// we are therefore done with this rule.
if (util::get_string(arg_stream, value, ","))
{
- retval = rule_api.add_rule_option("urilen", value);
- rule_api.select_option("urilen");
+ retval = rule_api.add_rule_option("bufferlen", value);
+ rule_api.select_option("bufferlen");
if (util::get_string(arg_stream, value, ","))
{
bool tmpval = true;
if (!value.compare("raw"))
- tmpval = rule_api.add_rule_option_before_selected("http_raw_uri");
+ rule_api.add_rule_option_before_selected("http_raw_uri");
else if (!value.compare("norm"))
- tmpval = rule_api.add_rule_option_before_selected("http_uri");
+ rule_api.add_rule_option_before_selected("http_uri");
else
- rule_api.bad_rule(data_stream, "invalid arguments: " + args);
-
- if (retval && !tmpval)
- retval = false;
+ rule_api.bad_rule(data_stream, "urilen:" + value + "," + args);
+ }
+ else
+ {
+ rule_api.add_rule_option_before_selected("http_uri");
}
}
else
{
- rule_api.bad_rule(data_stream, "urilen: option required");
+ rule_api.bad_rule(data_stream, "urilen - option required");
}
rule_api.unselect_option();
- return set_next_rule_state(data_stream) && retval;
+ return set_next_rule_state(data_stream);
}
/**************************
alert tcp any any <> any any ( sid:1000036; msg:"x"; resp:rst_snd, rst_rcv, rst_all; )
alert tcp any any <> any any ( sid:1000037; msg:"x"; resp:icmp_net, icmp_host, icmp_port, icmp_all; )
alert tcp any any <> any any ( sid:1000038; msg:"x"; resp:reset_source, reset_dest, reset_both, reset_dest; )
+
+
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.ZeroAccess URI and Referer"; flow:to_server,established; urilen:52; content:"/s/?k="; fast_pattern:only; http_header; pcre:"/^\x2f[a-z0-9]{51}$/Ui"; pcre:"/Referer\x3a\s*?http\x3a\x2f{2}[a-z0-9\x2e\x2d]+\x2fs\x2f\x3fk\x3d/Hi"; metadata:policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:25224; rev:2;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET [110,8080] (msg:"MALWARE-CNC Win.Trojan.Basutra variant outbound connection"; flow:to_server,established; content:"|7E 77 6F 6F 6F 6F|"; depth:6; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service pop3; reference:url,www.virustotal.com/file/1F8FB6C3EEEB6F17A6D08094B3154DF2C517BFB52698E72DBF8D197A201941A3/analysis/; classtype:trojan-activity; sid:25249; rev:1;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Worm.Gamarue outbound connection"; flow:to_server,established; content:"POST"; http_method; urilen:12; content:"/a/image.php"; fast_pattern:only; http_uri; content:"User-Agent|3A 20|Mozilla/4.0|0D 0A|"; http_header; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:25256; rev:2;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Skintrim outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"/bin/check.php?cv="; http_uri; content:"ThIs_Is_tHe_bouNdaRY_$"; fast_pattern; http_header; metadata:policy balanced-ips drop, policy security-ips drop, ruleset community, service http; reference:url,www.virustotal.com/file/80e67695fa394f56fd6ddae74b72e9050f651244aad52ad48ebe6304edff95e2/analysis/1357239259/; classtype:trojan-activity; sid:25257; rev:3;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"OS-WINDOWS SMB-DS DCERPC Remote Activation bind attempt"; flow:to_server,established; content:"|FF|SMB%"; depth:5; offset:4; nocase; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00|"; within:12; distance:5; nocase; content:"|05|"; within:1; content:"|0B|"; within:1; distance:1; byte_test:1,&,1,0,relative; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; tag:session,5,packets; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, ruleset community, service netbios-ssn; reference:bugtraq,8234; reference:bugtraq,8458; reference:cve,2003-0528; reference:cve,2003-0605; reference:cve,2003-0715; reference:nessus,11798; reference:nessus,11835; reference:url,technet.microsoft.com/en-us/security/bulletin/MS03-039; classtype:attempted-admin; sid:2252; rev:20;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"PROTOCOL-TELNET FreeBSD telnetd dec_keyid overflow attempt"; flow:established,to_server; content:"|FF FA 26 08|"; fast_pattern; rawbytes; isdataat:66,relative,rawbytes; content:!"|FF F0|"; within:66; rawbytes; metadata:policy balanced-ips drop, policy security-ips drop, service telnet; reference:bugtraq,51182; reference:cve,2011-4862; reference:url,security.freebsd.org/advisories/FreeBSD-SA-11:08.telnetd.asc; classtype:attempted-admin; sid:20813; rev:6;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"SERVER-MAIL Alt-N MDaemon IMAP Server FETCH command buffer overflow attempt"; flow:to_server,established; flowbits:isset,server.mdaemon; content:"FETCH"; fast_pattern:only; content:"BODY"; content:"["; isdataat:256,relative; content:!"]"; within:256; metadata:policy balanced-ips drop, policy security-ips drop, service imap; reference:bugtraq,28245; reference:cve,2008-1358; reference:url,files.altn.com/MDaemon/Release/RelNotes_en.txt; classtype:attempted-admin; sid:13663; rev:7;)
+alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-MULTIMEDIA AVI file chunk length integer overflow attempt"; flow:to_client,established; flowbits:isset,file.avi.video; file_data; content:"AVI LIST"; depth:8; offset:8; content:"hdrlavih"; within:8; distance:4; content:"INFO"; distance:0; byte_extract:4,4,chunk_size,relative,little; isdataat:!chunk_size; metadata:policy balanced-ips drop, policy security-ips drop, service http, service imap, service pop3; reference:cve,2011-3834; reference:url,forums.winamp.com/showthread.php?t=332010; classtype:attempted-user; sid:21168; rev:4;)
+alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-MULTIMEDIA AVI file chunk length integer overflow attempt"; flow:to_server,established; flowbits:isset,file.avi.video; file_data; content:"AVI LIST"; depth:8; offset:8; content:"hdrlavih"; within:8; distance:4; content:"INFO"; distance:0; byte_extract:4,4,chunk_size,relative,little; isdataat:!chunk_size; metadata:policy balanced-ips drop, policy security-ips drop, service smtp; reference:cve,2011-3834; reference:url,forums.winamp.com/showthread.php?t=332010; classtype:attempted-user; sid:24955; rev:2;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"PROTOCOL-TELNET FreeBSD telnetd enc_keyid overflow attempt"; flow:established,to_server; content:"|FF FA 26 07|"; fast_pattern; rawbytes; isdataat:66,relative,rawbytes; content:!"|FF F0|"; within:66; rawbytes; metadata:policy balanced-ips drop, policy security-ips drop, service telnet; reference:bugtraq,51182; reference:cve,2011-4862; reference:url,security.freebsd.org/advisories/FreeBSD-SA-11:08.telnetd.asc; classtype:attempted-admin; sid:20812; rev:6;)
+alert tcp $EXTERNAL_NET any -> $TELNET_SERVERS 23 (msg:"PROTOCOL-TELNET FreeBSD telnetd dec_keyid overflow attempt"; flow:established,to_server; content:"|FF FA 26 08|"; fast_pattern; rawbytes; isdataat:66,relative,rawbytes; content:!"|FF F0|"; within:66; rawbytes; metadata:policy balanced-ips drop, policy security-ips drop, service telnet; reference:bugtraq,51182; reference:cve,2011-4862; reference:url,security.freebsd.org/advisories/FreeBSD-SA-11:08.telnetd.asc; classtype:attempted-admin; sid:20813; rev:6;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"INDICATOR-COMPROMISE Unix.Backdoor.Cdorked redirected URI attempt"; flow:to_server,established; urilen:>150,norm; content:"/index.php?"; fast_pattern:only; http_uri; content:"Host:"; nocase; http_header; pcre:"/^Host:\s*?[a-f0-9]{16}\./Him"; metadata:impact_flag red, policy balanced-ips drop, policy security-ips drop, service http; reference:url,blog.sucuri.net/2013/04/apache-binary-backdoors-on-cpanel-based-servers.html; reference:url,virustotal.com/en/file/7b3cd8c1bd0249df458084f28d91648ad14e1baf455fdd53b174481d540070c6/analysis/; classtype:trojan-activity; sid:26530; rev:2;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-OTHER NeoSploit Malvertising - URI Requested"; flow:to_server,established; urilen:>62; content:"GET /?"; fast_pattern:only; pcre:"/\/\?[0-9a-f]{60,66}[\;\d]*$/U"; metadata:policy balanced-ips drop, policy security-ips drop, service http; classtype:trojan-activity; sid:23058; rev:2;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"EXPLOIT-KIT Redkit exploit kit landing page"; flow:to_server,established; urilen:18<>21; content:".html?h="; fast_pattern:only; http_uri; pcre:"/\/[a-z]{4}\.html\?h\=\d{6,7}$/Ui"; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:cve,2012-0188; reference:cve,2012-0507; reference:cve,2012-1723; reference:cve,2012-4681; reference:cve,2013-0422; reference:cve,2013-2423; reference:url,blog.malwarebytes.org/intelligence/2013/04/redkit-exploit-kit-does-the-splits/; classtype:trojan-activity; sid:26345; rev:3;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"EXPLOIT-KIT Blackholev2 exploit kit Initial Gate from Linked-In Mailing Campaign"; flow:to_server,established; urilen:17,norm; content:"/linkendorse.html"; fast_pattern:only; http_uri; metadata:policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:26814; rev:1;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"EXPLOIT-KIT Blackholev2 exploit kit Initial Gate from Linked-In Mailing Campaign"; flow:to_server,established; urilen:17,raw; content:"/linkendorse.html"; fast_pattern:only; http_uri; metadata:policy balanced-ips drop, policy security-ips drop, ruleset community, service http; classtype:trojan-activity; sid:26814; rev:1;)
projects / thirdparty / snort3.git / commitdiff
