Bleedingsnort.com Daily Update

[***] Results from Oinkmaster started Fri Oct 22 20:00:03 2004 [***]

[+++]          Added rules:          [+++]

     -> Added to bleeding-virus.rules (4):
        alert tcp $HOME_NET !21:443 -> $EXTERNAL_NET !80 (msg:"BLEEDING-EDGE 
IRC Trojan Reporting (Scan)"; content:"PRIVMSG"; nocase; content:"Scan"; 
nocase; within:80; tag:session, 20, packets; classtype:trojan-activity; 
sid:2001372; rev:1;)
        alert tcp $HOME_NET !21:443 -> $EXTERNAL_NET !80 (msg:"BLEEDING-EDGE 
IRC Trojan Reporting (lsass)"; content:"PRIVMSG"; nocase; content:"lsass"; 
nocase; within:80; tag:session, 20, packets; classtype:trojan-activity; 
sid:2001371; rev:1;)
        alert tcp $HOME_NET !21:443 -> $EXTERNAL_NET !80 (msg:"BLEEDING-EDGE 
IRC Trojan Reporting (Exploit)"; content:"PRIVMSG"; nocase; content:"Exploit"; 
nocase; within:80; tag:session, 20, packets; classtype:trojan-activity; 
sid:2001370; rev:1;)
        alert tcp $HOME_NET !21:443 -> $EXTERNAL_NET !80 (msg:"BLEEDING-EDGE 
IRC Trojan Reporting (zombie)"; content:"PRIVMSG"; nocase; content:"zombie"; 
nocase; within:80; tag:session, 20, packets; classtype:trojan-activity; 
sid:2001373; rev:1;)

     -> Added to bleeding.rules (1):
        alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg: 
"BLEEDING-EDGE MS04-032 Bad EMF file"; content: "|01 00 00 00|"; depth: 4; 
content: "|20 45 4d 46|"; depth: 44; offset: 40; byte_test: 4, >, 256, 60, 
little; sid:2001374; rev:1;)

[---]         Removed rules:         [---]

     -> Removed from bleeding-virus.rules (1):
        alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"BLEEDING-EDGE IRC 
Trojan Reporting LSASS Exploitation"; content:"lsass\: exploit"; 
flow:established,to_server; 
reference:url,www.bleedingsnort.com/forum/viewtopic.php?forum=4&showtopic=85; 
classtype:trojan-activity; sid:2001361; rev:2;)

[+++]      Added non-rule lines:     [+++]

     -> Added to bleeding-sid-msg.map (5):
        2001370 || BLEEDING-EDGE IRC Trojan Reporting (Exploit)
        2001371 || BLEEDING-EDGE IRC Trojan Reporting (lsass)
        2001372 || BLEEDING-EDGE IRC Trojan Reporting (Scan)
        2001373 || BLEEDING-EDGE IRC Trojan Reporting (zombie)
        2001374 || BLEEDING-EDGE MS04-032 Bad EMF file

     -> Added to bleeding-virus.rules (1):
        #Unknown Writer

     -> Added to bleeding.rules (1):
        #From Erik Fichtner

[---]     Removed non-rule lines:    [---]

     -> Removed from bleeding-sid-msg.map (1):
        2001361 || BLEEDING-EDGE IRC Trojan Reporting LSASS Exploitation || 
url,www.bleedingsnort.com/forum/viewtopic.php?forum=4&showtopic=85

     -> Removed from bleeding-virus.rules (1):
        #Submitted by colforbin5

[*] Added files: [*]
    None.



-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl