitSamples

I don't have any live images handy. It installs pretty easily on most
platforms via rpm or port. Pretty safe to run.

If anyone has samples to contribute they'll be put to very good use!

Matt

Jason Lewis wrote:
> I've actually been looking for a VM for nepenthes, SPARSA had one, but
> the image seems to be down.
> 
> jas
>> The listening post isn't in need of nodes, but we can always use
>> nepenthes boxes!
>>
>> If you can setup a listening nepenthes and have it submit samples our
>> way they'll go right into the sandnet, and we'll get them analyzed and
>> rules created if required!
>>
>> I'll put up a page (been meaning to do so) on easy ways to automate
>> sending nep binaries to our sandnet.
>>
>> We can also use analysts to help go through samples in the sandnet.
>> Great fun, and you're really contributing directly to the community as a
>> whole!
>>
>> Matt
>>
>>
>>   
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Tue Sep 23 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Tue, 23 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080923200008.649AC4502B@goliath.jonkmans.com>


[***] Results from Oinkmaster started Tue Sep 23 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008581 - ET P2P BitTorrent DHT ping request (emerging-p2p.rules)
 2008582 - ET P2P BitTorrent DHT find_node request (emerging-p2p.rules)
 2008583 - ET P2P BitTorrent DHT nodes reply (emerging-p2p.rules)
 2008584 - ET P2P BitTorrent DHT get_peers request (emerging-p2p.rules)
 2008585 - ET P2P BitTorrent DHT announce_peers request (emerging-p2p.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-p2p.rules (1):
        #Trackerless torrents, by David Bianco

     -> Added to emerging-sid-msg.map (5):
        2008581 || ET P2P BitTorrent DHT ping request || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008582 || ET P2P BitTorrent DHT find_node request || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008583 || ET P2P BitTorrent DHT nodes reply || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008584 || ET P2P BitTorrent DHT get_peers request || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008585 || ET P2P BitTorrent DHT announce_peers request || url,wiki.theory.org/BitTorrentDraftDHTProtocol

     -> Added to emerging-sid-msg.map.txt (5):
        2008581 || ET P2P BitTorrent DHT ping request || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008582 || ET P2P BitTorrent DHT find_node request || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008583 || ET P2P BitTorrent DHT nodes reply || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008584 || ET P2P BitTorrent DHT get_peers request || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008585 || ET P2P BitTorrent DHT announce_peers request || url,wiki.theory.org/BitTorrentDraftDHTProtocol


From jonkman at jonkmans.com  Tue Sep 23 16:52:50 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Tue, 23 Sep 2008 16:52:50 -0400
Subject: [Emerging-Sigs] Rule source question
In-Reply-To: <48D8F653.6040000@packetnexus.com>
References: <48D8F653.6040000@packetnexus.com>
Message-ID: <48D95722.7090202@jonkmans.com>

At Jason's suggestion we've got the SSH BruteForceBlocker blacklist
imported intot he compromised-hosts ruleset.

Great idea, and thanks to Dan Gerzo for making the data available to us!!

Matt

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From dxp2532 at gmail.com  Wed Sep 24 10:26:00 2008
From: dxp2532 at gmail.com (dxp)
Date: Wed, 24 Sep 2008 10:26:00 -0400
Subject: [Emerging-Sigs] Microsoft BITS Sig
In-Reply-To: <48D6869F.1010906@jonkmans.com>
References: <48D3B1B1.2070005@jonkmans.com>  <48D6869F.1010906@jonkmans.com>
Message-ID: <1222266360.6390.3.camel@kinta>

In addition to what's already listed I've seen lots of hits to the
following FQDNs:
    
    go.microsoft.com
    go2.microsoft.com
    toolbar.msn.com
    updates.smithmicro.com


-- 

-=[ dxp ]=-
0xA3F3C6E3

On Sun, 2008-09-21 at 13:38 -0400, Matt Jonkman wrote:

> Haven't had as many reports of other BITS using legitimate sites as I
> expected. Anyone else that's tested it seen hits on more than:
> 
> "Autobahn" software to "swarmcast.net".
> "PDFcomplete" enterprise sfw to "pdfcomplete.com"
> 
> Matt
> 
> Matt Jonkman wrote:
> > Cees and Bojan have sent in a sig related to Bojan's ISC entry of yesterday:
> > 
> > http://isc.sans.org/diary.html?storyid=5054
> > 
> > Related to the numbers of malware using the MS BITS download tools, or
> > at least their user-agent string, to avoid detection. Indeed we've seen
> > this technique in samples in the sandnet for a long time now, thousands
> > of instances.
> > 
> > But before we post this sig to the main ruleset I'd like to ask a few
> > sites to run it for 24 hours and let us know about any other sites we
> > should whitelist. Here's the sig so far:
> > 
> > alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Microsoft
> > BIT's User-Agent to an unknown domain - Likely Malware";
> > flow:established,to_server; content:"|0d 0a|User-Agent\: Microsoft
> > BITS"; content:!"|0d 0a|Host\: au.download.windowsupdate.com";
> > content:!"|0d 0a|Host\: cache.pack.google.com"; content:!"|0d 0a|Host\:
> > origin.onecare.live.com"; content:!"|0d 0a|Host\: dl.google.com";
> > content:"|0d 0a|Host\:"; content:!"sun.com"; within:20;
> > classtype:trojan-activity; sid:2008566; rev:1;)
> > 
> > Can a few folks give this a whirl to test the whitelisting?
> > 
> > Thanks!!
> > 
> > Matt
> > 
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080924/447a4348/attachment.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080924/447a4348/attachment.bin

From jlewis at packetnexus.com  Wed Sep 24 11:33:02 2008
From: jlewis at packetnexus.com (Jason Lewis)
Date: Wed, 24 Sep 2008 11:33:02 -0400
Subject: [Emerging-Sigs] Rule source question
In-Reply-To: <48D95722.7090202@jonkmans.com>
References: <48D8F653.6040000@packetnexus.com> <48D95722.7090202@jonkmans.com>
Message-ID: <48DA5DAE.5050407@packetnexus.com>

I'll keep posting lists as I find them.  Everyone can discuss if they
are worth using for rulesets.  Feel free to let me know if it's too much.

Virbl - http://virbl.bit.nl/  Virbl is a project of which the idea was
born during the RIPE-48 meeting. The plan was to get reports of
virusscanning mailservers, and put the sending IP-addresses on a blacklist.

There are many formats, but here's the text. 
http://virbl.bit.nl/download/virbl.dnsbl.bit.nl.txt


Matt Jonkman wrote:
> At Jason's suggestion we've got the SSH BruteForceBlocker blacklist
> imported intot he compromised-hosts ruleset.
>
> Great idea, and thanks to Dan Gerzo for making the data available to us!!
>
> Matt
>
>   


From jonkman at jonkmans.com  Wed Sep 24 11:33:43 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Wed, 24 Sep 2008 11:33:43 -0400
Subject: [Emerging-Sigs] Microsoft BITS Sig
In-Reply-To: <1222266360.6390.3.camel@kinta>
References: <48D3B1B1.2070005@jonkmans.com> <48D6869F.1010906@jonkmans.com>
	<1222266360.6390.3.camel@kinta>
Message-ID: <48DA5DD7.7060202@jonkmans.com>

Ya, I've had a good 30 sites reported using that UA legitimately. I
think we have to scrap the experiment. Won't be adding that sig to the
ruleset unless we find some other way to qualify the traffic.

Thanks all who tested it though!

Matt

dxp wrote:
> In addition to what's already listed I've seen lots of hits to the
> following FQDNs:
>    
>     go.microsoft.com
>     go2.microsoft.com
>     toolbar.msn.com
>     updates.smithmicro.com
> 
> 
> -- 
> 
> -=[ dxp ]=-
> 0xA3F3C6E3
> 
> 
> On Sun, 2008-09-21 at 13:38 -0400, Matt Jonkman wrote:
>> Haven't had as many reports of other BITS using legitimate sites as I
>> expected. Anyone else that's tested it seen hits on more than:
>>
>> "Autobahn" software to "swarmcast.net".
>> "PDFcomplete" enterprise sfw to "pdfcomplete.com"
>>
>> Matt
>>
>> Matt Jonkman wrote:
>> > Cees and Bojan have sent in a sig related to Bojan's ISC entry of yesterday:
>> > 
>> > http://isc.sans.org/diary.html?storyid=5054
>> > 
>> > Related to the numbers of malware using the MS BITS download tools, or
>> > at least their user-agent string, to avoid detection. Indeed we've seen
>> > this technique in samples in the sandnet for a long time now, thousands
>> > of instances.
>> > 
>> > But before we post this sig to the main ruleset I'd like to ask a few
>> > sites to run it for 24 hours and let us know about any other sites we
>> > should whitelist. Here's the sig so far:
>> > 
>> > alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Microsoft
>> > BIT's User-Agent to an unknown domain - Likely Malware";
>> > flow:established,to_server; content:"|0d 0a|User-Agent\: Microsoft
>> > BITS"; content:!"|0d 0a|Host\: au.download.windowsupdate.com";
>> > content:!"|0d 0a|Host\: cache.pack.google.com"; content:!"|0d 0a|Host\:
>> > origin.onecare.live.com"; content:!"|0d 0a|Host\: dl.google.com";
>> > content:"|0d 0a|Host\:"; content:!"sun.com"; within:20;
>> > classtype:trojan-activity; sid:2008566; rev:1;)
>> > 
>> > Can a few folks give this a whirl to test the whitelisting?
>> > 
>> > Thanks!!
>> > 
>> > Matt
>> > 
>>
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From bicer.tom at gmail.com  Wed Sep 24 11:43:50 2008
From: bicer.tom at gmail.com (Tom Bicer)
Date: Wed, 24 Sep 2008 11:43:50 -0400
Subject: [Emerging-Sigs] TinyPE Binary rule FP.
Message-ID: <acd88a3e0809240843n7771e67dnce6a6359d91ffb38@mail.gmail.com>

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET TROJAN
TinyPE Binary - Possibly Hostile"; flow:from_server,established;
content:"|4D 5A|"; content:"|50 45|"; within: 120;
reference:url,www.phreedom.org/solar/code/tinype/;
reference:url,bits.packetninjas.org/eblog/?p=316;
classtype:trojan-activity; sid:2008576; rev:1;)

Anyone receiving false positive on this? This is triggered on cookies,
GIFs, JPEGs, gzip, flash, and other traffic I haven't identified yet.

From inittab at jtan.com  Wed Sep 24 12:15:07 2008
From: inittab at jtan.com (RPG)
Date: Wed, 24 Sep 2008 12:15:07 -0400
Subject: [Emerging-Sigs] TinyPE Binary rule FP.
In-Reply-To: <acd88a3e0809240843n7771e67dnce6a6359d91ffb38@mail.gmail.com>
References: <acd88a3e0809240843n7771e67dnce6a6359d91ffb38@mail.gmail.com>
Message-ID: <48DA678B.7060309@jtan.com>

Yes we're seeing a LOT of FP's including streaming video/audio.

Tom Bicer wrote:
> alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET TROJAN
> TinyPE Binary - Possibly Hostile"; flow:from_server,established;
> content:"|4D 5A|"; content:"|50 45|"; within: 120;
> reference:url,www.phreedom.org/solar/code/tinype/;
> reference:url,bits.packetninjas.org/eblog/?p=316;
> classtype:trojan-activity; sid:2008576; rev:1;)
> 
> Anyone receiving false positive on this? This is triggered on cookies,
> GIFs, JPEGs, gzip, flash, and other traffic I haven't identified yet.
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

From jonkman at jonkmans.com  Wed Sep 24 13:50:36 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Wed, 24 Sep 2008 13:50:36 -0400
Subject: [Emerging-Sigs] TinyPE Binary rule FP.
In-Reply-To: <48DA678B.7060309@jtan.com>
References: <acd88a3e0809240843n7771e67dnce6a6359d91ffb38@mail.gmail.com>
	<48DA678B.7060309@jtan.com>
Message-ID: <48DA7DEC.3050402@jonkmans.com>

Yes, we had reports on that earlier this week. There's a rev:2 out
that's fixed the issues.

Can you update and let me know if you're still seeing the same?

matt

RPG wrote:
> Yes we're seeing a LOT of FP's including streaming video/audio.
> 
> Tom Bicer wrote:
>> alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET TROJAN
>> TinyPE Binary - Possibly Hostile"; flow:from_server,established;
>> content:"|4D 5A|"; content:"|50 45|"; within: 120;
>> reference:url,www.phreedom.org/solar/code/tinype/;
>> reference:url,bits.packetninjas.org/eblog/?p=316;
>> classtype:trojan-activity; sid:2008576; rev:1;)
>>
>> Anyone receiving false positive on this? This is triggered on cookies,
>> GIFs, JPEGs, gzip, flash, and other traffic I haven't identified yet.
>> _______________________________________________
>> Emerging-sigs mailing list
>> Emerging-sigs at emergingthreats.net
>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From jonkman at jonkmans.com  Wed Sep 24 13:52:05 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Wed, 24 Sep 2008 13:52:05 -0400
Subject: [Emerging-Sigs] Rule source question
In-Reply-To: <48DA5DAE.5050407@packetnexus.com>
References: <48D8F653.6040000@packetnexus.com> <48D95722.7090202@jonkmans.com>
	<48DA5DAE.5050407@packetnexus.com>
Message-ID: <48DA7E45.9020702@jonkmans.com>

That's a good one, but way too large unfortunately. Snort just can't
hack that.

Interesting project though, have to look further into it.

Matt

Jason Lewis wrote:
> I'll keep posting lists as I find them.  Everyone can discuss if they
> are worth using for rulesets.  Feel free to let me know if it's too much.
> 
> Virbl - http://virbl.bit.nl/  Virbl is a project of which the idea was
> born during the RIPE-48 meeting. The plan was to get reports of
> virusscanning mailservers, and put the sending IP-addresses on a blacklist.
> 
> There are many formats, but here's the text. 
> http://virbl.bit.nl/download/virbl.dnsbl.bit.nl.txt
> 
> 
> Matt Jonkman wrote:
>> At Jason's suggestion we've got the SSH BruteForceBlocker blacklist
>> imported intot he compromised-hosts ruleset.
>>
>> Great idea, and thanks to Dan Gerzo for making the data available to us!!
>>
>> Matt
>>
>>   
> 

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From campesic at centenarycollege.edu  Wed Sep 24 15:37:44 2008
From: campesic at centenarycollege.edu (Campesi, Christopher)
Date: Wed, 24 Sep 2008 15:37:44 -0400
Subject: [Emerging-Sigs] TroDjan 2.0 rules
Message-ID: <54125DA6FB3A3249B874A94D39E9E6D9038EE8EA@BENDER.centenarycollege.edu>

Recent Trojan I downloaded, TroDjan 2.0. 

Don't know if anyone has rules for this or seen it used in the wild. I
know that AV's catch the server.

 

alert tcp $HOME_NET any -> $EXTERNAL_NET 1800 (msg:"TroDjan 2.0 Server
to Client Connection";flags:S;sid:2;classtype:misc-activity;rev:1;)

 

alert tcp $EXTERNAL_NET 1802 -> $HOME_NET any (msg:"TroDjan 2.0 FTP Open
Request";content:"ftpopen";classtype:trojan-activity;sid:6;rev:1;)

 

alert tcp $HOME_NET 91 -> $EXTERNAL_NET any (msg:"TroDjan 2.0 FTP Server
Ready";content:"220 ICS FTP Server
ready";classtype:misc-activity;sid:4;rev:1; )

 

alert tcp $EXTERNAL_NET any -> $HOME_NET 91 (msg:"TroDjan 2.0 FTP File
Transfer";content:"RETR ";classtype:misc-activity;sid:5;rev:1; )

 

Chris

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080924/13f1d473/attachment.html

From emerging at emergingthreats.net  Wed Sep 24 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Wed, 24 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080924200008.32D8845026@goliath.jonkmans.com>


[***] Results from Oinkmaster started Wed Sep 24 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008586 - ET MALWARE Casino Related Spyware User-Agent Detected (Viper 4.0) (emerging-malware.rules)


[///]     Modified active rules:     [///]

 2406000 - ET RBN Known Russian Business Network Monitored Domains (1) (emerging-rbn.rules)
 2406001 - ET RBN Known Russian Business Network Monitored Domains (2) (emerging-rbn.rules)
 2406002 - ET RBN Known Russian Business Network Monitored Domains (3) (emerging-rbn.rules)
 2406003 - ET RBN Known Russian Business Network Monitored Domains (4) (emerging-rbn.rules)
 2406004 - ET RBN Known Russian Business Network Monitored Domains (5) (emerging-rbn.rules)
 2406005 - ET RBN Known Russian Business Network Monitored Domains (6) (emerging-rbn.rules)
 2406006 - ET RBN Known Russian Business Network Monitored Domains (7) (emerging-rbn.rules)
 2406007 - ET RBN Known Russian Business Network Monitored Domains (8) (emerging-rbn.rules)
 2406008 - ET RBN Known Russian Business Network Monitored Domains (9) (emerging-rbn.rules)
 2406009 - ET RBN Known Russian Business Network Monitored Domains (10) (emerging-rbn.rules)
 2406010 - ET RBN Known Russian Business Network Monitored Domains (11) (emerging-rbn.rules)
 2406011 - ET RBN Known Russian Business Network Monitored Domains (12) (emerging-rbn.rules)
 2406012 - ET RBN Known Russian Business Network Monitored Domains (13) (emerging-rbn.rules)
 2406013 - ET RBN Known Russian Business Network Monitored Domains (14) (emerging-rbn.rules)
 2406014 - ET RBN Known Russian Business Network Monitored Domains (15) (emerging-rbn.rules)
 2406015 - ET RBN Known Russian Business Network Monitored Domains (16) (emerging-rbn.rules)
 2406016 - ET RBN Known Russian Business Network Monitored Domains (17) (emerging-rbn.rules)
 2406017 - ET RBN Known Russian Business Network Monitored Domains (18) (emerging-rbn.rules)
 2406018 - ET RBN Known Russian Business Network Monitored Domains (19) (emerging-rbn.rules)
 2406019 - ET RBN Known Russian Business Network Monitored Domains (20) (emerging-rbn.rules)
 2407000 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (1) (emerging-rbn-BLOCK.rules)
 2407001 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (2) (emerging-rbn-BLOCK.rules)
 2407002 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (3) (emerging-rbn-BLOCK.rules)
 2407003 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (4) (emerging-rbn-BLOCK.rules)
 2407004 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (5) (emerging-rbn-BLOCK.rules)
 2407005 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (6) (emerging-rbn-BLOCK.rules)
 2407006 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (7) (emerging-rbn-BLOCK.rules)
 2407007 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (8) (emerging-rbn-BLOCK.rules)
 2407008 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (9) (emerging-rbn-BLOCK.rules)
 2407009 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (10) (emerging-rbn-BLOCK.rules)
 2407010 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (11) (emerging-rbn-BLOCK.rules)
 2407011 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (12) (emerging-rbn-BLOCK.rules)
 2407012 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (13) (emerging-rbn-BLOCK.rules)
 2407013 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (14) (emerging-rbn-BLOCK.rules)
 2407014 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (15) (emerging-rbn-BLOCK.rules)
 2407015 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) (emerging-rbn-BLOCK.rules)
 2407016 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) (emerging-rbn-BLOCK.rules)
 2407017 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) (emerging-rbn-BLOCK.rules)
 2407018 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) (emerging-rbn-BLOCK.rules)
 2407019 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) (emerging-rbn-BLOCK.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-rbn-BLOCK.rules (2):
        #  VERSION 62
        #  Updated 2008-09-24 10:05:47

     -> Added to emerging-rbn.rules (2):
        #  VERSION 62
        #  Updated 2008-09-24 10:05:47

     -> Added to emerging-sid-msg.map (159):
        2008586 || ET MALWARE Casino Related Spyware User-Agent Detected (Viper 4.0)
        2500001 || ET COMPROMISED Known Compromised or Hostile Host Traffic (2) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500002 || ET COMPROMISED Known Compromised or Hostile Host Traffic (3) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500003 || ET COMPROMISED Known Compromised or Hostile Host Traffic (4) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500004 || ET COMPROMISED Known Compromised or Hostile Host Traffic (5) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500005 || ET COMPROMISED Known Compromised or Hostile Host Traffic (6) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500006 || ET COMPROMISED Known Compromised or Hostile Host Traffic (7) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500007 || ET COMPROMISED Known Compromised or Hostile Host Traffic (8) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500008 || ET COMPROMISED Known Compromised or Hostile Host Traffic (9) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500009 || ET COMPROMISED Known Compromised or Hostile Host Traffic (10) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500010 || ET COMPROMISED Known Compromised or Hostile Host Traffic (11) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500011 || ET COMPROMISED Known Compromised or Hostile Host Traffic (12) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500012 || ET COMPROMISED Known Compromised or Hostile Host Traffic (13) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500013 || ET COMPROMISED Known Compromised or Hostile Host Traffic (14) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500014 || ET COMPROMISED Known Compromised or Hostile Host Traffic (15) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500015 || ET COMPROMISED Known Compromised or Hostile Host Traffic (16) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500016 || ET COMPROMISED Known Compromised or Hostile Host Traffic (17) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500017 || ET COMPROMISED Known Compromised or Hostile Host Traffic (18) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500018 || ET COMPROMISED Known Compromised or Hostile Host Traffic (19) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500019 || ET COMPROMISED Known Compromised or Hostile Host Traffic (20) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500020 || ET COMPROMISED Known Compromised or Hostile Host Traffic (21) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500021 || ET COMPROMISED Known Compromised or Hostile Host Traffic (22) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500022 || ET COMPROMISED Known Compromised or Hostile Host Traffic (23) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500023 || ET COMPROMISED Known Compromised or Hostile Host Traffic (24) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500024 || ET COMPROMISED Known Compromised or Hostile Host Traffic (25) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500025 || ET COMPROMISED Known Compromised or Hostile Host Traffic (26) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500026 || ET COMPROMISED Known Compromised or Hostile Host Traffic (27) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500027 || ET COMPROMISED Known Compromised or Hostile Host Traffic (28) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500028 || ET COMPROMISED Known Compromised or Hostile Host Traffic (29) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500029 || ET COMPROMISED Known Compromised or Hostile Host Traffic (30) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500030 || ET COMPROMISED Known Compromised or Hostile Host Traffic (31) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500031 || ET COMPROMISED Known Compromised or Hostile Host Traffic (32) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500032 || ET COMPROMISED Known Compromised or Hostile Host Traffic (33) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500033 || ET COMPROMISED Known Compromised or Hostile Host Traffic (34) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500034 || ET COMPROMISED Known Compromised or Hostile Host Traffic (35) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500035 || ET COMPROMISED Known Compromised or Hostile Host Traffic (36) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500036 || ET COMPROMISED Known Compromised or Hostile Host Traffic (37) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500037 || ET COMPROMISED Known Compromised or Hostile Host Traffic (38) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500038 || ET COMPROMISED Known Compromised or Hostile Host Traffic (39) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500039 || ET COMPROMISED Known Compromised or Hostile Host Traffic (40) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500040 || ET COMPROMISED Known Compromised or Hostile Host Traffic (41) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500041 || ET COMPROMISED Known Compromised or Hostile Host Traffic (42) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500042 || ET COMPROMISED Known Compromised or Hostile Host Traffic (43) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500043 || ET COMPROMISED Known Compromised or Hostile Host Traffic (44) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500044 || ET COMPROMISED Known Compromised or Hostile Host Traffic (45) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500045 || ET COMPROMISED Known Compromised or Hostile Host Traffic (46) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500046 || ET COMPROMISED Known Compromised or Hostile Host Traffic (47) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500047 || ET COMPROMISED Known Compromised or Hostile Host Traffic (48) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500048 || ET COMPROMISED Known Compromised or Hostile Host Traffic (49) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500049 || ET COMPROMISED Known Compromised or Hostile Host Traffic (50) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500050 || ET COMPROMISED Known Compromised or Hostile Host Traffic (51) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500051 || ET COMPROMISED Known Compromised or Hostile Host Traffic (52) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500052 || ET COMPROMISED Known Compromised or Hostile Host Traffic (53) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500053 || ET COMPROMISED Known Compromised or Hostile Host Traffic (54) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500054 || ET COMPROMISED Known Compromised or Hostile Host Traffic (55) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500055 || ET COMPROMISED Known Compromised or Hostile Host Traffic (56) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500056 || ET COMPROMISED Known Compromised or Hostile Host Traffic (57) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500057 || ET COMPROMISED Known Compromised or Hostile Host Traffic (58) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500058 || ET COMPROMISED Known Compromised or Hostile Host Traffic (59) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500059 || ET COMPROMISED Known Compromised or Hostile Host Traffic (60) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500060 || ET COMPROMISED Known Compromised or Hostile Host Traffic (61) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500061 || ET COMPROMISED Known Compromised or Hostile Host Traffic (62) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500062 || ET COMPROMISED Known Compromised or Hostile Host Traffic (63) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500063 || ET COMPROMISED Known Compromised or Hostile Host Traffic (64) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500064 || ET COMPROMISED Known Compromised or Hostile Host Traffic (65) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500065 || ET COMPROMISED Known Compromised or Hostile Host Traffic (66) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500066 || ET COMPROMISED Known Compromised or Hostile Host Traffic (67) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500067 || ET COMPROMISED Known Compromised or Hostile Host Traffic (68) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500068 || ET COMPROMISED Known Compromised or Hostile Host Traffic (69) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500069 || ET COMPROMISED Known Compromised or Hostile Host Traffic (70) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500070 || ET COMPROMISED Known Compromised or Hostile Host Traffic (71) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500071 || ET COMPROMISED Known Compromised or Hostile Host Traffic (72) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500072 || ET COMPROMISED Known Compromised or Hostile Host Traffic (73) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500073 || ET COMPROMISED Known Compromised or Hostile Host Traffic (74) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500074 || ET COMPROMISED Known Compromised or Hostile Host Traffic (75) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500075 || ET COMPROMISED Known Compromised or Hostile Host Traffic (76) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500076 || ET COMPROMISED Known Compromised or Hostile Host Traffic (77) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500077 || ET COMPROMISED Known Compromised or Hostile Host Traffic (78) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500078 || ET COMPROMISED Known Compromised or Hostile Host Traffic (79) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500079 || ET COMPROMISED Known Compromised or Hostile Host Traffic (80) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510001 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (2) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510002 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (3) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510003 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (4) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510004 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (5) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510005 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (6) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510006 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (7) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510007 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (8) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510008 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (9) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510009 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (10) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510010 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (11) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510011 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (12) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510012 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (13) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510013 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (14) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510014 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (15) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510015 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (16) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510016 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (17) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510017 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (18) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510018 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (19) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510019 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (20) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510020 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (21) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510021 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (22) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510022 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (23) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510023 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (24) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510024 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (25) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510025 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (26) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510026 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (27) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510027 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (28) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510028 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (29) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510029 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (30) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510030 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (31) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510031 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (32) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510032 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (33) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510033 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (34) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510034 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (35) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510035 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (36) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510036 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (37) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510037 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (38) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510038 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (39) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510039 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (40) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510040 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (41) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510041 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (42) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510042 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (43) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510043 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (44) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510044 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (45) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510045 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (46) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510046 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (47) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510047 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (48) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510048 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (49) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510049 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (50) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510050 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (51) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510051 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (52) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510052 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (53) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510053 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (54) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510054 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (55) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510055 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (56) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510056 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (57) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510057 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (58) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510058 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (59) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510059 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (60) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510060 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (61) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510061 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (62) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510062 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (63) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510063 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (64) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510064 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (65) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510065 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (66) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510066 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (67) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510067 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (68) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510068 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (69) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510069 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (70) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510070 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (71) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510071 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (72) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510072 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (73) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510073 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (74) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510074 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (75) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510075 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (76) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510076 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (77) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510077 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (78) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510078 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (79) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510079 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (80) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts

     -> Added to emerging-sid-msg.map.txt (159):
        2008586 || ET MALWARE Casino Related Spyware User-Agent Detected (Viper 4.0)
        2500001 || ET COMPROMISED Known Compromised or Hostile Host Traffic (2) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500002 || ET COMPROMISED Known Compromised or Hostile Host Traffic (3) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500003 || ET COMPROMISED Known Compromised or Hostile Host Traffic (4) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500004 || ET COMPROMISED Known Compromised or Hostile Host Traffic (5) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500005 || ET COMPROMISED Known Compromised or Hostile Host Traffic (6) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500006 || ET COMPROMISED Known Compromised or Hostile Host Traffic (7) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500007 || ET COMPROMISED Known Compromised or Hostile Host Traffic (8) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500008 || ET COMPROMISED Known Compromised or Hostile Host Traffic (9) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500009 || ET COMPROMISED Known Compromised or Hostile Host Traffic (10) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500010 || ET COMPROMISED Known Compromised or Hostile Host Traffic (11) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500011 || ET COMPROMISED Known Compromised or Hostile Host Traffic (12) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500012 || ET COMPROMISED Known Compromised or Hostile Host Traffic (13) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500013 || ET COMPROMISED Known Compromised or Hostile Host Traffic (14) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500014 || ET COMPROMISED Known Compromised or Hostile Host Traffic (15) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500015 || ET COMPROMISED Known Compromised or Hostile Host Traffic (16) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500016 || ET COMPROMISED Known Compromised or Hostile Host Traffic (17) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500017 || ET COMPROMISED Known Compromised or Hostile Host Traffic (18) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500018 || ET COMPROMISED Known Compromised or Hostile Host Traffic (19) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500019 || ET COMPROMISED Known Compromised or Hostile Host Traffic (20) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500020 || ET COMPROMISED Known Compromised or Hostile Host Traffic (21) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500021 || ET COMPROMISED Known Compromised or Hostile Host Traffic (22) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500022 || ET COMPROMISED Known Compromised or Hostile Host Traffic (23) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500023 || ET COMPROMISED Known Compromised or Hostile Host Traffic (24) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500024 || ET COMPROMISED Known Compromised or Hostile Host Traffic (25) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500025 || ET COMPROMISED Known Compromised or Hostile Host Traffic (26) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500026 || ET COMPROMISED Known Compromised or Hostile Host Traffic (27) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500027 || ET COMPROMISED Known Compromised or Hostile Host Traffic (28) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500028 || ET COMPROMISED Known Compromised or Hostile Host Traffic (29) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500029 || ET COMPROMISED Known Compromised or Hostile Host Traffic (30) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500030 || ET COMPROMISED Known Compromised or Hostile Host Traffic (31) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500031 || ET COMPROMISED Known Compromised or Hostile Host Traffic (32) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500032 || ET COMPROMISED Known Compromised or Hostile Host Traffic (33) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500033 || ET COMPROMISED Known Compromised or Hostile Host Traffic (34) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500034 || ET COMPROMISED Known Compromised or Hostile Host Traffic (35) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500035 || ET COMPROMISED Known Compromised or Hostile Host Traffic (36) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500036 || ET COMPROMISED Known Compromised or Hostile Host Traffic (37) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500037 || ET COMPROMISED Known Compromised or Hostile Host Traffic (38) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500038 || ET COMPROMISED Known Compromised or Hostile Host Traffic (39) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500039 || ET COMPROMISED Known Compromised or Hostile Host Traffic (40) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500040 || ET COMPROMISED Known Compromised or Hostile Host Traffic (41) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500041 || ET COMPROMISED Known Compromised or Hostile Host Traffic (42) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500042 || ET COMPROMISED Known Compromised or Hostile Host Traffic (43) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500043 || ET COMPROMISED Known Compromised or Hostile Host Traffic (44) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500044 || ET COMPROMISED Known Compromised or Hostile Host Traffic (45) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500045 || ET COMPROMISED Known Compromised or Hostile Host Traffic (46) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500046 || ET COMPROMISED Known Compromised or Hostile Host Traffic (47) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500047 || ET COMPROMISED Known Compromised or Hostile Host Traffic (48) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500048 || ET COMPROMISED Known Compromised or Hostile Host Traffic (49) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500049 || ET COMPROMISED Known Compromised or Hostile Host Traffic (50) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500050 || ET COMPROMISED Known Compromised or Hostile Host Traffic (51) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500051 || ET COMPROMISED Known Compromised or Hostile Host Traffic (52) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500052 || ET COMPROMISED Known Compromised or Hostile Host Traffic (53) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500053 || ET COMPROMISED Known Compromised or Hostile Host Traffic (54) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500054 || ET COMPROMISED Known Compromised or Hostile Host Traffic (55) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500055 || ET COMPROMISED Known Compromised or Hostile Host Traffic (56) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500056 || ET COMPROMISED Known Compromised or Hostile Host Traffic (57) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500057 || ET COMPROMISED Known Compromised or Hostile Host Traffic (58) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500058 || ET COMPROMISED Known Compromised or Hostile Host Traffic (59) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500059 || ET COMPROMISED Known Compromised or Hostile Host Traffic (60) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500060 || ET COMPROMISED Known Compromised or Hostile Host Traffic (61) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500061 || ET COMPROMISED Known Compromised or Hostile Host Traffic (62) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500062 || ET COMPROMISED Known Compromised or Hostile Host Traffic (63) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500063 || ET COMPROMISED Known Compromised or Hostile Host Traffic (64) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500064 || ET COMPROMISED Known Compromised or Hostile Host Traffic (65) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500065 || ET COMPROMISED Known Compromised or Hostile Host Traffic (66) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500066 || ET COMPROMISED Known Compromised or Hostile Host Traffic (67) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500067 || ET COMPROMISED Known Compromised or Hostile Host Traffic (68) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500068 || ET COMPROMISED Known Compromised or Hostile Host Traffic (69) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500069 || ET COMPROMISED Known Compromised or Hostile Host Traffic (70) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500070 || ET COMPROMISED Known Compromised or Hostile Host Traffic (71) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500071 || ET COMPROMISED Known Compromised or Hostile Host Traffic (72) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500072 || ET COMPROMISED Known Compromised or Hostile Host Traffic (73) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500073 || ET COMPROMISED Known Compromised or Hostile Host Traffic (74) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500074 || ET COMPROMISED Known Compromised or Hostile Host Traffic (75) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500075 || ET COMPROMISED Known Compromised or Hostile Host Traffic (76) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500076 || ET COMPROMISED Known Compromised or Hostile Host Traffic (77) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500077 || ET COMPROMISED Known Compromised or Hostile Host Traffic (78) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500078 || ET COMPROMISED Known Compromised or Hostile Host Traffic (79) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500079 || ET COMPROMISED Known Compromised or Hostile Host Traffic (80) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510001 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (2) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510002 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (3) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510003 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (4) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510004 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (5) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510005 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (6) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510006 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (7) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510007 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (8) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510008 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (9) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510009 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (10) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510010 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (11) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510011 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (12) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510012 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (13) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510013 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (14) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510014 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (15) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510015 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (16) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510016 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (17) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510017 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (18) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510018 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (19) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510019 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (20) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510020 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (21) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510021 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (22) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510022 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (23) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510023 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (24) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510024 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (25) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510025 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (26) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510026 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (27) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510027 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (28) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510028 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (29) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510029 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (30) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510030 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (31) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510031 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (32) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510032 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (33) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510033 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (34) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510034 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (35) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510035 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (36) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510036 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (37) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510037 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (38) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510038 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (39) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510039 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (40) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510040 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (41) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510041 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (42) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510042 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (43) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510043 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (44) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510044 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (45) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510045 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (46) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510046 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (47) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510047 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (48) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510048 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (49) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510049 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (50) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510050 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (51) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510051 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (52) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510052 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (53) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510053 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (54) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510054 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (55) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510055 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (56) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510056 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (57) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510057 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (58) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510058 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (59) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510059 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (60) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510060 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (61) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510061 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (62) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510062 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (63) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510063 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (64) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510064 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (65) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510065 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (66) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510066 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (67) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510067 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (68) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510068 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (69) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510069 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (70) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510070 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (71) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510071 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (72) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510072 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (73) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510073 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (74) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510074 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (75) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510075 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (76) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510076 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (77) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510077 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (78) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510078 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (79) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510079 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (80) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-rbn-BLOCK.rules (2):
        #  VERSION 61
        #  Updated 2008-09-21 13:52:54

     -> Removed from emerging-rbn.rules (2):
        #  VERSION 61
        #  Updated 2008-09-21 13:52:54

     -> Removed from emerging-sid-msg.map (2):
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org

     -> Removed from emerging-sid-msg.map.txt (2):
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org


From jonkman at jonkmans.com  Wed Sep 24 22:26:59 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Wed, 24 Sep 2008 22:26:59 -0400
Subject: [Emerging-Sigs] TroDjan 2.0 rules
In-Reply-To: <54125DA6FB3A3249B874A94D39E9E6D9038EE8EA@BENDER.centenarycollege.edu>
References: <54125DA6FB3A3249B874A94D39E9E6D9038EE8EA@BENDER.centenarycollege.edu>
Message-ID: <48DAF6F3.6090404@jonkmans.com>

Good sigs, some questions inline. Do you happen to have a sample md5 or
a pcap you could share?

more...

Campesi, Christopher wrote:
> alert tcp $HOME_NET any -> $EXTERNAL_NET 1800 (msg:"TroDjan 2.0 Server
> to Client Connection";flags:S;sid:2;classtype:misc-activity;rev:1;)

Is there some content we can match on here? There are legit apps that
run on that port, we'd see too many falses I think.

> alert tcp $EXTERNAL_NET 1802 -> $HOME_NET any (msg:"TroDjan 2.0 FTP Open
> Request";content:"ftpopen";classtype:trojan-activity;sid:6;rev:1;)

Can we anchor this in the packet? Start, end, etc? Average packet size
maybe?

> alert tcp $HOME_NET 91 -> $EXTERNAL_NET any (msg:?TroDjan 2.0 FTP Server
> Ready";content:"220 ICS FTP Server
> ready";classtype:misc-activity;sid:4;rev:1; )

That looks good. Is ICS a known legit ftp server, or all badness?

Is that the entire packet contents? Could also use dsize in that case.

> alert tcp $EXTERNAL_NET any -> $HOME_NET 91 (msg:"TroDjan 2.0 FTP File
> Transfer";content:"RETR ";classtype:misc-activity;sid:5;rev:1; )

Similar questions. Packet size, is that retr the first 4 bytes of the
packet?

Thanks for the sigs!! We'll get them optimized and posted asap!

Matt

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From campesic at centenarycollege.edu  Thu Sep 25 10:38:01 2008
From: campesic at centenarycollege.edu (Campesi, Christopher)
Date: Thu, 25 Sep 2008 10:38:01 -0400
Subject: [Emerging-Sigs] TroDjan 2.0 rules
In-Reply-To: <48DAF6F3.6090404@jonkmans.com>
References: <54125DA6FB3A3249B874A94D39E9E6D9038EE8EA@BENDER.centenarycollege.edu>
	<48DAF6F3.6090404@jonkmans.com>
Message-ID: <54125DA6FB3A3249B874A94D39E9E6D9038EEA4D@BENDER.centenarycollege.edu>

Heres the pcap starting from join to ftp connection to download of
file(s).
 
Answer to your questions:
1. No content match on the connection. I agree that there probably will
be false pos there
2. Data is 7 bytes long
3. The ICS ftp server is built into XP. Internet Connection Sharing and
from the device that's doing the sharing, FTP Server can be selected as
one of the services to run. Since this is not turned on by default I'm
going to say this is mostly leaning toward bad with few false positive. 
4. Yes

After the ftpopen packet there's also this, might be better?:

46 6f 69 20 61 62 65 72 74 61 20 75 6d 61 20 70  Foi aberta uma p
6f 72 74 61 20 46 54 50 20 6e 6f 20 73 65 72 76  orta FTP no serv
65 72                                            er

So if you want to nix the ftpopen and go with this specifically can do
that to... believe is Portuguese?
 
Chris

-----Original Message-----
From: Matt Jonkman [mailto:jonkman at jonkmans.com] 
Sent: Wednesday, September 24, 2008 10:27 PM
To: Campesi, Christopher
Cc: Emerging Threats Signatures
Subject: Re: [Emerging-Sigs] TroDjan 2.0 rules

Good sigs, some questions inline. Do you happen to have a sample md5 or
a pcap you could share?

more...

Campesi, Christopher wrote:
> alert tcp $HOME_NET any -> $EXTERNAL_NET 1800 (msg:"TroDjan 2.0 Server
> to Client Connection";flags:S;sid:2;classtype:misc-activity;rev:1;)

Is there some content we can match on here? There are legit apps that
run on that port, we'd see too many falses I think.

> alert tcp $EXTERNAL_NET 1802 -> $HOME_NET any (msg:"TroDjan 2.0 FTP
Open
> Request";content:"ftpopen";classtype:trojan-activity;sid:6;rev:1;)

Can we anchor this in the packet? Start, end, etc? Average packet size
maybe?

> alert tcp $HOME_NET 91 -> $EXTERNAL_NET any (msg:"TroDjan 2.0 FTP
Server
> Ready";content:"220 ICS FTP Server
> ready";classtype:misc-activity;sid:4;rev:1; )

That looks good. Is ICS a known legit ftp server, or all badness?

Is that the entire packet contents? Could also use dsize in that case.

> alert tcp $EXTERNAL_NET any -> $HOME_NET 91 (msg:"TroDjan 2.0 FTP File
> Transfer";content:"RETR ";classtype:misc-activity;sid:5;rev:1; )

Similar questions. Packet size, is that retr the first 4 bytes of the
packet?

Thanks for the sigs!! We'll get them optimized and posted asap!

Matt

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc


-------------- next part --------------
A non-text attachment was scrubbed...
Name: TroDjan.pcap
Type: application/octet-stream
Size: 259788 bytes
Desc: TroDjan.pcap
Url : http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080925/c9f0fb86/TroDjan-0001.obj

From jonkman at jonkmans.com  Thu Sep 25 12:10:20 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Thu, 25 Sep 2008 12:10:20 -0400
Subject: [Emerging-Sigs] TroDjan 2.0 rules
In-Reply-To: <54125DA6FB3A3249B874A94D39E9E6D9038EEA4D@BENDER.centenarycollege.edu>
References: <54125DA6FB3A3249B874A94D39E9E6D9038EE8EA@BENDER.centenarycollege.edu>	<48DAF6F3.6090404@jonkmans.com>
	<54125DA6FB3A3249B874A94D39E9E6D9038EEA4D@BENDER.centenarycollege.edu>
Message-ID: <48DBB7EC.5020403@jonkmans.com>

Great pcap, thanks for sending it over.

That initial port 1800 connection has the string:

"Windows NT 5.1 (Build 2600: Service Pack 3)"

Which I think we can assume that'll always start with Windows, and
always be under say 60 bytes. That should make the first rule more
reliable. So I'll post this:

alert tcp $HOME_NET any -> $EXTERNAL_NET 1800 (msg:"ET TROJAN TroDjan
2.0 Infection Report"; flow:established,to_server; dsize:<60;
classtype:trojan-activity; sid:xx; rev:1;)

That look good to everyone?

On the second connection, it says:
Foi aberta uma porta FTP no server

which is portugese as you said, translates to "It was an open door in
FTP server". Likely reporting infection mode. Port 1700. I think
skipping sigging that one is good, may be a different message each time.

Then the ftpopen on port 1802. That's very sigable as you had:

alert tcp $EXTERNAL_NET 1802 -> $HOME_NET any (msg:"ET TROJAN TroDjan
2.0 FTP Channel Open Command"; flow:established,to_server; dsize:7;
content:"ftpopen"; classtype:trojan-activity; sid:xx; rev:1;)


On the last thing, I'm leaning toward a sig that'll help us find ANY ftp
conversation on an off port, especially a low port like 91. If someone's
going to run an ftp server on an off port it'll likely by a high port,
not 91.

So:

alert tcp $EXTERNAL_NET any -> $HOME_NET 22:1024 (msg:"ET POLICY FTP
Conversation on Low Port - Likely Hostile (TYPE A)";
flow:established,to_server; dsize:6; content:"TYPE "; depth:5;
classtype:trojan-activity; sid:xx; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET 22:1024 (msg:"ET POLICY FTP
Conversation on Low Port - Likely Hostile (PASV)";
flow:established,to_server; dsize:4; content:"PASV";
classtype:trojan-activity; sid:xx; rev:1;)

I'd like to get everyone's thoughts on those, especially the ftp ones
before I post. Am I missing anything important?

Matt




Campesi, Christopher wrote:
> Heres the pcap starting from join to ftp connection to download of
> file(s).
>  
> Answer to your questions:
> 1. No content match on the connection. I agree that there probably will
> be false pos there
> 2. Data is 7 bytes long
> 3. The ICS ftp server is built into XP. Internet Connection Sharing and
> from the device that's doing the sharing, FTP Server can be selected as
> one of the services to run. Since this is not turned on by default I'm
> going to say this is mostly leaning toward bad with few false positive. 
> 4. Yes
> 
> After the ftpopen packet there's also this, might be better?:
> 
> 46 6f 69 20 61 62 65 72 74 61 20 75 6d 61 20 70  Foi aberta uma p
> 6f 72 74 61 20 46 54 50 20 6e 6f 20 73 65 72 76  orta FTP no serv
> 65 72                                            er
> 
> So if you want to nix the ftpopen and go with this specifically can do
> that to... believe is Portuguese?
>  
> Chris
> 
> -----Original Message-----
> From: Matt Jonkman [mailto:jonkman at jonkmans.com] 
> Sent: Wednesday, September 24, 2008 10:27 PM
> To: Campesi, Christopher
> Cc: Emerging Threats Signatures
> Subject: Re: [Emerging-Sigs] TroDjan 2.0 rules
> 
> Good sigs, some questions inline. Do you happen to have a sample md5 or
> a pcap you could share?
> 
> more...
> 
> Campesi, Christopher wrote:
>> alert tcp $HOME_NET any -> $EXTERNAL_NET 1800 (msg:"TroDjan 2.0 Server
>> to Client Connection";flags:S;sid:2;classtype:misc-activity;rev:1;)
> 
> Is there some content we can match on here? There are legit apps that
> run on that port, we'd see too many falses I think.
> 
>> alert tcp $EXTERNAL_NET 1802 -> $HOME_NET any (msg:"TroDjan 2.0 FTP
> Open
>> Request";content:"ftpopen";classtype:trojan-activity;sid:6;rev:1;)
> 
> Can we anchor this in the packet? Start, end, etc? Average packet size
> maybe?
> 
>> alert tcp $HOME_NET 91 -> $EXTERNAL_NET any (msg:"TroDjan 2.0 FTP
> Server
>> Ready";content:"220 ICS FTP Server
>> ready";classtype:misc-activity;sid:4;rev:1; )
> 
> That looks good. Is ICS a known legit ftp server, or all badness?
> 
> Is that the entire packet contents? Could also use dsize in that case.
> 
>> alert tcp $EXTERNAL_NET any -> $HOME_NET 91 (msg:"TroDjan 2.0 FTP File
>> Transfer";content:"RETR ";classtype:misc-activity;sid:5;rev:1; )
> 
> Similar questions. Packet size, is that retr the first 4 bytes of the
> packet?
> 
> Thanks for the sigs!! We'll get them optimized and posted asap!
> 
> Matt
> 
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Thu Sep 25 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Thu, 25 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080925200008.0A3D245026@goliath.jonkmans.com>


[***] Results from Oinkmaster started Thu Sep 25 16:00:07 2008 [***]

[*] Rules modifications: [*]
    None.

[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-sid-msg.map (4):
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org
        2500080 || ET COMPROMISED Known Compromised or Hostile Host Traffic (81) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510080 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (81) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts

     -> Added to emerging-sid-msg.map.txt (4):
        2404020 || ET DROP Known Bot C&C Server Traffic (group 21)  || url,www.shadowserver.org
        2405020 || ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE || url,www.shadowserver.org
        2500080 || ET COMPROMISED Known Compromised or Hostile Host Traffic (81) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510080 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (81) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts


From jonkman at jonkmans.com  Thu Sep 25 18:20:05 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Thu, 25 Sep 2008 18:20:05 -0400
Subject: [Emerging-Sigs] TroDjan 2.0 rules
In-Reply-To: <48DBB7EC.5020403@jonkmans.com>
References: <54125DA6FB3A3249B874A94D39E9E6D9038EE8EA@BENDER.centenarycollege.edu>	<48DAF6F3.6090404@jonkmans.com>	<54125DA6FB3A3249B874A94D39E9E6D9038EEA4D@BENDER.centenarycollege.edu>
	<48DBB7EC.5020403@jonkmans.com>
Message-ID: <48DC0E95.209@jonkmans.com>

I'll take the silence as no problems foreseen. Posting now.

Thanks all!

Matt

Matt Jonkman wrote:
> Great pcap, thanks for sending it over.
> 
> That initial port 1800 connection has the string:
> 
> "Windows NT 5.1 (Build 2600: Service Pack 3)"
> 
> Which I think we can assume that'll always start with Windows, and
> always be under say 60 bytes. That should make the first rule more
> reliable. So I'll post this:
> 
> alert tcp $HOME_NET any -> $EXTERNAL_NET 1800 (msg:"ET TROJAN TroDjan
> 2.0 Infection Report"; flow:established,to_server; dsize:<60;
> classtype:trojan-activity; sid:xx; rev:1;)
> 
> That look good to everyone?
> 
> On the second connection, it says:
> Foi aberta uma porta FTP no server
> 
> which is portugese as you said, translates to "It was an open door in
> FTP server". Likely reporting infection mode. Port 1700. I think
> skipping sigging that one is good, may be a different message each time.
> 
> Then the ftpopen on port 1802. That's very sigable as you had:
> 
> alert tcp $EXTERNAL_NET 1802 -> $HOME_NET any (msg:"ET TROJAN TroDjan
> 2.0 FTP Channel Open Command"; flow:established,to_server; dsize:7;
> content:"ftpopen"; classtype:trojan-activity; sid:xx; rev:1;)
> 
> 
> On the last thing, I'm leaning toward a sig that'll help us find ANY ftp
> conversation on an off port, especially a low port like 91. If someone's
> going to run an ftp server on an off port it'll likely by a high port,
> not 91.
> 
> So:
> 
> alert tcp $EXTERNAL_NET any -> $HOME_NET 22:1024 (msg:"ET POLICY FTP
> Conversation on Low Port - Likely Hostile (TYPE A)";
> flow:established,to_server; dsize:6; content:"TYPE "; depth:5;
> classtype:trojan-activity; sid:xx; rev:1;)
> 
> alert tcp $EXTERNAL_NET any -> $HOME_NET 22:1024 (msg:"ET POLICY FTP
> Conversation on Low Port - Likely Hostile (PASV)";
> flow:established,to_server; dsize:4; content:"PASV";
> classtype:trojan-activity; sid:xx; rev:1;)
> 
> I'd like to get everyone's thoughts on those, especially the ftp ones
> before I post. Am I missing anything important?
> 
> Matt
> 
> 
> 
> 
> Campesi, Christopher wrote:
>> Heres the pcap starting from join to ftp connection to download of
>> file(s).
>>  
>> Answer to your questions:
>> 1. No content match on the connection. I agree that there probably will
>> be false pos there
>> 2. Data is 7 bytes long
>> 3. The ICS ftp server is built into XP. Internet Connection Sharing and
>> from the device that's doing the sharing, FTP Server can be selected as
>> one of the services to run. Since this is not turned on by default I'm
>> going to say this is mostly leaning toward bad with few false positive. 
>> 4. Yes
>>
>> After the ftpopen packet there's also this, might be better?:
>>
>> 46 6f 69 20 61 62 65 72 74 61 20 75 6d 61 20 70  Foi aberta uma p
>> 6f 72 74 61 20 46 54 50 20 6e 6f 20 73 65 72 76  orta FTP no serv
>> 65 72                                            er
>>
>> So if you want to nix the ftpopen and go with this specifically can do
>> that to... believe is Portuguese?
>>  
>> Chris
>>
>> -----Original Message-----
>> From: Matt Jonkman [mailto:jonkman at jonkmans.com] 
>> Sent: Wednesday, September 24, 2008 10:27 PM
>> To: Campesi, Christopher
>> Cc: Emerging Threats Signatures
>> Subject: Re: [Emerging-Sigs] TroDjan 2.0 rules
>>
>> Good sigs, some questions inline. Do you happen to have a sample md5 or
>> a pcap you could share?
>>
>> more...
>>
>> Campesi, Christopher wrote:
>>> alert tcp $HOME_NET any -> $EXTERNAL_NET 1800 (msg:"TroDjan 2.0 Server
>>> to Client Connection";flags:S;sid:2;classtype:misc-activity;rev:1;)
>> Is there some content we can match on here? There are legit apps that
>> run on that port, we'd see too many falses I think.
>>
>>> alert tcp $EXTERNAL_NET 1802 -> $HOME_NET any (msg:"TroDjan 2.0 FTP
>> Open
>>> Request";content:"ftpopen";classtype:trojan-activity;sid:6;rev:1;)
>> Can we anchor this in the packet? Start, end, etc? Average packet size
>> maybe?
>>
>>> alert tcp $HOME_NET 91 -> $EXTERNAL_NET any (msg:"TroDjan 2.0 FTP
>> Server
>>> Ready";content:"220 ICS FTP Server
>>> ready";classtype:misc-activity;sid:4;rev:1; )
>> That looks good. Is ICS a known legit ftp server, or all badness?
>>
>> Is that the entire packet contents? Could also use dsize in that case.
>>
>>> alert tcp $EXTERNAL_NET any -> $HOME_NET 91 (msg:"TroDjan 2.0 FTP File
>>> Transfer";content:"RETR ";classtype:misc-activity;sid:5;rev:1; )
>> Similar questions. Packet size, is that retr the first 4 bytes of the
>> packet?
>>
>> Thanks for the sigs!! We'll get them optimized and posted asap!
>>
>> Matt
>>
>>
>>
>> ------------------------------------------------------------------------
>>
>> _______________________________________________
>> Emerging-sigs mailing list
>> Emerging-sigs at emergingthreats.net
>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
> 

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From phatbuckett at gmail.com  Thu Sep 25 19:22:23 2008
From: phatbuckett at gmail.com (Darren Spruell)
Date: Thu, 25 Sep 2008 16:22:23 -0700
Subject: [Emerging-Sigs] Malware consistency between 2007712 and 2008011
Message-ID: <839aec700809251622n199e4c4elfda5bcb73f585c10@mail.gmail.com>

emerging-virus.rules:

alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET TROJAN
Pakes/Cutwall/Kobcka Update Detected High Ports";
flow:established,to_server; content:"GET "; depth:4; content:"|0d
0a|Host\: "; distance:0; content:"|0d 0a|X-Flags\: "; distance:0;
within:40; content:"|0d 0a|X-TM\:"; distance:0; content:"|0d 0a|X-BI\:
"; distance:0; classtype:trojan-activity; sid:2008011; rev:3;)

alert tcp $HOME_NET any -> $EXTERNAL_NET 4099 (msg:"ET TROJAN Srizbi
requesting template"; flow:established,to_server; content:"GET|20|/";
depth:5; content:"|0d0a|X-Flags|3a20|";  within:200;
content:"|0d0a|X-TM|3a20|"; within:20;  content:"|0d0a|X-BI|3a20|";
within:20; reference:url,www.secureworks.com/research/threats/ronpaul/;
classtype:trojan-activity; sid:2007712; rev:5;)

My experience with this payload suggests the Srizbi association is
accurate; maybe useful to de-duplicate these rules?

-- 
Darren Spruell
phatbuckett at gmail.com

From jonkman at jonkmans.com  Fri Sep 26 09:14:57 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Fri, 26 Sep 2008 09:14:57 -0400
Subject: [Emerging-Sigs] Atrivo/Intercage Offline again
Message-ID: <48DCE051.9000003@jonkmans.com>

http://www.cidr-report.org/cgi-bin/as-report?as=as27595

In case you've missed it, Atrivo/Intercage had a short reprieve while
United Layer peered them for a few days. They said publicly that the
leash was short, no continued hostile activity would be tolerated.

Apparently they hit the end of the leash. Looking forward to a statement
from United Layer.

Kudos to them either way. This was a good way to handle things. Make the
terms clear (a clean network), or else.

Matt

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From campesic at centenarycollege.edu  Fri Sep 26 12:36:29 2008
From: campesic at centenarycollege.edu (Campesi, Christopher)
Date: Fri, 26 Sep 2008 12:36:29 -0400
Subject: [Emerging-Sigs] Ares Galaxy Connection
Message-ID: <54125DA6FB3A3249B874A94D39E9E6D9038EED22@BENDER.centenarycollege.edu>

Ares Galaxy 2.0.9

 

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg: "Ares Server
Connection";content:"r|be|bloop|00|dV";flow:to_server;distance:16;conten
t:"Ares|00
0a|";classtype:policy-violation;reference:url,aresgalaxy.sourceforge.net
;sid:XXXXXXXX;rev:1;)

 

Chris

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080926/e680db56/attachment.html

From jonkman at jonkmans.com  Fri Sep 26 13:48:45 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Fri, 26 Sep 2008 13:48:45 -0400
Subject: [Emerging-Sigs] Ares Galaxy Connection
In-Reply-To: <54125DA6FB3A3249B874A94D39E9E6D9038EED22@BENDER.centenarycollege.edu>
References: <54125DA6FB3A3249B874A94D39E9E6D9038EED22@BENDER.centenarycollege.edu>
Message-ID: <48DD207D.7090307@jonkmans.com>

Is there a port range we could narrow down to?

That distance, did you mean for it to apply to the second content match?

Dsize limit maybe? That'd help performance-wise.

Thanks Christopher!!

Matt

Campesi, Christopher wrote:
> Ares Galaxy 2.0.9
> 
>  
> 
> alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg: ?Ares Server
> Connection";content:"r|be|bloop|00|dV";flow:to_server;distance:16;content:"Ares|00
> 0a|";classtype:policy-violation;reference:url,aresgalaxy.sourceforge.net;sid:XXXXXXXX;rev:1;)
> 
>  
> 
> Chris**
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From jonkman at jonkmans.com  Fri Sep 26 13:50:16 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Fri, 26 Sep 2008 13:50:16 -0400
Subject: [Emerging-Sigs] Malware consistency between 2007712 and 2008011
In-Reply-To: <839aec700809251622n199e4c4elfda5bcb73f585c10@mail.gmail.com>
References: <839aec700809251622n199e4c4elfda5bcb73f585c10@mail.gmail.com>
Message-ID: <48DD20D8.5080200@jonkmans.com>

You're definitely right Darren. I'll combine these down to one.

Great catch!

Thanks

Matt

Darren Spruell wrote:
> emerging-virus.rules:
> 
> alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET TROJAN
> Pakes/Cutwall/Kobcka Update Detected High Ports";
> flow:established,to_server; content:"GET "; depth:4; content:"|0d
> 0a|Host\: "; distance:0; content:"|0d 0a|X-Flags\: "; distance:0;
> within:40; content:"|0d 0a|X-TM\:"; distance:0; content:"|0d 0a|X-BI\:
> "; distance:0; classtype:trojan-activity; sid:2008011; rev:3;)
> 
> alert tcp $HOME_NET any -> $EXTERNAL_NET 4099 (msg:"ET TROJAN Srizbi
> requesting template"; flow:established,to_server; content:"GET|20|/";
> depth:5; content:"|0d0a|X-Flags|3a20|";  within:200;
> content:"|0d0a|X-TM|3a20|"; within:20;  content:"|0d0a|X-BI|3a20|";
> within:20; reference:url,www.secureworks.com/research/threats/ronpaul/;
> classtype:trojan-activity; sid:2007712; rev:5;)
> 
> My experience with this payload suggests the Srizbi association is
> accurate; maybe useful to de-duplicate these rules?
> 

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From campesic at centenarycollege.edu  Fri Sep 26 14:34:27 2008
From: campesic at centenarycollege.edu (Campesi, Christopher)
Date: Fri, 26 Sep 2008 14:34:27 -0400
Subject: [Emerging-Sigs] Ares Galaxy Connection
In-Reply-To: <48DD207D.7090307@jonkmans.com>
References: <54125DA6FB3A3249B874A94D39E9E6D9038EED22@BENDER.centenarycollege.edu>
	<48DD207D.7090307@jonkmans.com>
Message-ID: <54125DA6FB3A3249B874A94D39E9E6D9038EED5A@BENDER.centenarycollege.edu>

Sorry bout that.. 
I did several more caps and so far they consistently hit on these ports:
10210,12163,23811,36281
Then the bloop packets stop and go into a bunch of udp packets but Ares
never connects to the service.

Yea the distance to the second match
Dsize might be < 65
The total byte content is 64

Chris


-----Original Message-----
From: Matt Jonkman [mailto:jonkman at jonkmans.com] 
Sent: Friday, September 26, 2008 1:49 PM
To: Campesi, Christopher
Cc: emerging-sigs at emergingthreats.net
Subject: Re: [Emerging-Sigs] Ares Galaxy Connection

Is there a port range we could narrow down to?

That distance, did you mean for it to apply to the second content match?

Dsize limit maybe? That'd help performance-wise.

Thanks Christopher!!

Matt

Campesi, Christopher wrote:
> Ares Galaxy 2.0.9
> 
>  
> 
> alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg: "Ares Server
>
Connection";content:"r|be|bloop|00|dV";flow:to_server;distance:16;conten
t:"Ares|00
>
0a|";classtype:policy-violation;reference:url,aresgalaxy.sourceforge.net
;sid:XXXXXXXX;rev:1;)
> 
>  
> 
> Chris**
> 
> 
>
------------------------------------------------------------------------
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From jonkman at jonkmans.com  Fri Sep 26 14:49:34 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Fri, 26 Sep 2008 14:49:34 -0400
Subject: [Emerging-Sigs] Ares Galaxy Connection
In-Reply-To: <54125DA6FB3A3249B874A94D39E9E6D9038EED5A@BENDER.centenarycollege.edu>
References: <54125DA6FB3A3249B874A94D39E9E6D9038EED22@BENDER.centenarycollege.edu>	<48DD207D.7090307@jonkmans.com>
	<54125DA6FB3A3249B874A94D39E9E6D9038EED5A@BENDER.centenarycollege.edu>
Message-ID: <48DD2EBE.3010605@jonkmans.com>

Ahh, that works! So we can go high ports and the dsize. Makes this much
nicer, like:

alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET P2P Ares
Server Connection"; flow:established,to_server; dsize:<70;
content:"r|be|bloop|00|dV"; content:"Ares|00 0a|"; distance:16;
classtype:trojan-activity; reference:url,aresgalaxy.sourceforge.net;
sid:2008591; rev:1;)

Look good to all?

Thanks again Christopher!

matt



Campesi, Christopher wrote:
> Sorry bout that.. 
> I did several more caps and so far they consistently hit on these ports:
> 10210,12163,23811,36281
> Then the bloop packets stop and go into a bunch of udp packets but Ares
> never connects to the service.
> 
> Yea the distance to the second match
> Dsize might be < 65
> The total byte content is 64
> 
> Chris
> 
> 
> -----Original Message-----
> From: Matt Jonkman [mailto:jonkman at jonkmans.com] 
> Sent: Friday, September 26, 2008 1:49 PM
> To: Campesi, Christopher
> Cc: emerging-sigs at emergingthreats.net
> Subject: Re: [Emerging-Sigs] Ares Galaxy Connection
> 
> Is there a port range we could narrow down to?
> 
> That distance, did you mean for it to apply to the second content match?
> 
> Dsize limit maybe? That'd help performance-wise.
> 
> Thanks Christopher!!
> 
> Matt
> 
> Campesi, Christopher wrote:
>> Ares Galaxy 2.0.9
>>
>>  
>>
>> alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg: "Ares Server
>>
> Connection";content:"r|be|bloop|00|dV";flow:to_server;distance:16;conten
> t:"Ares|00
> 0a|";classtype:policy-violation;reference:url,aresgalaxy.sourceforge.net
> ;sid:XXXXXXXX;rev:1;)
>>  
>>
>> Chris**
>>
>>
>>
> ------------------------------------------------------------------------
>> _______________________________________________
>> Emerging-sigs mailing list
>> Emerging-sigs at emergingthreats.net
>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
> 

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From campesic at centenarycollege.edu  Fri Sep 26 15:02:57 2008
From: campesic at centenarycollege.edu (Campesi, Christopher)
Date: Fri, 26 Sep 2008 15:02:57 -0400
Subject: [Emerging-Sigs] Ares Galaxy Connection
In-Reply-To: <48DD2EBE.3010605@jonkmans.com>
References: <54125DA6FB3A3249B874A94D39E9E6D9038EED22@BENDER.centenarycollege.edu>	<48DD207D.7090307@jonkmans.com>
	<54125DA6FB3A3249B874A94D39E9E6D9038EED5A@BENDER.centenarycollege.edu>
	<48DD2EBE.3010605@jonkmans.com>
Message-ID: <54125DA6FB3A3249B874A94D39E9E6D9038EED64@BENDER.centenarycollege.edu>

Classtype should be policy-violation since its P2P program...

Chris


-----Original Message-----
From: Matt Jonkman [mailto:jonkman at jonkmans.com] 
Sent: Friday, September 26, 2008 2:50 PM
To: Campesi, Christopher
Cc: emerging-sigs at emergingthreats.net
Subject: Re: [Emerging-Sigs] Ares Galaxy Connection

Ahh, that works! So we can go high ports and the dsize. Makes this much
nicer, like:

alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET P2P Ares
Server Connection"; flow:established,to_server; dsize:<70;
content:"r|be|bloop|00|dV"; content:"Ares|00 0a|"; distance:16;
classtype:trojan-activity; reference:url,aresgalaxy.sourceforge.net;
sid:2008591; rev:1;)

Look good to all?

Thanks again Christopher!

matt



Campesi, Christopher wrote:
> Sorry bout that.. 
> I did several more caps and so far they consistently hit on these
ports:
> 10210,12163,23811,36281
> Then the bloop packets stop and go into a bunch of udp packets but
Ares
> never connects to the service.
> 
> Yea the distance to the second match
> Dsize might be < 65
> The total byte content is 64
> 
> Chris
> 
> 
> -----Original Message-----
> From: Matt Jonkman [mailto:jonkman at jonkmans.com] 
> Sent: Friday, September 26, 2008 1:49 PM
> To: Campesi, Christopher
> Cc: emerging-sigs at emergingthreats.net
> Subject: Re: [Emerging-Sigs] Ares Galaxy Connection
> 
> Is there a port range we could narrow down to?
> 
> That distance, did you mean for it to apply to the second content
match?
> 
> Dsize limit maybe? That'd help performance-wise.
> 
> Thanks Christopher!!
> 
> Matt
> 
> Campesi, Christopher wrote:
>> Ares Galaxy 2.0.9
>>
>>  
>>
>> alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg: "Ares Server
>>
>
Connection";content:"r|be|bloop|00|dV";flow:to_server;distance:16;conten
> t:"Ares|00
>
0a|";classtype:policy-violation;reference:url,aresgalaxy.sourceforge.net
> ;sid:XXXXXXXX;rev:1;)
>>  
>>
>> Chris**
>>
>>
>>
>
------------------------------------------------------------------------
>> _______________________________________________
>> Emerging-sigs mailing list
>> Emerging-sigs at emergingthreats.net
>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
> 

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Fri Sep 26 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Fri, 26 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080926200008.DC91C45026@goliath.jonkmans.com>


[***] Results from Oinkmaster started Fri Sep 26 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008587 - ET TROJAN TroDjan 2.0 Infection Report (emerging-virus.rules)
 2008588 - ET TROJAN TroDjan 2.0 FTP Channel Open Command (emerging-virus.rules)
 2008589 - ET POLICY FTP Conversation on Low Port - Likely Hostile (TYPE A) (emerging-policy.rules)
 2008590 - ET POLICY FTP Conversation on Low Port - Likely Hostile (PASV) (emerging-policy.rules)
 2008591 - ET P2P Ares Server Connection (emerging-p2p.rules)
 2406020 - ET RBN Known Russian Business Network Monitored Domains (21) (emerging-rbn.rules)
 2407020 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (21) (emerging-rbn-BLOCK.rules)


[///]     Modified active rules:     [///]

 2001059 - ET P2P Ares traffic (emerging-p2p.rules)
 2007711 - ET TROJAN Srizbi registering with controller (emerging-virus.rules)
 2007712 - ET TROJAN Srizbi requesting template (emerging-virus.rules)
 2406000 - ET RBN Known Russian Business Network Monitored Domains (1) (emerging-rbn.rules)
 2406001 - ET RBN Known Russian Business Network Monitored Domains (2) (emerging-rbn.rules)
 2406002 - ET RBN Known Russian Business Network Monitored Domains (3) (emerging-rbn.rules)
 2406003 - ET RBN Known Russian Business Network Monitored Domains (4) (emerging-rbn.rules)
 2406004 - ET RBN Known Russian Business Network Monitored Domains (5) (emerging-rbn.rules)
 2406005 - ET RBN Known Russian Business Network Monitored Domains (6) (emerging-rbn.rules)
 2406006 - ET RBN Known Russian Business Network Monitored Domains (7) (emerging-rbn.rules)
 2406007 - ET RBN Known Russian Business Network Monitored Domains (8) (emerging-rbn.rules)
 2406008 - ET RBN Known Russian Business Network Monitored Domains (9) (emerging-rbn.rules)
 2406009 - ET RBN Known Russian Business Network Monitored Domains (10) (emerging-rbn.rules)
 2406010 - ET RBN Known Russian Business Network Monitored Domains (11) (emerging-rbn.rules)
 2406011 - ET RBN Known Russian Business Network Monitored Domains (12) (emerging-rbn.rules)
 2406012 - ET RBN Known Russian Business Network Monitored Domains (13) (emerging-rbn.rules)
 2406013 - ET RBN Known Russian Business Network Monitored Domains (14) (emerging-rbn.rules)
 2406014 - ET RBN Known Russian Business Network Monitored Domains (15) (emerging-rbn.rules)
 2406015 - ET RBN Known Russian Business Network Monitored Domains (16) (emerging-rbn.rules)
 2406016 - ET RBN Known Russian Business Network Monitored Domains (17) (emerging-rbn.rules)
 2406017 - ET RBN Known Russian Business Network Monitored Domains (18) (emerging-rbn.rules)
 2406018 - ET RBN Known Russian Business Network Monitored Domains (19) (emerging-rbn.rules)
 2406019 - ET RBN Known Russian Business Network Monitored Domains (20) (emerging-rbn.rules)
 2407000 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (1) (emerging-rbn-BLOCK.rules)
 2407001 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (2) (emerging-rbn-BLOCK.rules)
 2407002 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (3) (emerging-rbn-BLOCK.rules)
 2407003 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (4) (emerging-rbn-BLOCK.rules)
 2407004 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (5) (emerging-rbn-BLOCK.rules)
 2407005 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (6) (emerging-rbn-BLOCK.rules)
 2407006 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (7) (emerging-rbn-BLOCK.rules)
 2407007 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (8) (emerging-rbn-BLOCK.rules)
 2407008 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (9) (emerging-rbn-BLOCK.rules)
 2407009 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (10) (emerging-rbn-BLOCK.rules)
 2407010 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (11) (emerging-rbn-BLOCK.rules)
 2407011 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (12) (emerging-rbn-BLOCK.rules)
 2407012 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (13) (emerging-rbn-BLOCK.rules)
 2407013 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (14) (emerging-rbn-BLOCK.rules)
 2407014 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (15) (emerging-rbn-BLOCK.rules)
 2407015 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) (emerging-rbn-BLOCK.rules)
 2407016 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) (emerging-rbn-BLOCK.rules)
 2407017 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) (emerging-rbn-BLOCK.rules)
 2407018 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) (emerging-rbn-BLOCK.rules)
 2407019 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) (emerging-rbn-BLOCK.rules)


[---]         Removed rules:         [---]

 2001060 - ET P2P Ares GET (emerging-p2p.rules)
 2001756 - ET P2P Ares File Upload (emerging-p2p.rules)
 2008011 - ET TROJAN Pakes/Cutwall/Kobcka Update Detected High Ports (emerging-virus.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-p2p.rules (1):
        #by Christopher Campesi

     -> Added to emerging-rbn-BLOCK.rules (2):
        #  VERSION 63
        #  Updated 2008-09-25 09:04:53

     -> Added to emerging-rbn.rules (2):
        #  VERSION 63
        #  Updated 2008-09-25 09:04:53

     -> Added to emerging-sid-msg.map (7):
        2008587 || ET TROJAN TroDjan 2.0 Infection Report
        2008588 || ET TROJAN TroDjan 2.0 FTP Channel Open Command
        2008589 || ET POLICY FTP Conversation on Low Port - Likely Hostile (TYPE A)
        2008590 || ET POLICY FTP Conversation on Low Port - Likely Hostile (PASV)
        2008591 || ET P2P Ares Server Connection || url,aresgalaxy.sourceforge.net
        2406020 || ET RBN Known Russian Business Network Monitored Domains (21) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407020 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (21) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork

     -> Added to emerging-sid-msg.map.txt (7):
        2008587 || ET TROJAN TroDjan 2.0 Infection Report
        2008588 || ET TROJAN TroDjan 2.0 FTP Channel Open Command
        2008589 || ET POLICY FTP Conversation on Low Port - Likely Hostile (TYPE A)
        2008590 || ET POLICY FTP Conversation on Low Port - Likely Hostile (PASV)
        2008591 || ET P2P Ares Server Connection || url,aresgalaxy.sourceforge.net
        2406020 || ET RBN Known Russian Business Network Monitored Domains (21) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407020 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (21) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork

     -> Added to emerging-virus.rules (1):
        #by Christopher Campesi

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-rbn-BLOCK.rules (2):
        #  VERSION 62
        #  Updated 2008-09-24 10:05:47

     -> Removed from emerging-rbn.rules (2):
        #  VERSION 62
        #  Updated 2008-09-24 10:05:47

     -> Removed from emerging-sid-msg.map (3):
        2001060 || ET P2P Ares GET || url,www.aresgalaxy.org
        2001756 || ET P2P Ares File Upload || url,www.aresgalaxy.org
        2008011 || ET TROJAN Pakes/Cutwall/Kobcka Update Detected High Ports

     -> Removed from emerging-sid-msg.map.txt (3):
        2001060 || ET P2P Ares GET || url,www.aresgalaxy.org
        2001756 || ET P2P Ares File Upload || url,www.aresgalaxy.org
        2008011 || ET TROJAN Pakes/Cutwall/Kobcka Update Detected High Ports


From jonkman at jonkmans.com  Fri Sep 26 16:39:55 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Fri, 26 Sep 2008 16:39:55 -0400
Subject: [Emerging-Sigs] Ares Galaxy Connection
In-Reply-To: <54125DA6FB3A3249B874A94D39E9E6D9038EED64@BENDER.centenarycollege.edu>
References: <54125DA6FB3A3249B874A94D39E9E6D9038EED22@BENDER.centenarycollege.edu>	<48DD207D.7090307@jonkmans.com>
	<54125DA6FB3A3249B874A94D39E9E6D9038EED5A@BENDER.centenarycollege.edu>
	<48DD2EBE.3010605@jonkmans.com>
	<54125DA6FB3A3249B874A94D39E9E6D9038EED64@BENDER.centenarycollege.edu>
Message-ID: <48DD489B.1090609@jonkmans.com>

You are correct! Fixed.

Matt

Campesi, Christopher wrote:
> Classtype should be policy-violation since its P2P program...
> 
> Chris
> 
> 
> -----Original Message-----
> From: Matt Jonkman [mailto:jonkman at jonkmans.com] 
> Sent: Friday, September 26, 2008 2:50 PM
> To: Campesi, Christopher
> Cc: emerging-sigs at emergingthreats.net
> Subject: Re: [Emerging-Sigs] Ares Galaxy Connection
> 
> Ahh, that works! So we can go high ports and the dsize. Makes this much
> nicer, like:
> 
> alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET P2P Ares
> Server Connection"; flow:established,to_server; dsize:<70;
> content:"r|be|bloop|00|dV"; content:"Ares|00 0a|"; distance:16;
> classtype:trojan-activity; reference:url,aresgalaxy.sourceforge.net;
> sid:2008591; rev:1;)
> 
> Look good to all?
> 
> Thanks again Christopher!
> 
> matt
> 
> 
> 
> Campesi, Christopher wrote:
>> Sorry bout that.. 
>> I did several more caps and so far they consistently hit on these
> ports:
>> 10210,12163,23811,36281
>> Then the bloop packets stop and go into a bunch of udp packets but
> Ares
>> never connects to the service.
>>
>> Yea the distance to the second match
>> Dsize might be < 65
>> The total byte content is 64
>>
>> Chris
>>
>>
>> -----Original Message-----
>> From: Matt Jonkman [mailto:jonkman at jonkmans.com] 
>> Sent: Friday, September 26, 2008 1:49 PM
>> To: Campesi, Christopher
>> Cc: emerging-sigs at emergingthreats.net
>> Subject: Re: [Emerging-Sigs] Ares Galaxy Connection
>>
>> Is there a port range we could narrow down to?
>>
>> That distance, did you mean for it to apply to the second content
> match?
>> Dsize limit maybe? That'd help performance-wise.
>>
>> Thanks Christopher!!
>>
>> Matt
>>
>> Campesi, Christopher wrote:
>>> Ares Galaxy 2.0.9
>>>
>>>  
>>>
>>> alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg: "Ares Server
>>>
> Connection";content:"r|be|bloop|00|dV";flow:to_server;distance:16;conten
>> t:"Ares|00
>>
> 0a|";classtype:policy-violation;reference:url,aresgalaxy.sourceforge.net
>> ;sid:XXXXXXXX;rev:1;)
>>>  
>>>
>>> Chris**
>>>
>>>
>>>
> ------------------------------------------------------------------------
>>> _______________________________________________
>>> Emerging-sigs mailing list
>>> Emerging-sigs at emergingthreats.net
>>> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
> 

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Sat Sep 27 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Sat, 27 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080927200008.D3E3145026@goliath.jonkmans.com>


[***] Results from Oinkmaster started Sat Sep 27 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008592 - ET TROJAN Nbar.co.kr Related Trojan Checkin (emerging-virus.rules)


[///]     Modified active rules:     [///]

 2008591 - ET P2P Ares Server Connection (emerging-p2p.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-sid-msg.map (1):
        2008592 || ET TROJAN Nbar.co.kr Related Trojan Checkin

     -> Added to emerging-sid-msg.map.txt (1):
        2008592 || ET TROJAN Nbar.co.kr Related Trojan Checkin


From emerging at emergingthreats.net  Sat Sep 27 18:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Sat, 27 Sep 2008 18:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Weekly Signature Changes
Message-ID: <20080927220008.2B77D45026@goliath.jonkmans.com>


[***] Results from Oinkmaster started Sat Sep 27 18:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008577 - ET SCAN Voiper Fuzzing Scan (emerging-scan.rules)
 2008578 - ET SCAN Sipvicious Scan (emerging-scan.rules)
 2008579 - ET SCAN Sipp SIP Stress Test Detected (emerging-scan.rules)
 2008580 - ET TROJAN Trojan Sinowal Phoning Home (emerging-virus.rules)
 2008581 - ET P2P BitTorrent DHT ping request (emerging-p2p.rules)
 2008582 - ET P2P BitTorrent DHT find_node request (emerging-p2p.rules)
 2008583 - ET P2P BitTorrent DHT nodes reply (emerging-p2p.rules)
 2008584 - ET P2P BitTorrent DHT get_peers request (emerging-p2p.rules)
 2008585 - ET P2P BitTorrent DHT announce_peers request (emerging-p2p.rules)
 2008586 - ET MALWARE Casino Related Spyware User-Agent Detected (Viper 4.0) (emerging-malware.rules)
 2008587 - ET TROJAN TroDjan 2.0 Infection Report (emerging-virus.rules)
 2008588 - ET TROJAN TroDjan 2.0 FTP Channel Open Command (emerging-virus.rules)
 2008589 - ET POLICY FTP Conversation on Low Port - Likely Hostile (TYPE A) (emerging-policy.rules)
 2008590 - ET POLICY FTP Conversation on Low Port - Likely Hostile (PASV) (emerging-policy.rules)
 2008591 - ET P2P Ares Server Connection (emerging-p2p.rules)
 2008592 - ET TROJAN Nbar.co.kr Related Trojan Checkin (emerging-virus.rules)
 2406020 - ET RBN Known Russian Business Network Monitored Domains (21) (emerging-rbn.rules)
 2407020 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (21) (emerging-rbn-BLOCK.rules)


[///]     Modified active rules:     [///]

 2001059 - ET P2P Ares traffic (emerging-p2p.rules)
 2003484 - ET WORM Allaple Unique HTTP Request - Possibly part of DDOS (emerging-virus.rules)
 2007711 - ET TROJAN Srizbi registering with controller (emerging-virus.rules)
 2007712 - ET TROJAN Srizbi requesting template (emerging-virus.rules)
 2008576 - ET TROJAN TinyPE Binary - Possibly Hostile (emerging-virus.rules)
 2400000 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400001 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400002 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400003 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400004 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400005 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400006 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2400007 - ET DROP Spamhaus DROP Listed Traffic Inbound (emerging-drop.rules)
 2401000 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401001 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401002 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401003 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401004 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401005 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401006 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2401007 - ET DROP Spamhaus DROP Listed Traffic Inbound - BLOCKING SOURCE (emerging-drop-BLOCK.rules)
 2402000 - ET DROP Dshield Block Listed Source (emerging-dshield.rules)
 2403000 - ET DROP Dshield Block Listed Source - BLOCKING (emerging-dshield-BLOCK.rules)
 2404000 - ET DROP Known Bot C&C Server Traffic (group 1)  (emerging-botcc.rules)
 2404001 - ET DROP Known Bot C&C Server Traffic (group 2)  (emerging-botcc.rules)
 2404002 - ET DROP Known Bot C&C Server Traffic (group 3)  (emerging-botcc.rules)
 2404003 - ET DROP Known Bot C&C Server Traffic (group 4)  (emerging-botcc.rules)
 2404004 - ET DROP Known Bot C&C Server Traffic (group 5)  (emerging-botcc.rules)
 2404005 - ET DROP Known Bot C&C Server Traffic (group 6)  (emerging-botcc.rules)
 2404006 - ET DROP Known Bot C&C Server Traffic (group 7)  (emerging-botcc.rules)
 2404007 - ET DROP Known Bot C&C Server Traffic (group 8)  (emerging-botcc.rules)
 2404008 - ET DROP Known Bot C&C Server Traffic (group 9)  (emerging-botcc.rules)
 2404009 - ET DROP Known Bot C&C Server Traffic (group 10)  (emerging-botcc.rules)
 2404010 - ET DROP Known Bot C&C Server Traffic (group 11)  (emerging-botcc.rules)
 2404011 - ET DROP Known Bot C&C Server Traffic (group 12)  (emerging-botcc.rules)
 2404012 - ET DROP Known Bot C&C Server Traffic (group 13)  (emerging-botcc.rules)
 2404013 - ET DROP Known Bot C&C Server Traffic (group 14)  (emerging-botcc.rules)
 2404014 - ET DROP Known Bot C&C Server Traffic (group 15)  (emerging-botcc.rules)
 2404015 - ET DROP Known Bot C&C Server Traffic (group 16)  (emerging-botcc.rules)
 2404016 - ET DROP Known Bot C&C Server Traffic (group 17)  (emerging-botcc.rules)
 2404017 - ET DROP Known Bot C&C Server Traffic (group 18)  (emerging-botcc.rules)
 2404018 - ET DROP Known Bot C&C Server Traffic (group 19)  (emerging-botcc.rules)
 2404019 - ET DROP Known Bot C&C Server Traffic (group 20)  (emerging-botcc.rules)
 2404020 - ET DROP Known Bot C&C Server Traffic (group 21)  (emerging-botcc.rules)
 2405000 - ET DROP Known Bot C&C Traffic (group 1) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405001 - ET DROP Known Bot C&C Traffic (group 2) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405002 - ET DROP Known Bot C&C Traffic (group 3) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405003 - ET DROP Known Bot C&C Traffic (group 4) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405004 - ET DROP Known Bot C&C Traffic (group 5) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405005 - ET DROP Known Bot C&C Traffic (group 6) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405006 - ET DROP Known Bot C&C Traffic (group 7) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405007 - ET DROP Known Bot C&C Traffic (group 8) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405008 - ET DROP Known Bot C&C Traffic (group 9) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405009 - ET DROP Known Bot C&C Traffic (group 10) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405010 - ET DROP Known Bot C&C Traffic (group 11) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405011 - ET DROP Known Bot C&C Traffic (group 12) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405012 - ET DROP Known Bot C&C Traffic (group 13) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405013 - ET DROP Known Bot C&C Traffic (group 14) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405014 - ET DROP Known Bot C&C Traffic (group 15) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405015 - ET DROP Known Bot C&C Traffic (group 16) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405016 - ET DROP Known Bot C&C Traffic (group 17) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405017 - ET DROP Known Bot C&C Traffic (group 18) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405018 - ET DROP Known Bot C&C Traffic (group 19) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405019 - ET DROP Known Bot C&C Traffic (group 20) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2405020 - ET DROP Known Bot C&C Traffic (group 21) - BLOCKING SOURCE (emerging-botcc-BLOCK.rules)
 2406000 - ET RBN Known Russian Business Network Monitored Domains (1) (emerging-rbn.rules)
 2406001 - ET RBN Known Russian Business Network Monitored Domains (2) (emerging-rbn.rules)
 2406002 - ET RBN Known Russian Business Network Monitored Domains (3) (emerging-rbn.rules)
 2406003 - ET RBN Known Russian Business Network Monitored Domains (4) (emerging-rbn.rules)
 2406004 - ET RBN Known Russian Business Network Monitored Domains (5) (emerging-rbn.rules)
 2406005 - ET RBN Known Russian Business Network Monitored Domains (6) (emerging-rbn.rules)
 2406006 - ET RBN Known Russian Business Network Monitored Domains (7) (emerging-rbn.rules)
 2406007 - ET RBN Known Russian Business Network Monitored Domains (8) (emerging-rbn.rules)
 2406008 - ET RBN Known Russian Business Network Monitored Domains (9) (emerging-rbn.rules)
 2406009 - ET RBN Known Russian Business Network Monitored Domains (10) (emerging-rbn.rules)
 2406010 - ET RBN Known Russian Business Network Monitored Domains (11) (emerging-rbn.rules)
 2406011 - ET RBN Known Russian Business Network Monitored Domains (12) (emerging-rbn.rules)
 2406012 - ET RBN Known Russian Business Network Monitored Domains (13) (emerging-rbn.rules)
 2406013 - ET RBN Known Russian Business Network Monitored Domains (14) (emerging-rbn.rules)
 2406014 - ET RBN Known Russian Business Network Monitored Domains (15) (emerging-rbn.rules)
 2406015 - ET RBN Known Russian Business Network Monitored Domains (16) (emerging-rbn.rules)
 2406016 - ET RBN Known Russian Business Network Monitored Domains (17) (emerging-rbn.rules)
 2406017 - ET RBN Known Russian Business Network Monitored Domains (18) (emerging-rbn.rules)
 2406018 - ET RBN Known Russian Business Network Monitored Domains (19) (emerging-rbn.rules)
 2406019 - ET RBN Known Russian Business Network Monitored Domains (20) (emerging-rbn.rules)
 2407000 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (1) (emerging-rbn-BLOCK.rules)
 2407001 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (2) (emerging-rbn-BLOCK.rules)
 2407002 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (3) (emerging-rbn-BLOCK.rules)
 2407003 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (4) (emerging-rbn-BLOCK.rules)
 2407004 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (5) (emerging-rbn-BLOCK.rules)
 2407005 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (6) (emerging-rbn-BLOCK.rules)
 2407006 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (7) (emerging-rbn-BLOCK.rules)
 2407007 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (8) (emerging-rbn-BLOCK.rules)
 2407008 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (9) (emerging-rbn-BLOCK.rules)
 2407009 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (10) (emerging-rbn-BLOCK.rules)
 2407010 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (11) (emerging-rbn-BLOCK.rules)
 2407011 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (12) (emerging-rbn-BLOCK.rules)
 2407012 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (13) (emerging-rbn-BLOCK.rules)
 2407013 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (14) (emerging-rbn-BLOCK.rules)
 2407014 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (15) (emerging-rbn-BLOCK.rules)
 2407015 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) (emerging-rbn-BLOCK.rules)
 2407016 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) (emerging-rbn-BLOCK.rules)
 2407017 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) (emerging-rbn-BLOCK.rules)
 2407018 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) (emerging-rbn-BLOCK.rules)
 2407019 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) (emerging-rbn-BLOCK.rules)


[---]         Removed rules:         [---]

 2001060 - ET P2P Ares GET (emerging-p2p.rules)
 2001756 - ET P2P Ares File Upload (emerging-p2p.rules)
 2002969 - ET POLICY Microsoft BITS User Agent (emerging-policy.rules)
 2008011 - ET TROJAN Pakes/Cutwall/Kobcka Update Detected High Ports (emerging-virus.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-drop-BLOCK.rules (2):
        #  VERSION 1309
        #  Generated 2008-09-27 00:03:02 EDT

     -> Added to emerging-drop.rules (2):
        #  VERSION 1309
        #  Generated 2008-09-27 00:03:02 EDT

     -> Added to emerging-p2p.rules (2):
        #by Christopher Campesi
        #Trackerless torrents, by David Bianco

     -> Added to emerging-rbn-BLOCK.rules (2):
        #  VERSION 63
        #  Updated 2008-09-25 09:04:53

     -> Added to emerging-rbn.rules (2):
        #  VERSION 63
        #  Updated 2008-09-25 09:04:53

     -> Added to emerging-sid-msg.map (179):
        2003484 || ET WORM Allaple Unique HTTP Request - Possibly part of DDOS || url,isc.sans.org/diary.html?storyid=2451 || url,doc.emergingthreats.net/2003484
        2008577 || ET SCAN Voiper Fuzzing Scan || url,sourceforge.net/projects/voiper
        2008578 || ET SCAN Sipvicious Scan || url,sipvicious.org/blog/
        2008579 || ET SCAN Sipp SIP Stress Test Detected || url,sourceforge.net/projects/sipp/
        2008580 || ET TROJAN Trojan Sinowal Phoning Home
        2008581 || ET P2P BitTorrent DHT ping request || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008582 || ET P2P BitTorrent DHT find_node request || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008583 || ET P2P BitTorrent DHT nodes reply || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008584 || ET P2P BitTorrent DHT get_peers request || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008585 || ET P2P BitTorrent DHT announce_peers request || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008586 || ET MALWARE Casino Related Spyware User-Agent Detected (Viper 4.0)
        2008587 || ET TROJAN TroDjan 2.0 Infection Report
        2008588 || ET TROJAN TroDjan 2.0 FTP Channel Open Command
        2008589 || ET POLICY FTP Conversation on Low Port - Likely Hostile (TYPE A)
        2008590 || ET POLICY FTP Conversation on Low Port - Likely Hostile (PASV)
        2008591 || ET P2P Ares Server Connection || url,aresgalaxy.sourceforge.net
        2008592 || ET TROJAN Nbar.co.kr Related Trojan Checkin
        2406020 || ET RBN Known Russian Business Network Monitored Domains (21) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407020 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (21) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2500001 || ET COMPROMISED Known Compromised or Hostile Host Traffic (2) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500002 || ET COMPROMISED Known Compromised or Hostile Host Traffic (3) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500003 || ET COMPROMISED Known Compromised or Hostile Host Traffic (4) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500004 || ET COMPROMISED Known Compromised or Hostile Host Traffic (5) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500005 || ET COMPROMISED Known Compromised or Hostile Host Traffic (6) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500006 || ET COMPROMISED Known Compromised or Hostile Host Traffic (7) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500007 || ET COMPROMISED Known Compromised or Hostile Host Traffic (8) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500008 || ET COMPROMISED Known Compromised or Hostile Host Traffic (9) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500009 || ET COMPROMISED Known Compromised or Hostile Host Traffic (10) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500010 || ET COMPROMISED Known Compromised or Hostile Host Traffic (11) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500011 || ET COMPROMISED Known Compromised or Hostile Host Traffic (12) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500012 || ET COMPROMISED Known Compromised or Hostile Host Traffic (13) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500013 || ET COMPROMISED Known Compromised or Hostile Host Traffic (14) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500014 || ET COMPROMISED Known Compromised or Hostile Host Traffic (15) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500015 || ET COMPROMISED Known Compromised or Hostile Host Traffic (16) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500016 || ET COMPROMISED Known Compromised or Hostile Host Traffic (17) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500017 || ET COMPROMISED Known Compromised or Hostile Host Traffic (18) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500018 || ET COMPROMISED Known Compromised or Hostile Host Traffic (19) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500019 || ET COMPROMISED Known Compromised or Hostile Host Traffic (20) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500020 || ET COMPROMISED Known Compromised or Hostile Host Traffic (21) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500021 || ET COMPROMISED Known Compromised or Hostile Host Traffic (22) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500022 || ET COMPROMISED Known Compromised or Hostile Host Traffic (23) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500023 || ET COMPROMISED Known Compromised or Hostile Host Traffic (24) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500024 || ET COMPROMISED Known Compromised or Hostile Host Traffic (25) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500025 || ET COMPROMISED Known Compromised or Hostile Host Traffic (26) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500026 || ET COMPROMISED Known Compromised or Hostile Host Traffic (27) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500027 || ET COMPROMISED Known Compromised or Hostile Host Traffic (28) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500028 || ET COMPROMISED Known Compromised or Hostile Host Traffic (29) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500029 || ET COMPROMISED Known Compromised or Hostile Host Traffic (30) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500030 || ET COMPROMISED Known Compromised or Hostile Host Traffic (31) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500031 || ET COMPROMISED Known Compromised or Hostile Host Traffic (32) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500032 || ET COMPROMISED Known Compromised or Hostile Host Traffic (33) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500033 || ET COMPROMISED Known Compromised or Hostile Host Traffic (34) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500034 || ET COMPROMISED Known Compromised or Hostile Host Traffic (35) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500035 || ET COMPROMISED Known Compromised or Hostile Host Traffic (36) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500036 || ET COMPROMISED Known Compromised or Hostile Host Traffic (37) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500037 || ET COMPROMISED Known Compromised or Hostile Host Traffic (38) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500038 || ET COMPROMISED Known Compromised or Hostile Host Traffic (39) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500039 || ET COMPROMISED Known Compromised or Hostile Host Traffic (40) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500040 || ET COMPROMISED Known Compromised or Hostile Host Traffic (41) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500041 || ET COMPROMISED Known Compromised or Hostile Host Traffic (42) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500042 || ET COMPROMISED Known Compromised or Hostile Host Traffic (43) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500043 || ET COMPROMISED Known Compromised or Hostile Host Traffic (44) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500044 || ET COMPROMISED Known Compromised or Hostile Host Traffic (45) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500045 || ET COMPROMISED Known Compromised or Hostile Host Traffic (46) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500046 || ET COMPROMISED Known Compromised or Hostile Host Traffic (47) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500047 || ET COMPROMISED Known Compromised or Hostile Host Traffic (48) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500048 || ET COMPROMISED Known Compromised or Hostile Host Traffic (49) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500049 || ET COMPROMISED Known Compromised or Hostile Host Traffic (50) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500050 || ET COMPROMISED Known Compromised or Hostile Host Traffic (51) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500051 || ET COMPROMISED Known Compromised or Hostile Host Traffic (52) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500052 || ET COMPROMISED Known Compromised or Hostile Host Traffic (53) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500053 || ET COMPROMISED Known Compromised or Hostile Host Traffic (54) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500054 || ET COMPROMISED Known Compromised or Hostile Host Traffic (55) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500055 || ET COMPROMISED Known Compromised or Hostile Host Traffic (56) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500056 || ET COMPROMISED Known Compromised or Hostile Host Traffic (57) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500057 || ET COMPROMISED Known Compromised or Hostile Host Traffic (58) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500058 || ET COMPROMISED Known Compromised or Hostile Host Traffic (59) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500059 || ET COMPROMISED Known Compromised or Hostile Host Traffic (60) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500060 || ET COMPROMISED Known Compromised or Hostile Host Traffic (61) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500061 || ET COMPROMISED Known Compromised or Hostile Host Traffic (62) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500062 || ET COMPROMISED Known Compromised or Hostile Host Traffic (63) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500063 || ET COMPROMISED Known Compromised or Hostile Host Traffic (64) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500064 || ET COMPROMISED Known Compromised or Hostile Host Traffic (65) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500065 || ET COMPROMISED Known Compromised or Hostile Host Traffic (66) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500066 || ET COMPROMISED Known Compromised or Hostile Host Traffic (67) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500067 || ET COMPROMISED Known Compromised or Hostile Host Traffic (68) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500068 || ET COMPROMISED Known Compromised or Hostile Host Traffic (69) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500069 || ET COMPROMISED Known Compromised or Hostile Host Traffic (70) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500070 || ET COMPROMISED Known Compromised or Hostile Host Traffic (71) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500071 || ET COMPROMISED Known Compromised or Hostile Host Traffic (72) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500072 || ET COMPROMISED Known Compromised or Hostile Host Traffic (73) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500073 || ET COMPROMISED Known Compromised or Hostile Host Traffic (74) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500074 || ET COMPROMISED Known Compromised or Hostile Host Traffic (75) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500075 || ET COMPROMISED Known Compromised or Hostile Host Traffic (76) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500076 || ET COMPROMISED Known Compromised or Hostile Host Traffic (77) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500077 || ET COMPROMISED Known Compromised or Hostile Host Traffic (78) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500078 || ET COMPROMISED Known Compromised or Hostile Host Traffic (79) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500079 || ET COMPROMISED Known Compromised or Hostile Host Traffic (80) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500080 || ET COMPROMISED Known Compromised or Hostile Host Traffic (81) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510001 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (2) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510002 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (3) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510003 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (4) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510004 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (5) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510005 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (6) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510006 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (7) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510007 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (8) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510008 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (9) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510009 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (10) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510010 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (11) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510011 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (12) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510012 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (13) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510013 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (14) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510014 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (15) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510015 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (16) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510016 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (17) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510017 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (18) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510018 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (19) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510019 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (20) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510020 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (21) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510021 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (22) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510022 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (23) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510023 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (24) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510024 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (25) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510025 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (26) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510026 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (27) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510027 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (28) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510028 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (29) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510029 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (30) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510030 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (31) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510031 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (32) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510032 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (33) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510033 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (34) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510034 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (35) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510035 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (36) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510036 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (37) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510037 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (38) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510038 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (39) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510039 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (40) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510040 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (41) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510041 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (42) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510042 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (43) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510043 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (44) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510044 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (45) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510045 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (46) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510046 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (47) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510047 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (48) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510048 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (49) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510049 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (50) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510050 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (51) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510051 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (52) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510052 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (53) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510053 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (54) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510054 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (55) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510055 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (56) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510056 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (57) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510057 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (58) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510058 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (59) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510059 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (60) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510060 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (61) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510061 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (62) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510062 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (63) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510063 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (64) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510064 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (65) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510065 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (66) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510066 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (67) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510067 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (68) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510068 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (69) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510069 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (70) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510070 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (71) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510071 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (72) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510072 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (73) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510073 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (74) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510074 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (75) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510075 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (76) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510076 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (77) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510077 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (78) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510078 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (79) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510079 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (80) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510080 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (81) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts

     -> Added to emerging-sid-msg.map.txt (179):
        2003484 || ET WORM Allaple Unique HTTP Request - Possibly part of DDOS || url,isc.sans.org/diary.html?storyid=2451 || url,doc.emergingthreats.net/2003484
        2008577 || ET SCAN Voiper Fuzzing Scan || url,sourceforge.net/projects/voiper
        2008578 || ET SCAN Sipvicious Scan || url,sipvicious.org/blog/
        2008579 || ET SCAN Sipp SIP Stress Test Detected || url,sourceforge.net/projects/sipp/
        2008580 || ET TROJAN Trojan Sinowal Phoning Home
        2008581 || ET P2P BitTorrent DHT ping request || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008582 || ET P2P BitTorrent DHT find_node request || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008583 || ET P2P BitTorrent DHT nodes reply || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008584 || ET P2P BitTorrent DHT get_peers request || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008585 || ET P2P BitTorrent DHT announce_peers request || url,wiki.theory.org/BitTorrentDraftDHTProtocol
        2008586 || ET MALWARE Casino Related Spyware User-Agent Detected (Viper 4.0)
        2008587 || ET TROJAN TroDjan 2.0 Infection Report
        2008588 || ET TROJAN TroDjan 2.0 FTP Channel Open Command
        2008589 || ET POLICY FTP Conversation on Low Port - Likely Hostile (TYPE A)
        2008590 || ET POLICY FTP Conversation on Low Port - Likely Hostile (PASV)
        2008591 || ET P2P Ares Server Connection || url,aresgalaxy.sourceforge.net
        2008592 || ET TROJAN Nbar.co.kr Related Trojan Checkin
        2406020 || ET RBN Known Russian Business Network Monitored Domains (21) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407020 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (21) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2500001 || ET COMPROMISED Known Compromised or Hostile Host Traffic (2) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500002 || ET COMPROMISED Known Compromised or Hostile Host Traffic (3) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500003 || ET COMPROMISED Known Compromised or Hostile Host Traffic (4) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500004 || ET COMPROMISED Known Compromised or Hostile Host Traffic (5) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500005 || ET COMPROMISED Known Compromised or Hostile Host Traffic (6) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500006 || ET COMPROMISED Known Compromised or Hostile Host Traffic (7) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500007 || ET COMPROMISED Known Compromised or Hostile Host Traffic (8) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500008 || ET COMPROMISED Known Compromised or Hostile Host Traffic (9) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500009 || ET COMPROMISED Known Compromised or Hostile Host Traffic (10) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500010 || ET COMPROMISED Known Compromised or Hostile Host Traffic (11) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500011 || ET COMPROMISED Known Compromised or Hostile Host Traffic (12) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500012 || ET COMPROMISED Known Compromised or Hostile Host Traffic (13) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500013 || ET COMPROMISED Known Compromised or Hostile Host Traffic (14) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500014 || ET COMPROMISED Known Compromised or Hostile Host Traffic (15) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500015 || ET COMPROMISED Known Compromised or Hostile Host Traffic (16) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500016 || ET COMPROMISED Known Compromised or Hostile Host Traffic (17) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500017 || ET COMPROMISED Known Compromised or Hostile Host Traffic (18) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500018 || ET COMPROMISED Known Compromised or Hostile Host Traffic (19) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500019 || ET COMPROMISED Known Compromised or Hostile Host Traffic (20) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500020 || ET COMPROMISED Known Compromised or Hostile Host Traffic (21) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500021 || ET COMPROMISED Known Compromised or Hostile Host Traffic (22) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500022 || ET COMPROMISED Known Compromised or Hostile Host Traffic (23) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500023 || ET COMPROMISED Known Compromised or Hostile Host Traffic (24) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500024 || ET COMPROMISED Known Compromised or Hostile Host Traffic (25) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500025 || ET COMPROMISED Known Compromised or Hostile Host Traffic (26) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500026 || ET COMPROMISED Known Compromised or Hostile Host Traffic (27) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500027 || ET COMPROMISED Known Compromised or Hostile Host Traffic (28) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500028 || ET COMPROMISED Known Compromised or Hostile Host Traffic (29) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500029 || ET COMPROMISED Known Compromised or Hostile Host Traffic (30) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500030 || ET COMPROMISED Known Compromised or Hostile Host Traffic (31) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500031 || ET COMPROMISED Known Compromised or Hostile Host Traffic (32) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500032 || ET COMPROMISED Known Compromised or Hostile Host Traffic (33) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500033 || ET COMPROMISED Known Compromised or Hostile Host Traffic (34) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500034 || ET COMPROMISED Known Compromised or Hostile Host Traffic (35) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500035 || ET COMPROMISED Known Compromised or Hostile Host Traffic (36) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500036 || ET COMPROMISED Known Compromised or Hostile Host Traffic (37) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500037 || ET COMPROMISED Known Compromised or Hostile Host Traffic (38) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500038 || ET COMPROMISED Known Compromised or Hostile Host Traffic (39) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500039 || ET COMPROMISED Known Compromised or Hostile Host Traffic (40) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500040 || ET COMPROMISED Known Compromised or Hostile Host Traffic (41) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500041 || ET COMPROMISED Known Compromised or Hostile Host Traffic (42) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500042 || ET COMPROMISED Known Compromised or Hostile Host Traffic (43) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500043 || ET COMPROMISED Known Compromised or Hostile Host Traffic (44) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500044 || ET COMPROMISED Known Compromised or Hostile Host Traffic (45) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500045 || ET COMPROMISED Known Compromised or Hostile Host Traffic (46) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500046 || ET COMPROMISED Known Compromised or Hostile Host Traffic (47) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500047 || ET COMPROMISED Known Compromised or Hostile Host Traffic (48) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500048 || ET COMPROMISED Known Compromised or Hostile Host Traffic (49) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500049 || ET COMPROMISED Known Compromised or Hostile Host Traffic (50) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500050 || ET COMPROMISED Known Compromised or Hostile Host Traffic (51) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500051 || ET COMPROMISED Known Compromised or Hostile Host Traffic (52) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500052 || ET COMPROMISED Known Compromised or Hostile Host Traffic (53) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500053 || ET COMPROMISED Known Compromised or Hostile Host Traffic (54) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500054 || ET COMPROMISED Known Compromised or Hostile Host Traffic (55) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500055 || ET COMPROMISED Known Compromised or Hostile Host Traffic (56) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500056 || ET COMPROMISED Known Compromised or Hostile Host Traffic (57) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500057 || ET COMPROMISED Known Compromised or Hostile Host Traffic (58) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500058 || ET COMPROMISED Known Compromised or Hostile Host Traffic (59) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500059 || ET COMPROMISED Known Compromised or Hostile Host Traffic (60) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500060 || ET COMPROMISED Known Compromised or Hostile Host Traffic (61) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500061 || ET COMPROMISED Known Compromised or Hostile Host Traffic (62) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500062 || ET COMPROMISED Known Compromised or Hostile Host Traffic (63) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500063 || ET COMPROMISED Known Compromised or Hostile Host Traffic (64) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500064 || ET COMPROMISED Known Compromised or Hostile Host Traffic (65) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500065 || ET COMPROMISED Known Compromised or Hostile Host Traffic (66) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500066 || ET COMPROMISED Known Compromised or Hostile Host Traffic (67) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500067 || ET COMPROMISED Known Compromised or Hostile Host Traffic (68) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500068 || ET COMPROMISED Known Compromised or Hostile Host Traffic (69) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500069 || ET COMPROMISED Known Compromised or Hostile Host Traffic (70) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500070 || ET COMPROMISED Known Compromised or Hostile Host Traffic (71) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500071 || ET COMPROMISED Known Compromised or Hostile Host Traffic (72) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500072 || ET COMPROMISED Known Compromised or Hostile Host Traffic (73) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500073 || ET COMPROMISED Known Compromised or Hostile Host Traffic (74) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500074 || ET COMPROMISED Known Compromised or Hostile Host Traffic (75) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500075 || ET COMPROMISED Known Compromised or Hostile Host Traffic (76) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500076 || ET COMPROMISED Known Compromised or Hostile Host Traffic (77) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500077 || ET COMPROMISED Known Compromised or Hostile Host Traffic (78) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500078 || ET COMPROMISED Known Compromised or Hostile Host Traffic (79) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500079 || ET COMPROMISED Known Compromised or Hostile Host Traffic (80) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2500080 || ET COMPROMISED Known Compromised or Hostile Host Traffic (81) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510001 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (2) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510002 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (3) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510003 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (4) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510004 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (5) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510005 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (6) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510006 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (7) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510007 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (8) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510008 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (9) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510009 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (10) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510010 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (11) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510011 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (12) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510012 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (13) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510013 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (14) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510014 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (15) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510015 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (16) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510016 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (17) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510017 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (18) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510018 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (19) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510019 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (20) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510020 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (21) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510021 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (22) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510022 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (23) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510023 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (24) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510024 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (25) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510025 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (26) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510026 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (27) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510027 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (28) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510028 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (29) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510029 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (30) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510030 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (31) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510031 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (32) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510032 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (33) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510033 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (34) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510034 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (35) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510035 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (36) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510036 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (37) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510037 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (38) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510038 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (39) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510039 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (40) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510040 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (41) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510041 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (42) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510042 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (43) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510043 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (44) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510044 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (45) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510045 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (46) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510046 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (47) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510047 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (48) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510048 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (49) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510049 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (50) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510050 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (51) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510051 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (52) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510052 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (53) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510053 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (54) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510054 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (55) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510055 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (56) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510056 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (57) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510057 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (58) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510058 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (59) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510059 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (60) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510060 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (61) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510061 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (62) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510062 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (63) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510063 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (64) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510064 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (65) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510065 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (66) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510066 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (67) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510067 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (68) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510068 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (69) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510069 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (70) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510070 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (71) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510071 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (72) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510072 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (73) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510073 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (74) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510074 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (75) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510075 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (76) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510076 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (77) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510077 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (78) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510078 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (79) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510079 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (80) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts
        2510080 || ET COMPROMISED Known Compromised or Hostile Host Traffic - BLOCKING (81) || url,doc.emergingthreats.net/bin/view/Main/CompromisedHosts

     -> Added to emerging-virus.rules (1):
        #by Christopher Campesi

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-drop-BLOCK.rules (2):
        #  VERSION 1302
        #  Generated 2008-09-20 00:03:02 EDT

     -> Removed from emerging-drop.rules (2):
        #  VERSION 1302
        #  Generated 2008-09-20 00:03:02 EDT

     -> Removed from emerging-policy.rules (2):
        #Microsoft BITS (Background Intelligent Transfer Agent) user agent sig
        #Thresholded like the Windows-User-Agent user agent sig (after suggestion from Eduardo)

     -> Removed from emerging-rbn-BLOCK.rules (2):
        #  VERSION 60
        #  Updated 2008-09-09 12:41:40

     -> Removed from emerging-rbn.rules (2):
        #  VERSION 60
        #  Updated 2008-09-09 12:41:40

     -> Removed from emerging-sid-msg.map (5):
        2001060 || ET P2P Ares GET || url,www.aresgalaxy.org
        2001756 || ET P2P Ares File Upload || url,www.aresgalaxy.org
        2002969 || ET POLICY Microsoft BITS User Agent || url,au.download.windowsupdate.com
        2003484 || ET WORM Allaple Unique HTTP Request - Possibly part of DDOS || url,isc.sans.org/diary.html?storyid=2451 || url,doc.emergingthreats.net/2003483
        2008011 || ET TROJAN Pakes/Cutwall/Kobcka Update Detected High Ports

     -> Removed from emerging-sid-msg.map.txt (5):
        2001060 || ET P2P Ares GET || url,www.aresgalaxy.org
        2001756 || ET P2P Ares File Upload || url,www.aresgalaxy.org
        2002969 || ET POLICY Microsoft BITS User Agent || url,au.download.windowsupdate.com
        2003484 || ET WORM Allaple Unique HTTP Request - Possibly part of DDOS || url,isc.sans.org/diary.html?storyid=2451 || url,doc.emergingthreats.net/2003483
        2008011 || ET TROJAN Pakes/Cutwall/Kobcka Update Detected High Ports


From campesic at centenarycollege.edu  Mon Sep 29 13:51:27 2008
From: campesic at centenarycollege.edu (Campesi, Christopher)
Date: Mon, 29 Sep 2008 13:51:27 -0400
Subject: [Emerging-Sigs] SoulSeek P2P
Message-ID: <54125DA6FB3A3249B874A94D39E9E6D9038EEFAD@BENDER.centenarycollege.edu>

Connecting to SoulSeek service

 

Alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 2240 (msg:"SoulSeek P2P
Server Connection";flow:established,to_server;content:"|45 00 00 00 01
00 00
00|";flags:PA;offset:0;dsize:8;classtype:policy-violation;reference:url,
www.slsknet.org;sid:XXXXXXXX;rev:1;)

 

Chris

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080929/b3f2c21b/attachment.html

From jonkman at jonkmans.com  Mon Sep 29 14:03:07 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Mon, 29 Sep 2008 14:03:07 -0400
Subject: [Emerging-Sigs] SoulSeek P2P
In-Reply-To: <54125DA6FB3A3249B874A94D39E9E6D9038EEFAD@BENDER.centenarycollege.edu>
References: <54125DA6FB3A3249B874A94D39E9E6D9038EEFAD@BENDER.centenarycollege.edu>
Message-ID: <48E1185B.7060906@jonkmans.com>

Posted, thanks Christopher!

Matt

Campesi, Christopher wrote:
> Connecting to SoulSeek service
> 
>  
> 
> Alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 2240 (msg:"SoulSeek P2P
> Server Connection";flow:established,to_server;content:"|45 00 00 00 01
> 00 00
> 00|";flags:PA;offset:0;dsize:8;classtype:policy-violation;reference:url,www.slsknet.org;sid:XXXXXXXX;rev:1;)
> 
>  
> 
> *Chris*
> 
>  
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Mon Sep 29 16:00:09 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Mon, 29 Sep 2008 16:00:09 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080929200009.0589D4502B@goliath.jonkmans.com>


[***] Results from Oinkmaster started Mon Sep 29 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008593 - ET TROJAN Ultimate Defender Fake AV Checkin (emerging-virus.rules)
 2008594 - ET MALWARE ezday.co.kr Related Spyware User-Agent Detected (Ezshop) (emerging-malware.rules)
 2008595 - ET P2P SoulSeek P2P Server Connection (emerging-p2p.rules)
 2008596 - ET SCAN Brute Force Exploit Detector HTTP Buffer Overflow Detection (emerging-scan.rules)
 2008597 - ET SCAN Cisco Torch SNMP Scan (emerging-scan.rules)
 2008598 - ET SCAN Sipsak SIP scan (emerging-scan.rules)
 2406021 - ET RBN Known Russian Business Network Monitored Domains (22) (emerging-rbn.rules)
 2406022 - ET RBN Known Russian Business Network Monitored Domains (23) (emerging-rbn.rules)
 2406023 - ET RBN Known Russian Business Network Monitored Domains (24) (emerging-rbn.rules)
 2406024 - ET RBN Known Russian Business Network Monitored Domains (25) (emerging-rbn.rules)
 2406025 - ET RBN Known Russian Business Network Monitored Domains (26) (emerging-rbn.rules)
 2406026 - ET RBN Known Russian Business Network Monitored Domains (27) (emerging-rbn.rules)
 2406027 - ET RBN Known Russian Business Network Monitored Domains (28) (emerging-rbn.rules)
 2406028 - ET RBN Known Russian Business Network Monitored Domains (29) (emerging-rbn.rules)
 2406029 - ET RBN Known Russian Business Network Monitored Domains (30) (emerging-rbn.rules)
 2407021 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (22) (emerging-rbn-BLOCK.rules)
 2407022 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (23) (emerging-rbn-BLOCK.rules)
 2407023 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (24) (emerging-rbn-BLOCK.rules)
 2407024 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (25) (emerging-rbn-BLOCK.rules)
 2407025 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (26) (emerging-rbn-BLOCK.rules)
 2407026 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (27) (emerging-rbn-BLOCK.rules)
 2407027 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (28) (emerging-rbn-BLOCK.rules)
 2407028 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (29) (emerging-rbn-BLOCK.rules)
 2407029 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (30) (emerging-rbn-BLOCK.rules)


[///]     Modified active rules:     [///]

 2007922 - ET TROJAN Backdoor.Win32.VB.brg C&C Checkin (emerging-virus.rules)
 2007979 - ET TROJAN Backdoor.Win32.VB.brg C&C Reporting Version (emerging-virus.rules)
 2406000 - ET RBN Known Russian Business Network Monitored Domains (1) (emerging-rbn.rules)
 2406001 - ET RBN Known Russian Business Network Monitored Domains (2) (emerging-rbn.rules)
 2406002 - ET RBN Known Russian Business Network Monitored Domains (3) (emerging-rbn.rules)
 2406003 - ET RBN Known Russian Business Network Monitored Domains (4) (emerging-rbn.rules)
 2406004 - ET RBN Known Russian Business Network Monitored Domains (5) (emerging-rbn.rules)
 2406005 - ET RBN Known Russian Business Network Monitored Domains (6) (emerging-rbn.rules)
 2406006 - ET RBN Known Russian Business Network Monitored Domains (7) (emerging-rbn.rules)
 2406007 - ET RBN Known Russian Business Network Monitored Domains (8) (emerging-rbn.rules)
 2406008 - ET RBN Known Russian Business Network Monitored Domains (9) (emerging-rbn.rules)
 2406009 - ET RBN Known Russian Business Network Monitored Domains (10) (emerging-rbn.rules)
 2406010 - ET RBN Known Russian Business Network Monitored Domains (11) (emerging-rbn.rules)
 2406011 - ET RBN Known Russian Business Network Monitored Domains (12) (emerging-rbn.rules)
 2406012 - ET RBN Known Russian Business Network Monitored Domains (13) (emerging-rbn.rules)
 2406013 - ET RBN Known Russian Business Network Monitored Domains (14) (emerging-rbn.rules)
 2406014 - ET RBN Known Russian Business Network Monitored Domains (15) (emerging-rbn.rules)
 2406015 - ET RBN Known Russian Business Network Monitored Domains (16) (emerging-rbn.rules)
 2406016 - ET RBN Known Russian Business Network Monitored Domains (17) (emerging-rbn.rules)
 2406017 - ET RBN Known Russian Business Network Monitored Domains (18) (emerging-rbn.rules)
 2406018 - ET RBN Known Russian Business Network Monitored Domains (19) (emerging-rbn.rules)
 2406019 - ET RBN Known Russian Business Network Monitored Domains (20) (emerging-rbn.rules)
 2406020 - ET RBN Known Russian Business Network Monitored Domains (21) (emerging-rbn.rules)
 2407000 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (1) (emerging-rbn-BLOCK.rules)
 2407001 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (2) (emerging-rbn-BLOCK.rules)
 2407002 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (3) (emerging-rbn-BLOCK.rules)
 2407003 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (4) (emerging-rbn-BLOCK.rules)
 2407004 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (5) (emerging-rbn-BLOCK.rules)
 2407005 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (6) (emerging-rbn-BLOCK.rules)
 2407006 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (7) (emerging-rbn-BLOCK.rules)
 2407007 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (8) (emerging-rbn-BLOCK.rules)
 2407008 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (9) (emerging-rbn-BLOCK.rules)
 2407009 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (10) (emerging-rbn-BLOCK.rules)
 2407010 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (11) (emerging-rbn-BLOCK.rules)
 2407011 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (12) (emerging-rbn-BLOCK.rules)
 2407012 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (13) (emerging-rbn-BLOCK.rules)
 2407013 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (14) (emerging-rbn-BLOCK.rules)
 2407014 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (15) (emerging-rbn-BLOCK.rules)
 2407015 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) (emerging-rbn-BLOCK.rules)
 2407016 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) (emerging-rbn-BLOCK.rules)
 2407017 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) (emerging-rbn-BLOCK.rules)
 2407018 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) (emerging-rbn-BLOCK.rules)
 2407019 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) (emerging-rbn-BLOCK.rules)
 2407020 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (21) (emerging-rbn-BLOCK.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-p2p.rules (1):
        #christopher Campesi

     -> Added to emerging-rbn-BLOCK.rules (2):
        #  VERSION 72
        #  Updated 2008-09-29 10:01:51

     -> Added to emerging-rbn.rules (2):
        #  VERSION 72
        #  Updated 2008-09-29 10:01:51

     -> Added to emerging-sid-msg.map (24):
        2008593 || ET TROJAN Ultimate Defender Fake AV Checkin
        2008594 || ET MALWARE ezday.co.kr Related Spyware User-Agent Detected (Ezshop)
        2008595 || ET MALWARE Suspicious User-Agent Detected (Windows+NT)
        2008596 || ET SCAN Brute Force Exploit Detector HTTP Buffer Overflow Detection || url,www.snake-basket.de/bed.html
        2008597 || ET SCAN Cisco Torch SNMP Scan || url,www.securiteam.com/tools/5EP0F1FEUA.html || url,www.hackingexposedcisco.com/?link=tools
        2008598 || ET SCAN Sipsak SIP scan || url,sipsak.org/
        2406021 || ET RBN Known Russian Business Network Monitored Domains (22) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406022 || ET RBN Known Russian Business Network Monitored Domains (23) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406023 || ET RBN Known Russian Business Network Monitored Domains (24) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406024 || ET RBN Known Russian Business Network Monitored Domains (25) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406025 || ET RBN Known Russian Business Network Monitored Domains (26) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406026 || ET RBN Known Russian Business Network Monitored Domains (27) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406027 || ET RBN Known Russian Business Network Monitored Domains (28) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406028 || ET RBN Known Russian Business Network Monitored Domains (29) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406029 || ET RBN Known Russian Business Network Monitored Domains (30) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407021 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (22) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407022 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (23) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407023 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (24) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407024 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (25) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407025 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (26) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407026 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (27) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407027 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (28) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407028 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (29) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407029 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (30) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork

     -> Added to emerging-sid-msg.map.txt (24):
        2008593 || ET TROJAN Ultimate Defender Fake AV Checkin
        2008594 || ET MALWARE ezday.co.kr Related Spyware User-Agent Detected (Ezshop)
        2008595 || ET MALWARE Suspicious User-Agent Detected (Windows+NT)
        2008596 || ET SCAN Brute Force Exploit Detector HTTP Buffer Overflow Detection || url,www.snake-basket.de/bed.html
        2008597 || ET SCAN Cisco Torch SNMP Scan || url,www.securiteam.com/tools/5EP0F1FEUA.html || url,www.hackingexposedcisco.com/?link=tools
        2008598 || ET SCAN Sipsak SIP scan || url,sipsak.org/
        2406021 || ET RBN Known Russian Business Network Monitored Domains (22) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406022 || ET RBN Known Russian Business Network Monitored Domains (23) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406023 || ET RBN Known Russian Business Network Monitored Domains (24) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406024 || ET RBN Known Russian Business Network Monitored Domains (25) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406025 || ET RBN Known Russian Business Network Monitored Domains (26) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406026 || ET RBN Known Russian Business Network Monitored Domains (27) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406027 || ET RBN Known Russian Business Network Monitored Domains (28) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406028 || ET RBN Known Russian Business Network Monitored Domains (29) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2406029 || ET RBN Known Russian Business Network Monitored Domains (30) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407021 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (22) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407022 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (23) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407023 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (24) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407024 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (25) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407025 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (26) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407026 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (27) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407027 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (28) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407028 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (29) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork
        2407029 || ET RBN Known Russian Business Network Monitored Domains - BLOCKING (30) || url,doc.emergingthreats.net/bin/view/Main/RussianBusinessNetwork

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-rbn-BLOCK.rules (2):
        #  VERSION 63
        #  Updated 2008-09-25 09:04:53

     -> Removed from emerging-rbn.rules (2):
        #  VERSION 63
        #  Updated 2008-09-25 09:04:53


From phatbuckett at gmail.com  Tue Sep 30 02:38:17 2008
From: phatbuckett at gmail.com (Darren Spruell)
Date: Mon, 29 Sep 2008 23:38:17 -0700
Subject: [Emerging-Sigs] SID 2007771: Cutwall -> Cutwail
Message-ID: <839aec700809292338g6a6d8c21sccabbb9fdd70ae13@mail.gmail.com>

msg:"ET TROJAN Pakes/Cutwall/Kobcka Update URL Detected";

s/Cutwall/Cutwail

Speaking of Cutwail, SecureWorks' writeup on the Pushdo trojan
(http://www.secureworks.com/research/threats/pushdo/) suggests that
the request URIs detected in 2007771 and 2008493 belong to Pushdo,
differentiating Cutwail as a seperate malware that is typically
downloaded by Pushdo. Are the labeling in the rule messages on these
signatures as Cutwail accurate?

-- 
Darren Spruell
phatbuckett at gmail.com

From jonkman at jonkmans.com  Tue Sep 30 08:03:57 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Tue, 30 Sep 2008 08:03:57 -0400
Subject: [Emerging-Sigs] SID 2007771: Cutwall -> Cutwail
In-Reply-To: <839aec700809292338g6a6d8c21sccabbb9fdd70ae13@mail.gmail.com>
References: <839aec700809292338g6a6d8c21sccabbb9fdd70ae13@mail.gmail.com>
Message-ID: <48E215AD.6090807@jonkmans.com>

2008493 is definitely Pushdo, I've renamed it to reflect.

The other:
VIRUS/TROJAN_Pakes:alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"ET TROJAN Pakes/Cutwall/Kobcka Update URL Detected";
flow:established,to_server; uricontent:"/40E800"; nocase;
uricontent:"C00000"; nocase; classtype:trojan-activity; sid:2007771; rev:6;)

is something else. I think Pakes is what it's most often called. It's
got a very distinct url style, we're still seeing them now and then.

As for how we name: that's tough. Often we're writing a sig when we have
only a couple of AV companies (if any) calling it something. So we end
up with a lot in the unknown category until we get some coverage.

But generally we pick names based on what most of the AV's call it. If
there's a lot of disagreement I generally default to using Kaspersky's
naming (as many other AV's buy their database) and they're often among
the first to name things.

That help?

Matt

Darren Spruell wrote:
> msg:"ET TROJAN Pakes/Cutwall/Kobcka Update URL Detected";
> 
> s/Cutwall/Cutwail
> 
> Speaking of Cutwail, SecureWorks' writeup on the Pushdo trojan
> (http://www.secureworks.com/research/threats/pushdo/) suggests that
> the request URIs detected in 2007771 and 2008493 belong to Pushdo,
> differentiating Cutwail as a seperate malware that is typically
> downloaded by Pushdo. Are the labeling in the rule messages on these
> signatures as Cutwail accurate?
> 

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From signatures at stillsecure.com  Tue Sep 30 08:37:17 2008
From: signatures at stillsecure.com (signatures)
Date: Tue, 30 Sep 2008 06:37:17 -0600
Subject: [Emerging-Sigs] Stillsecure: Signature - 30th Sep-08
Message-ID: <5C9E8CCEEB81ED498AC0C3B0054704F3054C2903@webmail.latis.com>

Hi,
 
Please find New Signature below:
 
Signature for Chilkat IMAP ActiveX File Excution and IE DOS
 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"Chilkat IMAP ActiveX File Execution and IE DoS"; flow:to_client,established; content:"CLSID"; nocase; content:"126FB030-1E9E-4517-A254-430616582C50"; distance:0; nocase;  content:"LoadXmlEmail"; nocase; classtype:web-application-attack; reference:url,/www.milw0rm.com/exploits/6600; sid:8812; rev:1;)

 
Looking forward for your comments if any...
 
Thanks & Regards,
Stillsecure
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080930/e0c85863/attachment.html

From jonkman at jonkmans.com  Tue Sep 30 08:41:22 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Tue, 30 Sep 2008 08:41:22 -0400
Subject: [Emerging-Sigs] Stillsecure: Signature - 30th Sep-08
In-Reply-To: <5C9E8CCEEB81ED498AC0C3B0054704F3054C2903@webmail.latis.com>
References: <5C9E8CCEEB81ED498AC0C3B0054704F3054C2903@webmail.latis.com>
Message-ID: <48E21E72.6030502@jonkmans.com>

Looks good! Thanks. Posting now

Matt

signatures wrote:
> Hi,
>  
> Please find New Signature below:
>  
> *Signature for Chilkat IMAP ActiveX File Excution and IE DOS*
>  
> 
> alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"Chilkat IMAP ActiveX
> File Execution and IE DoS"; flow:to_client,established; content:"CLSID";
> nocase; content:"126FB030-1E9E-4517-A254-430616582C50"; distance:0;
> nocase;  content:"LoadXmlEmail"; nocase;
> classtype:web-application-attack;
> reference:url,/www.milw0rm.com/exploits/6600; sid:8812; rev:1;)
> 
>  
> Looking forward for your comments if any...
>  
> Thanks & Regards,
> Stillsecure
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From campesic at centenarycollege.edu  Tue Sep 30 13:08:06 2008
From: campesic at centenarycollege.edu (Campesi, Christopher)
Date: Tue, 30 Sep 2008 13:08:06 -0400
Subject: [Emerging-Sigs] SoulSeek P2P Revision
Message-ID: <54125DA6FB3A3249B874A94D39E9E6D9038EF1E1@BENDER.centenarycollege.edu>

This is a revision to the SoulSeek sig I submitted the other day

 

I removed the first 4 bytes, changed the offset, and removed dsize and
put in depth instead. The first byte of the previous sig changes
depending on the length of the message. But the 01 00 00 00 is always
the same and so is the dst port. 

 

alert tcp $HOME_NET 1024:  -> $EXTERNAL_NET 2240 (msg:"SoulSeek P2P
Server Connection";flow:to_server;content:"|01 00 00
00|";flags:PA;offset:4;depth:4;classtype:policy-violation;reference:url,
www.slsknet.org;sid: 2008595;rev:2;)

 

This is another one we can use as well:

This content is the response to the login from the client and remains
the same

alert tcp $EXTERNAL_NET 2240 -> $HOME_NET 1024: (msg:"SoulSeek P2P Login
Response";content:"|5c 01 00 00 01 00 00
00|";flow:to_client;offset:0;depth:8;classtype:policy-violation;referenc
e:url,www.slsknet.org;sid:XXXXXX;rev:1;)

 

 

Chris

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20080930/f74fda56/attachment.html

From jonkman at jonkmans.com  Tue Sep 30 14:32:26 2008
From: jonkman at jonkmans.com (Matt Jonkman)
Date: Tue, 30 Sep 2008 14:32:26 -0400
Subject: [Emerging-Sigs] SoulSeek P2P Revision
In-Reply-To: <54125DA6FB3A3249B874A94D39E9E6D9038EF1E1@BENDER.centenarycollege.edu>
References: <54125DA6FB3A3249B874A94D39E9E6D9038EF1E1@BENDER.centenarycollege.edu>
Message-ID: <48E270BA.8020601@jonkmans.com>

Got em, good changes. Posting now.

Thanks Christopher!

Matt

Campesi, Christopher wrote:
> This is a revision to the SoulSeek sig I submitted the other day
> 
>  
> 
> I removed the first 4 bytes, changed the offset, and removed dsize and
> put in depth instead. The first byte of the previous sig changes
> depending on the length of the message. But the 01 00 00 00 is always
> the same and so is the dst port.
> 
>  
> 
> alert tcp $HOME_NET 1024:  -> $EXTERNAL_NET 2240 (msg:"SoulSeek P2P
> Server Connection";flow:to_server;content:"|01 00 00
> 00|";flags:PA;offset:4;depth:4;classtype:policy-violation;reference:url,www.slsknet.org;sid:
> 2008595;rev:2;)
> 
>  
> 
> This is another one we can use as well:
> 
> This content is the response to the login from the client and remains
> the same
> 
> alert tcp $EXTERNAL_NET 2240 -> $HOME_NET 1024: (msg:"SoulSeek P2P Login
> Response";content:"|5c 01 00 00 01 00 00
> 00|";flow:to_client;offset:0;depth:8;classtype:policy-violation;reference:url,www.slsknet.org;sid:XXXXXX;rev:1;)
> 
>  
> 
>  
> 
> *Chris*
> 
>  
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at emergingthreats.net
> http://lists.emergingthreats.net/mailman/listinfo/emerging-sigs

-- 
--------------------------------------------
Matthew Jonkman
Emerging Threats
Phone 765-429-0398
Fax 312-264-0205
http://www.emergingthreats.net
--------------------------------------------

PGP: http://www.jonkmans.com/mattjonkman.asc



From emerging at emergingthreats.net  Tue Sep 30 16:00:08 2008
From: emerging at emergingthreats.net (emerging@emergingthreats.net)
Date: Tue, 30 Sep 2008 16:00:08 -0400 (EDT)
Subject: [Emerging-Sigs] Emerging Threats Daily Signature Changes
Message-ID: <20080930200008.5970B45026@goliath.jonkmans.com>


[***] Results from Oinkmaster started Tue Sep 30 16:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2008599 - ET CURRENT_EVENTS Asprox Cookie SQL Injection Attempt (emerging.rules)
 2008600 - ET MALWARE Suspicious User-Agent Detected (Windows+NT) (emerging-malware.rules)
 2008601 - ET TROJAN Visual Shock Keylogger Reporting to Controller (emerging-virus.rules)
 2008602 - ET TROJAN Visual Shock Keylogger Reporting Idle to Controller (emerging-virus.rules)
 2008603 - ET MALWARE Suspicious User-Agent Detected (RLMultySocket) (emerging-malware.rules)
 2008604 - ET TROJAN Gamethief/PSW.Magania Checkin (emerging-virus.rules)
 2008605 - ET SCAN Stompy Web Application Session Scan (emerging-scan.rules)
 2008606 - ET SCAN Enumiax Inter-Asterisk Exchange Protocol Username Scan (emerging-scan.rules)
 2008607 - Chilkat IMAP ActiveX File Execution and IE DoS (emerging-exploit.rules)
 2008608 - ET MALWARE WinFixer Trojan Related User-Agent Detected (ElectroSun NetInstaller) (emerging-malware.rules)
 2008609 - ET SCAN Sivus VOIP Vulnerability Scanner SIP Scan (emerging-scan.rules)
 2008610 - ET SCAN Sivus VOIP Vulnerability Scanner SIP Components Scan (emerging-scan.rules)


[///]     Modified active rules:     [///]

 2008334 - ET TROJAN Beizhu/Womble/Vipdataend Checking in with Controller (emerging-virus.rules)
 2008335 - ET TROJAN Beizhu/Womble/Vipdataend Controller Keepalive (emerging-virus.rules)
 2008493 - ET TROJAN Pushdo Checkin (emerging-virus.rules)
 2406000 - ET RBN Known Russian Business Network Monitored Domains (1) (emerging-rbn.rules)
 2406001 - ET RBN Known Russian Business Network Monitored Domains (2) (emerging-rbn.rules)
 2406002 - ET RBN Known Russian Business Network Monitored Domains (3) (emerging-rbn.rules)
 2406003 - ET RBN Known Russian Business Network Monitored Domains (4) (emerging-rbn.rules)
 2406004 - ET RBN Known Russian Business Network Monitored Domains (5) (emerging-rbn.rules)
 2406005 - ET RBN Known Russian Business Network Monitored Domains (6) (emerging-rbn.rules)
 2406006 - ET RBN Known Russian Business Network Monitored Domains (7) (emerging-rbn.rules)
 2406007 - ET RBN Known Russian Business Network Monitored Domains (8) (emerging-rbn.rules)
 2406008 - ET RBN Known Russian Business Network Monitored Domains (9) (emerging-rbn.rules)
 2406009 - ET RBN Known Russian Business Network Monitored Domains (10) (emerging-rbn.rules)
 2406010 - ET RBN Known Russian Business Network Monitored Domains (11) (emerging-rbn.rules)
 2406011 - ET RBN Known Russian Business Network Monitored Domains (12) (emerging-rbn.rules)
 2406012 - ET RBN Known Russian Business Network Monitored Domains (13) (emerging-rbn.rules)
 2406013 - ET RBN Known Russian Business Network Monitored Domains (14) (emerging-rbn.rules)
 2406014 - ET RBN Known Russian Business Network Monitored Domains (15) (emerging-rbn.rules)
 2406015 - ET RBN Known Russian Business Network Monitored Domains (16) (emerging-rbn.rules)
 2406016 - ET RBN Known Russian Business Network Monitored Domains (17) (emerging-rbn.rules)
 2406017 - ET RBN Known Russian Business Network Monitored Domains (18) (emerging-rbn.rules)
 2406018 - ET RBN Known Russian Business Network Monitored Domains (19) (emerging-rbn.rules)
 2406019 - ET RBN Known Russian Business Network Monitored Domains (20) (emerging-rbn.rules)
 2406020 - ET RBN Known Russian Business Network Monitored Domains (21) (emerging-rbn.rules)
 2406021 - ET RBN Known Russian Business Network Monitored Domains (22) (emerging-rbn.rules)
 2406022 - ET RBN Known Russian Business Network Monitored Domains (23) (emerging-rbn.rules)
 2406023 - ET RBN Known Russian Business Network Monitored Domains (24) (emerging-rbn.rules)
 2406024 - ET RBN Known Russian Business Network Monitored Domains (25) (emerging-rbn.rules)
 2406025 - ET RBN Known Russian Business Network Monitored Domains (26) (emerging-rbn.rules)
 2406026 - ET RBN Known Russian Business Network Monitored Domains (27) (emerging-rbn.rules)
 2406027 - ET RBN Known Russian Business Network Monitored Domains (28) (emerging-rbn.rules)
 2406028 - ET RBN Known Russian Business Network Monitored Domains (29) (emerging-rbn.rules)
 2406029 - ET RBN Known Russian Business Network Monitored Domains (30) (emerging-rbn.rules)
 2407000 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (1) (emerging-rbn-BLOCK.rules)
 2407001 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (2) (emerging-rbn-BLOCK.rules)
 2407002 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (3) (emerging-rbn-BLOCK.rules)
 2407003 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (4) (emerging-rbn-BLOCK.rules)
 2407004 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (5) (emerging-rbn-BLOCK.rules)
 2407005 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (6) (emerging-rbn-BLOCK.rules)
 2407006 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (7) (emerging-rbn-BLOCK.rules)
 2407007 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (8) (emerging-rbn-BLOCK.rules)
 2407008 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (9) (emerging-rbn-BLOCK.rules)
 2407009 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (10) (emerging-rbn-BLOCK.rules)
 2407010 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (11) (emerging-rbn-BLOCK.rules)
 2407011 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (12) (emerging-rbn-BLOCK.rules)
 2407012 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (13) (emerging-rbn-BLOCK.rules)
 2407013 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (14) (emerging-rbn-BLOCK.rules)
 2407014 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (15) (emerging-rbn-BLOCK.rules)
 2407015 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (16) (emerging-rbn-BLOCK.rules)
 2407016 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (17) (emerging-rbn-BLOCK.rules)
 2407017 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (18) (emerging-rbn-BLOCK.rules)
 2407018 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (19) (emerging-rbn-BLOCK.rules)
 2407019 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (20) (emerging-rbn-BLOCK.rules)
 2407020 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (21) (emerging-rbn-BLOCK.rules)
 2407021 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (22) (emerging-rbn-BLOCK.rules)
 2407022 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (23) (emerging-rbn-BLOCK.rules)
 2407023 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (24) (emerging-rbn-BLOCK.rules)
 2407024 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (25) (emerging-rbn-BLOCK.rules)
 2407025 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (26) (emerging-rbn-BLOCK.rules)
 2407026 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (27) (emerging-rbn-BLOCK.rules)
 2407027 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (28) (emerging-rbn-BLOCK.rules)
 2407028 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (29) (emerging-rbn-BLOCK.rules)
 2407029 - ET RBN Known Russian Business Network Monitored Domains - BLOCKING (30) (emerging-rbn-BLOCK.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to emerging-exploit.rules (1):
        #by Stillsecure

     -> Added to emerging-rbn-BLOCK.rules (2):
        #  VERSION 74
        #  Updated 2008-09-29 22:09:20

     -> Added to emerging-rbn.rules (2):
        #  VERSION 74
        #  Updated 2008-09-29 22:09:20

     -> Added to emerging-sid-msg.map (15):
        2008334 || ET TROJAN Beizhu/Womble/Vipdataend Checking in with Controller
        2008493 || ET TROJAN Pushdo Checkin
        2008595 || ET P2P SoulSeek P2P Server Connection || url,www.slsknet.org
        2008599 || ET CURRENT_EVENTS Asprox Cookie SQL Injection Attempt || url,isc.sans.org/diary.html?n&storyid=5092
        2008600 || ET MALWARE Suspicious User-Agent Detected (Windows+NT)
        2008601 || ET TROJAN Visual Shock Keylogger Reporting to Controller || url,research.sunbelt-software.com/threatdisplay.aspx?threatid=42573
        2008602 || ET TROJAN Visual Shock Keylogger Reporting Idle to Controller || url,research.sunbelt-software.com/threatdisplay.aspx?threatid=42573
        2008603 || ET MALWARE Suspicious User-Agent Detected (RLMultySocket)
        2008604 || ET TROJAN Gamethief/PSW.Magania Checkin
        2008605 || ET SCAN Stompy Web Application Session Scan || url,www.darknet.org.uk/2007/03/stompy-the-web-application-session-analyzer-tool/
        2008606 || ET SCAN Enumiax Inter-Asterisk Exchange Protocol Username Scan || url,sourceforge.net/projects/enumiax/
        2008607 || Chilkat IMAP ActiveX File Execution and IE DoS || url,www.milw0rm.com/exploits/6600
        2008608 || ET MALWARE WinFixer Trojan Related User-Agent Detected (ElectroSun NetInstaller)
        2008609 || ET SCAN Sivus VOIP Vulnerability Scanner SIP Scan || url,http://www.vopsecurity.org/ || url,www.security-database.com/toolswatch/SiVus-VoIP-Security-Scanner-1-09.html
        2008610 || ET SCAN Sivus VOIP Vulnerability Scanner SIP Components Scan || url,www.vopsecurity.org/ || url,www.security-database.com/toolswatch/SiVus-VoIP-Security-Scanner-1-09.html

     -> Added to emerging-sid-msg.map.txt (15):
        2008334 || ET TROJAN Beizhu/Womble/Vipdataend Checking in with Controller
        2008493 || ET TROJAN Pushdo Checkin
        2008595 || ET P2P SoulSeek P2P Server Connection || url,www.slsknet.org
        2008599 || ET CURRENT_EVENTS Asprox Cookie SQL Injection Attempt || url,isc.sans.org/diary.html?n&storyid=5092
        2008600 || ET MALWARE Suspicious User-Agent Detected (Windows+NT)
        2008601 || ET TROJAN Visual Shock Keylogger Reporting to Controller || url,research.sunbelt-software.com/threatdisplay.aspx?threatid=42573
        2008602 || ET TROJAN Visual Shock Keylogger Reporting Idle to Controller || url,research.sunbelt-software.com/threatdisplay.aspx?threatid=42573
        2008603 || ET MALWARE Suspicious User-Agent Detected (RLMultySocket)
        2008604 || ET TROJAN Gamethief/PSW.Magania Checkin
        2008605 || ET SCAN Stompy Web Application Session Scan || url,www.darknet.org.uk/2007/03/stompy-the-web-application-session-analyzer-tool/
        2008606 || ET SCAN Enumiax Inter-Asterisk Exchange Protocol Username Scan || url,sourceforge.net/projects/enumiax/
        2008607 || Chilkat IMAP ActiveX File Execution and IE DoS || url,www.milw0rm.com/exploits/6600
        2008608 || ET MALWARE WinFixer Trojan Related User-Agent Detected (ElectroSun NetInstaller)
        2008609 || ET SCAN Sivus VOIP Vulnerability Scanner SIP Scan || url,http://www.vopsecurity.org/ || url,www.security-database.com/toolswatch/SiVus-VoIP-Security-Scanner-1-09.html
        2008610 || ET SCAN Sivus VOIP Vulnerability Scanner SIP Components Scan || url,www.vopsecurity.org/ || url,www.security-database.com/toolswatch/SiVus-VoIP-Security-Scanner-1-09.html

     -> Added to emerging-virus.rules (1):
        # ref: 4e224c80f62c1b3dc74d295d0633e699

     -> Added to emerging.rules (1):
        #matt jonkman

[---]     Removed non-rule lines:    [---]

     -> Removed from emerging-rbn-BLOCK.rules (2):
        #  VERSION 72
        #  Updated 2008-09-29 10:01:51

     -> Removed from emerging-rbn.rules (2):
        #  VERSION 72
        #  Updated 2008-09-29 10:01:51

     -> Removed from emerging-sid-msg.map (3):
        2008334 || ET TROJAN Beizhu/Womble/Vipdataend Checking with Controller
        2008493 || ET TROJAN Cutwail/W32.Small.avu Dropper
        2008595 || ET MALWARE Suspicious User-Agent Detected (Windows+NT)

     -> Removed from emerging-sid-msg.map.txt (3):
        2008334 || ET TROJAN Beizhu/Womble/Vipdataend Checking with Controller
        2008493 || ET TROJAN Cutwail/W32.Small.avu Dropper
        2008595 || ET MALWARE Suspicious User-Agent Detected (Windows+NT)