From: Jeff Lucovsky Date: Wed, 10 Aug 2022 12:00:22 +0000 (-0400) Subject: test/rules: Update ETOpen rules X-Git-Tag: suricata-6.0.9~10 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F1003%2Fhead;p=thirdparty%2Fsuricata-verify.git test/rules: Update ETOpen rules Issue: 2982 During 2982 development, an issue with some rules in the ETOpen ruleset were discovered and reported to Proofpoint. This commit updates the ETOpen rules containing the fixes for the reported issue which manifested in 2 rules: sids 2037001 and 2035521. --- diff --git a/tests/test-ruleparse-etopen-01/emerging-all.rules b/tests/test-ruleparse-etopen-01/emerging-all.rules index 6569ed543..74a1c63ef 100644 --- a/tests/test-ruleparse-etopen-01/emerging-all.rules +++ b/tests/test-ruleparse-etopen-01/emerging-all.rules @@ -38,51629 +38,52435 @@ # This Ruleset is EmergingThreats Open optimized for suricata-5.0-enhanced. -#alert udp $HOME_NET any -> $EXTERNAL_NET 69 (msg:"ET ATTACK_RESPONSE Cisco TclShell TFTP Read Request"; content:"|00 01 74 63 6C 73 68 2E 74 63 6C|"; reference:url,wwww.irmplc.com/downloads/whitepapers/Creating_Backdoors_in_Cisco_IOS_using_Tcl.pdf; reference:url,doc.emergingthreats.net/2009244; classtype:bad-unknown; sid:2009244; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX EasyMail Object IMAP4 Component Buffer Overflow Function call Attempt"; flow:from_server,established; content:"ActiveXObject"; nocase; content:"EasyMail.IMAP4.6"; distance:0; nocase; content:"LicenseKey"; nocase; reference:url,secunia.com/advisories/24199/; reference:url,doc.emergingthreats.net/2010658; classtype:web-application-attack; sid:2010658; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert udp $EXTERNAL_NET 69 -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Cisco TclShell TFTP Download"; content:"|54 63 6C 53 68 65 6C 6C|"; reference:url,wwww.irmplc.com/downloads/whitepapers/Creating_Backdoors_in_Cisco_IOS_using_Tcl.pdf; reference:url,doc.emergingthreats.net/2009245; classtype:bad-unknown; sid:2009245; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX SaschArt SasCam Webcam Server ActiveX Control Head Method Buffer Overflow Attempt"; flow:to_client,established; content:" any any (msg:"ET SHELLCODE Bindshell2 Decoder Shellcode"; flow:established; content:"|53 53 53 53 53 43 53 43 53 FF D0 66 68|"; content:"|66 53 89 E1 95 68 A4 1A|"; distance:0; reference:url,doc.emergingthreats.net/2009246; classtype:shellcode-detect; sid:2009246; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX SoftCab Sound Converter ActiveX SaveFormat File overwrite Attempt"; flow:established,to_client; content:"66757BFC-DA0C-41E6-B3FE-B6D461223FF5"; nocase; content:"SaveFormat"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*66757BFC-DA0C-41E6-B3FE-B6D461223FF5/si"; reference:url,secunia.com/advisories/37967/; reference:url,doc.emergingthreats.net/2010943; classtype:web-application-attack; sid:2010943; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert udp any any -> any any (msg:"ET SHELLCODE Bindshell2 Decoder Shellcode (UDP)"; content:"|53 53 53 53 53 43 53 43 53 FF D0 66 68|"; content:"|66 53 89 E1 95 68 A4 1A|"; distance:0; reference:url,doc.emergingthreats.net/2009285; classtype:shellcode-detect; sid:2009285; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Visagesoft eXPert PDF Viewer ActiveX Control Arbitrary File Overwrite"; flow:to_client,established; content:"CLSID"; nocase; content:"BDF3E9D2-5F7A-4F4A-A914-7498C862EA6A"; nocase; distance:0; content:"savePageAsBitmap"; nocase; reference:bugtraq,31984; reference:url,milw0rm.com/exploits/6875; reference:url,doc.emergingthreats.net/2008791; classtype:web-application-attack; sid:2008791; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> any any (msg:"ET SHELLCODE Rothenburg Shellcode"; flow:established; content:"|D9 74 24 F4 5B 81 73 13|"; content:"|83 EB FC E2 F4|"; distance:0; reference:url,doc.emergingthreats.net/2009247; classtype:shellcode-detect; sid:2009247; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Viscom Movie Player Pro SDK ActiveX DrawText method Buffer Overflow Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"MOVIEPLAYER.MoviePlayerCtrl.1"; nocase; distance:0; content:"DrawText"; nocase; reference:url,www.shinnai.net/exploits/X6hU4E0E7P5H3qH5yXrn.txt; reference:url,secunia.com/advisories/38156/; reference:url,doc.emergingthreats.net/2010944; classtype:attempted-user; sid:2010944; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Rothenburg Shellcode (UDP)"; content:"|D9 74 24 F4 5B 81 73 13|"; content:"|83 EB FC E2 F4|"; distance:0; reference:url,doc.emergingthreats.net/2009284; classtype:shellcode-detect; sid:2009284; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (7)"; flow:to_client,established; content:"clsid"; nocase; content:"1BE49F30-0E1B-11D3-9D8E-00C04F72D980"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1BE49F30-0E1B-11D3-9D8E-00C04F72D980/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009620; classtype:web-application-attack; sid:2009620; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Lindau (linkbot) xor Decoder Shellcode"; flow:established; content:"|EB 15 B9|"; content:"|81 F1|"; distance:0; content:"|80 74 31 FF|"; distance:0; content:"|E2 F9 EB 05 E8 E6 FF FF FF|"; reference:url,doc.emergingthreats.net/2009248; classtype:shellcode-detect; sid:2009248; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (8)"; flow:to_client,established; content:"clsid"; nocase; content:"1C15D484-911D-11D2-B632-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1C15D484-911D-11D2-B632-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009621; classtype:web-application-attack; sid:2009621; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Lindau (linkbot) xor Decoder Shellcode (UDP)"; content:"|EB 15 B9|"; content:"|81 F1|"; distance:0; content:"|80 74 31 FF|"; distance:0; content:"|E2 F9 EB 05 E8 E6 FF FF FF|"; reference:url,doc.emergingthreats.net/2009283; classtype:shellcode-detect; sid:2009283; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (9)"; flow:to_client,established; content:"clsid"; nocase; content:"1DF7D126-4050-47F0-A7CF-4C4CA9241333"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1DF7D126-4050-47F0-A7CF-4C4CA9241333/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009622; classtype:web-application-attack; sid:2009622; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Adenau Shellcode"; flow:established; content:"|eb 19 5e 31 c9 81 e9|"; content:"|81 36|"; distance:0; content:"|81 ee fc ff ff ff|"; distance:0; reference:url,doc.emergingthreats.net/2009249; classtype:shellcode-detect; sid:2009249; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (10)"; flow:to_client,established; content:"clsid"; nocase; content:"2C63E4EB-4CEA-41B8-919C-E947EA19A77C"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2C63E4EB-4CEA-41B8-919C-E947EA19A77C/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009623; classtype:web-application-attack; sid:2009623; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Adenau Shellcode (UDP)"; content:"|eb 19 5e 31 c9 81 e9|"; content:"|81 36|"; distance:0; content:"|81 ee fc ff ff ff|"; distance:0; reference:url,doc.emergingthreats.net/2009282; classtype:shellcode-detect; sid:2009282; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (11)"; flow:to_client,established; content:"clsid"; nocase; content:"334125C0-77E5-11D3-B653-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*334125C0-77E5-11D3-B653-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009624; classtype:web-application-attack; sid:2009624; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Mainz/Bielefeld Shellcode"; flow:established; content:"|33 c9 66 b9|"; content:"|80 34|"; distance:0; content:"|eb 05 e8 eb ff ff ff|"; distance:0; reference:url,doc.emergingthreats.net/2009250; classtype:shellcode-detect; sid:2009250; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (12)"; flow:to_client,established; content:"clsid"; nocase; content:"37B0353C-A4C8-11D2-B634-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B0353C-A4C8-11D2-B634-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009625; classtype:web-application-attack; sid:2009625; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Mainz/Bielefeld Shellcode (UDP)"; content:"|33 c9 66 b9|"; content:"|80 34|"; distance:0; content:"|eb 05 e8 eb ff ff ff|"; distance:0; reference:url,doc.emergingthreats.net/2009281; classtype:shellcode-detect; sid:2009281; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (13)"; flow:to_client,established; content:"clsid"; nocase; content:"37B03543-A4C8-11D2-B634-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03543-A4C8-11D2-B634-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009626; classtype:web-application-attack; sid:2009626; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Wuerzburg Shellcode"; flow:established; content:"|eb 27|"; content:"|5d 33 c9 66 b9|"; distance:0; content:"|8d 75 05 8b fe 8a 06 3c|"; distance:0; content:"|75 05 46 8a 06|"; distance:0; content:"|88 07 47 e2 ed eb 0a e8 da ff ff ff|"; distance:0; reference:url,doc.emergingthreats.net/2009251; classtype:shellcode-detect; sid:2009251; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (14)"; flow:to_client,established; content:"clsid"; nocase; content:"37B03544-A4C8-11D2-B634-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03544-A4C8-11D2-B634-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009627; classtype:web-application-attack; sid:2009627; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Wuerzburg Shellcode (UDP)"; content:"|eb 27|"; content:"|5d 33 c9 66 b9|"; distance:0; content:"|8d 75 05 8b fe 8a 06 3c|"; distance:0; content:"|75 05 46 8a 06|"; distance:0; content:"|88 07 47 e2 ed eb 0a e8 da ff ff ff|"; distance:0; reference:url,doc.emergingthreats.net/2009280; classtype:shellcode-detect; sid:2009280; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (15)"; flow:to_client,established; content:"clsid"; nocase; content:"418008F3-CF67-4668-9628-10DC52BE1D08"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*418008F3-CF67-4668-9628-10DC52BE1D08/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009628; classtype:web-application-attack; sid:2009628; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Schauenburg Shellcode"; flow:established; content:"|eb 0f 8b 34 24 33 c9 80 c1|"; content:"|80 36|"; distance:0; content:"|46 e2 fa c3 e8 ec|"; distance:0; reference:url,doc.emergingthreats.net/2009252; classtype:shellcode-detect; sid:2009252; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (16)"; flow:to_client,established; content:"clsid"; nocase; content:"4A5869CF-929D-4040-AE03-FCAFC5B9CD42"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4A5869CF-929D-4040-AE03-FCAFC5B9CD42/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009629; classtype:web-application-attack; sid:2009629; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Schauenburg Shellcode (UDP)"; content:"|eb 0f 8b 34 24 33 c9 80 c1|"; content:"|80 36|"; distance:0; content:"|46 e2 fa c3 e8 ec|"; distance:0; reference:url,doc.emergingthreats.net/2009279; classtype:shellcode-detect; sid:2009279; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (17)"; flow:to_client,established; content:"clsid"; nocase; content:"577FAA18-4518-445E-8F70-1473F8CF4BA4"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*577FAA18-4518-445E-8F70-1473F8CF4BA4/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009630; classtype:web-application-attack; sid:2009630; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Koeln Shellcode"; flow:established; content:"|eb 0f 8b 34 24 33 c9 80 c1|"; content:"|80 36|"; distance:0; content:"|46 e2 fa c3 e8 ec|"; distance:0; reference:url,doc.emergingthreats.net/2009253; classtype:shellcode-detect; sid:2009253; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (18)"; flow:to_client,established; content:"clsid"; nocase; content:"59DC47A8-116C-11D3-9D8E-00C04F72D980"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*59DC47A8-116C-11D3-9D8E-00C04F72D980/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009631; classtype:web-application-attack; sid:2009631; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Koeln Shellcode (UDP)"; content:"|eb 0f 8b 34 24 33 c9 80 c1|"; content:"|80 36|"; distance:0; content:"|46 e2 fa c3 e8 ec|"; distance:0; reference:url,doc.emergingthreats.net/2009278; classtype:shellcode-detect; sid:2009278; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (19)"; flow:to_client,established; content:"clsid"; nocase; content:"7F9CB14D-48E4-43B6-9346-1AEBC39C64D3"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F9CB14D-48E4-43B6-9346-1AEBC39C64D3/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009632; classtype:web-application-attack; sid:2009632; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Lichtenfels Shellcode"; flow:established; content:"|01 fc ff ff 83 e4 fc 8b ec 33 c9 66 b9|"; content:"|80 30|"; distance:0; content:"|40 e2 fA|"; distance:0; reference:url,doc.emergingthreats.net/2009254; classtype:shellcode-detect; sid:2009254; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (20)"; flow:to_client,established; content:"clsid"; nocase; content:"823535A0-0318-11D3-9D8E-00C04F72D980"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*823535A0-0318-11D3-9D8E-00C04F72D980/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009633; classtype:web-application-attack; sid:2009633; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Lichtenfels Shellcode (UDP)"; content:"|01 fc ff ff 83 e4 fc 8b ec 33 c9 66 b9|"; content:"|80 30|"; distance:0; content:"|40 e2 fA|"; distance:0; reference:url,doc.emergingthreats.net/2009277; classtype:shellcode-detect; sid:2009277; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (21)"; flow:to_client,established; content:"clsid"; nocase; content:"8872FF1B-98FA-4D7A-8D93-C9F1055F85BB"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8872FF1B-98FA-4D7A-8D93-C9F1055F85BB/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009634; classtype:web-application-attack; sid:2009634; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Mannheim Shellcode"; flow:established; content:"|80 73 0e|"; content:"|43 e2|"; distance:0; content:"|73 73 73|"; distance:0; content:"|81 86 8c 81|"; distance:0; reference:url,doc.emergingthreats.net/2009255; classtype:shellcode-detect; sid:2009255; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (22)"; flow:to_client,established; content:"clsid"; nocase; content:"8A674B4C-1F63-11D3-B64C-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4C-1F63-11D3-B64C-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009635; classtype:web-application-attack; sid:2009635; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Mannheim Shellcode (UDP)"; content:"|80 73 0e|"; content:"|43 e2|"; distance:0; content:"|73 73 73|"; distance:0; content:"|81 86 8c 81|"; distance:0; reference:url,doc.emergingthreats.net/2009276; classtype:shellcode-detect; sid:2009276; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (23)"; flow:to_client,established; content:"clsid"; nocase; content:"8A674B4D-1F63-11D3-B64C-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4D-1F63-11D3-B64C-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009636; classtype:web-application-attack; sid:2009636; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Berlin Shellcode"; flow:established; content:"|31 c9 b1 fc 80 73 0c|"; content:"|43 e2 8b 9f|"; distance:0; reference:url,doc.emergingthreats.net/2009256; classtype:shellcode-detect; sid:2009256; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (24)"; flow:to_client,established; content:"clsid"; nocase; content:"9CD64701-BDF3-4D14-8E03-F12983D86664"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9CD64701-BDF3-4D14-8E03-F12983D86664/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009638; classtype:web-application-attack; sid:2009638; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Berlin Shellcode (UDP)"; content:"|31 c9 b1 fc 80 73 0c|"; content:"|43 e2 8b 9f|"; distance:0; reference:url,doc.emergingthreats.net/2009275; classtype:shellcode-detect; sid:2009275; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (25)"; flow:to_client,established; content:"clsid"; nocase; content:"9E77AAC4-35E5-42A1-BDC2-8F3FF399847C"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9E77AAC4-35E5-42A1-BDC2-8F3FF399847C/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009639; classtype:web-application-attack; sid:2009639; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Leimbach Shellcode"; flow:established; content:"|5b 31 c9 b1|"; content:"|80 73|"; distance:0; content:"|43 e2|"; distance:0; reference:url,doc.emergingthreats.net/2009257; classtype:shellcode-detect; sid:2009257; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (26)"; flow:to_client,established; content:"clsid"; nocase; content:"A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009640; classtype:web-application-attack; sid:2009640; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Leimbach Shellcode (UDP)"; content:"|5b 31 c9 b1|"; content:"|80 73|"; distance:0; content:"|43 e2|"; distance:0; reference:url,doc.emergingthreats.net/2009274; classtype:shellcode-detect; sid:2009274; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (27)"; flow:to_client,established; content:"clsid"; nocase; content:"A2E3074E-6C3D-11D3-B653-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E3074E-6C3D-11D3-B653-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009641; classtype:web-application-attack; sid:2009641; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Aachen Shellcode"; flow:established; content:"|8b 45 04 35|"; content:"|89 45 04 66 8b 45 02 66 35|"; distance:0; content:"|66 89 45 02|"; distance:0; reference:url,doc.emergingthreats.net/2009258; classtype:shellcode-detect; sid:2009258; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (28)"; flow:to_client,established; content:"clsid"; nocase; content:"A2E30750-6C3D-11D3-B653-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009642; classtype:web-application-attack; sid:2009642; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Aachen Shellcode (UDP)"; content:"|8b 45 04 35|"; content:"|89 45 04 66 8b 45 02 66 35|"; distance:0; content:"|66 89 45 02|"; distance:0; reference:url,doc.emergingthreats.net/2009273; classtype:shellcode-detect; sid:2009273; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Altirix eXpress NS SC ActiveX Arbitrary Code Execution Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"Altiris.AeXNSPkgDL.1"; nocase; distance:0; content:"DownloadAndInstall"; nocase; reference:url,trac.metasploit.com/browser/framework3/trunk/modules/exploits/windows/browser/symantec_altirisdeployment_downloadandinstall.rb?rev=7023; reference:url,secunia.com/advisories/36679; reference:url,doc.emergingthreats.net/2010190; classtype:attempted-user; sid:2010190; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Furth Shellcode"; flow:established; content:"|31 c9 66 b9|"; content:"|80 73|"; distance:0; content:"|43 e2 1f|"; distance:0; reference:url,doc.emergingthreats.net/2009259; classtype:shellcode-detect; sid:2009259; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX AOLShare ActiveX AppString method denial of service Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"YGPWz.CAOLMemExpWz"; nocase; distance:0; content:"AppString"; nocase; reference:url,packetstorm.foofus.com/1001-exploits/aolactivex-dos.txt; reference:url,doc.emergingthreats.net/2010987; classtype:attempted-user; sid:2010987; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Furth Shellcode (UDP)"; content:"|31 c9 66 b9|"; content:"|80 73|"; distance:0; content:"|43 e2 1f|"; distance:0; reference:url,doc.emergingthreats.net/2009272; classtype:shellcode-detect; sid:2009272; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX AtHocGov IWSAlerts ActiveX Control Buffer Overflow Function Call Attempt"; flow:established,to_client; content:"ActiveXObject"; nocase; content:"AtHocGovGSTlBar.GSHelper.1"; nocase; distance:0; content:"CompleteInstallation"; nocase; reference:url,metasploit.com/modules/exploit/windows/browser/athocgov_completeinstallation; reference:url,athoc.com/products/IWSAlerts_overview.aspx; reference:url,doc.emergingthreats.net/2011211; classtype:attempted-user; sid:2011211; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Langenfeld Shellcode"; flow:established; content:"|eb 0f 5b 33 c9 66 b9|"; content:"|80 33|"; distance:0; content:"|43 e2 fa eb|"; distance:0; reference:url,doc.emergingthreats.net/2009260; classtype:shellcode-detect; sid:2009260; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Attachmate Reflection X ActiveX Control 'ControlID' Buffer Overflow Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"R2AXCTRLLib.R2winCtrl"; nocase; distance:0; content:"ControlID"; nocase; reference:url,doc.emergingthreats.net/2011130; classtype:attempted-user; sid:2011130; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Langenfeld Shellcode (UDP)"; content:"|eb 0f 5b 33 c9 66 b9|"; content:"|80 33|"; distance:0; content:"|43 e2 fa eb|"; distance:0; reference:url,doc.emergingthreats.net/2009271; classtype:shellcode-detect; sid:2009271; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX BaoFeng Storm mps.dll ActiveX OnBeforeVideoDownload Buffer Overflow Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"MPS.StormPlayer.1"; nocase; distance:0; content:"OnBeforeVideoDownload"; nocase; reference:bugtraq,34789; reference:url,doc.emergingthreats.net/2010995; classtype:attempted-user; sid:2010995; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Bonn Shellcode"; flow:established; content:"|31 c9 81 e9|"; content:"|83 eb|"; distance:0; content:"|80 73|"; distance:0; content:"|43 e2 f9|"; distance:0; reference:url,doc.emergingthreats.net/2009261; classtype:shellcode-detect; sid:2009261; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Black Ice Printer Driver Resource Toolkit ActiveX Control EnableStartApplication/EnableStartBeforePrint/EnableKeepExistingFiles/EnablePassParameters Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"BlackIceDEVMODECtrl.1"; nocase; distance:0; pcre:"/(EnableStartApplication|EnableStartBeforePrint|EnableKeepExistingFiles|EnablePassParameters)/i"; reference:url,www.securityfocus.com/bid/36548; reference:url,doc.emergingthreats.net/2010208; classtype:attempted-user; sid:2010208; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Bonn Shellcode (UDP)"; content:"|31 c9 81 e9|"; content:"|83 eb|"; distance:0; content:"|80 73|"; distance:0; content:"|43 e2 f9|"; distance:0; reference:url,doc.emergingthreats.net/2009270; classtype:shellcode-detect; sid:2009270; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Black Ice Printer Driver Resource Toolkit ActiveX Control SetApplicationPath/SetStartApplicationParamCode/SetCustomStartAppParameter Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"BlackIceDEVMODECtrl.1"; nocase; distance:0; pcre:"/(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)/i"; reference:url,www.securityfocus.com/bid/36548; reference:url,doc.emergingthreats.net/2010209; classtype:attempted-user; sid:2010209; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Siegburg Shellcode"; flow:established; content:"|31 eb 80 eb|"; content:"|58 80 30|"; distance:0; content:"|40 81 38|"; distance:0; reference:url,doc.emergingthreats.net/2009262; classtype:shellcode-detect; sid:2009262; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Black Ice Printer Driver Resource Toolkit ActiveX Control SaveBlackIceDEVMODE Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"BlackIceDEVMODECtrl.1"; nocase; distance:0; content:"SaveBlackIceDEVMODE"; nocase; reference:url,www.securityfocus.com/bid/36548; reference:url,doc.emergingthreats.net/2010210; classtype:attempted-user; sid:2010210; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Siegburg Shellcode (UDP)"; content:"|31 eb 80 eb|"; content:"|58 80 30|"; distance:0; content:"|40 81 38|"; distance:0; reference:url,doc.emergingthreats.net/2009269; classtype:shellcode-detect; sid:2009269; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Black Ice Printer Driver Resource Toolkit ActiveX Control ClearUserSettings Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"BlackIceDEVMODECtrl.1"; nocase; distance:0; content:"ClearUserSettings"; nocase; reference:url,www.securityfocus.com/bid/36548; reference:url,doc.emergingthreats.net/2010211; classtype:attempted-user; sid:2010211; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Plain1 Shellcode"; flow:established; content:"|89 e1 cd|"; content:"|5b 5d 52 66 bd|"; distance:0; content:"|0f cd 09 dd 55 6a|"; distance:0; content:"|51 50|"; distance:0; reference:url,doc.emergingthreats.net/2009263; classtype:shellcode-detect; sid:2009263; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Black Ice Printer Driver Resource Toolkit ActiveX Control ControlJob Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"BlackIceDEVMODECtrl.1"; nocase; distance:0; content:"ControlJob"; nocase; reference:url,www.securityfocus.com/bid/36548; reference:url,doc.emergingthreats.net/2010212; classtype:attempted-user; sid:2010212; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Plain1 Shellcode (UDP)"; content:"|89 e1 cd|"; content:"|5b 5d 52 66 bd|"; distance:0; content:"|0f cd 09 dd 55 6a|"; distance:0; content:"|51 50|"; distance:0; reference:url,doc.emergingthreats.net/2009268; classtype:shellcode-detect; sid:2009268; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Consona Products SdcUser.TgConCtl ActiveX Control BOF Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"SdcUser.TgConCtl"; nocase; distance:0; content:"RunCMD"; nocase; reference:url,www.kb.cert.org/vuls/id/602801; reference:bugtraq,40006; reference:url,juniper.net/security/auto/vulnerabilities/vuln40006.html; reference:url,doc.emergingthreats.net/2011213; classtype:attempted-user; sid:2011213; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Plain2 Shellcode"; flow:established; content:"|50 50 50 50 40 50 40 50 ff 56 1c 8b d8 57 57 68 02|"; content:"|8b cc 6a|"; distance:0; content:"|51 53|"; distance:0; reference:url,doc.emergingthreats.net/2009264; classtype:shellcode-detect; sid:2009264; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible EMC Captiva PixTools Distributed Imaging ActiveX Control Vulnerable SetLogLevel/SetLogFileName Method Arbitrary File Creation/Overwrite Attempt"; flow:established,from_server; content:"clsid"; nocase; content:"00200338-3D33-4FFC-AC20-67AA234325F3"; nocase; distance:0; content:"SetLog"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3/si"; reference:url,www.securityfocus.com/bid/36566/info; reference:url,www.shinnai.net/xplits/TXT_17zVMhRhsRE6qC6DAj52.html; reference:url,doc.emergingthreats.net/2010036; classtype:attempted-user; sid:2010036; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Plain2 Shellcode (UDP)"; content:"|50 50 50 50 40 50 40 50 ff 56 1c 8b d8 57 57 68 02|"; content:"|8b cc 6a|"; distance:0; content:"|51 53|"; distance:0; reference:url,doc.emergingthreats.net/2009267; classtype:shellcode-detect; sid:2009267; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX EMC Captiva PixTools ActiveX Arbitrary File Creation/Overwrite function call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"PDIControl.PDI.1"; nocase; distance:0; content:"WriteToLog"; distance:0; reference:url,www.securityfocus.com/bid/36566/info; reference:url,www.shinnai.net/xplits/TXT_17zVMhRhsRE6qC6DAj52.html; reference:url,doc.emergingthreats.net/2010154; classtype:web-application-attack; sid:2010154; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any any (msg:"ET SHELLCODE Bindshell1 Decoder Shellcode"; flow:established; content:"|58 99 89 E1 CD 80 96 43 52 66 68|"; content:"|66 53 89 E1 6A 66 58 50 51 56|"; distance:0; reference:url,doc.emergingthreats.net/2009265; classtype:shellcode-detect; sid:2009265; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX EMC Captiva PixTools ActiveX Arbitrary File Creation/Overwrite function call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"PDIControl.PDI.1"; nocase; distance:0; content:"SetLog"; distance:0; reference:url,www.securityfocus.com/bid/36566/info; reference:url,www.shinnai.net/xplits/TXT_17zVMhRhsRE6qC6DAj52.html; reference:url,doc.emergingthreats.net/2010155; classtype:web-application-attack; sid:2010155; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any any (msg:"ET SHELLCODE Bindshell1 Decoder Shellcode (UDP)"; content:"|58 99 89 E1 CD 80 96 43 52 66 68|"; content:"|66 53 89 E1 6A 66 58 50 51 56|"; distance:0; reference:url,doc.emergingthreats.net/2009266; classtype:shellcode-detect; sid:2009266; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Foxit Reader ActiveX OpenFile method Remote Code Execution Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"FOXITREADEROCXLib.FoxitReaderOCX"; nocase; distance:0; content:"OpenFile "; nocase; reference:url,www.exploit-db.com/exploits/11196; reference:url,doc.emergingthreats.net/2010930; classtype:attempted-user; sid:2010930; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET ATTACK_RESPONSE FTP inaccessible directory access COM1"; flow: established; content:"/COM1/"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2000499; classtype:string-detect; sid:2000499; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Gom Player V 2.1.16 ActiveX Command Execution Function call attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"GOMWEBCTRLLib.GomWeb"; nocase; distance:0; content:"Command"; nocase; reference:url,www.packetstormsecurity.org/0909-exploits/gomplayer-exec.txt; reference:url,doc.emergingthreats.net/2010368; classtype:web-application-attack; sid:2010368; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET ATTACK_RESPONSE FTP inaccessible directory access COM2"; flow: established; content:"/COM2/"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2000500; classtype:string-detect; sid:2000500; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Haihaisoft Universal Player ActiveX Control URL Property Buffer Overflow Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"MYACTIVEX|2E|MyActiveXCtrl|2E|1"; nocase; distance:0; content:"URL"; nocase; reference:url,www.shinnai.net/exploits/ZzLsi6TIfSuVPh1kPHmP.txt; reference:url,www.securityfocus.com/bid/37151/info; reference:url,doc.emergingthreats.net/2010374; classtype:attempted-user; sid:2010374; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET ATTACK_RESPONSE FTP inaccessible directory access COM3"; flow: established; content:"/COM3/"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2000501; classtype:string-detect; sid:2000501; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Hyleos ChemView ActiveX Buffer Overflow Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"HyleosChemView.HLChemView"; nocase; distance:0; pcre:"/(ReadMolFile|SaveasMolFile)/i"; reference:url,www.security-assessment.com/files/advisories/2010-02-11_ChemviewX_Activex.pdf; reference:url,secunia.com/advisories/38523/; reference:url,doc.emergingthreats.net/2010999; classtype:attempted-user; sid:2010999; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET ATTACK_RESPONSE FTP inaccessible directory access COM4"; flow: established; content:"/COM4/"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2000502; classtype:string-detect; sid:2000502; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX IBM Access Support ActiveX GetXMLValue Stack Overflow Attempt"; flow:from_server,established; content:"ActiveXObject"; nocase; content:"IbmEgath.IbmEgathCtl.1"; distance:0; nocase; content:"GetXMLValue"; nocase; reference:url,dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/ibmegath_getxmlvalue.rb; reference:url,www.kb.cert.org/vuls/id/340420; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=17871; reference:cve,2009-0215; reference:url,doc.emergingthreats.net/2010482; classtype:attempted-user; sid:2010482; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET ATTACK_RESPONSE FTP inaccessible directory access LPT1"; flow: established; content:"/LPT1/"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2000503; classtype:string-detect; sid:2000503; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft Multimedia Controls - ActiveX control's spline function call Object"; flow:from_server,established; content:" DirectAnimation.PathControl"; content:".Spline|28|"; nocase; pcre:"/new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*\1[\r\n\s]*\)/smi"; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=28841; reference:cve,2006-4446; reference:url,doc.emergingthreats.net/2003103; classtype:attempted-user; sid:2003103; rev:10; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ACTIVEX, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET ATTACK_RESPONSE FTP inaccessible directory access LPT2"; flow: established; content:"/LPT2/"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2000504; classtype:string-detect; sid:2000504; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft Multimedia Controls - ActiveX control's KeyFrame function call Object"; flow:from_server,established; content:"ActiveXObject"; nocase; content:"DirectAnimation.PathControl"; nocase; content:".KeyFrame|28|"; nocase; pcre:"/new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*\1[\r\n\s]*\)/smi"; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=28842; reference:cve,2006-4777; reference:url,doc.emergingthreats.net/2003105; classtype:attempted-user; sid:2003105; rev:10; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET ATTACK_RESPONSE FTP inaccessible directory access LPT3"; flow: established; content:"/LPT3/"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2000505; classtype:string-detect; sid:2000505; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft Microsoft.DbgClr.DTE.8.0 object call CSLID"; flow:from_server,established; content:"CLSID"; nocase; content:"D0C07D56-7C69-43F1-B4A0-25F5A11FAB19"; nocase; reference:url,doc.emergingthreats.net/2003162; classtype:attempted-user; sid:2003162; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET ATTACK_RESPONSE FTP inaccessible directory access LPT4"; flow: established; content:"/LPT4/"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2000506; classtype:string-detect; sid:2000506; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft VsaIDE.DTE object call CSLID"; flow:from_server,established; content:"CLSID"; nocase; content:"E8CCCDDF-CA28-496b-B050-6C07C962476B"; nocase; reference:url,doc.emergingthreats.net/2003163; classtype:attempted-user; sid:2003163; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET ATTACK_RESPONSE FTP inaccessible directory access AUX"; flow: established; content:"/AUX/"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2000507; classtype:string-detect; sid:2000507; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft Business Object Factory object call CSLID"; flow:from_server,established; content:"CLSID"; nocase; content:"AB9BCEDD-EC7E-47E1-9322-D4A210617116"; nocase; reference:url,doc.emergingthreats.net/2003164; classtype:attempted-user; sid:2003164; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET ATTACK_RESPONSE FTP inaccessible directory access NULL"; flow: established; content:"/NULL/"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2000508; classtype:string-detect; sid:2000508; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft Outlook Data Object object call CSLID"; flow:from_server,established; content:"CLSID"; nocase; content:"0006F033-0000-0000-C000-000000000046"; nocase; reference:url,doc.emergingthreats.net/2003165; classtype:attempted-user; sid:2003165; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET 1024: -> any 1024: (msg:"ET ATTACK_RESPONSE Off-Port FTP Without Banners - pass"; flowbits:isset,ET.strippedftpuser; flow:established,from_server; dsize:>7; content:"PASS "; depth:5; offset:0; content:" |0d 0a|"; distance:1; flowbits:set,ET.strippedftppass; reference:url,doc.emergingthreats.net/bin/view/Main/2007717; classtype:trojan-activity; sid:2007717; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft Outlook.Application object call CSLID"; flow:from_server,established; content:"CLSID"; nocase; content:"0006F03A-0000-0000-C000-000000000046"; nocase; reference:url,doc.emergingthreats.net/2003166; classtype:attempted-user; sid:2003166; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET 1024: -> any 1024: (msg:"ET ATTACK_RESPONSE Off-Port FTP Without Banners - retr"; flowbits:isset,ET.strippedftppass; flow:established,from_server; dsize:>7; content:"RETR "; depth:5; offset:0; tag:session,300,seconds; reference:url,doc.emergingthreats.net/bin/view/Main/2007723; classtype:trojan-activity; sid:2007723; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Microsoft Internet Explorer ADODB.Redcordset Double Free Memory Exploit - MS07-009"; flow:from_server,established; content:"CLSID"; nocase; content:"00000535-0000-0010-8000-00AA006D2EA4"; nocase; reference:url,www.milw0rm.com/exploits/3577; reference:url,www.microsoft.com/technet/security/Bulletin/MS07-009.mspx; reference:url,doc.emergingthreats.net/2003514; classtype:attempted-user; sid:2003514; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp any 21 -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Hostile FTP Server Banner (StnyFtpd)"; flow:established,from_server; content:"220 StnyFtpd 0wns j0"; offset:0; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2002809; classtype:trojan-activity; sid:2002809; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX ACTIVEX Possible Microsoft IE Install Engine Inseng.dll Arbitrary Code Execution"; flow:from_server,established; content:"6E449683-C509-11CF-AAFA-00AA00B6015C"; nocase; content:"BaseUrl"; nocase; content:"SetCifFile"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6E449683-C509-11CF-AAFA-00AA00B6015C/si"; reference:url,osvdb.org/10705; reference:cve,2004-0216; reference:url,doc.emergingthreats.net/2003231; classtype:attempted-user; sid:2003231; rev:10; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ACTIVEX, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any 21 -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Hostile FTP Server Banner (Reptile)"; flow:established,from_server; content:"220 Reptile welcomes you"; offset:0; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2002810; classtype:trojan-activity; sid:2002810; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Microsoft IE Install Engine Inseng.dll Arbitrary Code Execution (2)"; flow:from_server,established; content:" ASControls.InstallEngineCtl"; content:"BaseUrl"; nocase; content:"SetCifFile"; nocase; pcre:"/new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*\1[\r\n\s]*\)/smi"; reference:url,osvdb.org/10705; reference:cve,2004-0216; reference:url,doc.emergingthreats.net/2003232; classtype:attempted-user; sid:2003232; rev:59; metadata:created_at 2010_07_30, former_category ACTIVEX, updated_at 2010_07_30;) -alert tcp any 21 -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Hostile FTP Server Banner (Bot Server)"; flow:established,from_server; content:"220 Bot Server (Win32)"; offset:0; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2002811; classtype:trojan-activity; sid:2002811; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Microsoft IE Shell.Application ActiveX Arbitrary Command Execution"; flow:from_server,established; content:" Shell.Application"; content:"GetLink"; nocase; pcre:"/new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*\1[\r\n\s]*\)/smi"; reference:url,osvdb.org/7913; reference:cve,2004-2291; reference:url,doc.emergingthreats.net/2003233; classtype:attempted-user; sid:2003233; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ACTIVEX, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any [21,1024:] -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Unusual FTP Server Banner (fuckFtpd)"; flow:established,from_server; dsize:<18; content:"220 fuckFtpd"; depth:12; offset:0; nocase; reference:url,doc.emergingthreats.net/2009210; classtype:trojan-activity; sid:2009210; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX ACTIVEX Possible Microsoft IE Shell.Application ActiveX Arbitrary Command Execution (2)"; flow:from_server,established; content:"13709620-C279-11CE-A49E-444553540000"; nocase; content:"GetLink"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*13709620-C279-11CE-A49E-444553540000/si"; reference:url,osvdb.org/7913; reference:cve,2004-2291; reference:url,doc.emergingthreats.net/2003234; classtype:attempted-user; sid:2003234; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ACTIVEX, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any [21,1024:] -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Unusual FTP Server Banner (NzmxFtpd)"; flow:established,from_server; dsize:<18; content:"220 NzmxFtpd"; depth:12; offset:0; nocase; reference:url,doc.emergingthreats.net/2009211; classtype:trojan-activity; sid:2009211; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Internet Explorer Plugin.ocx Heap Overflow"; flow: from_server,established; content:"06DD38D0-D187-11CF-A80D-00C04FD74AD8"; nocase; content:".load("; nocase; reference:url,www.hnc3k.com/ievulnerabil.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2001181; classtype:misc-attack; sid:2001181; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter File Download Detected"; flow:to_client,established; content:"stdapi_fs_stat"; depth:54; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009558; classtype:successful-user; sid:2009558; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Internet Information Service adsiis.dll activex remote DOS"; flow:to_client,established; content:"CLSID"; nocase; content:"D6BFA35E-89F2-11D0-8527-00C04FD8D503"; distance:0; nocase; content:"GetObject"; nocase; reference:cve,2008-4300; reference:url,securityreason.com/securityalert/4325; reference:url,doc.emergingthreats.net/2008621; classtype:web-application-attack; sid:2008621; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter Process List (ps) Command Detected"; flow:to_client,established; content:"stdapi_sys_process_get_processes"; depth:65; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009559; classtype:successful-user; sid:2009559; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Image22 ActiveX DrawIcon Method Buffer Overflow Attempt"; flow:to_client,established; content:" $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter Getuid Command Detected"; flow:to_client,established; content:"stdapi_sys_config_getuid"; depth:65; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009560; classtype:successful-user; sid:2009560; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX ImageShack Toolbar ImageShackToolbar.dll ActiveX Control Insecure Method Vulnerability"; flow:to_client,established; content:"clsid"; nocase; content:"BDF9442E-9B03-42C2-87BA-2A459B0A5317"; nocase; pcre:"/file\:.*\.(jpg|ini|exe|dll|bat|com|cab|txt)/i"; content:"BuildSlideShow"; reference:url,www.milw0rm.com/exploits/4981; reference:bugtraq,27439; reference:url,doc.emergingthreats.net/2007853; classtype:web-application-attack; sid:2007853; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter Process Migration Detected"; flow:to_client,established; content:"core_migrate"; depth:60; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009561; classtype:successful-user; sid:2009561; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX ACTIVEX IncrediMail IMMenuShellExt ActiveX Control Buffer Overflow Vulnerability"; flow:to_client,established; content:"CLSID"; nocase; content:"F8984111-38B6-11D5-8725-0050DA2761C4"; nocase; distance:0; content:"ImShExt.dll"; nocase; content:"DoWebMenuAction"; nocase; content:"INCREDISHELLEXTLib.IMMenuShellExt"; nocase; content:"String"; nocase; distance:0; pcre:"/[0-9]{3,}/"; reference:url,www.milw0rm.com/exploits/3877; reference:bugtraq,23674; reference:cve,CVE-2007-1683; reference:url,doc.emergingthreats.net/2007931; classtype:web-application-attack; sid:2007931; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter ipconfig Command Detected"; flow:to_client,established; content:"stdapi_net_config_get_interfaces"; depth:65; threshold: type threshold, track by_src, count 2, seconds 4; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009562; classtype:successful-user; sid:2009562; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX IncrediMail 2.0 Authenticate Method Remote Buffer Overflow Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"032038A5-B655-11D3-BB7D-0050DA276194"; nocase; distance:0; content:"Authenticate"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*032038A5-B655-11D3-BB7D-0050DA276194/si"; reference:url,packetstormsecurity.org/1004-exploits/incredimail20-overflow.txt; reference:url,exploit-db.com/exploits/12030; reference:url,doc.emergingthreats.net/2011048; classtype:attempted-user; sid:2011048; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter Sysinfo Command Detected"; flow:to_client,established; content:"stdapi_sys_config_sysinfo"; depth:60; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009563; classtype:successful-user; sid:2009563; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Installshiled 2009 premier ActiveX File Overwrite Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"ISWiAuto15.ISWiSequence"; nocase; distance:0; content:"SaveToFile"; nocase; reference:url,packetstormsecurity.com/0909-exploits/installshield-overwrite.txt; reference:url,doc.emergingthreats.net/2010257; classtype:attempted-user; sid:2010257; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter Route Command Detected"; flow:to_client,established; content:"stdapi_net_config_get_route"; depth:62; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009564; classtype:successful-user; sid:2009564; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Installshiled 2009 premier ActiveX File Overwrite clsid Access"; flow:established,to_client; content:"34E7A6F9-F260-46BD-AAC8-1E70E22139D2"; nocase; content:"SaveToFile"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*34E7A6F9-F260-46BD-AAC8-1E70E22139D2/si"; reference:url,packetstormsecurity.com/0909-exploits/installshield-overwrite.txt; reference:url,doc.emergingthreats.net/2010258; classtype:web-application-attack; sid:2010258; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter Kill Process Command Detected"; flow:to_client,established; content:"stdapi_sys_process_kill"; depth:60; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009565; classtype:successful-user; sid:2009565; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX InstanGet v2.08 Activex Control DOS clsid access attempt"; flow:established,to_client; content:"clsid"; nocase; content:"98C92840-EB1C-40BD-B6A5-395EC9CD6510D"; nocase; distance:0; content:"ShowBar"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510/si"; reference:url,www.packetstormsecurity.org/0909-exploits/instantget-dos.txt; reference:url,doc.emergingthreats.net/2010279; classtype:web-application-attack; sid:2010279; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter Print Working Directory Command Detected"; flow:to_client,established; content:"stdapi_fs_getwd"; depth:55; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009566; classtype:successful-user; sid:2009566; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX JamDTA ActiveX Control SaveToFile Arbitrary File Overwrite"; flow:to_client,established; content:"clsid"; nocase; content:"0B8F9DC9-A99C-40AD-BE40-88DDE92BAC41"; nocase; distance:0; content:"SaveToFile"; nocase; reference:bugtraq,33345; reference:url,doc.emergingthreats.net/2009115; classtype:web-application-attack; sid:2009115; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter View Current Process ID Command Detected"; flow:to_client,established; content:"stdapi_sys_process_getpid"; depth:60; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009567; classtype:successful-user; sid:2009567; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX IncrediMail 2.0 Authenticate Method Remote Buffer Overflow Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"INCREDISPOOLERLib.Pop"; nocase; distance:0; content:"Authenticate"; nocase; reference:url,packetstormsecurity.org/1004-exploits/incredimail20-overflow.txt; reference:url,exploit-db.com/exploits/12030; reference:url,doc.emergingthreats.net/2011049; classtype:attempted-user; sid:2011049; rev:6; metadata:created_at 2010_07_30, updated_at 2022_05_03;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter Execute Command Detected"; flow:to_client,established; content:"stdapi_sys_process_execute"; depth:62; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009568; classtype:successful-user; sid:2009568; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Sun Java Runtime Environment ActiveX Control Multiple Remote Buffer Overflow"; flow:to_client,established; content:"clsid"; nocase; content:"CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA"; nocase; distance:0; pcre:"/(setInstallerType|setAdditionalPackages|installLatestJRE|compareVersion|installJRE|getStaticCLSID|launch)/i"; reference:url,xforce.iss.net/xforce/xfdb/50508; reference:bugtraq,34931; reference:url,milw0rm.com/exploits/8665; reference:url,doc.emergingthreats.net/2009434; classtype:web-application-attack; sid:2009434; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter System Reboot/Shutdown Detected"; flow:to_client,established; content:"stdapi_sys_power_exitwindows"; depth:62; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009569; classtype:successful-user; sid:2009569; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX JuniperSetup Control Buffer Overflow"; flow:established,from_server; content:"E5F5D008-DD2C-4D32-977D-1A0ADF03058B"; nocase; pcre:"/param[^>]*name\s*=\s*["']?productname["']?[^>]*\s+value\s*=\s*(['"])((?!\1).|\\['"]){200}/Ri"; reference:url,www.eeye.com/html/research/advisories/AD20060424.html; reference:url,doc.emergingthreats.net/2002889; classtype:attempted-user; sid:2002889; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter System Get Idle Time Command Detected"; flow:to_client,established; content:"stdapi_ui_get_idle_time"; depth:60; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009570; classtype:successful-user; sid:2009570; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible EMC Captiva QuickScan Pro KeyWorks KeyHelp Module keyhelp.ocx ActiveX Control Remote Buffer Overflow Attempt"; flow:to_client,established; content:"clsid"; nocase; content:"B7ECFD41-BE62-11D2-B9A8-00104B138C8C"; nocase; distance:0; content:"KEYHELP"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B7ECFD41-BE62-11D2-B9A8-00104B138C8C/si"; reference:url,www.securityfocus.com/bid/36546/info; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=19135; reference:url,downloads.securityfocus.com/vulnerabilities/exploits/36546.html; reference:url,doc.emergingthreats.net/2010012; classtype:attempted-user; sid:2010012; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter Make Directory Command Detected"; flow:to_client,established; content:"stdapi_fs_mkdir"; depth:55; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009571; classtype:successful-user; sid:2009571; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX LEADTOOLS Multimedia Toolkit 15 Arbitrary Files Overwrite"; flow:to_client,established; content:"CLSID"; nocase; content:"00150B1A-B1BA-11CE-ABC6-F5B2E79D9E3F"; nocase; distance:0; pcre:"/.*\.(ini|exe|dll|bat|com|cab|txt)/iR"; content:"SaveSettingsToFile"; distance:0; nocase; reference:url,www.shinnai.altervista.org/xplits/TXT_lyyELAFI8pOPu2p7N6cq.html; reference:bugtraq,28442; reference:cve,CVE-2008-1605; reference:url,doc.emergingthreats.net/2008129; classtype:web-application-attack; sid:2008129; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter Remove Directory Command Detected"; flow:to_client,established; content:"stdapi_fs_delete_dir"; depth:57; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009572; classtype:successful-user; sid:2009572; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Liquid XML Studio 2010 OpenFile Method Remote Heap Overflow Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"E68E401C-7DB0-4F3A-88E1-159882468A79"; nocase; distance:0; content:"OpenFile"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E68E401C-7DB0-4F3A-88E1-159882468A79/si"; reference:url,exploit-db.com/exploits/11750; reference:url,doc.emergingthreats.net/2011050; classtype:attempted-user; sid:2011050; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter Change Directory Command Detected"; flow:to_client,established; content:"stdapi_fs_chdir"; depth:57; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009573; classtype:successful-user; sid:2009573; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Logitech VideoCall ActiveX Start method buffer overflow Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"BF4C7B03-F381-4544-9A33-CB6DAD2A87CD"; nocase; distance:0; content:"Start"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BF4C7B03-F381-4544-9A33-CB6DAD2A87CD/si"; reference:url,osvdb.org/36820; reference:url,www.packetstormsecurity.nl/0911-exploits/logitechvideocall_start.rb.txt; reference:url,www.kb.cert.org/vuls/id/330289; reference:url,doc.emergingthreats.net/2010851; classtype:web-application-attack; sid:2010851; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter List (ls) Command Detected"; flow:to_client,established; content:"stdapi_fs_ls"; depth:52; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009574; classtype:successful-user; sid:2009574; rev:3; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Orca Browser 1.1 ActiveX Command Execution Function call attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"MOZXLib.EmbeddedMoz"; nocase; distance:0; content:"ExecCommand"; nocase; reference:url,www.packetstormsecurity.org/0909-exploits/orca-exec.txt; reference:url,doc.emergingthreats.net/2010364; classtype:web-application-attack; sid:2010364; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter rev2self Command Detected"; flow:to_client,established; content:"stdapi_sys_config_rev2self"; depth:52; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009575; classtype:successful-user; sid:2009575; rev:3; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX ProgramChecker 1.5 ActiveX Command Execution Function call attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"TRATLLib.Options"; nocase; distance:0; content:"Run"; nocase; reference:url,www.packetstormsecurity.org/0909-exploits/programchecker-exec.txt; reference:url,doc.emergingthreats.net/2010366; classtype:web-application-attack; sid:2010366; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter Enabling/Disabling of Keyboard Detected"; flow:to_client,established; content:"stdapi_ui_enable_keyboard"; depth:60; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009576; classtype:successful-user; sid:2009576; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Rising Online Virus Scanner ActiveX Scan Method stack Overflow Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"RavOLCtlLib.RavOnline"; nocase; distance:0; content:"Scan"; nocase; reference:url,packetstorm.foofus.com/1002-exploits/risingonline-dos.txt; reference:bugtraq,38282; reference:url,doc.emergingthreats.net/2011021; classtype:attempted-user; sid:2011021; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter Enabling/Disabling of Mouse Detected"; flow:to_client,established; content:"stdapi_ui_enable_mouse"; depth:60; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009577; classtype:successful-user; sid:2009577; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX SAP GUI vsflexGrid ActiveX Buffer Overflow Function call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"VSFlexGrid.VSFlexGridL"; nocase; distance:0; pcre:"/(Text|EditSelText|EditText|CellFontName|Archive)/i"; reference:url,dsecrg.com/pages/vul/show.php?id=117; reference:url,osvdb.org/show/osvdb/41939; reference:url,doc.emergingthreats.net/2010467; classtype:web-application-attack; sid:2010467; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter File/Memory Interaction Detected"; flow:to_client,established; content:"stdapi_fs_file_expand_path"; depth:60; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009578; classtype:successful-user; sid:2009578; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX ACTIVEX Possible Symantec Altiris Deployment Solution and Notification Server ActiveX Control RunCmd Arbitrary Code Execution Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"Altiris.AeXNSConsoleUtilities"; nocase; distance:0; content:"RunCmd"; nocase; reference:url,securitytracker.com/alerts/2009/Nov/1023238.html; reference:url,www.securityfocus.com/bid/37092; reference:cve,2009-3033; reference:url,doc.emergingthreats.net/2010370; classtype:attempted-user; sid:2010370; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter Registry Interation Detected"; flow:to_client,established; content:"stdapi_registry_create_key"; depth:60; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009579; classtype:successful-user; sid:2009579; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Symantec Antivirus 10.0 Client Proxy ActiveX Control Buffer Overflow Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"cliproxy.objects.1"; nocase; distance:0; content:"SetRemoteComputerName"; nocase; reference:url,www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20100217_02; reference:url,dsecrg.com/pages/vul/show.php?id=139; reference:cve,2010-0108; reference:url,doc.emergingthreats.net/2010959; classtype:attempted-user; sid:2010959; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter File Upload Detected"; flow:to_client,established; content:"core_channel_write"; depth:50; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009580; classtype:successful-user; sid:2009580; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Windows Defender ActiveX DeleteValue method Remote Code Execution Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"MpComExportsLib.MsMpSimpleConfig"; nocase; distance:0; content:"DeleteValue"; nocase; reference:url,www.packetstormsecurity.org/1001-exploits/msdef1-overflow.txt; reference:url,doc.emergingthreats.net/2010835; classtype:attempted-user; sid:2010835; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Metasploit Meterpreter Channel Interaction Detected, Likely Interaction With Executable"; flow:to_client,established; content:"core_channel_interact"; depth:60; reference:url,www.nologin.org/Downloads/Papers/meterpreter.pdf; reference:url,doc.emergingthreats.net/2009651; classtype:successful-user; sid:2009651; rev:3; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Windows Defender ActiveX WriteValue method Remote Code Execution Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"MpComExportsLib.MsMpSimpleConfig"; nocase; distance:0; content:"WriteValue"; nocase; reference:url,www.packetstormsecurity.org/1001-exploits/msdef2-overflow.txt; reference:url,doc.emergingthreats.net/2010837; classtype:attempted-user; sid:2010837; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET 1024:65535 (msg:"ET ATTACK_RESPONSE Metasploit/Meterpreter - Sending metsrv.dll to Compromised Host"; flow:established; content:"|40 00 41 00 42 0043 00 44 00 6d 65 74 73 72 76 2e 64 6c 6c 00 49 6e 69 74 00 5f 52 65 66 6c 65 63 74 69 76 65 4c 6f 61|"; reference:url,doc.emergingthreats.net/2010454; classtype:successful-admin; sid:2010454; rev:3; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Windows Live Messenger ActiveX Control RichUploadControlContextData Buffer Overflow Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"RichUploadLib.UploadControl"; nocase; distance:0; content:"RichUploadControlContextData"; nocase; reference:url,www.securityfocus.com/bid/37908/info; reference:url,doc.emergingthreats.net/2010703; classtype:attempted-user; sid:2010703; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE c99shell phpshell detected"; flow:established,from_server; content:"c99shell"; reference:url,www.rfxn.com/vdb.php; reference:url,doc.emergingthreats.net/bin/view/Main/2007652; classtype:web-application-activity; sid:2007652; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible activePDF WebGrabber ActiveX Control Buffer Overflow Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"APWebGrabber.Object"; nocase; distance:0; content:"GetStatus"; nocase; reference:url,www.fortiguard.com/encyclopedia/vulnerability/activepdf.webgrabber.apwebgrb.ocx.activex.access.html; reference:url,packetstormsecurity.org/0911-exploits/activepdf_webgrabber.rb.txt; reference:url,doc.emergingthreats.net/2010690; classtype:attempted-user; sid:2010690; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET 139 -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE Weak Netbios Lanman Auth Challenge Detected"; flow:from_server; content:"|ff 53 4d 42|"; content:"|00 11 22 33 44 55 66 77 88|"; reference:url,doc.emergingthreats.net/bin/view/Main/2006417; classtype:policy-violation; sid:2006417; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX AOL 9.5 ActiveX control Import method Heap Overflow Attempt"; flow:established,to_client; content:"A105BD70-BF56-4D10-BC91-41C88321F47C"; nocase; content:"Import"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C/si"; reference:url,www.exploit-db.com/exploits/11204; reference:url,doc.emergingthreats.net/2010977; classtype:attempted-user; sid:2010977; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> any 53 (msg:"ET DOS DNS BIND 9 Dynamic Update DoS attempt"; byte_test:1,&,40,2; byte_test:1,>,0,5; byte_test:1,>,0,1; content:"|00 00 06|"; offset:8; content:"|c0 0c 00 ff|"; distance:2; reference:cve,2009-0696; reference:url,doc.emergingthreats.net/2009701; classtype:attempted-dos; sid:2009701; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft Whale Intelligent App Gateway ActiveX Buffer Overflow Function call-1"; flow:from_server,established; content:"ActiveXObject"; nocase; content:"ComponentManager.Installer.1"; distance:0; nocase; content:"CheckForUpdates"; nocase; reference:url,dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/mswhale_checkforupdates.rb; reference:url,www.kb.cert.org/vuls/id/789121; reference:url,doc.emergingthreats.net/210560; classtype:web-application-attack; sid:2010560; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET DOS Possible Cisco ASA 5500 Series Adaptive Security Appliance Remote SIP Inspection Device Reload Denial of Service Attempt"; flow:established,to_server; content:"REGISTER"; depth:8; nocase; isdataat:400,relative; pcre:"/REGISTER.{400}/smi"; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=19915; reference:cve,2010-0569; reference:url,doc.emergingthreats.net/2010817; classtype:attempted-dos; sid:2010817; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft Whale Intelligent App Gateway ActiveX Buffer Overflow Function call-2"; flow:from_server,established; content:"ActiveXObject"; nocase; content:"ComponentManager.Installer.1"; distance:0; nocase; content:"UpdateComponents"; nocase; reference:url,dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/mswhale_checkforupdates.rb; reference:url,www.kb.cert.org/vuls/id/789121; reference:url,doc.emergingthreats.net/2010561; classtype:web-application-attack; sid:2010561; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any 53 -> $DNS_SERVERS any (msg:"ET DNS Excessive DNS Responses with 1 or more RR's (100+ in 10 seconds) - possible Cache Poisoning Attempt"; byte_test:2,>,0,6; byte_test:2,>,0,10; threshold: type both, track by_src, count 100, seconds 10; reference:url,doc.emergingthreats.net/bin/view/Main/2008446; classtype:bad-unknown; sid:2008446; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible McAfee Remediation Client Enginecom.Dll ActiveX Code Execution Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"Enginecom.imagineLANEngine.1"; nocase; distance:0; content:"DeleteSnapshot"; nocase; reference:url,fgc.fortinet.com/encyclopedia/vulnerability/mcafee.remediation.client.enginecom.dll.activex.access.html; reference:url,doc.emergingthreats.net/2010692; classtype:attempted-user; sid:2010692; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"ET SQL MSSQL sp_replwritetovarbin - potential memory overwrite case 1"; flow:to_server,established; content:"s|00|p|00|_|00|r|00|e|00|p|00|l|00|w|00|r|00|i|00|t|00|e|00|t|00|o|00|v|00|a|00|r|00|b|00|i|00|n"; nocase; reference:url,archives.neohapsis.com/archives/fulldisclosure/2008-12/0239.html; reference:url,doc.emergingthreats.net/bin/view/Main/2008909; classtype:attempted-user; sid:2008909; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX NCTAVIFile V 1.6.2 ActiveX File Creation Function call attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"NCTAVIFileLib.AVIFileM"; nocase; distance:0; content:"OpenFile"; nocase; reference:url,www.packetstatic.com/0909-exploits/nctavi-exec.txt; reference:url,doc.emergingthreats.net/2010357; classtype:web-application-attack; sid:2010357; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"ET DELETED MSSQL sp_replwritetovarbin - potential memory overwrite case 2"; flow:to_server,established; content:"sp_replwritetovarbin"; nocase; reference:url,archives.neohapsis.com/archives/fulldisclosure/2008-12/0239.html; reference:url,doc.emergingthreats.net/bin/view/Main/2008910; classtype:attempted-user; sid:2008910; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Novell iPrint Client Browser Plugin ExecuteRequest debug Parameter Stack Overflow Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"36723f97-7aa0-11d4-8919-ff2d71d0d32c"; nocase; distance:0; content:"ExecuteRequest"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723f97-7aa0-11d4-8919-ff2d71d0d32c/si"; reference:url,www.exploit-db.com/moaub-14-novell-iprint-client-browser-plugin-executerequest-debug-parameter-stack-overflow/; reference:bid,42100; reference:url,doc.emergingthreats.net/2011509; classtype:attempted-user; sid:2011509; rev:2; metadata:created_at 2010_09_29, updated_at 2010_09_29;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET NETBIOS Remote SMB2.0 DoS Exploit"; flow:to_server,established; content:"|ff|SMB|72 00 00 00 00 18 53 c8|"; offset:4; content:!"|00 00|"; within:2; reference:url,securityreason.com/exploitalert/7138; reference:url,doc.emergingthreats.net/2009886; classtype:attempted-dos; sid:2009886; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Apple QuickTime _Marshaled_pUnk Backdoor Param Arbitrary Code Execution Attempt"; flow:established,from_server; content:"clsid"; nocase; content:"02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"; nocase; distance:0; content:"_Marshaled_pUnk"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02BF25D5-8C17-4B23-BC80-D3488ABDDC6B/si"; reference:url,www.exploit-db.com/exploits/14843/; classtype:attempted-user; sid:2011412; rev:2; metadata:created_at 2010_09_28, updated_at 2010_09_28;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Psyb0t joining an IRC Channel"; flow:established,to_server; flowbits:isset,is_proto_irc; content:"JOIN #mipsel"; reference:url,www.adam.com.au/bogaurd/PSYB0T.pdf; reference:url,doc.emergingthreats.net/2009172; classtype:trojan-activity; sid:2009172; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Sony ImageStation (SonyISUpload.cab 1.0.0.38) ActiveX Buffer Overflow Exploit"; flow:to_client,established; content:"0x40000"; nocase; content:"E9A7F56F-C40F-4928-8C6F-7A72F2A25222"; nocase; content:"SetLogging"; nocase; reference:url,www.milw0rm.com/exploits/5086; reference:url,www.milw0rm.com/exploits/5100; reference:url,doc.emergingthreats.net/bin/view/Main/2007847; classtype:web-application-attack; sid:2007847; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET HUNTING Suspicious SMTP handshake outbound"; flow:established,to_server; content:"001 RUTHERE"; depth:11; reference:url,doc.emergingthreats.net/bin/view/Main/2008562; classtype:unknown; sid:2008562; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Java Deployment Toolkit CSLID Command Execution Attempt"; flow:to_client,established; content:"CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA"; nocase; content:"launch"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA/si"; reference:url,seclists.org/fulldisclosure/2010/Apr/119; reference:url,doc.emergingthreats.net/2011010; classtype:attempted-user; sid:2011010; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 25 -> $HOME_NET any (msg:"ET HUNTING Suspicious SMTP handshake reply"; flow:established,from_server; content:"701 IMHERE"; depth:10; reference:url,doc.emergingthreats.net/bin/view/Main/2008563; classtype:unknown; sid:2008563; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible NOS Microsystems Adobe Reader/Acrobat getPlus Get_atlcomHelper ActiveX Control Multiple Stack Overflows Remote Code Execution Attempt"; flow:established,to_client; content:"E2883E8F-472F-4fb0-9522-AC9BF37916A7"; nocase; content:"offer-"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+offer-(ineligible|preinstalled|declined|accepted)/si"; reference:url,www.securityfocus.com/bid/37759; reference:url,www.kb.cert.org/vuls/id/773545; reference:url,www.adobe.com/support/security/bulletins/apsb10-02.html; reference:url,www.exploit-db.com/exploits/11172/; reference:cve,2009-3958; reference:url,doc.emergingthreats.net/2010665; classtype:attempted-user; sid:2010665; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET DELETED Unknown Keepalive out"; flow:established,to_server; dsize:5; content:"|17 24 1B 00 00|"; flowbits:isnotset,ET.teamviewerkeepaliveout; flowbits:set,ET.unknownkeepaliveup; flowbits:noalert; reference:url,doc.emergingthreats.net/bin/view/Main/2008779; classtype:unknown; sid:2008779; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible NOS Microsystems Adobe Reader/Acrobat getPlus Get_atlcom Helper ActiveX Control Multiple Stack Overflows Remote Code Execution Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"E2883E8F-472F-4fb0-9522-AC9BF37916A7"; nocase; distance:0; content:!"offer-"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+(service-url|banner|noexec|OS|Lang|return-page|core-product|userid|itemid|_c[xy]|sec-param|secparam)/si"; reference:url,www.securityfocus.com/bid/37759; reference:url,www.kb.cert.org/vuls/id/773545; reference:url,www.exploit-db.com/exploits/11172/; reference:url,www.adobe.com/support/security/bulletins/apsb10-02.html; reference:cve,2009-3958; reference:url,doc.emergingthreats.net/2011675; classtype:attempted-user; sid:2011675; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET DELETED Unknown Keepalive in"; flow:established,to_client; dsize:5; content:"|17 24 1B 00 00|"; flowbits:isnotset,ET.teamviewerkeepaliveout; flowbits:isset,ET.unknownkeepaliveup; reference:url,doc.emergingthreats.net/bin/view/Main/2008780; classtype:unknown; sid:2008780; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (29)"; flow:to_client,established; content:"clsid"; nocase; content:"A8DCF3D5-0780-4EF4-8A83-2CFFAACB8ACE"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009598; classtype:web-application-attack; sid:2009598; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"ET DOS Catalyst memory leak attack"; flow: to_server,established; content:"|41 41 41 0a|"; depth: 20; reference:url,www.cisco.com/en/US/products/products_security_advisory09186a00800b138e.shtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000011; classtype:attempted-dos; sid:2000011; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (30)"; flow:to_client,established; content:"clsid"; nocase; content:"AD8E510D-217F-409B-8076-29C5E73B98E8"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AD8E510D-217F-409B-8076-29C5E73B98E8/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009599; classtype:web-application-attack; sid:2009599; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 162 (msg:"ET SNMP Cisco Non-Trap PDU request on SNMPv1 trap port"; content:"|02 01 00|"; depth:3; byte_test:1,>,159,8,relative; byte_test:1,<,164,8,relative; reference:cve,2004-0714; reference:bugtraq,10186; reference:url,doc.emergingthreats.net/bin/view/Main/2002880; classtype:attempted-dos; sid:2002880; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (31)"; flow:to_client,established; content:"clsid"; nocase; content:"B0EDF163-910A-11D2-B632-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B0EDF163-910A-11D2-B632-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009600; classtype:web-application-attack; sid:2009600; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 162 (msg:"ET SNMP Cisco Non-Trap PDU request on SNMPv2 trap port"; content:"|02 01|"; depth:2; byte_test:1,>,0,0,relative; byte_test:1,<,3,0,relative; byte_test:1,>,159,9,relative; byte_test:1,<,167,9,relative; reference:cve,2004-0714; reference:bugtraq,10186; reference:url,doc.emergingthreats.net/bin/view/Main/2002881; classtype:attempted-dos; sid:2002881; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (32)"; flow:to_client,established; content:"clsid"; nocase; content:"B64016F3-C9A2-4066-96F0-BD9563314726"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B64016F3-C9A2-4066-96F0-BD9563314726/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009601; classtype:web-application-attack; sid:2009601; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 162 (msg:"ET SNMP Cisco Non-Trap PDU request on SNMPv3 trap port"; content:"|02 01 03|"; depth:3; byte_test:1,>,159,43,relative; byte_test:1,<,167,43,relative; reference:cve,2004-0714; reference:bugtraq,10186; reference:url,doc.emergingthreats.net/bin/view/Main/2002882; classtype:attempted-dos; sid:2002882; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (33)"; flow:to_client,established; content:"clsid"; nocase; content:"BB530C63-D9DF-4B49-9439-63453962E598"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BB530C63-D9DF-4B49-9439-63453962E598/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009602; classtype:web-application-attack; sid:2009602; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $EXTERNAL_NET !161 -> $HOME_NET 49152: (msg:"ET SNMP Cisco Non-Trap PDU request on SNMPv1 random port"; content:"|02 01 00|"; depth:3; byte_test:1,>,159,8,relative; byte_test:1,<,164,8,relative; reference:cve,2004-0714; reference:bugtraq,10186; reference:url,doc.emergingthreats.net/bin/view/Main/2002926; classtype:attempted-dos; sid:2002926; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (34)"; flow:to_client,established; content:"clsid"; nocase; content:"C531D9FD-9685-4028-8B68-6E1232079F1E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C531D9FD-9685-4028-8B68-6E1232079F1E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009603; classtype:web-application-attack; sid:2009603; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $EXTERNAL_NET !161 -> $HOME_NET 49152: (msg:"ET SNMP Cisco Non-Trap PDU request on SNMPv2 random port"; content:"|02 01|"; depth:2; byte_test:1,>,0,0,relative; byte_test:1,<,3,0,relative; byte_test:1,>,159,9,relative; byte_test:1,<,167,9,relative; reference:cve,2004-0714; reference:bugtraq,10186; reference:url,doc.emergingthreats.net/bin/view/Main/2002927; classtype:attempted-dos; sid:2002927; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (35)"; flow:to_client,established; content:"clsid"; nocase; content:"C5702CCC-9B79-11D3-B654-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCC-9B79-11D3-B654-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009604; classtype:web-application-attack; sid:2009604; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $EXTERNAL_NET !161 -> $HOME_NET 49152: (msg:"ET SNMP Cisco Non-Trap PDU request on SNMPv3 random port"; content:"|02 01 03|"; depth:3; byte_test:1,>,159,43,relative; byte_test:1,<,167,43,relative; reference:cve,2004-0714; reference:bugtraq,10186; reference:url,doc.emergingthreats.net/bin/view/Main/2002928; classtype:attempted-dos; sid:2002928; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (37)"; flow:to_client,established; content:"clsid"; nocase; content:"C5702CCE-9B79-11D3-B654-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCE-9B79-11D3-B654-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009606; classtype:web-application-attack; sid:2009606; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2022_05_03;) -#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET DOS Excessive SMTP MAIL-FROM DDoS"; flow: to_server, established; content:"MAIL FROM|3a|"; nocase; window: 0; id:0; threshold: type limit, track by_src, count 30, seconds 60; reference:url,doc.emergingthreats.net/bin/view/Main/2001795; classtype:denial-of-service; sid:2001795; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download (1)"; flow:to_client,established; content:"F0E42D50-368C-11D0-AD81-00A0C90DC8D9"; nocase; pcre:"/(SnapshotPath|CompressedPath|PrintSnapshot)/i"; pcre:"/(exe|bat|com|dll|ini)/i"; reference:bugtraq,30114; reference:url,downloads.securityfocus.com/vulnerabilities/exploits/30114.html; reference:url,pstgroup.blogspot.com/2008/07/exploitmicrosoft-office-snapshot-viewer.html; reference:url,doc.emergingthreats.net/bin/view/Main/2008407; classtype:web-application-attack; sid:2008407; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET DELETED HELO Non-Displayable Characters MailEnable Denial of Service"; flow:established,to_server; content:"HELO "; nocase; depth:60; pcre:"/^[^\n]*[\x00-\x08\x0e-\x1f]/R"; reference:cve,2006-3277; reference:bugtraq,18630; reference:url,doc.emergingthreats.net/bin/view/Main/2002998; classtype:attempted-dos; sid:2002998; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download (2)"; flow:to_client,established; content:"F0E42D60-368C-11D0-AD81-00A0C90DC8D9"; nocase; pcre:"/(SnapshotPath|CompressedPath|PrintSnapshot)/i"; pcre:"/(exe|bat|com|dll|ini)/i"; reference:bugtraq,30114; reference:url,downloads.securityfocus.com/vulnerabilities/exploits/30114.html; reference:url,pstgroup.blogspot.com/2008/07/exploitmicrosoft-office-snapshot-viewer.html; reference:url,doc.emergingthreats.net/bin/view/Main/2008408; classtype:web-application-attack; sid:2008408; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 3306 (msg:"ET DOS Possible MYSQL GeomFromWKB() function Denial Of Service Attempt"; flow:to_server,established; content:"SELECT"; nocase; content:"geometrycollectionfromwkb"; distance:0; nocase; pcre:"/SELECT.+geometrycollectionfromwkb/si"; reference:url,www.securityfocus.com/bid/37297/info; reference:url,marc.info/?l=oss-security&m=125881733826437&w=2; reference:url,downloads.securityfocus.com/vulnerabilities/exploits/37297.txt; reference:cve,2009-4019; reference:url,doc.emergingthreats.net/2010491; classtype:attempted-dos; sid:2010491; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download (3)"; flow:to_client,established; content:"clsid"; nocase; content:"F2175210-368C-11D0-AD81-00A0C90DC8D9"; nocase; pcre:"/(SnapshotPath|CompressedPath|PrintSnapshot)/i"; pcre:"/(exe|bat|com|dll|ini)/i"; reference:bugtraq,30114; reference:url,downloads.securityfocus.com/vulnerabilities/exploits/30114.html; reference:url,pstgroup.blogspot.com/2008/07/exploitmicrosoft-office-snapshot-viewer.html; reference:url,doc.emergingthreats.net/bin/view/Main/2008409; classtype:web-application-attack; sid:2008409; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 3306 (msg:"ET DOS Possible MYSQL SELECT WHERE to User Variable Denial Of Service Attempt"; flow:to_server,established; content:"SELECT"; nocase; content:"WHERE"; distance:0; nocase; content:"SELECT"; nocase; content:"INTO"; distance:0; nocase; content:"|60|"; within:50; content:"|60|"; pcre:"/SELECT.+WHERE.+SELECT.+\x60/si"; reference:url,www.securityfocus.com/bid/37297/info; reference:url,marc.info/?l=oss-security&m=125881733826437&w=2; reference:url,downloads.securityfocus.com/vulnerabilities/exploits/37297-2.txt; reference:cve,2009-4019; reference:url,doc.emergingthreats.net/2010492; classtype:attempted-dos; sid:2010492; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (38)"; flow:to_client,established; content:"clsid"; nocase; content:"C5702CCF-9B79-11D3-B654-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCF-9B79-11D3-B654-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009607; classtype:web-application-attack; sid:2009607; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 3306 (msg:"ET DOS Possible MySQL ALTER DATABASE Denial Of Service Attempt"; flow:established,to_server; content:"ALTER "; nocase; content:"DATABASE"; nocase; within:12; content:"|22|."; distance:0; content:"UPGRADE "; nocase; distance:0; content:"DATA"; nocase; within:8; pcre:"/ALTER.+DATABASE.+\x22\x2E(\x22|\x2E\x22|\x2E\x2E\x2F\x22).+UPGRADE.+DATA/si"; reference:url,securitytracker.com/alerts/2010/Jun/1024160.html; reference:url,dev.mysql.com/doc/refman/5.1/en/alter-database.html; reference:cve,2010-2008; reference:url,doc.emergingthreats.net/2011761; classtype:attempted-dos; sid:2011761; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (40)"; flow:to_client,established; content:"clsid"; nocase; content:"C6B14B32-76AA-4A86-A7AC-5C79AAF58DA7"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6B14B32-76AA-4A86-A7AC-5C79AAF58DA7/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009609; classtype:web-application-attack; sid:2009609; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $EXTERNAL_NET 123 -> $HOME_NET 123 (msg:"ET DOS Potential Inbound NTP denial-of-service attempt (repeated mode 7 request)"; dsize:1; content:"|17|"; threshold:type limit, count 1, seconds 60, track by_src; reference:url,www.kb.cert.org/vuls/id/568372; reference:cve,2009-3563; reference:url,doc.emergingthreats.net/2010486; classtype:attempted-dos; sid:2010486; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (41)"; flow:to_client,established; content:"clsid"; nocase; content:"CAAFDD83-CEFC-4E3D-BA03-175F17A24F91"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAAFDD83-CEFC-4E3D-BA03-175F17A24F91/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009610; classtype:web-application-attack; sid:2009610; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $EXTERNAL_NET 123 -> $HOME_NET 123 (msg:"ET DOS Potential Inbound NTP denial-of-service attempt (repeated mode 7 reply)"; dsize:4; content:"|97 00 00 00|"; threshold:type limit, count 1, seconds 60, track by_src; reference:url,www.kb.cert.org/vuls/id/568372; reference:cve,2009-3563; reference:url,doc.emergingthreats.net/2010487; classtype:attempted-dos; sid:2010487; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (42)"; flow:to_client,established; content:"clsid"; nocase; content:"D02AAC50-027E-11D3-9D8E-00C04F72D980"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D02AAC50-027E-11D3-9D8E-00C04F72D980/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009611; classtype:web-application-attack; sid:2009611; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $HOME_NET 123 -> $EXTERNAL_NET 123 (msg:"ET DELETED Potential Inbound NTP denial-of-service attempt (repeated mode 7 request)"; dsize:1; content:"|17|"; threshold:type limit, count 1, seconds 60, track by_src; reference:url,www.kb.cert.org/vuls/id/568372; reference:cve,2009-3563; reference:url,doc.emergingthreats.net/2010488; classtype:attempted-dos; sid:2010488; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (44)"; flow:to_client,established; content:"clsid"; nocase; content:"FA7C375B-66A7-4280-879D-FD459C84BB02"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FA7C375B-66A7-4280-879D-FD459C84BB02/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009613; classtype:web-application-attack; sid:2009613; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $HOME_NET 123 -> $EXTERNAL_NET 123 (msg:"ET DELETED Potential Inbound NTP denial-of-service attempt (repeated mode 7 reply)"; dsize:4; content:"|97 00 00 00|"; threshold:type limit, count 1, seconds 60, track by_src; reference:url,www.kb.cert.org/vuls/id/568372; reference:cve,2009-3563; reference:url,doc.emergingthreats.net/2010489; classtype:attempted-dos; sid:2010489; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (1)"; flow:to_client,established; content:"clsid"; nocase; content:"011B3619-FE63-4814-8A84-15A194CE9CE3"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*011B3619-FE63-4814-8A84-15A194CE9CE3/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009614; classtype:web-application-attack; sid:2009614; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"ET DOS Possible SolarWinds TFTP Server Read Request Denial Of Service Attempt"; content:"|00 01 01|"; depth:3; content:"NETASCII"; reference:url,www.exploit-db.com/exploits/12683/; reference:url,doc.emergingthreats.net/2011673; classtype:attempted-dos; sid:2011673; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (2)"; flow:to_client,established; content:"clsid"; nocase; content:"0149EEDF-D08F-4142-8D73-D23903D21E90"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0149EEDF-D08F-4142-8D73-D23903D21E90/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009615; classtype:web-application-attack; sid:2009615; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"ET DOS SolarWinds TFTP Server Long Write Request Denial Of Service Attempt"; content:"|00 02|"; depth:2; isdataat:1000,relative; content:!"|0A|"; within:1000; content:"NETASCII"; distance:1000; reference:url,www.exploit-db.com/exploits/13836/; reference:url,doc.emergingthreats.net/2011674; classtype:attempted-dos; sid:2011674; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (3)"; flow:to_client,established; content:"clsid"; nocase; content:"0369B4E5-45B6-11D3-B650-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E5-45B6-11D3-B650-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009616; classtype:web-application-attack; sid:2009616; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 5900 (msg:"ET DOS Possible VNC ClientCutText Message Denial of Service/Memory Corruption Attempt"; flow:established,to_server; content:"|06|"; depth:1; isdataat:1000,relative; content:!"|0A|"; within:1000; reference:url,www.fortiguard.com/encyclopedia/vulnerability/vnc.server.clientcuttext.message.memory.corruption.html; reference:url,doc.emergingthreats.net/2011732; classtype:attempted-dos; sid:2011732; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (4)"; flow:to_client,established; content:"clsid"; nocase; content:"0369B4E6-45B6-11D3-B650-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E6-45B6-11D3-B650-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009617; classtype:web-application-attack; sid:2009617; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 2200 (msg:"ET EXPLOIT CA BrightStor ARCserve Mobile Backup LGSERVER.EXE Heap Corruption"; flow:established,to_server; content:"|4e 3d 2c 1b|"; depth:4; isdataat:2891,relative; reference:cve,2007-0449; reference:url,doc.emergingthreats.net/bin/view/Main/2003369; classtype:attempted-admin; sid:2003369; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (5)"; flow:to_client,established; content:"clsid"; nocase; content:"055CB2D7-2969-45CD-914B-76890722F112"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*055CB2D7-2969-45CD-914B-76890722F112/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009618; classtype:web-application-attack; sid:2009618; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 1900 (msg:"ET EXPLOIT Computer Associates Mobile Backup Service LGSERVER.EXE Stack Overflow"; flow:established,to_server; content:"0000033000"; depth:10; isdataat:1000,relative; reference:url,www.milw0rm.com/exploits/3244; reference:url,doc.emergingthreats.net/bin/view/Main/2003378; classtype:attempted-admin; sid:2003378; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (6)"; flow:to_client,established; content:"clsid"; nocase; content:"15D6504A-5494-499C-886C-973C9E53B9F1"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15D6504A-5494-499C-886C-973C9E53B9F1/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009619; classtype:web-application-attack; sid:2009619; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 2401 (msg:"ET EXPLOIT CVS server heap overflow attempt (target Linux)"; flow: to_server,established; dsize: >512; content:"|45 6e 74 72 79 20 43 43 43 43 43 43 43 43 43 2f 43 43|"; offset: 0; depth: 20; threshold: type limit, track by_dst, count 1, seconds 60; reference:url,doc.emergingthreats.net/bin/view/Main/2000048; classtype:attempted-admin; sid:2000048; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible AOL IWinAmp ActiveX ConvertFile Buffer Overflow Attempt"; flow:from_server,established; content:"FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6"; nocase; content:"ConvertFile"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6/si"; reference:url,www.milw0rm.org/exploits/8733; reference:url,www.securityfocus.com/bid/35028; reference:url,doc.emergingthreats.net/2010160; classtype:attempted-user; sid:2010160; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 2401 (msg:"ET EXPLOIT CVS server heap overflow attempt (target BSD)"; flow: to_server,established; dsize: >512; content:"|45 6e 74 72 79 20 61 61 61 61 61 61 61 61 61 61 61 61|"; offset: 0; depth: 18; threshold: type limit, track by_dst, count 1, seconds 60; reference:url,doc.emergingthreats.net/bin/view/Main/2000031; classtype:attempted-admin; sid:2000031; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible AOL 9.5 BindToFile Heap Overflow Attempt"; flow:established,to_client; content:"BC8A96C6-3909-11D5-9001-00C04F4C3B9F"; nocase; content:"BindToFile"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC8A96C6-3909-11D5-9001-00C04F4C3B9F/si"; reference:url,tcc.hellcode.net/advisories/hellcode-adv008.txt; reference:url,doc.emergingthreats.net/2010814; classtype:attempted-user; sid:2010814; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 2401 (msg:"ET EXPLOIT CVS server heap overflow attempt (target Solaris)"; flow: to_server,established; dsize: >512; content:"|41 72 67 75 6d 65 6e 74 20 62 62 62 62 62 62 62 62 62|"; offset: 0; depth: 18; threshold: type limit, track by_dst, count 1, seconds 60; reference:url,doc.emergingthreats.net/bin/view/Main/2000049; classtype:attempted-admin; sid:2000049; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX AOL 9.5 Phobos.Playlist Import ActiveX Buffer Overflow Attempt"; flow:established,to_client; content:"A105BD70-BF56-4D10-BC91-41C88321F47C"; nocase; content:".Import"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C/si"; reference:url,www.rec-sec.com/2010/01/25/aol-playlist-class-buffer-overflow/; reference:url,doc.emergingthreats.net/2010962; classtype:attempted-user; sid:2010962; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"ET EXPLOIT Catalyst SSH protocol mismatch"; flow: to_server,established; content:"|61 25 61 25 61 25 61 25 61 25 61 25 61 25|"; reference:url,www.cisco.com/warp/public/707/catalyst-ssh-protocolmismatch-pub.shtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000007; classtype:attempted-dos; sid:2000007; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Acer LunchApp Arbitrary Code Exucution Attempt"; flow:established,from_server; content:"3895DD35-7573-11D2-8FED-00606730D3AA"; nocase; content:"RUN"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3895DD35-7573-11D2-8FED-00606730D3AA/si"; reference:url,securitytracker.com/alerts/2009/Aug/1022752.html; reference:url,www.kb.cert.org/vuls/id/485961; reference:url,www.securityfocus.com/bid/21207/info; reference:url,doc.emergingthreats.net/2009868; classtype:attempted-user; sid:2009868; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"ET EXPLOIT Cisco Telnet Buffer Overflow"; flow: to_server,established; content:"|3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 3f 61 7e 20 25 25 25 25 25 58 58|"; threshold: type limit, track by_src, count 1, seconds 120; reference:url,www.cisco.com/warp/public/707/cisco-sn-20040326-exploits.shtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000005; classtype:attempted-dos; sid:2000005; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Adobe Shockwave Player ActiveX Control Buffer Overflow clsid access"; flow:established,to_client; content:"233C1507-6A77-46A4-9443-F871F945D258"; nocase; content:"PlayerVersion"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*233C1507-6A77-46A4-9443-F871F945D258/si"; reference:url,www.milw0rm.com/exploits/9682; reference:url,doc.emergingthreats.net/2010256; classtype:web-application-attack; sid:2010256; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 1900 (msg:"ET EXPLOIT UPnP DLink M-Search Overflow Attempt"; content:"M-SEARCH "; depth:9; nocase; isdataat:500,relative; pcre:"/M-SEARCH\s+[^\n]{500}/i"; reference:url,www.eeye.com/html/research/advisories/AD20060714.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003039; classtype:attempted-user; sid:2003039; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Akamai Download Manager Stack Buffer Overflow CLSID Access 2"; flow:to_client,established; content:"2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B/si"; reference:url,labs.idefense.com/intelligence/vulnerabilities/display.php?id=813; reference:url,doc.emergingthreats.net/2009688; classtype:web-application-attack; sid:2009688; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 427 (msg:"ET EXPLOIT ExtremeZ-IP File and Print Server Multiple Vulnerabilities - udp"; content:"language"; content:"|65 7a 69 70 3a 2f 2f 62 6c 61 2f 62 6c 61 3f 53 4e 3d 62 6c 61 3f 50 4e 3d 62 6c 61 3f 55 4e 3d 62 6c 61|"; reference:bugtraq,27718; reference:url,aluigi.altervista.org/adv/ezipirla-adv.txt; reference:cve,CVE-2008-0767; reference:url,doc.emergingthreats.net/bin/view/Main/2007876; classtype:successful-dos; sid:2007876; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Akamai Download Manager Stack Buffer Overflow CLSID Access 3"; flow:to_client,established; content:"FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1/si"; reference:url,labs.idefense.com/intelligence/vulnerabilities/display.php?id=813; reference:url,doc.emergingthreats.net/2009689; classtype:web-application-attack; sid:2009689; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET FTP FTP SITE command attempt without login"; flow:established,to_server; flowbits:isnotset,ET.ftp.user.login; content:!"USER"; depth:4; content:"SITE"; nocase; reference:url,www.nsftools.com/tips/RawFTP.htm; reference:url,doc.emergingthreats.net/2010732; classtype:attempted-recon; sid:2010732; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Symantec Altiris Deployment Solution AeXNSPkgDLLib.dll ActiveX Control DownloadAndInstall Method Arbitrary Code Execution Attempt"; flow:from_server,established; content:"63716E93-033D-48B0-8A2F-8E8473FD7AC7"; nocase; content:"DownloadAndInstall"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*63716E93-033D-48B0-8A2F-8E8473FD7AC7/si"; reference:url,securitytracker.com/alerts/2009/Sep/1022928.html; reference:url,www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20090922_00; reference:url,trac.metasploit.com/browser/framework3/trunk/modules/exploits/windows/browser/symantec_altirisdeployment_downloadandinstall.rb?rev=7023; reference:url,doc.emergingthreats.net/2010011; classtype:attempted-user; sid:2010011; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET FTP FTP RMDIR command attempt without login"; flow:established,to_server; flowbits:isnotset,ET.ftp.user.login; content:!"USER"; depth:4; content:"RMDIR"; nocase; reference:url,www.nsftools.com/tips/RawFTP.htm; reference:url,doc.emergingthreats.net/2010733; classtype:attempted-recon; sid:2010733; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX AOLShare ActiveX AppString method denial of service Attempt"; flow:established,to_client; content:"18477169-4752-41DC-AB0F-C50EBA75641D"; nocase; content:"Appstring"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18477169-4752-41DC-AB0F-C50EBA75641D/si"; reference:url,packetstorm.foofus.com/1001-exploits/aolactivex-dos.txt; reference:url,doc.emergingthreats.net/2010986; classtype:attempted-user; sid:2010986; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET FTP FTP MKDIR command attempt without login"; flow:established,to_server; flowbits:isnotset,ET.ftp.user.login; content:!"USER"; depth:4; content:"MKDIR"; nocase; reference:url,www.nsftools.com/tips/RawFTP.htm; reference:url,doc.emergingthreats.net/2010734; classtype:attempted-recon; sid:2010734; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Attachmate Reflection X ActiveX Control 'ControlID' Buffer Overflow Attempt"; flow:established,to_client; content:"15B168B2-AD3C-11D1-A8D8-00A0C9200E61"; nocase; content:"ControlID"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15B168B2-AD3C-11D1-A8D8-00A0C9200E61/si"; reference:url,doc.emergingthreats.net/2011129; classtype:attempted-user; sid:2011129; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET FTP FTP PWD command attempt without login"; flow:established,to_server; flowbits:isnotset,ET.ftp.user.login; content:!"USER"; depth:4; content:"PWD"; nocase; reference:url,www.nsftools.com/tips/RawFTP.htm; reference:url,doc.emergingthreats.net/2010735; classtype:attempted-recon; sid:2010735; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Autodesk Design Review DWF Viewer ActiveX Control SaveAs Insecure Method"; flow:to_client,established; content:"A662DA7E-CCB7-4743-B71A-D817F6D575DF"; nocase; content:"SaveAS"; nocase; reference:url,retrogod.altervista.org/9sg_autodesk_revit_arch_2009_exploit.html; reference:url,secunia.com/Advisories/31989/; reference:url,doc.emergingthreats.net/2008612; classtype:web-application-attack; sid:2008612; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET FTP FTP RETR command attempt without login"; flow:established,to_server; flowbits:isnotset,ET.ftp.user.login; content:!"USER"; depth:4; content:"RETR"; nocase; reference:url,www.nsftools.com/tips/RawFTP.htm; reference:url,doc.emergingthreats.net/2010736; classtype:attempted-recon; sid:2010736; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Autodesk IDrop Indicator ActiveX Control Memory Corruption"; flow:to_client,established; content:"21E0CB95-1198-4945-A3D2-4BF804295F78"; nocase; pcre:"/(Src|Background|PackageXml)/i"; reference:url,secunia.com/advisories/34563/; reference:url,archives.neohapsis.com/archives/fulldisclosure/2009-04/0020.html; reference:url,vupen.com/english/advisories/2009/0942; reference:url,milw0rm.com/exploits/8560; reference:url,doc.emergingthreats.net/2009399; classtype:web-application-attack; sid:2009399; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET FTP FTP NLST command attempt without login"; flow:established,to_server; flowbits:isnotset,ET.ftp.user.login; content:!"USER"; depth:4; content:"NLST"; nocase; reference:url,www.nsftools.com/tips/RawFTP.htm; reference:url,doc.emergingthreats.net/2010737; classtype:attempted-recon; sid:2010737; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Avax Vector avPreview.ocx ActiveX Control Buffer Overflow"; flow:to_client,established; content:"9589AEC9-1C2D-4428-B7E8-63B39D356F9C"; nocase; content:"PrinterName"; nocase; reference:url,packetstormsecurity.nl/0907-exploits/avax13-dos.txt; reference:bugtraq,35582; reference:url,juniper.net/security/auto/vulnerabilities/vuln35583.html; reference:url,doc.emergingthreats.net/2009792; classtype:web-application-attack; sid:2009792; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET FTP FTP RNTO command attempt without login"; flow:established,to_server; flowbits:isnotset,ET.ftp.user.login; content:!"USER"; depth:4; content:"RNTO"; nocase; reference:url,www.nsftools.com/tips/RawFTP.htm; reference:url,doc.emergingthreats.net/2010738; classtype:attempted-recon; sid:2010738; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX BaoFeng Storm ActiveX Control OnBeforeVideoDownload Method Buffer Overflow"; flow:to_client,established; content:"6BE52E1D-E586-474F-A6E2-1A85A9B4D9FB"; nocase; content:"OnBeforeVideoDownload"; nocase; reference:bugtraq,34789; reference:url,milw0rm.com/exploits/8579; reference:url,doc.emergingthreats.net/2009425; classtype:web-application-attack; sid:2009425; rev:10; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET FTP FTP RNFR command attempt without login"; flow:established,to_server; flowbits:isnotset,ET.ftp.user.login; content:!"USER"; depth:4; content:"RNFR"; nocase; reference:url,www.nsftools.com/tips/RawFTP.htm; reference:url,doc.emergingthreats.net/2010739; classtype:attempted-recon; sid:2010739; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX BaoFeng Storm ActiveX Control SetAttributeValue Method Buffer Overflow"; flow:to_client,established; content:"BD103B2B-30FB-4F1E-8C17-D8F6AADBCC05"; nocase; content:"SetAttributeValue"; nocase; reference:bugtraq,34869; reference:url,juniper.net/security/auto/vulnerabilities/vuln34869.html; reference:url,vupen.com/english/advisories/2009/1392; reference:url,milw0rm.com/exploits/8757; reference:url,doc.emergingthreats.net/2009657; classtype:web-application-attack; sid:2009657; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET FTP FTP STOR command attempt without login"; flow:established,to_server; flowbits:isnotset,ET.ftp.user.login; content:!"USER"; depth:4; content:"STOR"; nocase; reference:url,www.nsftools.com/tips/RawFTP.htm; reference:url,doc.emergingthreats.net/2010740; classtype:attempted-recon; sid:2010740; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Black Ice Printer Driver Resource Toolkit ActiveX Control EnableStartApplication/EnableStartBeforePrint/EnableKeepExistingFiles/EnablePassParameters Buffer Overflow Attempt"; flow:from_server,established; content:"1503569A-0AE2-4333-B6E6-466AB0BC73E5"; nocase; content:"Enable"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(EnableKeepExistingFiles|EnableStartApplication|EnableStartBeforePrint|EnablePassParameters)/si"; reference:url,www.securityfocus.com/bid/36548; reference:url,doc.emergingthreats.net/2010203; classtype:attempted-user; sid:2010203; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET EXPLOIT GuildFTPd CWD and LIST Command Heap Overflow - POC-1"; flow:established; content:"cwd"; depth:4; nocase; dsize:>74; pcre:"/(\/\.){70,}/i"; reference:url,milw0rm.com/exploits/6738; reference:cve,CVE-2008-4572; reference:bugtraq,31729; reference:url,doc.emergingthreats.net/bin/view/Main/2008776; classtype:web-application-attack; sid:2008776; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Black Ice Printer Driver Resource Toolkit ActiveX Control SetApplicationPath/SetStartApplicationParamCode/SetCustomStartAppParameter Buffer Overflow Attempt"; flow:from_server,established; content:"1503569A-0AE2-4333-B6E6-466AB0BC73E5"; nocase; content:"Set"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)/si"; reference:url,www.securityfocus.com/bid/36548; reference:url,doc.emergingthreats.net/2010204; classtype:attempted-user; sid:2010204; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET EXPLOIT GuildFTPd CWD and LIST Command Heap Overflow - POC-2"; flow:established; content:"list"; depth:5; nocase; dsize:>74; pcre:"/[\w]{70,}/i"; reference:url,milw0rm.com/exploits/6738; reference:cve,CVE-2008-4572; reference:bugtraq,31729; reference:url,doc.emergingthreats.net/bin/view/Main/2008777; classtype:web-application-attack; sid:2008777; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Black Ice Printer Driver Resource Toolkit ActiveX Control SaveBlackIceDEVMODE Buffer Overflow Attempt"; flow:from_server,established; content:"1503569A-0AE2-4333-B6E6-466AB0BC73E5"; nocase; content:"SaveBlackIceDEVMODE"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5/si"; reference:url,www.securityfocus.com/bid/36548; reference:url,doc.emergingthreats.net/2010205; classtype:attempted-user; sid:2010205; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 1530 (msg:"ET EXPLOIT HP Open View Data Protector Buffer Overflow Attempt"; flow:established,to_server; content:"|B6 29 8C 23 FF FF FF|"; pcre:"/\xB6\x29\x8C\x23\xFF\xFF\xFF[\xF8-\xFF]/"; reference:url,dvlabs.tippingpoint.com/advisory/TPTI-09-15; reference:url,doc.emergingthreats.net/2010546; reference:cve,2007-2281; classtype:attempted-admin; sid:2010546; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Black Ice Printer Driver Resource Toolkit ActiveX Control ClearUserSettings Buffer Overflow Attempt"; flow:from_server,established; content:"1503569A-0AE2-4333-B6E6-466AB0BC73E5"; nocase; content:"ClearUserSettings"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5/si"; reference:url,www.securityfocus.com/bid/36548; reference:url,doc.emergingthreats.net/2010206; classtype:attempted-user; sid:2010206; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET FTP HP-UX LIST command without login"; flow:established,to_server; flowbits:isnotset,ET.ftp.user.login; content:"LIST "; nocase; depth:5; reference:cve,2005-3296; reference:bugtraq,15138; reference:url,doc.emergingthreats.net/bin/view/Main/2002851; classtype:attempted-recon; sid:2002851; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Black Ice Printer Driver Resource Toolkit ActiveX Control ControlJob Buffer Overflow Attempt"; flow:from_server,established; content:"1503569A-0AE2-4333-B6E6-466AB0BC73E5"; nocase; content:"ControlJob"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5/si"; reference:url,www.securityfocus.com/bid/36548; reference:url,doc.emergingthreats.net/2010207; classtype:attempted-user; sid:2010207; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET EXPLOIT IIS FTP Exploit - NLST Globbing Exploit"; flow:established,to_server; content:"NLST "; nocase; content:"|2a 2f 2e 2e 2f|"; reference:url,www.milw0rm.com/exploits/9541; reference:url,doc.emergingthreats.net/2009860; reference:cve,2009-3023; classtype:attempted-admin; sid:2009860; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Charm Real Converter pro 6.6 Activex Control DOS clsid access attempt"; flow:established,to_client; content:"F4F647AD-B160-11D2-A3EF-00104BDF4755"; nocase; content:"GetCodecModulus"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4F647AD-B160-11D2-A3EF-00104BDF4755/si"; reference:url,www.packetstormsecurity.org/0909-exploits/charmrc-dos.txt; reference:url,doc.emergingthreats.net/2010280; classtype:web-application-attack; sid:2010280; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Invalid non-fragmented packet with fragment offset>0"; fragbits: !M; fragoffset: >0; reference:url,doc.emergingthreats.net/bin/view/Main/2001022; classtype:bad-unknown; sid:2001022; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Chilkat IMAP ActiveX File Execution and IE DoS"; flow:to_client,established; content:"126FB030-1E9E-4517-A254-430616582C50"; nocase; content:"LoadXmlEmail"; nocase; reference:url,www.milw0rm.com/exploits/6600; reference:url,doc.emergingthreats.net/2008607; classtype:web-application-attack; sid:2008607; rev:10; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Invalid fragment - ACK reset"; fragbits: M; flags: !A,12; reference:url,doc.emergingthreats.net/bin/view/Main/2001023; classtype:bad-unknown; sid:2001023; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Chilkat Crypt ActiveX Component WriteFile Insecure Method"; flow:to_client,established; content:"3352B5B9-82E8-4FFD-9EB1-1A3E60056904"; nocase; content:"WriteFile"; nocase; reference:url,secunia.com/Advisories/32513/; reference:url,milw0rm.com/exploits/6963; reference:url,doc.emergingthreats.net/2008814; classtype:web-application-attack; sid:2008814; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Invalid fragment - illegal flags"; fragbits: M; flags: *FSR,12; reference:url,doc.emergingthreats.net/bin/view/Main/2001024; classtype:bad-unknown; sid:2001024; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Chilkat Socket ACTIVEX Remote Arbitrary File Creation"; flow:to_client,established; content:"474FCCCD-1B89-4D34-9E09-45807F23289C"; nocase; content:"SaveLastError"; nocase; reference:bugtraq,32333; reference:url,milw0rm.com/exploits/7142; reference:url,doc.emergingthreats.net/2008870; classtype:web-application-attack; sid:2008870; rev:10; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET NETBIOS MS04011 Lsasrv.dll RPC exploit (Win2k)"; flow: to_server,established; content:"|00 00 00 00 9A A8 40 00 01 00 00 00 00 00 00 00|"; content:"|01 0000 00 00 00 00 00 9A A8 40 00 01 00 00 00|"; reference:url,doc.emergingthreats.net/bin/view/Main/2000046; reference:cve,2003-0533; classtype:misc-activity; sid:2000046; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Chilkat Socket Activex Remote Arbitrary File Overwrite 1"; flow:to_client,established; content:"3B598BD0-AF50-48C6-B6A5-63261A48B054"; nocase; content:"SaveLastError"; nocase; reference:bugtraq,32333; reference:url,milw0rm.com/exploits/7594; reference:url,doc.emergingthreats.net/2009046; classtype:web-application-attack; sid:2009046; rev:48; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET NETBIOS MS04011 Lsasrv.dll RPC exploit (WinXP)"; flow: to_server,established; content:"|95 14 40 00 03 00 00 00 7C 70 40 00 01|"; content:"|78 85 13 00 AB5B A6 E9 31 31|"; reference:url,doc.emergingthreats.net/bin/view/Main/2000033; reference:cve,2003-0533; classtype:misc-activity; sid:2000033; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Chinagames ActiveX Control CreateChinagames Method Buffer Overflow"; flow:to_client,established; content:"75108B29-202F-493C-86C5-1C182A485C4C"; nocase; content:"CreateChinagames"; nocase; reference:bugtraq,34871; reference:url,milw0rm.com/exploits/8758; reference:url,doc.emergingthreats.net/2009500; classtype:web-application-attack; sid:2009500; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET EXPLOIT libPNG - Possible integer overflow in allocation in png_handle_sPLT"; flow: established; content:"|89 50 4E 47 0D 0A 1A 0A|"; depth:8; content:"sPLT"; isdataat:80,relative; content:!"|00|"; distance: 0; reference:url,www.securiteam.com/unixfocus/5ZP0C0KDPG.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001195; classtype:misc-activity; sid:2001195; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Ciansoft PDFBuilderX Control ActiveX Arbitrary File Overwrite"; flow:to_client,established; content:"00E7C7F8-71E2-498A-AB28-A3D72FC74485"; nocase; content:"SaveToFile"; nocase; reference:bugtraq,33233; reference:url,milw0rm.com/exploits/7794; reference:url,doc.emergingthreats.net/2009064; classtype:web-application-attack; sid:2009064; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT MS04-032 Windows Metafile (.emf) Heap Overflow Exploit"; flow: established; content:"|45 4D 46|"; content:"|EB 12 90 90 90 90 90 90|"; content:"|9e 5c 05 78|"; nocase; reference:url,www.k-otik.com/exploits/20041020.HOD-ms04032-emf-expl2.c.php; reference:url,doc.emergingthreats.net/bin/view/Main/2001369; classtype:shellcode-detect; sid:2001369; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Citrix Presentation Server Client WFICA.OCX ActiveX Component Heap Buffer Overflow Exploit"; flow:established,to_client; content:"0x40000"; content:"SendChannelData"; nocase; content:"238F6F83-B8B4-11CF-8771-00A024541EE3"; nocase; reference:url,www.milw0rm.com/exploits/5106; reference:bugtraq,21458; reference:cve,CVE-2006-6334; reference:url,doc.emergingthreats.net/bin/view/Main/2007851; classtype:web-application-attack; sid:2007851; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible MS04-032 Windows Metafile (.emf) Heap Overflow Portbind Attempt"; flow: established; content:"|45 4D 46|"; content:"|23 6A 75 4E|"; reference:url,www.microsoft.com/technet/security/bulletin/ms04-032.mspx; reference:url,doc.emergingthreats.net/bin/view/Main/2001363; classtype:shellcode-detect; sid:2001363; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX ComponentOne VSFlexGrid ActiveX Control Archive Method Buffer Overflow Attempt"; flow:established,to_client; content:" $HOME_NET any (msg:"ET EXPLOIT MS04-032 Windows Metafile (.emf) Heap Overflow Connectback Attempt"; flow: established; content:"|45 4D 46|"; content:"|5E 79 72 63|"; content:"|48 4F 44 21|"; reference:url,www.microsoft.com/technet/security/bulletin/ms04-032.mspx; reference:url,doc.emergingthreats.net/bin/view/Main/2001364; classtype:shellcode-detect; sid:2001364; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Consona Products SdcUser.TgConCtl ActiveX Control Buffer Overflow Attempt"; flow:established,to_client; content:" $HOME_NET any (msg:"ET EXPLOIT MS04-032 Bad EMF file"; flow: from_server,established; content:"|01 00 00 00|"; depth: 4; content:"|20 45 4d 46|"; offset: 40; depth: 44; byte_test:4, >, 256, 60, little; reference:url,www.sygate.com/alerts/SSR20041013-0001.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2001374; classtype:misc-activity; sid:2001374; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Data Dynamics ActiveBar ActiveX Control (Actbar3.ocx 3.2) Multiple Insecure Methods"; flow:to_client,established; content:"5407153D-022F-4CD2-8BFF-465569BC5DB8"; nocase; pcre:"/.*\.(ini|exe|dll|bat|com|cab|txt)/i"; pcre:"/(Save|SaveLayoutChanges|SaveMenuUsageData)/i"; reference:bugtraq,24959; reference:cve,CVE-2007-3883; reference:url,www.exploit-db.com/exploits/5395/; reference:url,doc.emergingthreats.net/2008127; classtype:web-application-attack; sid:2008127; rev:10; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET EXPLOIT Exploit MS05-002 Malformed .ANI stack overflow attack"; flow: to_client,established; content:"RIFF"; content:"ACON"; distance: 8; content:"anih"; distance: 160; byte_test:4,>,36,0,relative,little; reference:url,doc.emergingthreats.net/bin/view/Main/2001668; classtype:misc-attack; sid:2001668; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX D-Link MPEG4 SHM (Audio) Control ActiveX Control Url Property Buffer Overflow Vulnerability"; flow:to_client,established; content:"A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C"; nocase; content:"0x40000"; content:"Url"; nocase; reference:bugtraq,28010; reference:url,www.milw0rm.com/exploits/5193; reference:url,doc.emergingthreats.net/2007905; classtype:web-application-attack; sid:2007905; rev:48; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET 445 -> $EXTERNAL_NET any (msg:"ET NETBIOS ms05-011 exploit"; flow:from_server,established; content:"|00|"; depth:1; content:"|FF|SMB|32|"; depth:9; offset:4; content: "|ff ff ff ff 00 00 00 00 ff|"; offset: 132; depth: 141; reference:bugtraq,12484; reference:url,www.frsirt.com/exploits/20050623.mssmb_poc.c.php; reference:url,doc.emergingthreats.net/bin/view/Main/2002064; classtype:attempted-admin; sid:2002064; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible EDraw Flowchart ActiveX Control OpenDocument Method Remote Code Execution Attempt"; flow:to_client,established; content:"F685AFD8-A5CC-410E-98E4-BAA1C559BA61"; nocase; content:"OpenDocument"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F685AFD8-A5CC-410E-98E4-BAA1C559BA61/si"; reference:url,doc.emergingthreats.net/2011055; classtype:attempted-user; sid:2011055; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET EXPLOIT MS05-021 Exchange Link State - Possible Attack (1)"; flow: to_server,established; content:"X-LINK2STATE"; nocase; reference:cve,CAN-2005-0560; reference:url,isc.sans.org/diary.php?date=2005-04-12; reference:url,www.microsoft.com/technet/security/bulletin/MS05-021.mspx; reference:url,doc.emergingthreats.net/bin/view/Main/2001848; classtype:misc-activity; sid:2001848; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible EMC Captiva PixTools Distributed Imaging ActiveX Control Vulnerable WriteToLog Method Arbitrary File Creation/Overwrite Attempt"; flow:established,from_server; content:"00200338-3D33-4FFC-AC20-67AA234325F3"; nocase; content:"WriteToLog"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3/si"; reference:url,www.securityfocus.com/bid/36566/info; reference:url,www.shinnai.net/xplits/TXT_17zVMhRhsRE6qC6DAj52.html; reference:url,doc.emergingthreats.net/2010035; classtype:attempted-user; sid:2010035; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 691 (msg:"ET EXPLOIT MS05-021 Exchange Link State - Possible Attack (2)"; flow: to_server,established; content:"X-LSA-2"; nocase; reference:cve,CAN-2005-0560; reference:url,isc.sans.org/diary.php?date=2005-04-12; reference:url,www.microsoft.com/technet/security/bulletin/MS05-021.mspx; reference:url,doc.emergingthreats.net/bin/view/Main/2001849; classtype:misc-activity; sid:2001849; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX EasyMail Objects emmailstore.dll ActiveX Control Remote Buffer Overflow"; flow:to_client,established; content:"5B8BE023-76A2-4F6D-8993-F7E588D79D98"; nocase; content:"0x400000"; nocase; content:"CreateStore"; nocase; reference:bugtraq,32722; reference:url,milw0rm.com/exploits/7402; reference:url,doc.emergingthreats.net/2008963; classtype:web-application-attack; sid:2008963; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET EXPLOIT MS Exchange Link State Routing Chunk (maybe MS05-021)"; flow: to_server, established; content:"X-LINK2STATE"; nocase; content:"CHUNK="; nocase; threshold: type limit, track by_src, count 1, seconds 60; flowbits:set,msxlsa; reference:cve,CAN-2005-0560; reference:url,isc.sans.org/diary.php?date=2005-04-12; reference:url,www.microsoft.com/technet/security/bulletin/MS05-021.mspx; reference:url,doc.emergingthreats.net/bin/view/Main/2001873; classtype:misc-activity; sid:2001873; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Quiksoft EasyMail imap connect() ActiveX stack overflow vulnerability"; flow:from_server,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D/si"; reference:url,www.milw0rm.com/exploits/9704; reference:url,www.securityfocus.com/bid/22583; reference:url,doc.emergingthreats.net/2009948; classtype:attempted-user; sid:2009948; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $SMTP_SERVERS 25 -> $EXTERNAL_NET any (msg:"ET EXPLOIT TCP Reset from MS Exchange after chunked data, probably crashed it (MS05-021)"; flags: R; flowbits:isset,msxlsa; flowbits: unset,msxlsa; reference:cve,CAN-2005-0560; reference:url,isc.sans.org/diary.php?date=2005-04-12; reference:url,www.microsoft.com/technet/security/bulletin/MS05-021.mspx; reference:url,doc.emergingthreats.net/bin/view/Main/2001874; classtype:misc-activity; sid:2001874; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX EasyMail Quicksoft ActiveX Control Remote code excution clsid access attempt"; flow:to_client,established; content:"0CEA3FB1-7F88-4803-AA8E-AD021566955D"; nocase; content:"LicenseKey"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D/si"; reference:url,milw0rm.com/exploits/9684; reference:url,doc.emergingthreats.net/2010253; classtype:web-application-attack; sid:2010253; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET NETBIOS SMB-DS Microsoft Windows 2000 Plug and Play Vulnerability"; flow:to_server,established; content:"|FF|SMB%"; depth:5; offset:4; nocase; content:"|2600|"; depth:2; offset:65; content:"|67157a76|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS05-039.mspx; reference:url,isc.sans.org/diary.php?date=2005-08-14; reference:url,doc.emergingthreats.net/bin/view/Main/2002186; classtype:attempted-admin; sid:2002186; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX EasyMail ActiveX AddAttachment method Remote code excution clsid access attempt"; flow:established,to_client; content:"68AC0D5F-0424-11D5-822F-00C04F6BA8D9"; nocase; content:"AddAttachment"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9/si"; reference:url,www.milw0rm.com/exploits/9705; reference:url,doc.emergingthreats.net/2010278; classtype:web-application-attack; sid:2010278; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET NETBIOS SMB-DS DCERPC PnP HOD bind attempt"; flow:to_server,established; content:"|FF|SMB%"; depth:5; offset:4; nocase; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00|"; within:12; distance:5; nocase; content:"|05|"; within:1; distance:4; content:"|0B|"; within:1; distance:1; content:"|40 4E 9F 8D 3D A0 CE 11 8F 69 08 00 3E 30 05 1B|"; flowbits:set,netbios.pnp.bind.attempt; flowbits:noalert; reference:url,doc.emergingthreats.net/bin/view/Main/2002199; classtype:protocol-command-decode; sid:2002199; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX EasyMail Quicksoft ActiveX CreateStore method Remote code excution clsid access"; flow:established,to_client; content:"18A76B9A-45C1-11D3-80DC-00C04F6B92D0"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18A76B9A-45C1-11D3-80DC-00C04F6B92D0/si"; content:"CreateStore"; nocase; reference:url,www.milw0rm.com/exploits/9685; reference:url,doc.emergingthreats.net/2010277; classtype:web-application-attack; sid:2010277; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET NETBIOS SMB-DS DCERPC PnP bind attempt"; flow:to_server,established; content:"|FF|SMB%"; depth:5; offset:4; nocase; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00|"; within:12; distance:5; nocase; content:"|05|"; within:1; distance:2; content:"|0B|"; within:1; distance:1; content:"|40 4E 9F 8D 3D A0 CE 11 8F 69 08 00 3E 30 05 1B|"; flowbits:set,netbios.pnp.bind.attempt; flowbits:noalert; reference:url,doc.emergingthreats.net/bin/view/Main/2002200; classtype:protocol-command-decode; sid:2002200; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Easy Grid ActiveX Multiple Arbitrary File Overwrite"; flow:to_client,established; content:"DD44C0EA-B2CF-31D1-8DD3-444553540000"; nocase; content:"DoSaveFile"; nocase; reference:bugtraq,33272; reference:url,doc.emergingthreats.net/2009102; classtype:web-application-attack; sid:2009102; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET NETBIOS SMB-DS DCERPC PnP QueryResConfList exploit attempt"; flow:to_server,established; content:"|FF|SMB%"; depth:5; offset:4; nocase; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00|"; within:12; distance:5; nocase; content:"|36 00|"; within:2; distance:26; pcre:"/(\x00\\\x00.*?){2}\x00{2}\xFF{2}.{128,}[\x04-\xFF][\x00-\xFF]{3}\x00{4}$/Rs"; flowbits:isset,netbios.pnp.bind.attempt; reference:cve,CAN-2005-1983; reference:url,www.microsoft.com/technet/security/Bulletin/MS05-039.mspx; reference:url,doc.emergingthreats.net/bin/view/Main/2002201; classtype:attempted-admin; sid:2002201; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Easy Grid ActiveX Multiple Arbitrary File Overwrite"; flow:to_client,established; content:"DD44C0EA-B2CF-31D1-8DD3-444553540000"; nocase; content:"DoSaveFile"; nocase; reference:bugtraq,33272; reference:url,doc.emergingthreats.net/2009063; classtype:web-application-attack; sid:2009063; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"ET NETBIOS SMB DCERPC PnP bind attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB%"; depth:5; offset:4; nocase; byte_test:2,^,1,5,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00 05 00 0B|"; within:10; distance:4; byte_test:1,&,16,1,relative; content:"|40 4E 9F 8D 3D A0 CE 11 8F 69 08 00 3E 30 05 1B|"; flowbits:set,netbios.pnp.bind.attempt; flowbits:noalert; reference:url,doc.emergingthreats.net/bin/view/Main/2002202; classtype:protocol-command-decode; sid:2002202; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX eBay Enhanced Picture Services Control Clsid Access (1)"; flow:from_server,established; content:"4C39376E-FA9D-4349-BACC-D305C1750EF3"; nocase; content:"PictureUrls"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4C39376E-FA9D-4349-BACC-D305C1750EF3/si"; reference:url,www.kb.cert.org/vuls/id/983731; reference:url,www.microsoft.com/technet/security/advisory/969898.mspx; reference:url,pages.ebay.com/securitycenter/activex/index.html; reference:url,doc.emergingthreats.net/2009402; classtype:attempted-user; sid:2009402; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"ET NETBIOS SMB DCERPC PnP QueryResConfList exploit attempt"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB%"; depth:5; offset:4; nocase; byte_test:2,^,1,5,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00 05 00 00|"; within:10; distance:4; nocase; content:"|36 00|"; within:2; distance:19; pcre:"/(\x00\\\x00.*?){2}\x00{2}\xFF{2}.{128,}[\x04-\xFF][\x00-\xFF]{3}\x00{4}$/Rs"; flowbits:isset,netbios.pnp.bind.attempt; reference:cve,CAN-2005-1983; reference:url,www.microsoft.com/technet/security/Bulletin/MS05-039.mspx; reference:url,doc.emergingthreats.net/bin/view/Main/2002203; classtype:attempted-admin; sid:2002203; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX eBay Enhanced Picture Services Control Clsid Access (2)"; flow:from_server,established; content:"C3EB1670-84E0-4EDA-B570-0B51AAE81679"; nocase; content:"PictureUrls"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C3EB1670-84E0-4EDA-B570-0B51AAE81679/si"; reference:url,www.kb.cert.org/vuls/id/983731; reference:url,www.microsoft.com/technet/security/advisory/969898.mspx; reference:url,pages.ebay.com/securitycenter/activex/index.html; reference:url,doc.emergingthreats.net/2009403; classtype:attempted-user; sid:2009403; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Windows Media Player parsing BMP file with 0 size offset to start of image"; flow:established,from_server; content:"BM"; depth:400; byte_test:8,=,0,4,relative; reference:url,www.milw0rm.com/id.php?id=1500; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-005.mspx; reference:cve,2006-0006; reference:bugtraq,16633; reference:url,doc.emergingthreats.net/bin/view/Main/2002802; classtype:attempted-user; sid:2002802; rev:8; metadata:created_at 2010_07_30, former_category EXPLOIT, updated_at 2017_09_28;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX EvansFTP EvansFTP.ocx Remote Buffer Overflow"; flow:to_client,established; content:"7E864D3E-3E6A-48F0-88AF-CEAEE322F9FD"; nocase; content:"RemoteAddress"; nocase; reference:bugtraq,32814; reference:url,www.milw0rm.com/exploits/7460; reference:url,doc.emergingthreats.net/2008999; classtype:web-application-attack; sid:2008999; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET EXPLOIT DOS Microsoft Windows SRV.SYS MAILSLOT"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/sR"; content:"|03|"; distance:21; content:"|01 00 00 00 00 00|"; distance:1; within:6; byte_test:2,=,17,0,little,relative; content:"|5C|MAILSLOT|5C|"; within:10; distance:2; reference:url,www.milw0rm.com/exploits/2057; reference:url,www.microsoft.com/technet/security/bulletin/MS06-035.mspx; reference:url,doc.emergingthreats.net/bin/view/Main/2003067; classtype:attempted-dos; sid:2003067; rev:5; metadata:created_at 2010_07_30, former_category EXPLOIT, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX FathFTP ActiveX DeleteFile Arbitrary File Deletion"; flow:to_client,established; content:"62A989CE-D39A-11D5-86F0-B9C370762176"; nocase; content:"DeleteFile"; nocase; reference:bugtraq,33842; reference:url,xforce.iss.net/xforce/xfdb/48837; reference:url,doc.emergingthreats.net/2009184; classtype:web-application-attack; sid:2009184; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"ET NETBIOS NETBIOS SMB DCERPC NetrpPathCanonicalize request (possible MS06-040)"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB|25|"; depth:5; offset:4; nocase; byte_test:2,^,1,5,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00 05 00|"; within:9; distance:4; content:"|1f 00|"; distance:20; within:2; reference:url,www.microsoft.com/technet/security/bulletin/MS06-040.mspx; reference:url,doc.emergingthreats.net/bin/view/Main/2003081; classtype:misc-attack; sid:2003081; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX FathFTP ActiveX Control GetFromURL Method Buffer Overflow Attempt"; flow:to_client,established; content:" $HOME_NET 445 (msg:"ET NETBIOS NETBIOS SMB-DS DCERPC NetrpPathCanonicalize request (possible MS06-040)"; flow:to_server,established; content:"|00|"; depth:1; content:"|FF|SMB|25|"; depth:5; offset:4; nocase; byte_test:2,^,1,5,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00 05 00|"; within:9; distance:4; content:"|1f 00|"; distance:20; within:2; reference:url,www.microsoft.com/technet/security/bulletin/MS06-040.mspx; reference:url,doc.emergingthreats.net/bin/view/Main/2003082; classtype:misc-attack; sid:2003082; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX FlexCell Grid ActiveX Multiple Arbitrary File Overwrite"; flow:to_client,established; content:"2A7D9CCE-211A-4654-9449-718F71ED9644"; nocase; pcre:"/(SaveFile|ExportToXML)/i"; reference:url,www.milw0rm.com/exploits/7868; reference:bugtraq,33453; reference:url,doc.emergingthreats.net/2009120; classtype:web-application-attack; sid:2009120; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert udp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (1)"; content:"|0B|"; offset:2; depth:1; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008690; classtype:attempted-admin; sid:2008690; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Foxit Reader ActiveX control OpenFile method Heap Overflow Attempt"; flow:established,to_client; content:"05563215-225C-45EB-BB34-AFA47217B1DE"; nocase; content:"OpenFile"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*05563215-225C-45EB-BB34-AFA47217B1DE/si"; reference:url,www.exploit-db.com/exploits/11196; reference:url,doc.emergingthreats.net/2010929; classtype:attempted-user; sid:2010929; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert udp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (2)"; content:"|1F 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"..|5C|..|5C|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008691; classtype:attempted-admin; sid:2008691; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Gateway Weblaunch2.ocx ActiveX Control Insecure Method Exploit"; flow:to_client,established; content:"0x40000"; content:"DoWebLaunch"; content:"97BB6657-DC7F-4489-9067-51FAB9D8857E"; nocase; reference:url,www.milw0rm.com/exploits/4982; reference:bugtraq,27193; reference:url,doc.emergingthreats.net/2007852; classtype:web-application-attack; sid:2007852; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert udp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (3)"; content:"|1F 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"../../"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008692; classtype:attempted-admin; sid:2008692; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX GdPicture Pro ActiveX control SaveAsPDF Insecure Method"; flow:to_client,established; content:"E8512363-3581-42EF-A43D-990E7935C8BE"; nocase; content:"SaveAsPDF"; nocase; reference:url,secunia.com/Advisories/31966/; reference:url,milw0rm.com/exploits/6638; reference:url,doc.emergingthreats.net/2008613; classtype:web-application-attack; sid:2008613; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert udp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (4)"; content:"|1F 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"|00 2E 00 2E 00 2F 00 2E 00 2E 00 2F|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008693; classtype:attempted-admin; sid:2008693; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX GeoVision LiveAudio ActiveX Control Remote Code Execution"; flow:to_client,established; content:"814A3C52-B6F7-4AEA-A9BC-7849B9B0ECA8"; nocase; content:"GetAudioPlayingTime"; nocase; reference:bugtraq,34115; reference:url,milw0rm.com/exploits/8206; reference:url,doc.emergingthreats.net/2009328; classtype:web-application-attack; sid:2009328; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert udp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (5)"; content:"|1F 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"|00 2E 00 2E 00 5C 00 2E 00 2E 00 5C|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008694; classtype:attempted-admin; sid:2008694; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX GeoVision LiveX_v8200 ActiveX Control Arbitrary File Overwrite"; flow:to_client,established; content:"8D58D690-6B71-4ee8-85AD-006DB0287BF1"; nocase; pcre:"/(SnapShotToFile|SnapShotX)/i"; reference:url,milw0rm.com/exploits/8059; reference:url,doc.emergingthreats.net/2009160; classtype:web-application-attack; sid:2009160; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any any -> $HOME_NET 139 (msg:"ET DELETED Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (6)"; content:"|0B|"; offset:2; depth:1; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008695; classtype:attempted-admin; sid:2008695; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX GeoVision LiveX_v7000 ActiveX Control Arbitrary File Overwrite"; flow:to_client,established; content:"DA8484DE-52DB-4860-A986-61A8682E298A"; nocase; pcre:"/(SnapShotToFile|SnapShotX)/i"; reference:url,xforce.iss.net/xforce/xfdb/48773; reference:url,milw0rm.com/exploits/8059; reference:url,doc.emergingthreats.net/2009161; classtype:web-application-attack; sid:2009161; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert udp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (7)"; content:"|20 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"..|5C|..|5C|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008696; classtype:attempted-admin; sid:2008696; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX GeoVision LiveX_v8120 ActiveX Control Arbitrary File Overwrite"; flow:to_client,established; content:"F4421170-DB22-4551-BBFB-FFCFFB419F6F"; nocase; pcre:"/(SnapShotToFile|SnapShotX)/i"; reference:url,xforce.iss.net/xforce/xfdb/48773; reference:url,milw0rm.com/exploits/8059; reference:url,doc.emergingthreats.net/2009162; classtype:web-application-attack; sid:2009162; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert udp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (8)"; content:"|20 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"../../"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008697; classtype:attempted-admin; sid:2008697; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Gom Player V 2.1.16 Activex Command Execution clsid access attempt"; flow:established,to_client; content:"7606693A-C18D-4567-AF85-6194FF70761E"; nocase; content:"Command"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E/si"; reference:url,www.packetstormsecurity.org/0909-exploits/gomplayer-exec.txt; reference:url,doc.emergingthreats.net/2010367; classtype:web-application-attack; sid:2010367; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert udp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (9)"; content:"|20 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"|00 2E 00 2E 00 2F 00 2E 00 2E 00 2F|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008698; classtype:attempted-admin; sid:2008698; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Gracenote CDDBControl ActiveX Control ViewProfile Method Heap Buffer Overflow Attempt"; flow:established,to_client; content:"B69003B3-C55E-4B48-836C-BC5946FC3B28"; nocase; content:"ViewProfile"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B69003B3-C55E-4B48-836C-BC5946FC3B28/si"; reference:url,www.securityfocus.com/bid/37834; reference:url,doc.emergingthreats.net/2010760; classtype:attempted-user; sid:2010760; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert udp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (10)"; content:"|20 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"|00 2E 00 2E 00 5C 00 2E 00 2E 00 5C|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008699; classtype:attempted-admin; sid:2008699; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible HP LoadRunner XUpload.ocx ActiveX Control MakeHttpRequest Arbitrary File Download Attempt"; flow:from_server,established; content:"E87F6C8E-16C0-11D3-BEF7-009027438003"; nocase; content:"XUPLOAD"; nocase; content:"MakeHttpRequest"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E87F6C8E-16C0-11D3-BEF7-009027438003/si"; reference:url,www.securityfocus.com/bid/36550/info; reference:url,doc.emergingthreats.net/2010010; classtype:attempted-user; sid:2010010; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert udp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 - Known Exploit Instance"; content:"|00 2e 00 2e 00 2f 00 2e 00 2e 00 2f 00 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 87|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008700; classtype:attempted-admin; sid:2008700; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX HP Openview NNM ActiveX DisplayName method Memory corruption Attempt"; flow:established,to_client; content:"A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE"; nocase; content:"DisplayName"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE/si"; reference:url,www.securityfocus.com/archive/1/507948; reference:url,doc.emergingthreats.net/2010611; classtype:web-application-attack; sid:2010611; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 445 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (11)"; flow:established,to_server; content:"|0B|"; offset:2; depth:1; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008701; classtype:attempted-admin; sid:2008701; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX HP Openview NNM ActiveX AddGroup method Memory corruption Attempt"; flow:established,to_client; content:"A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE"; nocase; content:"AddGroup"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE/si"; reference:url,www.securityfocus.com/archive/1/507948; reference:url,doc.emergingthreats.net/2010612; classtype:web-application-attack; sid:2010612; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 445 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (12)"; flow:established,to_server; content:"|1F 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"|5C|..|5C|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008702; classtype:attempted-admin; sid:2008702; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX HP Openview NNM ActiveX InstallComponent method Memory corruption Attempt"; flow:established,to_client; content:"A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE"; nocase; content:"InstallComponent"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE/si"; reference:url,www.securityfocus.com/archive/1/507948; reference:url,doc.emergingthreats.net/2010613; classtype:web-application-attack; sid:2010613; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 445 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (13)"; flow:established,to_server; content:"|1F 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"/../"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008703; classtype:attempted-admin; sid:2008703; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX HP Openview NNM ActiveX Subscribe method Memory corruption Attempt"; flow:established,to_client; content:"A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE"; nocase; content:"Subscribe"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE/si"; reference:url,www.securityfocus.com/archive/1/507948; reference:url,doc.emergingthreats.net/2010614; classtype:web-application-attack; sid:2010614; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 445 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (14)"; flow:established,to_server; content:"|1F 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"|00 2E 00 2E 00 2F 00 2E 00 2E 00 2F|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008704; classtype:attempted-admin; sid:2008704; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX HP Mercury Quality Center ActiveX ProgColor Buffer Overflow Attempt -1"; flow:established,to_client; content:"98C53984-8BF8-4D11-9B1C-C324FCA9CADE"; nocase; content:"ProgColor"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C53984-8BF8-4D11-9B1C-C324FCA9CADE/si"; reference:url,secunia.com/advisories/24692/; reference:url,www.packetstormsecurity.nl/0911-exploits/hpmqc_progcolor.rb.txt; reference:url,www.kb.cert.org/vuls/id/589097; reference:url,doc.emergingthreats.net/2010778; classtype:attempted-user; sid:2010778; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 445 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (15)"; flow:established,to_server; content:"|1F 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"|00 2E 00 2E 00 5C 00 2E 00 2E 00 5C|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008705; classtype:attempted-admin; sid:2008705; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX HP Mercury Quality Center ActiveX ProgColor Buffer Overflow Attempt -2"; flow:established,to_client; content:"CDBD9968-7BF1-11D4-9D36-0001029DEBEB"; nocase; content:"ProgColor"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CDBD9968-7BF1-11D4-9D36-0001029DEBEB/si"; reference:url,secunia.com/advisories/24692/; reference:url,www.packetstormsecurity.nl/0911-exploits/hpmqc_progcolor.rb.txt; reference:url,www.kb.cert.org/vuls/id/589097; reference:url,doc.emergingthreats.net/2010779; classtype:attempted-user; sid:2010779; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (16)"; flow:established,to_server; content:"|0B|"; offset:2; depth:1; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008706; classtype:attempted-admin; sid:2008706; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX HP Operations Manager SourceView ActiveX LoadFile/SaveFile Method Buffer Overflow Attempt"; flow:established,to_client; content:"366C9C52-C402-416B-862D-1464F629CA59"; nocase; content:"File"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*366C9C52-C402-416B-862D-1464F629CA59.+(LoadFile|SaveFile)/si"; reference:url,packetstormsecurity.org/1004-exploits/CORELAN-10-027.txt; reference:url,secunia.com/advisories/39538/; reference:url,doc.emergingthreats.net/2011075; classtype:attempted-user; sid:2011075; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (17)"; flow:established,to_server; content:"|1F 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"..|5C|..|5C|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008707; classtype:attempted-admin; sid:2008707; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX HP Virtual Rooms Control Clsid Access"; flow:from_server,established; content:"00000032-9593-4264-8B29-930B3E4EDCCD"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00000032-9593-4264-8B29-930B3E4EDCCD/si"; reference:url,www.microsoft.com/technet/security/advisory/969898.mspx; reference:url,h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01678405; reference:url,doc.emergingthreats.net/2009404; classtype:attempted-user; sid:2009404; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (18)"; flow:established,to_server; content:"|1F 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"../../"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008708; classtype:attempted-admin; sid:2008708; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Haihaisoft Universal Player ActiveX Control URL Property Buffer Overflow Attempt"; flow:established,to_client; content:"1A01FF01-EA62-4702-B837-1E07158145FA"; nocase; content:"URL"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1A01FF01-EA62-4702-B837-1E07158145FA/si"; reference:url,www.shinnai.net/exploits/ZzLsi6TIfSuVPh1kPHmP.txt; reference:url,www.securityfocus.com/bid/37151/info; reference:url,doc.emergingthreats.net/2010373; classtype:attempted-user; sid:2010373; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (19)"; flow:established,to_server; content:"|1F 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"|00 2E 00 2E 00 2F 00 2E 00 2E 00 2F|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008709; classtype:attempted-admin; sid:2008709; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Hummingbird Deployment Wizard 2008 ActiveX Insecure Methods"; flow:to_client,established; content:"7F9B30F1-5129-4F5C-A76C-CE264A6C7D10"; nocase; pcre:"/(Run|SetRegistryValueAsString|PerformUpdateAsync)/i"; reference:url,secunia.com/Advisories/32337/; reference:url,doc.emergingthreats.net/2008678; classtype:web-application-attack; sid:2008678; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (20)"; flow:established,to_server; content:"|1F 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"|00 2E 00 2E 00 5C 00 2E 00 2E 00 5C|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008710; classtype:attempted-admin; sid:2008710; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Hyleos ChemView ActiveX Control SaveasMolFile Method Buffer Overflow Attempt"; flow:established,to_client; content:"C372350A-1D5A-44DC-A759-767FC553D96C"; nocase; content:"SaveasMolFile"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C/si"; reference:url,www.security-assessment.com/files/advisories/2010-02-11_ChemviewX_Activex.pdf; reference:url,secunia.com/advisories/38523/; reference:url,doc.emergingthreats.net/2010997; classtype:attempted-user; sid:2010997; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> $HOME_NET 445 (msg:"ET DELETED Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (21)"; flow:established,to_server; content:"|0B|"; offset:2; depth:1; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008711; classtype:attempted-admin; sid:2008711; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Hyleos ChemView ActiveX Control ReadMolFile Method Buffer Overflow Attempt"; flow:established,to_client; content:"C372350A-1D5A-44DC-A759-767FC553D96C"; nocase; content:"ReadMolFile"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C/si"; reference:url,www.security-assessment.com/files/advisories/2010-02-11_ChemviewX_Activex.pdf; reference:url,secunia.com/advisories/38523/; reference:url,doc.emergingthreats.net/2010998; classtype:attempted-user; sid:2010998; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 445 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (22)"; flow:established,to_server; content:"|20 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"|5C|..|5C|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008712; classtype:attempted-admin; sid:2008712; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX IAS Helper COM Component iashlpr.dll activex remote DOS"; flow:to_client,established; content:"6BC096BC-0CE6-11D1-BAAE-00C04FC2E20D"; nocase; content:"PutProperty"; nocase; reference:url,www.securityfocus.com/archive/1/archive/1/496695/100/0/threaded; reference:cve,2008-2639; reference:url,securityreason.com/securityalert/4323; reference:url,doc.emergingthreats.net/2008618; classtype:web-application-attack; sid:2008618; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 445 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (23)"; flow:established,to_server; content:"|20 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"/../"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008713; classtype:attempted-admin; sid:2008713; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX IBM Access Support ActiveX GetXMLValue Stack Overflow Attempt"; flow:established,to_client; content:"74FFE28D-2378-11D5-990C-006094235084"; nocase; content:"GetXMLValue"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*74FFE28D-2378-11D5-990C-006094235084/si"; reference:url,dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/ibmegath_getxmlvalue.rb; reference:url,www.kb.cert.org/vuls/id/340420; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=17871; reference:cve,2009-0215; reference:url,doc.emergingthreats.net/2010483; classtype:attempted-user; sid:2010483; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 445 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (24)"; flow:established,to_server; content:"|20 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"|00 2E 00 2E 00 2F 00 2E 00 2E 00 2F|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008714; classtype:attempted-admin; sid:2008714; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft Multimedia Controls - ActiveX control's spline function call CLSID"; flow:from_server,established; content:"D7A7D7C3-D47F-11D0-89D3-00A0C90833E6"; nocase; content:".Spline|28|"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D7A7D7C3-D47F-11D0-89D3-00A0C90833E6/si"; reference:url,www.osvdb.org/displayvuln.php?osvdb_id=28841; reference:cve,2006-4446; reference:url,doc.emergingthreats.net/2003102; classtype:attempted-user; sid:2003102; rev:12; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 445 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (25)"; flow:established,to_server; content:"|20 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"|00 2E 00 2E 00 5C 00 2E 00 2E 00 5C|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008715; classtype:attempted-admin; sid:2008715; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft WMIScriptUtils.WMIObjectBroker object call CSLID"; flow:from_server,established; content:"7F5B7F63-F06F-4331-8A26-339E03C0AE3D"; nocase; reference:url,www.securityfocus.com/bid/20843; reference:url,secunia.com/advisories/22603; reference:cve,2006-4704; reference:url,www.microsoft.com/technet/security/bulletin/ms06-073.mspx; reference:url,doc.emergingthreats.net/2003158; classtype:attempted-user; sid:2003158; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp any any -> $HOME_NET 139 (msg:"ET DELETED Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (26)"; flow:established,to_server; content:"|0B|"; offset:2; depth:1; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008716; classtype:attempted-admin; sid:2008716; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft VsmIDE.DTE object call CSLID"; flow:from_server,established; content:"06723E09-F4C2-43c8-8358-09FCD1DB0766"; nocase; reference:url,doc.emergingthreats.net/2003159; classtype:attempted-user; sid:2003159; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (27)"; flow:established,to_server; content:"|20 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"..|5C|..|5C|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008717; classtype:attempted-admin; sid:2008717; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft DExplore.AppObj.8.0 object call CSLID"; flow:from_server,established; content:"639F725F-1B2D-4831-A9FD-874847682010"; nocase; reference:url,doc.emergingthreats.net/2003160; classtype:attempted-user; sid:2003160; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (28)"; flow:established,to_server; content:"|20 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"../../"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008718; classtype:attempted-admin; sid:2008718; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft VisualStudio.DTE.8.0 object call CSLID"; flow:from_server,established; content:"BA018599-1DB3-44f9-83B4-461454C84BF8"; nocase; reference:url,doc.emergingthreats.net/2003161; classtype:attempted-user; sid:2003161; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (29)"; flow:established,to_server; content:"|20 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"|00 2E 00 2E 00 2F 00 2E 00 2E 00 2F|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008719; classtype:attempted-admin; sid:2008719; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Wmm2fxa.dll COM Object Instantiation Memory Corruption CLSID 1 Access Attempt"; flow:established,to_client; content:"B4DC8DD9-2CC1-4081-9B2B-20D7030234EF"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B4DC8DD9-2CC1-4081-9B2B-20D7030234EF/si"; reference:cve,2006-1303; reference:bugtraq,18328; reference:url,www.microsoft.com/technet/security/bulletin/ms06-021.mspx; reference:url,doc.emergingthreats.net/2002971; classtype:attempted-user; sid:2002971; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp any any -> $HOME_NET 139 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (30)"; flow:established,to_server; content:"|20 00|"; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; content:"|00 2E 00 2E 00 5C 00 2E 00 2E 00 5C|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008720; classtype:attempted-admin; sid:2008720; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Wmm2fxa.dll COM Object Instantiation Memory Corruption CLSID 2 Access Attempt"; flow:established,to_client; content:"C63344D8-70D3-4032-9B32-7A3CAD5091A5"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C63344D8-70D3-4032-9B32-7A3CAD5091A5/si"; reference:cve,2006-1303; reference:bugtraq,18328; reference:url,www.microsoft.com/technet/security/bulletin/ms06-021.mspx; reference:url,doc.emergingthreats.net/2010263; classtype:attempted-user; sid:2010263; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp any any -> $HOME_NET 445 (msg:"ET NETBIOS Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 - Known Exploit Instance (2)"; flow:established,to_server; content:"|00 2e 00 2e 00 2f 00 2e 00 2e 00 2f 00 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 87|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008721; classtype:attempted-admin; sid:2008721; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Wmm2fxa.dll COM Object Instantiation Memory Corruption CLSID 3 Access Attempt"; flow:established,to_client; content:"353359C1-39E1-491b-9951-464FD8AB071C"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*353359C1-39E1-491b-9951-464FD8AB071C/si"; reference:cve,2006-1303; reference:bugtraq,18328; reference:url,www.microsoft.com/technet/security/bulletin/ms06-021.mspx; reference:url,doc.emergingthreats.net/2010264; classtype:attempted-user; sid:2010264; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"ET EXPLOIT MSSQL Hello Overflow Attempt"; flow:established,to_server; dsize:>400; content:"|12 01 00 34 00 00 00 00|"; offset:0; depth:8; reference:cve,2002-1123; reference:bugtraq,5411; reference:url,doc.emergingthreats.net/bin/view/Main/2002845; classtype:attempted-admin; sid:2002845; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 1 Access Attempt"; flow:established,to_client; content:"5DFB2651-9668-11D0-B17B-00C04FC2A0CA"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5DFB2651-9668-11D0-B17B-00C04FC2A0CA/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010292; classtype:attempted-user; sid:2010292; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"ET EXPLOIT MS-SQL SQL Injection closing string plus line comment"; flow: to_server,established; content:"'|00|"; content:"-|00|-|00|"; reference:url,owasp.org/index.php/SQL_Injection; reference:url,doc.emergingthreats.net/bin/view/Main/2000488; classtype:attempted-user; sid:2000488; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 2 Access Attempt"; flow:established,to_client; content:"39A2C2A6-4778-11D2-9BDB-204C4F4F5020"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*39A2C2A6-4778-11D2-9BDB-204C4F4F5020/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010293; classtype:attempted-user; sid:2010293; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"ET EXPLOIT MS-SQL SQL Injection line comment"; flow: to_server,established; content:"-|00|-|00|"; reference:url,www.nextgenss.com/papers/more_advanced_sql_injection.pdf; reference:url,www.securitymap.net/sdm/docs/windows/mssql-checklist.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000373; classtype:attempted-user; sid:2000373; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 3 Access Attempt"; flow:established,to_client; content:"3DA2AA3E-3D96-11D2-9BD2-204C4F4F5020"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3DA2AA3E-3D96-11D2-9BD2-204C4F4F5020/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010294; classtype:attempted-user; sid:2010294; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp $EXTERNAL_NET any -> $SQL_SERVERS 1434 (msg:"ET EXPLOIT MS-SQL heap overflow attempt"; content:"|08 3A 31|"; depth: 3; reference:url,www.nextgenss.com/papers/tp-SQL2000.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2000377; classtype:attempted-admin; sid:2000377; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 4 Access Attempt"; flow:established,to_client; content:"E8C31D11-6FD2-4659-AD75-155FA143F42B"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E8C31D11-6FD2-4659-AD75-155FA143F42B/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010295; classtype:attempted-user; sid:2010295; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp $EXTERNAL_NET any -> $SQL_SERVERS 1434 (msg:"ET EXPLOIT MS-SQL DOS attempt (08)"; dsize: >1; content:"|08|"; depth: 1; content:!"|3A|"; offset: 1; depth: 1; reference:url,www.nextgenss.com/papers/tp-SQL2000.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2000378; classtype:attempted-dos; sid:2000378; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 5 Access Attempt"; flow:established,to_client; content:"44C79591-D0DE-49C4-BA3C-A45AB7003356"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44C79591-D0DE-49C4-BA3C-A45AB7003356/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010296; classtype:attempted-user; sid:2010296; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp $EXTERNAL_NET any -> $SQL_SERVERS 1434 (msg:"ET EXPLOIT MS-SQL DOS attempt (08) 1 byte"; dsize: 1; content:"|08|"; depth: 1; reference:url,www.nextgenss.com/papers/tp-SQL2000.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2000379; classtype:attempted-dos; sid:2000379; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 6 Access Attempt"; flow:established,to_client; content:"1B544C24-FD0B-11CE-8C63-00AA0044B520"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1B544C24-FD0B-11CE-8C63-00AA0044B520/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010297; classtype:attempted-user; sid:2010297; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp $EXTERNAL_NET any -> $SQL_SERVERS 1434 (msg:"ET EXPLOIT MS-SQL Spike buffer overflow"; content:"|12 01 00 34|"; depth: 4; reference:bugtraq,5411; reference:url,doc.emergingthreats.net/bin/view/Main/2000380; classtype:attempted-admin; sid:2000380; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 7 Access Attempt"; flow:established,to_client; content:"1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010298; classtype:attempted-user; sid:2010298; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"ET EXPLOIT xp_servicecontrol access"; flow:to_server,established; content:"x|00|p|00|_|00|s|00|e|00|r|00|v|00|i|00|c|00|e|00|c|00|o|00|n|00|t|00|r|00|o|00|l|00|"; nocase; reference:url,doc.emergingthreats.net/2009999; classtype:attempted-user; sid:2009999; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 8 Access Attempt"; flow:established,to_client; content:"2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010299; classtype:attempted-user; sid:2010299; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"ET EXPLOIT xp_fileexist access"; flow:to_server,established; content:"x|00|p|00|_|00|f|00|i|00|l|00|e|00|e|00|x|00|i|00|s|00|t|00|"; nocase; reference:url,doc.emergingthreats.net/2010000; classtype:attempted-user; sid:2010000; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 9 Access Attempt"; flow:established,to_client; content:"31087270-D348-432C-899E-2D2F38FF29A0"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31087270-D348-432C-899E-2D2F38FF29A0/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010300; classtype:attempted-user; sid:2010300; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"ET EXPLOIT MDAEMON (Post Auth) Remote Root IMAP FETCH Command Universal Exploit"; flow:established,to_server; content:"FLAGS BODY"; pcre:"/[0-9a-zA-Z]{200,}/R"; content:"|EB 06 90 90 8b 11 DC 64 90|"; distance:0; reference:url,www.milw0rm.com/exploits/5248; reference:bugtraq,28245; reference:url,doc.emergingthreats.net/bin/view/Main/2008063; reference:cve,2008-1358; classtype:successful-user; sid:2008063; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 10 Access Attempt"; flow:established,to_client; content:"41D2B841-7692-4C83-AFD3-F60E845341AF"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*41D2B841-7692-4C83-AFD3-F60E845341AF/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010301; classtype:attempted-user; sid:2010301; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"ET SHELLCODE METASPLOIT BSD Bind shell"; content:"|83 e9 ec d9 ee d9 74 24 f4 5b 81 73 13|"; reference:url,doc.emergingthreats.net/2010383; classtype:shellcode-detect; sid:2010383; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 11 Access Attempt"; flow:established,to_client; content:"2EA10031-0033-450E-8072-E27D9E768142"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2EA10031-0033-450E-8072-E27D9E768142/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010302; classtype:attempted-user; sid:2010302; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"ET SHELLCODE METASPLOIT BSD Bind shell (Not Encoded 2)"; content:"|89 e1 52 42 52 42 52 6a 10 cd 80 99 93 51 53 52 6a 68 58 cd|"; reference:url,doc.emergingthreats.net/2010392; classtype:shellcode-detect; sid:2010392; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 12 Access Attempt"; flow:established,to_client; content:"4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010303; classtype:attempted-user; sid:2010303; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"ET SHELLCODE METASPLOIT BSD Reverse shell (JmpCallAdditive Encoded 1)"; content:"|eb 0c 5e 56 31 1e ad 01 c3 85 c0 75 f7 c3 e8 ef ff ff ff|"; reference:url,doc.emergingthreats.net/2010423; classtype:shellcode-detect; sid:2010423; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 13 Access Attempt"; flow:established,to_client; content:"C0D076C5-E4C6-4561-8BF4-80DA8DB819D7"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0D076C5-E4C6-4561-8BF4-80DA8DB819D7/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010304; classtype:attempted-user; sid:2010304; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"ET SHELLCODE METASPLOIT BSD Reverse shell (Alpha2 Encoded 1)"; content:"|49 49 49 49 49 49 49 51 5a 6a|"; reference:url,doc.emergingthreats.net/2010424; classtype:shellcode-detect; sid:2010424; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 14 Access Attempt"; flow:established,to_client; content:"4F3E50BD-A9D7-4721-B0E1-00CB42A0A747"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4F3E50BD-A9D7-4721-B0E1-00CB42A0A747/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010305; classtype:attempted-user; sid:2010305; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"ET SHELLCODE METASPLOIT BSD Reverse shell (Alpha2 Encoded 2)"; content:"|58 50 30 42 31 41 42 6b 42 41|"; reference:url,doc.emergingthreats.net/2010425; classtype:shellcode-detect; sid:2010425; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 15 Access Attempt"; flow:established,to_client; content:"586FB486-5560-4FF3-96DF-1118C96AF456"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*586FB486-5560-4FF3-96DF-1118C96AF456/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010306; classtype:attempted-user; sid:2010306; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"ET SHELLCODE METASPLOIT BSD Reverse shell (Alpha2 Encoded 3)"; content:"|32 41 41 30 41 41 58 50 38 42 42 75|"; reference:url,doc.emergingthreats.net/2010426; classtype:shellcode-detect; sid:2010426; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 16 Access Attempt"; flow:established,to_client; content:"5B4B05EB-1F63-446B-AAD1-E10A34D650E0"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5B4B05EB-1F63-446B-AAD1-E10A34D650E0/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010307; classtype:attempted-user; sid:2010307; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"ET SHELLCODE METASPLOIT BSD SPARC Bind shell (SPARC Encoded 1)"; content:"|20 bf ff ff 20 bf ff ff 7f ff ff ff ea 03 e0 20 aa 9d 40 11|"; reference:url,doc.emergingthreats.net/2010427; classtype:shellcode-detect; sid:2010427; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 17 Access Attempt"; flow:established,to_client; content:"679E132F-561B-42F8-846C-A70DBDC62999"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*679E132F-561B-42F8-846C-A70DBDC62999/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010308; classtype:attempted-user; sid:2010308; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"ET SHELLCODE METASPLOIT BSD SPARC Bind shell (SPARC Encoded 2)"; content:"|ea 23 e0 20 a2 04 40 15 81 db e0 20 12 bf ff fb 9e 03 e0 04|"; reference:url,doc.emergingthreats.net/2010428; classtype:shellcode-detect; sid:2010428; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 18 Access Attempt"; flow:established,to_client; content:"6C68955E-F965-4249-8E18-F0977B1D2899"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6C68955E-F965-4249-8E18-F0977B1D2899/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010309; classtype:attempted-user; sid:2010309; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"ET SHELLCODE METASPLOIT BSD SPARC Bind shell (Not Encoded 1)"; content:"|e0 23 bf f0 c0 23 bf f4 92 23 a0 10 94 10 20 10 82 10 20 68|"; reference:url,doc.emergingthreats.net/2010429; classtype:shellcode-detect; sid:2010429; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 19 Access Attempt"; flow:established,to_client; content:"7F1232EE-44D7-4494-AB8B-CC61B10E21A5"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F1232EE-44D7-4494-AB8B-CC61B10E21A5/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010310; classtype:attempted-user; sid:2010310; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"ET SHELLCODE METASPLOIT BSD SPARC Bind shell (Not Encoded 2)"; content:"|91 d0 20 08 d0 03 bf f8 92 10 20 01 82 10 20 6a 91 d0 20 08|"; reference:url,doc.emergingthreats.net/2010430; classtype:shellcode-detect; sid:2010430; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 20 Access Attempt"; flow:established,to_client; content:"92883667-E95C-443D-AC96-4CACA27BEB6E"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*92883667-E95C-443D-AC96-4CACA27BEB6E/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010311; classtype:attempted-user; sid:2010311; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"ET SHELLCODE METASPLOIT BSD SPARC Bind shell (Not Encoded 3)"; content:"|d0 03 bf f8 92 1a 40 09 94 12 40 09 82 10 20 1e 91 d0 20 08|"; reference:url,doc.emergingthreats.net/2010431; classtype:shellcode-detect; sid:2010431; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 22 Access Attempt"; flow:established,to_client; content:"A2EDA89A-0966-4B91-9C18-AB69F098187F"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2EDA89A-0966-4B91-9C18-AB69F098187F/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010313; classtype:attempted-user; sid:2010313; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"ET SHELLCODE METASPLOIT BSD SPARC Bind shell (Not Encoded 4)"; content:"|23 0b dc da 90 23 a0 10 92 23 a0 08 e0 3b bf f0 d0 23 bf f8|"; reference:url,doc.emergingthreats.net/2010432; classtype:shellcode-detect; sid:2010432; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 23 Access Attempt"; flow:established,to_client; content:"C44C65C7-FDF1-453D-89A5-BCC28F5D69F9"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C44C65C7-FDF1-453D-89A5-BCC28F5D69F9/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010314; classtype:attempted-user; sid:2010314; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"ET SHELLCODE METASPLOIT BSD SPARC Reverse shell (Not Encoded 1)"; content:"|9c 2b a0 07 94 1a c0 0b 92 10 20 01 90 10 20 02 82 10 20 61|"; reference:url,doc.emergingthreats.net/2010433; classtype:shellcode-detect; sid:2010433; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 24 Access Attempt"; flow:established,to_client; content:"C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010315; classtype:attempted-user; sid:2010315; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"ET SHELLCODE METASPLOIT BSD SPARC Reverse shell (Not Encoded 2)"; content:"|91 d0 20 08 d0 23 bf f8 92 10 20 03 92 a2 60 01 82 10 20 5a|"; reference:url,doc.emergingthreats.net/2010434; classtype:shellcode-detect; sid:2010434; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 25 Access Attempt"; flow:established,to_client; content:"AECF5D2E-7A18-4DD2-BDCD-29B6F615B448"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AECF5D2E-7A18-4DD2-BDCD-29B6F615B448/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010316; classtype:attempted-user; sid:2010316; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"ET SHELLCODE METASPLOIT BSD SPARC Reverse shell (Not Encoded 3)"; content:"|91 d0 20 08 12 bf ff fd d0 03 bf f8 21 3f c0|"; reference:url,doc.emergingthreats.net/2010437; classtype:shellcode-detect; sid:2010437; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 26 Access Attempt"; flow:established,to_client; content:"BC0D69A8-0923-4EEE-9375-9239F5A38B92"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC0D69A8-0923-4EEE-9375-9239F5A38B92/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010317; classtype:attempted-user; sid:2010317; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"ET SHELLCODE METASPLOIT BSD SPARC Reverse shell (SPARC Encoded 1)"; content:"|20 bf ff ff 20 bf ff ff 7f ff ff ff ea 03 e0 20 aa 9d 40 11|"; reference:url,doc.emergingthreats.net/2010435; classtype:shellcode-detect; sid:2010435; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 27 Access Attempt"; flow:established,to_client; content:"C8F209F8-480E-454C-94A4-5392D88EBA0F"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C8F209F8-480E-454C-94A4-5392D88EBA0F/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010318; classtype:attempted-user; sid:2010318; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any (msg:"ET SHELLCODE METASPLOIT BSD SPARC Reverse shell (SPARC Encoded 2)"; content:"|ea 23 e0 20 a2 04 40 15 81 db e0 20 12 bf ff fb 9e 03 e0 04|"; reference:url,doc.emergingthreats.net/2010436; classtype:shellcode-detect; sid:2010436; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 28 Access Attempt"; flow:established,to_client; content:"CC45B0B0-72D8-4652-AE5F-5E3E266BE7ED"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CC45B0B0-72D8-4652-AE5F-5E3E266BE7ED/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010319; classtype:attempted-user; sid:2010319; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED CAN-2005-0399 Gif Vuln via http"; flow: from_server,established; content:"GIF89a"; content:"|21 ff 0b|NETSCAPE2.0"; byte_test:1,!=,3,0,relative; reference:cve,2005-0399; reference:url,doc.emergingthreats.net/bin/view/Main/2001807; classtype:attempted-admin; sid:2001807; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 29 Access Attempt"; flow:established,to_client; content:"CFFB1FC7-270D-4986-B299-FECF3F0E42DB"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFFB1FC7-270D-4986-B299-FECF3F0E42DB/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010320; classtype:attempted-user; sid:2010320; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 9999 (msg:"ET EXPLOIT MySQL MaxDB Buffer Overflow"; flow: to_server,established; content:"GET"; content:"|31 c9 83 e9 af d9 ee|"; pcre:"/(GET).\/%.{1586,}/i"; reference:url,doc.emergingthreats.net/bin/view/Main/2001988; classtype:attempted-admin; sid:2001988; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 30 Access Attempt"; flow:established,to_client; content:"E188F7A3-A04E-413E-99D1-D79A45F70305"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E188F7A3-A04E-413E-99D1-D79A45F70305/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010321; classtype:attempted-user; sid:2010321; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"ET NETBIOS NII Microsoft ASN.1 Library Buffer Overflow Exploit"; flow: to_server,established; content:"|A1 05 23 03 03 01 07|"; reference:url,www.microsoft.com/technet/security/bulletin/ms04-007.asp; reference:url,doc.emergingthreats.net/bin/view/Main/2000017; classtype:bad-unknown; sid:2000017; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 31 Access Attempt"; flow:established,to_client; content:"E476CBFF-E229-4524-B6B7-228A3129D1C7"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E476CBFF-E229-4524-B6B7-228A3129D1C7/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010322; classtype:attempted-user; sid:2010322; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"ET EXPLOIT Possible Novell Groupwise Internet Agent CREATE Verb Stack Overflow Attempt"; flow:established,to_server; content:"|41 30 30 31|"; depth:4; content:"CREATE "; within:10; isdataat:500,relative; content:!"|0A|"; within:500; reference:url,www.exploit-db.com/exploits/14379/; reference:url,www.zerodayinitiative.com/advisories/ZDI-10-129/; reference:url,support.microfocus.com/kb/doc.php?id=7006374; reference:url,doc.emergingthreats.net/2011235; classtype:attempted-admin; sid:2011235; rev:2; metadata:created_at 2010_07_30, former_category EXPLOIT, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 32 Access Attempt"; flow:established,to_client; content:"EF105BC3-C064-45F1-AD53-6D8A8578D01B"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EF105BC3-C064-45F1-AD53-6D8A8578D01B/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010323; classtype:attempted-user; sid:2010323; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ET EXPLOIT SYS get_domain_index_metadata Privilege Escalation Attempt"; flow:established,to_server; content:"ODCIIndexMetadata"; nocase; content:"sys.dbms_export_extension.get_domain_index_metadata"; nocase; reference:bugtraq,17699; reference:url,doc.emergingthreats.net/bin/view/Main/2002886; classtype:attempted-admin; sid:2002886; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 33 Access Attempt"; flow:established,to_client; content:"EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010324; classtype:attempted-user; sid:2010324; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ET EXPLOIT SYS get_domain_index_tables Access"; flow:established,to_server; content:"sys.dbms_export_extension.get_domain_index_tables"; nocase; reference:bugtraq,17699; reference:url,doc.emergingthreats.net/bin/view/Main/2002887; classtype:attempted-admin; sid:2002887; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 34 Access Attempt"; flow:established,to_client; content:"F44BB2D0-F070-463E-9433-B0CCF3CFD627"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F44BB2D0-F070-463E-9433-B0CCF3CFD627/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010325; classtype:attempted-user; sid:2010325; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"ET EXPLOIT SYS get_v2_domain_index_tables Privilege Escalation Attempt"; flow:established,to_server; content:"ODCIIndexUtilGetTableNames"; nocase; content:"sys.dbms_export_extension.get_v2_domain_index_tables"; nocase; reference:bugtraq,17699; reference:url,doc.emergingthreats.net/bin/view/Main/2002888; classtype:attempted-admin; sid:2002888; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 35 Access Attempt"; flow:established,to_client; content:"5A20FD6F-F8FE-4a22-9EE7-307D72D09E6E"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A20FD6F-F8FE-4a22-9EE7-307D72D09E6E/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010326; classtype:attempted-user; sid:2010326; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET $ORACLE_PORTS (msg:"ET EXPLOIT Possible Oracle Database Text Component ctxsys.drvxtabc.create_tables Remote SQL Injection Attempt"; flow:established,to_server; content:"ctxsys|2E|drvxtabc|2E|create|5F|tables"; nocase; content:"dbms|5F|sql|2E|execute"; nocase; distance:0; pcre:"/ctxsys\x2Edrvxtabc\x2Ecreate\x5Ftables.+(SELECT|DELETE|CREATE|INSERT|UPDATE|OUTFILE)/si"; reference:url,www.securityfocus.com/bid/36748; reference:cve,2009-1991; reference:url,doc.emergingthreats.net/2010375; classtype:attempted-admin; sid:2010375; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 36 Access Attempt"; flow:established,to_client; content:"ADEADEB8-E54B-11d1-9A72-0000F875EADE"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*ADEADEB8-E54B-11d1-9A72-0000F875EADE/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010327; classtype:attempted-user; sid:2010327; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET EXPLOIT FTP .message file write"; flow:to_server,established; content:"STOR "; nocase; depth:5; content:".message|0d 0a|"; distance:0; pcre:"/[^a-zA-Z0-9]+\.message/"; flowbits:set,BE.ftp.message; reference:url,www.milw0rm.com/exploits/2856; reference:url,doc.emergingthreats.net/bin/view/Main/2003196; classtype:misc-attack; sid:2003196; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 37 Access Attempt"; flow:established,to_client; content:"EC85D8F1-1C4E-46e4-A748-7AA04E7C0496"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EC85D8F1-1C4E-46e4-A748-7AA04E7C0496/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010328; classtype:attempted-user; sid:2010328; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET EXPLOIT ProFTPD .message file overflow attempt"; flowbits:isset,BE.ftp.message; flow:to_server,established; content:"CWD "; depth:4; nocase; flowbits:unset,BE.ftp.message; reference:url,www.milw0rm.com/exploits/2856; reference:url,doc.emergingthreats.net/bin/view/Main/2003197; classtype:misc-attack; sid:2003197; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 38 Access Attempt"; flow:established,to_client; content:"A2D4529E-84E0-4550-A2E0-C25D7C5CC0D0"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2D4529E-84E0-4550-A2E0-C25D7C5CC0D0/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010329; classtype:attempted-user; sid:2010329; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp any any -> $HOME_NET 139 (msg:"ET EXPLOIT Pwdump3e Session Established Reg-Entry port 139"; flow: to_server,established; content:"|53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 45 00 62 00 69 00 7a 00 5c 00 68 00 61 00 73 00 68|"; reference:url,doc.emergingthreats.net/bin/view/Main/2000565; classtype:suspicious-login; sid:2000565; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 39 Access Attempt"; flow:established,to_client; content:"E673DCF2-C316-4c6f-AA96-4E4DC6DC291E"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E673DCF2-C316-4c6f-AA96-4E4DC6DC291E/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010330; classtype:attempted-user; sid:2010330; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp any any -> $HOME_NET 445 (msg:"ET EXPLOIT Pwdump3e Session Established Reg-Entry port 445"; flow: to_server,established; content:"|53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 45 00 62 00 69 00 7a 00 5c 00 68 00 61 00 73 00 68|"; reference:url,doc.emergingthreats.net/bin/view/Main/2000566; classtype:suspicious-login; sid:2000566; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 40 Access Attempt"; flow:established,to_client; content:"D74CA70F-2236-4BA8-A297-4B2A28C2363C"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D74CA70F-2236-4BA8-A297-4B2A28C2363C/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010331; classtype:attempted-user; sid:2010331; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp any any -> $HOME_NET 445 (msg:"ET EXPLOIT Pwdump3e pwservice.exe Access port 445"; flow: to_server,established; content:"p|00|w|00|s|00|e|00|r|00|v|00|i|00|c|00|e|00|.|00|e|00|x|00|e"; reference:url,doc.emergingthreats.net/bin/view/Main/2000564; classtype:misc-attack; sid:2000564; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 41 Access Attempt"; flow:established,to_client; content:"01002B17-5D93-4551-81E4-831FEF780A53"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*01002B17-5D93-4551-81E4-831FEF780A53/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010332; classtype:attempted-user; sid:2010332; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp any any -> $HOME_NET 139 (msg:"ET EXPLOIT Pwdump3e pwservice.exe Access port 139"; flow: to_server,established; content:"p|00|w|00|s|00|e|00|r|00|v|00|i|00|c|00|e|00|.|00|e|00|x|00|e"; reference:url,doc.emergingthreats.net/bin/view/Main/2000567; classtype:misc-attack; sid:2000567; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft Communications Control Clsid Access"; flow:from_server,established; content:"648A5600-2C6E-101B-82B6-000000000014"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*648A5600-2C6E-101B-82B6-000000000014/si"; reference:url,www.microsoft.com/technet/security/advisory/969898.mspx; reference:url,doc.emergingthreats.net/2009400; classtype:attempted-user; sid:2009400; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp any any -> $HOME_NET 139 (msg:"ET EXPLOIT NTDump.exe Service Started port 139"; flow: to_server,established; content:"|4e 00 74 00 44 00 75 00 6d 00 70 00 53 00 76 00 63 00 2e 00 65 00 78 00 65 00|"; reference:url,doc.emergingthreats.net/bin/view/Main/2001053; classtype:misc-activity; sid:2001053; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft DebugDiag CrashHangExt.dll ActiveX Control Remote Denial of Service"; flow:to_client,established; content:"7233D6F8-AD31-440F-BAF0-9E7A292A53DA"; nocase; content:"GetEntryPointForThread"; nocase; reference:bugtraq,31996; reference:url,doc.emergingthreats.net/2008792; classtype:web-application-attack; sid:2008792; rev:48; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 445 (msg:"ET EXPLOIT NTDump.exe Service Started port 445"; flow: to_server,established; content:"|4e 00 74 00 44 00 75 00 6d 00 70 00 53 00 76 00 63 00 2e 00 65 00 78 00 65 00|"; reference:url,doc.emergingthreats.net/bin/view/Main/2001544; classtype:misc-activity; sid:2001544; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft Visual Basic Common AVI ActiveX Control File Parsing Buffer Overflow"; flow:to_client,established; content:"B09DE715-87C1-11D1-8BE3-0000F8754DA1"; nocase; content:"Open"; nocase; content:".avi"; nocase; distance:0; reference:url,www.milw0rm.com/exploits/7431; reference:bugtraq,32613; reference:url,doc.emergingthreats.net/2008993; classtype:web-application-attack; sid:2008993; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 139 (msg:"ET EXPLOIT NTDump Session Established Reg-Entry port 139"; flow: to_server,established; content:"|53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4e 00 74 00 44 00 75 00 6d 00 70 00|"; reference:url,doc.emergingthreats.net/bin/view/Main/2001052; classtype:misc-activity; sid:2001052; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft Whale Intelligent Application Gateway ActiveX Buffer Overflow-1"; flow:established,to_client; content:"8D9563A9-8D5F-459B-87F2-BA842255CB9A"; nocase; content:"CheckForUpdates"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A/si"; reference:url,dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/mswhale_checkforupdates.rb; reference:url,www.kb.cert.org/vuls/id/789121; reference:url,doc.emergingthreats.net/2010562; classtype:web-application-attack; sid:2010562; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 445 (msg:"ET EXPLOIT NTDump Session Established Reg-Entry port 445"; flow: to_server,established; content:"|53 00 4f 00 46 00 54 00 57 00 41 00 52 00 45 00 5c 00 4e 00 74 00 44 00 75 00 6d 00 70 00|"; reference:url,doc.emergingthreats.net/bin/view/Main/2001543; classtype:misc-activity; sid:2001543; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft Whale Intelligent Application Gateway ActiveX Buffer Overflow-2"; flow:established,to_client; content:"8D9563A9-8D5F-459B-87F2-BA842255CB9A"; nocase; content:"UpdateComponents"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A/si"; reference:url,dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/mswhale_checkforupdates.rb; reference:url,www.kb.cert.org/vuls/id/789121; reference:url,doc.emergingthreats.net/2010563; classtype:web-application-attack; sid:2010563; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 139 (msg:"ET EXPLOIT Pwdump4 Session Established GetHash port 139"; flow: to_server,established; content:"|50 57 44 75 6d 70 34 2e 64 6c 6c 00 47 65 74 48 61 73 68|"; reference:url,doc.emergingthreats.net/bin/view/Main/2001753; classtype:suspicious-login; sid:2001753; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft Windows Media Services nskey.dll ActiveX Control Possible Remote Buffer Overflow"; flow:to_client,established; content:"2646205B-878C-11D1-B07C-0000C040BCDB"; nocase; content:"CallHTMLHelp"; nocase; reference:bugtraq,30814; reference:cve,2008-5232; reference:url,doc.emergingthreats.net/2008925; classtype:web-application-attack; sid:2008925; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> $HOME_NET 445 (msg:"ET EXPLOIT Pwdump4 Session Established GetHash port 445"; flow: to_server,established; content:"|50 57 44 75 6d 70 34 2e 64 6c 6c 00 47 65 74 48 61 73 68|"; reference:url,doc.emergingthreats.net/bin/view/Main/2001754; classtype:suspicious-login; sid:2001754; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft Works 7 WkImgSrv.dll ActiveX Remote BOF Exploit"; flow:to_client,established; content:"0x40000"; content:"WksPictureInterface"; nocase; distance:0; content:"00E1DB59-6EFD-4CE7-8C0A-2DA3BCAAD9C6"; nocase; distance:0; reference:bugtraq,28820; reference:url,www.milw0rm.com/exploits/5460; reference:url,www.milw0rm.com/exploits/5530; reference:url,doc.emergingthreats.net/2008226; classtype:web-application-attack; sid:2008226; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT VNC Possible Vulnerable Server Response"; flow:established; dsize:12; content:"RFB 003.00"; depth:11; flowbits:noalert; flowbits:set,BSposs.vuln.vnc.svr; reference:url,www.realvnc.com/docs/rfbproto.pdf; reference:cve,2006-2369; reference:url,doc.emergingthreats.net/bin/view/Main/2002912; classtype:misc-activity; sid:2002912; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft XML Core Services DTD Cross Domain Information Disclosure clsid"; flow:to_client,established; content:"f5078f32-c551-11d3-89b9-0000f81fe221"; nocase; content:"loadXML"; nocase; distance:0; content:"parseError.srcText"; nocase; distance:0; reference:bugtraq,32155; reference:url,milw0rm.com/exploits/7196; reference:url,doc.emergingthreats.net/2008887; classtype:web-application-attack; sid:2008887; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT VNC Client response"; flowbits:isset,BSposs.vuln.vnc.svr; flow:established; dsize:12; content:"RFB 003.0"; depth:9; flowbits:noalert; flowbits:set,BSis.vnc.setup; reference:url,www.realvnc.com/docs/rfbproto.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2002913; classtype:misc-activity; sid:2002913; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Macrovision FLEXnet Connect ActiveX Control Arbitrary File Download"; flow:to_client, established; content:"DownloadAndExecute"; nocase; content:"1DF951B1-8D40-4894-A04C-66AD824A0EEF"; nocase; distance:0; reference:bugtraq,27279; reference:url,www.milw0rm.com/exploits/4913; reference:url,doc.emergingthreats.net/2010358; classtype:successful-user; sid:2010358; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT VNC Server VNC Auth Offer"; flowbits:isset,BSis.vnc.setup; flow:established; dsize:20; content:"|00 00 00 02|"; depth:4; flowbits:noalert; flowbits:set,BSvnc.auth.offered; reference:url,www.realvnc.com/docs/rfbproto.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2002914; classtype:misc-activity; sid:2002914; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX McAfee ePolicy Orchestrator naPolicyManager.dll Arbitrary Data Write Attempt"; flow:from_server,established; content:"04D18721-749F-4140-AEB0-CAC099CA4741"; nocase; content:"WriteTaskDataToIniFile"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*04D18721-749F-4140-AEB0-CAC099CA4741/si"; reference:url,www.securitytracker.com/alerts/2009/Jun/1022413.html; reference:url,www.packetstormsecurity.com/0906-exploits/mcafee-activex.txt; reference:url,doc.emergingthreats.net/2009411; classtype:attempted-user; sid:2009411; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT VNC Server VNC Auth Offer - No Challenge string"; flowbits:isset,BSis.vnc.setup; flow:established; dsize:2; content:"|01 02|"; depth:2; flowbits:noalert; flowbits:set,BSvnc.auth.offered; reference:url,www.realvnc.com/docs/rfbproto.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2002918; classtype:misc-activity; sid:2002918; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX MetaProducts MetaTreeX ActiveX Control Arbitrary File Overwrite"; flow:to_client,established; content:"67E66985-F81A-11D6-BC0F-F7B40157DC26"; nocase; pcre:"/(SaveToBMP|SaveToFile)/i"; reference:bugtraq,33318; reference:url,milw0rm.com/exploits/7804; reference:url,doc.emergingthreats.net/2009104; classtype:web-application-attack; sid:2009104; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT VNC Server Not Requiring Authentication"; flowbits:isset,BSis.vnc.setup; flow:established; content:"|01 01|"; depth:2; flowbits:set,BSvnc.auth.offered; flowbits:unset,BSis.vnc.setup; flowbits:unset,BSvnc.auth.offered; reference:url,www.realvnc.com/docs/rfbproto.pdf; reference:cve,2006-2369; reference:url,doc.emergingthreats.net/bin/view/Main/2002924; classtype:misc-activity; sid:2002924; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microgaming FlashXControl Control Clsid Access"; flow:from_server,established; content:"D8089245-3211-40F6-819B-9E5E92CD61A2"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D8089245-3211-40F6-819B-9E5E92CD61A2/si"; reference:url,www.microsoft.com/technet/security/advisory/969898.mspx; reference:url,www.microgaming.co.uk/news_flashxcontrol.php; reference:url,doc.emergingthreats.net/2009401; classtype:attempted-user; sid:2009401; rev:26; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT VNC Server Not Requiring Authentication (case 2)"; flowbits:isset,BSis.vnc.setup; dsize:4; flow:established; content:"|00 00 00 01|"; depth:4; flowbits:set,BSvnc.auth.offered; reference:url,www.realvnc.com/docs/rfbproto.pdf; reference:cve,2006-2369; reference:url,doc.emergingthreats.net/bin/view/Main/2002923; classtype:misc-activity; sid:2002923; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX NCTsoft NCTAudioFile2 ActiveX Control NCTWMAFILE2.DLL Arbitrary File Overwrite"; flow:to_client,established; content:"6ED74AE3-8066-4385-AABA-243E033F75A3"; nocase; content:"CreateFile"; nocase; reference:url,www.milw0rm.com/exploits/7871; reference:bugtraq,24613; reference:url,doc.emergingthreats.net/2009121; classtype:web-application-attack; sid:2009121; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT VNC Good Authentication Reply"; flowbits:isset,BSvnc.auth.offered; flow:established; dsize:2; content:"|02|"; flowbits:unset,BSvnc.auth.offered; flowbits:noalert; flowbits:set,BSvnc.auth.agreed; reference:url,www.realvnc.com/docs/rfbproto.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2002919; classtype:attempted-admin; sid:2002919; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Nokia Phoenix Service Software ActiveX Control Buffer Overflow"; flow:to_client,established; content:"F85B4A10-B530-4D68-A714-7415838FD174"; nocase; content:"SelectDevice"; nocase; reference:bugtraq,33726; reference:url,doc.emergingthreats.net/2009178; classtype:web-application-attack; sid:2009178; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT VNC Authentication Reply"; flowbits:isset,BSvnc.auth.offered; flow:established; dsize:16; flowbits:unset,BSvnc.auth.offered; flowbits:noalert; flowbits:set,BSvnc.auth.agreed; reference:url,www.realvnc.com/docs/rfbproto.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2002915; classtype:attempted-admin; sid:2002915; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Novell GroupWise Client 'gxmim1.dll' ActiveX Buffer Overflow Attempt"; flow:established,to_client; content:"9796BED2-C1CF-11D2-9384-0008C7396667"; nocase; content:"SetFontFace"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9796BED2-C1CF-11D2-9384-0008C7396667/si"; reference:url,www.securityfocus.com/bid/36398; reference:url,doc.emergingthreats.net/2009923; classtype:attempted-user; sid:2009923; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT RealVNC Authentication Bypass Attempt"; flowbits:isset,BSvnc.auth.offered; flow:established; dsize:1; content:"|01|"; depth:1; flowbits:set,BSvnc.null.auth.sent; reference:url,secunia.com/advisories/20107/; reference:url,archives.neohapsis.com/archives/fulldisclosure/2006-05/0356.html; reference:cve,2006-2369; reference:url,doc.emergingthreats.net/bin/view/Main/2002916; classtype:attempted-admin; sid:2002916; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Novell iPrint Client ExecuteRequest ActiveX Control Buffer Overflow Attempt"; flow:established,to_client; content:"36723F97-7AA0-11D4-8919-FF2D71D0D32C"; nocase; content:"ExecuteRequest"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C/si"; reference:cve,2008-0935; reference:url,doc.emergingthreats.net/2010693; classtype:attempted-user; sid:2010693; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT RealVNC Server Authentication Bypass Successful"; flowbits:isset,BSvnc.null.auth.sent; flow:established; dsize:4; content:"|00 00 00 00|"; depth:4; flowbits:unset,BSis.vnc.setup; flowbits:unset,BSvnc.auth.offered; reference:url,secunia.com/advisories/20107/; reference:url,archives.neohapsis.com/archives/fulldisclosure/2006-05/0356.html; reference:cve,2006-2369; reference:url,doc.emergingthreats.net/bin/view/Main/2002917; classtype:successful-admin; sid:2002917; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Novell iPrint Client GetDriverSettings ActiveX Control Buffer Overflow Attempt"; flow:established,to_client; content:"336723F97-7AA0-11D4-8919-FF2D71D0D32C"; nocase; content:"GetDriverSettings"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C/si"; reference:cve,2008-2908; reference:url,doc.emergingthreats.net/2010694; classtype:attempted-user; sid:2010694; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT VNC Multiple Authentication Failures"; flowbits:isset,BSvnc.auth.agreed; flow:established; dsize:<50; content:"|00 00 00 02|"; depth:4; reference:url,www.realvnc.com/docs/rfbproto.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2002921; classtype:attempted-admin; sid:2002921; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Orbit Downloader ActiveX Control Arbitrary File Delete"; flow:to_client,established; content:"3F1D494B-0CEF-4468-96C9-386E2E4DEC90"; nocase; content:"download"; nocase; reference:bugtraq,34200; reference:url,milw0rm.com/exploits/8257; reference:url,doc.emergingthreats.net/2009314; classtype:web-application-attack; sid:2009314; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"ET EXPLOIT SQL sp_configure - configuration change"; flow:to_server,established; content:"s|00|p|00|_|00|c|00|o|00|n|00|f|00|i|00|g|00|u|00|r|00|e|00|"; nocase; reference:url,msdn.microsoft.com/en-us/library/ms190693.aspx; reference:url,doc.emergingthreats.net/bin/view/Main/2008517; classtype:attempted-user; sid:2008517; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Orca Browser 1.1 Activex Command Execution clsid access attempt"; flow:established,to_client; content:"7606693A-C18D-4567-AF85-6194FF70761E"; nocase; content:"ExecCommand"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E/si"; reference:url,www.packetstormsecurity.org/0909-exploits/orca-exec.txt; reference:url,doc.emergingthreats.net/2010363; classtype:web-application-attack; sid:2010363; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET EXPLOIT SQL sp_configure attempt"; flow:to_server,established; content:"sp_configure"; nocase; reference:url,msdn.microsoft.com/en-us/library/ms190693.aspx; reference:url,doc.emergingthreats.net/bin/view/Main/2008518; classtype:attempted-user; sid:2008518; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX PDFZilla 1.0.8 ActiveX DebugMsgLog method DOS CLSid Access"; flow:established,to_client; content:"59DBDDA6-9A80-42A4-B824-9BC50CC172F5"; nocase; content:"DebugMsgLog"; nocase; reference:url,packetstormsecurity.org/0908-exploits/pdfzilla-overflow.txt; reference:url,doc.emergingthreats.net/9130; classtype:web-application-attack; sid:2010029; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET NETBIOS LSA exploit"; flow: to_server,established; content:"|313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131313131|"; offset: 78; depth: 192; reference:url,www.eeye.com/html/research/advisories/AD20040501.html; reference:url,www.upenn.edu/computing/virus/04/w32.sasser.worm.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000032; classtype:misc-activity; sid:2000032; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX PPStream PowerPlayer.DLL ActiveX Control BoF Vulnerability"; flow:to_client,established; content:"5EC7C511-CD0F-42E6-830C-1BD9882F3458"; nocase; content:"0x40000"; content:"Logo"; nocase; reference:bugtraq,25502; reference:url,doc.emergingthreats.net/2008173; classtype:web-application-attack; sid:2008173; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 4000 (msg:"ET EXPLOIT SecurityGateway 1.0.1 Remote Buffer Overflow"; flow:to_server,established; content:"POST "; depth:5; nocase; content:"/SecurityGateway.dll"; nocase; distance:0; content:"logon"; nocase; distance:0; content:"&username"; nocase; distance:0; pcre:"/\x3d[^\x26]{720}/R"; reference:url,frsirt.com/english/advisories/2008/1717; reference:url,milw0rm.com/exploits/5718; reference:url,doc.emergingthreats.net/bin/view/Main/2008426; reference:cve,2008-4193; classtype:misc-attack; sid:2008426; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible PPStream MList.ocx Buffer Overflow Attempt"; flow:from_server,established; content:"D22DE742-04CD-4B5C-A8A3-82AB3DAEC43D"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D22DE742-04CD-4B5C-A8A3-82AB3DAEC43D/si"; reference:url,www.securityfocus.com/bid/36234/info; reference:url,doc.emergingthreats.net/2009858; classtype:attempted-user; sid:2009858; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible ShixxNote buffer-overflow + remote shell attempt"; flow: established,to_server; content:"|68 61 63 6b 75|"; offset: 126; depth: 5; content:"|68 61 63 6b 90 61 61 61 61|"; offset: 519; depth: 9; reference:url,aluigi.altervista.org/adv/shixxbof-adv.txt; reference:url,doc.emergingthreats.net/bin/view/Main/2001385; classtype:shellcode-detect; sid:2001385; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Phoenician Casino FlashAX ActiveX Control Remote Buffer Overflow"; flow:to_client,established; content:"D8089245-3211-40F6-819B-9E5E92CD61A2"; nocase; content:"SetID"; nocase; reference:bugtraq,32901; reference:url,www.milw0rm.com/exploits/7505; reference:url,doc.emergingthreats.net/2009002; classtype:web-application-attack; sid:2009002; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"ET EXPLOIT Solaris TTYPROMPT environment variable set"; flow: established,to_server; content:"|00 54 54 59 50 52 4F 4D 50 54|"; reference:url,online.securityfocus.com/archive/1/293844; reference:url,doc.emergingthreats.net/bin/view/Main/2001780; classtype:attempted-admin; sid:2001780; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX PrecisionID Datamatrix ActiveX control Arbitrary File Overwrite"; flow:to_client,established; content:"6C951D10-B07F-11DB-A6ED-0050C2490048"; nocase; pcre:"/(SaveBarCode|SaveEnhWMF)/i"; reference:url,milw0rm.com/exploits/8332; reference:url,securityfocus.com/archive/1/502319; reference:url,doc.emergingthreats.net/2009315; classtype:web-application-attack; sid:2009315; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"ET EXPLOIT Solaris telnet USER environment vuln Attack inbound"; flow:to_server,established; content: "|ff fa 27 00 00 55 53 45 52 01 2d 66|"; rawbytes; reference:url,riosec.com/solaris-telnet-0-day; reference:url,isc.sans.org/diary.html?n&storyid=2220; reference:url,doc.emergingthreats.net/bin/view/Main/2003411; reference:cve,2007-0882; classtype:attempted-user; sid:2003411; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX ProgramChecker 1.5 Activex Command Execution clsid access attempt"; flow:established,to_client; content:"DD50A655-10FB-11D2-A22B-00104B27F81B"; nocase; content:"Run"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*DD50A655-10FB-11D2-A22B-00104B27F81B/si"; reference:url,www.packetstormsecurity.org/0909-exploits/programchecker-exec.txt; reference:url,doc.emergingthreats.net/2010365; classtype:web-application-attack; sid:2010365; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 23 (msg:"ET EXPLOIT Solaris telnet USER environment vuln Attack outbound"; flow:to_server,established; content: "|ff fa 27 00 00 55 53 45 52 01 2d 66|"; rawbytes; reference:url,riosec.com/solaris-telnet-0-day; reference:url,isc.sans.org/diary.html?n&storyid=2220; reference:url,doc.emergingthreats.net/bin/view/Main/2003412; reference:cve,2007-0882; classtype:attempted-user; sid:2003412; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Remote Desktop Connection ActiveX Control Heap Overflow clsid access"; flow:established,to_client; content:"7390f3d8-0439-4c05-91e3-cf5cb290c3d0"; nocase; pcre:"/]*\s*classid\s*=\s*(.+\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*7390f3d8-0439-4c05-91e3-cf5cb290c3d0\s*}?\s*(\?P=q1)(\s|>)/si"; reference:cve,2009-1929; reference:url,www.microsoft.com/technet/security/Bulletin/MS09-044.mspx; reference:url,doc.emergingthreats.net/2009907; classtype:attempted-user; sid:2009907; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET EXPLOIT Possible SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt"; flow:established,to_server; content:"to|3A|"; depth:10; nocase; content:"+|3A|\"|7C|"; distance:0; reference:url,www.securityfocus.com/bid/38578; reference:url,seclists.org/fulldisclosure/2010/Mar/140; reference:url,doc.emergingthreats.net/2010877; classtype:attempted-user; sid:2010877; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX RKD Software ActiveX Control SaveasMolFile Method Buffer Overflow Attempt"; flow:established,to_client; content:"C26D9CA8-6747-11D5-AD4B-C01857C10000"; nocase; content:"SaveasMolFile"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C26D9CA8-6747-11D5-AD4B-C01857C10000/si"; reference:url,packetstorm.foofus.com/1002-exploits/barcode_ax49.rb.txt; reference:bugtraq,24596; reference:url,doc.emergingthreats.net/2011020; classtype:attempted-user; sid:2011020; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET EXPLOIT Possible Sendmail SpamAssassin Milter Plugin Remote Arbitrary Command Injection Attempt"; flow:established,to_server; content:"to|3A|"; depth:10; nocase; content:"+\"|7C|"; distance:0; reference:url,www.securityfocus.com/bid/38578; reference:url,seclists.org/fulldisclosure/2010/Mar/140; reference:url,doc.emergingthreats.net/2010941; classtype:attempted-user; sid:2010941; rev:1; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX RTSP MPEG4 SP Control ActiveX Control Url Property Buffer Overflow Vulnerability"; flow:to_client,established; content:"45830FF9-D9E6-4F41-86ED-B266933D8E90"; nocase; content:"0x40000"; nocase; content:"Url"; nocase; reference:bugtraq,28010; reference:url,www.milw0rm.com/exploits/5193; reference:url,doc.emergingthreats.net/2007904; classtype:web-application-attack; sid:2007904; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 3128 (msg:"ET EXPLOIT Squid NTLM Auth Overflow Exploit"; flow: to_server; content:"|4141 414a 4351 6b4a 4351 6b4a 4351 6b4a|"; offset: 96; reference:url,www.idefense.com/application/poi/display?id=107; reference:cve,CAN-2004-0541; reference:url,doc.emergingthreats.net/bin/view/Main/2000342; classtype:misc-attack; sid:2000342; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Rediff Bol Downloader ActiveX Control Remote Code Execution"; flow:to_client,established; content:"BADA82CB-BF48-4D76-9611-78E2C6F49F03"; nocase; content:"url"; nocase; distance:0; pcre:"/(exe|bat|com|dll|ini)/i"; content:"start"; nocase; reference:cve,CVE-2006-6838; reference:bugtraq,21831; reference:url,downloads.securityfocus.com/vulnerabilities/exploits/21831.html; reference:url,doc.emergingthreats.net/2007998; classtype:web-application-attack; sid:2007998; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"ET EXPLOIT TFTP Invalid Mode in file Get"; content:"|01|"; depth:1; content:"|00|"; distance:1; content:"|00|"; distance:0; content:!"|00|binary|00|"; nocase; content:!"|00|netascii|00|"; nocase; content:!"|00|mail|00|"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2003198; classtype:non-standard-protocol; sid:2003198; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Registry OCX ActiveX FullPath Method Buffer Overflow Attempt"; flow:to_client,established; content:"6D5B4E71-625F-11D2-B3AE-00A0C932C7DF"; nocase; content:"FullPath"; nocase; reference:url,exploit-db.com/exploits/14200/; reference:url,doc.emergingthreats.net/2011253; classtype:attempted-user; sid:2011253; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"ET EXPLOIT TFTP Invalid Mode in file Put"; content:"|02|"; depth:1; content:"|00|"; distance:1; content:"|00|"; distance:0; content:!"|00|binary|00|"; nocase; content:!"|00|netascii|00|"; nocase; content:!"|00|mail|00|"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2003199; classtype:non-standard-protocol; sid:2003199; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Rising Online Virus Scanner ActiveX Control Scan() Method Stack Buffer Overflow Attempt"; flow:established,to_client; content:"9FAFB576-6933-4CCC-AB3D-B988EC43D04E"; nocase; content:"Scan"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9FAFB576-6933-4CCC-AB3D-B988EC43D04E/si"; reference:url,www.securityfocus.com/bid/38282; reference:url,doc.emergingthreats.net/2010839; classtype:attempted-user; sid:2010839; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 14942 (msg:"ET EXPLOIT Trend Micro Web Interface Auth Bypass Vulnerable Cookie Attempt"; flow:established,to_server; content:"splx_2376_info"; reference:url,labs.idefense.com/intelligence/vulnerabilities/display.php?id=477; reference:url,www.trendmicro.com/download/product.asp?productid=20; reference:url,doc.emergingthreats.net/bin/view/Main/2003434; classtype:attempted-admin; sid:2003434; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Roxio CinePlayer SonicDVDDashVRNav.DLL ActiveX Control Remote Buffer Overflow"; flow:to_client,established; content:"9F1363DA-0220-462E-B923-9E3C9038896F"; nocase; content:"DiskType"; nocase; reference:url,milw0rm.com/exploits/8824; reference:bugtraq,23412; reference:url,doc.emergingthreats.net/2009725; classtype:web-application-attack; sid:2009725; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 10000 (msg:"ET EXPLOIT Possible BackupExec Metasploit Exploit (outbound)"; flow:established,to_server; content: "|00 00 03 00 00 02 00 58 58 58|"; offset: 24; depth: 20; reference:url,isc.sans.org/diary.php?date=2005-06-27; reference:url,www.metasploit.org/projects/Framework/modules/exploits/backupexec_agent.pm; reference:url,doc.emergingthreats.net/bin/view/Main/2002062; classtype:attempted-admin; sid:2002062; rev:4; metadata:affected_product Any, attack_target Client_and_Server, created_at 2010_07_30, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Roxio CinePlayer IAManager.dll ActiveX Control Buffer Overflow"; flow:to_client,established; content:"EE1BBA18-F0C8-477E-8AC8-C28B94F1B7DC"; nocase; content:"SetIAPlayerName"; nocase; reference:url,xforce.iss.net/xforce/xfdb/50868; reference:url,milw0rm.com/exploits/8835; reference:url,doc.emergingthreats.net/2009735; classtype:web-application-attack; sid:2009735; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET 10000 -> $EXTERNAL_NET any (msg:"ET EXPLOIT NDMP Notify Connect - Possible Backup Exec Remote Agent Recon"; flow:established,from_server; content:"|00 00 05 02|"; offset:16; depth:20; content: "|00 00 00 03|"; offset: 28; depth: 32; reference:url,www.ndmp.org/download/sdk_v4/draft-skardal-ndmp4-04.txt; reference:url,doc.emergingthreats.net/bin/view/Main/2002068; classtype:attempted-recon; sid:2002068; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible SAP GUI ActiveX Control Insecure Method File Overwrite Attempt"; flow:from_server,established; content:"AFBBE070-7340-11d2-AA6B-00E02924C34E"; nocase; content:"Save"; nocase; content:"ToSessionFile"; within:17; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AFBBE070-7340-11d2-AA6B-00E02924C34E/si"; reference:url,www.securitytracker.com/alerts/2009/Sep/1022953.html; reference:url,doc.emergingthreats.net/2010013; classtype:attempted-user; sid:2010013; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 10000 (msg:"ET EXPLOIT Backup Exec Windows Agent Remote File Access - Attempt"; flow:to_server,established; flowbits:isnotset,SID2002181; content:"|0000 0000 0000 0901 0000 0000 0000 0000 0000 0002 0000 0004 726f 6f74 b4b8 0f26 205c 4234 03fc aeee 8f91 3d6f|"; offset:8; depth:52; flowbits:set,SID2002181; reference:url,www.frsirt.com/english/advisories/2005/1387; reference:url,www.frsirt.com/exploits/20050811.backupexec_dump.pm.php; reference:url,doc.emergingthreats.net/bin/view/Main/2002181; classtype:default-login-attempt; sid:2002181; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX ACTIVEX SAP AG SAPgui sapirrfc.dll ActiveX Control Buffer Overflow Attempt"; flow:from_server,established; content:"77F12F8A-F117-11D0-8CF1-00A0C91D9D87"; nocase; content:"Accept"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*77F12F8A-F117-11D0-8CF1-00A0C91D9D87/si"; reference:url,www.securityfocus.com/bid/35256/info; reference:url,doc.emergingthreats.net/2010219; classtype:attempted-user; sid:2010219; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET 10000 -> $EXTERNAL_NET any (msg:"ET EXPLOIT Backup Exec Windows Agent Remote File Access - Vulnerable"; flow:from_server,established; flowbits:isset,SID2002181; content:"|0000 0001 0000 0901|"; offset:8; depth:16; content:"|0000 0000 0000 0000|"; distance:4; within:12; reference:url,www.frsirt.com/english/advisories/2005/1387; reference:url,www.frsirt.com/exploits/20050811.backupexec_dump.pm.php; reference:url,doc.emergingthreats.net/bin/view/Main/2002182; classtype:misc-attack; sid:2002182; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX SAP GUI vsflexGrid ActiveX Archive method Buffer Overflow CLSID Attempt"; flow:established,to_client; content:"C0A63B86-4B21-11D3-BD95-D426EF2C7949"; nocase; content:"Archive"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949/si"; reference:url,dsecrg.com/pages/vul/show.php?id=117; reference:url,osvdb.org/show/osvdb/41939; reference:url,doc.emergingthreats.net/2010468; classtype:web-application-attack; sid:2010468; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT WMF Exploit"; flow:established; content:"|01 00 09 00 00 03 52 1f 00 00 06 00 3d 00 00 00|"; content:"|00 26 06 0f 00 08 00 ff ff ff ff 01 00 00 00 03 00 00 00 00 00|"; reference:url,www.frsirt.com/exploits/20051228.ie_xp_pfv_metafile.pm.php; reference:url,doc.emergingthreats.net/bin/view/Main/2002734; classtype:attempted-user; sid:2002734; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX SAP GUI vsflexGrid ActiveX Text method Buffer Overflow CLSID Attempt"; flow:established,to_client; content:"C0A63B86-4B21-11D3-BD95-D426EF2C7949"; nocase; content:"Text"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949/si"; reference:url,dsecrg.com/pages/vul/show.php?id=117; reference:url,osvdb.org/show/osvdb/41939; reference:url,doc.emergingthreats.net/2010469; classtype:web-application-attack; sid:2010469; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 9100 (msg:"ET EXPLOIT Xerox WorkCentre PJL Daemon Buffer Overflow Attempt"; flow:established,to_server; content:"ENTER LANGUAGE ="; depth:50; nocase; isdataat:55,relative; content:!"|0A|"; within:55; pcre:"/ENTER\x20LANGUAGE\x20\x3D.{55}/smi"; reference:url,www.securityfocus.com/bid/38010; reference:url,doc.emergingthreats.net/2010759; classtype:attempted-admin; sid:2010759; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX SAP GUI vsflexGrid ActiveX EditSelText method Buffer Overflow CLSID Attempt"; flow:established,to_client; content:"C0A63B86-4B21-11D3-BD95-D426EF2C7949"; nocase; content:"EditSelText"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949/si"; reference:url,dsecrg.com/pages/vul/show.php?id=117; reference:url,osvdb.org/show/osvdb/41939; reference:url,doc.emergingthreats.net/2010470; classtype:web-application-attack; sid:2010470; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Battle.net Starcraft login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"RATS"; offset:12; depth:12; reference:url,doc.emergingthreats.net/bin/view/Main/2002101; classtype:policy-violation; sid:2002101; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX SAP GUI vsflexGrid ActiveX EditText method Buffer Overflow CLSID Attempt"; flow:established,to_client; content:"C0A63B86-4B21-11D3-BD95-D426EF2C7949"; nocase; content:"EditText"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949/si"; reference:url,dsecrg.com/pages/vul/show.php?id=117; reference:url,osvdb.org/show/osvdb/41939; reference:url,doc.emergingthreats.net/2010471; classtype:web-application-attack; sid:2010471; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Battle.net Brood War login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"PXES"; offset:12; depth:12; reference:url,doc.emergingthreats.net/bin/view/Main/2002102; classtype:policy-violation; sid:2002102; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX SAP GUI vsflexGrid ActiveX CellFontName method Buffer Overflow CLSID Attempt"; flow:established,to_client; content:"C0A63B86-4B21-11D3-BD95-D426EF2C7949"; nocase; content:"CellFontName"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949/si"; reference:url,dsecrg.com/pages/vul/show.php?id=117; reference:url,osvdb.org/show/osvdb/41939; reference:url,doc.emergingthreats.net/2010472; classtype:web-application-attack; sid:2010472; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Battle.net Diablo login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"LTRD"; offset:12; depth:12; reference:url,doc.emergingthreats.net/bin/view/Main/2002103; classtype:policy-violation; sid:2002103; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX SAP AG SAPgui EAI WebViewer2D ActiveX stack buffer overflow CLSid Access"; flow:established,to_client; content:"A76CEBEE-7364-11D2-AA6B-00E02924C34E"; nocase; content:"SaveToSessionFile"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A76CEBEE-7364-11D2-AA6B-00E02924C34E/si"; reference:url,dsecrg.com/pages/vul/show.php?id=143; reference:url,doc.emergingthreats.net/2010481; classtype:attempted-user; sid:2010481; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Battle.net Diablo 2 login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"VD2D"; offset:12; depth:12; reference:url,doc.emergingthreats.net/bin/view/Main/2002104; classtype:policy-violation; sid:2002104; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX SAP GUI SAPBExCommonResources ActiveX Insecure Method Code Execution Attempt"; flow:established,to_client; content:"A009C90D-814B-11D3-BA3E-080009D22344"; nocase; content:"Execute"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A009C90D-814B-11D3-BA3E-080009D22344/si"; reference:url,dsecrg.com/pages/vul/show.php?id=164; reference:url,doc.emergingthreats.net/2010957; classtype:attempted-user; sid:2010957; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Battle.net Diablo 2 Lord of Destruction login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"PX2D"; offset:12; depth:12; reference:url,doc.emergingthreats.net/bin/view/Main/2002105; classtype:policy-violation; sid:2002105; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX SaschArt SasCam Webcam Server ActiveX Control Get Method Buffer Overflow"; flow:to_client,established; content:"0297D24A-F425-47EE-9F3B-A459BCE593E3"; nocase; content:"Get"; nocase; reference:bugtraq,33053; reference:url,milw0rm.com/exploits/7617; reference:url,doc.emergingthreats.net/2009047; classtype:web-application-attack; sid:2009047; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Battle.net Warcraft 2 login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"NB2W"; offset:12; depth:12; reference:url,doc.emergingthreats.net/bin/view/Main/2002106; classtype:policy-violation; sid:2002106; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible SmartVMD VideoMovement.dll Buffer Overflow Attempt"; flow:established,from_server; content:"E3462D53-47A6-11D8-8EF6-DAE89272743C"; nocase; content:"StartVideoSaving"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E3462D53-47A6-11D8-8EF6-DAE89272743C/si"; reference:url,www.securityfocus.com/bid/36217/info; reference:url,doc.emergingthreats.net/2009869; classtype:attempted-user; sid:2009869; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Battle.net Warcraft 3 login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"3RAW"; offset:12; depth:12; reference:url,doc.emergingthreats.net/bin/view/Main/2002107; classtype:policy-violation; sid:2002107; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX SonicWALL SSL VPN Client Remote ActiveX AddRouteEntry Attempt"; flow:to_client,established; content:"6EEFD7B1-B26C-440D-B55A-1EC677189F30"; nocase; content:"AddRouteEntry"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6EEFD7B1-B26C-440D-B55A-1EC677189F30/si"; reference:url,www.securityfocus.com/bid/26288/info; reference:cve,2007-5603; reference:url,doc.emergingthreats.net/2010456; classtype:attempted-user; sid:2010456; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net old game version"; flow:established,from_server; content:"|FF 51|"; depth:2; content:"|00 01 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002109; classtype:policy-violation; sid:2002109; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Sopcast SopCore ActiveX Control Remote Code Execution"; flow:to_client,established; content:"8FEFF364-6A5F-4966-A917-A3AC28411659"; nocase; content:"SetExternalPlayer"; nocase; reference:bugtraq,33920; reference:url,packetstorm.linuxsecurity.com/0902-exploits/9sg_sopcastia.txt; reference:url,doc.emergingthreats.net/2009226; classtype:web-application-attack; sid:2009226; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net invalid version"; flow:established,from_server; content:"|FF 51 08 00 01 01 00 00|"; reference:url,doc.emergingthreats.net/bin/view/Main/2002110; classtype:policy-violation; sid:2002110; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX SupportSoft DNA Editor Module ActiveX Control Insecure Method Remote Code Execution"; flow:to_client,established; content:"01110800-3E00-11D2-8470-0060089874ED"; nocase; pcre:"/(Packagefiles|SaveDna|SetIdentity|AddFile)/i"; reference:bugtraq,34004; reference:url,milw0rm.com/exploits/8160; reference:url,doc.emergingthreats.net/2009322; classtype:web-application-attack; sid:2009322; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net invalid cdkey"; flow:established,from_server; content:"|FF 51 09 00 00 02 00 00|"; reference:url,doc.emergingthreats.net/bin/view/Main/2002111; classtype:policy-violation; sid:2002111; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Sygate Personal Firewall ActiveX SetRegString Method Stack Overflow Attempt"; flow:established,to_client; content:"D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9"; nocase; content:"SetRegString"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9/si"; reference:url,www.exploit-db.com/exploits/13834/; reference:url,www.corelan.be#=#=8800/index.php/forum/security-advisories/10-050-sygate-personal-firewall-5-6-build-2808-activex/; reference:url,doc.emergingthreats.net/2011690; classtype:attempted-user; sid:2011690; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net cdkey in use"; flow:established,from_server; content:"|FF 51|"; depth:2; content:"|01 02 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002112; classtype:policy-violation; sid:2002112; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Symantec BackupExec Calendar Control (PVCalendar.ocx) BoF Vulnerability"; flow:to_client,established; content:"22ACD16F-99EB-11D2-9BB3-00400561D975"; nocase; content:"0x40000"; pcre:"/(_DOWText)|(_MonthText)/i"; content:"Save"; nocase; reference:url,www.milw0rm.com/exploits/5205; reference:cve,CVE-2007-6017; reference:bugtraq,28008; reference:url,doc.emergingthreats.net/2007932; classtype:web-application-attack; sid:2007932; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net banned key"; flow:established,from_server; content:"|FF 51 09 00 02 02 00 00|"; reference:url,doc.emergingthreats.net/bin/view/Main/2002113; classtype:policy-violation; sid:2002113; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Symantec Norton Ghost EasySetupInt.dll ActiveX Multiple Remote Denial of Service"; flow:to_client,established; content:"7972D5BE-2213-4B28-884C-F8F82432EAA5"; nocase; pcre:"/(SetupDeleteVolume|GetBackupLocationPath|CallUninstall|CanUseEasySetup|CallAddInitialProtection|CallTour)/i"; reference:url,milw0rm.com/exploits/8523; reference:bugtraq,34696; reference:url,doc.emergingthreats.net/2009373; classtype:web-application-attack; sid:2009373; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net wrong product"; flow:established,from_server; content:"|FF 51 09 00 03 02 00 00|"; reference:url,doc.emergingthreats.net/bin/view/Main/2002114; classtype:policy-violation; sid:2002114; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Symantec WinFax Pro DCCFAXVW.DLL Heap Buffer Overflow"; flow:to_client,established; content:"C05A1FBC-1413-11D1-B05F-00805F4945F6"; nocase; content:"AppendFax"; nocase; reference:bugtraq,34766; reference:url,milw0rm.com/exploits/8562; reference:url,doc.emergingthreats.net/2009385; classtype:web-application-attack; sid:2009385; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net user in channel"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|01 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002118; classtype:policy-violation; sid:2002118; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Symantec Security Check RuFSI ActiveX Control Buffer Overflow"; flow:to_client,established; content:"69DEAF94-AF66-11D3-BEC0-00105AA9B6AE"; nocase; pcre:"/classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*69DEAF94-AF66-11D3-BEC0-00105AA9B6AE/si"; reference:bugtraq,8008; reference:url,xforce.iss.net/xforce/xfdb/12423; reference:url,juniper.net/security/auto/vulnerabilities/vuln8008.html; reference:url,doc.emergingthreats.net/2009847; classtype:web-application-attack; sid:2009847; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net user joined channel"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|02 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002140; classtype:policy-violation; sid:2002140; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Symantec Multiple Altiris Products AeXNSConsoleUtilities.dll ActiveX Control BrowseAndSaveFile Method Buffer Overflow Attempt"; flow:established,from_server; content:"B44D252D-98FC-4D5C-948C-BE868392A004"; nocase; content:"BrowseAndSaveFile"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004/si"; reference:url,www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20091102_00; reference:url,www.securityfocus.com/bid/36698/info; reference:url,sotiriu.de/adv/NSOADV-2009-001.txt; reference:cve,2009-3031; reference:url,doc.emergingthreats.net/2010227; classtype:attempted-user; sid:2010227; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net user left channel"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|03 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002141; classtype:policy-violation; sid:2002141; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Symantec Altiris Deployment Solution and Notification Server ActiveX Control RunCmd Arbitrary Code Execution Attempt"; flow:established,to_client; content:"B44D252D-98FC-4D5C-948C-BE868392A004"; nocase; content:"RunCmd"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004/si"; reference:url,securitytracker.com/alerts/2009/Nov/1023238.html; reference:url,www.securityfocus.com/bid/37092; reference:cve,2009-3033; reference:url,doc.emergingthreats.net/2010369; classtype:attempted-user; sid:2010369; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net received whisper message"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|04 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002142; classtype:policy-violation; sid:2002142; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Symantec Antivirus 10.0 Client Proxy ActiveX Control Buffer Overflow Attempt"; flow:established,to_client; content:"E381F1C0-910E-11D1-AB1E-00A0C90F8F6F"; nocase; content:"SetRemoteComputerName"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E381F1C0-910E-11D1-AB1E-00A0C90F8F6F/si"; reference:url,www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20100217_02; reference:url,dsecrg.com/pages/vul/show.php?id=139; reference:cve,2010-0108; reference:url,doc.emergingthreats.net/2010958; classtype:attempted-user; sid:2010958; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net received server broadcast"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|06 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002143; classtype:policy-violation; sid:2002143; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible activePDF WebGrabber ActiveX Control Buffer Overflow Attempt"; flow:established,to_client; content:"02C2DD87-2E67-11D2-96EF-0000861852D5"; nocase; content:"GetStatus"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02C2DD87-2E67-11D2-96EF-0000861852D5/si"; reference:url,www.fortiguard.com/encyclopedia/vulnerability/activepdf.webgrabber.apwebgrb.ocx.activex.access.html; reference:url,packetstormsecurity.org/0911-exploits/activepdf_webgrabber.rb.txt; reference:url,doc.emergingthreats.net/2010691; classtype:attempted-user; sid:2010691; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net joined channel"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|07 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002144; classtype:policy-violation; sid:2002144; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Tumbleweed SecureTransport FileTransfer ActiveX BOF Exploit"; flow:to_client,established; content:"38681fbd-d4cc-4a59-a527-b3136db711d3"; nocase; content:"TransferFile"; nocase; pcre:"/[\w\W]{2500,}/i"; reference:bugtraq,28662; reference:url,www.milw0rm.com/exploits/5398; reference:url,doc.emergingthreats.net/2008128; classtype:web-application-attack; sid:2008128; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net user had a flags update"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|09 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002145; classtype:policy-violation; sid:2002145; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible HTTP ACTi SaveXMLFile()/DeleteXMLFile() nvUnifiedControl.dll Arbitrary File Overwrite/Deletion Attempt"; flow:established,from_server; content:"A0D43FB0-116B-47AB-80FB-6DCFA92A03E3"; nocase; content:"eXMLFile"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A0D43FB0-116B-47AB-80FB-6DCFA92A03E3/si"; reference:url,tools.cisco.com/security/center/viewIpsSignature.x?signatureId=18237&signatureSubId=1&softwareVersion=6.0&releaseVersion=S429; reference:url,www.symantec.com/business/security_response/attacksignatures/detail.jsp?asid=22546; reference:url,www.securityfocus.com/bid/25465; reference:url,doc.emergingthreats.net/2009894; classtype:attempted-user; sid:2009894; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net sent a whisper"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|0a 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002146; classtype:policy-violation; sid:2002146; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible HTTP ACTi SetText() nvUnifiedControl.dll Buffer Overflow Attempt"; flow:established,from_server; content:"A6F36F3F-3AE0-458B-AFC4-AA82565E0BF8"; nocase; content:"SetText"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s* \x7B?\s*A6F36F3F-3AE0-458B-AFC4-AA82565E0BF8/si"; reference:url,tools.cisco.com/security/center/viewIpsSignature.x?signatureId=18237&signatureSubId=1&softwareVersion=6.0&releaseVersion=S429; reference:url,www.symantec.com/business/security_response/attacksignatures/detail.jsp?asid=22546; reference:url,www.securityfocus.com/bid/25465; reference:url,doc.emergingthreats.net/2009893; classtype:attempted-user; sid:2009893; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net channel full"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|0d 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002147; classtype:policy-violation; sid:2002147; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Edraw PDF Viewer FtpConnect Component ActiveX Remote code execution Attempt"; flow:from_server,established; content:"44A8091F-8F01-43B7-8CF7-4BBA71E61E04"; nocase; content:"FtpConnect"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44A8091F-8F01-43B7-8CF7-4BBA71E61E04/si"; reference:url,www.milw0rm.org/exploits/8986; reference:url,doc.emergingthreats.net/2010161; classtype:attempted-user; sid:2010161; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net channel doesn't exist"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|0e 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002148; classtype:policy-violation; sid:2002148; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Windows Defender ActiveX DeleteValue/WriteValue method Heap Overflow Attempt"; flow:established,to_client; content:"07DD3249-A591-4949-8F20-09CD347C69DC"; nocase; content:"Value"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*07DD3249-A591-4949-8F20-09CD347C69DC.+(DeleteValue|WriteValue)/si"; reference:url,www.packetstormsecurity.org/1001-exploits/msdef1-overflow.txt; reference:url,doc.emergingthreats.net/2010834; classtype:attempted-user; sid:2010834; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net channel is restricted"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|0f 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002149; classtype:policy-violation; sid:2002149; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Windows Live Messenger ActiveX Control RichUploadControlContextData Buffer Overflow Attempt"; flow:established,to_client; content:"C2828995-4A83-4100-A212-3024BA117356"; nocase; content:"RichUploadControlContextData"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C2828995-4A83-4100-A212-3024BA117356/si"; reference:url,www.securityfocus.com/bid/37908/info; reference:url,doc.emergingthreats.net/2010702; classtype:attempted-user; sid:2010702; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net informational message"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|12 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002150; classtype:policy-violation; sid:2002150; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX VeryDOC PDF Viewer ActiveX Control OpenPDF Buffer Overflow"; flow:to_client,established; content:"433268D7-2CD4-43E6-AA24-2188672E7252"; nocase; content:"OpenPDF"; nocase; reference:bugtraq,32313; reference:url,milw0rm.com/exploits/7126; reference:url,doc.emergingthreats.net/2008869; classtype:web-application-attack; sid:2008869; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net error message"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|13 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002151; classtype:policy-violation; sid:2002151; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Visagesoft eXPert PDF EditorX ActiveX Control Arbitrary File Overwrite"; flow:to_client,established; content:"89F968A1-DBAC-4807-9B3C-405A55E4A279"; nocase; content:"extractPagesToFile"; nocase; distance:0; reference:bugtraq,32664; reference:url,milw0rm.com/exploits/7358; reference:url,doc.emergingthreats.net/2008895; classtype:web-application-attack; sid:2008895; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net 'emote' message"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|17 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002152; classtype:policy-violation; sid:2002152; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Viscom Software Movie Player Pro SDK ActiveX 6.8 Remote Buffer Overflow Attempt"; flow:established,to_client; content:"F4A32EAF-F30D-466D-BEC8-F4ED86CAF84E"; nocase; content:"DrawText"; nocase; content:!"|0A|"; within:25; isdataat:25,relative; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4A32EAF-F30D-466D-BEC8-F4ED86CAF84E/si"; reference:url,en.securitylab.ru/poc/extra/389924.php; reference:url,doc.emergingthreats.net/2010840; classtype:attempted-user; sid:2010840; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Battle.net outgoing chat message"; flow:established,to_server; content:"|FF 0E|"; depth:2; reference:url,doc.emergingthreats.net/bin/view/Main/2002119; classtype:policy-violation; sid:2002119; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible VMware Console ActiveX Format String Remote Code Execution Attempt"; flow:established,to_client; content:"B94C2238-346E-4C5E-9B36-8CC627F35574"; nocase; content:"connect"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B94C2238-346E-4C5E-9B36-8CC627F35574/si"; reference:url,dsecrg.com/pages/vul/show.php?id=153; reference:url,lists.vmware.com/pipermail/security-announce/2010/000090.html; reference:cve,2009-3732; reference:url,doc.emergingthreats.net/2011126; classtype:attempted-user; sid:2011126; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 3724 (msg:"ET GAMES World of Warcraft connection"; flow:established,to_server; content:"|00|"; depth:1; content:"|25 00|WoW|00|"; distance:1; within:7; reference:url,doc.emergingthreats.net/bin/view/Main/2002138; classtype:policy-violation; sid:2002138; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Web on Windows ActiveX Insecure Methods"; flow:to_client,established; content:"441E9D47-9F52-11D6-9672-0080C88B3613"; nocase; pcre:"/(WriteIniFileString|ShellExecute)/i"; reference:bugtraq,33515; reference:url,xforce.iss.net/xforce/xfdb/48337; reference:url,doc.emergingthreats.net/2009136; classtype:web-application-attack; sid:2009136; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 3724 -> $HOME_NET any (msg:"ET GAMES World of Warcraft failed logon"; flow:established,from_server; content:"|01 0A|"; depth:2; reference:url,doc.emergingthreats.net/bin/view/Main/2002139; classtype:policy-violation; sid:2002139; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX WinDVD7 IASystemInfo.DLL ActiveX ApplicationType method buffer overflow Attempt"; flow:established,to_client; content:"B727C217-2022-11D4-B2C6-0050DA1BD906"; nocase; content:"ApplicationType"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B727C217-2022-11D4-B2C6-0050DA1BD906/si"; reference:url,www.packetstormsecurity.nl/0911-exploits/windvd7_applicationtype.rb.txt; reference:url,secunia.com/advisories/24556/; reference:url,doc.emergingthreats.net/2010852; classtype:web-application-attack; sid:2010852; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Guild Wars connection"; flow:established,to_server; content:"|01 00 00 00 00 F1 00 10 00 01 00 00 00 00 00 00 00 00 00 00 00|"; reference:url,doc.emergingthreats.net/bin/view/Main/2002154; classtype:policy-violation; sid:2002154; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Universal HTTP File Upload Remote File Deletetion"; flow:to_client,established; content:"4FD48E6-0712-4937-B09E-F3D285B11D82"; nocase; content:"RemoveFileOrDir"; nocase; pcre:"/(txt|ini|com|exe|bat|dll|dat)/i"; reference:url,www.milw0rm.com/exploits/5272; reference:url,doc.emergingthreats.net/2008062; classtype:web-application-attack; sid:2008062; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net incoming chat message"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|05 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002170; classtype:policy-violation; sid:2002170; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Universal HTTP Image/File Upload ActiveX Remote File Deletion Exploit"; flow:to_client,established; content:"04FD48E6-0712-4937-B09E-F3D285B11D82"; nocase; content:"RemoveFileOrDir"; nocase; distance:0; reference:url,www.milw0rm.com/exploits/5569; reference:url,doc.emergingthreats.net/2008225; classtype:web-application-attack; sid:2008225; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $HOME_NET any -> $EXTERNAL_NET 27015 (msg:"ET GAMES Steam connection"; content:"getchallengesteam"; reference:url,doc.emergingthreats.net/bin/view/Main/2002155; classtype:policy-violation; sid:2002155; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Novell ZENWorks for Desktops Remote Heap-Based Buffer Overflow"; flow:to_client,established; content:"0F517994-A6FA-4F39-BD4B-EC2DF00AEEF1"; nocase; content:"CanUninstall"; nocase; reference:bugtraq,31435; reference:url,securitytracker.com/alerts/2008/Sep/1020951.html; reference:url,doc.emergingthreats.net/2008619; classtype:web-application-attack; sid:2008619; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 27020:27050 (msg:"ET GAMES STEAM Connection (v2)"; flow:established,to_server; content:"|00 00 00 03|"; dsize:4; reference:url,doc.emergingthreats.net/bin/view/Main/2003089; classtype:policy-violation; sid:2003089; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX IE ActiveX control Exec method Remote code execution Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"72C24DD5-D70A-438B-8A42-98424B88AFB8"; nocase; distance:0; content:"Exec"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*72C24DD5-D70A-438B-8A42-98424B88AFB8/si"; reference:url,www.packetstormsecurity.org/1001-exploits/wshomocx-activex.txt; reference:url,doc.emergingthreats.net/2010978; classtype:attempted-user; sid:2010978; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak3 Connect"; content:"|00 00 00 00 02 9d 74 8b 45 aa 7b ef b9 9e fe ad 08 19 ba cf 41 e0 16 a2|"; offset:8; depth:24; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011733; classtype:policy-violation; sid:2011733; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Internet Information Service iisext.dll activex setpassword Insecure Method"; flow:to_client,established; content:"CLSID"; nocase; content:"C3B32488-AFEC-11D1-9868-00A0C922E703"; distance:0; nocase; content:"SetPassword"; nocase; reference:cve,2008-4301; reference:url,www.securityfocus.com/archive/1/archive/1/496694/100/0/threaded; reference:url,doc.emergingthreats.net/2008620; classtype:web-application-attack; sid:2008620; rev:38; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Connection/Login"; content:"|f4 be 03 00|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011734; classtype:policy-violation; sid:2011734; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX 4XEM VatDecoder VatCtrl Class ActiveX Control Url Property Buffer Overflow Vulnerability"; flow:to_client,established; content:"210D0CBC-8B17-48D1-B294-1A338DD2EB3A"; nocase; content:"0x40000"; content:"Url"; nocase; reference:bugtraq,28010; reference:url,www.milw0rm.com/exploits/5193; reference:url,doc.emergingthreats.net/2007903; classtype:web-application-attack; sid:2007903; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Connection/Login Replay"; content:"|f4 be 04 00|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011735; classtype:policy-violation; sid:2011735; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Danim.dll and Dxtmsft.dll COM Objects"; flow:established,from_server; pcre:"/42B07B28-2280-4937-B035-0293FB812781|542FB453-5003-11CF-92A2-00AA00B8A733/i"; reference:cve,2006-1186; reference:url,www.microsoft.com/technet/security/bulletin/ms06-013.mspx; reference:url,doc.emergingthreats.net/2002861; classtype:web-application-attack; sid:2002861; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Connection/Ping"; content:"|f4 be 01 00|"; depth:4; threshold:type limit, count 1, seconds 300, track by_src; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011736; classtype:policy-violation; sid:2011736; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Morovia Barcode ActiveX Control Arbitrary File Overwrite"; flow:to_client,established; content:"18B409DA-241A-4BD8-AC69-B5D547D5B141"; nocase; pcre:"/(Save|ExportImage)/i"; reference:url,milw0rm.com/exploits/8208; reference:bugtraq,23934; reference:url,doc.emergingthreats.net/2009334; classtype:web-application-attack; sid:2009334; rev:30; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Connection/Ping Reply"; content:"|f4 be 02 00|"; depth:4; threshold:type limit, count 1, seconds 300, track by_src; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011737; classtype:policy-violation; sid:2011737; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX NCTAVIFile V 1.6.2 Activex File Creation clsid access attempt"; flow:established,to_client; content:"6B1E11AC-BF5C-4CF5-9DC9-F81F715EB790"; nocase; content:"OpenFile"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6B1E11AC-BF5C-4CF5-9DC9-F81F715EB790/si"; reference:url,www.packetstatic.com/0909-exploits/nctavi-exec.txt; reference:url,doc.emergingthreats.net/2010356; classtype:web-application-attack; sid:2010356; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Standard/Channel List"; content:"|f0 be 06 00|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011739; classtype:policy-violation; sid:2011739; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX iDefense COMRaider ActiveX Control Arbitrary File Deletion"; flow:to_client,established; content:"9A077D0D-B4A6-4EC0-B6CF-98526DF589E4"; nocase; pcre:"/(DeleteFile|write)/i"; reference:bugtraq,33867; reference:bugtraq,33942; reference:url,doc.emergingthreats.net/2009187; classtype:web-application-attack; sid:2009187; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Standard/Player List"; content:"|f0 be 07 00|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011740; classtype:policy-violation; sid:2011740; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX MW6 Technologies Barcode ActiveX Barcode.dll Multiple Arbitrary File Overwrite"; flow:to_client,established; content:"14D09688-CFA7-11D5-995A-005004CE563B"; nocase; pcre:"/(SaveAsBMP|SaveAsWMF)/i"; reference:bugtraq,31979; reference:url,milw0rm.com/exploits/6871; reference:url,doc.emergingthreats.net/2008809; classtype:web-application-attack; sid:2008809; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Standard/Login End"; content:"|f0 be 08 00|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011741; classtype:policy-violation; sid:2011741; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX MW6 PDF417 MW6PDF417.dll ActiveX Control Multiple Arbitrary File Overwrite"; flow:to_client,established; content:"90D2A875-5024-4CCD-80AA-C8A353DB2B45"; nocase; pcre:"/(SaveAsBMP|SaveAsWMF)/i"; reference:bugtraq,31983; reference:url,milw0rm.com/exploits/6873; reference:url,doc.emergingthreats.net/2008810; classtype:web-application-attack; sid:2008810; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Standard/New Player Joined"; content:"|f0 be 64 00|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011742; classtype:policy-violation; sid:2011742; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX MW6 DataMatrix DataMatrix.dll ActiveX Control Multiple Arbitrary File Overwrite"; flow:to_client,established; content:"DE7DA0B5-7D7B-4CEA-8739-65CF600D511E"; nocase; pcre:"/(SaveAsBMP|SaveAsWMF)/i"; reference:bugtraq,31980; reference:url,milw0rm.com/exploits/6872; reference:url,doc.emergingthreats.net/2008811; classtype:web-application-attack; sid:2008811; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Standard/Player Left"; content:"|f0 be 65 00|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011743; classtype:policy-violation; sid:2011743; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX MW6 Aztec ActiveX Aztec.dll ActiveX Control Multiple Arbitrary File Overwrite"; flow:to_client,established; content:"F359732D-D020-40ED-83FF-F381EFE36B54"; nocase; pcre:"/(SaveAsBMP|SaveAsWMF)/i"; reference:bugtraq,31974; reference:url,milw0rm.com/exploits/6870; reference:url,doc.emergingthreats.net/2008812; classtype:web-application-attack; sid:2008812; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Standard/Change Status"; content:"|f0 be 30 01|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011744; classtype:policy-violation; sid:2011744; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX AOL Radio AmpX ActiveX Control ConvertFile Method Buffer Overflow"; flow:to_client,established; content:"FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6"; nocase; content:"ConvertFile"; nocase; reference:url,milw0rm.com/exploits/8733; reference:bugtraq,35028; reference:url,doc.emergingthreats.net/2009469; classtype:web-application-attack; sid:2009469; rev:11; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Standard/Known Player Update"; content:"|f0 be 68 00|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011745; classtype:policy-violation; sid:2011745; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Akamai Download Manager Stack Buffer Overflow CLSID Access 1"; flow:to_client,established; content:"4871A87A-BFDD-4106-8153-FFDE2BAC2967"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4871A87A-BFDD-4106-8153-FFDE2BAC2967/si"; reference:url,labs.idefense.com/intelligence/vulnerabilities/display.php?id=813; reference:url,doc.emergingthreats.net/2009687; classtype:web-application-attack; sid:2009687; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Standard/Disconnect"; content:"|f0 be 2c 01|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011746; classtype:policy-violation; sid:2011746; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX MciWndx ActiveX Control"; flow:from_server,established; content:"288F1523-FAC4-11CE-B16F-00AA0060D93D"; nocase; reference:url,www.microsoft.com/technet/security/bulletin/ms05-054.mspx; reference:url,doc.emergingthreats.net/2002724; classtype:web-application-attack; sid:2002724; rev:11; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 ACK"; content:"|f1 be|"; depth:2; dsize:16; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011747; classtype:policy-violation; sid:2011747; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX ACTIVEX PPMate PPMedia Class ActiveX Control Buffer Overflow"; flow:to_client,established; content:"72B15B25-2EC8-4CDD-B284-C89A5F8E8D5F"; nocase; content:"StartURL"; nocase; reference:cve,2008-3242; reference:url,secunia.com/advisories/30952; reference:url,milw0rm.com/exploits/6090; reference:url,doc.emergingthreats.net/2009143; classtype:web-application-attack; sid:2009143; rev:37; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 1024:5000 -> $HOME_NET 1024:65535 (msg:"ET INFO SOCKSv5 IPv6 Inbound Connect Request (Windows Source)"; dsize:10<>23; flow:established,to_server; content:"|05 01 00 04|"; depth:4; threshold:type both, track by_src, count 1, seconds 900; reference:url,handlers.sans.org/wsalusky/rants/; reference:url,en.wikipedia.org/wiki/SOCKS; reference:url,ss5.sourceforge.net/socks4.protocol.txt; reference:url,ss5.sourceforge.net/socks4A.protocol.txt; reference:url,www.ietf.org/rfc/rfc1928.txt; reference:url,www.ietf.org/rfc/rfc1929.txt; reference:url,www.ietf.org/rfc/rfc1961.txt; reference:url,www.ietf.org/rfc/rfc3089.txt; reference:url,doc.emergingthreats.net/bin/view/Main/2003284; classtype:protocol-command-decode; sid:2003284; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2017_10_27;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Microsoft WMI Administration Tools WEBSingleView.ocx ActiveX Buffer Overflow Attempt Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"WBEM.SingleViewCtrl.1"; nocase; distance:0; pcre:"/WBEM\x2ESingleViewCtrl\x2E1.+(AddContextRef|ReleaseContext)/smi"; reference:url,xcon.xfocus.net/XCon2010_ChenXie_EN.pdf; reference:url,wooyun.org/bug.php?action=view&id=1006; classtype:attempted-user; sid:2012157; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_01_06, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 32768:61000 -> $HOME_NET 1024:65535 (msg:"ET INFO SOCKSv5 IPv6 Inbound Connect Request (Linux Source)"; dsize:10<>23; flow:established,to_server; content:"|05 01 00 04|"; depth:4; threshold:type both, track by_src, count 1, seconds 900; reference:url,handlers.sans.org/wsalusky/rants/; reference:url,en.wikipedia.org/wiki/SOCKS; reference:url,ss5.sourceforge.net/socks4.protocol.txt; reference:url,ss5.sourceforge.net/socks4A.protocol.txt; reference:url,www.ietf.org/rfc/rfc1928.txt; reference:url,www.ietf.org/rfc/rfc1929.txt; reference:url,www.ietf.org/rfc/rfc1961.txt; reference:url,www.ietf.org/rfc/rfc3089.txt; reference:url,doc.emergingthreats.net/bin/view/Main/2003285; classtype:protocol-command-decode; sid:2003285; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2017_10_27;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX NewV SmartClient NewvCommon.ocx DelFile Method Arbitrary File Deletion Attempt"; flow:established,to_client; content:"0B68B7EB-02FF-4A41-BC14-3C303BB853F9"; nocase; content:"DelFile"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B68B7EB-02FF-4A41-BC14-3C303BB853F9/si"; reference:url,packetstormsecurity.org/files/view/97394/newvcommon-insecure.txt; classtype:attempted-user; sid:2012192; rev:3; metadata:created_at 2011_01_15, updated_at 2011_01_15;) -#alert tcp $EXTERNAL_NET 1024:5000 -> $HOME_NET 1024:65535 (msg:"ET INFO SOCKSv4 Bind Inbound (Windows Source)"; dsize:9<>18; flow:established,to_server; content:"|04 02|"; depth:2; reference:url,handlers.sans.org/wsalusky/rants/; reference:url,en.wikipedia.org/wiki/SOCKS; reference:url,ss5.sourceforge.net/socks4.protocol.txt; reference:url,ss5.sourceforge.net/socks4A.protocol.txt; reference:url,www.ietf.org/rfc/rfc1928.txt; reference:url,www.ietf.org/rfc/rfc1929.txt; reference:url,www.ietf.org/rfc/rfc1961.txt; reference:url,www.ietf.org/rfc/rfc3089.txt; reference:url,doc.emergingthreats.net/bin/view/Main/2003288; classtype:protocol-command-decode; sid:2003288; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2017_10_27;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Real Networks RealPlayer SP RecordClip Method Remote Code Execution Attempt"; flow:established,to_client; content:"FDC7A535-4070-4B92-A0EA-D9994BCC0DC5"; nocase; content:"RecordClip"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FDC7A535-4070-4B92-A0EA-D9994BCC0DC5/si"; reference:bid,44443; reference:cve,2010-3749; classtype:attempted-user; sid:2012194; rev:3; metadata:created_at 2011_01_15, updated_at 2011_01_15;) -#alert tcp $EXTERNAL_NET 32768:61000 -> $HOME_NET 1024:65535 (msg:"ET INFO SOCKSv4 Bind Inbound (Linux Source)"; dsize:9<>18; flow:established,to_server; content:"|04 02|"; depth:2; reference:url,handlers.sans.org/wsalusky/rants/; reference:url,en.wikipedia.org/wiki/SOCKS; reference:url,ss5.sourceforge.net/socks4.protocol.txt; reference:url,ss5.sourceforge.net/socks4A.protocol.txt; reference:url,www.ietf.org/rfc/rfc1928.txt; reference:url,www.ietf.org/rfc/rfc1929.txt; reference:url,www.ietf.org/rfc/rfc1961.txt; reference:url,www.ietf.org/rfc/rfc3089.txt; reference:url,doc.emergingthreats.net/bin/view/Main/2003289; classtype:protocol-command-decode; sid:2003289; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2017_10_27;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object MS06-042 CLSID 21 Access Attempt"; flow:established,to_client; content:"930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6/si"; reference:cve,2006-3638; reference:url,www.microsoft.com/technet/security/Bulletin/MS06-042.mspx; reference:url,doc.emergingthreats.net/2010312; classtype:attempted-user; sid:2010312; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 32768:61000 -> $HOME_NET 1024:65535 (msg:"ET INFO SOCKSv5 Bind Inbound (Linux Source)"; dsize:10; flow:established,to_server; content:"|05 02 00 01|"; depth:4; reference:url,handlers.sans.org/wsalusky/rants/; reference:url,en.wikipedia.org/wiki/SOCKS; reference:url,ss5.sourceforge.net/socks4.protocol.txt; reference:url,ss5.sourceforge.net/socks4A.protocol.txt; reference:url,www.ietf.org/rfc/rfc1928.txt; reference:url,www.ietf.org/rfc/rfc1929.txt; reference:url,www.ietf.org/rfc/rfc1961.txt; reference:url,www.ietf.org/rfc/rfc3089.txt; reference:url,doc.emergingthreats.net/bin/view/Main/2003290; classtype:protocol-command-decode; sid:2003290; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2017_10_27;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Novell iPrint ActiveX GetDriverSettings Remote Code Execution Attempt"; flow:established,to_client; content:"36723F97-7AA0-11D4-8919-FF2D71D0D32C"; nocase; content:"GetDriverSettings2"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C/si"; reference:url,www.zerodayinitiative.com/advisories/ZDI-10-256/; reference:url,www.vupen.com/english/advisories/2010/3023; reference:bid,44966; reference:cve,2010-4321; classtype:attempted-user; sid:2012206; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_01_20, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 1024:5000 -> $HOME_NET 1024:65535 (msg:"ET INFO SOCKSv5 Bind Inbound (Windows Source)"; dsize:10; flow:established,to_server; content:"|05 02 00 01|"; depth:4; reference:url,handlers.sans.org/wsalusky/rants/; reference:url,en.wikipedia.org/wiki/SOCKS; reference:url,ss5.sourceforge.net/socks4.protocol.txt; reference:url,ss5.sourceforge.net/socks4A.protocol.txt; reference:url,www.ietf.org/rfc/rfc1928.txt; reference:url,www.ietf.org/rfc/rfc1929.txt; reference:url,www.ietf.org/rfc/rfc1961.txt; reference:url,www.ietf.org/rfc/rfc3089.txt; reference:url,doc.emergingthreats.net/bin/view/Main/2003291; classtype:protocol-command-decode; sid:2003291; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2017_10_27;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Oracle Document Capture Insecure Read Method File Access Attempt"; flow:established,to_client; content:"68AC0D5F-0424-11D5-822F-00C04F6BA8D9"; nocase; content:"ImportBodyText"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9/si"; reference:cve,2010-3595; classtype:attempted-user; sid:2012231; rev:2; metadata:created_at 2011_01_27, updated_at 2011_01_27;) -alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET P2P Ares Server Connection"; flow:established,to_server; dsize:<70; content:"r|be|bloop|00|dV"; content:"Ares|00 0a|"; distance:16; reference:url,aresgalaxy.sourceforge.net; reference:url,doc.emergingthreats.net/bin/view/Main/2008591; classtype:policy-violation; sid:2008591; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Oracle Document Capture File Deletion Attempt"; flow:established,to_client; content:"F647CBE5-3C01-402A-B3F0-502A77054A24"; nocase; content:"DownloadSingleMessageToFile"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F647CBE5-3C01-402A-B3F0-502A77054A24/si"; reference:cve,2010-3591; classtype:attempted-user; sid:2012232; rev:2; metadata:created_at 2011_01_27, updated_at 2011_01_27;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 6969 (msg:"ET P2P BitTorrent Announce"; flow: to_server,established; content:"/announce"; reference:url,bitconjurer.org/BitTorrent/protocol.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000369; classtype:policy-violation; sid:2000369; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Oracle Document Capture File Overwrite Attempt"; flow:established,to_client; content:"4932CEF4-2CAA-11D2-A165-0060081C43D9"; nocase; content:"SaveLayoutChanges"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4932CEF4-2CAA-11D2-A165-0060081C43D9/si"; reference:cve,2010-3591; classtype:attempted-user; sid:2012233; rev:3; metadata:created_at 2011_01_27, updated_at 2011_01_27;) -#alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P Edonkey IP Request"; dsize:4; content:"|e3 1b|"; depth:2; flowbits:set,BEedk.ip.requestect; flowbits:noalert; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003308; classtype:policy-violation; sid:2003308; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX RealPlayer CDDA URI Overflow Uninitialized Pointer Attempt"; flow:established,to_client; content:"CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA"; nocase; content:"cdda|3A|//"; nocase; distance:0; isdataat:100,relative; content:!"|0A|"; within:100; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA/si"; reference:bid,44450; reference:cve,2010-3747; classtype:attempted-user; sid:2012543; rev:3; metadata:created_at 2011_03_24, updated_at 2011_03_24;) -#alert udp $EXTERNAL_NET 1024:65535 -> $HOME_NET 1024:65535 (msg:"ET P2P Edonkey IP Reply"; flowbits:isset,BEedk.ip.requestect; dsize:<20; content:"|e3 1c|"; depth:2; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003309; classtype:policy-violation; sid:2003309; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX RealNetworks RealGames StubbyUtil.ProcessMgr.1 InstallerDlg.dll Remote Command Execution Attempt"; flow:established,to_client; content:"5818813E-D53D-47A5-ABBB-37E2A07056B5"; nocase; content:"Exec"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5.+(Exec|ExecLow|ShellExec)/smi"; reference:url,www.exploit-db.com/exploits/17105/; reference:bid,47133; classtype:attempted-user; sid:2012636; rev:3; metadata:created_at 2011_04_05, updated_at 2011_04_05;) -#alert udp $EXTERNAL_NET 1024:65535 -> $HOME_NET 1024:65535 (msg:"ET P2P Edonkey IP Query End"; dsize:<20; content:"|e3 1d|"; depth:2; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003316; classtype:policy-violation; sid:2003316; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX RealNetworks RealGames StubbyUtil.ProcessMgr.1 InstallerDlg.dll Remote Command Execution Attempt"; flow:established,to_client; content:"5818813E-D53D-47A5-ABBB-37E2A07056B5"; nocase; content:"CreateVistaTaskLow"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5/si"; reference:url,www.exploit-db.com/exploits/17105/; reference:bid,47133; classtype:attempted-user; sid:2012637; rev:4; metadata:created_at 2011_04_05, updated_at 2011_04_05;) -alert udp $EXTERNAL_NET 1024:65535 -> $HOME_NET 1024:65535 (msg:"ET P2P Edonkey Publicize File ACK"; dsize:<20; content:"|e3 0d|"; depth:2; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003311; classtype:policy-violation; sid:2003311; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX RealNetworks RealGames StubbyUtil.ShellCtl.1 InstallerDlg.dll Remote Command Execution Attempt"; flow:established,to_client; content:"80AB3FB6-9660-416C-BE8D-0E2E8AC3138B"; nocase; content:"ShellExec"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B/si"; reference:url,www.exploit-db.com/exploits/17105/; reference:bid,47133; classtype:attempted-user; sid:2012638; rev:4; metadata:created_at 2011_04_05, updated_at 2011_04_05;) -alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P Edonkey Connect Request"; dsize:25; content:"|e3 0a|"; depth:2; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003312; classtype:policy-violation; sid:2003312; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX RealNetworks RealGames StubbyUtil.ShellCtl.1 InstallerDlg.dll Remote Command Execution Attempt"; flow:established,to_client; content:"80AB3FB6-9660-416C-BE8D-0E2E8AC3138B"; nocase; content:"CreateShortcut"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B/si"; reference:url,www.exploit-db.com/exploits/17105/; reference:bid,47133; classtype:attempted-user; sid:2012639; rev:4; metadata:created_at 2011_04_05, updated_at 2011_04_05;) -#alert udp $EXTERNAL_NET 1024:65535 -> $HOME_NET 1024:65535 (msg:"ET DELETED Edonkey Connect Reply and Server List"; dsize:>200; content:"|e3 0b|"; depth:2; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003313; classtype:policy-violation; sid:2003313; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX RealNetworks RealGames StubbyUtil.ShellCtl.1 InstallerDlg.dll Remote Command Execution Attempt"; flow:established,to_client; content:"80AB3FB6-9660-416C-BE8D-0E2E8AC3138B"; nocase; content:"CopyDocument"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B/si"; reference:url,www.exploit-db.com/exploits/17105/; reference:bid,47133; classtype:attempted-user; sid:2012640; rev:4; metadata:created_at 2011_04_05, updated_at 2011_04_05;) -#alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P Edonkey Search Request (by file hash)"; dsize:19; content:"|e3 0e 14|"; depth:3; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003314; classtype:policy-violation; sid:2003314; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Sun Java Runtime New Plugin Docbase Buffer Overflow Attempt"; flow:established,to_client; content:"CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA"; nocase; content:"launchjnlp"; fast_pattern; nocase; distance:0; content:"docbase"; nocase; distance:0; content:"value=|22|"; nocase; distance:0; isdataat:257,relative; content:!"|0A|"; within:257; reference:bid,44023; reference:cve,2010-3552; classtype:attempted-user; sid:2012641; rev:3; metadata:created_at 2011_04_06, updated_at 2011_04_06;) -#alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET DELETED Edonkey Search Request (any type file)"; dsize:>19; content:"|e3 0e|"; depth:2; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003317; classtype:policy-violation; sid:2003317; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Gesytec ElonFmt ActiveX Component Format String Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"ELONFMTLib.ElonFmt"; nocase; distance:0; content:".GetItem1"; nocase; reference:url,exploit-db.com/exploits/17196; classtype:attempted-user; sid:2012742; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_04_29, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P Edonkey Get Sources Request (by hash)"; dsize:19; content:"|e3 9a|"; depth:2; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003318; classtype:policy-violation; sid:2003318; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft Internet Explorer Tabular DataURL ActiveX Control Memory Corruption Attempt"; flow:established,to_client; content:"333C7BC4-460F-11D0-BC04-0080C7055A83"; nocase; content:"DataURL"; nocase; distance:0; content:"value=|22|"; nocase; distance:0; isdataat:100,relative; content:!"|0A|"; within:100; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*333C7BC4-460F-11D0-BC04-0080C7055A83/si"; reference:url,securitytracker.com/alerts/2010/Mar/1023773.html; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=20202; reference:url,www.metasploit.com/redmine/projects/framework/repository/revisions/9018/entry/modules/exploits/windows/browser/ms10_018_ie_tabular_activex.rb; reference:url,www.microsoft.com/technet/security/bulletin/ms10-018.mspx; reference:url,www.vupen.com/english/advisories/2010/0744; reference:url,www.kb.cert.org/vuls/id/744549; reference:cve,2010-0805; reference:url,doc.emergingthreats.net/2011007; classtype:attempted-user; sid:2011007; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $EXTERNAL_NET 1024:65535 -> $HOME_NET 1024:65535 (msg:"ET DELETED Edonkey Search Results"; dsize:>21; content:"|e3 99|"; depth:2; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003320; classtype:policy-violation; sid:2003320; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Magneto ICMP ActiveX ICMPSendEchoRequest Remote Code Execution Attempt"; flow:established,to_client; content:"3A86F1F2-4921-4C75-AF2C-A1AA241E12BA"; nocase; content:"ICMPSendEchoRequest"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3A86F1F2-4921-4C75-AF2C-A1AA241E12BA/si"; reference:url,www.exploit-db.com/exploits/17328/; classtype:attempted-user; sid:2012905; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_05_31, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET 4660:4799 (msg:"ET P2P Edonkey Server Status"; flow:established; dsize:14; content:"|e3 09 00 00 00 34|"; depth:6; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003324; classtype:policy-violation; sid:2003324; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Cisco AnyConnect VPN Secure Mobility Client Arbitrary Program Execution Attempt"; flow:established,to_client; content:"55963676-2F5E-4BAF-AC28-CF26AA587566"; nocase; content:"url"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*55963676-2F5E-4BAF-AC28-CF26AA587566/si"; reference:url,labs.idefense.com/intelligence/vulnerabilities/display.php?id=909; reference:bid,48081; reference:cve,2011-2039; reference:cve,2011-2040; classtype:attempted-user; sid:2012929; rev:2; metadata:created_at 2011_06_03, updated_at 2011_06_03;) -alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P GnucDNA UDP Ultrapeer Traffic"; content:"SCP@|83|DNA@"; threshold: type both,track by_src,count 10,seconds 600; reference:url,doc.emergingthreats.net/bin/view/Main/2002760; classtype:policy-violation; sid:2002760; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Cisco AnyConnect VPN Secure Mobility Client Cisco.AnyConnect.VPNWeb.1 Arbitrary Program Execution Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"Cisco.AnyConnect.VPNWeb.1"; nocase; distance:0; content:"url"; nocase; distance:0; reference:url,labs.idefense.com/intelligence/vulnerabilities/display.php?id=909; reference:bid,48081; reference:cve,2011-2039; reference:cve,2011-2040; classtype:attempted-user; sid:2012930; rev:3; metadata:created_at 2011_06_03, updated_at 2011_06_03;) -alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P Kazaa over UDP"; content:"KaZaA"; nocase; threshold: type threshold, track by_src,count 10, seconds 60; reference:url,www.kazaa.com/us/index.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2001796; classtype:policy-violation; sid:2001796; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Black Ice Fax Voice SDK GetFirstItem Method Remote Code Execution Exploit"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000/si"; reference:url,exploit-db.com/exploits/17416; classtype:attempted-user; sid:2013132; rev:2; metadata:created_at 2011_06_29, updated_at 2011_06_29;) -alert udp $EXTERNAL_NET 41170 -> $HOME_NET any (msg:"ET P2P Manolito Connection (1)"; dsize:<48; content:"|3d 4a d9|"; depth:3; reference:url,doc.emergingthreats.net/2009097; classtype:policy-violation; sid:2009097; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Black Ice Fax Voice SDK GetItemQueue Method Remote Code Execution Exploit"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000/si"; reference:url,exploit-db.com/exploits/17416; classtype:attempted-user; sid:2013131; rev:2; metadata:created_at 2011_06_29, updated_at 2011_06_29;) -alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 41170 (msg:"ET P2P Manolito Ping"; dsize:<24; content:"|3d|"; depth:1; content:"|d9|"; distance:1; content:"|ed bb|"; distance:13; threshold: type limit, track by_src, seconds 300, count 1; reference:url,doc.emergingthreats.net/2009098; classtype:policy-violation; sid:2009098; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Black Ice Cover Page SDK DownloadImageFileURL Method Exploit"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*79956462-F148-497F-B247-DF35A095F80B/si"; reference:url,exploit-db.com/exploits/17415/; reference:cve,2008-2683; classtype:attempted-user; sid:2013130; rev:2; metadata:created_at 2011_06_29, updated_at 2011_06_29;) -alert udp $HOME_NET 8247 -> $EXTERNAL_NET 8247 (msg:"ET P2P Octoshape UDP Session"; threshold: type both, count 2, seconds 60, track by_src; reference:url,msmvps.com/blogs/bradley/archive/2009/01/20/peer-to-peer-on-cnn.aspx; reference:url,doc.emergingthreats.net/2009986; classtype:trojan-activity; sid:2009986; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX LEADTOOLS Imaging LEADSmtp ActiveX SaveMessage Method Vulnerability"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F/si"; reference:bugtraq,48408; classtype:attempted-user; sid:2013163; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_07_01, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp any any -> any any (msg:"ET P2P Phatbot Control Connection"; flow: established; content:"Wonk-"; content:"|00|#waste|00|"; within: 15; reference:url,www.lurhq.com/phatbot.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000015; classtype:trojan-activity; sid:2000015; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Ubisoft CoGSManager ActiveX RunCore method Buffer Overflow Vulnerability"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289/si"; reference:url,secunia.com/advisories/45044; classtype:attempted-user; sid:2013162; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_07_01, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET 2234 -> $HOME_NET any (msg:"ET P2P Soulseek Filesearch Results"; flow: from_server,established; content:"|09 00 00 00 78|"; reference:url,www.slsknet.org; reference:url,doc.emergingthreats.net/bin/view/Main/2001187; classtype:policy-violation; sid:2001187; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Ubisoft CoGSManager ActiveX Initialize method Buffer Overflow Vulnerability"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289/si"; reference:url,secunia.com/advisories/45044; classtype:attempted-user; sid:2013161; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_07_01, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp [174.129.0.0/16,67.202.0.0/18,79.125.0.0/17,184.72.0.0/15,75.101.128.0/17,174.129.0.0/16,204.236.128.0/17] !53 -> $HOME_NET !53 (msg:"ET POLICY Incoming UDP Packet From Amazon EC2 Cloud"; reference:url,doc.emergingthreats.net/2010816; classtype:command-and-control; sid:2010816; rev:6; metadata:created_at 2010_07_30, former_category POLICY, updated_at 2020_08_20;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX CygniCon CyViewer ActiveX Control SaveData Insecure Method Vulnerability"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A6FC2988-16BE-4053-BE89-F562431FD6ED/si"; reference:bugtraq,48483; classtype:attempted-user; sid:2013160; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_07_01, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY REG files version 5 download"; flow: established; content:"Windows Registry Editor Version 5.00"; content:"|0D 0A|"; content:"["; content:"HKEY_"; nocase; reference:url,www.ss64.com/nt/regedit.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000421; classtype:misc-activity; sid:2000421; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Chilkat Crypt ActiveX Control SaveDecrypted Insecure Method Vulnerability"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B70AB61-5C95-4126-9985-A32531CA8619/si"; reference:bugtraq,48585; classtype:attempted-user; sid:2013233; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_07_08, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY REG files version 5 Unicode download"; flow: established; content:"W|00|i|00|n|00|d|00|o|00|w|00|s|00| |00|R|00|e|00|g|00|i|00|s|00|t|00|r|00|y|00| |00|E|00|d|00|i|00|t|00|o|00|r|00| |00|V|00|e|00|r|00|s|00|i|00|o|00|n|00| |00|5|00|.|00|0|00|0|00|"; content:"|0D 0A|"; content:"[|00|"; content:"H|00|K|00|E|00|Y|00|_|00|"; nocase; reference:url,www.ss64.com/nt/regedit.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000422; classtype:misc-activity; sid:2000422; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX IDrive Online Backup ActiveX control SaveToFile Insecure Method"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*979AE8AA-C206-40EC-ACA7-EC6B6BD7BE5E/si"; reference:url,htbridge.ch/advisory/idrive_online_backup_activex_control_insecure_method.html; classtype:attempted-user; sid:2013232; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_07_08, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED NE EXE OS2 file download"; flow: established; content:"MZ"; isdataat: 76,relative; content:"This program cannot be run in a DOS session."; isdataat: 6,relative; content:"NE"; distance: 0; reference:url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2000423; classtype:misc-activity; sid:2000423; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 5"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FCB4B50A-E3F1-4174-BD18-54C3B3287258/si"; reference:url,packetstormsecurity.org/files/view/103964/teechart_pro.rb.txt; classtype:attempted-user; sid:2013432; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_08_19, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED LX EXE OS2 file download"; flow: established; content:"MZ"; isdataat: 76,relative; content:"This program cannot be run in a DOS session."; isdataat: 6,relative; content:"LX"; distance: 0; reference:url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2000424; classtype:misc-activity; sid:2000424; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 4"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BDEB0088-66F9-4A55-ABD2-0BF8DEEC1196/si"; reference:url,packetstormsecurity.org/files/view/103964/teechart_pro.rb.txt; classtype:attempted-user; sid:2013431; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_08_19, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED NE EXE Windows 3.x file download"; flow: established; content:"MZ"; isdataat: 76,relative; content:"This program requires Microsoft Windows."; isdataat: 10,relative; content:"NE"; distance: 0; reference:url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2000425; classtype:misc-activity; sid:2000425; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 3"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FAB9B41C-87D6-474D-AB7E-F07D78F2422E/si"; reference:url,packetstormsecurity.org/files/view/103964/teechart_pro.rb.txt; classtype:attempted-user; sid:2013430; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_08_19, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY EXE compressed PKWARE Windows file download"; flow: established; content:"MZ"; isdataat: 28,relative; content:"PKLITE"; distance: 0; reference:url,www.program-transformation.org/Transform/PcExeFormat; reference:url,doc.emergingthreats.net/bin/view/Main/2000426; classtype:misc-activity; sid:2000426; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 2"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*536600D3-70FE-4C50-92FB-640F6BFC49AD/si"; reference:url,packetstormsecurity.org/files/view/103964/teechart_pro.rb.txt; classtype:attempted-user; sid:2013429; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_08_19, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY ZIP file download"; flow: established; content:"PK|0304|"; byte_test:1, <=, 0x14, 0, string, hex; content:"|00 00 00|"; distance: 0; reference:url,zziplib.sourceforge.net/zzip-parse.print.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000428; classtype:misc-activity; sid:2000428; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 1"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6C10489-FB89-11D4-93C9-006008A7EED4/si"; reference:url,packetstormsecurity.org/files/view/103964/teechart_pro.rb.txt; classtype:attempted-user; sid:2013428; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_08_19, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY Download Windows Help File CHM"; flow: established; content:"ITSF|03|"; isdataat: 19,relative; content:"|7C 01 FD 10 7B AA 11 D0 9E 0C 00 A0 C9 22 E6 EC 7C 01 FD 11 7B AA 11 D0 9E 0C 00 A0 C9 22 E6 EC|"; distance: 0; reference:url,www.speakeasy.org/~russotto/chm/chmformat.html; reference:url,www.securiteam.com/windowsntfocus/6V00N000AU.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000489; classtype:misc-activity; sid:2000489; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Tom Sawyer Software Possible Memory Corruption Attempt"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*658ED6E7-0DA1-4ADD-B2FB-095F08091118/si"; classtype:web-application-attack; sid:2013565; rev:2; metadata:created_at 2011_09_12, updated_at 2011_09_12;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY Download Windows Help File CHM 2"; flow: established; content:"ITSF|03|"; isdataat: 19,relative; content:"|10 FD 01 7C AA 7B D0 11 9E 0C 00 A0 C9 22 E6 EC 11 FD 01 7C AA 7B D0 11 9E 0C 00 A0 C9 22 E6 EC|"; distance: 0; reference:url,www.speakeasy.org/~russotto/chm/chmformat.html; reference:url,www.securiteam.com/windowsntfocus/6V00N000AU.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000429; classtype:misc-activity; sid:2000429; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Tom Sawyer Possible Memory Corruption Attempt Format String Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"TomSawyer.DefaultExtFactory.5.5.3.238.VS7.1"; nocase; distance:0; classtype:attempted-user; sid:2013566; rev:2; metadata:created_at 2011_09_12, updated_at 2011_09_12;) -#alert ip [10.0.0.0/8,169.254.0.0/16,172.16.0.0/12,192.168.0.0/16] any -> $HOME_NET any (msg:"ET POLICY Reserved Internal IP Traffic"; threshold: type limit, track by_src, count 1, seconds 360; reference:url,www.cymru.com/Documents/bogon-list.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002752; classtype:bad-unknown; sid:2002752; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX DivX Plus Web Player DivXPlaybackModule File URL Buffer Overflow Attempt"; flow:established,to_client; content:"67DABFBF-D0AB-41fa-9C46-CC0F21721616"; nocase; content:"file|3A 2F 2F|"; nocase; distance:0; isdataat:200,relative; content:!"|0A|"; within:200; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*67DABFBF-D0AB-41fa-9C46-CC0F21721616/smi"; reference:url,www.dl.packetstormsecurity.net/1109-advisories/sa45550.txt; classtype:attempted-user; sid:2013750; rev:3; metadata:created_at 2011_10_11, updated_at 2011_10_11;) -#alert tcp $HOME_NET any -> 38.97.75.0/24 443 (msg:"ET POLICY Carbonite Online Backup SSL Handshake"; flow:established,to_server; content:"CarboniteInc"; offset:56; reference:url,doc.emergingthreats.net/2009798; classtype:policy-violation; sid:2009798; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Oracle AutoVue Activex Insecure method (ExportEdaBom) Format String Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"AUTOVUEX.AutoVueXCtrl.1"; nocase; distance:0; content:".ExportEdaBom"; content:"|2E 2E 2F|"; reference:url,packetstormsecurity.org/files/106065/9sg_autovueiii.tgz; classtype:attempted-user; sid:2013814; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_10_31, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET 23 -> any any (msg:"ET POLICY Cisco Device in Config Mode"; flow: established; content:"Enter configuration commands, one per line"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2001239; classtype:not-suspicious; sid:2001239; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Oracle AutoVue Activex Insecure method (ExportEdaBom)"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F/si"; reference:url,packetstormsecurity.org/files/106065/9sg_autovueiii.tgz; classtype:attempted-user; sid:2013813; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_10_31, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET 23 -> any any (msg:"ET POLICY Cisco Device New Config Built"; flow: established; content:"Building configuration..."; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2001240; classtype:not-suspicious; sid:2001240; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Oracle AutoVue Activex Insecure method (Export3DBom) Format String Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"AUTOVUEX.AutoVueXCtrl.1"; nocase; distance:0; content:".Export3DBom"; content:"|2E 2E 2F|"; reference:url,packetstormsecurity.org/files/106064/9sg_autovueii.tgz; classtype:attempted-user; sid:2013812; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_10_31, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret REL TO"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX Oracle AutoVue Activex Insecure method (Export3DBom)"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F/si"; reference:url,packetstormsecurity.org/files/106064/9sg_autovueii.tgz; classtype:attempted-user; sid:2013811; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_10_31, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Confidential COMINT"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002426; classtype:policy-violation; sid:2002426; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Oracle AutoVue Activex Insecure method (SaveViewStateToFile) Format String Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"AUTOVUEX.AutoVueXCtrl.1"; nocase; distance:0; content:".SaveViewStateToFile"; nocase; content:"|2E 2E 2F|"; reference:url,exploit-db.com/exploits/18016; classtype:attempted-user; sid:2013810; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_10_31, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Top Secret COMINT"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002427; classtype:policy-violation; sid:2002427; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Oracle AutoVue Activex Insecure method (SaveViewStateToFile)"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F/si"; reference:url,exploit-db.com/exploits/18016; classtype:attempted-user; sid:2013809; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_10_31, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret COMINT"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"GPL ACTIVEX winhelp clsid attempt"; flow:from_server,established; content:"adb880a6-d8ff-11cf-9377-00aa003b7a11"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*adb880a6-d8ff-11cf-9377-00aa003b7a11/si"; reference:bugtraq,4857; reference:cve,2002-0823; reference:url,www.ngssoftware.com/advisories/ms-winhlp.txt; classtype:attempted-user; sid:2103148; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret COMSEC"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX ASUS Net4Switch ActiveX CxDbgPrint Format String Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"ipswcom.IPSWComItf"; nocase; distance:0; content:"CxDbgPrint"; nocase; reference:url,packetstormsecurity.org/files/110296/ASUS-Net4Switch-ipswcom.dll-ActiveX-Stack-Buffer-Overflow.html; classtype:attempted-user; sid:2014326; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_03_06, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret IMCON"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX EdrawSoft Office Viewer Component ActiveX FtpUploadFile Stack Buffer Overflow"; flow:to_client,established; content:" $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret CNWDI"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX EdrawSoft Office Viewer Component ActiveX FtpUploadFile Format String Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"OfficeViewer.OfficeViewer"; nocase; distance:0; content:"FtpUploadFile"; nocase; reference:url,packetstormsecurity.org/files/109298/EdrawSoft-Office-Viewer-Component-ActiveX-5.6-Buffer-Overflow.html; classtype:attempted-user; sid:2014391; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_03_17, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret TK"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera PlayerPT ActiveX Control PlayerPT.ocx Access 2"; flow:from_server,established; content:" $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret NOFORN"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX Cisco Linksys WVC200 Wireless-G PTZ Internet Video Camera PlayerPT ActiveX Control PlayerPT.ocx Access 1"; flow:from_server,established; content:" $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret ORCON"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX 2X Client for RDP ClientSystem Class ActiveX Control InstallClient Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"TuxClientSystem.ClientSystem.1"; nocase; distance:0; content:"InstallClient"; nocase; reference:url,www.exploit-db.com/exploits/18624/; classtype:attempted-user; sid:2014423; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_03_26, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret PROPIN"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX 2X ApplicationServer TuxSystem Class ActiveX Control ExportSettings Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"TuxScripting.TuxSystem.1"; nocase; distance:0; content:"ExportSettings"; nocase; reference:url,www.exploit-db.com/exploits/18625/; classtype:attempted-user; sid:2014421; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_03_26, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret RD"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX 2X ApplicationServer TuxSystem Class ActiveX Control ExportSettings Remote File Overwrite Attempt"; flow:to_client,established; content:"CLSID"; nocase; content:"5BD64392-DA66-4852-9715-CFBA98D25296"; nocase; distance:0; content:"ExportSettings"; nocase; reference:url,www.exploit-db.com/exploits/18625/; classtype:attempted-user; sid:2014420; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_03_26, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret SPECAT"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX 2X ApplicationServer TuxSystem Class ActiveX Control ImportSettings Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"TuxScripting.TuxSystem.1"; nocase; distance:0; content:"ImportSettings"; nocase; reference:url,www.exploit-db.com/exploits/18625/; classtype:attempted-user; sid:2014419; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_03_26, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Secret REL TO"; flow:to_server,established; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX 2X ApplicationServer TuxSystem Class ActiveX Control ImportSettings Remote File Overwrite Attempt"; flow:to_client,established; content:"CLSID"; nocase; content:"5BD64392-DA66-4852-9715-CFBA98D25296"; nocase; distance:0; content:"ImportSettings"; nocase; reference:url,www.exploit-db.com/exploits/18625/; classtype:attempted-user; sid:2014418; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_03_26, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Confidential COMINT"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002511; classtype:policy-violation; sid:2002511; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Quest InTrust Annotation Objects ActiveX Control Add Access Potential Remote Code Execution 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"AnnotationX.AnnList.1"; nocase; distance:0; content:".Add("; nocase; distance:0; reference:url,www.exploit-db.com/exploits/18674/; classtype:attempted-user; sid:2014454; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_01, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Top Secret COMINT"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002512; classtype:policy-violation; sid:2002512; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX TRENDnet TV-IP121WN UltraMJCam ActiveX Control OpenFileDlg Access Potential Remote Stack Buffer Overflow"; flow:to_client,established; content:"CLSID"; nocase; content:"707ABFC2-1D27-4a10-A6E4-6BE6BDF9FB11"; nocase; distance:0; content:".OpenFileDlg"; nocase; distance:0; reference:url,www.exploit-db.com/exploits/18675/; classtype:attempted-user; sid:2014455; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_01, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Secret COMINT"; flow:to_server,established; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX TRENDnet TV-IP121WN UltraMJCam ActiveX Control OpenFileDlg Access Potential Remote Stack Buffer Overflow 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"UltraMJCam.UltraMJCam.1"; nocase; distance:0; content:".OpenFileDlg"; nocase; distance:0; reference:url,www.exploit-db.com/exploits/18675/; classtype:attempted-user; sid:2014456; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_01, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Secret COMSEC"; flow:to_server,established; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX Possible UserManager SelectServer method Buffer Overflow Attempt"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E5D2CE27-5FA0-11D2-A666-204C4F4F5020/si"; reference:url,exploit-db.com/exploits/16002/; classtype:web-application-attack; sid:2012218; rev:3; metadata:created_at 2011_01_21, updated_at 2011_01_21;) -#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Confidential COMINT"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002591; classtype:policy-violation; sid:2002591; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft PicturePusher ActiveX Cross Site File Upload Attack"; flow:from_server,established; content:"507813C3-0B26-47AD-A8C0-D483C7A21FA7"; nocase; pcre:"/http\://.*?[\w]{4,}=1/i"; pcre:"/(PostURL|AddSeperator|AddString|Post)/i"; reference:url,milw0rm.com/exploits/6699; reference:url,doc.emergingthreats.net/2008673; classtype:web-application-attack; sid:2008673; rev:11; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Top Secret COMINT"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002592; classtype:policy-violation; sid:2002592; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible IBM Tivoli Provisioning Manager Express Isig.isigCtl.1 ActiveX RunAndUploadFile Method Overflow"; flow:to_client,established; content:"CLSID"; nocase; content:"84B74E82-3475-420E-9949-773B4FB91771"; nocase; distance:0; content:"RunAndUploadFile"; nocase; distance:0; reference:url,packetstormsecurity.org/files/111680/IBM-Tivoli-Provisioning-Manager-Express-Overflow.html; classtype:attempted-user; sid:2014550; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_13, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Secret COMINT"; flow:to_server,established; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX Possible IBM Tivoli Provisioning Manager Express Isig.isigCtl.1 ActiveX RunAndUploadFile Method Overflow 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"Isig.isigCtl.1"; nocase; distance:0; content:"RunAndUploadFile"; nocase; distance:0; reference:url,packetstormsecurity.org/files/111680/IBM-Tivoli-Provisioning-Manager-Express-Overflow.html; classtype:attempted-user; sid:2014551; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_13, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Secret TK"; flow:to_server,established; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX Possible Dell IT Assistant detectIESettingsForITA.ocx ActiveX Control readRegVal Remote Registry Dump Vulnerability"; flow:to_client,established; content:"CLSID"; nocase; content:"6286EF1A-B56E-48EF-90C3-743410657F3C"; nocase; distance:0; content:"readRegVal"; nocase; distance:0; reference:url,exploit-db.com/exploits/17557/; classtype:attempted-user; sid:2014552; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_13, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Secret NOFORN"; flow:to_server,established; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX Possible Dell IT Assistant detectIESettingsForITA.ocx ActiveX Control readRegVal Remote Registry Dump Vulnerability 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"DETECTIESETTINGS.detectIESettingsCtrl.1"; nocase; distance:0; content:"readRegVal"; nocase; distance:0; reference:url,exploit-db.com/exploits/17557/; classtype:attempted-user; sid:2014553; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_13, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Secret ORCON"; flow:to_server,established; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX Possible Edraw Diagram Component 5 ActiveX LicenseName Access Potential buffer overflow DOS"; flow:to_client,established; content:"CLSID"; nocase; content:"6116A7EC-B914-4CCE-B186-66E0EE7067CF"; nocase; distance:0; content:"LicenseName"; nocase; distance:0; reference:url,exploit-db.com/exploits/18461/; classtype:attempted-user; sid:2014585; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_16, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Secret SPECAT"; flow:to_server,established; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX Possible Edraw Diagram Component 5 ActiveX LicenseName Access Potential buffer overflow DOS 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"EDBoardLib.EDBoard"; nocase; distance:0; content:"LicenseName"; nocase; distance:0; reference:url,exploit-db.com/exploits/18461/; classtype:attempted-user; sid:2014586; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_16, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Secret"; flow:to_server,established; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX Possible Quest vWorkspace Broker Client ActiveX Control SaveMiniLaunchFile Remote File Creation/Overwrite"; flow:to_client,established; content:"CLSID"; nocase; content:"D9397163-A2DB-4A4A-B2C9-34E876AF2DFC"; nocase; distance:0; content:"SaveMiniLaunchFile("; nocase; distance:0; reference:url,exploit-db.com/exploits/18704/; classtype:attempted-user; sid:2014587; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_16, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 20000 (msg:"ET POLICY Club World Casino Client in Use"; flow:established,to_server; dsize:23; content:"Club World Casinos"; reference:url,doc.emergingthreats.net/2007754; classtype:policy-violation; sid:2007754; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Quest vWorkspace Broker Client ActiveX Control SaveMiniLaunchFile Remote File Creation/Overwrite 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"PNLLM.Client.1"; nocase; distance:0; content:"SaveMiniLaunchFile("; nocase; distance:0; reference:url,exploit-db.com/exploits/18704/; classtype:attempted-user; sid:2014588; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_16, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert ip any any -> any any (msg:"ET POLICY Credit Card Number Detected in Clear (16 digit spaced)"; pcre:"/ (6011|5[1-5]\d{2}|4\d{3}|3\d{3}) \d{4} \d{4} \d{4}/"; reference:url,www.beachnet.com/~hstiles/cardtype.html; reference:url,doc.emergingthreats.net/2001375; classtype:policy-violation; sid:2001375; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Oracle Hyperion Financial Management TList6 ActiveX Control Remote Code Execution"; flow:to_client,established; content:"CLSID"; nocase; content:"65996200-3B87-11D4-A21F-00E029189826"; nocase; distance:0; content:".SaveData("; nocase; distance:0; reference:url,securityfocus.com/archive/1/520353; classtype:attempted-user; sid:2014593; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_16, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert ip any any -> any any (msg:"ET POLICY Credit Card Number Detected in Clear (16 digit dashed)"; pcre:"/ (6011|5[1-5]\d{2}|4\d{3}|3\d{3})-\d{4}-\d{4}-\d{4}/"; reference:url,www.beachnet.com/~hstiles/cardtype.html; reference:url,doc.emergingthreats.net/2001376; classtype:policy-violation; sid:2001376; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Oracle Hyperion Financial Management TList6 ActiveX Control Remote Code Execution 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"TList.TList.6"; fast_pattern; nocase; distance:0; content:".SaveData("; nocase; distance:0; reference:url,securityfocus.com/archive/1/520353; classtype:attempted-user; sid:2014594; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_16, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert ip any any -> any any (msg:"ET POLICY Credit Card Number Detected in Clear (16 digit)"; pcre:"/ (6011|5[1-5]\d{2}|4\d{3}|3\d{3})\d{12} /"; reference:url,www.beachnet.com/~hstiles/cardtype.html; reference:url,doc.emergingthreats.net/2001377; classtype:policy-violation; sid:2001377; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible McAfee SaaS MyCioScan ShowReport Method Call Remote Command Execution"; flow:to_client,established; content:"CLSID"; nocase; content:"209EBDEE-065C-11D4-A6B8-00C04F0D38B7"; nocase; distance:0; content:"ShowReport"; nocase; distance:0; reference:url,packetstormsecurity.org/files/108767/McAfee-SaaS-MyCioScan-ShowReport-Remote-Command-Execution.html; classtype:attempted-user; sid:2014619; rev:2; metadata:created_at 2012_04_20, updated_at 2012_04_20;) -#alert ip any any -> any any (msg:"ET POLICY Credit Card Number Detected in Clear (15 digit)"; pcre:"/ (3[4|7]\d{2}|2014|2149|2131|1800)\d{11} /"; reference:url,www.beachnet.com/~hstiles/cardtype.html; reference:url,doc.emergingthreats.net/2001378; classtype:policy-violation; sid:2001378; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible McAfee SaaS MyCioScan ShowReport Method Call Remote Command Execution 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"MYCIOSCNLib.Scan"; nocase; distance:0; content:"ShowReport"; nocase; distance:0; reference:url,packetstormsecurity.org/files/108767/McAfee-SaaS-MyCioScan-ShowReport-Remote-Command-Execution.html; classtype:attempted-user; sid:2014620; rev:2; metadata:created_at 2012_04_20, updated_at 2012_04_20;) -#alert ip any any -> any any (msg:"ET POLICY Credit Card Number Detected in Clear (15 digit spaced)"; pcre:"/ (3[4|7]\d{2}|2014|2149|2131|1800) \d{4} \d{4} \d{3} /"; reference:url,www.beachnet.com/~hstiles/cardtype.html; reference:url,doc.emergingthreats.net/2001379; classtype:policy-violation; sid:2001379; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Tracker Software pdfSaver ActiveX InitFromRegistry Method Access Potential Buffer Overflow 2"; flow:to_client,established; file_data; content:"ActiveXObject"; nocase; content:"pdfxctrlLib.PdfPrinterPreferences"; nocase; distance:0; content:"InitFromRegistry"; nocase; distance:0; reference:url,exploit-db.com/exploits/18427/; classtype:attempted-user; sid:2014651; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_28, deployment Perimeter, former_category ACTIVEX, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert ip any any -> any any (msg:"ET POLICY Credit Card Number Detected in Clear (15 digit dashed)"; pcre:"/ (3[4|7]\d{2}|2014|2149|2131|1800)-\d{4}-\d{4}-\d{3} /"; reference:url,www.beachnet.com/~hstiles/cardtype.html; reference:url,doc.emergingthreats.net/2001380; classtype:policy-violation; sid:2001380; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Tracker Software pdfSaver ActiveX InitFromRegistry Method Access Potential Buffer Overflow"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"2EE01CFA-139F-431E-BB1D-5E56B4DCEC18"; nocase; distance:0; content:"InitFromRegistry"; nocase; distance:0; reference:url,exploit-db.com/exploits/18427/; classtype:attempted-user; sid:2014650; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_28, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert ip any any -> any any (msg:"ET POLICY Credit Card Number Detected in Clear (14 digit)"; pcre:"/ (30[0-5]\d|36\d{2}|38\d{2})\d{10} /"; reference:url,www.beachnet.com/~hstiles/cardtype.html; reference:url,doc.emergingthreats.net/2001381; classtype:policy-violation; sid:2001381; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Tracker Software pdfSaver ActiveX StoreInRegistry Method Access Potential Buffer Overflow"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"2EE01CFA-139F-431E-BB1D-5E56B4DCEC18"; nocase; distance:0; content:"StoreInRegistry"; nocase; distance:0; reference:url,exploit-db.com/exploits/18427/; classtype:attempted-user; sid:2014648; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_28, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert ip any any -> any any (msg:"ET POLICY Credit Card Number Detected in Clear (14 digit spaced)"; pcre:"/ (30[0-5]\d|36\d{2}|38\d{2}) \d{4} \d{4} \d{2} /"; reference:url,www.beachnet.com/~hstiles/cardtype.html; reference:url,doc.emergingthreats.net/2001382; classtype:policy-violation; sid:2001382; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Tracker Software pdfSaver ActiveX StoreInRegistry Method Access Potential Buffer Overflow 2"; flow:to_client,established; file_data; content:"ActiveXObject"; nocase; content:"pdfxctrlLib.PdfPrinterPreferences"; nocase; distance:0; content:"StoreInRegistry"; nocase; distance:0; reference:url,exploit-db.com/exploits/18427/; classtype:attempted-user; sid:2014649; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_28, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert ip any any -> any any (msg:"ET POLICY Credit Card Number Detected in Clear (14 digit dashed)"; pcre:"/ (30[0-5]\d|36\d{2}|38\d{2})-\d{4}-\d{4}-\d{2} /"; reference:url,www.beachnet.com/~hstiles/cardtype.html; reference:url,doc.emergingthreats.net/2001383; classtype:policy-violation; sid:2001383; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Quest Explain Plan Display ActiveX Control SaveToFile Insecure Method Access"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"F7014877-6F5A-4019-A3B2-74077F2AE126"; nocase; distance:0; content:".SaveToFile|28|"; nocase; distance:0; reference:url,secunia.com/advisories/48681/; classtype:attempted-user; sid:2014652; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_28, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert ip any any -> any any (msg:"ET POLICY Credit Card Number Detected in Clear (15 digit spaced 2)"; pcre:"/ (3[4|7]\d{2}|2014|2149|2131|1800) \d{6} \d{5} /"; reference:url,www.beachnet.com/~hstiles/cardtype.html; reference:url,doc.emergingthreats.net/2009293; classtype:policy-violation; sid:2009293; rev:1; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Quest Explain Plan Display ActiveX Control SaveToFile Insecure Method Access 2"; flow:to_client,established; file_data; content:"ActiveXObject"; nocase; content:"QExplain2.ExplainPlanDisplayX"; nocase; distance:0; content:".SaveToFile|28|"; nocase; distance:0; reference:url,secunia.com/advisories/48681/; classtype:attempted-user; sid:2014653; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_28, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert ip any any -> any any (msg:"ET POLICY Credit Card Number Detected in Clear (15 digit dashed 2)"; pcre:"/ (3[4|7]\d{2}|2014|2149|2131|1800)-\d{6}-\d{5} /"; reference:url,www.beachnet.com/~hstiles/cardtype.html; reference:url,doc.emergingthreats.net/2009294; classtype:policy-violation; sid:2009294; rev:1; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible McAfee Virtual Technician MVT.MVTControl.6300 ActiveX Control GetObject method Remote Code Execution"; flow:to_client,established; content:"CLSID"; nocase; content:"2EBE1406-BE0E-44E6-AE10-247A0C5AEDCF"; nocase; distance:0; content:".GetObject("; nocase; distance:0; reference:url,exploit-db.com/exploits/18805/; classtype:attempted-user; sid:2014708; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_04, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp any 53 -> ![$DNS_SERVERS,$SMTP_SERVERS] any (msg:"ET POLICY Unusual number of DNS No Such Name Responses"; content:"|83|"; offset:3; depth:1; threshold: type both , track by_dst, count 50, seconds 300; reference:url,doc.emergingthreats.net/2003195; classtype:bad-unknown; sid:2003195; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible McAfee Virtual Technician MVT.MVTControl.6300 ActiveX Control GetObject method Remote Code Execution 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"MVT.MVTControl.6300"; nocase; distance:0; content:".GetObject("; nocase; distance:0; reference:url,exploit-db.com/exploits/18805/; classtype:attempted-user; sid:2014709; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_04, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET POLICY nstx DNS Tunnel Outbound"; content:"cT"; offset:12; depth:3; content:"|00 10 00 01 00 00 29 08|"; within:255; reference:url,savannah.nongnu.org/projects/nstx/; reference:url,nstx.dereference.de/nstx; reference:url,doc.emergingthreats.net/2002676; classtype:bad-unknown; sid:2002676; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Samsung NET-i Viewer Active-X SEH Overwrite"; flow:to_client,established; content:"CLSID"; nocase; content:"FA6E2EA9-D816-4F00-940B-609C9E8847A4"; nocase; distance:0; content:"RequestScreenOptimization"; nocase; distance:0; reference:url,packetstormsecurity.com/files/112363; classtype:attempted-user; sid:2014710; rev:3; metadata:created_at 2012_05_04, former_category ACTIVEX, updated_at 2012_05_04;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY Dameware Remote Control Service Install"; flow: to_server,established; content:"DWRCK.DLL"; nocase; reference:url,doc.emergingthreats.net/2001294; classtype:successful-admin; sid:2001294; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible WebEx UCF atucfobj.dll ActiveX NewObject Method Buffer Overflow"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"WebexUCFObject.WebexUCFObject"; nocase; distance:0; content:"NewObject("; nocase; distance:0; reference:url,exploit-db.com/exploits/16604/; classtype:attempted-user; sid:2014713; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_04, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET POLICY SMTP Executable attachment"; flow:established,to_server; content:"filename="; nocase; content:".exe"; nocase; distance:0; pcre:"/filename=\s*[^\n]+\.exe/i"; reference:url,doc.emergingthreats.net/2003325; classtype:policy-violation; sid:2003325; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible WebEx UCF atucfobj.dll ActiveX NewObject Method Buffer Overflow 2"; flow:to_client,established; content:"CLSID"; nocase; content:"32E26FD9-F435-4A20-A561-35D4B987CFDC"; nocase; distance:0; content:"NewObject("; nocase; distance:0; reference:url,exploit-db.com/exploits/16604/; classtype:attempted-user; sid:2014714; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_04, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED offers.e-centives.com Coupon Printer"; flow:established,to_server; content:"|0d 0a|User-Agent\: Mozilla/4.0 (compatible\; YourApp\; AK\; Windows 95)|0d 0a|"; nocase; reference:url,offers.e-centives.com; reference:url,doc.emergingthreats.net/2010338; classtype:policy-violation; sid:2010338; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Camera Stream Client Possible ActiveX Control SetDirectory Method Access Buffer Overflow 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"DcsCliCtrl.DCSStrmControl.1"; nocase; distance:0; content:"SetDirectory"; nocase; distance:0; reference:url,secunia.com/advisories/48602/; classtype:attempted-user; sid:2014903; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_06_15, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET POLICY FTP Login Attempt (non-anonymous)"; flow:to_server,established; content:"USER"; content:!"PASS "; nocase; pcre:!"/^USER\s+(anonymous|ftp)/smi"; reference:url,doc.emergingthreats.net/2003303; classtype:misc-activity; sid:2003303; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Camera Stream Client Possible ActiveX Control SetDirectory Method Access Buffer Overflow"; flow:to_client,established; content:"CLSID"; nocase; content:"721700FE-7F0E-49C5-BDED-CA92B7CB1245"; nocase; distance:0; content:"SetDirectory"; nocase; distance:0; reference:url,secunia.com/advisories/48602/; classtype:attempted-user; sid:2014902; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_06_15, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET POLICY FTP Frequent Administrator Login Attempts"; flow:to_server,established; content:"USER Administrator|0d0a|"; nocase; threshold: type threshold, track by_src, count 3, seconds 30; reference:url,doc.emergingthreats.net/2009667; classtype:attempted-admin; sid:2009667; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible IBM Lotus iNotes Upload Module possible ActiveX Control Attachment_Times Method Access Buffer Overflow Attempt"; flow:to_client,established; content:"CLSID"; nocase; content:"0F2AAAE3-7E9E-4b64-AB5D-1CA24C6ACB9C"; nocase; distance:0; content:"Attachment_Times"; nocase; distance:0; reference:url,secunia.com/advisories/49443/; classtype:attempted-user; sid:2014896; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_06_15, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET POLICY FTP Frequent Admin Login Attempts"; flow:to_server,established; content:"USER Admin|0d0a|"; nocase; threshold: type threshold, track by_src, count 3, seconds 30; reference:url,doc.emergingthreats.net/2009668; classtype:attempted-admin; sid:2009668; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Autodesk MapGuide Viewer ActiveX LayersViewWidth Method Access Denial of Service"; flow:to_client,established; content:"CLSID"; nocase; content:"62789780-B744-11D0-986B-00609731A21D"; nocase; distance:0; content:"LayersViewWidth"; nocase; distance:0; reference:url,1337day.com/exploits/13938; classtype:attempted-user; sid:2014942; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_06_22, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 22:1024 (msg:"ET POLICY FTP Conversation on Low Port - Likely Hostile (TYPE A)"; flow:established,to_server; dsize:6; content:"TYPE "; depth:5; reference:url,doc.emergingthreats.net/2008589; classtype:trojan-activity; sid:2008589; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Autodesk MapGuide Viewer ActiveX LayersViewWidth Method Access Denial of Service 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"MGMapControl.MGMap"; nocase; distance:0; content:"LayersViewWidth"; nocase; distance:0; reference:url,1337day.com/exploits/13938; classtype:attempted-user; sid:2014943; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_06_22, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 22:1024 (msg:"ET POLICY FTP Conversation on Low Port - Likely Hostile (PASV)"; flow:established,to_server; dsize:4; content:"PASV"; reference:url,doc.emergingthreats.net/2008590; classtype:trojan-activity; sid:2008590; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible SonciWALL Aventail AuthCredential Format String Exploit 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"Aventail.EPInterrogator.10.0.4.018"; nocase; distance:0; content:"AuthCredential"; nocase; distance:0; reference:url,packetstormsecurity.org/files/92931/SonciWALL-Aventail-epi.dll-AuthCredential-Format-String-Exploit.html; classtype:attempted-user; sid:2014991; rev:3; metadata:created_at 2012_06_29, updated_at 2012_06_29;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 5222 (msg:"ET CHAT Facebook Chat using XMPP"; flow:to_server,established; content:"chat.facebook.com"; nocase; content:"jabber|3A|client"; nocase; distance:9; within:13; threshold: type limit, track by_src, count 1, seconds 60; reference:url,www.facebook.com/sitetour/chat.php; reference:url,doc.emergingthreats.net/2010819; classtype:policy-violation; sid:2010819; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible SonciWALL Aventail AuthCredential Format String Exploit"; flow:to_client,established; content:"CLSID"; nocase; content:"2A1BE1E7-C550-4D67-A553-7F2D3A39233D"; nocase; distance:0; content:"AuthCredential"; nocase; distance:0; reference:url,packetstormsecurity.org/files/92931/SonciWALL-Aventail-epi.dll-AuthCredential-Format-String-Exploit.html; classtype:attempted-user; sid:2014992; rev:3; metadata:created_at 2012_06_29, updated_at 2012_06_29;) -#alert tcp $HOME_NET any -> 66.151.158.177 any (msg:"ET DELETED GotoMyPC Polling Client"; flow: established; threshold: type limit, track by_src, count 1, seconds 360; reference:url,doc.emergingthreats.net/2000309; classtype:policy-violation; sid:2000309; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible IBM Rational ClearQuest Activex Control RegisterSchemaRepoFromFileByDbSet Insecure Method Access"; flow:to_client,established; content:"CLSID"; nocase; content:"88DD90B6-C770-4CFF-B7A4-3AFD16BB8824"; nocase; distance:0; content:"RegisterSchemaRepoFromFileByDbSet"; nocase; distance:0; reference:url,11337day.com/exploits/18917; classtype:attempted-user; sid:2015032; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_07, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp 66.151.158.177 8200 -> $HOME_NET any (msg:"ET DELETED GotoMyPC poll.gotomypc.com Server Response to Polling Client OK"; flow: established,from_server; content:"cnt=0"; nocase; depth: 40; content:"eventid="; nocase; depth: 40; threshold: type limit, track by_src, count 1, seconds 360; reference:url,doc.emergingthreats.net/2002022; classtype:policy-violation; sid:2002022; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Crystal Reports Viewer Activex Control ServerResourceVersion Insecure Method Access"; flow:to_client,established; content:"CLSID"; nocase; content:"88DD90B6-C770-4CFF-B7A4-3AFD16BB8824"; nocase; distance:0; content:"ServerResourceVersion"; nocase; distance:0; reference:url,1337day.com/exploits/15098; classtype:attempted-user; sid:2015036; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_07, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any <> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Gmail gtalk"; flow:established; pcre:"/\[\[\d{1,3}\,\[\\\"\w\\\"\,\\\".+@gmail.com.+\\\"\,\\\"/i"; reference:url,doc.emergingthreats.net/2003092; classtype:policy-violation; sid:2003092; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Crystal Reports Viewer Activex Control ServerResourceVersion Insecure Method Access 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"CrystalPrintControlLib.CrystalPrintControl"; nocase; distance:0; content:"ServerResourceVersion"; nocase; distance:0; reference:url,1337day.com/exploits/15098; classtype:attempted-user; sid:2015037; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_07, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 8000 (msg:"ET MISC HP Web JetAdmin ExecuteFile admin access"; flow: to_server,established; content:"/plugins/framework/script/content.hts"; nocase; content:"ExecuteFile"; nocase; reference:bugtraq,10224; reference:url,doc.emergingthreats.net/2001055; classtype:attempted-admin; sid:2001055; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible AdminStudio Activex Control LaunchProcess Method Access Arbitrary Code Execution"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"LaunchHelp.HelpLauncher.1"; nocase; distance:0; content:"LaunchProcess"; nocase; distance:0; reference:url,packetstormsecurity.org/files/114564/AdminStudio-LaunchHelp.dll-ActiveX-Arbitrary-Code-Execution.html; classtype:attempted-user; sid:2015464; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_13, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert udp any 1985 -> 224.0.0.2 1985 (msg:"ET POLICY HSRP Active Router Changed"; content:"|00 04|"; depth:3; reference:url,packetlife.net/blog/2008/oct/27/hijacking-hsrp/; reference:url,doc.emergingthreats.net/2009243; classtype:bad-unknown; sid:2009243; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible beSTORM ActiveX (WinGraphviz.dll) Remote Heap Overflow"; flow:to_client,established; content:"CLSID"; nocase; content:"684811FB-0523-420F-9E8F-A5452C65A19C"; nocase; distance:0; content:"ToSvg"; nocase; distance:0; reference:url,exploit-db.com/exploits/19861/; classtype:attempted-user; sid:2015490; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_20, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET !$HTTP_PORTS (msg:"ET POLICY Inbound HTTP CONNECT Attempt on Off-Port"; flow:to_server,established; content:"CONNECT "; nocase; depth:8; content:" HTTP/1."; nocase; within:1000; reference:url,doc.emergingthreats.net/2008284; classtype:misc-activity; sid:2008284; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible CA BrightStor ARCserve Backup ActiveX AddColumn Method Access Buffer Overflow"; flow:to_client,established; content:"CLSID"; nocase; content:"BF6EFFF3-4558-4C4C-ADAF-A87891C5F3A3"; nocase; distance:0; content:"AddColumn"; nocase; distance:0; reference:url,packetstormsecurity.org/files/82950/CA-BrightStor-ARCserve-Backup-AddColumn-ActiveX-Buffer-Overflow.html; classtype:attempted-user; sid:2015491; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_20, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET POLICY Possible HTTP-TUNNEL to External Proxy for Anonymous Access"; flow:established,to_server; content:"GET /login/FetchProtocolVersion2.htm"; depth:36; threshold:type limit, track by_src,count 5, seconds 30; reference:url,doc.emergingthreats.net/2008842; classtype:policy-violation; sid:2008842; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible CommuniCrypt Mail SMTP ActiveX AddAttachments Method Access Stack Buffer Overflow"; flow:to_client,established; content:"CLSID"; nocase; content:"F8D07B72-B4B4-46A0-ACC0-C771D4614B82"; nocase; distance:0; content:"AddAttachments"; nocase; distance:0; reference:url,packetstormsecurity.org/files/89856/CommuniCrypt-Mail-1.16-SMTP-ActiveX-Stack-Buffer-Overflow.html; classtype:attempted-user; sid:2015493; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_20, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET POLICY Possible HTTP-TUNNEL to External Proxy for Anonymous Access (server download)"; flow:established,to_server; content:"GET login/fetchFreeServersVersion2.aspx"; depth:39; threshold:type limit, track by_src,count 5, seconds 30; reference:url,doc.emergingthreats.net/2008843; classtype:policy-violation; sid:2008843; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible CA BrightStor ARCserve Backup ActiveX AddColumn Method Access Buffer Overflow 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"ListCtrl.ocx"; fast_pattern; nocase; distance:0; content:"AddColumn"; nocase; distance:0; reference:url,packetstormsecurity.org/files/82950/CA-BrightStor-ARCserve-Backup-AddColumn-ActiveX-Buffer-Overflow.html; classtype:attempted-user; sid:2015492; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_20, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 8074 (msg:"ET CHAT GaduGadu Chat Client Login Packet"; flowbits:isset,ET.gadu.welcome; flow:established,to_server; dsize:<50; content:"|15 00 00 00|"; depth:4; flowbits:set,ET.gadu.loginsent; reference:url,piotr.trzcionkowski.pl/default.asp?load=/programy/pppgg_protokol.html; reference:url,doc.emergingthreats.net/2008298; classtype:policy-violation; sid:2008298; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Oracle AutoVue ActiveX SetMarkupMode Method Access Remote Code Execution"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"AutoVueX.ocx"; fast_pattern; nocase; distance:0; content:"SetMarkupMode"; nocase; distance:0; reference:url,packetstormsecurity.org/files/114364/Oracle-AutoVue-ActiveX-SetMarkupMode-Remote-Code-Execution.html; classtype:attempted-user; sid:2015465; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_13, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET 8074 -> $HOME_NET any (msg:"ET CHAT GaduGadu Chat Server Login Failed Packet"; flowbits:isset,ET.gadu.loginsent; flow:established,from_server; dsize:8; content:"|09 00 00 00 00 00 00 00|"; reference:url,piotr.trzcionkowski.pl/default.asp?load=/programy/pppgg_protokol.html; reference:url,doc.emergingthreats.net/2008300; classtype:policy-violation; sid:2008300; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Symantec AppStream LaunchObj ActiveX Control Arbitrary File Download and Execute"; flow:to_client,established; content:"CLSID"; nocase; content:"3356DB7C-58A7-11D4-AA5C-006097314BF8"; nocase; distance:0; content:"installAppMgr"; nocase; distance:0; reference:url,packetstormsecurity.org/files/82969/Symantec-AppStream-LaunchObj-ActiveX-Control-Arbitrary-File-Download-and-Execute..html; classtype:attempted-user; sid:2015537; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_27, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 8074 (msg:"ET CHAT GaduGadu Chat Server Available Status Packet"; flowbits:isset,ET.gadu.loggedin; flow:established,to_server; content:"|02 00 00 00|"; depth:4; reference:url,piotr.trzcionkowski.pl/default.asp?load=/programy/pppgg_protokol.html; reference:url,doc.emergingthreats.net/2008301; classtype:policy-violation; sid:2008301; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible WinZip FileView ActiveX CreateNewFolderFromName Method Access Buffer Overflow"; flow:to_client,established; content:"CLSID"; nocase; content:"A09AE68F-B14D-43ED-B713-BA413F034904"; nocase; distance:0; content:"CreateNewFolderFromName"; nocase; distance:0; reference:url,packetstormsecurity.org/files/83024/WinZip-FileView-WZFILEVIEW.FileViewCtrl.61-ActiveX-Buffer-Overflow.html; classtype:attempted-user; sid:2015538; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_27, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 8074 (msg:"ET CHAT GaduGadu Chat Send Message"; flowbits:isset,ET.gadu.loggedin; flow:established,to_server; content:"|0b 00 00 00|"; depth:4; reference:url,piotr.trzcionkowski.pl/default.asp?load=/programy/pppgg_protokol.html; reference:url,doc.emergingthreats.net/2008302; classtype:policy-violation; sid:2008302; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible WinZip FileView (WZFILEVIEW.FileViewCtrl.61) ActiveX Buffer Overflow 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"WZFILEVIEW.FileViewCtrl.61"; nocase; distance:0; content:"CreateNewFolderFromName"; nocase; distance:0; reference:url,packetstormsecurity.org/files/83024/WinZip-FileView-WZFILEVIEW.FileViewCtrl.61-ActiveX-Buffer-Overflow.html; classtype:attempted-user; sid:2015539; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_27, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET 8074 -> $HOME_NET any (msg:"ET CHAT GaduGadu Chat Receive Message"; flowbits:isset,ET.gadu.loggedin; flow:established,from_server; content:"|0a 00 00 00|"; depth:4; reference:url,piotr.trzcionkowski.pl/default.asp?load=/programy/pppgg_protokol.html; reference:url,doc.emergingthreats.net/2008303; classtype:policy-violation; sid:2008303; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible BarCodeWiz (BARCODEWIZLib.BarCodeWiz) ActiveX Control Buffer Overflow"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"BARCODEWIZLib.BarCodeWiz"; nocase; distance:0; content:"Barcode"; nocase; distance:0; reference:url,securityfocus.com/bid/54701; classtype:attempted-user; sid:2015564; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_03, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 8074 (msg:"ET CHAT GaduGadu Chat Keepalive PING"; flowbits:isset,ET.gadu.loggedin; flow:established,to_server; content:"|08 00 00 00|"; depth:4; reference:url,piotr.trzcionkowski.pl/default.asp?load=/programy/pppgg_protokol.html; reference:url,doc.emergingthreats.net/2008304; classtype:policy-violation; sid:2008304; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible AOL ICQ ActiveX Control DownloadAgent Method Access Arbitrary File Download and Execute"; flow:to_client,established; content:"CLSID"; nocase; content:"54BDE6EC-F42F-4500-AC46-905177444300"; nocase; distance:0; content:"DownloadAgent"; nocase; distance:0; reference:url,packetstormsecurity.org/files/83020/America-Online-ICQ-ActiveX-Control-Arbitrary-File-Download-and-Execute..html; classtype:attempted-user; sid:2015566; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_03, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET 8074 -> $HOME_NET any (msg:"ET CHAT GaduGadu Chat Keepalive PONG"; flowbits:isset,ET.gadu.loggedin; flow:established,from_server; content:"|07 00 00 00|"; depth:4; reference:url,piotr.trzcionkowski.pl/default.asp?load=/programy/pppgg_protokol.html; reference:url,doc.emergingthreats.net/2008305; classtype:policy-violation; sid:2008305; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible AOL ICQ ActiveX Control DownloadAgent Method Access Arbitrary File Download and Execute 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"ICQPhone.SipxPhoneManager.1"; nocase; distance:0; content:"DownloadAgent"; nocase; distance:0; reference:url,packetstormsecurity.org/files/83020/America-Online-ICQ-ActiveX-Control-Arbitrary-File-Download-and-Execute..html; classtype:attempted-user; sid:2015567; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_03, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 8074 (msg:"ET CHAT GaduGadu Chat File Send Request"; flowbits:isset,ET.gadu.loggedin; flow:established,to_server; content:"|01 00 00 00|"; depth:4; reference:url,piotr.trzcionkowski.pl/default.asp?load=/programy/pppgg_protokol.html; reference:url,doc.emergingthreats.net/2008306; classtype:policy-violation; sid:2008306; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible BarCodeWiz BarcodeWiz.dll ActiveX Control Barcode Method Remote Buffer Overflow Attempt"; flow:to_client,established; content:"CLSID"; nocase; content:"CD3B09F1-26FB-41CD-B3F2-E178DFD3BCC6"; nocase; distance:0; content:"Barcode"; nocase; distance:0; reference:url,securityfocus.com/bid/54701; classtype:attempted-user; sid:2015563; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_03, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 8074 (msg:"ET CHAT GaduGadu Chat File Send Details"; flowbits:isset,ET.gadu.loggedin; flow:established,to_server; content:"|03 00 00 00|"; depth:4; reference:url,piotr.trzcionkowski.pl/default.asp?load=/programy/pppgg_protokol.html; reference:url,doc.emergingthreats.net/2008307; classtype:policy-violation; sid:2008307; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution"; flow:to_client,established; content:"CLSID"; nocase; content:"6F255F99-6961-48DC-B17E-6E1BCCBC0EE3"; nocase; distance:0; content:"CacheDocumentXMLWithId"; nocase; distance:0; reference:url,1337day.com/exploits/17395; classtype:attempted-user; sid:2015606; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_10, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET 8074 -> $HOME_NET any (msg:"ET CHAT GaduGadu Chat File Send Accept"; flowbits:isset,ET.gadu.loggedin; flow:established,from_server; content:"|06 00 00 00|"; depth:4; reference:url,piotr.trzcionkowski.pl/default.asp?load=/programy/pppgg_protokol.html; reference:url,doc.emergingthreats.net/2008308; classtype:policy-violation; sid:2008308; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible HP Easy Printer Care XMLCacheMgr Class ActiveX Control Remote Code Execution 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"HPESPRIT.XMLCacheMgr.1"; nocase; distance:0; content:"CacheDocumentXMLWithId"; nocase; distance:0; reference:url,1337day.com/exploits/17395; classtype:attempted-user; sid:2015607; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_10, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET 8074 -> $HOME_NET any (msg:"ET CHAT GaduGadu Chat File Send Begin"; flowbits:isset,ET.gadu.loggedin; flow:established,from_server; content:"|03 00 00 00|"; depth:4; reference:url,piotr.trzcionkowski.pl/default.asp?load=/programy/pppgg_protokol.html; reference:url,doc.emergingthreats.net/2008309; classtype:policy-violation; sid:2008309; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Kazaa Altnet Download Manager ActiveX Control Install Method Access Buffer Overflow"; flow:to_client,established; content:"CLSID"; nocase; content:"DEF37997-D9C9-4A4B-BF3C-88F99EACEEC2"; nocase; distance:0; content:".Install("; nocase; distance:0; reference:url,packetstormsecurity.org/files/83086/Kazaa-Altnet-Download-Manager-ActiveX-Control-Buffer-Overflow.html; classtype:attempted-user; sid:2015608; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_10, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 5190 (msg:"ET CHAT ICQ Status Invisible"; flow: from_client,established; content:"|2A02|"; depth: 2; content:"|001900130005|"; offset: 4; depth: 6; reference:url,doc.emergingthreats.net/2001801; classtype:policy-violation; sid:2001801; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible CA eTrust PestPatrol ActiveX Control Buffer Overflow"; flow:to_client,established; content:"CLSID"; nocase; content:"5E644C49-F8B0-4E9A-A2ED-5F176BB18CE6"; nocase; distance:0; content:".Initialize("; nocase; distance:0; reference:url,exploit-db.com/exploits/16630/; classtype:attempted-user; sid:2015636; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_17, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 5190 (msg:"ET CHAT ICQ Status Change (1)"; flow: from_client,established; content:"|2A02|"; depth: 2; content:"|000E00010011|"; offset: 4; depth: 6; reference:url,doc.emergingthreats.net/2001802; classtype:policy-violation; sid:2001802; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Electronic Arts SnoopyCtrl ActiveX Control Buffer Overflow"; flow:to_client,established; content:"CLSID"; nocase; content:"525A15D0-4938-11D4-94C7-0050DA20189B"; nocase; distance:0; content:"CheckRequirements("; nocase; distance:0; reference:url,exploit-db.com/exploits/16609/; reference:url,kb.cert.org/vuls/id/179281; classtype:attempted-user; sid:2015643; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_17, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 5190 (msg:"ET CHAT ICQ Status Change (2)"; flow: from_client,established; content:"|2A02|"; depth: 2; content:"|00120001001E|"; offset: 4; depth: 6; reference:url,doc.emergingthreats.net/2001803; classtype:policy-violation; sid:2001803; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Electronic Arts SnoopyCtrl ActiveX Control Buffer Overflow 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"SnoopyX.SnoopyCtrl.1"; nocase; distance:0; content:"CheckRequirements("; nocase; distance:0; reference:url,exploit-db.com/exploits/16609/; classtype:attempted-user; sid:2015644; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_17, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 5190 (msg:"ET CHAT ICQ Login"; flow: from_client,established; content:"|2A01|"; depth: 2; content:"|00010001|"; offset: 8; depth: 4; reference:url,doc.emergingthreats.net/2001804; classtype:policy-violation; sid:2001804; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Apple QuickTime <= 7.4.1 QTPlugin.ocx Multiple Remote Stack Overflow"; flow:to_client,established; content:"02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"; nocase; content:"String("; nocase; distance:0; pcre:"/^\s*?[0-9]{4}/R"; pcre:"/(SetBgColor|SetMovieName|SetTarget|SetMatrix|SetHREF)/Ri"; reference:bugtraq,27769; reference:cve,CVE-2008-0778; reference:url,www.milw0rm.com/exploits/5110; reference:url,doc.emergingthreats.net/2007878; classtype:web-application-attack; sid:2007878; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $HOME_NET any <> $EXTERNAL_NET any (msg:"ET CHAT ICQ Message"; flow: established; content:"|2A02|"; depth: 2; content:"|000400060000|"; offset: 6; depth: 6; reference:url,doc.emergingthreats.net/2001805; classtype:policy-violation; sid:2001805; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Image Viewer CP Gold Image2PDF Buffer Overflow"; flow:established,to_client; file_data; content:"clsid"; nocase; content:"E589DA78-AD4C-4FC5-B6B9-9E47B110679E"; nocase; content:"|2e|Image2PDF"; distance:0; pcre:"/]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*E589DA78-AD4C-4FC5-B6B9-9E47B110679E\s*}?\s*(.*)(\s|>)/si"; reference:url,www.exploit-db.com/exploits/15658/; classtype:attempted-user; sid:2012102; rev:4; metadata:created_at 2010_12_27, updated_at 2010_12_27;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 5222 (msg:"ET CHAT Google Talk (Jabber) Client Login"; flow:established,to_server; content:"gmail.com"; nocase; content:"jabber"; nocase; distance:9; within:6; reference:url,talk.google.com; reference:url,www.xmpp.org; reference:url,doc.emergingthreats.net/2002327; classtype:policy-violation; sid:2002327; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Advanced File Vault Activex Heap Spray Attempt"; flow:established,to_client; file_data; content:"|2e|GetWebStoreURL"; content:"clsid"; nocase; content:"25982EAA-87CC-4747-BE09-9913CF7DD2F1"; nocase; distance:0; pcre:"/]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*25982EAA-87CC-4747-BE09-9913CF7DD2F1\s*}?(.*)\>/si"; reference:url,www.exploit-db.com/exploits/14580/; classtype:attempted-user; sid:2012147; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_01_05, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET POLICY Google Talk TLS Client Traffic"; flow:established,to_server; content:"gmail.com"; nocase; content:"jabber"; nocase; distance:64; within:78; reference:url,talk.google.com; reference:url,www.xmpp.org; reference:url,doc.emergingthreats.net/2002330; classtype:policy-violation; sid:2002330; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX dBpowerAMP Audio Player 2 FileExists Method ActiveX Buffer Overflow"; flow:established,to_client; file_data; content:"clsid"; nocase; content:"BECB8EE1-6BBB-4A85-8DFD-099B7A60903A"; nocase; distance:0; content:"|2e|Enque"; distance:0; pcre:"/]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*BECB8EE1-6BBB-4A85-8DFD-099B7A60903A\s*}?(.*)\>/si"; reference:url,www.exploit-db.com/exploits/14586/; classtype:attempted-user; sid:2012148; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_01_05, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any <> $EXTERNAL_NET any (msg:"ET CHAT MSN file transfer request"; flow: established; content:"MSG "; depth: 4; content:"Content-Type|3A|"; nocase; distance: 0; content:"text/x-msmsgsinvite"; nocase; distance: 0; content:"Application-Name|3A|"; content:"File Transfer"; nocase; distance: 0; reference:url,doc.emergingthreats.net/2001241; classtype:policy-violation; sid:2001241; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX FathFTP 1.8 EnumFiles Method ActiveX Buffer Overflow"; flow:established,to_client; file_data; content:"clsid"; nocase; content:"62A989CE-D39A-11D5-86F0-B9C370762176"; nocase; distance:0; content:"|2e|EnumFiles"; distance:0; pcre:"/]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*62A989CE-D39A-11D5-86F0-B9C370762176\s*}?(.*)\>/si"; reference:url,www.exploit-db.com/exploits/14552/; classtype:attempted-user; sid:2012133; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_01_05, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any <> $EXTERNAL_NET any (msg:"ET CHAT MSN file transfer accept"; flow: established; content:"MSG "; depth: 4; content:"Content-Type|3A|"; nocase; content:"text/x-msmsgsinvite"; distance: 0; content:"Invitation-Command|3A|"; content:"ACCEPT"; distance: 1; reference:url,doc.emergingthreats.net/2001242; classtype:policy-violation; sid:2001242; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible NVIDIA Install Application ActiveX Control AddPackages Unicode Buffer Overflow"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"A9C8F210-55EB-4849-8807-EC49C5389A79"; nocase; distance:0; content:".AddPackages"; nocase; distance:0; reference:url,packetstormsecurity.org/files/118648/NVIDIA-Install-Application-2.1002.85.551-Buffer-Overflow.html; classtype:attempted-user; sid:2016041; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_12_14, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any <> $EXTERNAL_NET any (msg:"ET CHAT MSN file transfer reject"; flow: established; content:"MSG "; depth: 4; content:"Content-Type|3A|"; nocase; content:"text/x-msmsgsinvite"; distance: 0; content:"Invitation-Command|3A|"; content:"CANCEL"; distance: 0; content:"Cancel-Code|3A|"; nocase; content:"REJECT"; nocase; distance: 0; reference:url,doc.emergingthreats.net/2001243; classtype:policy-violation; sid:2001243; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible HP ALM XGO.ocx ActiveX Control SetShapeNodeType method Remote Code Execution"; flow:to_client,established; file_data; content:"CLSID"; nocase; distance:0; content:"C3B92104-B5A7-11D0-A37F-00A0248F0AF1"; nocase; distance:0; content:".SetShapeNodeType("; nocase; distance:0; reference:url,packetstormsecurity.org/files/116848/HP-ALM-Remote-Code-Execution.html; classtype:attempted-user; sid:2016084; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_12_21, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CHAT MSN status change"; flow:established,to_server; content:"CHG "; depth:55; reference:url,doc.emergingthreats.net/2002192; classtype:policy-violation; sid:2002192; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Cyme ChartFX client server ActiveX Control ShowPropertiesDialog arbitrary code execution"; flow:to_client,established; file_data; content:"CLSID"; nocase; distance:0; content:"E9DF30CA-4B30-4235-BF0C-7150F646606C"; nocase; distance:0; content:"ShowPropertiesDialog"; nocase; distance:0; reference:url,packetstormsecurity.org/files/117137/Cyme-ChartFX-Client-Server-Array-Indexing.html; classtype:attempted-user; sid:2016085; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_12_21, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED MSN Game Loading"; flow:established,to_server; content:"|6D 73 6E 67 61 6D 65 2E 61 73 70 78|"; depth:90; reference:url,doc.emergingthreats.net/2002312; classtype:policy-violation; sid:2002312; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Advantech Studio ISSymbol ActiveX Control Multiple Buffer Overflow Attempt"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"3c9dff6f-5cb0-422e-9978-d6405d10718f"; nocase; distance:0; content:"InternationalSeparator"; nocase; distance:0; reference:url,securityfocus.com/bid/47596; classtype:attempted-user; sid:2016118; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_12_29, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CHAT Yahoo IM voicechat"; flow: from_server,established; content:"YMSG"; nocase; depth: 4; content:"|00|J"; offset: 10; depth: 2; reference:url,doc.emergingthreats.net/2001254; classtype:policy-violation; sid:2001254; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Sony PC Companion Load method Stack-based Unicode Buffer Overload SEH"; flow:to_client,established; file_data; content:"CLSID"; nocase; distance:0; content:"EEA36793-F574-4CC1-8690-60E3511CFEAA"; nocase; distance:0; content:".Load"; nocase; distance:0; reference:url,packetstormsecurity.com/files/119022/Sony-PC-Companion-2.1-Load-Unicode-Buffer-Overflow.html; classtype:attempted-user; sid:2016160; rev:3; metadata:created_at 2013_01_05, updated_at 2013_01_05;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CHAT Yahoo IM ping"; flow: to_server,established; content:"YMSG"; nocase; depth: 4; content:"|00 12|"; offset: 10; depth: 2; reference:url,doc.emergingthreats.net/2001255; classtype:policy-violation; sid:2001255; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Sony PC Companion CheckCompatibility method Stack-based Unicode Buffer Overload"; flow:to_client,established; file_data; content:"CLSID"; nocase; distance:0; content:"A70D160E-E925-4207-803B-A0D702BEDF46"; nocase; distance:0; content:".CheckCompatibility"; nocase; distance:0; reference:url,packetstormsecurity.com/files/119023/Sony-PC-Companion-2.1-CheckCompatibility-Unicode-Buffer-Overflow.html; classtype:attempted-user; sid:2016161; rev:3; metadata:created_at 2013_01_05, updated_at 2013_01_05;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CHAT Yahoo IM conference invitation"; flow: from_server,established; content:"YMSG"; nocase; depth: 4; content:"|00 18|"; offset: 10; depth: 2; reference:url,doc.emergingthreats.net/2001256; classtype:policy-violation; sid:2001256; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Sony PC Companion Admin_RemoveDirectory Stack-based Unicode Buffer Overload SEH"; flow:to_client,established; file_data; content:"CLSID"; nocase; distance:0; content:"BBB7AA7C-DCE4-4F85-AED3-72FE3BCA4141"; nocase; distance:0; content:".Admin_RemoveDirectory"; nocase; distance:0; reference:url,packetstormsecurity.com/files/119024/Sony-PC-Companion-2.1-Admin_RemoveDirectory-Unicode-Buffer-Overflow.html; classtype:attempted-user; sid:2016162; rev:3; metadata:created_at 2013_01_05, updated_at 2013_01_05;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CHAT Yahoo IM conference logon success"; flow: from_server,established; content:"YMSG"; nocase; depth: 4; content:"|00 19|"; offset: 10; depth: 2; reference:url,doc.emergingthreats.net/2001257; classtype:policy-violation; sid:2001257; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Honeywell Tema Remote Installer ActiveX DownloadFromURL method Remote Code Execution"; flow:to_client,established; file_data; content:"CLSID"; nocase; distance:0; content:"E01DF79C-BE0C-4999-9B13-B5F7B2306E9B"; nocase; distance:0; content:".DownloadFromURL"; nocase; distance:0; reference:url,packetstormsecurity.com/files/119427/Honeywell-Tema-Remote-Installer-ActiveX-Remote-Code-Execution.html; classtype:attempted-user; sid:2016197; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_01_12, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CHAT Yahoo IM conference message"; flow: to_server,established; content:"YMSG"; nocase; depth: 4; content:"|00 1D|"; offset: 10; depth: 2; reference:url,doc.emergingthreats.net/2001258; classtype:policy-violation; sid:2001258; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible KeyHelp ActiveX LaunchTriPane Remote Code Execution Vulnerability"; flow:to_client,established; file_data; content:"45E66957-2932-432A-A156-31503DF0A681"; nocase; distance:0; content:".LaunchTriPane("; nocase; distance:0; reference:url,packetstormsecurity.com/files/117293/KeyHelp-ActiveX-LaunchTriPane-Remote-Code-Execution.html; classtype:attempted-user; sid:2016236; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_01_18, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CHAT Yahoo IM Unavailable Status"; flow: to_server,established; content:"|59 47 00 0b 00 00 00 00 00 12 00 00 00 00|"; depth: 55; reference:url,doc.emergingthreats.net/2001427; classtype:policy-violation; sid:2001427; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Samsung Kies ActiveX PrepareSync method Buffer overflow"; flow:to_client,established; file_data; content:"CLSID"; nocase; distance:0; content:"EA8A3985-F9DF-4652-A255-E4E7772AFCA8"; nocase; distance:0; content:".PrepareSync"; nocase; distance:0; reference:url,packetstormsecurity.com/files/119423/Samsung-Kies-2.5.0.12114_1-Buffer-Overflow.html; classtype:attempted-user; sid:2016237; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_01_18, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any <> $EXTERNAL_NET any (msg:"ET CHAT Yahoo IM message"; flow: established; content:"YMSG"; depth: 4; reference:url,doc.emergingthreats.net/2001260; classtype:policy-violation; sid:2001260; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible KeyHelp ActiveX LaunchTriPane Remote Code Execution Vulnerability 2"; flow:to_client,established; file_data; content:"ActiveXObject"; nocase; content:"KeyHelp.KeyScript"; nocase; distance:0; content:".LaunchTriPane("; nocase; distance:0; reference:url,packetstormsecurity.com/files/117293/KeyHelp-ActiveX-LaunchTriPane-Remote-Code-Execution.html; classtype:attempted-user; sid:2016235; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_01_18, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CHAT Yahoo IM conference offer invitation"; flow: to_server,established; content:"YMSG"; nocase; depth: 4; content:"|00|P"; offset: 10; depth: 2; reference:url,doc.emergingthreats.net/2001262; classtype:policy-violation; sid:2001262; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Aloaha PDF Crypter activex SaveToFile method arbitrary file overwrite"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"B1E7505E-BBFD-42BF-98C9-602205A1504C"; nocase; distance:0; content:".SaveToFile"; nocase; distance:0; reference:url,exploit-db.com/exploits/24319/; classtype:attempted-user; sid:2016286; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_01_25, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CHAT Yahoo IM conference request"; flow: to_server,established; content:" $HOME_NET any (msg:"ET ACTIVEX Possible Ecava IntegraXor save method Remote ActiveX Buffer Overflow"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"520F4CFD-61C6-4EED-8004-C26D514D3D19"; nocase; distance:0; content:".save"; nocase; distance:0; reference:url,1337day.org/exploit/15398; classtype:attempted-user; sid:2016382; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_02_08, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CHAT Yahoo IM conference watch"; flow: from_server,established; content:"|0D 00 05 00|"; depth: 4; reference:url,doc.emergingthreats.net/2001264; classtype:policy-violation; sid:2001264; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL ACTIVEX Norton antivirus sysmspam.dll load attempt"; flow:to_client,established; content:"clsid|3A|"; nocase; content:"0534CF61-83C5-4765-B19B-45F7A4E135D0"; nocase; reference:bugtraq,9916; reference:cve,2004-0363; classtype:attempted-admin; sid:2102485; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tcp $EXTERNAL_NET 5050 <> $HOME_NET any (msg:"ET DELETED Yahoo Chat Activity Inside Webmail (2)"; flow:established,to_server; content:" $HOME_NET any (msg:"ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdSave Method Access Buffer Overflow"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"32B165C1-AD31-11D5-8889-0010A4C62D06"; nocase; distance:0; content:"cmdSave"; nocase; distance:0; reference:url,secunia.com/advisories/45511; classtype:attempted-user; sid:2014737; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_11, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CHAT IRC authorization message"; flow: established; content:"NOTICE AUTH"; content:"Looking up your hostname..."; nocase; reference:url,doc.emergingthreats.net/2000355; classtype:misc-activity; sid:2000355; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdExport Method Access Buffer Overflow"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"32B165C1-AD31-11D5-8889-0010A4C62D06"; nocase; distance:0; content:"cmdExport"; nocase; distance:0; reference:url,secunia.com/advisories/45511; classtype:attempted-user; sid:2014739; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_11, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY IRC connection"; flow: established; content:"Welcome to the "; content:"IRC Network"; nocase; reference:url,doc.emergingthreats.net/2000356; classtype:misc-activity; sid:2000356; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdSave Method Access Buffer Overflow 2"; flow:to_client,established; file_data; content:"ActiveXObject"; nocase; content:"ThreeDify.ThreeDifyDesigner.1"; nocase; distance:0; content:"cmdSave"; nocase; distance:0; reference:url,secunia.com/advisories/45511; classtype:attempted-user; sid:2014738; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_11, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert ip any any -> any any (msg:"ET POLICY EIN in the clear (US-IRS Employer ID Number)"; pcre:"/ \d\d-\d{7} /"; reference:url,policy.ssa.gov/poms.nsf/lnx/0101001004; reference:url,policy.ssa.gov/poms.nsf/lnx/0101001001?opendocument; reference:url,doc.emergingthreats.net/2002658; classtype:policy-violation; sid:2002658; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdExport Method Access Buffer Overflow 2"; flow:to_client,established; file_data; content:"ActiveXObject"; nocase; content:"ThreeDify.ThreeDifyDesigner.1"; nocase; distance:0; content:"cmdExport"; nocase; distance:0; reference:url,secunia.com/advisories/45511; classtype:attempted-user; sid:2014740; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_11, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET DELETED Possible Image Spam Inbound (simple rule)"; flow:established,to_server; content:"Content-Transfer-Encoding|3A|"; content:"AMAgAOAgAABAACBAAEBAAGBAAIBAAKBAAMBAAOBAAABgACBgAEBgAGBgAIBgAKBgAMBgAOBg"; depth:575; content:"AACAACCAAECAAGCAAICAAKCAAMCAAOCAAACgACCgAECgAGCgAICgAKCgAMCgAOCgAADAACDA"; content:"AEDAAGDAAIDAAKDAAMDAAODAAADgACDgAEDgAGDgAIDgAKDgAMDgAODgAAAAQCAAQEAAQGAA"; reference:url,doc.emergingthreats.net/2003096; classtype:misc-activity; sid:2003096; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdImport Method Access Buffer Overflow"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"32B165C1-AD31-11D5-8889-0010A4C62D06"; nocase; distance:0; content:"cmdImport"; nocase; distance:0; reference:url,secunia.com/advisories/45511; classtype:attempted-user; sid:2014741; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_11, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET DELETED Possible Image Spam Inbound (complex rule)"; flow:established,to_server; content:"Content-Transfer-Encoding|3A|"; content:"AMAgAOAgAABAACBAAEBAAGBAAIBAAKBAAMBAAOBAAABgACBgAEBgAGBgAIBgAKBgAMBgAOBg"; depth:575; content:"AACAACCAAECAAGCAAICAAKCAAMCAAOCAAACgACCgAECgAGCgAICgAKCgAMCgAOCgAADAACDA"; content:"AEDAAGDAAIDAAKDAAMDAAODAAADgACDgAEDgAGDgAIDgAKDgAMDgAODgAAAAQCAAQEAAQGAA"; content:"QIAAQKAAQMAAQOAAQAAgQCAgQEAgQGAgQIAgQKAgQMAgQOAgQABAQCBAQEBAQGBAQIBAQKBA"; content:"QMBAQOBAQABgQCBgQEBgQGBgQIBgQKBgQMBgQOBgQACAQCCAQECAQGCAQICAQKCAQMCAQOCA"; content:"QACgQCCgQECgQGCgQICgQKCgQMCgQOCgQADAQCDAQEDAQGDAQIDAQKDAQMDAQODAQADgQCDg"; content:"QEDgQGDgQIDgQKDgQMDgQODgQAAAgCAAgEAAgGAAgIAAgKAAgMAAgOAAgAAggCAggEAggGAg"; content:"gIAggKAggMAggOAggABAgCBAgEBAgGBAgIBAgKBAgMBAgOBAgABggCBggEBggGBggIBggKBg"; content:"gMBggOBggACAgCCAgECAgGCAgICAgKCAgMCAgOCAgACggCCggECggGCggICggKCggMCggOCg"; content:"gADAgCDAgEDAgGDAgIDAgKDAgMDAgODAgADggCDggEDggGDggIDggKDggMDggODggAAAwCAA"; content:"wEAAwGAAwIAAwKAAwMAAwOAAwAAgwCAgwEAgwGAgwIAgwKAgwMAgwOAgwABAwCBAwEBAwGBA"; content:"wIBAwKBAwMBAwOBAwABgwCBgwEBgwGBgwIBgwKBgwMBgwOBgwACAwCCAwECAwGCAwICAwKCA"; content:"wMCAwOCAwACgwCCgwECgwGCgwICgwKCgwMCgwOCgwADAwCDAwEDAwGDAwIDAwKDAwP/78KCg"; reference:url,doc.emergingthreats.net/2003097; classtype:misc-activity; sid:2003097; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdImport Method Access Buffer Overflow 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"ThreeDify.ThreeDifyDesigner.1"; nocase; distance:0; content:"cmdImport"; nocase; distance:0; reference:url,secunia.com/advisories/45511; classtype:attempted-user; sid:2014742; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_11, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET DELETED Possible Image Spam Inbound (3)"; flow:established,to_server; content:"Content-Transfer-Encoding|3A|"; content:"R0lGODlh"; depth:575; content:"AOAgAABAACBAAEBAAGBAAIBAAKBAAMBAAOBAAABgACBgAEBgAGBgAIBgAKBgAMBgAOBgAACAACCA"; content:"AECAAGCAAICAAKCAAMCAAOCAAACgACCgAECgAGCgAICgAKCgAMCgAOCgAADAACDAAEDAAGDAAIDA"; reference:url,doc.emergingthreats.net/2003120; classtype:misc-activity; sid:2003120; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdOpen Method Access Buffer Overflow"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"32B165C1-AD31-11D5-8889-0010A4C62D06"; nocase; distance:0; content:"cmdOpen"; nocase; distance:0; reference:url,secunia.com/advisories/45511; classtype:attempted-user; sid:2014743; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_11, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY MP3 File Transfer Outbound"; flow:established; content:"ID3|03|"; content:"TIT2"; distance:6; within:10; reference:url,filext.com/detaillist.php?extdetail=mp3&Search=Search; reference:url,doc.emergingthreats.net/2002722; classtype:policy-violation; sid:2002722; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Potential ThreeDify Designer ActiveX Control cmdOpen Method Access Buffer Overflow 2"; flow:to_client,established; file_data; content:"ActiveXObject"; nocase; content:"ThreeDify.ThreeDifyDesigner.1"; nocase; distance:0; content:"cmdOpen"; nocase; distance:0; reference:url,secunia.com/advisories/45511; classtype:attempted-user; sid:2014744; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_11, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY MP3 File Transfer Inbound"; flow: established; content:"ID3|03|"; content:"TIT2"; distance:6; within:10; reference:url,filext.com/detaillist.php?extdetail=mp3&Search=Search; reference:url,doc.emergingthreats.net/2002723; classtype:policy-violation; sid:2002723; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Chilkat Software FTP2 ActiveX Component GetFile Access Remote Code Execution"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"302124C4-30A0-484A-9C7A-B51D5BA5306B"; nocase; distance:0; content:".GetFile"; nocase; distance:0; reference:url,packetstormsecurity.org/files/97160/Chilkat-Software-FTP2-ActiveX-Code-Execution.html; classtype:attempted-user; sid:2014763; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_18, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert udp $HOME_NET any -> $EXTERNAL_NET 3544 (msg:"ET POLICY Microsoft TEREDO IPv6 tunneling"; content:"|FE 80 00 00 00 00 00 00 80 00|TEREDO"; offset:21; depth:16; reference:url,doc.emergingthreats.net/2003155; classtype:misc-activity; sid:2003155; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible NET-i viewer ActiveX Control ConnectDDNS Method Access Code Execution Vulnerability 2"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"17A7F731-C9EC-461C-B813-2F42A1BB58EB"; nocase; distance:0; content:"ConnectDDNS"; nocase; distance:0; reference:url,secunia.com/advisories/48965/; classtype:attempted-user; sid:2014877; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_06_08, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> 76.74.9.18 $HTTP_PORTS (msg:"ET DELETED Milw0rm Exploit Archive Download"; content:"GET /sploits/milw0rm.tar.bz2"; depth:60; flow:to_server,established; reference:url,www.milw0rm.com; reference:url,doc.emergingthreats.net/2008524; classtype:misc-activity; sid:2008524; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Chilkat Software FTP2 ActiveX Component GetFile Access Remote Code Execution 2"; flow:to_client,established; file_data; content:"ActiveXObject"; nocase; content:"ChilkatFtp2.ChilkatFtp2.1"; nocase; distance:0; content:".GetFile"; nocase; distance:0; reference:url,packetstormsecurity.org/files/97160/Chilkat-Software-FTP2-ActiveX-Code-Execution.html; classtype:attempted-user; sid:2014764; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_18, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert udp any any -> any any (msg:"ET POLICY Netop Remote Control Usage"; content:"|554b30303736305337473130|"; reference:url,www.netop.com; reference:url,doc.emergingthreats.net/2001597; classtype:policy-violation; sid:2001597; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible NET-i viewer ActiveX Control ConnectDDNS Method Access Code Execution Vulnerability"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"EEDBA32E-5C2D-48f1-A58E-0AAB0BC230E3"; nocase; distance:0; content:"ConnectDDNS"; nocase; distance:0; reference:url,secunia.com/advisories/48965/; classtype:attempted-user; sid:2014876; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_06_08, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any $SSH_PORTS (msg:"ET POLICY SSHv2 Client New Keys detected on Expected Port"; flowbits:noalert; flowbits:isset,is_ssh_client_kex; flow: from_client,established; byte_test:1,=,21,5; flowbits: set,is_proto_ssh; reference:url,doc.emergingthreats.net/2001977; classtype:misc-activity; sid:2001977; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Windows Live Writer ActiveX BlogThisLink Method Access Denail of Service Attack"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"8F085BC0-363D-4219-95BA-DC8A5E06D295"; nocase; distance:0; content:"BlogThisLink"; nocase; distance:0; reference:url,1337day.com/exploits/17583; classtype:attempted-user; sid:2014765; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_18, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp any any -> any !$SSH_PORTS (msg:"ET POLICY SSHv2 Client New Keys Detected on Unusual Port"; flowbits:isset,is_ssh_client_kex; flowbits:noalert; flow: from_client,established; byte_test:1,=,21,5; flowbits: set,is_proto_ssh; reference:url,doc.emergingthreats.net/2001983; classtype:misc-activity; sid:2001983; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible NET-i viewer ActiveX Control BackupToAvi Method Access Buffer Overflow 2"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"208650B1-3CA1-4406-926D-45F2DBB9C299"; nocase; distance:0; content:"BackupToAvi"; nocase; distance:0; reference:url,secunia.com/advisories/48966/; classtype:attempted-user; sid:2014875; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_06_08, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 16680 (msg:"ET POLICY OperaUnite URL Registration"; flow:to_server,established; content:"REGISTER"; offset:0; depth:8; content:"operaunite.com"; within:109; reference:url,unite.opera.com; reference:url,doc.emergingthreats.net/2009895; classtype:policy-violation; sid:2009895; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible NET-i viewer ActiveX Control BackupToAvi Method Access Buffer Overflow"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"3D6F2DBA-F4E5-40A6-8725-E99BC96CC23A"; nocase; distance:0; content:"BackupToAvi"; nocase; distance:0; reference:url,secunia.com/advisories/48966/; classtype:attempted-user; sid:2014874; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_06_08, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> any !$HTTP_PORTS (msg:"ET DELETED PCMesh Anonymous Proxy client connect"; flow: from_client,established; content:"http|3a|//www.pcmesh.com|3a|80/ip-check.cgi"; depth:37; offset:4; reference:url,doc.emergingthreats.net/2003040; classtype:policy-violation; sid:2003040; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Windows Live Writer ActiveX BlogThisLink Method Access Denail of Service Attack 2"; flow:to_client,established; file_data; content:"ActiveXObject"; nocase; content:"WindowsLiveWriterApplicationLib.WindowsLiveWriterApplication"; nocase; distance:0; content:"BlogThisLink"; nocase; distance:0; reference:url,1337day.com/exploits/17583; classtype:attempted-user; sid:2014766; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_18, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Prospero Chat Session in Progress"; flow: established,to_server; content:"PCHAT2 "; offset: 0; depth: 7; content:"v='"; nocase; offset: 8; depth: 400; content:"jv='"; nocase; offset: 8; depth: 400; content:"u='"; nocase; offset: 8; depth: 400; reference:url,www.prospero.com/technology.htm; reference:url,doc.emergingthreats.net/2001989; classtype:policy-violation; sid:2001989; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible SonicWALL SSL-VPN End-Point Interrogator/Installer ActiveX Control Install3rdPartyComponent Method Buffer Overflow"; flow:to_client,established; file_data; content:"ActiveXObject"; nocase; content:"Aventail.EPInstaller"; nocase; distance:0; content:"Install3rdPartyComponent"; nocase; distance:0; reference:url,packetstormsecurity.org/files/95286/SonicWALL-SSL-VPN-End-Point-Interrogator-Installer-ActiveX-Control.html; classtype:attempted-user; sid:2014835; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_06_01, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY TRACE Request - outbound"; flow: to_server,established; content:"TRACE "; nocase; depth: 6; reference:url,doc.emergingthreats.net/2010767; classtype:bad-unknown; sid:2010767; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible LEADTOOLS ActiveX Raster Twain AppName Method Access Buffer Overflow 2"; flow:to_client,established; file_data; content:"ActiveXObject"; nocase; content:"LTRASTERTWAINLib_U.LEADRasterTwain_U"; nocase; distance:0; content:".AppName"; nocase; distance:0; reference:url,packetstormsecurity.org/files/93252/LEADTOOLS-ActiveX-Raster-Twain-16.5-Buffer-Overflow.html; classtype:attempted-user; sid:2014834; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_06_01, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET 3389 -> $EXTERNAL_NET any (msg:"ET POLICY RDP connection confirm"; flow: from_server,established; content:"|03|"; offset: 0; depth: 1; content:"|D0|"; offset: 5; depth: 1; reference:url,doc.emergingthreats.net/2001330; classtype:misc-activity; sid:2001330; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible SkinCrafter ActiveX Control InitLicenKeys Method Access Buffer Overflow"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"B9D38E99-5F6E-4C51-8CFD-507804387AE9"; nocase; distance:0; content:"InitLicenKeys"; nocase; distance:0; reference:url,exploit-db.com/exploits/18892/; classtype:attempted-user; sid:2014806; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_25, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Real.com Game Arcade Install (User agent)"; flow: established,to_server; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+ARCADE_BUNDLE_DOWNLOADER/i"; reference:url,doc.emergingthreats.net/2003045; classtype:policy-violation; sid:2003045; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible LEADTOOLS ActiveX Raster Twain AppName Method Access Buffer Overflow"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"00165752-B1BA-11CE-ABC6-F5B2E79D9E3F"; nocase; distance:0; content:".AppName"; nocase; distance:0; reference:url,packetstormsecurity.org/files/93252/LEADTOOLS-ActiveX-Raster-Twain-16.5-Buffer-Overflow.html; classtype:attempted-user; sid:2014833; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_06_01, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Real.com Game Arcade Install"; flow: established,to_server; content:"/gameconsole/bundlescripts/"; reference:url,doc.emergingthreats.net/2003046; classtype:policy-violation; sid:2003046; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Wireless Manager Sony VAIO ConnectToNetwork Method Access Buffer Overflow"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"92E7DDED-BBFE-4DDF-B717-074E3B602D1B"; nocase; distance:0; content:"ConnectToNetwork"; nocase; distance:0; reference:url,packetstormsecurity.org/files/113131/Wireless-Manager-Sony-VAIO-4.0.0.0-Buffer-Overflows.html; classtype:attempted-user; sid:2014832; rev:4; metadata:created_at 2012_06_01, updated_at 2012_06_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY VNC Authentication Successful"; flowbits:isset,BSvnc.auth.agreed; flow:established; dsize:4; content:"|00 00 00 00|"; depth:4; flowbits:unset,BSvnc.auth.agreed; flowbits:unset,BSis.vnc.setup; reference:url,www.cl.cam.ac.uk/Research/DTG/attarchive/vnc/rfbproto.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2002922; classtype:not-suspicious; sid:2002922; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Wireless Manager Sony VAIO SetTmpProfileOption Method Access Buffer Overflow"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"92E7DDED-BBFE-4DDF-B717-074E3B602D1B"; nocase; distance:0; content:"SetTmpProfileOption"; nocase; distance:0; reference:url,packetstormsecurity.org/files/113131/Wireless-Manager-Sony-VAIO-4.0.0.0-Buffer-Overflows.html; classtype:attempted-user; sid:2014831; rev:3; metadata:created_at 2012_06_01, updated_at 2012_06_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY VNC Authentication Failure"; flowbits:isset,BSvnc.auth.agreed; flow:established; dsize:<50; content:"|00 00 00 01|"; depth:4; reference:url,www.cl.cam.ac.uk/Research/DTG/attarchive/vnc/rfbproto.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2002920; classtype:attempted-admin; sid:2002920; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible SkinCrafter ActiveX Control InitLicenKeys Method Access Buffer Overflow 2"; flow:to_client,established; file_data; content:"ActiveXObject"; nocase; content:"SKINCRAFTERLib.SCSkin3"; nocase; distance:0; content:"InitLicenKeys"; nocase; distance:0; reference:url,exploit-db.com/exploits/18892/; classtype:attempted-user; sid:2014807; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_25, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE SC-KeyLog Keylogger Installed - Sending Initial Email Report"; flow:established,to_server; content:"Installation of SC-KeyLog on host "; nocase; content:"

You will receive a log report every "; nocase; reference:url,www.soft-central.net/keylog.php; reference:url,doc.emergingthreats.net/2002979; classtype:trojan-activity; sid:2002979; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible IBM Lotus Quickr for Domino ActiveX control Import_Times Method Access buffer overflow Attempt"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"05D96F71-87C6-11d3-9BE4-00902742D6E0"; nocase; distance:0; content:"Import_Times"; nocase; distance:0; reference:url,secunia.com/advisories/49285/; classtype:attempted-user; sid:2014809; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_25, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE SC-KeyLog Keylogger Installed - Sending Log Email Report"; flow:established,to_server; content:"SC-KeyLog log report"; nocase; content:"See attached file"; nocase; content:".log"; nocase; reference:url,www.soft-central.net/keylog.php; reference:url,doc.emergingthreats.net/2008348; classtype:trojan-activity; sid:2008348; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible IBM Lotus Quickr for Domino ActiveX control Attachment_Times Method Access buffer overflow Attempt"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"05D96F71-87C6-11d3-9BE4-00902742D6E0"; nocase; distance:0; content:"Attachment_Times"; nocase; distance:0; reference:url,secunia.com/advisories/49285/; classtype:attempted-user; sid:2014808; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_25, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET POLICY Known SSL traffic on port 443 being excluded from SSL Alerts"; flow:established,to_server; flowbits:noalert; flowbits:set,BS.SSL.Known.Port; reference:url,doc.emergingthreats.net/2003026; classtype:not-suspicious; sid:2003026; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX SigPlus Pro 3.74 ActiveX LCDWriteString Method Remote Buffer Overflow"; flow:established,to_client; file_data; content:"clsid"; nocase; content:"69A40DA3-4D42-11D0-86B0-0000C025864A"; nocase; distance:0; content:"clsid"; nocase; distance:0; content:"D27CDB6E-AE6D-11cf-96B8-444553540000"; nocase; distance:0; content:"|2e|LCDWriteString"; distance:0; pcre:"/]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*69A40DA3-4D42-11D0-86B0-0000C025864A\s*}?(.*)\>/si"; pcre:"/]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*D27CDB6E-AE6D-11cf-96B8-444553540000\s*}?(.*)\>/si"; reference:cve,2010-2931; reference:url,www.exploit-db.com/exploits/14514/; classtype:attempted-user; sid:2012134; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_01_05, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 9001 (msg:"ET POLICY Known SSL traffic on port 9001 (aol) being excluded from SSL Alerts"; flow:established,to_server; flowbits:noalert; flowbits:set,BS.SSL.Known.Port; reference:url,doc.emergingthreats.net/2004598; classtype:not-suspicious; sid:2004598; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX SoftArtisans XFile FileManager ActiveX Buildpath method stack overflow Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"E7B62F4E-82F4-11D2-BD41-00105A0A7E89"; nocase; distance:0; content:"BuildPath"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89/si"; reference:url,www.kb.cert.org/vuls/id/914785; reference:url,www.packetstormsecurity.nl/0911-exploits/softartisans_getdrivename.rb.txt; reference:url,osvdb.org/47794; reference:url,doc.emergingthreats.net/2010746; classtype:attempted-user; sid:2010746; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 8000 (msg:"ET POLICY Known SSL traffic on port 8000 being excluded from SSL Alerts"; flow:established,to_server; flowbits:noalert; flowbits:set,BS.SSL.Known.Port; reference:url,doc.emergingthreats.net/2003027; classtype:not-suspicious; sid:2003027; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX SoftArtisans XFile FileManager ActiveX stack overfow Function call Attempt"; flow:from_server,established; content:"ActiveXObject"; nocase; content:"SoftArtisans.FileManager.1"; distance:0; nocase; pcre:"/(Buildpath|GetDriveName|DriveExists|DeleteFile)/i"; reference:url,www.kb.cert.org/vuls/id/914785; reference:url,www.packetstormsecurity.nl/0911-exploits/softartisans_getdrivename.rb.txt; reference:url,osvdb.org/47794; reference:url,doc.emergingthreats.net/2010745; classtype:attempted-user; sid:2010745; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 8080 (msg:"ET POLICY Known SSL traffic on port 8080 being excluded from SSL Alerts"; flow:established,to_server; flowbits:noalert; flowbits:set,BS.SSL.Known.Port; reference:url,doc.emergingthreats.net/2003028; classtype:not-suspicious; sid:2003028; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX SoftArtisans XFile FileManager ActiveX GetDriveName method stack overflow Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"E7B62F4E-82F4-11D2-BD41-00105A0A7E89"; nocase; distance:0; content:"GetDriveName"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89/si"; reference:url,www.kb.cert.org/vuls/id/914785; reference:url,www.packetstormsecurity.nl/0911-exploits/softartisans_getdrivename.rb.txt; reference:url,osvdb.org/47794; reference:url,doc.emergingthreats.net/2010747; classtype:attempted-user; sid:2010747; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 8200 (msg:"ET POLICY Known SSL traffic on port 8200 being excluded from SSL Alerts"; flow:established,to_server; flowbits:noalert; flowbits:set,BS.SSL.Known.Port; reference:url,doc.emergingthreats.net/2003029; classtype:not-suspicious; sid:2003029; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX SoftArtisans XFile FileManager ActiveX DriveExists method stack overflow Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"E7B62F4E-82F4-11D2-BD41-00105A0A7E89"; nocase; distance:0; content:"DriveExists"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89/si"; reference:url,www.kb.cert.org/vuls/id/914785; reference:url,www.packetstormsecurity.nl/0911-exploits/softartisans_getdrivename.rb.txt; reference:url,osvdb.org/47794; reference:url,doc.emergingthreats.net/2010748; classtype:attempted-user; sid:2010748; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 8443 (msg:"ET POLICY Known SSL traffic on port 8443 being excluded from SSL Alerts"; flow:established,to_server; flowbits:noalert; flowbits:set,BS.SSL.Known.Port; reference:url,doc.emergingthreats.net/2003030; classtype:not-suspicious; sid:2003030; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX SoftArtisans XFile FileManager ActiveX DeleteFile method stack overflow Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"E7B62F4E-82F4-11D2-BD41-00105A0A7E89"; nocase; distance:0; content:"DeleteFile"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89/si"; reference:url,www.kb.cert.org/vuls/id/914785; reference:url,www.packetstormsecurity.nl/0911-exploits/softartisans_getdrivename.rb.txt; reference:url,osvdb.org/47794; reference:url,doc.emergingthreats.net/2010749; classtype:attempted-user; sid:2010749; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 5222 (msg:"ET CHAT Known SSL traffic on port 5222 (Jabber) being excluded from SSL Alerts"; flow:established,to_server; flowbits:noalert; flowbits:set,BS.SSL.Known.Port; reference:url,doc.emergingthreats.net/2003031; classtype:not-suspicious; sid:2003031; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX HP Easy Printer Care Software XMLCacheMgr ActiveX Control Remote Code Execution Attempt"; flow:established,to_client; content:"ActiveXObject"; nocase; content:"HPESPRIT.XMLCacheMgr.1"; nocase; distance:0; content:"CacheDocumentXMLWithId"; nocase; distance:0; reference:bid,51396; reference:cve,2011-4786; classtype:attempted-user; sid:2014132; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_01_18, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 5223 (msg:"ET CHAT Known SSL traffic on port 5223 (Jabber) being excluded from SSL Alerts"; flow:established,to_server; flowbits:noalert; flowbits:set,BS.SSL.Known.Port; reference:url,doc.emergingthreats.net/2003032; classtype:not-suspicious; sid:2003032; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX J-Integra ActiveX SetIdentity Buffer Overflow"; flow:established,to_client; content:"clsid"; nocase; content:"8234E54E-20CB-4A88-9AB6-7986F99BE243"; nocase; content:"|2e|SetIdentity"; distance:0; pcre:"/]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*8234E54E-20CB-4A88-9AB6-7986F99BE243\s*}?\s*(.*)(\s|>)/si"; reference:url,www.exploit-db.com/exploits/15655; classtype:attempted-user; sid:2012098; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_12_23, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 2967 (msg:"ET POLICY Known SSL traffic on port 2967 (Symantec) being excluded from SSL Alerts"; flow:established,to_server; flowbits:noalert; flowbits:set,BS.SSL.Known.Port; reference:url,doc.emergingthreats.net/2003033; classtype:not-suspicious; sid:2003033; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX J-Integra Remote Code Execution"; flow:established,to_client; content:"clsid"; nocase; content:"F21507A7-530F-4A89-8FE4-9D989670FD2C"; nocase; distance:0; pcre:"/]*\s*classid\s*=\s*(\x22|\x27)\s*clsid\s*\x3a\s*{?\s*F21507A7-530F-4A89-8FE4-9D989670FD2C\s*}?\s*(.*)(\s|)/si"; pcre:"/\x2e[RemoveAccessPermission|AddLaunchPermission|AddAccessPermission|RemoveLaunchPermission]/"; reference:url,www.exploit-db.com/exploits/15648; classtype:attempted-user; sid:2012095; rev:3; metadata:created_at 2010_12_23, updated_at 2010_12_23;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 3128 (msg:"ET POLICY Known SSL traffic on port 3128 (proxy) being excluded from SSL Alerts"; flow:established,to_server; flowbits:noalert; flowbits:set,BS.SSL.Known.Port; reference:url,doc.emergingthreats.net/2003035; classtype:not-suspicious; sid:2003035; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX WMITools ActiveX Remote Code Execution"; flow:established,to_client; content:"clsid"; nocase; content:"2745E5F5-D234-11D0-847A-00C04FD7BB08"; nocase; distance:0; content:"|2e|AddContextRef"; distance:0; pcre:"/]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08\s*}?(.*)\>/si"; reference:url,www.exploit-db.com/exploits/15809/; classtype:attempted-user; sid:2012097; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_12_23, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 8080 (msg:"ET POLICY Known SSL traffic on port 8080 (proxy) being excluded from SSL Alerts"; flow:established,to_server; flowbits:noalert; flowbits:set,BS.SSL.Known.Port; reference:url,doc.emergingthreats.net/2003036; classtype:not-suspicious; sid:2003036; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX COM Object Instantiation Memory Corruption Vulnerability MS05-054"; flow:established,from_server; pcre:"/000(2(042[1-5]|1401|000D)|6F071)-0000-0000-C000-000000000046|6E2271(FB|0[9A-F])-F799-11CF-9227-00AA00A1EB95|ECAB(AFC0|B0AB)-7F19-11D2-978E-0000F8757E2A|3050F4F5-98B5-11CF-BB82-00AA00BDCE0B|DF0B3D60-548F-101B-8E65-08002B2BD119|2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64|51B4ABF3-748F-4E3B-A276-C828330E926A|E4979309-7A32-495E-8A92-7B014AAD4961|62EC9F22-5E30-11D2-97A1-00C04FB6DD9A|B1D4ED44-EE64-11D0-97E6-00C04FC30B4A|D675E22B-CAE9-11D2-AF7B-00C04F99179F/i"; reference:cve,2005-2831; reference:url,www.microsoft.com/technet/security/bulletin/ms05-054.mspx; reference:url,doc.emergingthreats.net/2002725; classtype:web-application-attack; sid:2002725; rev:14; metadata:created_at 2010_07_30, updated_at 2016_04_25;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 8292 (msg:"ET POLICY Known SSL traffic on port 8292 (Bloomberg) being excluded from SSL Alerts"; flow:established,to_server; flowbits:noalert; flowbits:set,BS.SSL.Known.Port; reference:url,doc.emergingthreats.net/2003037; classtype:not-suspicious; sid:2003037; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX winhlp32 ActiveX control attack - phase 1"; flowbits:noalert; flow: to_client,established; file_data; content:"|3C|OBJECT"; nocase; content:"application/x-oleobject"; nocase; within:64; content:"codebase="; nocase; content:"hhctrl.ocx"; nocase; within:15; flowbits:set,winhlp32; reference:url,doc.emergingthreats.net/bin/view/Main/2001622; classtype:web-application-attack; sid:2001622; rev:16; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ACTIVEX, signature_severity Major, tag ActiveX, updated_at 2017_05_08;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 8294 (msg:"ET POLICY Known SSL traffic on port 8294 (Bloomberg) being excluded from SSL Alerts"; flow:established,to_server; flowbits:noalert; flowbits:set,BS.SSL.Known.Port; reference:url,doc.emergingthreats.net/2003038; classtype:not-suspicious; sid:2003038; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX winhlp32 ActiveX control attack - phase 2"; flow:to_client,established; flowbits:isset,winhlp32; file_data; content:"|3C|PARAM"; nocase; content:"value="; nocase; content:"command|3B|"; nocase; pcre:"/(javascript|http|ftp|vbscript)/iR"; reference:url,doc.emergingthreats.net/bin/view/Main/2001623; classtype:web-application-attack; sid:2001623; rev:15; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ACTIVEX, signature_severity Major, tag ActiveX, updated_at 2017_05_08;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1521 (msg:"ET POLICY Known SSL traffic on port 1521 (Oracle) being excluded from SSL Alerts"; flow:established,to_server; flowbits:noalert; flowbits:set,BS.SSL.Known.Port; reference:url,doc.emergingthreats.net/2003934; classtype:not-suspicious; sid:2003934; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX winhlp32 ActiveX control attack - phase 3"; flow:to_client, established; flowbits:isset,winhlp32; file_data; content:".HHClick|2829|"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2001624; classtype:web-application-attack; sid:2001624; rev:15; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ACTIVEX, signature_severity Major, tag ActiveX, updated_at 2017_05_08;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 995 (msg:"ET POLICY Known SSL traffic on port 995 (imaps) being excluded from SSL Alerts"; flow:established,to_server; flowbits:noalert; flowbits:set,BS.SSL.Known.Port; reference:url,doc.emergingthreats.net/2008543; classtype:not-suspicious; sid:2008543; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX AVTECH Software ActiveX SendCommand Method Buffer Overflow Attempt"; flow:established,to_client; content:" $EXTERNAL_NET 1024:65535 (msg:"ET POLICY TLS/SSL Client Hello on Unusual Port TLS"; flowbits:isnotset,BS.SSL.Known.Port; flowbits:isnotset,BS.SSL.Client.Hello; flow:established,to_server; content:"|16 03 01|"; depth:3; content:"|01|"; within:6; content:"|03 01|"; within:5; flowbits:set,BS.SSL.Client.Hello; flowbits:noalert; reference:url,doc.emergingthreats.net/2003002; classtype:unusual-client-port-connection; sid:2003002; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX AVTECH Software ActiveX Login Method Buffer Oveflow Attempt"; flow:established,to_client; content:" $EXTERNAL_NET 1024:65535 (msg:"ET POLICY TLS/SSL Client Hello on Unusual Port SSLv3"; flowbits:isnotset,BS.SSL.Known.Port; flowbits:isnotset,BS.SSL.Client.Hello; flow:established,to_server; content:"|16 03 00|"; depth:3; content:"|01|"; within:2; content:"|03 00|"; within:3; flowbits:set,BS.SSL.Client.Hello; flowbits:noalert; reference:url,doc.emergingthreats.net/2003003; classtype:unusual-client-port-connection; sid:2003003; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX AVTECH Software ActiveX _DownloadPBOpen Method Buffer Overflow Attempt"; flow:established,to_client; content:" $EXTERNAL_NET 1024:65535 (msg:"ET POLICY TLS/SSL Client Hello on Unusual Port Case 2"; flowbits:isnotset,BS.SSL.Known.Port; flowbits:isnotset,BS.SSL.Client.Hello; flow:established; content:"|01 03 01|"; depth:5; offset:2; flowbits:set,BS.SSL.Client.Hello; flowbits:noalert; reference:url,doc.emergingthreats.net/2003004; classtype:unusual-client-port-connection; sid:2003004; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX AVTECH Software ActiveX _DownloadPBClose Method Buffer Overflow Attempt"; flow:established,to_client; content:" $EXTERNAL_NET 1024:65535 (msg:"ET POLICY TLS/SSL Client Hello on Unusual Port SSLv3"; flowbits:isnotset,BS.SSL.Known.Port; flowbits:isnotset,BS.SSL.Client.Hello; flow:established; content:"|01 03 00|"; depth:5; flowbits:set,BS.SSL.Client.Hello; flowbits:noalert; reference:url,doc.emergingthreats.net/2003005; classtype:unusual-client-port-connection; sid:2003005; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX AVTECH Software ActiveX Snapshot Method Buffer Overflow Attempt"; flow:established,to_client; content:" $EXTERNAL_NET 1024:65535 (msg:"ET POLICY TLS/SSL Client Cipher Set on Unusual Port"; flowbits:isset,BS.SSL.Client.Hello; flow:established; content:"|14 03 01 00 01 01|"; flowbits:set,BS.SSL.Client.Cipher; flowbits:noalert; reference:url,doc.emergingthreats.net/2003008; classtype:unusual-client-port-connection; sid:2003008; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX AVTECH Software ActiveX _DownloadPBControl Method Buffer Overflow Attempt"; flow:established,to_client; content:" $EXTERNAL_NET 1024:65535 (msg:"ET POLICY TLS/SSL Client Cipher Set on Unusual Port SSLv3"; flowbits:isset,BS.SSL.Client.Hello; flow:established; content:"|14 03 00 00 01 01|"; flowbits:set,BS.SSL.Client.Cipher; flowbits:noalert; reference:url,doc.emergingthreats.net/2003009; classtype:unusual-client-port-connection; sid:2003009; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX AVTECH Software ActiveX Buffer Overflow Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"AVC781Viewer.CV781Object"; nocase; distance:0; pcre:"/(SendCommand|Login|Snapshot|_DownloadPBControl|_DownloadPBClose|_DownloadPBOpen)/i"; reference:url,zeroscience.mk/en/vulnerabilities/ZSL-2010-4934.php; reference:url,exploit-db.com/exploits/12294; reference:url,doc.emergingthreats.net/2011206; classtype:attempted-user; sid:2011206; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET POLICY TLS/SSL Server Hello on Unusual Port"; flowbits:isset,BS.SSL.Client.Hello; flow:established; content:"|16 03 01|"; depth:3; content:"|02|"; within:6; content:"|03 01|"; within:6; flowbits:set,BS.SSL.Server.Hello; flowbits:noalert; reference:url,doc.emergingthreats.net/2003010; classtype:unusual-client-port-connection; sid:2003010; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Adobe browser document ActiveX DoS Function call Attempt"; flow:from_server,established; content:"ActiveXObject"; nocase; content:"AcroPDFLib.AcroPDF"; distance:0; nocase; content:"src"; nocase; reference:url,www.packetstormsecurity.nl/0911-exploits/acropdf-dos.txt; reference:url,doc.emergingthreats.net/2010705; classtype:attempted-user; sid:2010705; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET POLICY TLS/SSL Server Hello on Unusual Port SSLv3"; flowbits:isset,BS.SSL.Client.Hello; flow:established; content:"|16 03 00|"; depth:3; content:"|02|"; within:6; content:"|03 00|"; within:6; flowbits:set,BS.SSL.Server.Hello; flowbits:noalert; reference:url,doc.emergingthreats.net/2003011; classtype:unusual-client-port-connection; sid:2003011; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Adobe browser document ActiveX DoS Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"CA8A9780-280D-11CF-A24D-444553540000"; nocase; distance:0; content:"src"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CA8A9780-280D-11CF-A24D-444553540000/si"; reference:url,www.packetstormsecurity.nl/0911-exploits/acropdf-dos.txt; reference:url,doc.emergingthreats.net/2010726; classtype:attempted-user; sid:2010726; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET POLICY TLS/SSL Server Key Exchange on Unusual Port"; flowbits:isset,BS.SSL.Client.Hello; flow:established; content:"|16 03 01|"; content:"|0c|"; within:6; flowbits:set,BS.SSL.Server.Key; flowbits:noalert; reference:url,doc.emergingthreats.net/2003014; classtype:unusual-client-port-connection; sid:2003014; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Ask.com Toolbar askBar.dll ActiveX ShortFormat Buffer Overflow Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"5A074B2B-F830-49DE-A31B-5BB9D7F6B407"; nocase; distance:0; content:"ShortFormat"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A074B2B-F830-49DE-A31B-5BB9D7F6B407/si"; reference:url,www.packetstormsecurity.nl/0911-exploits/ask_shortformat.rb.txt; reference:url,secunia.com/advisories/26960/; reference:url,doc.emergingthreats.net/2010921; classtype:web-application-attack; sid:2010921; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET POLICY TLS/SSL Server Key Exchange on Unusual Port SSLv3"; flowbits:isset,BS.SSL.Client.Hello; flow:established; content:"|16 03 00|"; content:"|0c|"; within:6; flowbits:set,BS.SSL.Server.Key; flowbits:noalert; reference:url,doc.emergingthreats.net/2003015; classtype:unusual-client-port-connection; sid:2003015; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible AOL SuperBuddy ActiveX Control Remote Code Execution Attempt"; flow:from_server,established; content:"189504B8-50D1-4AA8-B4D6-95C8F58A6414"; nocase; content:"SetSuperBuddy"; nocase; content:"//"; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*189504B8-50D1-4AA8-B4D6-95C8F58A6414/si"; reference:url,www.securityfocus.com/bid/36580/info; reference:url,www.securityfocus.com/archive/1/506889; reference:url,doc.emergingthreats.net/2010039; classtype:attempted-user; sid:2010039; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET DELETED TLS/SSL Server Hello Done on Unusual Port"; flowbits:isset,BS.SSL.Server.Key; flow:established; content:"|16 03 01|"; content:"|0e|"; within:6; flowbits:set,BS.SSL.Server.Hello.Done; flowbits:noalert; reference:url,doc.emergingthreats.net/2003016; classtype:unusual-client-port-connection; sid:2003016; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Awingsoft Web3D Player Remote Buffer Overflow"; flow:to_client,established; content:"17A54E7D-A9D4-11D8-9552-00E04CB09903"; nocase; content:"SceneURL"; nocase; reference:url,secunia.com/advisories/35764/; reference:url,milw0rm.com/exploits/9116; reference:url,shinnai.net/xplits/TXT_nsGUdeley3EHfKEV690p.html; reference:url,doc.emergingthreats.net/2009857; classtype:web-application-attack; sid:2009857; rev:8; metadata:created_at 2010_07_30, updated_at 2019_09_27;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET DELETED TLS/SSL Server Hello Done on Unusual Port SSLv3"; flowbits:isset,BS.SSL.Server.Key; flow:established; content:"|16 03 00|"; content:"|0e|"; within:6; flowbits:set,BS.SSL.Server.Hello.Done; flowbits:noalert; reference:url,doc.emergingthreats.net/2003017; classtype:unusual-client-port-connection; sid:2003017; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX ChilkatHttp ActiveX 2.3 Arbitrary Files Overwrite"; flow:to_client,established; content:"B973393F-27C7-4781-877D-8626AAEDF119"; nocase; pcre:"/.*\.(ini|exe|dll|bat|com|cab|txt)/Ri"; content:"SaveLastError"; nocase; reference:bugtraq,28546; reference:url,www.milw0rm.com/exploits/5338; reference:url,doc.emergingthreats.net/2008099; classtype:web-application-attack; sid:2008099; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET POLICY TLS/SSL Server Cipher Set on Unusual Port"; flowbits:isset,BS.SSL.Client.Cipher; flow:established; content:"|14 03 01 00 01|"; flowbits:set,BS.SSL.Established; flowbits:noalert; reference:url,doc.emergingthreats.net/2003018; classtype:unusual-client-port-connection; sid:2003018; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Dart Communications PowerTCP FTP for ActiveX DartFtp.dll Control Buffer Overflow"; flow:to_client,established; content:"39FDA070-61BA-11D2-AD84-00105A17B608"; nocase; content:"%5F%DC%02%10%cc"; nocase; distance:0; content:"SecretKey"; nocase; reference:bugtraq,31814; reference:url,www.milw0rm.com/exploits/6793; reference:url,doc.emergingthreats.net/2008683; classtype:web-application-attack; sid:2008683; rev:10; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET POLICY TLS/SSL Server Cipher Set on Unusual Port SSLv3"; flowbits:isset,BS.SSL.Client.Cipher; flow:established; content:"|14 03 00 00 01|"; flowbits:set,BS.SSL.Established; flowbits:noalert; reference:url,doc.emergingthreats.net/2003019; classtype:unusual-client-port-connection; sid:2003019; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Avaya CallPilot Unified Messaging ActiveX InstallFrom Method Access Attempt"; flow:to_client,established; content:" $EXTERNAL_NET 1024:65535 (msg:"ET POLICY TLS/SSL Encrypted Application Data on Unusual Port"; flowbits:isset,BS.SSL.Established; flow:established,to_server; content:"|17 03 01|"; depth:4; threshold:type limit, count 1, seconds 120, track by_src; reference:url,doc.emergingthreats.net/2003020; classtype:unusual-client-port-connection; sid:2003020; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Avaya CallPilot Unified Messaging ActiveX Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"NMWEBINST.NMWebInstCtrl.1"; nocase; distance:0; content:"InstallFrom"; nocase; reference:url,secunia.com/advisories/40184/; reference:bugtraq,40535; reference:url,doc.emergingthreats.net/2011681; classtype:attempted-user; sid:2011681; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET POLICY TLS/SSL Encrypted Application Data on Unusual Port SSLv3"; flowbits:isset,BS.SSL.Established; flow:established,to_server; content:"|17 03 00|"; depth:4; threshold:type limit, count 1, seconds 120, track by_src; reference:url,doc.emergingthreats.net/2003021; classtype:unusual-client-port-connection; sid:2003021; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Axis Media Controller ActiveX SetImage Method Remote Code Execution Attempt"; flow:to_client,established; content:" any any (msg:"ET POLICY SSN Detected in Clear Text (dashed)"; pcre:"/ ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2])-\d{2}-\d{4} /"; reference:url,doc.emergingthreats.net/2001328; classtype:policy-violation; sid:2001328; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX DjVu DjVu_ActiveX_MSOffice.dll ActiveX Component Heap Buffer Overflow"; flow:to_client,established; content:"CLSID"; nocase; content:"4A46B8CD-F7BD-11D4-B1D8-000102290E7C"; nocase; distance:0; content:"0x400000"; distance:0; content:"ImageURL"; nocase; reference:bugtraq,31987; reference:url,milw0rm.com/exploits/6878; reference:url,doc.emergingthreats.net/2008790; classtype:web-application-attack; sid:2008790; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;) -#alert ip any any -> any any (msg:"ET POLICY SSN Detected in Clear Text (spaced)"; pcre:"/ ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2]) \d{2} \d{4} /"; reference:url,doc.emergingthreats.net/2001384; classtype:policy-violation; sid:2001384; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX EasyMail Object SMTP Component Buffer Overflow Function call Attempt"; flow:from_server,established; content:"ActiveXObject"; nocase; content:"EasyMail.SMTP.6"; distance:0; nocase; pcre:"/(AddAttachment|SubmitToExpress)/i"; reference:url,secunia.com/advisories/24199/; reference:url,www.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/oracle_dc_submittoexpress.rb; reference:url,doc.emergingthreats.net/2010657; classtype:web-application-attack; sid:2010657; rev:6; metadata:created_at 2010_07_30, updated_at 2019_09_27;) -#alert ip any any -> any any (msg:"ET POLICY SSN Detected in Clear Text (SSN )"; content:"SSN "; nocase; pcre:"/SSN ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2])\d{6} /i"; reference:url,doc.emergingthreats.net/2007971; classtype:policy-violation; sid:2007971; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX AoA Audio Extractor ActiveX Control Buffer Overflow Attempt"; flow:to_client,established; content:" any any (msg:"ET POLICY SSN Detected in Clear Text (SSN# )"; content:"SSN# "; nocase; pcre:"/SSN# ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2])\d{6} /i"; reference:url,doc.emergingthreats.net/2007972; classtype:policy-violation; sid:2007972; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Microsoft DirectX 9 ActiveX Control Format String Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"MSVidCtlLib.MSVidVMR9"; nocase; distance:0; content:".CustomCompositorClass"; nocase; reference:url,packetstorm.linuxsecurity.com/1009-exploits/msvidctl-activex.txt; classtype:attempted-user; sid:2011590; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_10_02, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;) -alert tcp any any -> $HOME_NET [139,445] (msg:"ET POLICY RemoteControlX rctrlx service created"; flow:to_server,established; content:"|5c 00 72 00 63 00 74 00 72 00 6c 00 78 00 73 00 72 00 76 00 2e 00 65 00 78 00 65|"; reference:url,xinn.org/Snort-rctrlx.html; reference:url,doc.emergingthreats.net/2010782; classtype:suspicious-filename-detect; sid:2010782; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Softek Barcode Reader Toolkit ActiveX Control Format String Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"SoftekATL.CBarcode"; nocase; distance:0; content:".DebugTraceFile"; nocase; reference:url,exploit-db.com/exploits/15071/; classtype:attempted-user; sid:2011870; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_10_29, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;) -alert udp $HOME_NET any -> $EXTERNAL_NET 69 (msg:"ET TFTP Outbound TFTP Data Transfer"; content:"|00 03|"; depth:2; reference:url,doc.emergingthreats.net/2008117; classtype:policy-violation; sid:2008117; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Softek Barcode Reader Toolkit ActiveX Control Buffer Overflow Attempt"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*11E7DA45-B56D-4078-89F6-D3D651EC4CD6/si"; reference:url,exploit-db.com/exploits/15071; classtype:web-application-attack; sid:2011869; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_10_29, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;) -alert udp $HOME_NET any -> $EXTERNAL_NET 69 (msg:"ET TFTP Outbound TFTP ACK"; content:"|00 04|"; depth:2; reference:url,doc.emergingthreats.net/2008118; classtype:policy-violation; sid:2008118; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Trend Micro Internet Security Pro 2010 ActiveX extSetOwner Remote Code Execution Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"15DBC3F9-9F0A-472E-8061-043D9CEC52F0"; nocase; distance:0; content:"extSetOwner"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15DBC3F9-9F0A-472E-8061-043D9CEC52F0/si"; reference:url,www.exploit-db.com/trend-micro-internet-security-pro-2010-activex-extsetowner-remote-code-execution/; classtype:attempted-user; sid:2011867; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_10_29, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;) -alert udp $HOME_NET any -> $EXTERNAL_NET 69 (msg:"ET TFTP Outbound TFTP Error Message"; content:"|00 05|"; depth:2; reference:url,doc.emergingthreats.net/2008119; classtype:policy-violation; sid:2008119; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Microsoft DirectX 9 msvidctl.dll ActiveX Control Code Execution Attempt"; flow:to_client,established; content:"24DC3975-09BF-4231-8655-3EE71F43837D"; nocase; content:".CustomCompositorClass"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*24DC3975-09BF-4231-8655-3EE71F43837D/si"; reference:url,packetstorm.linuxsecurity.com/1009-exploits/msvidctl-activex.txt; classtype:web-application-attack; sid:2011589; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_10_02, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;) -#alert udp ![$DNS_SERVERS,$SMTP_SERVERS] any -> $DNS_SERVERS 53 (msg:"ET POLICY Possible Spambot Host DNS MX Query High Count"; content: "|01 00|"; offset: 2; depth: 4; content: "|00 0f 00 01|"; distance: 8; threshold:type both, count 30, seconds 10, track by_src; reference:url,doc.emergingthreats.net/2003330; classtype:bad-unknown; sid:2003330; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Oracle Document Capture File Overwrite or Buffer Overflow Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"NCSECWLib.NCSRenderer"; nocase; distance:0; content:"WriteJPG"; nocase; distance:0; reference:cve,2010-3599; classtype:attempted-user; sid:2012234; rev:4; metadata:created_at 2011_01_27, updated_at 2019_09_27;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET POLICY Possible Reference to Terrorist Literature (Moderate Islam...)"; flow: to_client,established; content:"Moderate Islam is a Prostration to the West"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010570; classtype:policy-violation; sid:2010570; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX ASUS Net4Switch ipswcom.dll ActiveX Stack Buffer Overflow"; flow:to_client,established; content:"CLSID"; nocase; content:"1B9E86D8-7CAF-46C8-9938-569B21E17A8E"; nocase; distance:0; content:"CxDbgPrint"; nocase; reference:url,packetstormsecurity.org/files/110296/ASUS-Net4Switch-ipswcom.dll-ActiveX-Stack-Buffer-Overflow.html; classtype:attempted-user; sid:2014325; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_03_06, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET POLICY Possible Reference to Terrorist Literature (Jihad, Martyrdom...)"; flow: to_client,established; content:"Jihad, Martyrdom and the Killing of Innocents"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010571; classtype:policy-violation; sid:2010571; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Easewe FTP OCX ActiveX Control EaseWeFtp.ocx Remote Code Execution Attempt"; flow:established,to_client; content:"31AE647D-11D1-4E6A-BE2D-90157640019A"; nocase; fast_pattern; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31AE647D-11D1-4E6A-BE2D-90157640019A.+(Execute|Run|CreateLocalFile|CreateLocalFolder|DeleteLocalFile)/smi"; reference:bid,48393; classtype:attempted-user; sid:2013119; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_06_24, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_10_08;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET POLICY Possible Reference to Terrorist Literature (The Call to Global...)"; flow: to_client,established; content:"The Call to Global Islamic Resistance"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010572; classtype:policy-violation; sid:2010572; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX NCTAudioFile2 ActiveX SetFormatLikeSample() Buffer Overflow"; flow:established,from_server; content:"77829F14-D911-40FF-A2F0-D11DB8D6D0BC"; content:"SetFormatLikeSample("; isdataat:500,relative; content:!")"; within:500; reference:cve,2007-0018; reference:url,secunia.com/advisories/23475/; reference:url,doc.emergingthreats.net/2003328; classtype:web-application-attack; sid:2003328; rev:10; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2020_08_20;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET POLICY Possible Reference to Terrorist Literature (Knights under the...)"; flow: to_client,established; content:"Knights under the Prophet's Banner"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010573; classtype:policy-violation; sid:2010573; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Netcraft Toolbar Remote Code Execution"; flow:established,to_client; file_data; content:"clsid"; nocase; content:"73F57628-B458-11D4-9673-00A0D212FC63"; nocase; distance:0; content:"document|2e|getElementById|28|"; distance:0; content:"|2e|MapZone|28|"; within:20; pcre:"/]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*73F57628-B458-11D4-9673-00A0D212FC63\s*}?\s*(.*)\>/si"; reference:url,www.exploit-db.com/exploits/15600; classtype:attempted-user; sid:2012145; rev:5; metadata:created_at 2011_01_05, updated_at 2020_08_20;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET POLICY Possible Reference to Terrorist Literature (Jihad against...)"; flow: to_client,established; content:"Jihad Against Jews and Crusaders World Islamic Front Statement"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010574; classtype:policy-violation; sid:2010574; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX ImageShack Toolbar Remote Code Execution"; flow:established,to_client; file_data; content:"clsid"; nocase; content:"DC922B67-FF61-455E-9D79-959925B6695C"; nocase; distance:0; content:"javascript|3a|document|2e|getElementById|28 27|"; content:"|2e|strategy"; within:20; content:"javascript|3a|document.getElementById|28 27|"; distance:0; content:"|2e|target"; within:20; pcre:"/]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*DC922B67-FF61-455E-9D79-959925B6695C\s*}?\s*(.*)\>/si"; reference:url,www.exploit-db.com/exploits/15601; classtype:attempted-user; sid:2012146; rev:9; metadata:created_at 2011_01_05, updated_at 2020_08_20;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET POLICY Possible Reference to Terrorist Literature (Declaration of War against the Americans...)"; flow: to_client,established; content:"Declaration of War against the Americans Occupying the Land of the Two Holy Places"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010575; classtype:policy-violation; sid:2010575; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX RSP MP3 Player OCX ActiveX OpenFile Method Buffer Overflow Attempt"; flow:to_client,established; content:"3C88113F-8CEC-48DC-A0E5-983EF9458687"; nocase; content:"OpenFile"; distance:0; nocase; reference:url,exploit-db.com/exploits/14309/; reference:url,packetstormsecurity.org/1007-exploits/rspmp3-overflow.txt; reference:url,doc.emergingthreats.net/2011249; classtype:web-application-attack; sid:2011249; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2022_05_03;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET POLICY Possible Reference to Terrorist Literature (Join the Caravan of Martyrs...)"; flow: to_client,established; content:"Join the Caravan of Martyrs"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010576; classtype:policy-violation; sid:2010576; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Gesytec ElonFmt ActiveX Component GetItem1 member Buffer Overflow Attempt"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*824C4DC5-8DA4-11D6-A01F-00E098177CDC/si"; reference:url,exploit-db.com/exploits/17196; classtype:web-application-attack; sid:2012741; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_04_29, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2022_05_03;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET POLICY Possible Reference to Terrorist Literature (Sharia and Democracy...)"; flow: to_client,established; content:"Sharia and Democracy"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010577; classtype:policy-violation; sid:2010577; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX 2X Client for RDP ClientSystem Class ActiveX Control InstallClient Download and Execute"; flow:to_client,established; content:"CLSID"; nocase; content:"F5DF8D65-559D-4b75-8562-5302BD2F5F20"; nocase; distance:0; content:"InstallClient"; nocase; reference:url,www.exploit-db.com/exploits/18624/; classtype:attempted-user; sid:2014422; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_03_26, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2022_05_03;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET POLICY Possible Reference to Terrorist Literature (Moderate Islam...) SMTP"; flow: to_client,established; content:"Moderate Islam is a Prostration to the West"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010581; classtype:policy-violation; sid:2010581; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Dell Webcam CrazyTalk ActiveX Control BackImage Access Potential Buffer Overflow Attempt"; flow:to_client,established; content:"CLSID"; nocase; content:"13149882-F480-4F6B-8C6A-0764F75B99ED"; nocase; distance:0; content:"BackImage"; nocase; distance:0; reference:url,packetstormsecurity.org/files/111077/Dell-Webcam-CrazyTalk-ActiveX-BackImage-Vulnerability.html; classtype:attempted-user; sid:2014451; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_01, deployment Perimeter, former_category ACTIVEX, signature_severity Major, tag ActiveX, updated_at 2022_05_03;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET POLICY Possible Reference to Terrorist Literature (Jihad, Martyrdom...) SMTP"; flow: to_client,established; content:"Jihad, Martyrdom and the Killing of Innocents"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010582; classtype:policy-violation; sid:2010582; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Quest InTrust Annotation Objects ActiveX Control Add Access Potential Remote Code Execution"; flow:to_client,established; content:"CLSID"; nocase; content:"EF600D71-358F-11D1-8FD4-00AA00BD091C"; nocase; distance:0; content:".Add("; nocase; distance:0; reference:url,www.exploit-db.com/exploits/18674/; classtype:attempted-user; sid:2014453; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_01, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2022_05_03;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET POLICY Possible Reference to Terrorist Literature (The Call to Global...) SMTP"; flow: to_client,established; content:"The Call to Global Islamic Resistance"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010583; classtype:policy-violation; sid:2010583; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Dell Webcam CrazyTalk ActiveX Control BackImage Access Potential Buffer Overflow Attempt 2"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"CRAZYTALK4Lib.CrazyTalk4"; nocase; distance:0; content:"BackImage"; nocase; distance:0; reference:url,packetstormsecurity.org/files/111077/Dell-Webcam-CrazyTalk-ActiveX-BackImage-Vulnerability.html; classtype:attempted-user; sid:2014452; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_01, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2022_05_03;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET POLICY Possible Reference to Terrorist Literature (Knights under the...) SMTP"; flow: to_client,established; content:"Knights under the Prophet's Banner"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010584; classtype:policy-violation; sid:2010584; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http any $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Windows Help Center Arbitrary Command Execution Exploit Attempt"; flow:established,from_server; content:"hcp|3a|//"; fast_pattern; nocase; content:"script"; nocase; distance:0; content:"defer"; nocase; distance:0; content:"unescape"; nocase; distance:0; pcre:"/src\s*=\s*[\x22\x27]?hcp\x3a\x2f\x2F[^\n]*?(%3c|<)script[^\n]*?defer[^\n]*?unescape/i"; reference:url,www.exploit-db.com/exploits/13808/; reference:url,doc.emergingthreats.net/2011173; reference:cve,2010-1885; classtype:misc-attack; sid:2011173; rev:12; metadata:created_at 2010_07_30, updated_at 2022_05_03;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET POLICY Possible Reference to Terrorist Literature (Jihad against...) SMTP"; flow: to_client,established; content:"Jihad Against Jews and Crusaders World Islamic Front Statement"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010585; classtype:policy-violation; sid:2010585; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Multiple Altiris Products AeXNSConsoleUtilities.dll ActiveX Control BrowseAndSaveFile Method Buffer Overflow Attempt Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"Altiris.AeXNSConsoleUtilities"; nocase; distance:0; content:"BrowseAndSaveFile"; nocase; reference:url,www.symantec.com/business/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2009&suid=20091102_00; reference:url,www.securityfocus.com/bid/36698/info; reference:url,sotiriu.de/adv/NSOADV-2009-001.txt; reference:url,securitytracker.com/alerts/2009/Nov/1023122.html; reference:cve,2009-3031; reference:url,doc.emergingthreats.net/2010245; classtype:attempted-user; sid:2010245; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2022_05_03;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET POLICY Possible Reference to Terrorist Literature (Declaration of War against the Americans...) SMTP"; flow: to_client,established; content:"Declaration of War against the Americans Occupying the Land of the Two Holy Places"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010586; classtype:policy-violation; sid:2010586; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX DB Software Laboratory VImpX.ocx ActiveX Control Multiple Insecure Methods"; flow:to_client,established; content:"CLSID"; nocase; content:"7600707B-9F47-416D-8AB5-6FD96EA37968"; nocase; pcre:"/(LogFile|ClearLogFile|SaveToFile)/i"; reference:bugtraq,31907; reference:url,milw0rm.com/exploits/6828; reference:url,doc.emergingthreats.net/2008789; classtype:web-application-attack; sid:2008789; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2022_05_03;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET POLICY Possible Reference to Terrorist Literature (Join the Caravan of Martyrs...) SMTP"; flow: to_client,established; content:"Join the Caravan of Martyrs"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010587; classtype:policy-violation; sid:2010587; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Microsoft WMI Administration Tools WEBSingleView.ocx ActiveX Buffer Overflow Attempt (CVE-2010-3973)"; flow:established,to_client; content:"2745E5F5-D234-11D0-847A-00C04FD7BB08"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext)/smi"; reference:url,xcon.xfocus.net/XCon2010_ChenXie_EN.pdf; reference:url,wooyun.org/bug.php?action=view&id=1006; reference:bid,45546; reference:cve,CVE-2010-3973; classtype:attempted-user; sid:2012158; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_01_06, deployment Perimeter, former_category ACTIVEX, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET POLICY Possible Reference to Terrorist Literature (Sharia and Democracy...) SMTP"; flow: to_client,established; content:"Sharia and Democracy"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010588; classtype:policy-violation; sid:2010588; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Follina Payload Delivery Page"; flow:established,to_client; http.stat_code; content:"200"; http.response_body; content:"|3c 21|doctype html|3e 0d 0a 3c|"; depth:18; content:"|3e 0d 0a 3c|head|3e 0d 0a 3c|title|3e 0d 0a|Good thing we disabled macros|0d 0a 3c 2f|title|3e 0d 0a 3c 2f|head|3e 0d 0a|"; within:85; fast_pattern; reference:md5,783f850d06c9f1286eb9b1bda0af0bce; reference:cve,2022-30190; classtype:trojan-activity; sid:2037082; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_22, deployment Perimeter, deployment SSLDecrypt, former_category ACTIVEX, signature_severity Major, updated_at 2022_06_22;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET POLICY Possible Reference to Al Qaeda Propaganda Theme (fardh ain) SMTP"; flow: to_client,established; content:"fardh ain"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010589; classtype:policy-violation; sid:2010589; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +# Emerging Threats +# +# This distribution may contain rules under two different licenses. +# +# Rules with sids 1 through 3464, and 100000000 through 100000908 are under the GPLv2. +# A copy of that license is available at http://www.gnu.org/licenses/gpl-2.0.html +# +# Rules with sids 2000000 through 2799999 are from Emerging Threats and are covered under the BSD License +# as follows: +# +#************************************************************* +# Copyright (c) 2003-2022, Emerging Threats +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the +# following conditions are met: +# +# * Redistributions of source code must retain the above copyright notice, this list of conditions and the following +# disclaimer. +# * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the +# following disclaimer in the documentation and/or other materials provided with the distribution. +# * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES, +# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE +# USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +# +#************************************************************* +# +# +# +# -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET POLICY Possible Reference to Al Qaeda Propaganda Theme/Group (Takfir) SMTP"; flow: to_client,established; content:"Takfir"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010590; classtype:policy-violation; sid:2010590; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +# This Ruleset is EmergingThreats Open optimized for suricata-5.0-enhanced. -alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET P2P TOR 1.0 Server Key Retrieval"; flow:established,to_server; content:"GET /tor/server/"; depth:16; threshold:type limit, track by_src, count 1, seconds 30; reference:url,tor.eff.org; reference:url,doc.emergingthreats.net/2002950; classtype:policy-violation; sid:2002950; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> any any (msg:"ET ADWARE_PUP Win32/Wizpop Initial Checkin"; flow:established,to_server; content:"User-Agent|3a| WizPop"; http_header; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Adware%3AWin32%2FWizpop&ThreatID=159818; classtype:pup-activity; sid:2013461; rev:3; metadata:created_at 2011_08_26, former_category MALWARE, updated_at 2011_08_26;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET P2P TOR 1.0 Status Update"; flow:established,to_server; content:"GET /tor/status/"; depth:16; threshold:type limit, track by_src, count 1, seconds 60; reference:url,tor.eff.org; reference:url,doc.emergingthreats.net/2002951; classtype:policy-violation; sid:2002951; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/Wizpop Checkin"; flow:established,to_server; content:"/count.asp?exe="; http_uri; content:"&act="; http_uri; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Adware%3AWin32%2FWizpop&ThreatID=159818; classtype:pup-activity; sid:2013502; rev:4; metadata:created_at 2011_08_31, former_category MALWARE, updated_at 2011_08_31;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET P2P TOR 1.0 Inbound Circuit Traffic"; flow:established; content:"TOR"; content:""; rawbytes; distance:10; within:35; threshold:type limit, track by_src, count 1, seconds 120; reference:url,tor.eff.org; reference:url,doc.emergingthreats.net/2002952; classtype:policy-violation; sid:2002952; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP QQHelper related Spyware User-Agent (H)"; flow:to_server,established; content:"User-Agent|3a| H|0d 0a|"; reference:url,doc.emergingthreats.net/2003749; classtype:pup-activity; sid:2003749; rev:8; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category USER_AGENTS, signature_severity Minor, tag Spyware_User_Agent, updated_at 2016_07_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET P2P TOR 1.0 Outbound Circuit Traffic"; flow:established; content:"TOR"; content:""; rawbytes; distance:10; within:35; threshold:type limit, track by_src, count 1, seconds 120; reference:url,tor.eff.org; reference:url,doc.emergingthreats.net/2002953; classtype:policy-violation; sid:2002953; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP MyWaySearch Products Spyware User Agent"; flow: established,to_server; content:"MyWay"; http_user_agent; reference:url,doc.emergingthreats.net/2002079; reference:url,www.funwebproducts.com; classtype:pup-activity; sid:2002079; rev:19; metadata:created_at 2010_07_30, former_category USER_AGENTS, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 20000 (msg:"ET GAMES Gold VIP Club Casino Client in Use"; flow:established,to_server; dsize:25; content:"Gold VIP Club Casino"; reference:url,doc.emergingthreats.net/2007746; classtype:policy-violation; sid:2007746; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Webbuying.net Spyware Install User-Agent 2 (wb v1.6.4)"; flow:to_server,established; content:"User-Agent|3a|"; nocase; http_header; content:"wb v"; http_user_agent; fast_pattern; reference:url,doc.emergingthreats.net/2003449; classtype:pup-activity; sid:2003449; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert udp $HOME_NET any -> $EXTERNAL_NET 88 (msg:"ET POLICY X-Box Live Connecting"; content:" $EXTERNAL_NET any (msg:"ET ADWARE_PUP Sogou.com Spyware User-Agent (SogouIMEMiniSetup)"; flow:established,to_server; content:"User-Agent|3a| SogouIME"; http_header; reference:url,doc.emergingthreats.net/2008500; classtype:pup-activity; sid:2008500; rev:9; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, signature_severity Minor, tag Spyware_User_Agent, updated_at 2017_04_04;) -#alert tcp any any -> any any (msg:"ET POLICY ZIPPED DOC in transit"; flow:established; content:"|50 4B 03 04|"; content:"|00|"; content:".doc"; nocase; reference:url,doc.emergingthreats.net/2001402; classtype:not-suspicious; sid:2001402; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Baidu.com Spyware Bar Reporting"; flow:to_server,established; content:"/update/barcab/"; nocase; http_uri; reference:url,www.pctools.com/mrc/infections/id/BaiDu/; reference:url,doc.emergingthreats.net/bin/view/Main/2003340; classtype:pup-activity; sid:2003340; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2017_04_21;) -#alert tcp any any -> any any (msg:"ET POLICY ZIPPED XLS in transit"; flow:established; content:"|50 4B 03 04|"; content:"|00|"; content:".xls"; nocase; reference:url,doc.emergingthreats.net/2001403; classtype:not-suspicious; sid:2001403; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Baidu.com Spyware Bar Pulling Content"; flow:to_server,established; content:"/update/cab/loadmovie.swf"; nocase; http_uri; content:"bar.baidu.com"; nocase; http_header; fast_pattern; reference:url,www.pctools.com/mrc/infections/id/BaiDu/; reference:url,doc.emergingthreats.net/bin/view/Main/2003341; classtype:pup-activity; sid:2003341; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2017_04_21;) -#alert tcp any any -> any any (msg:"ET POLICY ZIPPED EXE in transit"; flow:established; content:"|50 4B 03 04|"; content:"|00|"; content:".exe"; nocase; reference:url,doc.emergingthreats.net/2001404; classtype:not-suspicious; sid:2001404; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Baidu.com Spyware Bar Pulling Data"; flow:to_server,established; content:"/cpro/ui/ui"; nocase; http_uri; content:"baidu.com"; nocase; http_header; content:!"Referer|3a| "; nocase; http_header; reference:url,www.pctools.com/mrc/infections/id/BaiDu/; reference:url,doc.emergingthreats.net/bin/view/Main/2003578; classtype:pup-activity; sid:2003578; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2017_04_21;) -#alert tcp any any -> any any (msg:"ET POLICY ZIPPED PPT in transit"; flow:established; content:"|50 4B 03 04|"; content:"|00|"; content:".ppt"; nocase; reference:url,doc.emergingthreats.net/2001405; classtype:not-suspicious; sid:2001405; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32.LoadMoney User Agent"; flow:established,to_server; content:"Downloader "; http_user_agent; fast_pattern:only; pcre:"/^User-Agent\x3a Downloader \d\.\d\r?$/Hm"; reference:url,www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=PUA:Win32/LoadMoney; classtype:pup-activity; sid:2024260; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_04_27, deployment Perimeter, former_category ADWARE_PUP, malware_family Loadmoney, performance_impact Low, signature_severity Minor, tag Loadmoney, updated_at 2017_04_27;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN Amap TCP Service Scan Detected"; flow:to_server; flags:PA; content:"service|3A|thc|3A 2F 2F|"; depth:105; content:"service|3A|thc"; within:40; reference:url,freeworld.thc.org/thc-amap/; reference:url,doc.emergingthreats.net/2010371; classtype:attempted-recon; sid:2010371; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyspotter.com Access Likely Spyware"; flow: to_server,established; content:"Host|3a|"; nocase; http_header; content:".oemji.com"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001539; classtype:pup-activity; sid:2001539; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2017_05_11;) -alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN Amap UDP Service Scan Detected"; dsize:<135; content:"THCTHCTHCTHCTHC|20 20 20|"; reference:url,freeworld.thc.org/thc-amap/; reference:url,doc.emergingthreats.net/2010372; classtype:attempted-recon; sid:2010372; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP InstallCore Variant CnC Checkin"; flow:established,to_server; urilen:1; content:"POST"; http_method; content:"Accept|3a 20 2a 2f 2a 0d 0a|"; http_header; content:"|7c|"; http_client_body; depth:40; content:"POST|20|/|20|HTTP/1.1|0d 0a|Accept|3a 20 2a 2f 2a 0d 0a|Host|3a|"; fast_pattern; content:!"Referer|3a|"; http_header; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P"; reference:md5,42374945061c7941d6690793ae393d3a; classtype:pup-activity; sid:2024428; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_06_26, deployment Perimeter, former_category ADWARE_PUP, performance_impact Moderate, signature_severity Major, updated_at 2017_09_01;) -alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"ET SNMP Attempted UDP Access Attempt to Cisco IOS 12.1 Hidden Read/Write Community String ILMI"; content:"ILMI"; nocase; reference:url,www.cisco.com/warp/public/707/cisco-sa-20010228-ios-snmp-community.shtml; reference:url,www.cisco.com/warp/public/707/cisco-sa-20010227-ios-snmp-ilmi.shtml; reference:url,doc.emergingthreats.net/2011011; classtype:attempted-admin; sid:2011011; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ADWARE_PUP Windows executable sent when remote host claims to send an image M3"; flow: established,from_server; content:"|0d 0a|Content-Type|3a| image/png"; pcre:"/^(?:(?!\r?\n\r?\n).)*?\r?\n\r?\nMZ/Rs"; content:"!This program"; distance:0; fast_pattern; classtype:pup-activity; sid:2023750; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_01_19, deployment Perimeter, former_category ADWARE_PUP, performance_impact Low, signature_severity Major, updated_at 2017_12_21;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"ET SNMP Attempted TCP Access Attempt to Cisco IOS 12.1 Hidden Read/Write Community String ILMI"; flow:to_server,established; content:"ILMI"; nocase; reference:url,www.cisco.com/warp/public/707/cisco-sa-20010228-ios-snmp-community.shtml; reference:url,www.cisco.com/warp/public/707/cisco-sa-20010227-ios-snmp-ilmi.shtml; reference:url,doc.emergingthreats.net/2011012; classtype:attempted-admin; sid:2011012; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Gator Cookie"; flow: to_server,established; content:"webpdpcookie"; content:".gator.com"; nocase; http_header; reference:url,www3.ca.com/securityadvisor/pest/content.aspx?q=67999; reference:url,doc.emergingthreats.net/bin/view/Main/2000025; classtype:pup-activity; sid:2000025; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"ET SNMP Attempted UDP Access Attempt to Cisco IOS 12.1 Hidden Read/Write Community String cable-docsis"; content:"cable-docsis"; nocase; reference:url,www.cisco.com/warp/public/707/cisco-sa-20010228-ios-snmp-community.shtml; reference:url,www.iss.net/security_center/reference/vuln/cisco-ios-cable-docsis.htm; reference:url,www.kb.cert.org/vuls/id/840665; reference:cve,2004-1776; reference:url,doc.emergingthreats.net/2011013; classtype:attempted-admin; sid:2011013; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Binet (download complete)"; flow: to_server,established; content:"/download/cabs/"; nocase; http_uri; content:"download_complete.htm"; nocase; http_uri; reference:url,sarc.com/avcenter/venc/data/pf/adware.betterinternet.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000366; classtype:pup-activity; sid:2000366; rev:15; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"ET SNMP Attempted TCP Access Attempt to Cisco IOS 12.1 Hidden Read/Write Community String cable-docsis"; flow:to_server,established; content:"cable-docsis"; nocase; reference:url,www.cisco.com/warp/public/707/cisco-sa-20010228-ios-snmp-community.shtml; reference:url,www.iss.net/security_center/reference/vuln/cisco-ios-cable-docsis.htm; reference:url,www.kb.cert.org/vuls/id/840665; reference:cve,2004-1776; reference:url,doc.emergingthreats.net/2011014; classtype:attempted-admin; sid:2011014; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Binet (set_pix)"; flow: to_server,established; content:"/download/cabs/set_pix.php"; nocase; http_uri; content:"abetterinternet.com"; nocase; http_header; reference:url,sarc.com/avcenter/venc/data/pf/adware.betterinternet.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000367; classtype:pup-activity; sid:2000367; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"ET SCAN Cisco Torch TFTP Scan"; content:"|52 61 6E 64 30 6D 53 54 52 49 4E 47 00 6E 65 74 61 73 63 69 69|"; offset:2; depth:21; reference:url,www.hackingexposedcisco.com/?link=tools; reference:url,www.securiteam.com/tools/5EP0F1FEUA.html; reference:url,doc.emergingthreats.net/2008414; classtype:attempted-recon; sid:2008414; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Binet (randreco.exe)"; flow: to_server,established; content:"/download/cabs/RANDRECO/randreco.exe"; nocase; http_uri; content:"abetterinternet.com|0d 0a|"; nocase; http_header; fast_pattern; reference:url,sarc.com/avcenter/venc/data/pf/adware.betterinternet.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000371; classtype:pup-activity; sid:2000371; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET SCAN Multiple FTP Root Login Attempts from Single Source - Possible Brute Force Attempt"; flow:established,to_server; content:"USER "; nocase; depth:5; content:"root"; within:15; nocase; threshold: type threshold, track by_src, count 5, seconds 60; reference:url,doc.emergingthreats.net/2010642; classtype:attempted-recon; sid:2010642; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET ADWARE_PUP User-Agent (iexplore)"; flow:established,to_server; content:"User-Agent|3a| iexplore|0d 0a|"; nocase; http_header; reference:url,doc.emergingthreats.net/2000466; classtype:pup-activity; sid:2000466; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET SCAN Multiple FTP Administrator Login Attempts from Single Source - Possible Brute Force Attempt"; flow:established,to_server; content:"USER "; nocase; depth:5; content:"administrator"; within:25; nocase; threshold: type threshold, track by_src, count 5, seconds 60; reference:url,doc.emergingthreats.net/2010643; classtype:attempted-recon; sid:2010643; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP IE homepage hijacking"; flow: from_server,established; content:"wsh.RegWrite"; nocase; content:"HKLM\\\\Software\\\\Microsoft\\\\Internet Explorer\\\\Main\\\\Start Page"; nocase; reference:url,www.geek.com/news/geeknews/2004Jun/gee20040610025522.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2000514; classtype:pup-activity; sid:2000514; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET FTP Possible FTP Daemon Username SELECT FROM SQL Injection Attempt"; flow:established,to_server; content:"USER"; depth:4; content:"SELECT"; within:200; nocase; content:"FROM"; distance:0; nocase; pcre:"/SELECT.+FROM/i"; reference:url,en.wikipedia.org/wiki/SQL_injection; reference:url,doc.emergingthreats.net/2009981; classtype:attempted-user; sid:2009981; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP shell browser vulnerability W9x/XP"; flow: from_server,established; content:"shell|3a|windows"; nocase; reference:url,www.packetfocus.com/shell_exploit.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2000519; classtype:pup-activity; sid:2000519; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET FTP Possible FTP Daemon Username DELETE FROM SQL Injection Attempt"; flow:established,to_server; content:"USER"; depth:4; content:"DELETE"; within:200; nocase; content:"FROM"; distance:0; nocase; pcre:"/DELETE.+FROM/i"; reference:url,en.wikipedia.org/wiki/SQL_injection; reference:url,doc.emergingthreats.net/2009982; classtype:attempted-user; sid:2009982; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP shell browser vulnerability NT/2K"; flow: from_server,established; content:"shell|3a|winnt"; nocase; reference:url,www.packetfocus.com/shell_exploit.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2000520; classtype:pup-activity; sid:2000520; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET FTP Possible FTP Daemon Username INSERT INTO SQL Injection Attempt"; flow:established,to_server; content:"USER"; depth:4; content:"INSERT"; within:200; nocase; content:"INTO"; distance:0; nocase; pcre:"/INSERT.+INTO/i"; reference:url,en.wikipedia.org/wiki/SQL_injection; reference:url,doc.emergingthreats.net/2009983; classtype:attempted-user; sid:2009983; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Bargain Buddy"; flow: to_server,established; content:"/download/bargin_buddy"; nocase; http_uri; reference:url,www.doxdesk.com/parasite/BargainBuddy.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000574; classtype:pup-activity; sid:2000574; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET FTP Possible FTP Daemon Username UPDATE SET SQL Injection Attempt"; flow:established,to_server; content:"USER"; depth:4; content:"UPDATE"; within:200; nocase; content:"SET"; distance:0; nocase; pcre:"/UPDATE.+SET/i"; reference:url,en.wikipedia.org/wiki/SQL_injection; reference:url,doc.emergingthreats.net/2009984; classtype:attempted-user; sid:2009984; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Shop At Home Select.com Install Attempt"; flow: to_server,established; content:"/mindset/bunsetup.cab"; nocase; http_uri; reference:url,www.spywareguide.com/product_show.php?id=700; reference:url,www.shopathomeselect.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000580; classtype:pup-activity; sid:2000580; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET FTP Possible FTP Daemon Username UNION SELECT SQL Injection Attempt"; flow:established,to_server; content:"USER"; depth:4; content:"UNION"; within:200; nocase; content:"SELECT"; distance:0; nocase; pcre:"/UNION.+SELECT/i"; reference:url,en.wikipedia.org/wiki/SQL_injection; reference:url,doc.emergingthreats.net/2009985; classtype:attempted-user; sid:2009985; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP Shop At Home Select.com Install Download"; flow: from_server,established; content:"|ab 3b d4 97 d4 a7 b4 1d da 6e 6d 0f f4 aa 4f|"; content:"|46 b3 3b 8b 38 cc 2c 2a a4 c3 07 67 67 df 65 41|"; reference:url,www.spywareguide.com/product_show.php?id=700; reference:url,www.shopathomeselect.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000581; classtype:pup-activity; sid:2000581; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET FTP Possible FTP Daemon Username INTO OUTFILE SQL Injection Attempt"; flow:established,to_server; content:"USER"; depth:4; content:"INTO"; within:200; nocase; content:"OUTFILE"; distance:0; nocase; pcre:"/INTO.+OUTFILE/i"; reference:url,www.milw0rm.com/papers/372; reference:url,www.greensql.net/publications/backdoor-webserver-using-mysql-sql-injection; reference:url,websec.wordpress.com/2007/11/17/mysql-into-outfile/; reference:url,doc.emergingthreats.net/2010081; classtype:attempted-user; sid:2010081; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP F1Organizer Reporting"; flow: to_server,established; content:"/f1/audit/"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2000582; classtype:pup-activity; sid:2000582; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp any any -> any 21 (msg:"ET SCAN Grim's Ping ftp scanning tool"; flow:to_server,established; content:"PASS "; content:"gpuser@home.com"; within:18; reference:url,archives.neohapsis.com/archives/snort/2002-04/0448.html; reference:url,grimsping.cjb.net; reference:url,doc.emergingthreats.net/2007802; classtype:network-scan; sid:2007802; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Mindset Interactive Install (1)"; flow: to_server,established; content:"/mindset5/data"; nocase; http_uri; reference:url,www.mindsetinteractive.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000583; classtype:pup-activity; sid:2000583; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN ICMP PING IPTools"; itype: 8; icode: 0; content:"|A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7 A7|"; depth: 64; reference:url,www.ks-soft.net/ip-tools.eng; reference:url,www.ks-soft.net/ip-tools.eng/index.htm; reference:url,doc.emergingthreats.net/2000575; classtype:misc-activity; sid:2000575; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Mindset Interactive Install (2)"; flow: to_server,established; content:"/mindset/data"; nocase; http_uri; reference:url,www.mindsetinteractive.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000584; classtype:pup-activity; sid:2000584; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"ET SCAN NNG MS02-039 Exploit False Positive Generator - May Conceal A Genuine Attack"; content:"nng Snort (Snort)"; offset:90; threshold:type threshold, track by_dst, count 4, seconds 15; reference:url,packetstormsecurity.nl/filedesc/nng-4.13r-public.rar.html; reference:url,doc.emergingthreats.net/2008560; classtype:misc-activity; sid:2008560; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP F1Organizer Install Attempt"; flow: to_server,established; content:"/f1/objects/"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2000585; classtype:pup-activity; sid:2000585; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 3306 (msg:"ET SCAN MYSQL 4.0 brute force root login attempt"; flow:to_server,established; content:"|01|"; offset:3; depth:4; content:"root|00|"; nocase; distance:5; within:5; threshold:type both,track by_src,count 5,seconds 60; reference:url,www.redferni.uklinux.net/mysql/MySQL-323.html; reference:url,doc.emergingthreats.net/2001906; classtype:protocol-command-decode; sid:2001906; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SpywareLabs VirtualBouncer Seeking Instructions"; flow: to_server,established; content:"instructions"; nocase; pcre:"/instructions\/\d{2}\.xml/mi"; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.virtualbouncer.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000587; classtype:pup-activity; sid:2000587; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 3306 (msg:"ET SCAN MYSQL 4.1 brute force root login attempt"; flow:to_server,established; content:"|01|"; offset:3; depth:4; content:"root|00|"; nocase; distance:32; within:5; threshold:type both,track by_src,count 5,seconds 60; reference:url,www.redferni.uklinux.net/mysql/MySQL-Protocol.html; reference:url,doc.emergingthreats.net/2002842; classtype:protocol-command-decode; sid:2002842; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP TopMoxie Reporting Data to External Host"; flow: to_server,established; content:"/downloads/record_download.asp"; nocase; pcre:"/(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/downloads\/record_download\.asp/i"; reference:url,www.topmoxie.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000588; classtype:pup-activity; sid:2000588; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $HOME_NET 3306 -> any any (msg:"ET SCAN Non-Allowed Host Tried to Connect to MySQL Server"; flow:from_server,established; content:"|6A 04|Host|20 27|"; depth:70; content:"|27 20|is not allowed to connect to this MySQL server"; distance:0; reference:url,www.cyberciti.biz/tips/how-do-i-enable-remote-access-to-mysql-database-server.html; reference:url,doc.emergingthreats.net/2010493; classtype:attempted-recon; sid:2010493; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP TopMoxie Retrieving Data (downloads)"; flow: to_server,established; content:"/external/builds/downloads2/"; http_uri; nocase; reference:url,www.topmoxie.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000589; classtype:pup-activity; sid:2000589; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN NMAP -sS window 2048"; fragbits:!D; dsize:0; flags:S,12; ack:0; window:2048; threshold: type both, track by_dst, count 1, seconds 60; reference:url,doc.emergingthreats.net/2000537; classtype:attempted-recon; sid:2000537; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP TopMoxie Retrieving Data (common)"; flow: to_server,established; content:"/external/builds/common/"; http_uri; nocase; reference:url,www.topmoxie.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000590; classtype:pup-activity; sid:2000590; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;) -#alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN NMAP -sO"; dsize:0; ip_proto:21; threshold: type both, track by_dst, count 1, seconds 60; reference:url,doc.emergingthreats.net/2000536; classtype:attempted-recon; sid:2000536; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Binet Ad Retrieval"; flow: to_server,established; content:"/bba/flashimages/"; nocase; http_uri; reference:url,sarc.com/avcenter/venc/data/pf/adware.betterinternet.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000593; classtype:pup-activity; sid:2000593; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN NMAP -sA (1)"; fragbits:!D; dsize:0; flags:A,12; window:1024; threshold: type both, track by_dst, count 1, seconds 60; reference:url,doc.emergingthreats.net/2000538; classtype:attempted-recon; sid:2000538; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Gator New Code Download"; flow: to_server,established; content:"/gatorcme/"; nocase; http_uri; reference:url,www3.ca.com/securityadvisor/pest/content.aspx?q=67999; reference:url,doc.emergingthreats.net/bin/view/Main/2000597; classtype:pup-activity; sid:2000597; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN NMAP -sA (2)"; fragbits:!D; dsize:0; flags:A,12; window:3072; threshold: type both, track by_dst, count 1, seconds 60; reference:url,doc.emergingthreats.net/2000540; classtype:attempted-recon; sid:2000540; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Fun Web Products Install"; flow: to_server,established; content:"/install_ie.jsp?product="; http_uri; reference:url,www.funwebproducts.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000599; classtype:pup-activity; sid:2000599; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN NMAP -f -sF"; fragbits:!M; dsize:0; flags:F,12; ack:0; window:2048; threshold: type both, track by_dst, count 1, seconds 60; reference:url,doc.emergingthreats.net/2000543; classtype:attempted-recon; sid:2000543; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MyWebSearch Toolbar Receiving Configuration"; flow: to_server,established; content:"/speedbar/mySpeedbarCfg"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2000600; classtype:pup-activity; sid:2000600; rev:14; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN NMAP -f -sN"; fragbits:!M; dsize:0; flags:0,12; ack:0; window:2048; threshold: type both, track by_dst, count 1, seconds 60; reference:url,doc.emergingthreats.net/2000544; classtype:attempted-recon; sid:2000544; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Salongas Infection"; flow: to_server,established; content:"/sp.htm?id="; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2000601; classtype:pup-activity; sid:2000601; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN NMAP -f -sX"; fragbits:!M; dsize:0; flags:FPU,12; ack:0; window:2048; threshold: type both, track by_dst, count 1, seconds 60; reference:url,doc.emergingthreats.net/2000546; classtype:attempted-recon; sid:2000546; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MarketScore.com Spyware Configuration Access"; flow: to_server,established; content:"/oss/remoteconfig.asp"; http_uri; reference:url,www.marketscore.com; reference:url,www.spysweeper.com/remove-marketscore.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000902; classtype:pup-activity; sid:2000902; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert udp $HOME_NET 137 -> $EXTERNAL_NET any (msg:"ET SCAN Multiple NBTStat Query Responses to External Destination, Possible Automated Windows Network Enumeration"; content:"|20 43 4b 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00 00 21|"; depth:55; threshold: type threshold, track by_dst, count 10, seconds 60; reference:url,technet.microsoft.com/en-us/library/cc940106.aspx; reference:url,doc.emergingthreats.net/2009767; classtype:attempted-recon; sid:2009767; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Avres Agent Receiving Instructions"; flow: to_server,established; content:"/ie/updatenew/"; http_uri; content:"CONFIG"; nocase; reference:url,www.avres.net; reference:url,ar.avres.net/ie/updatenew/; reference:url,doc.emergingthreats.net/bin/view/Main/2000903; classtype:pup-activity; sid:2000903; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert udp $HOME_NET 137 -> $EXTERNAL_NET any (msg:"ET SCAN NBTStat Query Response to External Destination, Possible Windows Network Enumeration"; content:"|20 43 4b 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00 00 21|"; depth:55; reference:url,technet.microsoft.com/en-us/library/cc940106.aspx; reference:url,doc.emergingthreats.net/2009768; classtype:attempted-recon; sid:2009768; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP WhenUClick.com App and Search Bar Install (1)"; flow: to_server,established; content:"/vsn/ISA/"; nocase; http_uri; reference:url,www.whenusearch.com; reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000908; classtype:pup-activity; sid:2000908; rev:14; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET SCAN PRO Search Crawler Probe"; flow:to_server,established; content:"PASS "; nocase; depth:5; content:"crawler"; nocase; within:30; pcre:"/^PASS\s+PRO(-|\s)*search\s+Crawler/smi"; reference:url,sourceforge.net/project/showfiles.php?group_id=149797; reference:url,doc.emergingthreats.net/2008179; classtype:not-suspicious; sid:2008179; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP WhenUClick.com App and Search Bar Install (2)"; flow: to_server,established; content:"/Appinstall?app=VVSN"; nocase; http_uri; reference:url,www.whenusearch.com; reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000909; classtype:pup-activity; sid:2000909; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET SCAN Sipvicious Scan"; content:"From|3A 20 22|sipvicious"; threshold: type limit, count 1, seconds 10, track by_src; reference:url,blog.sipvicious.org; reference:url,doc.emergingthreats.net/2008578; classtype:attempted-recon; sid:2008578; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP WhenUClick.com Clock Sync App Checkin"; flow: to_server,established; content:"/heartbeat?"; nocase; http_uri; content:"=clock"; nocase; http_uri; reference:url,www.whenusearch.com; reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000910; classtype:pup-activity; sid:2000910; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET SCAN Modified Sipvicious User-Agent Detected (sundayddr)"; content:"|0d 0a|User-Agent|3A| sundayddr"; threshold: type limit, count 1, seconds 60, track by_src; reference:url,honeynet.org.au/?q=sunday_scanner; reference:url,code.google.com/p/sipvicious/; reference:url,blog.sipvicious.org/; reference:url,doc.emergingthreats.net/2011766; classtype:attempted-recon; sid:2011766; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP WhenUClick.com Weather App Checkin"; flow: to_server,established; content:"/heartbeat?"; nocase; http_uri; content:"=weather"; nocase; http_uri; reference:url,www.whenusearch.com; reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000911; classtype:pup-activity; sid:2000911; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Bugbear@MM virus via SMTP"; flow: established; content:"uv+LRCQID7dIDFEECggDSLm9df8C/zSNKDBBAAoGA0AEUQ+FEN23f7doqAT/dCQk/xWcEQmDxCTD"; reference:url,www.symantec.com/avcenter/venc/data/w32.bugbear@mm.html; reference:url,doc.emergingthreats.net/2001764; classtype:misc-activity; sid:2001764; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP WhenUClick.com Clock Sync App Checkin (1)"; flow: to_server,established; content:"/clock?id="; nocase; http_uri; reference:url,www.whenusearch.com; reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000912; classtype:pup-activity; sid:2000912; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> any 139 (msg:"ET DELETED BugBear@MM Worm Copied to Startup Folder"; flow: established; content:"|77 00 69 00 6B 00 2E 00 65 00 78 00 65 00 00 00|"; reference:url,www.symantec.com/avcenter/venc/data/w32.bugbear@mm.html; reference:url,doc.emergingthreats.net/2001766; classtype:misc-activity; sid:2001766; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP WhenUClick.com Clock Sync App Checkin (2)"; flow: to_server,established; content:"/clockDB"; nocase; http_uri; reference:url,www.whenusearch.com; reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000913; classtype:pup-activity; sid:2000913; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET DELETED Mytob.X clam SMTP Inbound"; flow:to_server,established; content:"UEsDBAoA"; content:"ojRrPyGt"; distance:8; within:16; reference:url,www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=42326; reference:url,doc.emergingthreats.net/2002892; classtype:trojan-activity; sid:2002892; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP WhenUClick.com Weather App Checkin (1)"; flow: to_server,established; content:"/weatherDB"; nocase; http_uri; reference:url,www.whenusearch.com; reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000914; classtype:pup-activity; sid:2000914; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET DELETED Mytob.X clam SMTP Outbound"; flow:to_server,established; content:"UEsDBAoA"; content:"ojRrPyGt"; distance:8; within:16; reference:url,www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=42326; reference:url,doc.emergingthreats.net/2002893; classtype:trojan-activity; sid:2002893; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP WhenUClick.com Weather App Checkin (2)"; flow: to_server,established; content:"/weather?id="; nocase; http_uri; reference:url,www.whenusearch.com; reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000915; classtype:pup-activity; sid:2000915; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET DELETED W32.Nugache SMTP Inbound"; flow:to_server,established; content:"RE9TIG1v"; content:"GUuDQ0KJ"; distance:1; within:9; reference:url,www.symantec.com/avcenter/venc/data/w32.nugache.a@mm.html; reference:url,doc.emergingthreats.net/2002894; classtype:trojan-activity; sid:2002894; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP WhenUClick.com WhenUSave App Checkin"; flow: to_server,established; content:"/heartbeat?"; nocase; http_uri; content:"=whenusave"; nocase; http_uri; reference:url,www.whenusearch.com; reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000916; classtype:pup-activity; sid:2000916; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET DELETED W32.Nugache SMTP Outbound"; flow:to_server,established; content:"RE9TIG1v"; content:"GUuDQ0KJ"; distance:1; within:9; reference:url,www.symantec.com/avcenter/venc/data/w32.nugache.a@mm.html; reference:url,doc.emergingthreats.net/2002895; classtype:trojan-activity; sid:2002895; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP WhenUClick.com WhenUSave Data Retrieval (offersdata)"; flow: to_server,established; content:"/OffersDataGZ?update="; nocase; http_uri; reference:url,www.whenusearch.com; reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000917; classtype:pup-activity; sid:2000917; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1433 (msg:"ET MALWARE Outbound AVISOSVB MSSQL Request"; flow:established,to_server; content:"|54 00 42 00 4c 00 5f 00 41 00 56 00 49 00 53 00 4f 00 53 00 56 00 42 00|"; reference:url,doc.emergingthreats.net/2011199; reference:md5,1f5b6d6d94cc6272c937045e22e6d192; classtype:trojan-activity; sid:2011199; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP WhenUClick.com Desktop Bar Install"; flow: to_server,established; content:"/Appinstall?app=desktop"; nocase; http_uri; reference:url,www.whenusearch.com; reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000918; classtype:pup-activity; sid:2000918; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer Command Execution"; flow:established; content:"|C2 E5 E5 E5 9E DD A4 A3 D4 A6 D4 D3 D1 C8 A0 A7 A1 D3 C8 D1 87 D7 87 C8 A7 A6 D4 A3 C8 D3 D1 D3 D2 D1 A0 DC DD A4 D2 D4 D5 98 E5|"; reference:url,doc.emergingthreats.net/2010909; classtype:trojan-activity; sid:2010909; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP WhenUClick.com WhenUSave Data Retrieval (Searchdb)"; flow: to_server,established; content:"/SearchDB?update="; nocase; http_uri; reference:url,www.whenusearch.com; reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000919; classtype:pup-activity; sid:2000919; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer DIR Listing"; flow:established; content:"|C2 E5 E5 E5 9E D5 D4 D2 D1 A1 D7 A3 A6 C8 D2 A6 A7 D3 C8 D1 84 D7 D7 C8 DD D2 A6 D2 C8 D2 A7 A7 D2 D7 A4 D6 D7 A3 D4 DC A3 98 E5|"; reference:url,doc.emergingthreats.net/2010910; classtype:trojan-activity; sid:2010910; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Hotbar Install (1)"; flow: to_server,established; content:"/install/startInstallprocess.asp?"; nocase; http_uri; content: "Defau"; http_uri; reference:url,www.hotbar.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000920; classtype:pup-activity; sid:2000920; rev:14; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer WRITE FILE command"; flow: established; content:"|C2 E5 E5 E5 9E DC DD A1 DC D0 DD A3 A6 C8 A1 D5 A4 D7 C8 D1 83 D4 86 C8 A7 DD D1 D4 C8 D7 D6 D7 A4 A7 D6 D0 D2 A0 D2 A6 DD 98 E5|"; reference:url,doc.emergingthreats.net/2010911; classtype:trojan-activity; sid:2010911; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Hotbar Install (2)"; flow: to_server,established; content:"/install/process/upsale/hotbar"; http_uri; reference:url,www.hotbar.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000921; classtype:pup-activity; sid:2000921; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer READ FILE Command"; flow:established; content:"|C2 E5 E5 E5 9E A3 D3 A6 D1 D6 A0 D4 A4 C8 D4 D0 D0 D4 C8 D1 D5 D5 D5 C8 A4 D1 DD D6 C8 A6 D6 D3 D4 DC D3 DC A4 A0 A6 D1 D4 98 E5|"; reference:url,doc.emergingthreats.net/2010912; classtype:trojan-activity; sid:2010912; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Hotbar Install (3)"; flow: to_server,established; content:"/installs/hotbar/programs/"; http_uri; reference:url,www.hotbar.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000922; classtype:pup-activity; sid:2000922; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer NOP Command"; flow:established; content:"|C2 E5 E5 E5 9E D2 DD D6 A0 A4 A6 A7 A3 C8 A0 A3 DD A7 C8 D1 DC DD 80 C8 A4 D5 D0 DC C8 A3 D5 A7 D0 A7 A1 D4 D7 D3 D1 D4 A0 98 E5|"; reference:url,doc.emergingthreats.net/2010913; classtype:trojan-activity; sid:2010913; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Hotbar Agent Reporting Information"; flow: to_server,established; content:"POST"; nocase; http_method; content:"/reports/hotbar/"; http_uri; reference:url,www.hotbar.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000923; classtype:pup-activity; sid:2000923; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer FIND FILE Command"; flow:established; content:"|C2 E5 E5 E5 9E A0 A4 D2 A4 D7 A0 A7 D2 C8 D4 A0 D1 DC C8 D1 81 D0 83 C8 A7 D1 A1 DD C8 A1 D3 D3 D1 D0 A7 D2 D1 D1 D5 A0 D6 98 E5|"; reference:url,doc.emergingthreats.net/2010914; classtype:trojan-activity; sid:2010914; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Hotbar Agent Upgrading"; flow: to_server,established; content:"/updates/hotbar/"; nocase; http_uri; reference:url,www.hotbar.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000924; classtype:pup-activity; sid:2000924; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer YES Command"; flow:established; content:"|C2 E5 E5 E5 9E A0 D7 A4 A6 D0 D5 DD DC C8 D6 DD D7 D5 C8 D1 D6 83 80 C8 DD A4 D1 A1 C8 A4 D2 D5 D7 DD A3 A4 A1 DD A6 D7 DD 98 E5|"; reference:url,doc.emergingthreats.net/2010915; classtype:trojan-activity; sid:2010915; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Hotbar Agent Partner Checkin"; flow: to_server,established; content:"/partners/"; nocase; http_uri; content:"partners.xip"; nocase; http_uri; reference:url,www.hotbar.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000925; classtype:pup-activity; sid:2000925; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer ADD RUN ONCE Command"; flow:established; content:"|C2 E5 E5 E5 9E D6 DD D1 A0 A7 A0 D7 A6 C8 A3 DC A0 A4 C8 D1 83 D3 87 C8 DC D1 A0 A3 C8 A6 DC A1 D7 A1 A4 D0 DD A3 A1 D4 D6 98 E5|"; reference:url,doc.emergingthreats.net/2010916; classtype:trojan-activity; sid:2010916; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP ISearchTech.com XXXPornToolbar Reporting"; flow: to_server,established; content:"/ist/scripts/log_downloads.php"; nocase; http_uri; reference:url,www.isearchtech.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000927; classtype:pup-activity; sid:2000927; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer DEL FILE Command"; flow:established; content:"|C2 E5 E5 E5 9E D1 A3 D1 A3 D5 A1 DD DD C8 A0 D2 D4 D0 C8 D1 87 D4 83 C8 A7 D6 D4 D4 C8 D3 D4 A0 D0 D6 D5 A6 D7 A6 DD A3 A6 98 E5|"; reference:url,doc.emergingthreats.net/2010917; classtype:trojan-activity; sid:2010917; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP ISearchTech.com XXXPornToolbar Activity (1)"; flow: to_server,established; content:"/ist/bars/"; nocase; http_uri; reference:url,www.isearchtech.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000928; classtype:pup-activity; sid:2000928; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET MALWARE Aurora Backdoor (C&C) client connection to CnC"; flow:established,to_server; content:"|ff ff ff ff ff ff 00 00 fe ff ff ff ff ff ff ff ff ff 88 ff|"; depth:20; flowbits:set,ET.aurora.init; reference:url,www.trustedsource.org/blog/373/An-Insight-into-the-Aurora-Communication-Protocol; reference:url,doc.emergingthreats.net/2010695; classtype:command-and-control; sid:2010695; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Hotbar Agent Activity"; flow: to_server,established; content:"/dynamic/hotbar/"; nocase; http_uri; threshold: type limit, count 1, track by_src, seconds 360; reference:url,www.hotbar.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000929; classtype:pup-activity; sid:2000929; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Aurora Backdoor (C&C) connection CnC response"; flowbits:isset,ET.aurora.init; flow:established,from_server; content:"|cc cc cc cc cd cc cc cc cd cc cc cc cc cc cc cc|"; depth:16; reference:url,www.trustedsource.org/blog/373/An-Insight-into-the-Aurora-Communication-Protocol; reference:url,doc.emergingthreats.net/2010696; classtype:command-and-control; sid:2010696; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Comet Systems Spyware Traffic"; flow: to_server,established; content:"/cc/"; http_uri; content:"Host|3a| update.cc.cometsystems.com"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2000931; classtype:pup-activity; sid:2000931; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor Possible Backdoor.Cow Varient (Backdoor.Win32.Agent.lam) C&C traffic"; content:"|6C 3C|"; depth:2; content:"|3E 20|"; within:3; content:"bid="; nocase; within:20; content:"bver="; nocase; within:20; content:"bip="; nocase; within:20; content:"bn="; nocase; within:20; reference:url,doc.emergingthreats.net/2008465; classtype:command-and-control; sid:2008465; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Keenvalue Update Engine"; flow: to_server,established; content:"Host|3a|secure.keenvalue.com"; http_header; content:"|0d0a|Extension|3a|Remote-Passphrase"; reference:url,www.safer-networking.org/index.php?page=updatehistory&detail=2003-11-24; reference:url,doc.emergingthreats.net/bin/view/Main/2000932; classtype:pup-activity; sid:2000932; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 8000 (msg:"ET MALWARE Backdoor.Hupigon Possible Control Connection Being Established"; flow:established,to_server; dsize:4; content:"|00 00 00 00|"; flowbits:set,BSHupigonControlStart; reference:url,www.avira.com/en/threats/section/fulldetails/id_vir/1051/bds_hupigon.bo.html; reference:url,doc.emergingthreats.net/2002974; classtype:trojan-activity; sid:2002974; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP FlashTrack Agent Retrieving New App Code"; flow: to_server,established; content:"/apps/r.exe"; http_uri; reference:url,www.flashpoint.bm; reference:url,doc.emergingthreats.net/bin/view/Main/2000936; classtype:pup-activity; sid:2000936; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 8000 (msg:"ET MALWARE Backdoor.Hupigon INFECTION - Reporting Host Type"; flow:established,to_server; flowbits:isset,BSHupigonControlStart; content:"Windows "; flowbits:isset,BSHupigonControlStart; reference:url,www.avira.com/en/threats/section/fulldetails/id_vir/1051/bds_hupigon.bo.html; reference:url,doc.emergingthreats.net/2002975; classtype:trojan-activity; sid:2002975; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Fun Web Products SmileyCentral"; flow: to_server,established; content:"/images/smileycentral/"; nocase; http_uri; content:"FunWebProducts"; nocase; http_header; fast_pattern; reference:url,www.funwebproducts.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001013; classtype:pup-activity; sid:2001013; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET !$HTTP_PORTS -> $EXTERNAL_NET 1337 (msg:"ET MALWARE Win32.SkSocket C&C Connection"; flow:established,to_server; flags:PA,12; dsize:1; content:"|04|"; reference:url,doc.emergingthreats.net/2007585; classtype:command-and-control; sid:2007585; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SideStep Bar Install"; flow: to_server,established; content:"/servlet/sbinstservlet"; nocase; http_uri; reference:url,www.sidestep.com; reference:url,www.spyany.com/program/article_spw_rm_SideStep.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001016; classtype:pup-activity; sid:2001016; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor.Win32.VB.brg C&C Checkin"; flow:established,to_server; content:"Status|2a 28|Idle|2e 2e 2e 29 2a|"; depth:17; offset:0; reference:url,doc.emergingthreats.net/2007922; classtype:command-and-control; sid:2007922; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SideStep Bar Reporting Data"; flow: to_server,established; content:"/servlet/sblogservlet"; nocase; http_uri; reference:url,www.sidestep.com; reference:url,www.spyany.com/program/article_spw_rm_SideStep.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001017; classtype:pup-activity; sid:2001017; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor.Win32.VB.brg C&C Reporting Version"; flow:established,to_server; content:"Version|28 2a|"; depth:9; offset:0; content:"|29 2a|"; within:8; reference:url,doc.emergingthreats.net/2007979; classtype:command-and-control; sid:2007979; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Casino on Net Ping Hit"; flow: to_server,established; content:"/Ping/Ping.txt"; nocase; http_uri; reference:url,www.888casino.net; reference:url,doc.emergingthreats.net/bin/view/Main/2001032; classtype:pup-activity; sid:2001032; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor.Win32.VB.brg C&C Kill Command Acknowledge"; flow:established,to_server; dsize:29; content:"Status|28 2a|UDP Attack Running!|2a 28|"; offset:0; reference:url,doc.emergingthreats.net/2007981; classtype:command-and-control; sid:2007981; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Casino on Net Data Download"; flow: to_server,established; content:"/sdl/casinov"; nocase; http_uri; reference:url,www.888casino.net; reference:url,doc.emergingthreats.net/bin/view/Main/2001033; classtype:pup-activity; sid:2001033; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor.Win32.VB.brg C&C DDoS Outbound"; flow:established,from_server; dsize:>100; content:"|ff ff ff ff|"; depth:4; content:" own you bitch!"; within:20; content:"|01 01 01 01 01 01 01 01 01 01 01 01 01|"; reference:url,doc.emergingthreats.net/2007982; classtype:command-and-control; sid:2007982; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Ebates Install"; flow: to_server,established; content:"/ebates.exe"; http_uri; reference:url,www.pestpatrol.com/PestInfo/e/ebates_moneymaker.asp; reference:url,doc.emergingthreats.net/bin/view/Main/2001038; classtype:pup-activity; sid:2001038; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Bandook v1.2 Initial Connection and Report"; flowbits:isnotset,BE.Bandook1.2; flow:established,to_server; content:"&first& # "; pcre:"/# \d+d \d+dh \d+m # /iR"; flowbits:set,BE.Bandook1.2; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003549; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Casino on Net Install"; flow: to_server,established; content:"/newdownload/newsetup/"; nocase; http_uri; content:"casinone"; nocase; reference:url,www.888casino.net; reference:url,doc.emergingthreats.net/bin/view/Main/2001041; classtype:pup-activity; sid:2001041; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Bandook v1.2 Get Processes"; flowbits:isset,BE.Bandook1.2; flow:established,to_server; dsize:8; content:"|99 9b 86 8a 85 80 9a 9d|"; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003550; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP UPX encrypted file download possible malware"; flow:established,from_server; content:"|0d 0a 0d 0a|MZ"; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; content:"|00|code|00|"; content:"|00 C0|text|00|"; reference:url,doc.emergingthreats.net/2001047; classtype:pup-activity; sid:2001047; rev:14; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Bandook v1.2 Kill Process Command"; flowbits:isset,BE.Bandook1.2; flow:established,to_server; dsize:>8; content:"kill3d"; offset:0; depth:6; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003551; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP CometSystems Spyware"; flow: to_server,established; content:"/comet/request"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001050; classtype:pup-activity; sid:2001050; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.2 Reporting Socks Proxy Active"; flowbits:isset,BE.Bandook1.2; flow:established,from_server; dsize:7; content:"sockson"; offset:0; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003552; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Twaintec Download Attempt"; flow: to_server,established; content:"/downloads/cabs/TWTDLL/twaintec.cab"; nocase; http_uri; reference:url,www.pestpatrol.com/PestInfo/t/twain-tech.asp; reference:url,doc.emergingthreats.net/bin/view/Main/2001198; classtype:pup-activity; sid:2001198; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.2 Reporting Socks Proxy Off"; flowbits:isset,BE.Bandook1.2; flow:established,from_server; dsize:8; content:"socksoff"; offset:0; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003553; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Twaintec Ad Retrieval"; flow: to_server,established; content:"/twain/servlet/Twain?adcontext="; nocase; http_uri; reference:url,www.pestpatrol.com/PestInfo/t/twain-tech.asp; reference:url,doc.emergingthreats.net/bin/view/Main/2001199; classtype:pup-activity; sid:2001199; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.2 Client Ping Reply"; flowbits:isset,BE.Bandook1.2; flow:established,from_server; dsize:10; content:"&SEXREPLY&"; offset:0; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003554; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Twaintec Reporting Data"; flow: to_server,established; content:"/downloads/record_download.asp"; nocase; http_uri; reference:url,www.pestpatrol.com/PestInfo/t/twain-tech.asp; reference:url,doc.emergingthreats.net/bin/view/Main/2001216; classtype:pup-activity; sid:2001216; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.35 Keepalive Send"; flowbits:isset,BE.Bandook1.35; flow:established,from_server; dsize:6; content:"|cf ab a8 a7 ae cf|"; offset:0; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003556; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP F1Organizer Config Download"; flow: to_server,established; content:"/F1/Cmd4F1"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001221; classtype:pup-activity; sid:2001221; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Bandook v1.35 Keepalive Reply"; flowbits:isset,BE.Bandook1.35; flow:established,to_server; dsize:9; content:"|cf ab a8 a4 ae cf 26 26 26|"; offset:0; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003557; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Regnow.com Gamehouse.com Access"; flow: to_server,established; content:"/affiliates/template.jsp?"; nocase; http_uri; content:"AID="; nocase; http_uri; reference:url,www.gamehouse.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001224; classtype:pup-activity; sid:2001224; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.35 Create Registry Key Command Send"; flowbits:isset,BE.Bandook1.35; flow:established,from_server; dsize:>10; content:"|cf 9b 8c 8e 8a 9b cf|"; offset:0; depth:7; content:"|95|"; distance:5; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003558; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Statblaster Receiving New configuration (update)"; flow: to_server,established; content:"/updatestats/update"; nocase; http_uri; content:".xml"; nocase; http_uri; content:"update"; depth:6; http_user_agent; content:"statblaster"; http_header; fast_pattern:only; pcre:"/\/updatestats\/update\d+?\.xml$/U"; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.statblaster.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001225; classtype:pup-activity; sid:2001225; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.35 Create Directory Command Send"; flowbits:isset,BE.Bandook1.35; flow:established,from_server; dsize:>7; content:"|cf 84 82 8d 80 9b cf 95|"; offset:0; depth:8; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003559; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Advertising.com Data Post (villains)"; flow: to_server,established; content:"/Games/villains.aspx"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.fastseek.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001228; classtype:pup-activity; sid:2001228; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.35 Window List Command Send"; flowbits:isset,BE.Bandook1.35; flow:established,from_server; dsize:10; content:"|cf 8e 80 84 84 8c 9e 80 87 cf|"; offset:0; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003560; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Advertising.com Data Post (cakedeal)"; flow: to_server,established; content:"/Games/cakedeal.aspx"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.fastseek.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001230; classtype:pup-activity; sid:2001230; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Bandook v1.35 Window List Reply"; flowbits:isset,BE.Bandook1.35; flow:established,to_server; dsize:>10; content:"|cf 9e 80 87 85 80 9a 9d cf|"; offset:0; depth:9; content:"|26 26 26|"; distance:10; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003561; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Wild Tangent Agent Installation"; flow: to_server,established; content:"/Recovery/Checkin.aspx?version"; nocase; http_uri; reference:url,www.spyany.com/program/article_spw_rm_WildTangent.html; reference:url,www.wildtangent.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001307; classtype:pup-activity; sid:2001307; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.35 Get Processes Command Send"; flowbits:isset,BE.Bandook1.35; flow:established,from_server; dsize:8; content:"|99 9b 86 8a 85 80 9a 9d|"; offset:0; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003562; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Internet Optomizer Reporting Data"; flow: to_server,established; content:"/io/downloads/"; nocase; http_uri; content:"/wsi8/optimize"; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.netoptimizer.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001308; classtype:pup-activity; sid:2001308; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Bandook v1.35 Get Processes Command Reply"; flowbits:isset,BE.Bandook1.35; flow:established,to_server; dsize:>10; content:"|cf 9d 82 99 9b 86 8a cf|"; offset:0; depth:8; content:"|26 26 26|"; distance:10; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003565; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Wild Tangent Agent Checking In"; flow: to_server,established; content:"/CDADeliveries/Checkin.aspx"; nocase; http_uri; reference:url,www.spyany.com/program/article_spw_rm_WildTangent.html; reference:url,www.wildtangent.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001309; classtype:pup-activity; sid:2001309; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.35 Start Socks5 Proxy Command Send"; flowbits:isset,BE.Bandook1.35; flow:established,from_server; dsize:>6; content:"|a7 a0 a7 ae 95|"; offset:0; depth:5; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003563; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Wild Tangent Agent Traffic"; flow: to_server,established; content:"/CDAFiles/DP/SysConfig"; nocase; http_uri; reference:url,www.spyany.com/program/article_spw_rm_WildTangent.html; reference:url,www.wildtangent.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001310; classtype:pup-activity; sid:2001310; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Bandook v1.35 Socks5 Proxy Start Command Reply"; flowbits:isset,BE.Bandook1.35; flow:established,to_server; dsize:10; content:"|9a 86 8a 82 9a 86 87 26 26 26|"; offset:0; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003564; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Rdxrp.com Traffic"; flow: to_server,established; content:"/rdxr020304.dat"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001311; classtype:pup-activity; sid:2001311; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Bandok phoning home (xor by 0xe9 to decode)"; flow:established,to_server; content:"|CF 8F 80 9B 9A 9D CF 95|"; depth:8; dsize:<80; reference:url,www.dshield.org/diary.html?date=2007-03-28; reference:url,www.secureworks.com/research/threats/bbbphish/?threat=bbbphish; reference:url,doc.emergingthreats.net/2003936; classtype:trojan-activity; sid:2003936; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Traffic Syndicate Add/Remove"; flow: to_server,established; content:"/Support/AddRemove.aspx?id="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001313; classtype:pup-activity; sid:2001313; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert udp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Banker.ike UDP C&C"; content:"|86 71 3b 72 50 61 7d 95 5f 61 46|"; nocase; reference:url,doc.emergingthreats.net/2007957; classtype:command-and-control; sid:2007957; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Wild Tangent Agent"; flow: to_server,established; content:"/CDAFiles/"; nocase; http_uri; reference:url,www.spyany.com/program/article_spw_rm_WildTangent.html; reference:url,www.wildtangent.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001314; classtype:pup-activity; sid:2001314; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Banker Trojan CnC AddNew Command"; flow:established,to_server; dsize:<120; content:"[S]ADDNEW|7c|"; depth:10; reference:url,doc.emergingthreats.net/2009862; classtype:command-and-control; sid:2009862; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Traffic Syndicate Agent Updating (1)"; flow: to_server,established; content:"/TbLinkConfig.asmx"; nocase; http_uri; threshold: type limit, track by_src, count 1, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/2001315; classtype:pup-activity; sid:2001315; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Banker Trojan CnC Hello Command"; flow:established,to_server; dsize:12; content:"[S]hello["; depth:9; reference:url,doc.emergingthreats.net/2009863; classtype:command-and-control; sid:2009863; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Traffic Syndicate Agent Updating (2)"; flow: to_server,established; content:"/TbInstConfig.asmx"; nocase; http_uri; threshold: type limit, track by_src, count 1, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/2001316; classtype:pup-activity; sid:2001316; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 8074 (msg:"ET MALWARE Banload Gadu-Gadu CnC Message Detected"; flowbits:isset,ET.gadu.loggedin; flow:established,to_server; content:"Uruchomiono trojana, wpisz help aby uzyskac pomoc"; nocase; reference:url,doc.emergingthreats.net/2008320; classtype:command-and-control; sid:2008320; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP Webhancer Data Upload"; flow: from_server,established; content:"WebHancer Authority Server"; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.webhancer.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001317; classtype:pup-activity; sid:2001317; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 447 (msg:"ET MALWARE Bobax/Kraken/Oderoor UDP 447 CnC Channel Initial Packet Outbound"; dsize:24; threshold:type threshold, track by_src, count 2, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/OdeRoor; classtype:command-and-control; sid:2008104; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Speedera Agent (Specific)"; flow: to_server,established; content:"/io/downloads/3/wsem302.dl"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001321; classtype:pup-activity; sid:2001321; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert udp $EXTERNAL_NET 447 -> $HOME_NET 1024: (msg:"ET MALWARE Bobax/Kraken/Oderoor UDP 447 CnC Channel Initial Packet Inbound"; dsize:24; threshold:type threshold, track by_src, count 2, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/OdeRoor; classtype:command-and-control; sid:2008105; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Wild Tangent New Install"; flow: to_server,established; content:"/NewUser/Checkin.aspx"; nocase; http_uri; reference:url,www.spyany.com/program/article_spw_rm_WildTangent.html; reference:url,www.wildtangent.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001322; classtype:pup-activity; sid:2001322; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 447 -> $HOME_NET 1024: (msg:"ET MALWARE Bobax/Kraken/Oderoor TCP 447 CnC Channel Initial Packet Inbound"; flow:established; dsize:24; threshold:type threshold, track by_src, count 2, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/OdeRoor; classtype:command-and-control; sid:2008106; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP Ezula Installer Download"; flow: from_server,established; content:"|65 5a 75 6c 61 20 49 6e 73 74 61 6c 6c 61 74 69 6f 6e 00 49|"; reference:url,www.ezula.com; reference:url,www.spyany.com/program/article_spw_rm_eZuLa.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001335; classtype:pup-activity; sid:2001335; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 447 (msg:"ET MALWARE Possible Bobax/Kraken/Oderoor UDP 447 CnC Channel Outbound"; threshold:type threshold, track by_src, count 5, seconds 60; reference:url,doc.emergingthreats.net/bin/view/Main/OdeRoor; classtype:command-and-control; sid:2008109; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP LocalNRD Spyware Checkin"; flow: to_server,established; content:"/a/Drk.syn?"; nocase; http_uri; content: "adcontext"; nocase; http_uri; reference:url,www.localnrd.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001340; classtype:pup-activity; sid:2001340; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET !$HTTP_PORTS -> $EXTERNAL_NET 1639 (msg:"ET DELETED Bofra Victim Accessing Reactor Page"; flow: from_client,established; content:"GET "; nocase; content:"reactor"; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/w32.bofra.e@mm.html; reference:url,us.mcafee.com/virusInfo/default.asp?id=description&virus_k=129631; reference:url,doc.emergingthreats.net/2001430; classtype:trojan-activity; sid:2001430; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP OfferOptimizer.com Spyware"; flow: to_server,established; content:"/ctx/keyword_context.php?"; nocase; http_uri; content:"urlContext=http"; nocase; http_uri; reference:url,www.offeroptimizer.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001341; classtype:pup-activity; sid:2001341; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Ceckno Keepalive from Controller"; flow:established,from_server; dsize:1; content:"1"; flowbits:isset,ET.cekno.initial; reference:url,doc.emergingthreats.net/2008178; classtype:trojan-activity; sid:2008178; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Bonziportal Traffic"; flow: to_server,established; content:"/bonziportal/bin/"; http_uri; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=59256; reference:url,doc.emergingthreats.net/bin/view/Main/2001345; classtype:pup-activity; sid:2001345; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Codesoft PW Stealer Email Report Outbound"; flow:established,to_server; content:"|0d 0a|Subject|3a| Codesoft PW Stealer"; content:"******STEAM PASS STEALER*******"; distance:0; reference:url,doc.emergingthreats.net/2008310; classtype:trojan-activity; sid:2008310; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MarketScore.com Spyware Access"; flow: to_server,established; content:"proxyhttp|0b|marketscore|03|com"; http_uri; reference:url,www.marketscore.com; reference:url,www.spysweeper.com/remove-marketscore.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001359; classtype:pup-activity; sid:2001359; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET MALWARE Conficker.a Shellcode"; flow:established,to_server; content:"|e8 ff ff ff ff c1|^|8d|N|10 80|1|c4|Af|81|9EPu|f5 ae c6 9d a0|O|85 ea|O|84 c8|O|84 d8|O|c4|O|9c cc|IrX|c4 c4 c4|,|ed c4 c4 c4 94|& $EXTERNAL_NET any (msg:"ET ADWARE_PUP Internet Optimizer Spyware Install"; flow: to_server,established; content:"/internet-optimizer/"; nocase; http_uri; content:"/optimize"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.netoptimizer.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001396; classtype:pup-activity; sid:2001396; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET MALWARE Conficker.b Shellcode"; flow:established,to_server; content:"|e8 ff ff ff ff c2|_|8d|O|10 80|1|c4|Af|81|9MSu|f5|8|ae c6 9d a0|O|85 ea|O|84 c8|O|84 d8|O|c4|O|9c cc|Ise|c4 c4 c4|,|ed c4 c4 c4 94|& $EXTERNAL_NET any (msg:"ET ADWARE_PUP Bfast.com Spyware"; flow: to_server,established; content:"/bfast/serve?bfmid"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001398; classtype:pup-activity; sid:2001398; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert udp $HOME_NET [!1720,!1722,!2427,!5060,1024:] -> $EXTERNAL_NET [!1720,!1722,!2427,!5060,1024:] (msg:"ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 4)"; dsize:>19; byte_test:1, &, 4, 19; threshold: type both, track by_src, count 95, seconds 40; reference:url,mtc.sri.com/Conficker/addendumC/; reference:url,doc.emergingthreats.net/2009206; reference:url,www.mandiant.com/resources/apt41-us-state-governments; reference:md5,b82456963d04f44e83442b6393face47; classtype:trojan-activity; sid:2009206; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP E2give Related Reporting Install"; flow: to_server,established; content:"/count/count.php?&mm"; nocase; http_uri; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=E2Give&threatid=4728; reference:url,doc.emergingthreats.net/bin/view/Main/2001416; classtype:pup-activity; sid:2001416; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert udp $HOME_NET [!1720,!1722,!2427,!5060,1024:] -> $EXTERNAL_NET [!1720,!1722,!2427,!5060,1024:] (msg:"ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)"; dsize:>19; byte_test:1, &, 5, 19; threshold: type both, track by_src, count 95, seconds 40; reference:url,mtc.sri.com/Conficker/addendumC/; reference:url,doc.emergingthreats.net/2009207; reference:url,www.mandiant.com/resources/apt41-us-state-governments; reference:md5,b82456963d04f44e83442b6393face47; classtype:trojan-activity; sid:2009207; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP E2give Related Receiving Config"; flow:established,to_server; http.uri; content:"/config/?"; nocase; content:"v=5"; nocase; content:"n=mm2"; nocase; content:"i="; nocase; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=E2Give&threatid=4728; reference:url,doc.emergingthreats.net/bin/view/Main/2001417; classtype:pup-activity; sid:2001417; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2022_04_18;) -#alert udp $HOME_NET [!1720,!1722,!2427,!5060,1024:] -> $EXTERNAL_NET [!1720,!1722,!2427,!5060,1024:] (msg:"ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16)"; dsize:>19; byte_test:1, &, 16, 19; threshold: type both, track by_src, count 95, seconds 40; reference:url,mtc.sri.com/Conficker/addendumC/; reference:url,doc.emergingthreats.net/2009208; classtype:trojan-activity; sid:2009208; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP E2give Related Reporting"; flow: to_server,established; content:"/count/count.php?&mm2cpr"; nocase; http_uri; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=E2Give&threatid=4728; reference:url,doc.emergingthreats.net/bin/view/Main/2001423; classtype:pup-activity; sid:2001423; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE DNS Changer.bnm/Downloader.bnm CnC Channel Start"; flow:established,to_server; dsize:8; content:"|0b 01 00 00 00 00 00 00|"; flowbits:noalert; flowbits:set,ET.dlbnm1; reference:url,doc.emergingthreats.net/2008805; classtype:command-and-control; sid:2008805; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET 20 -> $HOME_NET any (msg:"ET ADWARE_PUP Abox Download"; flow:established,to_server; content:"|5c 00 43 00 61 00 72 00 6d 00 65 00 6e 00 00 00 16 00 00 00 73 00 75 00 63|"; nocase; offset:160; depth:26; reference:url,doc.emergingthreats.net/bin/view/Main/2001440; classtype:pup-activity; sid:2001440; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE DNS Changer.bnm/Downloader.bnm CnC Channel Start Response"; flow:established,from_server; dsize:4; content:"|0b 01|"; depth:2; content:"|00|"; distance:1; within:1; flowbits:isset,ET.dlbnm1; reference:url,doc.emergingthreats.net/2008806; classtype:command-and-control; sid:2008806; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Abox Install Report"; flow: to_server,established; content:"&time="; nocase; http_uri; content:"/new_install?id="; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.adultbox.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001441; classtype:pup-activity; sid:2001441; rev:14; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE DNS Changer.bnm/Downloader.bnm Second CnC Channel Start"; flow:established,to_server; dsize:32; content:"|00 00 00 00 c0 a8 01 1e 67 00 00 00 00|"; depth:13; reference:url,doc.emergingthreats.net/2008807; classtype:command-and-control; sid:2008807; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Statblaster.MemoryWatcher Download"; flow: to_server,established; content:"/memorywatcher.exe"; http_uri; reference:url,www.memorywatcher.com/eula.aspx; reference:url,doc.emergingthreats.net/bin/view/Main/2001442; classtype:pup-activity; sid:2001442; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE DNS Changer.bnm/Downloader.bnm Second CnC Channel Traffic"; flow:established,to_server; dsize:32; content:"|55 d8 09 00 c0 a8 01 1e 67 00 00 00 00|"; depth:13; reference:url,doc.emergingthreats.net/2008808; classtype:command-and-control; sid:2008808; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Overpro Spyware Bundle Install"; flow: to_server,established; content:"Host|3a| download.overpro.com"; nocase; http_header; pcre:"/(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/WildApp\.cab/i"; reference:url,www.wildarcade.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001444; classtype:pup-activity; sid:2001444; rev:14; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET MALWARE Delf Keylog FTP Upload"; flow:established,to_server; content:"STOR "; depth:5; content:" Keylogger ["; nocase; distance:5; within:50; content:"].txt|0d 0a|"; nocase; distance:5; within:40; reference:url,doc.emergingthreats.net/2007858; classtype:trojan-activity; sid:2007858; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ADWARE_PUP 2nd-thought (W32.Daqa.C) Download"; flow: from_server,established; content:"|67 6f 69 64 72 2e 63 61 62|"; nocase; content:"|48 6f 73 74 3a 20 77 77 77 2e 77 65 62 6e 65 74 69 6e 66 6f 2e 6e 65 74|"; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.secondthought.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001447; classtype:pup-activity; sid:2001447; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Delf CnC Channel Keepalive Pong"; flow:established,to_server; dsize:<40; content:"|20 00 00 00 f8 4d b2 77|"; depth:8; reference:url,doc.emergingthreats.net/2008009; classtype:command-and-control; sid:2008009; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Wintools Download/Configure"; flow: to_server,established; content:"/WTools"; nocase; http_uri; content:".cab"; nocase; http_uri; reference:url,www.intermute.com/spyware/HuntBar.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001450; classtype:pup-activity; sid:2001450; rev:14; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Delf CnC Channel Keepalive Ping"; flow:established,from_server; dsize:22; content:"|12 00 00 00 1c 5e|"; depth:6; reference:url,doc.emergingthreats.net/2008010; classtype:command-and-control; sid:2008010; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Bundleware Spyware Download"; flow: to_server,established; content:"/app/InternetFuel/AppWrap.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001451; classtype:pup-activity; sid:2001451; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Trojan.Delf-5496 Checkin Error"; flow:established,to_server; dsize:350<>450; content:"Erorr File active\;sorry file erorr plaes down file agen"; reference:url,doc.emergingthreats.net/2008905; classtype:command-and-control; sid:2008905; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Bundleware Spyware CHM Download"; flow: to_server,established; content:"Referer|3a| ms-its|3a|mhtml|3a|file|3a|//C|3a|counter.mht!http|3a|//"; nocase; content:"/counter/HELP3.CHM|3a 3a|/help.htm"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2001452; classtype:pup-activity; sid:2001452; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Trojan.Delf-5496 Egg Request"; flow:established,to_server; dsize:<35; content:"|7c|CreateForm|7c|FileTransfer|7c|"; depth:29; reference:url,doc.emergingthreats.net/2008906; classtype:trojan-activity; sid:2008906; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Couponage Download"; flow: to_server,established; content:".dl_"; nocase; http_uri; content:"couponage.com"; nocase; http_header; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453090725; reference:url,doc.emergingthreats.net/bin/view/Main/2001453; classtype:pup-activity; sid:2001453; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Trojan.Delf-5496 File Manager Access Report"; flow:established,to_server; dsize:<35; content:"|7c|CreateForm|7c|FileManager|7c|"; depth:30; reference:url,doc.emergingthreats.net/2008907; classtype:trojan-activity; sid:2008907; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Couponage Configure"; flow: to_server,established; content:".da_"; nocase; content:"couponage.com"; nocase; http_header; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453090725; reference:url,doc.emergingthreats.net/bin/view/Main/2001454; classtype:pup-activity; sid:2001454; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Donbot Report to CnC"; flow:established,to_server; content:"HASH|3a 20|"; depth:6; content:"|0d 0a|ID|3a 20|"; distance:0; content:"|0d 0a|Session|31 20|"; distance:0; content:"|0d 0a|RBL|3a 20|"; reference:url,blog.fireeye.com/research/2009/10/a-little_more_on_donbot.html; reference:url,www.avertlabs.com/research/blog/index.php/2009/04/05/donbot-joining-the-club-of-million-dollar-botnets/; reference:url,doc.emergingthreats.net/2008451; classtype:command-and-control; sid:2008451; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP ContextPanel Reporting"; flow: to_server,established; content:"/cplog/?logtype="; nocase; http_uri; content:"contextpanel.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001456; classtype:pup-activity; sid:2001456; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Dorf/Win32.Inject.adt C&C Communication Outbound"; flow:established,to_server; dsize:16; content:"1SCD|00 00|"; depth:6; offset:0; reference:url,doc.emergingthreats.net/2008031; classtype:command-and-control; sid:2008031; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Bundleware Spyware cab Download"; flow: to_server,established; content:"/counter/counter_v3.cab"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001458; classtype:pup-activity; sid:2001458; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Dorf/Win32.Inject.adt C&C Communication Inbound"; flow:established,from_server; dsize:16; content:"1SCD|00 00|"; depth:6; offset:0; reference:url,doc.emergingthreats.net/2008032; classtype:command-and-control; sid:2008032; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Overpro Spyware Games"; flow: to_server,established; content:"/blocks/blasterblocks"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.overpro.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001459; classtype:pup-activity; sid:2001459; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Dropper-497 (Yumato) System Stats Report"; flow:established,to_server; content:"|00 00 00 83|"; depth:4; content:""; content:"<"; distance:0; content:""; content:"<"; distance:0; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanDropper497; classtype:trojan-activity; sid:2007918; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Sexmaniack Install Tracking"; flow: to_server,established; content:"/counted.php?ref="; nocase; http_uri; content:"Host|3a| counter.sexmaniack.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001460; classtype:pup-activity; sid:2001460; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Dropper-497 Yumato Reply from server"; flow:established,from_server; content:"YUMATO|0d 0a|1234"; depth:12; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanDropper497; classtype:trojan-activity; sid:2007919; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs (1)"; flow: to_server,established; content:"/fa/evil.html"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001461; classtype:pup-activity; sid:2001461; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity TCP (1)"; flow:established,to_server; content:"|08616c2d6a696e616e036e65740000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007673; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs Occuring"; flow: to_server,established; content:"/fa/?d=get"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001462; classtype:pup-activity; sid:2001462; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity TCP (2)"; flow:established,to_server; content:"|0861312d6a696e616e036e65740000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007674; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs (2)"; flow: to_server,established; content:"src=http|3a|//xpire.info/i.exe"; nocase; http_client_body; reference:url,doc.emergingthreats.net/bin/view/Main/2001463; classtype:pup-activity; sid:2001463; rev:12; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity TCP (3)"; flow:established,to_server; content:"|0661726464726104686f737402736b0000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007675; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs (3)"; flow: to_server,established; content:"/i.exe"; nocase; http_uri; content:"xpire.info"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001464; classtype:pup-activity; sid:2001464; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity TCP (4)"; flow:established,to_server; content:"|03777777056a6f2d7566036e65740000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007676; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs (4)"; flow: to_server,established; content:"/dl/adv121.php"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001466; classtype:pup-activity; sid:2001466; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity TCP (5)"; flow:established,to_server; content:"|037777770c6a6f66706d7579747276636603636f6d0000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007677; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs (5)"; flow: to_server,established; content:"/dl/adv121/x.chm"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001467; classtype:pup-activity; sid:2001467; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity UDP (1)"; content:"|08616c2d6a696e616e036e65740000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007678; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs CHM Exploit"; flow: to_server,established; content:"/fa/ied_s7m.chm"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001468; classtype:pup-activity; sid:2001468; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity UDP (2)"; content:"|0861312d6a696e616e036e65740000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007679; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs (6)"; flow: to_server,established; content:"/fa/x.chm"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001469; classtype:pup-activity; sid:2001469; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity UDP (3)"; content:"|0661726464726104686f737402736b0000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007680; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs (7)"; flow: to_server,established; content:"/fa/xpl3.htm"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001470; classtype:pup-activity; sid:2001470; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity UDP (4)"; content:"|03777777056a6f2d7566036e65740000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007681; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Spyware Exploit"; flow: to_server,established; content:"/2DimensionOfExploitsEnc.php"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001471; classtype:pup-activity; sid:2001471; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity UDP (5)"; content:"|037777770c6a6f66706d7579747276636603636f6d0000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007682; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Coolsearch Spyware Install"; flow: to_server,established; content:"coolsearch.biz/united.htm"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2001479; classtype:pup-activity; sid:2001479; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Likely EXE Cryptor Packed Binary - Likely Malware"; flow:from_server,established; content:"|4D 5A|"; content:"|2E 70 61 63 6B 65 64|"; within: 447; reference:url,bits.packetninjas.org; reference:url,doc.emergingthreats.net/2008557; classtype:trojan-activity; sid:2008557; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MediaTickets Spyware Install"; flow: to_server,established; content:"/mtrslib2.js"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.winad.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001481; classtype:pup-activity; sid:2001481; rev:9; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET MALWARE elitekeylogger v1.0 reporting - Inbound"; flow:established,to_server; content:"MAIL FROM|3a|"; reference:url,doc.emergingthreats.net/2002938; classtype:trojan-activity; sid:2002938; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP thebestsoft4u.com Spyware Install (1)"; flow: to_server,established; content:"/pa/glx.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001482; classtype:pup-activity; sid:2001482; rev:9; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE elitekeylogger v1.0 reporting - Outbound"; flow:established,to_server; content:"MAIL FROM|3a|"; reference:url,doc.emergingthreats.net/2002941; classtype:trojan-activity; sid:2002941; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchmeup Spyware Install (d.exe)"; flow: to_server,established; content:"/x30/d.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001484; classtype:pup-activity; sid:2001484; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE GENERAL Possible Trojan Sending Initial Email to Owner - SUCCESSO"; flow:established,to_server; content:"PC INFECTADO COM SUCCESSO"; nocase; reference:url,doc.emergingthreats.net/2002983; classtype:trojan-activity; sid:2002983; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP thebestsoft4u.com Spyware Install (2)"; flow: to_server,established; content:"/pa/proxyrnd.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001485; classtype:pup-activity; sid:2001485; rev:9; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Pass Stealer FTP Upload"; flow:established,to_server; content:"INFECTADO|0d 0a|=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|0d 0a|Computador"; depth:64; reference:url,doc.emergingthreats.net/2008237; classtype:trojan-activity; sid:2008237; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spygalaxy.ws Spyware Checkin"; flow: to_server,established; content:"/install.php?id="; nocase; http_uri; content:"Host|3a| spygalaxy.ws|0d 0a|"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001489; classtype:pup-activity; sid:2001489; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Gh0st Trojan CnC"; flow:established,to_server; content:"Gh0st"; depth:5; flowbits:set,ET.gh0st_client; reference:url,doc.emergingthreats.net/2010859; classtype:command-and-control; sid:2010859; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, malware_family Gh0st, malware_family PCRAT, signature_severity Critical, tag PCRAT, tag Gh0st, tag RAT, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP ICQ-Update.biz Reporting Install"; flow: to_server,established; content:"log.php?"; nocase; http_uri; content: "IP="; nocase; http_uri; content:"Port1="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001490; classtype:pup-activity; sid:2001490; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Gh0st Trojan CnC Response"; flow:established,from_server; content:"Gh0st"; depth:5; flowbits:isset,ET.gh0st_client; reference:url,doc.emergingthreats.net/2010860; classtype:command-and-control; sid:2010860; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, malware_family Gh0st, malware_family PCRAT, signature_severity Critical, tag PCRAT, tag Gh0st, tag RAT, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Spyware Checkin"; flow: to_server,established; content:"/install.gz"; nocase; http_uri; content:"Host|3a| xpire.info|0d 0a|"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001491; classtype:pup-activity; sid:2001491; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gimmiv Infection Ping Outbound"; icode:0; itype:8; dsize:20; content:"abcde12345fghij6789"; reference:url,doc.emergingthreats.net/2008726; classtype:trojan-activity; sid:2008726; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Outerinfo.com Spyware Install"; flow: to_server,established; content:"/ctxad-"; nocase; http_uri; pcre:"/ctxad-\d+\.sig/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2001495; classtype:pup-activity; sid:2001495; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Gimmiv Infection Ping Inbound"; icode:0; itype:8; dsize:20; content:"abcde12345fghij6789"; reference:url,doc.emergingthreats.net/2008727; classtype:trojan-activity; sid:2008727; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Clickspring.net Spyware Reporting"; flow: to_server,established; content:"Host|3a| www.bullseye-network.com"; nocase; http_header; reference:url,sarc.com/avcenter/venc/data/adware.bargainbuddy.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001501; classtype:pup-activity; sid:2001501; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE HackerDefender Root Kit Remote Connection Attempt Detected"; flow: established,to_server; content:"|01 9a 8c 66 af c0 4a 11 9e 3f 40 88 12 2c 3a 4a 84 65 38 b0 b4 08 0b af db ce 02 94 34 5f 22|"; rawbytes; tag: session, 20, packets; reference:url,securityresponse.symantec.com/avcenter/venc/data/backdoor.hackdefender.html; reference:url,doc.emergingthreats.net/2001743; classtype:trojan-activity; sid:2001743; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Medialoads.com Spyware Config"; flow: to_server,established; content:"/dw/cgi/download.cgi?"; nocase; http_uri; content:"sn="; nocase; http_uri; content:"pid="; nocase; http_uri; content:"Host|3a|config.medialoads.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001503; classtype:pup-activity; sid:2001503; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE HackerDefender.HE Root Kit Control Connection"; flow: established,to_server; content:"|d0 84 ec 77 cf ec 60 e9|"; depth:8; reference:url,securityresponse.symantec.com/avcenter/venc/data/backdoor.hackdefender.html; reference:url,doc.emergingthreats.net/2003244; classtype:trojan-activity; sid:2003244; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Smartpops.com Spyware Install rh.exe"; flow: to_server,established; content:"/install/RH/rh.exe"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.smartpops.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001505; classtype:pup-activity; sid:2001505; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE HackerDefender.HE Root Kit Control Connection Reply"; flow: established,from_server; content:"|d0 84 ec 77 cf ec 60 e9|"; depth:8; reference:url,securityresponse.symantec.com/avcenter/venc/data/backdoor.hackdefender.html; reference:url,doc.emergingthreats.net/2003245; classtype:trojan-activity; sid:2003245; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Medialoads.com Spyware Identifying Country of Origin"; flow: to_server,established; content:"/dw/cgi/country.cgi"; nocase; http_uri; content:"User-Agent|3a|"; nocase; http_header; content:"NSISDL"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001507; classtype:pup-activity; sid:2001507; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE HotLan.C Spambot C&C download command"; flow:established,from_server; content:"|3B|URL|3A|http|3A 2F 2F|"; pcre:"/\x0D\x0A\x0D\x0ASLP\x3A\d+\x3BMOD\x3A[\S\x3B]+\x3BURL\x3Ahttp\x3A\x2F{2}[^\x3B]+\x3BSRV\x3Aupd\x3B/"; reference:url,doc.emergingthreats.net/2008471; classtype:command-and-control; sid:2008471; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Medialoads.com Spyware Reporting (register.cgi)"; flow: to_server,established; content:"/dw/cgi/register.cgi?"; nocase; http_uri; content:"v="; nocase; http_uri; content:"Host|3a|config.medialoads.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001509; classtype:pup-activity; sid:2001509; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET DELETED Hupigon CnC init (variant abb)"; flow:established,to_server; dsize:4; flowbits:isnotset,ET.hupa.init; flowbits:noalert; content:"|00 00 00 00|"; flowbits:set,ET.hupa.init; reference:url,doc.emergingthreats.net/2008041; classtype:command-and-control; sid:2008041; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SurfAssistant.com Spyware Install"; flow: to_server,established; content:"/distribution/questmod-1.dll"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.sa.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001510; classtype:pup-activity; sid:2001510; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Hupigon CnC Communication (variant bysj)"; flow:established,to_server; dsize:5; content:"HTTP|00|"; reference:url,doc.emergingthreats.net/2008258; classtype:command-and-control; sid:2008258; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Smartpops.com Spyware Update"; flow: to_server,established; content:"/data/spv15.dat?v="; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.smartpops.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001513; classtype:pup-activity; sid:2001513; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 3128 (msg:"ET DELETED Likely Hupigon Post to Controller"; flow:established,to_server; content:"POST /+"; depth:7; flowbits:noalert; flowbits:set,ET.Hupinit1; reference:url,www.f-secure.com/v-descs/backdoor_w32_hupigon.shtml; reference:url,doc.emergingthreats.net/2008389; classtype:trojan-activity; sid:2008389; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SurfAssistant.com Spyware Reporting"; flow: to_server,established; content:"/sa/?a="; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.sa.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001514; classtype:pup-activity; sid:2001514; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 3128 -> $HOME_NET any (msg:"ET DELETED Hupigon Response from Controller (YES - ~~@@)"; flow:established,from_server; flowbits:isset,ET.Hupinit1; content:"HTTP/1.0 200 OK|0d 0a 0d 0a|YES|0d 0a 7e 7e|"; depth:26; content:"@@|0d 0a 0d 0a|"; within:150; reference:url,www.f-secure.com/v-descs/backdoor_w32_hupigon.shtml; reference:url,doc.emergingthreats.net/2008390; classtype:trojan-activity; sid:2008390; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Smartpops.com Spyware Install"; flow: to_server,established; content:"/install/SE/sed.exe"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.smartpops.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001516; classtype:pup-activity; sid:2001516; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Win32.Hupigon Control Server Response"; flow:from_server,established; dsize:16; content:"|03 00 00 00 00 00 00 00 c4 ec 48 f5 5e 00 85 80|"; depth:16; threshold: type both, count 2, seconds 120, track by_src; reference:url,doc.emergingthreats.net/2009350; classtype:trojan-activity; sid:2009350; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Websearch.com Outbound Dialer Retrieval"; flow: to_server,established; content:"/1/rdgUS10.exe"; nocase; http_uri; reference:mcafee,131461; reference:url,doc.emergingthreats.net/bin/view/Main/2001517; classtype:pup-activity; sid:2001517; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert icmp any any -> any any (msg:"ET DELETED ICMP Banking Trojan sending encrypted stolen data"; dsize:>64; itype:8; icode:0; content:"|08|"; depth:1; byte_test:4,>,64,1,little; byte_test:4,<,1500,1,little; content:"|0000|"; distance:4; within:1495; reference:url,www.websensesecuritylabs.com/alerts/alert.php?AlertID=570; reference:url,doc.emergingthreats.net/2003073; classtype:trojan-activity; sid:2003073; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spywaremover Activity"; flow: to_server,established; content:"/spywareremovers.php?"; http_uri; content:"Host|3a| topantispyware.com"; nocase; http_header; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.topantispyware.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001520; classtype:pup-activity; sid:2001520; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> any any (msg:"ET DELETED Kaiten IRCbotnet Response"; flow:established; flowbits:isset,irc.start; content:"NOTICE|20|"; content:"|20 3A|"; within:32; pcre:"/\x20\x3A(Receiving\x20file.\x0A|Saved\x20as\x20|Spoofs\x3A\x20|Kaiten\x20wa\x20goraku|Current\x20status\x20is\x3a\x20|Removed\x20all\x20spoofs|Packeting\x20|Panning\x20|Tsunami\x20heading\x20for\x20|Unknowing\x20|Killing\x20pid\x20)/"; reference:url,en.wikipedia.org/wiki/IRC_bot; reference:url,doc.emergingthreats.net/2007622; classtype:trojan-activity; sid:2007622; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spywaremover Activity"; flow: to_server,established; content:"/download/cabs/THNALL1L/thnall1l.exe"; http_uri; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453087903; reference:url,doc.emergingthreats.net/bin/view/Main/2001521; classtype:pup-activity; sid:2001521; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp any any -> $HOME_NET any (msg:"ET DELETED Kaiten IRCbotnet Commands"; flow:from_server,established; content:"PRIVMSG|20 21|"; pcre:"/PRIVMSG\x20\x21\S+\x20(TSUNAMI\x20|PAN\x20|UDP\x20|UNKNOWN\x20|GETSPOOFS|SPOOFS\x20)/i"; reference:url,en.wikipedia.org/wiki/IRC_bot; reference:url,doc.emergingthreats.net/2007623; classtype:trojan-activity; sid:2007623; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SpywareLabs Application Install"; flow: to_server,established; content:"/DistID/BaseInstalls/V"; nocase; http_uri; content:"User-Agent|3a|"; nocase; http_header; content:"Wise"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001522; classtype:pup-activity; sid:2001522; rev:15; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE TROJ_INJECT.NI Update Request"; flow:established,to_server; dsize:7; content:"F222222"; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_INJECT.NI&VSect=T; reference:url,doc.emergingthreats.net/2009077; classtype:trojan-activity; sid:2009077; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Virtumonde Spyware Code Download mmdom.exe"; flow: to_server,established; content:"/mmdom.exe"; nocase; http_uri; reference:url,sarc.com/avcenter/venc/data/adware.virtumonde.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001525; classtype:pup-activity; sid:2001525; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET DELETED Juicopotomous to Controller"; flow:established,to_server; dsize:1; content:"|7c|"; flowbits:set,ET.unknown.setup; flowbits:noalert; reference:url,doc.emergingthreats.net/2008245; classtype:trojan-activity; sid:2008245; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Virtumonde Spyware Code Download bkinst.exe"; flow: to_server,established; content:"/bkinst.exe"; nocase; http_uri; content:"virtumonde.com"; http_header; reference:url,www.lurhq.com/iframeads.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001526; classtype:pup-activity; sid:2001526; rev:24; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET DELETED Juicopotomous ack from Controller"; flowbits:isset,ET.unknown.setup; flow:established,from_server; dsize:<50; content:"|7d 27|"; depth:2; flowbits:set,ET.unknown.replied; reference:url,doc.emergingthreats.net/2008246; classtype:trojan-activity; sid:2008246; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP ak-networks.com Spyware Code Download"; flow: to_server,established; content:"/SyncAkSoft.da_"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001530; classtype:pup-activity; sid:2001530; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET DELETED Juicopotomous ack to Controller"; flowbits:isset,ET.unknown.replied; flow:established,to_server; dsize:<50; content:"|7e 27|"; depth:2; reference:url,doc.emergingthreats.net/2008247; classtype:trojan-activity; sid:2008247; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP Searchmiracle.com Spyware Installer silent.exe Download"; flow: from_server,established; content:"|20 28 43 29 20 32 30 30 31 2c 20 32 30 30 33 20 52 61 64 69 6d 20 50 69 63 68 61|"; reference:url,www.searchmiracle.com/silent.exe; reference:url,doc.emergingthreats.net/bin/view/Main/2001533; classtype:pup-activity; sid:2001533; rev:12; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Keylogger PRO GOLD Post"; flow:established,to_server; content:"to="; content:"&from="; within:200; content:"&subject="; within:200; content:"&message="; within:200; content:"Discribtion"; within:14; content:"KEYLOGG+PRO+GOLD+VERSION"; content:"IPHostName"; content:"IPAddress"; content:"YahooMessenger+Passwords"; reference:url,doc.emergingthreats.net/2008642; classtype:trojan-activity; sid:2008642; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyspotter.com Install"; flow: to_server,established; content:"/SpySpotterInstall.cab"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001536; classtype:pup-activity; sid:2001536; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Keylogger.ane Checkin"; flow:established,to_server; content:"Secret Client|00 00 00|"; depth:18; reference:url,doc.emergingthreats.net/2008449; classtype:command-and-control; sid:2008449; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyspotter.com Access"; flow: to_server,established; content:"Host|3a| "; http_header; content:"spyspotter.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001537; classtype:pup-activity; sid:2001537; rev:16; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Koobface BLACKLABEL"; flow:established,from_server; content: "#BLACKLABEL|0d 0a|EXIT"; reference:url,blog.threatexpert.com/2008/12/koobface-leaves-victims-black-spot.html; reference:url,doc.emergingthreats.net/2009407; classtype:trojan-activity; sid:2009407; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Oenji.com Install"; flow: to_server,established; content:"/Bundled/OemjiInstall"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001538; classtype:pup-activity; sid:2001538; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Koobface C&C availability check successful"; flowbits:isset,ET.koobfacecheck; flow:established,from_server; content:"|0d 0a 0d 0a|ACH_OK"; nocase; reference:url,us.trendmicro.com/imperia/md/content/us/trendwatch/researchandanalysis/the_20heart_20of_20koobface_final_1_.pdf; reference:url,doc.emergingthreats.net/2010152; classtype:command-and-control; sid:2010152; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchmiracle.com Spyware Install (v3cab)"; flow: to_server,established; content:"/cab/v3cab.cab"; http_uri; reference:url,www.searchmiracle.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001540; classtype:pup-activity; sid:2001540; rev:12; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Lethic Spambot CnC Initial Connect"; flow:established,from_server; flowbits:isnotset,ET.lethic.init; flowbits:set,ET.lethic.init; flowbits:noalert; dsize:5; content:"|00 00 00 00 06|"; reference:url,www.m86security.com/trace/spambotitem.asp?article=1205; reference:url,doc.emergingthreats.net/2010646; classtype:command-and-control; sid:2010646; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Install Report"; flow: to_server,established; content:"counter.htm"; nocase; pcre:"//user\d+/counter\.htm/im"; reference:url,doc.emergingthreats.net/bin/view/Main/2001541; classtype:pup-activity; sid:2001541; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Lethic Spambot CnC Initial Connect Bot Response"; flow:established,to_server; flowbits:isset,ET.lethic.init; dsize:5; content:"|00 00 00 00 06|"; flowbits:set,ET.lethic.established; reference:url,www.m86security.com/trace/spambotitem.asp?article=1205; reference:url,doc.emergingthreats.net/2010647; classtype:command-and-control; sid:2010647; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET ADWARE_PUP MarketScore.com Spyware SSL Access"; flow: to_server,established; content:"www.marketscore.com"; content:"InstantSSL1"; nocase; reference:url,www.marketscore.com; reference:url,www.spysweeper.com/remove-marketscore.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001563; classtype:pup-activity; sid:2001563; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Lethic Spambot CnC Connect Command"; flowbits:isset,ET.lethic.established; flow:established,from_server; dsize:11; content:"|02|"; offset:4; depth:5; reference:url,www.m86security.com/trace/spambotitem.asp?article=1205; reference:url,doc.emergingthreats.net/2010648; classtype:command-and-control; sid:2010648; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyware Stormer Reporting Data"; flow: established,to_server; content:"/showme.aspx?keyword="; nocase; http_uri; content:"ecomdata1="; nocase; http_client_body; reference:url,www.spywarestormer.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001570; classtype:pup-activity; sid:2001570; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Lethic Spambot CnC Connect Command (port 25 specifically)"; flowbits:isset,ET.lethic.established; flow:established,from_server; dsize:11; content:"|02|"; offset:4; depth:5; content:"|00 19|"; offset:9; reference:url,www.m86security.com/trace/spambotitem.asp?article=1205; reference:url,doc.emergingthreats.net/2010649; classtype:command-and-control; sid:2010649; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyware Stormer/Error Guard Activity"; flow: established,to_server; content:"/sell.cgi?errorguard/1/errorguard"; nocase; http_uri; reference:url,www.spywarestormer.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001571; classtype:pup-activity; sid:2001571; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Lethic Spambot CnC Bot Command Confirmation"; flow:established,to_server; flowbits:isset,ET.lethic.established; dsize:6; content:"|21 01|"; offset:4; reference:url,www.m86security.com/trace/spambotitem.asp?article=1205; reference:url,doc.emergingthreats.net/2010650; classtype:command-and-control; sid:2010650; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MarketScore.com Spyware Proxied Traffic (mitmproxy agent)"; flow: to_server,established; content:"Proxy-agent|3a| ManInTheMiddle-Proxy"; http_header; nocase; reference:url,www.marketscore.com; reference:url,www.spysweeper.com/remove-marketscore.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001586; classtype:pup-activity; sid:2001586; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Lethic Spambot CnC Bot Transaction Relay"; flow:established,to_server; flowbits:isset,ET.lethic.established; content:"|03|"; offset:4; depth:5; reference:url,www.m86security.com/trace/spambotitem.asp?article=1205; reference:url,doc.emergingthreats.net/2010651; classtype:command-and-control; sid:2010651; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MarketScore.com Spyware Upgrading"; flow: to_server,established; content:"/oss/upgrchk_2a.asp"; nocase; http_uri; reference:url,www.marketscore.com; reference:url,www.spysweeper.com/remove-marketscore.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001587; classtype:pup-activity; sid:2001587; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 81:90 -> $HOME_NET any (msg:"ET MALWARE Looked.P/Gamania/Delf #109/! Style CnC Checkin Response from Server"; flow:established,from_server; dsize:6; content:"#1"; depth:2; content:"/!"; offset:4; pcre:"/^\x23\d\d\d\x2f\x21/"; reference:url,doc.emergingthreats.net/bin/view/Main/Win32Looked; classtype:command-and-control; sid:2008220; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MarketScore.com Spyware Activity (1)"; flow: to_server,established; content:"/oss/dittorules.asp"; nocase; http_uri; reference:url,www.marketscore.com; reference:url,www.spysweeper.com/remove-marketscore.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001588; classtype:pup-activity; sid:2001588; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert udp $HOME_NET any -> $EXTERNAL_NET 6990:6999 (msg:"ET MALWARE Medbod UDP Phone Home Packet"; dsize:<50; content:"ebex"; nocase; pcre:"/\x06\x00?$/"; reference:url,doc.emergingthreats.net/2007949; classtype:trojan-activity; sid:2007949; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MarketScore.com Spyware Activity (2)"; flow: to_server,established; content:"/oss/routerrules2.asp"; nocase; http_uri; reference:url,www.marketscore.com; reference:url,www.spysweeper.com/remove-marketscore.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001589; classtype:pup-activity; sid:2001589; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 2227 (msg:"ET MALWARE Trojan-PSW.Win32.Nilage.crg Checkin"; flow:established,to_server; dsize:32; content:"|00 c0 a8 01 f4 6f 00 00 00|"; depth:12; content:"|00 00 00 05 01 28 0a|"; reference:url,doc.emergingthreats.net/2008481; classtype:command-and-control; sid:2008481; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Microgaming.com Spyware Installation (dlhelper)"; flow: established,to_server; content:"/dlhelper.cab"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001641; classtype:pup-activity; sid:2001641; rev:9; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Nine Ball Infection Ping Outbound"; icode:0; itype:8; dsize:32; content:"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"; reference:url,doc.emergingthreats.net/2011185; classtype:trojan-activity; sid:2011185; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Microgaming.com Spyware Installation (2)"; flow: established,to_server; content:"/DownloadHNew.asp?"; nocase; http_uri; content:"btag="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001643; classtype:pup-activity; sid:2001643; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Nine Ball Infection Posting Data"; flow:established,to_server; content:"POST /"; depth:6; content:"/gate/"; distance:0; content:".php"; distance:0; content:"|0d 0a 0d 0a|"; distance:0; content:"AAAAAAAACI"; distance:67; within:10; reference:url,www.martinsecurity.net/page/3; reference:url,doc.emergingthreats.net/2011187; classtype:trojan-activity; sid:2011187; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Microgaming.com Spyware Reporting Installation"; flow: established,to_server; content:"/dlhelper/downloadlogger2.asp?"; nocase; http_uri; content:"time="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001644; classtype:pup-activity; sid:2001644; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Overtoolbar.net Backdoor ICMP Checkin Request"; dsize:9; icode:0; itype:8; content:"Echo This"; reference:url,doc.emergingthreats.net/2009130; classtype:command-and-control; sid:2009130; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Microgaming.com Spyware Casino App Install"; flow: established,to_server; content:"/viper/thunderluck/00"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001645; classtype:pup-activity; sid:2001645; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Overtoolbar.net Backdoor ICMP Checkin Response"; dsize:9; icode:0; itype:0; content:"Echo This"; reference:url,doc.emergingthreats.net/2009131; classtype:command-and-control; sid:2009131; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Toprebates.com Install (1)"; flow: established,to_server; content:"/mailz.php?id="; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.webrebates.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001646; classtype:pup-activity; sid:2001646; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"ET MALWARE Prg Trojan Server Reply"; flow:to_client,established; content:"HTTP"; depth:4; content:"|0d0a|Hall|3a|"; depth:512; reference:url,www.securescience.net/FILES/securescience/10378/pubMalwareCaseStudy.pdf; reference:url,doc.emergingthreats.net/2003183; classtype:trojan-activity; sid:2003183; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Toprebates.com Install (2)"; flow: established,to_server; content:"/builds/"; nocase; http_uri; content:"AutoTrack_Install.exe"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.webrebates.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001647; classtype:pup-activity; sid:2001647; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Prg Trojan v0.1 Binary In Transit"; flow:to_client,established; content:"MZ"; content:"|1D B9 F2 75 62 85 5A 4F 15 48 52 1D 50 90 41 89 37 9F FF 94 CE A6 3E 63 35 AB 29 6B 30 43 2F 45 46 B0 E1 C2 11 7F 0C 55 0F C7|"; depth:128; reference:url,www.securescience.net/FILES/securescience/10378/pubMalwareCaseStudy.pdf; reference:url,doc.emergingthreats.net/2003184; classtype:trojan-activity; sid:2003184; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Toprebates.com User Confirming Membership"; flow: established,to_server; content:"/cgi/account.plx?pid="; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.webrebates.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001648; classtype:pup-activity; sid:2001648; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Prg Trojan v0.2 Binary In Transit"; flow:to_client,established; content:"MZ"; content:"|13 B9 F2 75 62 85 5A 4F 15 48 19 1D 10 4F 0D 5B 04 5B 04 60 CE 5F 00 67 F5 AE 25 6B 20 41 23 B3|"; depth:128; reference:url,www.securescience.net/FILES/securescience/10378/pubMalwareCaseStudy.pdf; reference:url,doc.emergingthreats.net/2003185; classtype:trojan-activity; sid:2003185; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Search Scout Related Spyware (content)"; flow: established,to_server; content:"Host|3a| content.searchscout.com"; nocase; http_header; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.searchscout.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001650; classtype:pup-activity; sid:2001650; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Prg Trojan v0.3 Binary In Transit"; flow:to_client,established; content:"MZ"; content:"| 5E 7D 66 7D 28 40 19 88 5F 8C 13 50 15 59 08 58 3C 97 00 9B 33 A5 F9 AF 39 68 F0 9F 27 AF E9 A8 25 B7 18 B6 15 7F 0E B6 1A|"; depth:128; reference:url,www.securescience.net/FILES/securescience/10378/pubMalwareCaseStudy.pdf; reference:url,doc.emergingthreats.net/2003186; classtype:trojan-activity; sid:2003186; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Search Scout Related Spyware (results)"; flow: established,to_server; content:"Host|3a| results.searchscout.com"; nocase; http_header; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.searchscout.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001653; classtype:pup-activity; sid:2001653; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1900 (msg:"ET MALWARE Backdoor.Win32/PcClient.ZL Checkin"; flow:established,to_server; content:"|00 00 00 10 c8 00 00 00 b0 ff|"; depth:10; reference:url,doc.emergingthreats.net/2008920; classtype:command-and-control; sid:2008920; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Comet Systems Spyware Traffic (context.xml)"; flow: to_server,established; content:"/context/1/up_context_1.xml"; nocase; http_uri; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453083029; reference:url,doc.emergingthreats.net/bin/view/Main/2001655; classtype:pup-activity; sid:2001655; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE PcClient Backdoor Checkin Packet 1"; flow:established,to_server; dsize:4; content:"|82 87 99 45|"; flowbits:set,ET.PcClient; flowbits:noalert; reference:url,doc.emergingthreats.net/2009238; classtype:command-and-control; sid:2009238; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP GlobalPhon.com Dialer"; flow: to_server,established; content:"Host|3a| www.globalphon.com"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001656; classtype:pup-activity; sid:2001656; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE PcClient Backdoor Checkin"; flowbits:isset,ET.PcClient; flow:established,to_server; dsize:248; content:"|52 0d 12 12|"; depth:4; flowbits:noalert; reference:url,doc.emergingthreats.net/2009239; classtype:command-and-control; sid:2009239; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP GlobalPhon.com Dialer Download"; flow: to_server,established; content:"/dialer/internazionale_ver"; nocase; http_uri; content:".CAB"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001657; classtype:pup-activity; sid:2001657; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE PECompact2 Packed Binary - Sometimes Hostile"; flow:from_server,established; content:"|74 65 78 74|"; content:"|50 45 43 32|"; within:40; reference:url,www.bitsum.com/pecompact.shtml; reference:url,bits.packetninjas.org/eblog/?p=306; reference:url,doc.emergingthreats.net/2008547; classtype:trojan-activity; sid:2008547; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Comet Systems Spyware Reporting"; flow: to_server,established; content:"Host|3a| log.cc.cometsystems.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001658; classtype:pup-activity; sid:2001658; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Perfect Keylogger FTP Initial Install Log Upload"; flow:established,to_server; content:"Congratulations! Perfect Kelogger was successfully installed"; depth:63; reference:url,doc.emergingthreats.net/2007973; classtype:trojan-activity; sid:2007973; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP GlobalPhon.com Dialer (no_pop)"; flow: to_server,established; content:"/no_pop.asp?"; nocase; http_uri; content: "id="; nocase; http_uri; content:"globalphon.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001659; classtype:pup-activity; sid:2001659; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Perfect Keylogger FTP Initial Install Log Upload (Null obfuscated)"; flow:established,to_server; content:"C|00|o|00|n|00|g|00|r|00|a|00|t|00|u|00|l|00|a|00|t|00|i|00|o|00|n|00|s|00|!|00| |00|P|00|e|00|r|00|f|00|e|00|c|00|t|00| |00|K|00|e|00|l|00|o|00|g|00|g|00|e|00|r|00| |00|w|00|a|00|s|00| |00|s|00|u|00|c|00|c|00|e|00|s|00|s|00|f|00|u|00|l|00|l|00|y|00| |00|i|00|n|00|s|00|t|00|a|00|l|00|l|00|e|00|d|00|"; reference:url,doc.emergingthreats.net/2008327; classtype:trojan-activity; sid:2008327; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP GlobalPhon.com Dialer (add_ocx)"; flow: to_server,established; content:"/add_ocx.asp?"; nocase; http_uri; content: "id="; nocase; http_uri; content:"globalphon.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001660; classtype:pup-activity; sid:2001660; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE RLPacked Binary - Likely Hostile"; flow:from_server,established; content:"|2E 70 61 63 6B 65 64|"; content:"|2E 52 4C 50 61 63 6B|"; within:50; reference:url,rlpack.jezgra.net; reference:url,www.teamfurry.com/wordpress/2007/04/01/unpacking-rlpack/; reference:url,doc.emergingthreats.net/2008285; classtype:trojan-activity; sid:2008285; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Metarewards Spyware Activity"; flow: to_server,established; content:"Host|3a| www.metareward.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001666; classtype:pup-activity; sid:2001666; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp any any -> any any (msg:"ET DELETED Generic Raider Obfuscated VBScript"; flow:established; content:"execute"; content:"|22 22 22 22 22 3A|"; offset:8; content:"function"; nocase; pcre:"/\x22\x3A(\w)\x3D\x22execute\s+\x22{5}\x3A.*\x3Aexecute\s*\x28\s*\1\s*\x29\x3Aend\s+function\x3A/s"; reference:url,bbs.duba.net/viewthread.php?tid=21892104&page=1&extra=page=1; reference:url,doc.emergingthreats.net/2008278; classtype:trojan-activity; sid:2008278; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Webhancer Agent Activity"; flow: to_server,established; content:"Host|3a|"; nocase; http_header; content:"webhancer.com"; nocase; http_header; within:32; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.webhancer.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001678; classtype:pup-activity; sid:2001678; rev:14; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET MALWARE Trojan.Win32.Regrun.ro FTP connection detected"; flow:established,to_server; content:"RETR k3ylogger.txt|0d 0a|"; depth:21; reference:url,doc.emergingthreats.net/2008733; classtype:trojan-activity; sid:2008733; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http any any -> $HOME_NET any (msg:"ET ADWARE_PUP Windows executable sent when remote host claims to send an image"; flow: established,from_server; content:"Content-Type|3a| image"; http_header; content:"|0d 0a 0d 0a|MZ"; byte_jump:4,58,relative,little; content:"PE|00 00|"; fast_pattern; distance:-64; within:4; reference:url,doc.emergingthreats.net/bin/view/Main/2001683; classtype:pup-activity; sid:2001683; rev:18; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 8080 (msg:"ET MALWARE Saturn Proxy Initial Outbound Checkin (404.txt)"; flow:established,to_server; dsize:<50; content:"GET /404.txt HTTP/1.0"; depth:21; flowbits:set,ET.saturn.checkin; reference:url,doc.emergingthreats.net/2007751; classtype:command-and-control; sid:2007751; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Search Relevancy Spyware"; flow: established,to_server; content:"/SearchRelevancy/SearchRelevancy.dll"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.relevancy.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001696; classtype:pup-activity; sid:2001696; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Saturn Proxy C&C Activity"; flow:established,from_server; dsize:12; content:"|2d 00 00 00|"; offset:0; depth:4; content:"|00 00 55 00 00 00|"; distance:2; reference:url,doc.emergingthreats.net/2007753; classtype:command-and-control; sid:2007753; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP ISearchTech Toolbar Data Submission"; flow: to_server,established; content:"/ist/scripts/istsvc_ads_data.php?"; nocase; http_uri; content: "version="; nocase; http_uri; reference:url,www.isearchtech.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001697; classtype:pup-activity; sid:2001697; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Socks666 Connection Initial Packet"; flow:established,to_server; dsize:24; content:"|9a 02 06 00|"; offset:0; depth:4; flowbits:set,BS.BPcheckin; flowbits:noalert; reference:url,doc.emergingthreats.net/2006396; classtype:trojan-activity; sid:2006395; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Windupdates.com Spyware Install"; flow: established,to_server; content:"/cab/CDTInc/ie/"; nocase; http_uri; content:".cab"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001700; classtype:pup-activity; sid:2001700; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Socks666 Connect Command Packet"; flowbits:isset,BS.BPcheckin; flow:established,from_server; dsize:10; content:"|9a 02 07 00|"; offset:0; depth:4; flowbits:set,BS.BPset; reference:url,doc.emergingthreats.net/2006396; classtype:trojan-activity; sid:2006396; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Windupdates.com Spyware Loggin Data"; flow: established,to_server; content:"/logging.php?p="; nocase; http_uri; content:"Host|3a| public.windupdates.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001701; classtype:pup-activity; sid:2001701; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Socks666 Successful Connect Packet Packet"; flowbits:isset,BS.BPset; flow:established,to_server; dsize:16; content:"|9a 02 08 00|"; offset:0; depth:4; flowbits:set,BS.BPcheckin; tag:session,300,seconds; reference:url,doc.emergingthreats.net/2006396; classtype:trojan-activity; sid:2006397; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Flingstone Spyware Install (sportsinteraction)"; flow: established,to_server; content:"/softwares/SportsInteraction.exe"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001705; classtype:pup-activity; sid:2001705; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Socks666 Checkin Packet"; flow:established,to_server; dsize:30; content:"|9a 02 01 00|"; offset:0; depth:4; flowbits:set,BS.BPcheckin1; flowbits:noalert; reference:url,doc.emergingthreats.net/2006396; classtype:command-and-control; sid:2006398; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Shop at Home Select Spyware Heartbeat"; flow: established,to_server; content:"/s.dll?MfcISAPICommand=heartbeat¶m="; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.sahagent.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001708; classtype:pup-activity; sid:2001708; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Socks666 Checkin Success Packet"; flowbits:isset,BS.BPcheckin1; flow:established,from_server; dsize:4; content:"|9a 02 05 00|"; offset:0; depth:4; reference:url,doc.emergingthreats.net/2006396; classtype:command-and-control; sid:2006399; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Flingstone Spyware Install (cxtpls)"; flow: established,to_server; content:"/softwares/cxtpls_loader_ff.exe"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.winfavorites.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001710; classtype:pup-activity; sid:2001710; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert icmp any any -> any any (msg:"ET MALWARE Storm Worm ICMP DDOS Traffic"; itype:8; icode:0; dsize:32; content:"abcdefghijklmnopqr|00 00|"; depth:22; threshold:type both, track by_src, count 1, seconds 60; reference:url,doc.emergingthreats.net/2007618; classtype:trojan-activity; sid:2007618; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Tibsystems Spyware Install (1)"; flow: to_server,established; content:"/fcgi-bin/iza2.fcgi?m="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001729; classtype:pup-activity; sid:2001729; rev:8; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Themida Packed Binary - Likely Hostile"; flow:established,from_server; content:"|2E 69 64 61 74 61 20 20|"; content:"|54 68 65 6D 64 61 20 00|"; within:49; reference:url,www.oreans.com/themida.php; reference:url,cwsandbox.org/?page=samdet&id=164533&password=wnnpi; reference:url,doc.emergingthreats.net/2008341; classtype:trojan-activity; sid:2008341; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP A-d-w-a-r-e.com Activity (popup)"; flow: established,to_server; content:"/cgi-bin/PopupV"; http_uri; nocase; content:"?ID={"; http_uri; nocase; reference:url,www.a-d-w-a-r-e.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001730; classtype:pup-activity; sid:2001730; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Turkojan C&C Initial Checkin (ams)"; flow:established,to_server; dsize:3; content:"ams"; reference:url,doc.emergingthreats.net/2008021; classtype:command-and-control; sid:2008021; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Tibsystems Spyware Install (2)"; flow: to_server,established; content:"/tb/loader2.ocx"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001734; classtype:pup-activity; sid:2001734; rev:8; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Turkojan C&C Logs Parse Command (LOGS1)"; flow:established,from_server; dsize:5; content:"LOGS1"; depth:5; reference:url,doc.emergingthreats.net/2008024; classtype:command-and-control; sid:2008024; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP A-d-w-a-r-e.com Activity (cmd)"; flow: established,to_server; content:"/app/VT00/ucmd.php?V="; http_uri; nocase; reference:url,www.a-d-w-a-r-e.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001735; classtype:pup-activity; sid:2001735; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Turkojan C&C Logs Parse Response Response (LOGS1)"; flow:established,to_server; content:"|08 00 00 00|LOGS1|5b|"; offset:0; depth:10; reference:url,doc.emergingthreats.net/2008025; classtype:command-and-control; sid:2008025; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP ak-networks.com Spyware Code Install"; flow: to_server,established; content:"/akcore.dl_"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001737; classtype:pup-activity; sid:2001737; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Turkojan C&C Keepalive (BAGLANTI)"; flow:established,to_server; dsize:9; content:"BAGLANTI?"; reference:url,doc.emergingthreats.net/2008026; classtype:command-and-control; sid:2008026; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchmiracle.com Spyware Install (install)"; flow: to_server,established; content:"/sideb.exe"; content:"Host|3a| install.searchmiracle.com"; nocase; http_header; reference:url,www.searchmiracle.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001744; classtype:pup-activity; sid:2001744; rev:14; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Turkojan C&C Browse Drive Command (BROWSC)"; flow:established,from_server; dsize:<100; content:"BROWS"; depth:5; content:"|3a|"; distance:1; within:2; reference:url,doc.emergingthreats.net/2008027; classtype:command-and-control; sid:2008027; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP My-Stats.com Spyware Checkin"; flow: established,to_server; content:"/ad-partner/SelectConfirm.php?"; nocase; http_uri; content:"dummy="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001747; classtype:pup-activity; sid:2001747; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Turkojan C&C Browse Drive Command Response (metin)"; flow:established,to_server; content:"|00 00|metin|0d 3a|"; offset:2; depth:11; reference:url,doc.emergingthreats.net/2008028; classtype:command-and-control; sid:2008028; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> any any (msg:"ET ADWARE_PUP Pynix.dll BHO Activity"; flow: established,to_server; content:"ABETTERINTERNET.EXE"; nocase; http_uri; content:"bho=PYNIX.DLL"; nocase; http_uri; reference:url,www.pynix.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001748; classtype:pup-activity; sid:2001748; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Turkojan C&C nxt Command Response (nxt)"; flow:established,from_server; dsize:16; content:"nxt|09 00 00 00|"; depth:7; offset:0; reference:url,doc.emergingthreats.net/2008030; classtype:command-and-control; sid:2008030; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Incredisearch.com Spyware Ping"; flow: established,to_server; content:"/ping.asp"; nocase; http_uri; content:"incredisearch.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001793; classtype:pup-activity; sid:2001793; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2022_05_03;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 5190 (msg:"ET MALWARE Win32.Agent.bea C&C connection"; flow:to_server,established; dsize:24; content:"|9a 02 06 00|"; depth:4; reference:url,doc.emergingthreats.net/2007608; classtype:command-and-control; sid:2007608; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Incredisearch.com Spyware Activity"; flow: established,to_server; content:"Host|3a| www.incredisearch.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001794; classtype:pup-activity; sid:2001794; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Win32.Inject.zy Checkin Post"; flow:established,to_server; dsize:8; content:"|16 00 00 00 00 00 00 00|"; reference:url,doc.emergingthreats.net/2007966; classtype:command-and-control; sid:2007966; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Likely Trojan/Spyware Installer Requested (1)"; flow: established,to_server; content:".scr"; nocase; http_uri; pcre:"/(cartao|mensagem|voxcards|humortadela|ouca|cartaovirtual|uol3171|embratel|yahoo|viewforhumor|humormenssagem|terra)\.scr/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2001850; classtype:pup-activity; sid:2001850; rev:12; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Proxy.Win32.Wopla.ag Check-In"; flow:established,to_server; dsize:12; content:"|0a 00 00 00 00 00 00 00 00 00 00 00|"; reference:url,doc.emergingthreats.net/2007603; classtype:trojan-activity; sid:2007603; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP DesktopTraffic Toolbar Spyware"; flow: to_server,established; content:"cgi-bin/ezl_kws.fcgi?cat"; nocase; http_uri; reference:url,research.spysweeper.com/threat_library/threat_details.php?threat=desktoptraffic.net_hijack; reference:url,doc.emergingthreats.net/bin/view/Main/2001884; classtype:pup-activity; sid:2001884; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Proxy.Win32.Wopla.ag Server Reply"; dsize:12; flow:established,from_server; content:"|0d 00 00 00|"; depth:4; content:"|00 00 00 00 00 00|"; distance:2; within:6; reference:url,doc.emergingthreats.net/2007604; classtype:trojan-activity; sid:2007604; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Begin2Search.com Spyware"; flow: to_server,established; content:"/cgi-bin/fav_del.fcgi?id"; nocase; http_uri; reference:url,sarc.com/avcenter/venc/data/adware.begin2search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001885; classtype:pup-activity; sid:2001885; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET MALWARE XP keylogger v2.1 mail report - Inbound"; flow:established,to_server; content:"X-Mailer|3a| JMail 4.3.0 Free Version by Dimac"; content:" $EXTERNAL_NET any (msg:"ET ADWARE_PUP ToolbarPartner Spyware Spambot Retrieving Target Emails"; flow: established,to_server; content:"/mailz.php?id="; nocase; http_uri; reference:url,toolbarpartner.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001895; classtype:pup-activity; sid:2001895; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE XP keylogger v2.1 mail report - Outbound"; flow:established,to_server; content:"X-Mailer|3a| JMail 4.3.0 Free Version by Dimac"; content:" $EXTERNAL_NET any (msg:"ET ADWARE_PUP Zenotecnico Adware"; flow: to_server,established; content:"/cl/clientdump"; http_uri; content:"zenotecnico"; nocase; http_header; reference:url,www.zenotecnico.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001947; classtype:pup-activity; sid:2001947; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Yoda's Protector Packed Binary - VERY Likely Hostile"; flow:established,from_server; content:"|E8 03 00 00 00 EB 01|"; content:"|BB 55 00 00 00 E8 03 00 00 00 EB 01|"; within:14; reference:url,doc.emergingthreats.net/2009557; classtype:trojan-activity; sid:2009557; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SurfSidekick Activity (ipixel)"; flow: established,to_server; content:"/ipixel.htm?cid="; nocase; http_uri; content:"&pck_id="; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.surfsidekick.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001994; classtype:pup-activity; sid:2001994; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WORM Allaple ICMP Sweep Ping Outbound"; icode:0; itype:8; content:"Babcdefghijklmnopqrstuvwabcdefghi"; threshold: type both, count 1, seconds 60, track by_src; reference:url,www.sophos.com/virusinfo/analyses/w32allapleb.html; reference:url,isc.sans.org/diary.html?storyid=2451; reference:url,doc.emergingthreats.net/2003292; classtype:trojan-activity; sid:2003292; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP TargetNetworks.net Spyware Reporting (req)"; flow: to_server,established; content:"/request/req.cgi?gu="; nocase; http_uri; content:"&sid="; nocase; http_uri; content:"&kw="; nocase; http_uri; reference:url,www.targetnetworks.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001997; classtype:pup-activity; sid:2001997; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WORM Allaple ICMP Sweep Ping Inbound"; icode:0; itype:8; content:"Babcdefghijklmnopqrstuvwabcdefghi"; threshold: type both, count 1, seconds 60, track by_src; reference:url,www.sophos.com/virusinfo/analyses/w32allapleb.html; reference:url,isc.sans.org/diary.html?storyid=2451; reference:url,doc.emergingthreats.net/2003294; classtype:trojan-activity; sid:2003294; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP UCMore Spyware Downloading Ads"; flow: to_server,established; content:"/clientsetupfinish.html?sponsor_id="; http_uri; nocase; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=58660; reference:url,doc.emergingthreats.net/bin/view/Main/2001998; classtype:pup-activity; sid:2001998; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1863 (msg:"ET DELETED Singworm MSN message Outbound"; flow:established; content:"Here are the new smiles for MSN, they are incredible!"; reference:url,doc.emergingthreats.net/2007605; classtype:trojan-activity; sid:2007605; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP BTGrab.com Spyware Downloading Ads"; flow: to_server,established; content:"/a/Drk.syn?"; nocase; http_uri; content:"adcontext="; nocase; http_uri; reference:url,www.btgrab.com; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453090726; reference:url,doc.emergingthreats.net/bin/view/Main/2001999; classtype:pup-activity; sid:2001999; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1863 -> $HOME_NET any (msg:"ET DELETED Singworm MSN message Inbound"; flow:established; content:"Here are the new smiles for MSN, they are incredible!"; reference:url,doc.emergingthreats.net/2007606; classtype:trojan-activity; sid:2007606; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Shopnav Spyware Install"; flow: to_server,established; content:"/toolbarv3.cgi?UID="; nocase; http_uri; content:"&version="; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.shopnav.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002000; classtype:pup-activity; sid:2002000; rev:8; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET VOIP INVITE Message Flood TCP"; flow:established,to_server; content:"INVITE"; depth:6; threshold: type both , track by_src, count 100, seconds 60; reference:url,doc.emergingthreats.net/2003192; classtype:attempted-dos; sid:2003192; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP 180solutions Spyware Install"; flow: to_server,established; content:"/downloads/installers/"; http_uri; nocase; content:"simpleinternet/180sainstaller.exe"; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002003; classtype:pup-activity; sid:2002003; rev:8; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2019_08_22, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET VOIP INVITE Message Flood UDP"; content:"INVITE"; depth:6; threshold: type both , track by_src, count 100, seconds 60; reference:url,doc.emergingthreats.net/2009698; classtype:attempted-dos; sid:2009698; rev:1; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Topconverting Spyware Install"; flow: to_server,established; content:"/activex/weirdontheweb_topc.exe"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002004; classtype:pup-activity; sid:2002004; rev:9; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET VOIP REGISTER Message Flood TCP"; flow:established,to_server; content:"REGISTER"; depth:8; threshold: type both , track by_src, count 100, seconds 60; reference:url,doc.emergingthreats.net/2003193; classtype:attempted-dos; sid:2003193; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Wild Tangent Install"; flow: to_server,established; content:"/updatestats/AI_Euro.exe"; nocase; http_uri; reference:mcafee,122249; reference:url,doc.emergingthreats.net/bin/view/Main/2002008; classtype:pup-activity; sid:2002008; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET VOIP REGISTER Message Flood UDP"; content:"REGISTER"; depth:8; threshold: type both , track by_src, count 100, seconds 60; reference:url,doc.emergingthreats.net/2009699; classtype:attempted-dos; sid:2009699; rev:1; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP ESyndicate Spyware Install (esyndicateinst.exe)"; flow: to_server,established; content:"/files/eSyndicateInst.exe"; nocase; http_uri; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453094058; reference:url,doc.emergingthreats.net/bin/view/Main/2002009; classtype:pup-activity; sid:2002009; rev:9; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET VOIP SIP UDP Softphone INVITE overflow"; dsize:>1000; content:"INVITE"; depth:6; nocase; pcre:"/\r?\n\r?\n/R"; isdataat:1000,relative; reference:bugtraq,16213; reference:cve,2006-0189; reference:url,doc.emergingthreats.net/bin/view/Main/2002848; classtype:attempted-user; sid:2002848; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP ESyndicate Spyware Install (sepinst.exe)"; flow: to_server,established; content:"/files/SEPInst.exe"; nocase; http_uri; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453094058; reference:url,doc.emergingthreats.net/bin/view/Main/2002010; classtype:pup-activity; sid:2002010; rev:9; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET VOIP MultiTech SIP UDP Overflow"; content:"INVITE"; nocase; depth:6; isdataat:65,relative; content:!"|0a|"; within:61; reference:cve,2005-4050; reference:url,doc.emergingthreats.net/2003237; classtype:attempted-user; sid:2003237; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP GrandstreetInteractive.com Install"; flow: to_server,established; content:"/tdtb.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002012; classtype:pup-activity; sid:2002012; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $HOME_NET 5060 -> $EXTERNAL_NET any (msg:"ET VOIP Multiple Unauthorized SIP Responses TCP"; flow:established,from_server; content:"SIP/2.0 401 Unauthorized"; depth:24; threshold: type both, track by_src, count 5, seconds 360; reference:url,doc.emergingthreats.net/2003194; classtype:attempted-dos; sid:2003194; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP GrandstreetInteractive.com Update"; flow: to_server,established; content:"/wupdsnff.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002013; classtype:pup-activity; sid:2002013; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert udp $HOME_NET 5060 -> $EXTERNAL_NET any (msg:"ET VOIP Multiple Unauthorized SIP Responses UDP"; content:"SIP/2.0 401 Unauthorized"; depth:24; threshold: type both, track by_src, count 5, seconds 360; reference:url,doc.emergingthreats.net/2009700; classtype:attempted-dos; sid:2009700; rev:1; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Internet Fuel.com Install"; flow: to_server,established; content:"/cgi-bin/omnidirect.cgi?&debug_log="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002015; classtype:pup-activity; sid:2002015; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 3443 (msg:"ET WEB_SERVER HP OpenView Network Node Manager Remote Command Execution Attempt"; flow:to_server,established; content:"/OvCgi/connectedNodes.ovpl?"; nocase; pcre:"/node=.*\|.+\|/i"; reference:bugtraq,14662; reference:url,doc.emergingthreats.net/2002365; classtype:web-application-attack; sid:2002365; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP jmnad1.com Spyware Install (2)"; flow: to_server,established; content:"/download/mw_4s_stub.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002016; classtype:pup-activity; sid:2002016; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"ET WEB_SERVER THCIISLame IIS SSL Exploit Attempt"; flow: to_server,established; content:"THCOWNZIIS!"; reference:url,www.thc.org/exploits/THCIISSLame.c; reference:url,isc.sans.org/diary.php?date=2004-07-17; reference:url,doc.emergingthreats.net/2000559; classtype:web-application-attack; sid:2000559; rev:14; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Overpro Spyware Install Report"; flow: to_server,established; content:"/processInstall.aspx"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.overpro.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002017; classtype:pup-activity; sid:2002017; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 82 (msg:"ET WEB_SPECIFIC_APPS ClarkConnect Linux proxy.php XSS Attempt"; flow:established,to_server; content:"GET"; content:"script"; nocase; content:"/proxy.php?"; nocase; content:"url="; nocase; pcre:"/\/proxy\.php(\?|.*[\x26\x3B])url=[^&\;\x0D\x0A]*[<>\"\']/i"; reference:url,www.securityfocus.com/bid/37446/info; reference:url,doc.emergingthreats.net/2010602; classtype:web-application-attack; sid:2010602; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP jmnad1.com Spyware Install (1)"; flow: to_server,established; content:"/install.qg?"; nocase; http_uri; content: "ID="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002019; reference:url,wilderssecurity.com/threads/hijack-this-log-sandoxer-jmnad1.42146/; classtype:pup-activity; sid:2002019; rev:12; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX EasyMail Object IMAP4 Component Buffer Overflow Function call Attempt"; flow:from_server,established; content:"ActiveXObject"; nocase; content:"EasyMail.IMAP4.6"; distance:0; nocase; content:"LicenseKey"; nocase; reference:url,secunia.com/advisories/24199/; reference:url,doc.emergingthreats.net/2010658; classtype:web-application-attack; sid:2010658; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Weird on the Web /180 Solutions Checkin"; flow: to_server,established; content:"/notifier/config.ini?v="; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002036; classtype:pup-activity; sid:2002036; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS JBoss JMX Console Beanshell Deployer .WAR File Upload and Deployment Cross Site Request Forgery Attempt"; flow:established,to_client; content:"/HtmlAdaptor"; nocase; content:"action=invokeOpByName"; nocase; within:25; content:"DeploymentFileRepository"; nocase; within:80; content:"methodName="; nocase; within:25; content:".war"; nocase; distance:0; content:".jsp"; nocase; distance:0; reference:url,www.redteam-pentesting.de/en/publications/jboss/-bridging-the-gap-between-the-enterprise-and-you-or-whos-the-jboss-now; reference:cve,2010-0738; reference:url,doc.emergingthreats.net/2011697; classtype:web-application-attack; sid:2011697; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Shop at Home Select Spyware Install"; flow: established,to_server; content:"/arcadecash/setup"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.sahagent.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002037; classtype:pup-activity; sid:2002037; rev:8; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;) -#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED phpbb Session Cookie"; flow: established; content:"phpbb2mysql_data=a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D"; nocase; reference:url,www.waraxe.us/ftopict-555.html; reference:url,doc.emergingthreats.net/2001762; classtype:web-application-attack; sid:2001762; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Topconverting Spyware Reporting"; flow: to_server,established; content:"/trigger.php?partner="; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002040; classtype:pup-activity; sid:2002040; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS XSS Possible Arbitrary Scripting Code Attack in phpBB (private message)"; flow: established,from_server; content:"privmsg.php"; pcre:"/\ $EXTERNAL_NET any (msg:"ET ADWARE_PUP OutBlaze.com Spyware Activity"; flow: to_server,established; content:"/scripts/adpopper/webservice.main"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002044; classtype:pup-activity; sid:2002044; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS XSS Possible Arbitrary Scripting Code Attack in phpBB (signature)"; flow: established,from_server; content:"_________________"; pcre:"/\
_________________\
\ $EXTERNAL_NET any (msg:"ET ADWARE_PUP TargetNetworks.net Spyware Reporting (tn)"; flow: to_server,established; content:"/data/tn.dat?v="; nocase; http_uri; content:"&sid="; nocase; http_uri; reference:url,www.targetnetworks.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002046; classtype:pup-activity; sid:2002046; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX SaschArt SasCam Webcam Server ActiveX Control Head Method Buffer Overflow Attempt"; flow:to_client,established; content:" $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP 180solutions Spyware Defs Download"; flow: to_server,established; content:"/geodefs/gdf"; http_uri; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002048; classtype:pup-activity; sid:2002048; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;) -alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX SoftCab Sound Converter ActiveX SaveFormat File overwrite Attempt"; flow:established,to_client; content:"66757BFC-DA0C-41E6-B3FE-B6D461223FF5"; nocase; content:"SaveFormat"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*66757BFC-DA0C-41E6-B3FE-B6D461223FF5/si"; reference:url,secunia.com/advisories/37967/; reference:url,doc.emergingthreats.net/2010943; classtype:web-application-attack; sid:2010943; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Pacimedia Spyware 1"; flow:to_server,established; content:"/mcp/mcp.cgi"; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002083; classtype:pup-activity; sid:2002083; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Synactis All_IN_THE_BOX ActiveX SaveDoc Method Arbitrary File Overwrite"; flow:to_client,established; content:"clsid"; nocase; content:"B5576893-F948-4E0F-9BE1-A37CB56D66FF"; nocase; distance:0; content:"SaveDoc"; nocase; reference:url,milw0rm.com/exploits/7928; reference:bugtraq,33535; reference:url,doc.emergingthreats.net/2009138; classtype:web-application-attack; sid:2009138; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP C4tdownload.com Spyware Activity"; flow: to_server,established; content:"/js.php?event_type=onload&recurrence="; nocase; http_uri; reference:url,sarc.com/avcenter/venc/data/adware.clickdloader.b.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002088; classtype:pup-activity; sid:2002088; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 10000 (msg:"ET WEB_SPECIFIC_APPS Virtualmin left.cgi XSS attempt"; flow:to_server,established; content:"GET "; depth:4; content:"/left.cgi?"; nocase; content:"dom="; nocase; content:"script"; nocase; pcre:"/?.*<.+\/script>?/i"; reference:url,milw0rm.com/exploits/9143; reference:url,doc.emergingthreats.net/2009587; classtype:web-application-attack; sid:2009587; rev:5; metadata:created_at 2010_07_30, former_category WEB_SPECIFIC_APPS, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP CWS qck.cc Spyware Installer (in.php)"; flow:established,to_server; content:"/x/in.php?wm="; nocase; http_uri; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453076035; reference:url,doc.emergingthreats.net/bin/view/Main/2002089; classtype:pup-activity; sid:2002089; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 10000 (msg:"ET WEB_SPECIFIC_APPS Virtualmin link.cgi XSS attempt"; flow:to_server,established; content:"GET "; depth:4; content:"/link.cgi/"; nocase; content:"script"; nocase; pcre:"/?.*<.+\/script>?/Ui"; reference:url,milw0rm.com/exploits/9143; reference:url,doc.emergingthreats.net/2009588; classtype:web-application-attack; sid:2009588; rev:5; metadata:created_at 2010_07_30, former_category WEB_SPECIFIC_APPS, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP IEHelp.net Spyware Installer"; flow:established,to_server; content:"/counter/help.chm"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.domcom.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002090; classtype:pup-activity; sid:2002090; rev:8; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 10000 (msg:"ET WEB_SPECIFIC_APPS Virtualmin Anonymous Proxy attempt"; flow:to_server,established; content:"GET "; depth:4; content:"/virtual-server/link.cgi/"; nocase; content:"/http\://"; nocase; reference:url,milw0rm.com/exploits/9143; reference:url,doc.emergingthreats.net/2009589; classtype:web-application-attack; sid:2009589; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchmiracle.com Spyware Install - silent.exe"; flow: to_server,established; content:"/silent.exe"; nocase; http_uri; reference:url,www.searchmiracle.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002091; classtype:pup-activity; sid:2002091; rev:8; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Visagesoft eXPert PDF Viewer ActiveX Control Arbitrary File Overwrite"; flow:to_client,established; content:"CLSID"; nocase; content:"BDF3E9D2-5F7A-4F4A-A914-7498C862EA6A"; nocase; distance:0; content:"savePageAsBitmap"; nocase; reference:bugtraq,31984; reference:url,milw0rm.com/exploits/6875; reference:url,doc.emergingthreats.net/2008791; classtype:web-application-attack; sid:2008791; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Likely Trojan/Spyware Installer Requested (2)"; flow: established,to_server; content:".exe"; nocase; http_uri; pcre:"/(discador|ocartao|msgav|extrato|correcao|extrato_tim|visualizar|cartas&cartoes|embratel|cartao|MSN_INSTALL|VirtualCards|atualizacaonorton|serasar|CobrancaEmbratel|ExtratoTim|FlashFotos|Vacina-Norton|CartaoIloves|Cobranca|fotos_ineditas|boletocobranca|saudades|wwwuolcartoescombr|cartaoanimado)\.exe/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2002093; classtype:pup-activity; sid:2002093; rev:9; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Viscom Movie Player Pro SDK ActiveX DrawText method Buffer Overflow Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"MOVIEPLAYER.MoviePlayerCtrl.1"; nocase; distance:0; content:"DrawText"; nocase; reference:url,www.shinnai.net/exploits/X6hU4E0E7P5H3qH5yXrn.txt; reference:url,secunia.com/advisories/38156/; reference:url,doc.emergingthreats.net/2010944; classtype:attempted-user; sid:2010944; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP CWS qck.cc Spyware Installer (web.php)"; flow:established,to_server; content:"/x/tbd_web.php?wm="; nocase; http_uri; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453076035; reference:url,doc.emergingthreats.net/bin/view/Main/2002095; classtype:pup-activity; sid:2002095; rev:8; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Webmoney Advisor ActiveX Redirect Method Remote DoS Attempt"; flow:established,to_client; content:" $EXTERNAL_NET any (msg:"ET ADWARE_PUP IEHelp.net Spyware checkin"; flow:established,to_server; content:"/l/gpr.php?"; nocase; http_uri; content: "ID1="; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.domcom.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002096; classtype:pup-activity; sid:2002096; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Webmoney Advisor ActiveX Control DoS Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"TOOLBAR3Lib.ToolbarObj"; nocase; distance:0; content:"Redirect"; nocase; reference:url,exploit-db.com/exploits/12431; reference:url,doc.emergingthreats.net/2011724; classtype:attempted-user; sid:2011724; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category WEB_SPECIFIC_APPS, signature_severity Major, tag ActiveX, updated_at 2019_04_15;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP 180solutions Spyware config Download"; flow: to_server,established; content:"/config.aspx?did="; http_uri; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002099; classtype:pup-activity; sid:2002099; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;) -alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Yahoo CD Player ActiveX Open Stack Overflow Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"5622772D-6C27-11D3-95E5-006008D14F3B"; nocase; distance:0; content:"Open"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5622772D-6C27-11D3-95E5-006008D14F3B/si"; reference:url,www.shinnai.net/exploits/pD9YWswsoR3EIcE9bf3N.txt; reference:url,doc.emergingthreats.net/2010945; classtype:attempted-user; sid:2010945; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP iWon Spyware (iWonSearchAssistant)"; flow:to_server,established; content:"User-Agent|3a| iWonSearch"; http_header; reference:url,www.spywareguide.com/product_show.php?id=461; reference:url,doc.emergingthreats.net/2002169; classtype:pup-activity; sid:2002169; rev:15; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Yahoo CD Player ActiveX Open Stack Overflow Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"YoPlayer.YoPlyCd.1"; nocase; distance:0; content:"open"; nocase; reference:url,www.shinnai.net/exploits/pD9YWswsoR3EIcE9bf3N.txt; reference:url,doc.emergingthreats.net/2010946; classtype:attempted-user; sid:2010946; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category WEB_SPECIFIC_APPS, signature_severity Major, tag ActiveX, updated_at 2019_04_15;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchfeed.com Spyware 1"; flow: to_server,established; content:"/rd/Clk.jsp"; http_uri; reference:url,www.searchfeed.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002296; classtype:pup-activity; sid:2002296; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 4274 (msg:"ET WEB_SPECIFIC_APPS Possible Xedus Webserver Directory Traversal Attempt"; flow: to_server,established; content:"/../data/log.txt"; content:"/../WINNT/"; nocase; reference:url,www.gulftech.org/?node=research&article_id=00047-08302004; reference:url,doc.emergingthreats.net/2001238; classtype:web-application-activity; sid:2001238; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchfeed.com Spyware 2"; flow: to_server,established; content:"/rd/feed/TextFeed.jsp"; http_uri; reference:url,www.searchfeed.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002297; classtype:pup-activity; sid:2002297; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Zen Cart Remote Code Execution"; flow:to_server,established; content:"POST "; depth:5; nocase; content:"admin/record_company.php/password_forgotten.php"; content:"action=insert"; nocase; depth:100; reference:url,www.securityfocus.com/bid/35467; reference:url,www.milw0rm.com/exploits/9004; reference:url,doc.emergingthreats.net/2009663; classtype:web-application-activity; sid:2009693; rev:4; metadata:created_at 2010_07_30, former_category WEB_SPECIFIC_APPS, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchfeed.com Spyware 3"; flow: to_server,established; content:"/rd/feed/XMLFeed.jsp"; http_uri; reference:url,www.searchfeed.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002298; classtype:pup-activity; sid:2002298; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 10616 (msg:"ET WEB_SPECIFIC_APPS EiQNetworks Security Analyzer Buffer Overflow"; flow:established,to_server; content:"LICMGR_ADDLICENSE&"; nocase; depth:18; isdataat:450,relative; pcre:"/LICMGR_ADDLICENSE&[^\x00\n\r@&]{450}/i"; reference:cve,2006-3838; reference:url,secunia.com/advisories/21211/; reference:url,doc.emergingthreats.net/2003056; classtype:attempted-admin; sid:2003056; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchfeed.com Spyware 4"; flow: to_server,established; content:"/rd/feed/JavaScriptFeed.jsp"; http_uri; reference:url,www.searchfeed.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002299; classtype:pup-activity; sid:2002299; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS WebHack Control Center User-Agent Outbound (WHCC/)"; flow:to_server,established; content:"User-Agent|3a|"; nocase; content:"WHCC"; http_header; fast_pattern; nocase; pcre:"/^User-Agent\:[^\n]+WHCC/Hmi"; reference:url,www.governmentsecurity.org/forum/index.php?showtopic=5112&pid=28561&mode=threaded&start=; reference:url,doc.emergingthreats.net/2003925; classtype:trojan-activity; sid:2003925; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchfeed.com Spyware 5"; flow: to_server,established; content:"/rd/feed/JavaScriptFeedSE.jsp"; http_uri; reference:url,www.searchfeed.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002300; classtype:pup-activity; sid:2002300; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET EXPLOIT Outgoing Electronic Mail for UNIX Expires Header Buffer Overflow Exploit"; flow:established; content:"Expires|3a|"; content:"|40 60 6e 63|"; distance:52; within:300; content:"|2d 70|"; distance:2; within:20; reference:url,www.frsirt.com/exploits/20050822.elmexploit.c.php; reference:url,www.instinct.org/elm/; reference:url,doc.emergingthreats.net/bin/view/Main/2002316; classtype:misc-attack; sid:2002316; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchfeed.com Spyware 6"; flow: to_server,established; content:"/rd/SearchResults.jsp"; http_uri; reference:url,www.searchfeed.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002301; classtype:pup-activity; sid:2002301; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET EXPLOIT Incoming Electronic Mail for UNIX Expires Header Buffer Overflow Exploit"; flow:established; content:"Expires|3a|"; content:"|40 60 6e 63|"; distance:52; within:300; content:"|2d 70|"; distance:2; within:20; reference:url,www.frsirt.com/exploits/20050822.elmexploit.c.php; reference:url,www.instinct.org/elm/; reference:url,doc.emergingthreats.net/bin/view/Main/2002315; classtype:misc-attack; sid:2002315; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchfeed.com Spyware 7"; flow: to_server,established; content:"/rd/jsp/BidRank/index.jsp"; http_uri; reference:url,www.searchfeed.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002302; classtype:pup-activity; sid:2002302; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"ET EXPLOIT MS-SQL SQL Injection running SQL statements line comment"; flow: to_server,established; content:"|3b 00|"; content:"-|00|-|00|"; reference:url,www.nextgenss.com/papers/more_advanced_sql_injection.pdf; reference:url,www.securitymap.net/sdm/docs/windows/mssql-checklist.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000372; classtype:attempted-user; sid:2000372; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchfeed.com Spyware 8"; flow: to_server,established; content:"/SFToolBar.html"; http_uri; reference:url,www.searchfeed.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002303; classtype:pup-activity; sid:2002303; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 2775 (msg:"ET EXPLOIT Now SMS/MMS Gateway SMPP BOF Vulnerability"; flow:established,to_server; content:"|00 00 00 04|"; content:"|00 00 00 01|"; distance:1; pcre:"/[a-zA-Z0-9]{1000,}/i"; reference:bugtraq,27896; reference:url,aluigi.altervista.org/adv/nowsmsz-adv.txt; reference:url,doc.emergingthreats.net/bin/view/Main/2007875; classtype:web-application-attack; sid:2007875; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Fun Web Products Smileychooser Spyware"; flow: to_server,established; content:"/SmileyChooser.html?"; nocase; http_uri; content:"v="; nocase; http_uri; reference:url,www.funwebproducts.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002305; classtype:pup-activity; sid:2002305; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $HOME_NET 445 -> any any (msg:"ET EXPLOIT Pwdump3e Password Hash Retrieval port 445"; flow: from_server,established; content:"|3a 00|5|00|0|00|0|3a|"; reference:url,doc.emergingthreats.net/bin/view/Main/2000563; classtype:misc-attack; sid:2000563; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Fun Web Products Cursorchooser Spyware"; flow: to_server,established; content:"/CursorChooser.html?"; nocase; http_uri; reference:url,www.funwebproducts.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002306; classtype:pup-activity; sid:2002306; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $HOME_NET 139 -> any any (msg:"ET EXPLOIT Pwdump3e Password Hash Retrieval port 139"; flow: from_server,established; content:"|3a 00|5|00|0|00|0|3a|"; reference:url,doc.emergingthreats.net/bin/view/Main/2000568; classtype:misc-attack; sid:2000568; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Fun Web Products Smileychooser Spyware"; flow: to_server,established; content:"/SmileyChooser.html?"; nocase; http_uri; content:"v="; nocase; http_uri; reference:url,www.funwebproducts.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002310; classtype:pup-activity; sid:2002310; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET GAMES TrackMania Request Connect"; flow:to_server,established; content:"POST"; http_method; content:"/online_game/request.php"; http_uri; content:"User-Agent|3a| GameBox"; http_header; content:"Connect"; nocase; http_client_body; reference:url,www.trackmania.com; reference:url,doc.emergingthreats.net/2011752; classtype:policy-violation; sid:2011752; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP EZSearch Spyware Reporting Search Strings"; flow:established,to_server; content:"/partner/rt.php?q="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002317; classtype:pup-activity; sid:2002317; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET INAPPROPRIATE Kiddy Porn preteen"; flow: from_server,established; content:"preteen"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/2001346; classtype:policy-violation; sid:2001346; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP EZSearch Spyware Reporting Search Category"; flow:established,to_server; content:"/partner/rt.php?cat="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002318; classtype:pup-activity; sid:2002318; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET INAPPROPRIATE Kiddy Porn pre-teen"; flow: from_server,established; content:"pre-teen"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/2001347; classtype:policy-violation; sid:2001347; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP EZSearch Spyware Reporting 2"; flow:established,to_server; content:"/partner/bom.php?e="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002319; classtype:pup-activity; sid:2002319; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET INAPPROPRIATE Kiddy Porn early teen"; flow: from_server,established; content:"early teen"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/2001348; classtype:policy-violation; sid:2001348; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Transponder Spyware Activity"; flow:established,to_server; content:"/sendROIcookie.cfm?refer="; nocase; http_uri; reference:url,www.doxdesk.com/parasite/Transponder.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002320; classtype:pup-activity; sid:2002320; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET INAPPROPRIATE Kiddy Porn zeps"; flow: from_server,established; content:" zeps "; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2001387; classtype:policy-violation; sid:2001387; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP VPP Technologies Spyware"; flow:established,to_server; content:"/DittoIA.jsh?pid="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002348; classtype:pup-activity; sid:2002348; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET INAPPROPRIATE Kiddy Porn r@ygold"; flow: from_server,established; content:" r@ygold "; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2001388; classtype:policy-violation; sid:2001388; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Alexa Spyware Reporting URL"; flow:established,to_server; content:"/image_server.cgi?size=small&url=http|3a|/"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002349; classtype:pup-activity; sid:2002349; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET INAPPROPRIATE Kiddy Porn childlover"; flow: from_server,established; content:" childlover "; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2001389; classtype:policy-violation; sid:2001389; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP VPP Technologies Spyware Reporting URL"; flow:established,to_server; content:"/js.vppimage?key="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002350; classtype:pup-activity; sid:2002350; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET INAPPROPRIATE free XXX"; flow: to_client,established; content:"FREE XXX"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/2001349; classtype:policy-violation; sid:2001349; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Comet Systems Spyware Update Download"; flow: to_server,established; content:"/cc/5/masterconfig/"; nocase; http_uri; content:"/update.xml?v="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002351; classtype:pup-activity; sid:2002351; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET INAPPROPRIATE hardcore anal"; flow: to_client,established; content:"hardcore anal"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/2001350; classtype:policy-violation; sid:2001350; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Comet Systems Spyware Context Report"; flow: to_server,established; content:"/context/1/up_context_1.xml?v="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002352; classtype:pup-activity; sid:2002352; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET INAPPROPRIATE masturbation"; flow: to_client,established; content:"masturbat"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/2001351; classtype:policy-violation; sid:2001351; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP 180solutions Spyware versionconfig POST"; flow:to_server,established; content:"/versionconfig.aspx?"; http_uri; content:"&ver="; http_uri; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002354; classtype:pup-activity; sid:2002354; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET INAPPROPRIATE ejaculation"; flow: to_client,established; content:"ejaculat"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/2001352; classtype:policy-violation; sid:2001352; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Adwave/MarketScore User-Agent (WTA)"; flow: to_server,established; content:"User-Agent|3a| WTA_"; http_header; reference:url,www.adwave.com/our_mission.aspx; reference:url,www.marketscore.com; reference:url,doc.emergingthreats.net/2002394; classtype:pup-activity; sid:2002394; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET INAPPROPRIATE BDSM"; flow: to_client,established; content:"BDSM"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/2001353; classtype:policy-violation; sid:2001353; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Movies-etc User-Agent (IOInstall)"; flow: to_server,established; content:"User-Agent|3a| IOInstall"; nocase; http_header; reference:url,www.movies-etc.com; reference:url,doc.emergingthreats.net/2002404; classtype:pup-activity; sid:2002404; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET INAPPROPRIATE Sextracker Tracking Code Detected (1)"; flow: from_server,established; content:"BEGIN SEXLIST REFERRER-STATS CODE"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2001392; classtype:policy-violation; sid:2001392; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP iframebiz - sploit.anr"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/sploit.anr"; nocase; http_uri; reference:url,iframecash.biz; reference:url,isc.sans.org/diary.php?storyid=868; reference:url,doc.emergingthreats.net/bin/view/Main/2002708; classtype:pup-activity; sid:2002708; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2022_05_03;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET INAPPROPRIATE Sextracker Tracking Code Detected (2)"; flow: from_server,established; content:"BEGIN SEXTRACKER CODE"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2001393; classtype:policy-violation; sid:2001393; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP iframebiz - loaderadv***.jar"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/loaderadv"; nocase; http_uri; pcre:"/loaderadv\d+\.jar/Ui"; reference:url,iframecash.biz; reference:url,isc.sans.org/diary.php?storyid=868; reference:url,doc.emergingthreats.net/bin/view/Main/2002709; classtype:pup-activity; sid:2002709; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET INAPPROPRIATE Likely Porn"; flow: established,from_server; pcre:"/ (FREE XXX|dildo|masturbat|oral sex|ejaculat|up skirt|tits|bondage|lolita|clitoris|cock suck|hardcore (teen|anal|sex|porn)|raw sex|((fuck|sex|porn|xxx) (movies|dvd))|((naked|nude) (celeb|lesbian)))\b/i"; reference:url,doc.emergingthreats.net/bin/view/Main/2001608; classtype:policy-violation; sid:2001608; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Trafficsector.com Spyware Install"; flow: to_server,established; content:"/install.php?"; nocase; http_uri; content:"afid="; nocase; http_uri; content:"&user_id="; http_uri; content:"trafficsector"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2002736; classtype:pup-activity; sid:2002736; rev:6; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Spyware 2020"; flow: to_server,established; content:"|48 6F 73 74 3A 20 77 77 77 2E 32 30 32 30 73 65 61 72 63 68 2E 63 6F 6D|"; content:"|49 70 41 64 64 72|"; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.2020search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000327; classtype:trojan-activity; sid:2000327; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SurfSidekick Activity (rinfo)"; flow: established,to_server; content:"/rinfo.htm?"; nocase; http_uri; content:"host="; nocase; http_uri; content:"action="; nocase; http_uri; content:"client=SSK"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.surfsidekick.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002738; classtype:pup-activity; sid:2002738; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ADWARE_PUP 2nd-thought (W32.Daqa.C) Download"; flow: from_server,established; content:"|67 6f 69 64 72 2e 63 61 62|"; nocase; content:"|48 6f 73 74 3a 20 77 77 77 2e 77 65 62 6e 65 74 69 6e 66 6f 2e 6e 65 74|"; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.secondthought.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001447; classtype:pup-activity; sid:2001447; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP adservs.com Spyware"; flow: to_server,established; content:"/binaries/relevance.dat"; http_uri; content:"adservs"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2002740; classtype:pup-activity; sid:2002740; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Altnet PeerPoints Manager Start"; flow: to_server,established; uricontent:"/pm/start.asp"; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.topsearch.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000906; classtype:policy-violation; sid:2000906; rev:9; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Corpsespyware.net BlackList - pcpeek"; flow:to_server,established; content:"Host|3a|"; nocase; http_header; content:"pcpeek-webcam-sex.com"; nocase; http_header; reference:url,www.securityfocus.com/infocus/1745; reference:url,doc.emergingthreats.net/bin/view/Main/2002766; classtype:pup-activity; sid:2002766; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Altnet PeerPoints Manager Data Submission"; flow: to_server,established; uricontent:"/backoffice.net/stats/Add.aspx"; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.topsearch.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000598; classtype:policy-violation; sid:2000598; rev:9; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Corpsespyware.net Distribution - bos.biz"; flow:to_server,established; content:"Host|3a|"; nocase; http_header; content:"businessopportunityseeker.biz"; nocase; http_header; reference:url,www.securityfocus.com/infocus/1745; reference:url,doc.emergingthreats.net/bin/view/Main/2002767; classtype:pup-activity; sid:2002767; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Altnet PeerPoints Manager Settings Download"; flow: to_server,established; uricontent:"/pointsmanager/settings.cab?"; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.topsearch.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000907; classtype:policy-violation; sid:2000907; rev:10; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Corpsespyware.net Distribution - studiolacase"; flow:to_server,established; content:"Host|3a|"; nocase; http_header; content:"studiolacase.com"; nocase; http_header; reference:url,www.securityfocus.com/infocus/1745; reference:url,doc.emergingthreats.net/bin/view/Main/2002769; classtype:pup-activity; sid:2002769; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Advertising.com Reporting Data"; flow: to_server,established; uricontent:"/site="; uricontent:"/mnum="; uricontent:"/bins="; uricontent:"/rich="; uricontent:"/logs="; uricontent:"/betr="; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.fastseek.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002304; classtype:policy-violation; sid:2002304; rev:8; metadata:created_at 2010_07_30, updated_at 2020_08_20;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Corpsespyware.net - msits.exe access"; flow:to_server,established; content:"/msits.exe"; nocase; http_uri; reference:url,www.securityfocus.com/infocus/1745; reference:url,doc.emergingthreats.net/bin/view/Main/2002770; classtype:pup-activity; sid:2002770; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED C4tdownload.com Access, Likely Spyware"; flow: to_server,established; content:"Host|3a|"; nocase; content:".c4tdownload.com"; within:26; nocase; reference:url,sarc.com/avcenter/venc/data/adware.clickdloader.b.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001531; classtype:trojan-activity; sid:2001531; rev:14; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Corpsespyware.net - msys.exe access"; flow:to_server,established; content:"/msys.exe"; nocase; http_uri; reference:url,www.securityfocus.com/infocus/1745; reference:url,doc.emergingthreats.net/bin/view/Main/2002771; classtype:pup-activity; sid:2002771; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Default-homepage-network.com Access"; flow: to_server,established; content:"wsh.RegWrite"; nocase; content:"default-homepage-network.com/start.cgi?"; nocase; reference:url,default-homepage-network.com/start.cgi?new-hkcu; reference:url,doc.emergingthreats.net/bin/view/Main/2001222; classtype:trojan-activity; sid:2001222; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyaxe Spyware DB Update"; flow: to_server,established; content:"/updates/database/dbver.php"; nocase; http_uri; content:"spywareaxe"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2002804; classtype:pup-activity; sid:2002804; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Evidencenuker.com Fake AV Updating"; flow:established,to_server; uricontent:"/products/evidencenuker/update.php?version="; nocase; reference:url,www.evidencenuker.com; reference:url,doc.emergingthreats.net/bin/view/Main/2003568; classtype:trojan-activity; sid:2003568; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyaxe Spyware DB Version Check"; flow: to_server,established; content:"/updates/database/dbver.dat"; nocase; http_uri; content:"spywareaxe"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2002805; classtype:pup-activity; sid:2002805; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Fun Web Products MyWay Agent Traffic"; flow: to_server,established; content:"FunWebProducts-MyWay|3b|"; nocase; threshold: type limit, track by_src, count 10, seconds 60; reference:url,www.funwebproducts.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001043; classtype:policy-violation; sid:2001043; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyaxe Spyware Checkin"; flow: to_server,established; content:"/download.php?sid="; nocase; http_uri; content:"spyaxe"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2002806; classtype:pup-activity; sid:2002806; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Pacimedia Spyware 2"; flow: to_server,established; uricontent:"/xml/check.php?"; nocase; uricontent:"u="; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2002194; classtype:policy-violation; sid:2002194; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP DelFin Project Spyware (payload)"; flow: established,to_server; content:"/in/payload/payload.nfo?"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002816; classtype:pup-activity; sid:2002816; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED YourSiteBar Data Submision"; flow: to_server,established; uricontent:"/ist/scripts/istsvc_ads_data.php?version="; nocase; reference:url,www.ysbweb.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001698; classtype:trojan-activity; sid:2001698; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP DelFin Project Spyware (setup)"; flow: established,to_server; content:"/in/defaults/setup.nfo?"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002817; classtype:pup-activity; sid:2002817; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET USER_AGENTS User Agent Containing http Suspicious - Likely Spyware/Trojan"; flow:to_server,established; content:"User-Agent|3a|"; nocase; content:!"rss"; nocase; pcre:"/User-Agent\:[^\n]+http\:\/\//i"; reference:url,doc.emergingthreats.net/bin/view/Main/2003394; classtype:trojan-activity; sid:2003394; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Hotbar Agent Subscription POST"; flow: to_server,established; content:"/hotbar/"; nocase; http_uri; content:"Subscription.dll?"; nocase; http_uri; reference:url,www.hotbar.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002820; classtype:pup-activity; sid:2002820; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET HUNTING Suspicious Mozilla User-Agent Likely Fake (Mozilla/5.0)"; flow:to_server,established; content:"|0d 0a|User-Agent|3a| Mozilla/5.0|0d 0a|"; nocase; content:!"|0d 0a|Host|3a| download.releasenotes.nokia.com"; content:!"Mozilla/5.0|0d 0a|Connection|3a| Close|0d 0a 0d 0a|"; reference:url,doc.emergingthreats.net/2009295; classtype:trojan-activity; sid:2009295; rev:9; metadata:created_at 2010_07_30, former_category INFO, updated_at 2017_10_27;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SideStep Bar Reporting Data (sbstart)"; flow: to_server,established; content:"/servlet/SbStartservlet"; nocase; http_uri; reference:url,www.sidestep.com; reference:url,www.spyany.com/program/article_spw_rm_SideStep.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002821; classtype:pup-activity; sid:2002821; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Suspicious User Agent (Internet Antivirus Pro)"; flow:established,to_server; content:"|0d 0a|User-Agent|3a| Internet Antivirus Pro|0d 0a|"; reference:url,doc.emergingthreats.net/2009440; classtype:trojan-activity; sid:2009440; rev:6; metadata:created_at 2010_07_30, former_category HUNTING, updated_at 2021_06_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MyWebSearch Toolbar Traffic (bar config download)"; flow: to_server,established; content:"/barcfg.jsp?"; nocase; http_uri; content:"MyWebSearchWB"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2002836; classtype:pup-activity; sid:2002836; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Suspicious User Agent (ClickAdsByIE)"; flow:established,to_server; content:"|0d 0a|User-Agent|3a| ClickAdsByIE"; reference:url,doc.emergingthreats.net/2009445; classtype:trojan-activity; sid:2009456; rev:5; metadata:created_at 2010_07_30, former_category HUNTING, updated_at 2021_06_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Fun Web Products StationaryChooser Spyware"; flow: to_server,established; content:"/StationeryChooser.html?"; nocase; http_uri; content: "v="; nocase; http_uri; reference:url,www.funwebproducts.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002858; classtype:pup-activity; sid:2002858; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP IE homepage hijacking"; flow: from_server,established; content:"wsh.RegWrite"; nocase; content:"HKLM\\\\Software\\\\Microsoft\\\\Internet Explorer\\\\Main\\\\Start Page"; nocase; reference:url,www.geek.com/news/geeknews/2004Jun/gee20040610025522.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2000514; classtype:pup-activity; sid:2000514; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP CWS Spy-Sheriff.com Infeced Buy Page Request"; flow:established,to_server; content:"/?advid="; nocase; http_uri; content:"spy-sheriff.com"; nocase; http_header; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453076035; reference:url,doc.emergingthreats.net/bin/view/Main/2002933; classtype:pup-activity; sid:2002933; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET ADWARE_PUP MarketScore.com Spyware SSL Access"; flow: to_server,established; content:"www.marketscore.com"; content:"InstantSSL1"; nocase; reference:url,www.marketscore.com; reference:url,www.spysweeper.com/remove-marketscore.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001563; classtype:pup-activity; sid:2001563; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Bravesentry.com Fake Antispyware Download"; flow:established,to_server; content:"/bravesentry.exe"; nocase; http_uri; reference:url,www.bravesentry.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=BraveSentry&threatid=44152; reference:url,doc.emergingthreats.net/bin/view/Main/2002954; classtype:pup-activity; sid:2002954; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BitTorrent DHT ping request"; content:"d1|3a|ad2|3a|id20|3a|"; depth:12; nocase; threshold: type both, count 1, seconds 300, track by_src; reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; reference:url,doc.emergingthreats.net/bin/view/Main/2008581; classtype:policy-violation; sid:2008581; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Bestcount.net Spyware Downloading vxgame"; flow:established,to_server; content:"/vxgame1/vxv.php"; nocase; http_uri; reference:url,reports.internic.net/cgi/whois?whois_nic=bestcount.net&type=domain; reference:url,doc.emergingthreats.net/bin/view/Main/2002956; classtype:pup-activity; sid:2002956; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BitTorrent DHT announce_peers request"; content:"d1|3a|ad2|3a|id20|3a|"; nocase; depth:14; content:"e1|3a|q13|3a|announce_peer1|3a|"; nocase; distance:55; threshold: type both, count 1, seconds 300, track by_src; reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; reference:url,doc.emergingthreats.net/bin/view/Main/2008585; classtype:policy-violation; sid:2008585; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Bestcount.net Spyware Initial Infection Download"; flow:established,to_server; content:"/win32.exe"; nocase; http_uri; pcre:"/\/adv\/\d+\/win32\.exe/Ui"; reference:url,reports.internic.net/cgi/whois?whois_nic=bestcount.net&type=domain; reference:url,doc.emergingthreats.net/bin/view/Main/2002957; classtype:pup-activity; sid:2002957; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P LimeWire P2P Traffic"; flow: established; content:"User-Agent|3a| LimeWire"; nocase; reference:url,www.limewire.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001808; classtype:policy-violation; sid:2001808; rev:8; metadata:created_at 2010_07_30, updated_at 2019_10_15;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SpySherriff Spyware Activity"; flow: to_server,established; content:"/progs_exe/jbsrak/"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002984; classtype:pup-activity; sid:2002984; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P LimeWire P2P Traffic"; flow: established; content:"Server|3a| LimeWire"; nocase; reference:url,www.limewire.com; reference:url,doc.emergingthreats.net/bin/view/Main/2007800; classtype:policy-violation; sid:2007800; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Jupitersatellites.biz Spyware Download"; flow: to_server,established; content:"/traff/ppiigg.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002987; classtype:pup-activity; sid:2002987; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert udp $HOME_NET any -> $EXTERNAL_NET 8247 (msg:"ET P2P Octoshape P2P streaming media"; content:"POST / HTTP/1."; depth:64; content:"Oshtcp-streamtype|3a|"; threshold: type limit, track by_src, count 1, seconds 600; reference:url,doc.emergingthreats.net/2010008; classtype:policy-violation; sid:2010008; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Possible Spambot Checking in to Spam"; flow:established,to_server; content:"/devrandom/"; nocase; http_uri; fast_pattern; content:!"User-Agent|3a|"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2002988; classtype:pup-activity; sid:2002988; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET SCAN Sipsak SIP scan"; content:"sip|3a|sipsak@"; offset:90; reference:url,sipsak.org/; reference:url,doc.emergingthreats.net/2008598; classtype:attempted-recon; sid:2008598; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Possible Spambot Pulling IP List to Spam"; flow:established,to_server; content:"/devrandom/access.php"; nocase; http_uri; fast_pattern; content:"User-Agent|3a| Mozilla/4.0 (compatible)"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2002990; classtype:pup-activity; sid:2002990; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET SCAN Sivus VOIP Vulnerability Scanner SIP Scan"; content:"SIVuS_VoIP_Scanner $EXTERNAL_NET any (msg:"ET ADWARE_PUP Possible Spambot getting new exe"; flow:established,to_server; content:"/traff/ppiigg.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002991; classtype:pup-activity; sid:2002991; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET SCAN Sivus VOIP Vulnerability Scanner SIP Components Scan"; content:"sip|3a|sivus-discovery@vopsecurity.org"; offset:110; reference:url,www.security-database.com/toolswatch/SiVus-VoIP-Security-Scanner-1-09.html; reference:url,www.vopsecurity.org/; reference:url,doc.emergingthreats.net/2008610; classtype:attempted-recon; sid:2008610; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP /jk/exp.wmf Exploit Code Load Attempt"; flow:to_server,established; content:"/jk/exp.wmf"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002999; classtype:pup-activity; sid:2002999; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert udp $EXTERNAL_NET any -> $HOME_NET 1900 (msg:"ET SCAN External to Internal UPnP Request udp port 1900"; content:"MSEARCH * HTTP/1.1"; depth:18; content:"MAN|3a| ssdp|3a|"; nocase; distance:0; reference:url,www.upnp-hacks.org/upnp.html; reference:url,doc.emergingthreats.net/2008094; classtype:attempted-recon; sid:2008094; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP PopupSh.ocx Access Attempt"; flow:to_server,established; content:"/PopupSh.ocx"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003000; classtype:pup-activity; sid:2003000; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET SCAN Smap VOIP Device Scan"; content:" $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP 180solutions Spyware Actionlibs Download"; flow:to_server,established; content:"/actionurls/ActionUrlb"; http_uri; nocase; content:"partnerid="; http_uri; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003057; classtype:pup-activity; sid:2003057; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;) -alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET SCAN Voiper Toolkit Torturer Scan"; content:"interesting-Method"; content:"sip|3a|1_unusual.URI"; content:"to-be!sure"; offset:20; depth:60; reference:url,sourceforge.net/projects/voiper; reference:url,doc.emergingthreats.net/2008568; classtype:attempted-recon; sid:2008568; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP 180solutions (Zango) Spyware Installer Download"; flow:to_server,established; content:"/downloads/valueadd/ping/ping.htm"; nocase; http_uri; content:"zango.com|0d 0a|"; http_header; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003058; classtype:pup-activity; sid:2003058; rev:7; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET SCAN Voiper Fuzzing Scan"; content:"sip|3a|tester@"; content:"Via|3a| SIP/2.0"; offset:20; depth:60; threshold: type threshold, track by_dst, count 5, seconds 15; reference:url,sourceforge.net/projects/voiper; reference:url,doc.emergingthreats.net/2008577; classtype:attempted-recon; sid:2008577; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP 180solutions (Zango) Spyware TB Installer Download"; flow:to_server,established; content:"/ZangoTBInstaller.exe"; http_uri; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003059; classtype:pup-activity; sid:2003059; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;) -#alert http $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ET SCAN Unusually Fast 400 Error Messages (Bad Request), Possible Web Application Scan"; flow:from_server,established; content:"HTTP/1.1 400"; depth:13; threshold: type threshold, track by_dst, count 30, seconds 60; reference:url,www.w3.org/Protocols/rfc2616/rfc2616-sec10.html; reference:url,support.microsoft.com/kb/247249; reference:url,doc.emergingthreats.net/2009884; classtype:attempted-recon; sid:2009884; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP 180solutions (Zango) Spyware Event Activity Post"; flow:to_server,established; content:"/php/uci.php"; http_uri; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003061; classtype:pup-activity; sid:2003061; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;) -#alert http $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ET SCAN Unusually Fast 404 Error Messages (Page Not Found), Possible Web Application Scan/Directory Guessing Attack"; flow:from_server,established; content:"HTTP/1.1 404"; depth:13; threshold: type threshold, track by_dst, count 30, seconds 60; reference:url,www.w3.org/Protocols/rfc2616/rfc2616-sec10.html; reference:url,en.wikipedia.org/wiki/HTTP_404; reference:url,doc.emergingthreats.net/2009885; classtype:attempted-recon; sid:2009885; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Content-loader.com Spyware Install"; flow: to_server,established; content:"/getexe/?wmid="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003074; classtype:pup-activity; sid:2003074; rev:6; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Sality Virus User Agent Detected (SPM_ID=)"; flow:established,to_server; content:"User-Agent|3a| SPM_ID="; nocase; reference:url,doc.emergingthreats.net/2003651; classtype:trojan-activity; sid:2003651; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Content-loader.com Spyware Install 2"; flow: to_server,established; content:"/getdata/getdata.php?wmid="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003075; classtype:pup-activity; sid:2003075; rev:6; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET HUNTING OUTBOUND Suspicious Email Attachment"; flow: to_server,established; content:"Content-Disposition|3A|"; nocase; content:"filename="; distance:0; pcre:"/^\s*=\s*.*?\.(?=[abcdehijlmnoprsvwx])(a(d[ep]|s[x])|c(rt|[ho]m|li|pl|md|pp)|d(iz|ll)|e(m[fl]|xe|bs)|h(lp|sq|ta)|jse?|m(d[abzew]|s[tcgip]|htm|ht)|p(cd|if|l[xsc]|[lm]|ot)|r(eg|ar)|s(cr|ct|[hy]s|wf)|v(b[es]?|xd)|w(m[dfsz]|p[msz]|s[cfh])|xl[tw]|folder|fol|ba[st]|i(sp|n[sif])|lnk|nws|ocx|zip|url)[\x27\x22\n\r\s]/iR"; reference:url,doc.emergingthreats.net/2000562; classtype:suspicious-filename-detect; sid:2000562; rev:12; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Content-loader.com (ownusa.info) Spyware Install"; flow: to_server,established; content:"/fdial2.php?o="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003076; classtype:pup-activity; sid:2003076; rev:6; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WORM Allaple ICMP Sweep Reply Inbound"; icode:0; itype:0; content:"Babcdefghijklmnopqrstuvwabcdefghi"; threshold: type both, count 1, seconds 60, track by_dst; reference:url,www.sophos.com/virusinfo/analyses/w32allapleb.html; reference:url,isc.sans.org/diary.html?storyid=2451; reference:url,doc.emergingthreats.net/2003293; classtype:trojan-activity; sid:2003293; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP TROJAN_VB Microjoin"; flow:established,to_server; content:"/bundle/loader.exe"; nocase; http_uri; reference:url,de.trendmicro-europe.com/consumer/vinfo/encyclopedia.php?VName=TROJ_VB.AWW; reference:url,doc.emergingthreats.net/bin/view/Main/2003084; classtype:pup-activity; sid:2003084; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WORM shell bot perl code download"; flow:to_client,established; content:"# ShellBOT"; nocase; reference:url,doc.emergingthreats.net/2002683; classtype:trojan-activity; sid:2002683; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Fun Web Products SmileyCentral IEsp2 Install"; flow: to_server,established; content:"/download/install_ie_sp2.jhtml?"; nocase; http_uri; content:"product="; nocase; http_uri; content:"utmCall="; nocase; http_uri; content:"bOrganic="; nocase; http_uri; reference:url,www.myfuncards.com; reference:url,doc.emergingthreats.net/bin/view/Main/2003151; classtype:pup-activity; sid:2003151; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WORM Shell Bot Code Download"; flow:to_client,established; content:"##################### IRC #######################"; nocase; reference:url,doc.emergingthreats.net/2002684; classtype:trojan-activity; sid:2002684; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Bestcount.net Spyware Exploit Download"; flow:established,to_server; content:"/sploit.anr"; nocase; http_uri; reference:url,reports.internic.net/cgi/whois?whois_nic=bestcount.net&type=domain; reference:url,doc.emergingthreats.net/bin/view/Main/2003153; classtype:pup-activity; sid:2003153; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Torpig Related Fake User-Agent (Apache (compatible...))"; flow:established,to_server; content:"User-Agent|3a| Apache (compatible|3b| MSIE 6.0|3b| Windows NT 5.1|3b| SV1)"; http_header; reference:url,doc.emergingthreats.net/2010823; classtype:trojan-activity; sid:2010823; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Bestcount.net Spyware Data Upload"; flow:established,to_server; content:"/objects/ocget.dll"; nocase; http_uri; content:"mybest"; nocase; reference:url,reports.internic.net/cgi/whois?whois_nic=bestcount.net&type=domain; reference:url,doc.emergingthreats.net/bin/view/Main/2003154; classtype:pup-activity; sid:2003154; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET DELETED MaMa CaSpEr RFI Scan"; flow:established,to_server; content:"|0D 0A|User-Agent|3a| MaMa CaSpEr|0D 0A|"; nocase; reference:url,doc.emergingthreats.net/2011176; classtype:web-application-attack; sid:2011176; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Thespyguard.com Spyware Install"; flow:established,to_server; content:"/soft/installers/spyguardf.php"; nocase; http_uri; reference:url,www.thespyguard.com; reference:url,www.kliksoftware.com; reference:url,doc.emergingthreats.net/bin/view/Main/2003201; classtype:pup-activity; sid:2003201; rev:6; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible UNION SELECT SQL Injection In Cookie"; flow:to_server,established; content:"|0d 0a|Cookie|3A|"; nocase; content:"UNION%20"; within:200; nocase; content:"SELECT"; nocase; distance:0; pcre:"/\x0a\x0dCookie\x3a[^\n]+UNION.+SELECT/i"; reference:url,www.w3schools.com/sql/sql_union.asp; reference:url,www.w3schools.com/sql/sql_select.asp; reference:url,en.wikipedia.org/wiki/SQL_injection; reference:url,www.owasp.org/index.php/SQL_Injection; reference:url,doc.emergingthreats.net/2009770; classtype:web-application-attack; sid:2009770; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Thespyguard.com Spyware Update Check"; flow:established,to_server; content:"/soft/update/check_update.php"; nocase; http_uri; content:"Host|3a| www.kliksoftware.com"; nocase; http_header; fast_pattern; reference:url,www.kliksoftware.com; reference:url,www.thespyguard.com; reference:url,doc.emergingthreats.net/bin/view/Main/2003202; classtype:pup-activity; sid:2003202; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible SELECT FROM SQL Injection In Cookie"; flow:to_server,established; content:"|0d 0a|Cookie|3A|"; nocase; content:"SELECT%20"; within:200; nocase; content:"FROM"; nocase; distance:0; pcre:"/\x0d\x0aCookie\x3a[^\n]+SELECT.+FROM/i"; reference:url,www.w3schools.com/sql/sql_select.asp; reference:url,en.wikipedia.org/wiki/SQL_injection; reference:url,www.owasp.org/index.php/SQL_Injection; reference:url,doc.emergingthreats.net/2009771; classtype:web-application-attack; sid:2009771; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Hitvirus Fake AV Install"; flow:established,to_server; content:"/soft/installers/hitvirusf.php"; nocase; http_uri; content:"get.hitvirus.com"; nocase; http_header; reference:url,www.kliksoftware.com; reference:url,doc.emergingthreats.net/bin/view/Main/2003203; classtype:pup-activity; sid:2003203; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible DELETE FROM SQL Injection In Cookie"; flow:to_server,established; content:"|0d 0a|Cookie|3A|"; nocase; content:"DELETE%20"; within:200; nocase; content:"FROM"; nocase; distance:0; pcre:"/\x0a\x0dCookie\x3a[^\n]DELETE.+FROM/i"; reference:url,www.w3schools.com/Sql/sql_delete.asp; reference:url,en.wikipedia.org/wiki/SQL_injection; reference:url,www.owasp.org/index.php/SQL_Injection; reference:url,doc.emergingthreats.net/2009772; classtype:web-application-attack; sid:2009772; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Thespyguard.com Spyware Updating"; flow:established,to_server; content:"/soft/update/get.php"; nocase; http_uri; content:"pid="; nocase; http_uri; content:"mail="; nocase; http_uri; content:"Host|3a| www.kliksoftware.com"; nocase; http_header; reference:url,www.kliksoftware.com; reference:url,www.thespyguard.com; reference:url,doc.emergingthreats.net/bin/view/Main/2003204; classtype:pup-activity; sid:2003204; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible INSERT INTO SQL Injection In Cookie"; flow:to_server,established; content:"|0d 0a|Cookie|3A|"; nocase; content:"INSERT%20"; nocase; within:200; content:"INTO"; nocase; distance:0; pcre:"/\x0a\x0dCookie\x3a[^\n]INSERT.+INTO/i"; reference:url,www.w3schools.com/SQL/sql_insert.asp; reference:url,en.wikipedia.org/wiki/SQL_injection; reference:url,www.owasp.org/index.php/SQL_Injection; reference:url,doc.emergingthreats.net/2009773; classtype:web-application-attack; sid:2009773; rev:36; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (Informer from RBC)"; flow:to_server,established; content:"Informer from RBC"; fast_pattern:only; http_header; reference:url,www.kliksoftware.com; reference:url,doc.emergingthreats.net/bin/view/Main/2003205; classtype:pup-activity; sid:2003205; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2022_05_03;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible INTO OUTFILE Arbitrary File Write SQL Injection In Cookie"; flow:to_server,established; content:"|0d 0a|Cookie|3A|"; nocase; content:"INTO%20"; nocase; within:200; content:"OUTFILE"; nocase; distance:0; pcre:"/\x0a\x0dCookie\x3a[^\n]INTO.+OUTFILE/i"; reference:url,www.milw0rm.com/papers/372; reference:url,www.greensql.net/publications/backdoor-webserver-using-mysql-sql-injection; reference:url,websec.wordpress.com/2007/11/17/mysql-into-outfile/; reference:url,doc.emergingthreats.net/2010038; classtype:web-application-attack; sid:2010038; rev:3; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Best-targeted-traffic.com Spyware Ping"; flow:established,to_server; content:"/ping.php?"; nocase; http_uri; content:"ul=http"; nocase; http_uri; content:"unq="; nocase; http_uri; content:"User-Agent|3a| Opera "; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2003211; classtype:pup-activity; sid:2003211; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET 1024: (msg:"ET WEB_SERVER Possible HTTP 404 XSS Attempt (Local Source)"; flow:from_server,established; content:"HTTP/1.1 404 Not Found|0d 0a|"; depth:24; nocase; content:" $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP 180solutions (Zango) Spyware Installer Config 2"; flow:to_server,established; content:"config.aspx"; http_uri; nocase; fast_pattern; content:"?ver="; nocase; http_uri; content:!"User-Agent|3a| "; http_header; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003217; classtype:pup-activity; sid:2003217; rev:9; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2022_05_03, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER SELECT INSTR in Cookie, Possible ORACLE Related Blind SQL Injection Attempt"; flow:established,to_server; content:"|0d 0a|Cookie|3A|"; nocase; content:"SELECT%20"; nocase; within:200; content:"INSTR"; nocase; distance:0; pcre:"/\x0a\x0dCookie\x3a[^\n]SELECT.+INSTR/i"; reference:url,www.psoug.org/reference/substr_instr.html; reference:url,www.easywebtech.com/artical/Oracle_INSTR.html; reference:url,www.owasp.org/index.php/SQL_Injection; reference:url,msdn.microsoft.com/en-us/library/ms161953.aspx; reference:url,doc.emergingthreats.net/2010286; classtype:web-application-attack; sid:2010286; rev:3; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Conduit Connect Toolbar Message Download(Many report to be benign)"; flow: to_server,established; content:"/Message/"; http_uri; content:"User-Agent|3a| EI"; nocase; http_header; pcre:"/\/Message\/\S+\/\S+\.xml/Ui"; reference:url,www.conduit.com; reference:url,doc.emergingthreats.net/bin/view/Main/2003218; classtype:pup-activity; sid:2003218; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER SELECT SUBSTR/ING in Cookie, Possible Blind SQL Injection Attempt"; flow:established,to_server; content:"|0d 0a|Cookie|3A|"; nocase; content:"SELECT%20"; nocase; within:200; content:"SUBSTR"; nocase; distance:0; pcre:"/\x0a\x0dCookie\x3a[^\n]SELECT.+SUBSTR/i"; reference:url,www.1keydata.com/sql/sql-substring.html; reference:url,www.owasp.org/index.php/SQL_Injection; reference:url,msdn.microsoft.com/en-us/library/ms161953.aspx; reference:url,doc.emergingthreats.net/2010287; classtype:web-application-attack; sid:2010287; rev:3; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Alexa Spyware Reporting"; flow:established,to_server; content:"/data?"; nocase; http_uri; content:"cli="; nocase; http_uri; content:"&dat="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&uid="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003219; classtype:pup-activity; sid:2003219; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible Sun Microsystems Sun Java System Web Server Remote File Disclosure Attempt"; flow:established,to_server; content:"UNLOCK"; nocase; depth:6; content:"Connection|3A| Close"; nocase; distance:0; content:"Lock-token|3A|"; nocase; within:100; reference:url,www.packetstormsecurity.org/1004-exploits/sun-knockout.txt; reference:url,doc.emergingthreats.net/2011015; classtype:web-application-attack; sid:2011015; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MySearchNow.com Spyware"; flow: to_server,established; content:"exe/dns.html"; nocase; http_uri; content:"User-Agent|3a| TPSystem"; nocase; http_header; reference:url,www.mysearchnow.com; reference:url,doc.emergingthreats.net/bin/view/Main/2003221; classtype:pup-activity; sid:2003221; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible Sun Microsystems Sun Java System Web Server Long OPTIONS URI Overflow Attmept"; flow:established,to_server; content:"OPTIONS|20|"; depth:8; nocase; isdataat:400,relative; content:!"|0A|"; within:400; reference:url,www.packetstormsecurity.com/1004-exploits/sunjavasystem-exec.txt; reference:cve,2010-0361; reference:url,doc.emergingthreats.net/2011016; classtype:web-application-attack; sid:2011016; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MyWebSearch Toolbar Receiving Config 2"; flow: to_server,established; content:"/mySpeedbarCfg2.jsp"; nocase; http_uri; content:"MyWebSearch"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2003222; classtype:pup-activity; sid:2003222; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER WebDAV search overflow"; flow:to_server,established; content:"SEARCH "; depth:8; nocase; isdataat:1000,relative; content:!"|0a|"; within:1000; reference:cve,2003-0109; reference:url,doc.emergingthreats.net/2002844; classtype:web-application-attack; sid:2002844; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP New.net Spyware updating"; flow:established,to_server; content:"/download/NewDotNet/"; nocase; http_uri; content:"/upgrade.cab?"; nocase; http_uri; content:"upg="; nocase; http_uri; content:"ec="; nocase; http_uri; reference:url,www.new.net; reference:url,doc.emergingthreats.net/bin/view/Main/2003240; classtype:pup-activity; sid:2003240; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET POLICY Possible Reference to Al Qaeda Propaganda Theme (Al-Wala' Wal Bara) SMTP"; flow: to_client,established; content:"Al-Wala' Wal Bara"; nocase; threshold: type threshold, track by_dst,count 5, seconds 360; reference:url,doc.emergingthreats.net/2010591; classtype:policy-violation; sid:2010591; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP New.net Spyware Checkin"; flow:established,to_server; content:"/?version="; nocase; http_uri; content:"discard_tag="; nocase; http_uri; content:"source="; nocase; http_uri; content:"ptr="; nocase; http_uri; content:"br=NewDotNet"; nocase; http_uri; content:"ec="; nocase; http_uri; reference:url,www.new.net; reference:url,doc.emergingthreats.net/bin/view/Main/2003241; classtype:pup-activity; sid:2003241; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE Outbound PHP Connection"; flow: established,to_server; content:"From|3a| anon@anon.com"; nocase; offset: 0; depth: 19; content:"User-Agent|3a| PHP"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2001628; classtype:web-application-activity; sid:2001628; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SpySheriff Intial Phone Home"; flow:established,to_server; content:"trial.php?rest="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&a="; nocase; http_uri; content:"trial.php"; nocase; content:!"User-Agent|3a| "; http_header; reference:url,vil.nai.com/vil/content/v_135033.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2003251; classtype:pup-activity; sid:2003251; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET ATTACK_RESPONSE r57 phpshell source being uploaded"; flow:established,to_server; content:"/* (c)oded by 1dt.w0lf"; content:"/* RST/GHC http"; distance:0; reference:url,www.pestpatrol.com/spywarecenter/pest.aspx?id=453096755; reference:url,doc.emergingthreats.net/bin/view/Main/2003536; classtype:web-application-activity; sid:2003536; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MarketScore Spyware Uploading Data"; flow: to_server,established; content:"/scripts/contentidpost.dll"; nocase; http_uri; content:"OSS-Proxy"; nocase; http_header; reference:url,www.marketscore.com; reference:url,www.spysweeper.com/remove-marketscore.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003253; classtype:pup-activity; sid:2003253; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE RFI Scanner detected"; flow:established,from_server; content:"RFI Scanner"; reference:url,www.rfxn.com/vdb.php; reference:url,doc.emergingthreats.net/bin/view/Main/2007653; classtype:web-application-activity; sid:2007653; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Travel Update Spyware"; flow:established,to_server; content:"/abt?data="; nocase; http_uri; pcre:"/\/abt\?data=\S{150}/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2003297; classtype:pup-activity; sid:2003297; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE C99 Modified phpshell detected"; flow:established,from_server; content:"C99 Modified"; reference:url,www.rfxn.com/vdb.php; reference:url,doc.emergingthreats.net/bin/view/Main/2007654; classtype:web-application-activity; sid:2007654; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP KMIP.net Spyware"; flow:established,to_server; content:"/iesocks?peer_id="; nocase; http_uri; content:"ver="; nocase; http_uri; reference:url,www.kmip.net; reference:url,doc.emergingthreats.net/bin/view/Main/2003298; classtype:pup-activity; sid:2003298; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE lila.jpg phpshell detected"; flow:established,from_server; content:"CMD PHP"; reference:url,www.rfxn.com/vdb.php; reference:url,doc.emergingthreats.net/bin/view/Main/2007655; classtype:web-application-activity; sid:2007655; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Effectivebrands.com Spyware Checkin"; flow:established,to_server; content:"/iis2ebs.asp"; nocase; http_uri; content:"effectivebrands.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2003304; classtype:pup-activity; sid:2003304; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE ALBANIA id.php detected"; flow:established,from_server; content:"UNITED ALBANIANS aka ALBOSS PARADISE"; reference:url,www.rfxn.com/vdb.php; reference:url,doc.emergingthreats.net/bin/view/Main/2007656; classtype:web-application-activity; sid:2007656; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Comet Systems Spyware Cursor DL"; flow: to_server,established; content:"/czcontent/cursor"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003307; classtype:pup-activity; sid:2003307; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE Mic22 id.php detected"; flow:established,from_server; content:"Mic22"; reference:url,www.rfxn.com/vdb.php; reference:url,doc.emergingthreats.net/bin/view/Main/2007657; classtype:web-application-activity; sid:2007657; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP AntiVermins.com Fake Antispyware Package User-Agent (AntiVerminser)"; flow:to_server,established; content:"User-Agent|3a|"; nocase; http_header; content:"AntiVerminser"; http_header; fast_pattern:only; reference:url,doc.emergingthreats.net/2003336; classtype:pup-activity; sid:2003336; rev:15; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2022_05_03;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Adobe Macromedia Flash Player In Windows XP Remote Arbitrary Code Execution CLSID Access Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"D27CDB6E-AE6D-11cf-96B8-444553540000"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D27CDB6E-AE6D-11cf-96B8-444553540000/si"; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=19710; reference:url,www.kb.cert.org/vuls/id/204889; reference:url,www.microsoft.com/technet/security/advisory/979267.mspx; reference:url,doc.emergingthreats.net/2010666; classtype:attempted-user; sid:2010666; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (Download UBAgent) - lop.com and other spyware"; flow:to_server,established; content:"Download UBAgent"; http_header; fast_pattern:only; reference:url,www.spywareinfo.com/articles/lop/; reference:url,doc.emergingthreats.net/2003345; classtype:pup-activity; sid:2003345; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET DELETED WU Malicious Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"filename"; within:100; content:"WU_Details_"; within:50; pcre:"/filename\s*=\s*"WU_Details_.....\.zip/m"; reference:url,doc.emergingthreats.net/2010376; classtype:trojan-activity; sid:2010376; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Gamehouse.com Activity"; flow: to_server,established; content:"/game-quit-count.jsp?ghgamecode="; http_uri; reference:url,www.gamehouse.com; reference:url,doc.emergingthreats.net/bin/view/Main/2003348; classtype:pup-activity; sid:2003348; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET DELETED MySpace Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"filename"; within:100; content:"MySpace"; within:50; pcre:"/filename\s*=\s*MySpace_document_[0-9]{5}\.zip/m"; reference:url,doc.emergingthreats.net/2010629; classtype:trojan-activity; sid:2010629; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Winferno Registry Fix Spyware Download"; flow: to_server,established; content:"/freeze_rpc6bundle_us/REGISTRYFIXDLL.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003353; classtype:pup-activity; sid:2003353; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET DELETED UPS Spam Inbound Variant 2"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"filename"; within:100; content:"UPS_INVOICE_NR"; within:50; pcre:"/filename=\x22UPS_INVOICE_NR\.[0-9]{4}-[0-9]{6}\.zip\x22/mi"; reference:url,doc.emergingthreats.net/201150; classtype:trojan-activity; sid:2011150; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Yourscreen.com Spyware Download"; flow: to_server,established; content:"/data/yourscreen_data.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003354; classtype:pup-activity; sid:2003354; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET DELETED UPS Spam Inbound Variant 3"; flow:established,to_server; content:"Content-Disposition|3a| attachment|3b|"; nocase; content:"filename=|22|UPS_LABEL_NR."; nocase; within:50; pcre:"/filename=\x22UPS_LABEL_NR\.[A-Z]+_[0-9]{4}-\d+\.ZIP\x22/i"; reference:url,doc.emergingthreats.net/2011151; classtype:trojan-activity; sid:2011151; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Catchonlife.com Spyware"; flow: to_server,established; content:"/nw3/r1.txt?"; http_uri; content:"catchonlife"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2003358; classtype:pup-activity; sid:2003358; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Potential Fake Anti-Virus Download Inst_58s6.exe"; flow:established,to_server; uricontent:"/Inst_58s6.exe"; nocase; reference:url,cyveillanceblog.com/general-cyberintel/malware-google-search-results; reference:url,doc.emergingthreats.net/2010339; classtype:trojan-activity; sid:2010339; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Effectivebrands.com Spyware Checkin 2"; flow:established,to_server; content:"/iis2ucms.asp"; nocase; http_uri; content:"effectivebrands.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2003360; classtype:pup-activity; sid:2003360; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Hostile domain, NeoSploit FakeAV google.analytics.com.*.info"; flow:established,to_server; content:"GET "; nocase; depth:4; content:"|0d 0a|Host|3a| google.analytics.com."; nocase; content:".info|0d 0a|"; within:15; reference:url,www.malwaredomainlist.com/forums/index.php?action=printpage#-#-topic=3781.0; reference:url,doc.emergingthreats.net/2010866; classtype:trojan-activity; sid:2010866; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Freeze.com Spyware/Adware (Pulling Ads)"; flow: to_server,established; content:"/ToastMessage/"; nocase; http_uri; content:"/Toast.asp?ysaid="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003362; classtype:pup-activity; sid:2003362; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Java Deployment Toolkit Launch Method Remote Code Execution Attempt"; flow:established,to_client; content:"-J-jar -J"; pcre:"/(launch\x28.+-J-jar -J|-J-jar -J.+launch\x28)/i"; reference:url,seclists.org/fulldisclosure/2010/Apr/119; reference:url,www.darknet.org.uk/2010/04/serious-java-bug-exposes-users-to-code-execution/; reference:url,doc.emergingthreats.net/2011053; classtype:attempted-user; sid:2011053; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Hotbar Agent Adopt/Zango"; flow: to_server,established; content:"/adopt.jsp?"; nocase; http_uri; content:"l="; nocase; http_uri; content:"&sz="; nocase; http_uri; content:"cid="; nocase; http_uri; reference:url,www.hotbar.com; reference:url,doc.emergingthreats.net/bin/view/Main/2003364; classtype:pup-activity; sid:2003364; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Possible Microsoft Windows Shortcut LNK File Automatic File Execution Attempt Via WebDAV"; flow:established,to_client; content:"T"; nocase; content:""; nocase; distance:0; content:""; nocase; distance:0; content:"shortcut"; nocase; distance:0; reference:url,support.microsoft.com/kb/2286198; reference:url,www.kb.cert.org/vuls/id/940193; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=20918; reference:cve,2010-2568; reference:url,doc.emergingthreats.net/2011239; classtype:attempted-user; sid:2011239; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Hotbar Zango Toolbar Spyware User Agent (ZangoToolbar )"; flow:to_server,established; content:"ZangoToolbar"; http_header; fast_pattern:only; pcre:"/^User-Agent\x3a.+ZangoToolbar.+\r$/Hmi"; reference:url,doc.emergingthreats.net/2003365; classtype:pup-activity; sid:2003365; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Microsoft DirectShow ActiveX Exploit Attempt"; flow:to_client,established; content:"clsid"; nocase; content:"0955AC62-BF2E-4CBA-A2B9-A63F772D46CF"; nocase; content:"omybro"; nocase; content:"logo.gif"; nocase; reference:url,csis.dk/dk/nyheder/nyheder.asp?tekstID=799; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=18595; reference:url,doc.emergingthreats.net/2009491; classtype:web-application-attack; sid:2009491; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spy-Not.com Spyware Pulling Fake Sigs"; flow:to_server,established; content:"/updates1/SKSignatures.zip"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003375; classtype:pup-activity; sid:2003375; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Vulnerable Microsoft Video ActiveX CLSID access (43)"; flow:to_client,established; content:"clsid"; nocase; content:"F9769A06-7ACA-4E39-9CFB-97BB35F0E77E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F9769A06-7ACA-4E39-9CFB-97BB35F0E77E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009612; classtype:web-application-attack; sid:2009612; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Instafinder.com spyware"; flow: established,to_server; content:"/404/update/instafi"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003376; classtype:pup-activity; sid:2003376; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2022_05_03;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (7)"; flow:to_client,established; content:"clsid"; nocase; content:"1BE49F30-0E1B-11D3-9D8E-00C04F72D980"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1BE49F30-0E1B-11D3-9D8E-00C04F72D980/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009620; classtype:web-application-attack; sid:2009620; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spy-Not.com Spyware Updating"; flow:to_server,established; content:"/updates1/SKVersion.ini"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003377; classtype:pup-activity; sid:2003377; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (8)"; flow:to_client,established; content:"clsid"; nocase; content:"1C15D484-911D-11D2-B632-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1C15D484-911D-11D2-B632-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009621; classtype:web-application-attack; sid:2009621; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Hotbar Keywords Download"; flow: to_server,established; content:"/keywords/kyfb."; nocase; http_uri; content:"partner_id="; nocase; http_uri; reference:url,www.hotbar.com; reference:url,doc.emergingthreats.net/bin/view/Main/2003388; classtype:pup-activity; sid:2003388; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (9)"; flow:to_client,established; content:"clsid"; nocase; content:"1DF7D126-4050-47F0-A7CF-4C4CA9241333"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1DF7D126-4050-47F0-A7CF-4C4CA9241333/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009622; classtype:web-application-attack; sid:2009622; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP WhenUClick.com Application Version Check"; flow: to_server,established; content:"/versions.html"; nocase; http_uri; content:"whenu.com"; nocase; http_header; fast_pattern; reference:url,www.whenusearch.com; reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; reference:url,doc.emergingthreats.net/bin/view/Main/2003389; classtype:pup-activity; sid:2003389; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (10)"; flow:to_client,established; content:"clsid"; nocase; content:"2C63E4EB-4CEA-41B8-919C-E947EA19A77C"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2C63E4EB-4CEA-41B8-919C-E947EA19A77C/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009623; classtype:web-application-attack; sid:2009623; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SurfAccuracy.com Spyware Pulling Ads"; flow:to_server,established; content:"/sacc/popup.php"; nocase; http_uri; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2005-062716-0109-99; reference:url,doc.emergingthreats.net/bin/view/Main/2003391; classtype:pup-activity; sid:2003391; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (11)"; flow:to_client,established; content:"clsid"; nocase; content:"334125C0-77E5-11D3-B653-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*334125C0-77E5-11D3-B653-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009624; classtype:web-application-attack; sid:2009624; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyhealer Fake Anti-Spyware Install User-Agent (SpyHealer)"; flow:to_server,established; content:"User-Agent|3a| SpyHeal"; nocase; http_header; reference:url,doc.emergingthreats.net/2003399; classtype:pup-activity; sid:2003399; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (12)"; flow:to_client,established; content:"clsid"; nocase; content:"37B0353C-A4C8-11D2-B634-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B0353C-A4C8-11D2-B634-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009625; classtype:web-application-attack; sid:2009625; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP WhenUClick.com WhenUSave Data Retrieval (DataChunksGZ)"; flow: to_server,established; content:"/DataChunksGZ?update="; nocase; http_uri; content:"ver="; nocase; http_uri; content:"svr="; nocase; http_uri; reference:url,www.whenusearch.com; reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; reference:url,doc.emergingthreats.net/bin/view/Main/2003404; classtype:pup-activity; sid:2003404; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (13)"; flow:to_client,established; content:"clsid"; nocase; content:"37B03543-A4C8-11D2-B634-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03543-A4C8-11D2-B634-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009626; classtype:web-application-attack; sid:2009626; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Epilot.com Spyware Reporting"; flow:established,to_server; content:"/getresults.aspx"; nocase; http_uri; content:"?aff="; nocase; http_uri; content:"&ip="; nocase; http_uri; content:"&keyword="; nocase; http_uri; content:"&source="; nocase; http_uri; reference:url,www.intermute.com/spysubtract/researchcenter/ClientMan.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003414; classtype:pup-activity; sid:2003414; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (14)"; flow:to_client,established; content:"clsid"; nocase; content:"37B03544-A4C8-11D2-B634-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03544-A4C8-11D2-B634-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009627; classtype:web-application-attack; sid:2009627; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Epilot.com Spyware Reporting Clicks"; flow:established,to_server; content:"/click.aspx?"; nocase; http_uri; content:"?xp="; nocase; http_uri; content:"Host|3a| "; nocase; http_header; content:"epilot.com"; nocase; http_header; reference:url,www.intermute.com/spysubtract/researchcenter/ClientMan.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003416; classtype:pup-activity; sid:2003416; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (15)"; flow:to_client,established; content:"clsid"; nocase; content:"418008F3-CF67-4668-9628-10DC52BE1D08"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*418008F3-CF67-4668-9628-10DC52BE1D08/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009628; classtype:web-application-attack; sid:2009628; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP CNSMIN (3721.com) Spyware Activity"; flow:established,to_server; content:"/download/CnsMin"; nocase; http_uri; content:"?t="; nocase; http_uri; reference:url,www.spyany.com/program/article_spy_rm_CnsMin.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003417; classtype:pup-activity; sid:2003417; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (16)"; flow:to_client,established; content:"clsid"; nocase; content:"4A5869CF-929D-4040-AE03-FCAFC5B9CD42"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4A5869CF-929D-4040-AE03-FCAFC5B9CD42/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009629; classtype:web-application-attack; sid:2009629; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP CNSMIN (3721.com) Spyware Activity 2"; flow:established,to_server; content:"/download/CnsUp"; nocase; http_uri; content:"?t="; nocase; http_uri; reference:url,www.spyany.com/program/article_spy_rm_CnsMin.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003418; classtype:pup-activity; sid:2003418; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (17)"; flow:to_client,established; content:"clsid"; nocase; content:"577FAA18-4518-445E-8F70-1473F8CF4BA4"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*577FAA18-4518-445E-8F70-1473F8CF4BA4/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009630; classtype:web-application-attack; sid:2009630; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP CNSMIN (3721.com) Spyware Activity 3"; flow:established,to_server; content:"/download/autolvsw.ini?"; nocase; http_uri; content:"?t="; nocase; http_uri; reference:url,www.spyany.com/program/article_spy_rm_CnsMin.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003419; classtype:pup-activity; sid:2003419; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (18)"; flow:to_client,established; content:"clsid"; nocase; content:"59DC47A8-116C-11D3-9D8E-00C04F72D980"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*59DC47A8-116C-11D3-9D8E-00C04F72D980/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009631; classtype:web-application-attack; sid:2009631; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP xxxtoolbar.com Spyware Install User-Agent"; flow:to_server,established; content:"User-Agent|3a 32 8b 86 85 86 8e 85 86 8c 0d 0a|"; nocase; http_header; reference:url,doc.emergingthreats.net/2003429; classtype:pup-activity; sid:2003429; rev:13; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (19)"; flow:to_client,established; content:"clsid"; nocase; content:"7F9CB14D-48E4-43B6-9346-1AEBC39C64D3"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F9CB14D-48E4-43B6-9346-1AEBC39C64D3/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009632; classtype:web-application-attack; sid:2009632; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Abcsearch.com Spyware Reporting"; flow:established,to_server; content:"/cgi-bin/search/mxml.fcgi?"; nocase; http_uri; content:"Terms="; nocase; http_uri; content:"&affiliate="; nocase; http_uri; content:"&subid="; nocase; http_uri; content:"&Hits_Per_Page="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003438; classtype:pup-activity; sid:2003438; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (20)"; flow:to_client,established; content:"clsid"; nocase; content:"823535A0-0318-11D3-9D8E-00C04F72D980"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*823535A0-0318-11D3-9D8E-00C04F72D980/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009633; classtype:web-application-attack; sid:2009633; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Webbuying.net Spyware Install User-Agent (wbi_v0.90)"; flow:to_server,established; content:" wbi_v0."; fast_pattern:only; http_header; pcre:"/User-Agent\:[^\n]+wbi_v\d/iH"; reference:url,doc.emergingthreats.net/2003441; classtype:pup-activity; sid:2003441; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (21)"; flow:to_client,established; content:"clsid"; nocase; content:"8872FF1B-98FA-4D7A-8D93-C9F1055F85BB"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8872FF1B-98FA-4D7A-8D93-C9F1055F85BB/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009634; classtype:web-application-attack; sid:2009634; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Webbuying.net Spyware Installing"; flow:established,to_server; content:"/inst.php?"; nocase; http_uri; content:"d="; nocase; http_uri; content:"&cl="; nocase; http_uri; content:"&l="; nocase; http_uri; content:"&e="; nocase; http_uri; content:"&v=wbi_v"; nocase; http_uri; content:"&uid="; nocase; http_uri; content:"&time="; nocase; http_uri; content:"&win="; nocase; http_uri; content:"&un=0"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003442; classtype:pup-activity; sid:2003442; rev:6; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (22)"; flow:to_client,established; content:"clsid"; nocase; content:"8A674B4C-1F63-11D3-B64C-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4C-1F63-11D3-B64C-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009635; classtype:web-application-attack; sid:2009635; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Deskwizz.com Spyware Install Code Download"; flow: to_server,established; content:"/ax/acdt-pid"; nocase; http_uri; content:".exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003444; classtype:pup-activity; sid:2003444; rev:6; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (23)"; flow:to_client,established; content:"clsid"; nocase; content:"8A674B4D-1F63-11D3-B64C-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4D-1F63-11D3-B64C-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009636; classtype:web-application-attack; sid:2009636; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Adware Command Client Checkin"; flow: to_server,established; content:"/client.php?str="; nocase; http_uri; content:"Indy Library)"; nocase; http_user_agent; reference:url,www.nuker.com/container/details/adware_command.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003446; classtype:pup-activity; sid:2003446; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (24)"; flow:to_client,established; content:"clsid"; nocase; content:"9CD64701-BDF3-4D14-8E03-F12983D86664"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9CD64701-BDF3-4D14-8E03-F12983D86664/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009638; classtype:web-application-attack; sid:2009638; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Specificclick.net Spyware Activity"; flow: to_server,established; content:"/adopt.sm?"; nocase; http_uri; content:"l="; nocase; http_uri; content:"&sz="; nocase; http_uri; content:"&redir="; nocase; http_uri; content:"&nmv="; nocase; http_uri; content:"&nrsz="; nocase; http_uri; content:"&r="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003450; classtype:pup-activity; sid:2003450; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (25)"; flow:to_client,established; content:"clsid"; nocase; content:"9E77AAC4-35E5-42A1-BDC2-8F3FF399847C"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9E77AAC4-35E5-42A1-BDC2-8F3FF399847C/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009639; classtype:web-application-attack; sid:2009639; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP K8l.info Spyware Activity"; flow: to_server,established; content:"/media/servlet/view/dynamic/url/zone?"; nocase; http_uri; content:"zid="; nocase; http_uri; content:"&pid="; nocase; http_uri; content:"&DHWidth="; nocase; http_uri; content:"&DHHeight="; nocase; http_uri; content:"Ref="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003451; classtype:pup-activity; sid:2003451; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (26)"; flow:to_client,established; content:"clsid"; nocase; content:"A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009640; classtype:web-application-attack; sid:2009640; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP CoolDeskAlert Spyware Activity"; flow:to_server,established; content:"/alert/get_xml"; nocase; http_uri; content:"deskbar_id={"; nocase; reference:url,cooldeskalert.com; reference:url,www.benedelman.org/spyware/images/bannerfarms-ad_w_a_r_e-globalstore-log-061006.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003462; classtype:pup-activity; sid:2003462; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (27)"; flow:to_client,established; content:"clsid"; nocase; content:"A2E3074E-6C3D-11D3-B653-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E3074E-6C3D-11D3-B653-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009641; classtype:web-application-attack; sid:2009641; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Suspicious User-Agent (Toolbar) Possibly Malware/Spyware"; flow:to_server,established; content:"User-Agent|3a| Toolbar"; http_header; content:!"cf.icq.com"; reference:url,doc.emergingthreats.net/bin/view/Main/2003463; classtype:pup-activity; sid:2003463; rev:18; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, signature_severity Major, tag User_Agent, updated_at 2016_07_01;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Vulnerable Microsoft Video ActiveX CLSID access (28)"; flow:to_client,established; content:"clsid"; nocase; content:"A2E30750-6C3D-11D3-B653-00C04F79498E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009642; classtype:web-application-attack; sid:2009642; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP DelFin Project Spyware (setup-alt)"; flow: established,to_server; content:"/in/defaults/setup-alt.nfo?"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003472; classtype:pup-activity; sid:2003472; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED MALVERTISING Adobe Exploited Check-In"; flow:established,to_server; content:"GET "; nocase; depth:4; uricontent:".php?&&reader_version="; nocase; reference:url,doc.emergingthreats.net/2011715; classtype:trojan-activity; sid:2011715; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP DelFin Project Spyware (payload-alt)"; flow: established,to_server; content:"/in/payload/payload-alt.nfo?"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003473; classtype:pup-activity; sid:2003473; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Malvertising drive by kit encountered - bmb cookie"; flow:established,to_client; content:"HTTP/1"; depth:6; content:"Set-Cookie|3a| bmb="; nocase; reference:url,doc.emergingthreats.net/2011222; classtype:bad-unknown; sid:2011222; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP AskSearch Toolbar Spyware User-Agent (AskBar)"; flow:to_server,established; content:"|3b| AskBar"; pcre:"/User-Agent\x3a[^\n]+AskBar/iH"; reference:url,doc.emergingthreats.net/2003496; classtype:pup-activity; sid:2003496; rev:13; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, signature_severity Minor, tag Spyware_User_Agent, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED TROJAN Likely FakeRean Download"; flow:established,to_server; content:"GET "; depth:4; nocase; uricontent:"/installer/InstallerClean.exe"; nocase; reference:url,doc.emergingthreats.net/2010053; classtype:trojan-activity; sid:2010053; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP E2give Spyware Reporting (check url)"; flow: to_server,established; content:"/go/check?build="; nocase; http_uri; content:"&source="; nocase; http_uri; content:"&merchants="; nocase; http_uri; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=E2Give&threatid=4728; reference:url,doc.emergingthreats.net/bin/view/Main/2003504; classtype:pup-activity; sid:2003504; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED TROJAN Likely Possible Rogue A/V Win32/FakeXPA Download"; flow:established,to_server; content:"GET "; depth:4; nocase; uricontent:"/Soft_21.exe"; nocase; reference:url,doc.emergingthreats.net/2010060; classtype:trojan-activity; sid:2010060; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Supergames.aavalue.com Spyware"; flow: established,to_server; content:"/toolbars/msg/msg_serverside.xml"; nocase; http_uri; content:"aavalue.com"; nocase; http_header; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=EZ-Tracks%20Toolbar&threatid=41189; reference:url,doc.emergingthreats.net/bin/view/Main/2003525; classtype:pup-activity; sid:2003525; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED MALWARE Potential Malware Download, pdf exploit"; flow:established,to_server; uricontent:"/ssp/files/annonce.pdf"; nocase; reference:url,malwareurl.com; reference:url,doc.emergingthreats.net/2010444; classtype:bad-unknown; sid:2010444; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP KMIP.net Spyware 2"; flow:established,to_server; content:"/sp?c=N&i="; nocase; http_uri; content:"&v="; nocase; http_uri; reference:url,www.kmip.net; reference:url,doc.emergingthreats.net/bin/view/Main/2003526; classtype:pup-activity; sid:2003526; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED MALWARE Potential Malware Download, rogue antivirus (IAInstall.exe)"; flow:established,to_server; uricontent:"/download/IAInstall.exe"; nocase; reference:url,malwareurl.com; reference:url,doc.emergingthreats.net/2010447; classtype:bad-unknown; sid:2010447; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Msgplus.net Spyware/Adware User-Agent (MsgPlus3)"; flow:to_server,established; content:"User-Agent|3a| MsgPlus3"; nocase; http_header; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Messenger%20Plus!&threatid=14931; reference:url,doc.emergingthreats.net/2003529; classtype:pup-activity; sid:2003529; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED MALWARE Potential Malware Download, trojan zbot"; flow:established,to_server; uricontent:"/globaldirectory/updatetool.exe"; nocase; reference:url,malwareurl.com; reference:url,doc.emergingthreats.net/2010448; classtype:bad-unknown; sid:2010448; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Antivermins.com Spyware/Adware User-Agent (AntiVermeans)"; flow:to_server,established; content:"User-Agent|3a| AntiVermeans"; nocase; http_header; reference:url,www.bleepingcomputer.com/forums/topic69886.htm; reference:url,doc.emergingthreats.net/2003531; classtype:pup-activity; sid:2003531; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED MALWARE Potential Malware Download, exploit redirect"; flow:established,to_server; uricontent:"/fkzd/2.htm"; nocase; reference:url,malwareurl.com; reference:url,doc.emergingthreats.net/2010449; classtype:bad-unknown; sid:2010449; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Sytes.net Related Spyware Reporting"; flow:to_server,established; content:"/Reporting/admin/upload.php"; nocase; http_uri; content:"POST"; nocase; http_method; content:"sytes.net"; nocase; http_header; reference:url,www.sophos.com/security/analyses/w32forbotdv.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003533; classtype:pup-activity; sid:2003533; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Malwareurl.com - potential oficla download (annonce.pdf)"; flow:established,to_server; content:"GET "; depth:4; nocase; uricontent:"/ssp/files/annonce.pdf"; nocase; pcre:"/\/ssp\/files\/annonce\.pdf$/Ui"; reference:url,www.malwareurl.com; reference:url,doc.emergingthreats.net/2010532; classtype:trojan-activity; sid:2010532; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Bravesentry.com Fake Antispyware Updating"; flow:established,to_server; content:"/update.php?v="; nocase; http_uri; content:"&d="; nocase; http_uri; content:"&vs="; nocase; http_uri; content:!"User-Agent|3a| "; http_header; content:"Host|3a| "; http_header; content:".bravesentry.com"; nocase; http_header; reference:url,www.bravesentry.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=BraveSentry&threatid=44152; reference:url,doc.emergingthreats.net/bin/view/Main/2003541; classtype:pup-activity; sid:2003541; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Malwareurl.com - potential oficla download (loadjavad.php)"; flow:established,to_server; content:"GET "; depth:4; nocase; uricontent:"/ssp/loadjavad.php"; nocase; pcre:"/\/ssp\/loadjavad\.php$/Ui"; reference:url,www.malwareurl.com; reference:url,doc.emergingthreats.net/2010534; classtype:trojan-activity; sid:2010534; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Winfixmaster.com Fake Anti-Spyware Install"; flow: to_server,established; content:"/dispatcher.php?action="; nocase; http_uri; content:"Host|3a| www.winfix"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2003543; classtype:pup-activity; sid:2003543; rev:7; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Malwareurl - wywg executable download Likely Malware"; flow:established,to_server; content:"GET "; nocase; depth:4; uricontent:"/wywg/"; nocase; uricontent:".exe"; nocase; pcre:"/\/wywg\/[a-z0-9]{2,5}\/[a-z0-9]+\.exe$/Ui"; reference:url,malwareurl.com; reference:url,doc.emergingthreats.net/2010716; classtype:trojan-activity; sid:2010716; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Privacyprotector.com Fake Anti-Spyware Install"; flow: to_server,established; content:"/privacyprotectorfreesetup.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003547; classtype:pup-activity; sid:2003547; rev:6; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED NeoSploit Exploit Kit Java exploit drive-by host likely infected (nte)"; flow:established,to_server; uricontent:"/nte/"; nocase; content:"|0d 0a|accept-encoding|3a| pack200-gzip,gzip|0d 0a|"; nocase; content:"|0d 0a|content-type|3a| application/x-java-archive|0d 0a|"; nocase; content:!"|0d 0a|Referer|3a| "; nocase; content:"|0d 0a|User-Agent|3a| Mozilla"; nocase; content:" Java/"; nocase; within:50; reference:url,www.malwaredomainlist.com/forums/index.php?action=printpage%3btopic=3781.0; reference:url,doc.emergingthreats.net/2010871; classtype:exploit-kit; sid:2010871; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Winsoftware.com Fake AV User-Agent (DNS Extractor)"; flow:to_server,established; content:"User-Agent|3a| DNS Extractor"; nocase; http_header; reference:url,doc.emergingthreats.net/2003567; classtype:pup-activity; sid:2003567; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Fake AV Related CSS Download"; flow:established,from_server; content:"#hello_nod32_guys_how_u_doing"; nocase; reference:url,doc.emergingthreats.net/2011670; classtype:trojan-activity; sid:2011670; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Evidencenuker.com Fake AV/Anti-Spyware User-Agent (EVNUKER)"; flow:to_server,established; content:"User-Agent|3a| EVNUKER"; nocase; http_header; reference:url,doc.emergingthreats.net/2003567; classtype:pup-activity; sid:2003569; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, signature_severity Minor, tag Spyware_User_Agent, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Executable requested from /wp-content/languages"; flow:established,to_server; uricontent:"/wp-content/languages/"; nocase; uricontent:".exe"; nocase; reference:url,www.malewareurl.com; reference:url,doc.emergingthreats.net/2011220; classtype:trojan-activity; sid:2011220; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Mirarsearch.com Spyware Posting Data"; flow:established,to_server; content:"/v70match.cgi?"; nocase; http_uri; content:"key1="; nocase; http_uri; content:"&key2="; nocase; http_uri; content:"&match="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003577; classtype:pup-activity; sid:2003577; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Zbot update (av-i386-daily.zip)"; flow:established,to_server; uricontent:"av_base/av-i386-daily.zip"; nocase; reference:url,doc.emergingthreats.net/2010565; reference:md5,06e69bfb6fffa17c4fc1e23af71b345c; classtype:trojan-activity; sid:2010568; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Findwhat.com Spyware (clickthrough)"; flow: to_server,established; content:"/bin/findwhat.dll?clickthrough&"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003579; classtype:pup-activity; sid:2003579; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Zbot update (av_base/pay.php)"; flow:established,to_server; uricontent:"av_base/pay.php"; nocase; reference:url,doc.emergingthreats.net/2010566; reference:md5,06e69bfb6fffa17c4fc1e23af71b345c; classtype:trojan-activity; sid:2010566; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Findwhat.com Spyware (sendmedia)"; flow: to_server,established; content:"/bin/findwhat.dll?sendmedia&"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003581; classtype:pup-activity; sid:2003581; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Zbot update (av_base/ip.php)"; flow:established,to_server; uricontent:"av_base/ip.php"; nocase; reference:md5,06e69bfb6fffa17c4fc1e23af71b345c; reference:url,doc.emergingthreats.net/2010567; classtype:trojan-activity; sid:2010567; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Trojan User-Agent (Windows Updates Manager)"; flow:to_server,established; content:"User-Agent|3a| Windows Updates Manager"; http_header; threshold: type limit, count 3, seconds 300, track by_src; reference:url,doc.emergingthreats.net/2003585; classtype:pup-activity; sid:2003585; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Trojan.Win32.Small.yml client registration"; flow:established,to_client; content:"|0d 0a|Content-Length|3a| "; depth:500; content:"|0d 0a 0d 0a|xxyysign|0d 0a|xxyyMyIP="; within:27; reference:url,doc.emergingthreats.net/2008950; classtype:trojan-activity; sid:2008950; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Worm.Pyks HTTP C&C Traffic User-Agent (skw00001)"; flow:established,to_server; content:"|0d 0a|User-Agent|3a| skw000"; http_header; reference:url,doc.emergingthreats.net/2003588; classtype:pup-activity; sid:2003588; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Trojan.Win32.Small.yml client command"; flow:established,to_client; content:"|0d 0a|Content-Length|3a| "; depth:500; content:"|0d 0a 0d 0a|xxyysign|0d 0a|xxyyUserNamePassWord="; within:40; reference:url,doc.emergingthreats.net/2008951; classtype:trojan-activity; sid:2008951; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Baidu.com Spyware Bar Activity"; flow:to_server,established; content:"/n?cmd="; nocase; http_uri; content:"&class="; nocase; http_uri; content:"&pn="; nocase; http_uri; content:"&tn"; nocase; http_uri; reference:url,www.pctools.com/mrc/infections/id/BaiDu/; reference:url,doc.emergingthreats.net/bin/view/Main/2003605; classtype:pup-activity; sid:2003605; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Altirix eXpress NS SC ActiveX Arbitrary Code Execution Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"Altiris.AeXNSPkgDL.1"; nocase; distance:0; content:"DownloadAndInstall"; nocase; reference:url,trac.metasploit.com/browser/framework3/trunk/modules/exploits/windows/browser/symantec_altirisdeployment_downloadandinstall.rb?rev=7023; reference:url,secunia.com/advisories/36679; reference:url,doc.emergingthreats.net/2010190; classtype:attempted-user; sid:2010190; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Alexa Spyware Reporting URL Visited"; flow:established,to_server; content:"/data/"; nocase; http_uri; content:"cli="; nocase; http_uri; content:"&ver=alxi"; nocase; http_uri; fast_pattern:only; content:"&url="; nocase; http_uri; content:"alexa.com|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2003606; classtype:pup-activity; sid:2003606; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2022_05_03;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX AOLShare ActiveX AppString method denial of service Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"YGPWz.CAOLMemExpWz"; nocase; distance:0; content:"AppString"; nocase; reference:url,packetstorm.foofus.com/1001-exploits/aolactivex-dos.txt; reference:url,doc.emergingthreats.net/2010987; classtype:attempted-user; sid:2010987; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP Zango Spyware (tbrequest data post)"; flow: to_server,established; content:"/tbrequest"; http_uri; nocase; content:"&q="; http_uri; nocase; pcre:"/\/tbrequest\d+\.php/Ui"; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003610; classtype:pup-activity; sid:2003610; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Win32/Winwebsec User-Agent Detected"; flow:established,to_server; content:"User-Agent|3a| InstallNotify/1.0"; http_header; reference:url,www.f-secure.com/sw-desc/rogue_w32_winwebsec.shtml; reference:url,blogs.technet.com/mmpc/archive/2009/05/13/msrt-tackles-another-rogue.aspx; reference:url,doc.emergingthreats.net/2009896; classtype:trojan-activity; sid:2009896; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Malwarealarm.com Fake AV/AntiSpyware Updating"; flow:established,to_server; content:"/update.php?v="; nocase; http_uri; content:"&d="; nocase; http_uri; content:"&vs="; nocase; http_uri; content:"Host|3a| www.MalwareAlarm.com"; nocase; http_header; reference:url,sunbeltblog.blogspot.com/2007/04/another-fake-security-scam-site_9466.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003611; classtype:pup-activity; sid:2003611; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX AtHocGov IWSAlerts ActiveX Control Buffer Overflow Function Call Attempt"; flow:established,to_client; content:"ActiveXObject"; nocase; content:"AtHocGovGSTlBar.GSHelper.1"; nocase; distance:0; content:"CompleteInstallation"; nocase; reference:url,metasploit.com/modules/exploit/windows/browser/athocgov_completeinstallation; reference:url,athoc.com/products/IWSAlerts_overview.aspx; reference:url,doc.emergingthreats.net/2011211; classtype:attempted-user; sid:2011211; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Malwarealarm.com Fake AV/AntiSpyware Download"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/madownload.php?&advid="; nocase; http_uri; content:"&u="; nocase; http_uri; content:"&p="; nocase; http_uri; content:"Host|3a| download.MalwareAlarm.com"; nocase; http_header; reference:url,sunbeltblog.blogspot.com/2007/04/another-fake-security-scam-site_9466.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003612; classtype:pup-activity; sid:2003612; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2022_05_03;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Attachmate Reflection X ActiveX Control 'ControlID' Buffer Overflow Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"R2AXCTRLLib.R2winCtrl"; nocase; distance:0; content:"ControlID"; nocase; reference:url,doc.emergingthreats.net/2011130; classtype:attempted-user; sid:2011130; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MyWebSearch Toolbar Posting Activity Report"; flow:to_server,established; content:"/jsp/cfg_redir2.jsp?id="; nocase; http_uri; content:"url=http"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003617; classtype:pup-activity; sid:2003617; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX BaoFeng Storm mps.dll ActiveX OnBeforeVideoDownload Buffer Overflow Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"MPS.StormPlayer.1"; nocase; distance:0; content:"OnBeforeVideoDownload"; nocase; reference:bugtraq,34789; reference:url,doc.emergingthreats.net/2010995; classtype:attempted-user; sid:2010995; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Alexa Spyware Redirecting User"; flow:established,to_server; content:"/redirect?http"; nocase; http_uri; content:"Host|3a| redirect.alexa.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2003619; classtype:pup-activity; sid:2003619; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Black Ice Printer Driver Resource Toolkit ActiveX Control EnableStartApplication/EnableStartBeforePrint/EnableKeepExistingFiles/EnablePassParameters Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"BlackIceDEVMODECtrl.1"; nocase; distance:0; pcre:"/(EnableStartApplication|EnableStartBeforePrint|EnableKeepExistingFiles|EnablePassParameters)/i"; reference:url,www.securityfocus.com/bid/36548; reference:url,doc.emergingthreats.net/2010208; classtype:attempted-user; sid:2010208; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP 51yes.com Spyware Reporting User Activity"; flow:established,to_server; content:"/sa.aspx?id="; http_uri; nocase; content:"&refe=http"; http_uri; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2003620; classtype:pup-activity; sid:2003620; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Black Ice Printer Driver Resource Toolkit ActiveX Control SetApplicationPath/SetStartApplicationParamCode/SetCustomStartAppParameter Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"BlackIceDEVMODECtrl.1"; nocase; distance:0; pcre:"/(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)/i"; reference:url,www.securityfocus.com/bid/36548; reference:url,doc.emergingthreats.net/2010209; classtype:attempted-user; sid:2010209; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Baidu.com Spyware Sobar Bar Activity"; flow:to_server,established; content:"/sobar/sobar"; nocase; http_uri; reference:url,www.pctools.com/mrc/infections/id/BaiDu/; reference:url,doc.emergingthreats.net/bin/view/Main/2003630; classtype:pup-activity; sid:2003630; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Black Ice Printer Driver Resource Toolkit ActiveX Control SaveBlackIceDEVMODE Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"BlackIceDEVMODECtrl.1"; nocase; distance:0; content:"SaveBlackIceDEVMODE"; nocase; reference:url,www.securityfocus.com/bid/36548; reference:url,doc.emergingthreats.net/2010210; classtype:attempted-user; sid:2010210; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Generic.Malware.dld User-Agent (Sickloader)"; flow:to_server,established; content:"User-Agent|3a| Sickloader"; nocase; http_header; reference:url,doc.emergingthreats.net/2003644; classtype:pup-activity; sid:2003644; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Black Ice Printer Driver Resource Toolkit ActiveX Control ClearUserSettings Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"BlackIceDEVMODECtrl.1"; nocase; distance:0; content:"ClearUserSettings"; nocase; reference:url,www.securityfocus.com/bid/36548; reference:url,doc.emergingthreats.net/2010211; classtype:attempted-user; sid:2010211; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP CoolStreaming Toolbar (Conduit related) User-Agent (Coolstreaming Tool-Bar)"; flow:to_server,established; content:"|0d 0a|User-Agent|3a| Coolstreaming"; nocase; http_header; reference:url,doc.emergingthreats.net/2003652; classtype:pup-activity; sid:2003652; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible Black Ice Printer Driver Resource Toolkit ActiveX Control ControlJob Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"BlackIceDEVMODECtrl.1"; nocase; distance:0; content:"ControlJob"; nocase; reference:url,www.securityfocus.com/bid/36548; reference:url,doc.emergingthreats.net/2010212; classtype:attempted-user; sid:2010212; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Bizconcept.info Spyware Checkin"; flow:to_server,established; content:"POST"; nocase; http_method; content:"/zuzu.php?&r="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2005319; classtype:pup-activity; sid:2005319; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Consona Products SdcUser.TgConCtl ActiveX Control BOF Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"SdcUser.TgConCtl"; nocase; distance:0; content:"RunCMD"; nocase; reference:url,www.kb.cert.org/vuls/id/602801; reference:bugtraq,40006; reference:url,juniper.net/security/auto/vulnerabilities/vuln40006.html; reference:url,doc.emergingthreats.net/2011213; classtype:attempted-user; sid:2011213; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Deepdo.com Toolbar/Spyware User Agent (DeepdoUpdate)"; flow:established,to_server; content:"User-Agent|3a| DeepdoUpdate/"; nocase; http_header; reference:url,doc.emergingthreats.net/2006386; classtype:pup-activity; sid:2006386; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_CLIENT DX Studio Player Firefox Plug-in Command Injection Attempt"; flow:established,to_client; content:" $EXTERNAL_NET any (msg:"ET ADWARE_PUP Doctorpro.co.kr Related Fake Anti-Spyware Mac Check"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/ctrl/nchkmac.php?mac=0"; nocase; http_uri; pcre:"/mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2006427; classtype:pup-activity; sid:2006427; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Possible EMC Captiva PixTools Distributed Imaging ActiveX Control Vulnerable SetLogLevel/SetLogFileName Method Arbitrary File Creation/Overwrite Attempt"; flow:established,from_server; content:"clsid"; nocase; content:"00200338-3D33-4FFC-AC20-67AA234325F3"; nocase; distance:0; content:"SetLog"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3/si"; reference:url,www.securityfocus.com/bid/36566/info; reference:url,www.shinnai.net/xplits/TXT_17zVMhRhsRE6qC6DAj52.html; reference:url,doc.emergingthreats.net/2010036; classtype:attempted-user; sid:2010036; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Doctorpro.co.kr Related Fake Anti-Spyware Checkin (open)"; flow:established,to_server; content:"/open.php?sn="; nocase; http_uri; pcre:"/sn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2006428; classtype:pup-activity; sid:2006428; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX EMC Captiva PixTools ActiveX Arbitrary File Creation/Overwrite function call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"PDIControl.PDI.1"; nocase; distance:0; content:"WriteToLog"; distance:0; reference:url,www.securityfocus.com/bid/36566/info; reference:url,www.shinnai.net/xplits/TXT_17zVMhRhsRE6qC6DAj52.html; reference:url,doc.emergingthreats.net/2010154; classtype:web-application-attack; sid:2010154; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Karine.co.kr Related Spyware User Agent (chk Profile)"; flow:established,to_server; content:"User-Agent|3a| chk Profile|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2006429; classtype:pup-activity; sid:2006429; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX EMC Captiva PixTools ActiveX Arbitrary File Creation/Overwrite function call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"PDIControl.PDI.1"; nocase; distance:0; content:"SetLog"; distance:0; reference:url,www.securityfocus.com/bid/36566/info; reference:url,www.shinnai.net/xplits/TXT_17zVMhRhsRE6qC6DAj52.html; reference:url,doc.emergingthreats.net/2010155; classtype:web-application-attack; sid:2010155; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Doctorpro.co.kr Related Fake Anti-Spyware Post"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/ctrl/chkblack.php?mac=0"; nocase; http_uri; pcre:"/mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2006431; classtype:pup-activity; sid:2006431; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_CLIENT Possible HTTP 403 XSS Attempt (External Source)"; flow:from_server,established; content:"HTTP/1.1 403 Forbidden|0d 0a|"; depth:24; nocase; content:" $EXTERNAL_NET any (msg:"ET ADWARE_PUP Doctorpro.co.kr Related Fake Anti-Spyware Checkin (ret)"; flow:established,to_server; content:"/ret.php?"; nocase; http_uri; content:"mode="; nocase; http_uri; content:"&cname="; nocase; http_uri; content:"&cn="; nocase; http_uri; pcre:"/cn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2006432; classtype:pup-activity; sid:2006432; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_CLIENT Possible HTTP 404 XSS Attempt (External Source)"; flow:from_server,established; content:"HTTP/1.1 404 Not Found|0d 0a|"; depth:24; nocase; content:" $EXTERNAL_NET any (msg:"ET ADWARE_PUP Doctorpro.co.kr Related Fake Anti-Spyware Post (api_result)"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/ctrl/api_result.php?"; nocase; http_uri; content:"mode="; nocase; http_uri; content:"&PartID="; nocase; http_uri; content:"&mac="; nocase; http_uri; pcre:"/mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2006433; classtype:pup-activity; sid:2006433; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Foxit Reader ActiveX OpenFile method Remote Code Execution Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"FOXITREADEROCXLib.FoxitReaderOCX"; nocase; distance:0; content:"OpenFile "; nocase; reference:url,www.exploit-db.com/exploits/11196; reference:url,doc.emergingthreats.net/2010930; classtype:attempted-user; sid:2010930; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (Dummy)"; flow: established,to_server; content:"User-Agent|3a| Dummy"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2007570; classtype:pup-activity; sid:2007570; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert tcp any any -> $HOME_NET any (msg:"ET DELETED Pitbull IRCbotnet Commands"; flow:from_server,established; content:"PRIVMSG|20|"; pcre:"/PRIVMSG.*@(portscan|nmap|back|udpflood|tcpflood|httpflood|linuxhelp|rfi|system|milw0rm|logcleaner|sendmail|join|part|help)/i"; reference:url,en.wikipedia.org/wiki/IRC_bot; reference:url,doc.emergingthreats.net/2007625; classtype:trojan-activity; sid:2007625; rev:6; metadata:created_at 2010_07_30, updated_at 2020_08_20;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (AntiSpyware) - Likely 2squared.com related"; flow: established,to_server; content:"User-Agent|3a| AntiSpyware"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2007575; classtype:pup-activity; sid:2007575; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED libPNG - Possible NULL-pointer crash in png_handle_iCCP"; flow: established; content:"|89 50 4E 47 0D 0A 1A 0A|"; depth:8; byte_test:4,>,0x80000000,0,relative,big,string,hex; reference:url,www.securiteam.com/unixfocus/5ZP0C0KDPG.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001190; classtype:misc-activity; sid:2001190; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SpyShredder Fake Anti-Spyware Install Download"; flow:established,to_server; content:"&advid="; nocase; http_uri; content:"&u="; nocase; http_uri; content:"&p="; nocase; http_uri; content:"?=______"; http_uri; content:"&vs="; nocase; http_uri; content:"&YZYYYYYYYYYYYYYYYYYYYYYYYYYY"; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2007593; classtype:pup-activity; sid:2007593; rev:6; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED libPNG - Height exceeds limit"; flow: established; content:"|89 50 4E 47 0D 0A 1A 0A|"; depth:8; byte_test:4,>,0x80000000,12,relative,big,string,hex; reference:url,www.securiteam.com/unixfocus/5ZP0C0KDPG.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001192; classtype:misc-activity; sid:2001192; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Advertisementserver.com Spyware Initial Checkin"; flow:to_server,established; content:"?UID="; nocase; http_uri; content:"&DIST="; nocase; http_uri; content:"&NPR="; nocase; http_uri; content:"User-Agent|3a| Microsoft URL Control"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2007601; classtype:pup-activity; sid:2007601; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WORM Allaple ICMP Sweep Reply Outbound"; icode:0; itype:0; content:"Babcdefghijklmnopqrstuvwabcdefghi"; threshold: type both, count 1, seconds 60, track by_dst; reference:url,www.sophos.com/virusinfo/analyses/w32allapleb.html; reference:url,isc.sans.org/diary.html?storyid=2451; reference:url,doc.emergingthreats.net/2003295; classtype:trojan-activity; sid:2003295; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Advertisementserver.com Spyware Checkin"; flow:to_server,established; content:"monitor.php"; nocase; http_uri; content:"?UID="; nocase; http_uri; pcre:"/UID=\d/Ui"; content:"User-Agent|3a| Microsoft URL Control"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2007602; classtype:pup-activity; sid:2007602; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Hidden iframe Served by nginx - Likely Hostile Code"; flow:established,to_client; content:"|0d 0a|Server|3a| nginx"; nocase; offset:15; depth:15; content:""; nocase; reference:url,doc.emergingthreats.net/2011714; classtype:bad-unknown; sid:2011714; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Viruscheck.co.kr Related Fake Anti-Spyware Post (chkvs)"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/chkvs.php?mac=0"; nocase; http_uri; pcre:"/mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2007642; classtype:pup-activity; sid:2007642; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_CLIENT Malvertising drive by kit encountered - Loading..."; flow:established,to_client; content:"HTTP/1"; depth:6; content:"Loading...
"; nocase; reference:url,doc.emergingthreats.net/2011223; classtype:bad-unknown; sid:2011223; rev:5; metadata:created_at 2010_07_30, former_category CURRENT_EVENTS, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP AVSystemcare.com.com Fake Anti-Virus Product"; flow:established,to_server; http.uri; content:"?proto="; nocase; content:"&rc="; nocase; content:"&v="; nocase; content:"&abbr="; nocase; content:"&platform="; nocase; content:"&os_version="; nocase; content:"&ac="; nocase; content:"&appid="; nocase; content:"&em="; nocase; content:"&pcid="; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2007664; classtype:pup-activity; sid:2007664; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2022_04_18;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Malvertising drive by kit collecting browser info"; flow:established,to_server; uricontent:"/plugins.php?p=appName"; nocase; reference:url,doc.emergingthreats.net/2011224; classtype:bad-unknown; sid:2011224; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP IEDefender (iedefender.com) Fake Antispyware User Agent (IEDefender 2.1)"; flow:established,to_server; content:"User-Agent|3a| IEDefender "; nocase; http_header; reference:url,doc.emergingthreats.net/2007690; classtype:pup-activity; sid:2007690; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED MALVERTISING client requesting drive by - /x/?src="; flow:established,to_server; uricontent:"/x/?src="; nocase; uricontent:"&o=o"; nocase; reference:url,doc.emergingthreats.net/2011230; classtype:bad-unknown; sid:2011230; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Softwarereferral.com Adware Checkin"; flow:established,to_server; content:"wmid="; nocase; http_uri; content:"&mid="; nocase; http_uri; content:"&lid="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2007696; classtype:pup-activity; sid:2007696; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) -#alert http $HOME_NET $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ET DELETED Possible ASPROX Hostile JS Being Served by a Local Webserver (/ngg.js)"; flow:established,from_server; content:""; within:100; reference:url,malwaresurvival.net/tag/lizamoon-com/; classtype:web-application-attack; sid:2012614; rev:5; metadata:created_at 2011_04_01, former_category CURRENT_EVENTS, updated_at 2011_04_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M115"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Aurora"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037395; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Monkif/DlKroha Trojan Activity HTTP Outbound"; flow:to_server,established; content:".php?"; http_uri; content:"4x4x4x4x4x6x"; http_uri; fast_pattern; reference:url,doc.emergingthreats.net/2009752; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3aWin32%2fMonkif.C; classtype:trojan-activity; sid:2009752; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M116"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 0c|Fort Collins"; distance:4; within:19; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037396; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Potential Lizamoon Client Request /ur.php"; flow:established,to_server; content:"GET"; http_method; content:"/ur.php"; http_uri; content:"GET /ur.php "; depth:12; classtype:trojan-activity; sid:2012625; rev:3; metadata:created_at 2011_04_04, updated_at 2011_04_04;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M117"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 09|New Haven"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037397; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Unknown Dropper Checkin with NSISDL/1.2 User-Agent"; flow:established,to_server; content:".php?id="; http_uri; content:"User-Agent|3a 20|NSISDL/1.2 (Mozilla)"; http_header; classtype:trojan-activity; sid:2012626; rev:4; metadata:created_at 2011_04_04, updated_at 2011_04_04;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M118"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 0a|Bridgeport"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037398; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Paypal Phishing victim POSTing data"; flow:established,to_server; content:"POST"; http_method; content:"usr="; content:"&pwd="; content:"&name-on="; content:"&cu-on="; content:"&how2-on="; fast_pattern; classtype:social-engineering; sid:2012630; rev:3; metadata:attack_target Client_Endpoint, created_at 2011_04_05, deployment Perimeter, signature_severity Major, tag Phishing, updated_at 2016_07_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M119"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 08|Stamford"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037399; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET PHISHING Potential Paypal Phishing Form Attachment"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"Restore Your Account"; distance:0; nocase; content:"paypal"; distance:0; nocase; content:"form.php|22| method=|22|post|22|"; nocase; distance:0; classtype:social-engineering; sid:2012632; rev:3; metadata:attack_target Client_Endpoint, created_at 2011_04_05, deployment Perimeter, signature_severity Major, tag Phishing, updated_at 2016_07_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M120"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 07|Norwalk"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037400; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Content-Type image/jpeg with DOS MZ header set likely 2nd stage download"; flow:established,from_server; content:"Content-Type|3a 20|image/jpeg|0d 0a|"; content:"MZ"; distance:0; content:"This program cannot be run in DOS mode"; fast_pattern; distance:0; classtype:trojan-activity; sid:2012633; rev:3; metadata:created_at 2011_04_05, updated_at 2011_04_05;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M121"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Seattle"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037401; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Content-Type image/jpeg with Win32 MZ header set likely 2nd stage download"; flow:established,from_server; content:"Content-Type|3a 20|image/jpeg|0d 0a|"; content:"MZ"; distance:0; content:"This program must be run under Win"; fast_pattern; distance:0; classtype:trojan-activity; sid:2012634; rev:3; metadata:created_at 2011_04_05, updated_at 2011_04_05;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M122"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 06|Tacoma"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037402; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET PHISHING Potential ACH Transaction Phishing Attachment"; flow:established,to_server; content:"ACH transaction"; nocase; content:".pdf.exe"; nocase; classtype:social-engineering; sid:2012635; rev:2; metadata:attack_target Client_Endpoint, created_at 2011_04_05, deployment Perimeter, signature_severity Major, tag Phishing, updated_at 2016_07_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M123"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Olympia"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037403; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX RealNetworks RealGames StubbyUtil.ProcessMgr.1 InstallerDlg.dll Remote Command Execution Attempt"; flow:established,to_client; content:"5818813E-D53D-47A5-ABBB-37E2A07056B5"; nocase; content:"Exec"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5.+(Exec|ExecLow|ShellExec)/smi"; reference:url,www.exploit-db.com/exploits/17105/; reference:bid,47133; classtype:attempted-user; sid:2012636; rev:3; metadata:created_at 2011_04_05, updated_at 2011_04_05;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M124"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Spokane"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037404; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX RealNetworks RealGames StubbyUtil.ProcessMgr.1 InstallerDlg.dll Remote Command Execution Attempt"; flow:established,to_client; content:"5818813E-D53D-47A5-ABBB-37E2A07056B5"; nocase; content:"CreateVistaTaskLow"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5/si"; reference:url,www.exploit-db.com/exploits/17105/; reference:bid,47133; classtype:attempted-user; sid:2012637; rev:4; metadata:created_at 2011_04_05, updated_at 2011_04_05;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M125"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 05|Miami"; distance:4; within:12; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037405; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX RealNetworks RealGames StubbyUtil.ShellCtl.1 InstallerDlg.dll Remote Command Execution Attempt"; flow:established,to_client; content:"80AB3FB6-9660-416C-BE8D-0E2E8AC3138B"; nocase; content:"ShellExec"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B/si"; reference:url,www.exploit-db.com/exploits/17105/; reference:bid,47133; classtype:attempted-user; sid:2012638; rev:4; metadata:created_at 2011_04_05, updated_at 2011_04_05;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M126"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 07|Orlando"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037406; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX RealNetworks RealGames StubbyUtil.ShellCtl.1 InstallerDlg.dll Remote Command Execution Attempt"; flow:established,to_client; content:"80AB3FB6-9660-416C-BE8D-0E2E8AC3138B"; nocase; content:"CreateShortcut"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B/si"; reference:url,www.exploit-db.com/exploits/17105/; reference:bid,47133; classtype:attempted-user; sid:2012639; rev:4; metadata:created_at 2011_04_05, updated_at 2011_04_05;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M127"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 05|Tampa"; distance:4; within:12; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037407; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX RealNetworks RealGames StubbyUtil.ShellCtl.1 InstallerDlg.dll Remote Command Execution Attempt"; flow:established,to_client; content:"80AB3FB6-9660-416C-BE8D-0E2E8AC3138B"; nocase; content:"CopyDocument"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B/si"; reference:url,www.exploit-db.com/exploits/17105/; reference:bid,47133; classtype:attempted-user; sid:2012640; rev:4; metadata:created_at 2011_04_05, updated_at 2011_04_05;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M128"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 0c|Jacksonville"; distance:4; within:19; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037408; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Sun Java Runtime New Plugin Docbase Buffer Overflow Attempt"; flow:established,to_client; content:"CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA"; nocase; content:"launchjnlp"; fast_pattern; nocase; distance:0; content:"docbase"; nocase; distance:0; content:"value=|22|"; nocase; distance:0; isdataat:257,relative; content:!"|0A|"; within:257; reference:bid,44023; reference:cve,2010-3552; classtype:attempted-user; sid:2012641; rev:3; metadata:created_at 2011_04_06, updated_at 2011_04_06;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M129"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 07|Chicago"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037409; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Java Exploit Attempt Request for hostile binary"; flow:established,to_server; content:"&|20|HTTP/1.1|0d 0a|User-A"; fast_pattern; content:".php?height="; http_uri; content:"|20|Java/"; http_header; pcre:"/\/[a-z0-9]{30,}\.php\?height=\d+&sid=\d+&width=[a-z0-9]+&/U"; classtype:trojan-activity; sid:2012644; rev:3; metadata:created_at 2011_04_06, former_category CURRENT_EVENTS, updated_at 2011_04_06;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M130"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Aurora"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037410; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Malicious JAR olig"; flow:established,from_server; content:"|00 00|META-INF/PK|0a|"; fast_pattern; content:"|00|olig/"; classtype:trojan-activity; sid:2012646; rev:3; metadata:created_at 2011_04_07, former_category CURRENT_EVENTS, updated_at 2011_04_07;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M131"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 0a|Naperville"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037411; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $HOME_NET 17500 -> any 17500 (msg:"ET POLICY Dropbox Client Broadcasting"; content:"{|22|host_int|22 3a| "; depth:13; content:" |22|version|22 3a| ["; distance:0; content:"], |22|displayname|22 3a| |22|"; distance:0; threshold:type limit, count 1, seconds 3600, track by_src; classtype:policy-violation; sid:2012648; rev:3; metadata:created_at 2011_04_07, updated_at 2011_04_07;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M132"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Peoria"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 02|co"; nocase; distance:4; within:9; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037412; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Windows-Based OpenSSL Tunnel Outbound"; flow:established; content:"|16 03 00|"; content:"|00 5c|"; distance:0; content:"|c0 14 c0 0a 00 39 00 38 00 88 00 87 c0 0f c0 05 00 35 00 84 c0 12 c0 08 00 16 00 13 c0 0d c0 03 00 0a c0 13 c0 09 00 33 00 32 00 9a 00 99 00 45 00 44 c0 0e c0 04 00 2f 00 96 00 41 00 07 c0 11 c0 07 c0 0c c0 02 00 05 00 04 00 15 00 12 00 09 00 14 00 11 00 08 00 06 00 03 00 ff|"; distance:0; threshold: type both, count 1, seconds 300, track by_dst; reference:url,www.stunnel.org/download/binaries.html; classtype:policy-violation; sid:2012078; rev:5; metadata:created_at 2010_12_22, updated_at 2010_12_22;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M133"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 00|"; distance:4; within:7; content:"|06 03 55 04 07 13 00|"; distance:4; within:7; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037413; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Windows-Based OpenSSL Tunnel Connection Outbound 2"; flow:established; content:"|16 03 00|"; content:"|00 26|"; distance:0; content:"|00 39 00 38 00 35 00 16 00 13 00 0a 00 33 00 32 00 2f 00 05 00 04 00 15 00 12 00 09 00 14 00 11 00 08 00 06 00 03|"; distance:0; threshold: type both, count 1, seconds 300, track by_dst; reference:url,www.stunnel.org/download/binaries.html; classtype:policy-violation; sid:2012079; rev:4; metadata:created_at 2010_12_22, updated_at 2010_12_22;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M134"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 07|Phoenix"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037414; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET POLICY Windows-Based OpenSSL Tunnel Connection Outbound 3"; flow:established; content:"|16 03 00|"; content:"|00 34|"; distance:0; content:"|00 39 00 38 00 35 00 16 00 13 00 0a 00 33 00 32 00 2f 00 66 00 05 00 04 00 63 00 62 00 61 00 15 00 12 00 09 00 65 00 64 00 60 00 14 00 11 00 08 00 06 00 03|"; distance:0; threshold: type both, count 1, seconds 300, track by_dst; reference:url,www.stunnel.org/download/binaries.html; classtype:policy-violation; sid:2012080; rev:4; metadata:created_at 2010_12_22, updated_at 2010_12_22;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M135"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 04|Mesa"; distance:4; within:11; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037415; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Suspicious Embedded Shockwave Flash In PDF"; flow:established,to_client; content:"PDF-"; depth:300; content:"x-shockwave-flash"; nocase; distance:0; pcre:"/(a|#61)(p|#70)(p|#70)(l|#6C)(i|#69)(c|#63)(a|#61)(t|#74)(i|#69)(o|#6F)(n|#6E)(\x2F|#2F)x-shockwave-flash/i"; classtype:bad-unknown; sid:2011866; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_10_29, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M136"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 0a|Scottsdale"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037416; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT PDF With Unescape Method Defined Possible Hostile Obfuscation Attempt"; flow:established,to_client; content:"PDF-"; depth:300; content:"unescape|28|"; nocase; distance:0; reference:url,isc.sans.org/diary.html?storyid=7903; reference:url,isc.sans.org/diary.html?storyid=7906; reference:url,doc.emergingthreats.net/2010881; classtype:bad-unknown; sid:2010881; rev:6; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_29, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M137"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 08|Chandler"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037417; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Hex Obfuscated arguments.callee Javascript Method in PDF Possibly Hostile PDF"; flow:established,to_client; content:"PDF-"; depth:300; content:"|61|"; distance:0; content:"|72|"; distance:1; within:2; content:"|67|"; distance:1; within:2; content:"|75|"; distance:1; within:2; content:"|6d|"; distance:1; within:2; content:"|65|"; distance:1; within:2; content:"|6e|"; distance:1; within:2; content:"|74|"; distance:1; within:2; content:"|73|"; distance:1; within:2; content:"|2e|"; distance:1; within:2; content:"|63|"; distance:1; within:2; content:"|61|"; distance:1; within:2; content:"|6c|"; distance:1; within:2; content:"|6c|"; distance:1; within:2; content:"|65|"; distance:1; within:2; content:"|65|"; distance:1; within:2; reference:url,doc.emergingthreats.net/2010879; classtype:misc-activity; sid:2010879; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M138"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0d|San Francisco"; distance:4; within:20; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037418; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible Hex Obfuscation of Javascript Declaration Within PDF File - Likely Hostile"; flow:established,to_client; content:"PDF-"; depth:300; content:"|2f|"; distance:0; content:"|4a|"; distance:1; within:2; content:"|61|"; distance:1; within:2; content:"|76|"; distance:1; within:2; content:"|61|"; distance:1; within:2; content:"|73|"; distance:1; within:2; content:"|63|"; distance:1; within:2; content:"|72|"; distance:1; within:2; content:"|69|"; content:"|70|"; distance:1; within:2; content:"|74|"; distance:1; within:2; reference:url,doc.emergingthreats.net/2010880; classtype:misc-activity; sid:2010880; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M139"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0d|San Francisco"; distance:4; within:20; content:"|06 03 55 04 09 13 12|Golden Gate Bridge"; distance:4; within:25; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037419; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY PDF File Containing arguments.callee in Cleartext - Likely Hostile"; flow:established,to_client; content:"PDF-"; depth:300; content:"arguments.callee"; nocase; distance:0; reference:url,isc.sans.org/diary.html?storyid=1519; reference:url,isc.sans.org/diary.html?storyid=7906; reference:url,doc.emergingthreats.net/2010883; classtype:misc-activity; sid:2010883; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M140"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Oakland"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037420; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED .pdf File Possibly Containing Basic Hex Obfuscation"; flow:established,from_server; content:"PDF-"; depth:300; pcre:"/PDF-.+[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F]/si"; reference:url,isc.sans.org/diary.html?storyid=7903; reference:url,isc.sans.org/diary.html?storyid=7906; reference:url,doc.emergingthreats.net/2010884; classtype:misc-activity; sid:2010884; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M141"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 08|Berkeley"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037421; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Foxit/Adobe PDF Reader Launch Action Remote Code Execution Attempt"; flow:to_client,established; content:"PDF-"; depth:300; content:"Launch"; distance:0; content:"Win"; distance:0; content:".exe"; nocase; distance:0; reference:url,www.kb.cert.org/vuls/id/570177; reference:url,www.h-online.com/security/news/item/Criminals-attempt-to-exploit-unpatched-hole-in-Adobe-Reader-979286.html; reference:url,www.sudosecure.net/archives/673; reference:url,www.h-online.com/security/news/item/Adobe-issues-official-workaround-for-PDF-vulnerability-971932.html; reference:url,blog.didierstevens.com/2010/03/31/escape-from-foxit-reader/; reference:url,www.m86security.com/labs/i/PDF-Launch-Feature-Used-to-Install-Zeus,trace.1301~.asp; reference:url,doc.emergingthreats.net/2010968; classtype:attempted-user; sid:2010968; rev:7; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M142"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 09|Palo Alto"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037422; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT PDF With eval Function - Possibly Hostile"; flow:established,to_client; content:"PDF-"; depth:300; content:"eval|28|"; nocase; distance:0; reference:url,www.w3schools.com/jsref/jsref_eval.asp; classtype:bad-unknown; sid:2011506; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_27, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M143"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0b|Los Angeles"; distance:4; within:18; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037423; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Foxit PDF Reader Buffer Overflow Attempt"; flow:established,to_client; content:"PDF-"; depth:300; content:"Launch"; nocase; distance:0; isdataat:600,relative; content:!"|0A|"; within:600; content:"NewWindow true"; nocase; distance:600; reference:url,www.coresecurity.com/content/foxit-reader-vulnerabilities#lref.4; reference:cve,2009-0837; reference:url,doc.emergingthreats.net/2010876; classtype:attempted-user; sid:2010876; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M144"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 09|San Diego"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037424; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Unknown Exploit Pack Binary Load Request"; flow:established,to_server; content:".php?sex="; nocase; http_uri; content:"&children="; nocase; http_uri; content:"&userid="; nocase; http_uri; pcre:"/\.php\?sex=\d+&children=\d+&userid=/U"; classtype:trojan-activity; sid:2012687; rev:2; metadata:created_at 2011_04_13, former_category CURRENT_EVENTS, updated_at 2011_04_13;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M145"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 08|San Jose"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037425; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET DELETED Buzus FTP Log Upload"; flow:established,to_server; dsize:100<>500; content:"|20 20 20 20|"; depth:4; content:"************CD-Key Pack************"; distance:0; content:"Microsoft Windows Product ID CD Key\: "; distance:0; reference:url,doc.emergingthreats.net/2008750; classtype:trojan-activity; sid:2008750; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M146"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Denver"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037426; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $HOME_NET any -> any any (msg:"ET ATTACK_RESPONSE Possible MS CMD Shell opened on local system"; flow:established; dsize:<110; content:"Microsoft Windows "; depth:20; content:"Copyright 1985-20"; distance:0; content:"Microsoft Corp"; distance:0; content:"|0a 0a|"; distance:0; reference:url,doc.emergingthreats.net/bin/view/Main/2008953; classtype:successful-admin; sid:2008953; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M147"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 07|Boulder"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037427; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Microsoft WMI Administration Tools WEBSingleView.ocx ActiveX Buffer Overflow Attempt"; flow:established,to_client; content:"2745E5F5-D234-11D0-847A-00C04FD7BB08"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext)/smi"; reference:url,xcon.xfocus.net/XCon2010_ChenXie_EN.pdf; reference:url,wooyun.org/bug.php?action=view&id=1006; reference:bid,45546; reference:cve,CVE-2010-3973; classtype:attempted-user; sid:2012158; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_01_06, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M148"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Aurora"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037428; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $HOME_NET any -> any any (msg:"ET ATTACK_RESPONSE Windows 7 CMD Shell from Local System"; flow:established; dsize:<160; content:"Microsoft Windows [Version "; depth:30; content:"Copyright (c)"; distance:0; content:"Microsoft Corp"; distance:0; classtype:successful-admin; sid:2012690; rev:1; metadata:created_at 2011_04_17, updated_at 2011_04_17;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M149"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 0c|Fort Collins"; distance:4; within:19; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037429; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Gh0st Remote Access Trojan Client Connect"; flow:to_server,established; content:"Gh0st"; depth:5; nocase; content:"|00 00 00|"; within:5; dsize:<180; flowbits:set,ET.ghost; reference:url,doc.emergingthreats.net/2008888; classtype:trojan-activity; sid:2008888; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, malware_family Gh0st, malware_family PCRAT, signature_severity Critical, tag PCRAT, tag Gh0st, tag RAT, updated_at 2016_07_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M150"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 09|New Haven"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037430; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Gh0st Remote Access Trojan Server Response"; flowbits:isset,ET.ghost; flow:to_client,established; content:"Gh0st"; depth:5; nocase; reference:url,www.shadowserver.org/wiki/pmwiki.php?n=Calendar.20081211; reference:url,doc.emergingthreats.net/2008889; classtype:trojan-activity; sid:2008889; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, malware_family Gh0st, malware_family PCRAT, signature_severity Critical, tag PCRAT, tag Gh0st, tag RAT, updated_at 2016_07_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M151"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 0a|Bridgeport"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037431; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED IP Check Domain (showmyipaddress.com in HTTP Host)"; flow:established,to_server; content:"Host|3a| www.showmyipaddress.com"; nocase; http_header; classtype:policy-violation; sid:2012691; rev:2; metadata:created_at 2011_04_18, former_category POLICY, updated_at 2018_07_31;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M152"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 08|Stamford"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037432; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $EXTERNAL_NET any -> $HOME_NET 1434 (msg:"GPL SQL Slammer Worm propagation attempt"; content:"|04|"; depth:1; content:"|81 F1 03 01 04 9B 81 F1 01|"; content:"sock"; content:"send"; reference:bugtraq,5310; reference:bugtraq,5311; reference:cve,2002-0649; reference:nessus,11214; reference:url,vil.nai.com/vil/content/v_99992.htm; classtype:misc-attack; sid:2102003; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M153"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 07|Norwalk"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037433; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $HOME_NET any -> $EXTERNAL_NET 1434 (msg:"GPL WORM Slammer Worm propagation attempt OUTBOUND"; content:"|04|"; depth:1; content:"|81 F1 03 01 04 9B 81 F1|"; content:"sock"; content:"send"; reference:bugtraq,5310; reference:bugtraq,5311; reference:cve,2002-0649; reference:nessus,11214; reference:url,vil.nai.com/vil/content/v_99992.htm; classtype:misc-attack; sid:2102004; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M154"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Seattle"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037434; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap kcms_server request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 87|}"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,6665; reference:cve,2003-0027; reference:url,www.kb.cert.org/vuls/id/850785; classtype:rpc-portmap-decode; sid:2102005; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M155"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 06|Tacoma"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037435; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap kcms_server request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 87|}"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,6665; reference:cve,2003-0027; reference:url,www.kb.cert.org/vuls/id/850785; classtype:rpc-portmap-decode; sid:2102006; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M156"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Olympia"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037436; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 32771:34000 (msg:"GPL RPC kcms_server directory traversal attempt"; flow:to_server,established; content:"|00 01 87|}"; depth:4; offset:16; byte_jump:4,20,relative,align; byte_jump:4,4,relative,align; content:"/../"; distance:0; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,6665; reference:cve,2003-0027; reference:url,www.kb.cert.org/vuls/id/850785; classtype:misc-attack; sid:2102007; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M157"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Spokane"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037437; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $HOME_NET 2401 -> $EXTERNAL_NET any (msg:"GPL MISC CVS invalid user authentication response"; flow:from_server,established; content:"E Fatal error, aborting."; content:"|3A| no such user"; classtype:misc-attack; sid:2102008; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M158"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 05|Miami"; distance:4; within:12; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037438; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $HOME_NET 2401 -> $EXTERNAL_NET any (msg:"GPL MISC CVS invalid repository response"; flow:from_server,established; content:"error "; content:"|3A| no such repository"; content:"I HATE YOU"; classtype:misc-attack; sid:2102009; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M159"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 07|Orlando"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037439; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $HOME_NET 2401 -> $EXTERNAL_NET any (msg:"GPL MISC CVS double free exploit attempt response"; flow:from_server,established; content:"free|28 29 3A| warning|3A| chunk is already free"; reference:bugtraq,6650; reference:cve,2003-0015; classtype:misc-attack; sid:2102010; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M160"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 05|Tampa"; distance:4; within:12; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037440; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $HOME_NET 2401 -> $EXTERNAL_NET any (msg:"GPL MISC CVS invalid directory response"; flow:from_server,established; content:"E protocol error|3A| invalid directory syntax in"; reference:bugtraq,6650; reference:cve,2003-0015; classtype:misc-attack; sid:2102011; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M161"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 0c|Jacksonville"; distance:4; within:19; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037441; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $HOME_NET 2401 -> $EXTERNAL_NET any (msg:"GPL MISC CVS missing cvsroot response"; flow:from_server,established; content:"E protocol error|3A| Root request missing"; classtype:misc-attack; sid:2102012; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M162"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 07|Chicago"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037442; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $HOME_NET 2401 -> $EXTERNAL_NET any (msg:"GPL MISC CVS invalid module response"; flow:from_server,established; content:"cvs server|3A| cannot find module"; content:"error"; distance:1; classtype:misc-attack; sid:2102013; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M163"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Aurora"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037443; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap UNSET attempt TCP 111"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 02|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,1892; classtype:rpc-portmap-decode; sid:2102014; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M164"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 0a|Naperville"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037444; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap UNSET attempt UDP 111"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 02|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,1892; classtype:rpc-portmap-decode; sid:2102015; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M165"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Peoria"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Partners"; nocase; distance:1; within:8; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037445; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap status request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 B8|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,15; classtype:rpc-portmap-decode; sid:2102016; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M166"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 00|"; distance:4; within:7; content:"|06 03 55 04 07 13 00|"; distance:4; within:7; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037446; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap espd request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 05 F7|u"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,2714; reference:cve,2001-0331; classtype:rpc-portmap-decode; sid:2102017; rev:13; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M167"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 07|Phoenix"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037447; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC mountd TCP dump request"; flow:to_server,established; content:"|00 01 86 A5|"; depth:4; offset:16; content:"|00 00 00 02|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:attempted-recon; sid:2102018; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M168"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 04|Mesa"; distance:4; within:11; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037448; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC mountd UDP dump request"; content:"|00 01 86 A5|"; depth:4; offset:12; content:"|00 00 00 02|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:attempted-recon; sid:2102019; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M169"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 0a|Scottsdale"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037449; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC mountd TCP unmount request"; flow:to_server,established; content:"|00 01 86 A5|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:attempted-recon; sid:2102020; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M170"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 08|Chandler"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037450; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC mountd UDP unmount request"; content:"|00 01 86 A5|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:attempted-recon; sid:2102021; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M171"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0d|San Francisco"; distance:4; within:20; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037451; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC mountd TCP unmountall request"; flow:to_server,established; content:"|00 01 86 A5|"; depth:4; offset:16; content:"|00 00 00 04|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:attempted-recon; sid:2102022; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M172"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0d|San Francisco"; distance:4; within:20; content:"|06 03 55 04 09 13 12|Golden Gate Bridge"; distance:4; within:25; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037452; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED mountd UDP unmountall request"; content:"|00 01 86 A5|"; depth:4; offset:12; content:"|00 00 00 04|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:attempted-recon; sid:2102023; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M173"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Oakland"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037453; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC yppasswd username overflow attempt UDP"; content:"|00 01 86 A9|"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_jump:4,0,relative,align; byte_test:4,>,64,0,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,2763; reference:cve,2001-0779; classtype:rpc-portmap-decode; sid:2102025; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M174"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 08|Berkeley"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037454; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC yppasswd username overflow attempt TCP"; flow:to_server,established; content:"|00 01 86 A9|"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_jump:4,0,relative,align; byte_test:4,>,64,0,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,2763; reference:cve,2001-0779; classtype:rpc-portmap-decode; sid:2102026; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M175"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 09|Palo Alto"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037455; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 1863 (msg:"GPL CHAT MSN user search"; flow:to_server,established; content:"CAL "; depth:4; nocase; classtype:policy-violation; sid:2101990; rev:2; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M176"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0b|Los Angeles"; distance:4; within:18; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037456; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 1863 (msg:"GPL CHAT MSN login attempt"; flow:to_server,established; content:"USR "; depth:4; nocase; content:" TWN "; distance:1; nocase; threshold:type limit, track by_src, count 1, seconds 60; classtype:policy-violation; sid:2101991; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M177"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 09|San Diego"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037457; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP LIST directory traversal attempt"; flow:to_server,established; content:"LIST"; nocase; content:".."; distance:1; content:".."; distance:1; reference:bugtraq,2618; reference:cve,2001-0680; reference:cve,2002-1054; reference:nessus,11112; classtype:protocol-command-decode; sid:2101992; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M178"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 08|San Jose"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037458; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"GPL IMAP login literal buffer overflow attempt"; flow:established,to_server; content:"LOGIN"; nocase; pcre:"/\sLOGIN\s[^\n]*?\s\{/smi"; byte_test:5,>,256,0,string,dec,relative; reference:bugtraq,6298; classtype:misc-attack; sid:2101993; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M179"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Denver"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037459; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 2140 (msg:"GPL DELETED DeepThroat 3.1 Connection attempt"; content:"00"; depth:2; reference:mcafee,98574; reference:nessus,10053; classtype:misc-activity; sid:2101980; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M180"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 07|Boulder"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037460; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 3150 (msg:"GPL DELETED DeepThroat 3.1 Connection attempt 3150"; content:"00"; depth:2; reference:mcafee,98574; reference:nessus,10053; classtype:misc-activity; sid:2101981; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M181"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Aurora"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037461; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $HOME_NET 3150 -> $EXTERNAL_NET any (msg:"GPL DELETED DeepThroat 3.1 Server Response 3150"; content:"Ahhhh My Mouth Is Open"; reference:arachnids,106; reference:mcafee,98574; reference:nessus,10053; classtype:misc-activity; sid:2101982; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M182"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 0c|Fort Collins"; distance:4; within:19; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037462; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 4120 (msg:"GPL DELETED DeepThroat 3.1 Connection attempt 4120"; content:"00"; depth:2; reference:mcafee,98574; reference:nessus,10053; classtype:misc-activity; sid:2101983; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M183"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 09|New Haven"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037463; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $HOME_NET 4120 -> $EXTERNAL_NET any (msg:"GPL DELETED DeepThroat 3.1 Server Response 4120"; content:"Ahhhh My Mouth Is Open"; reference:arachnids,106; reference:mcafee,98574; reference:nessus,10053; classtype:misc-activity; sid:2101984; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M184"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 0a|Bridgeport"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037464; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 1863 (msg:"GPL CHAT MSN outbound file transfer request"; flow:established; content:"MSG "; depth:4; content:"Content-Type|3A| application/x-msnmsgrp2p"; nocase; content:"INVITE"; distance:0; nocase; classtype:policy-violation; sid:2101986; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M185"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 08|Stamford"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037465; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 7100 (msg:"GPL EXPLOIT xfs overflow attempt"; flow:to_server,established; dsize:>512; content:"B|00 02|"; depth:3; reference:bugtraq,6241; reference:cve,2002-1317; reference:nessus,11188; classtype:misc-activity; sid:2101987; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M186"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 07|Norwalk"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037466; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET 1863 -> $HOME_NET any (msg:"GPL CHAT MSN outbound file transfer accept"; flow:established; content:"MSG "; depth:4; content:"Content-Type|3A| application/x-msnmsgrp2p"; distance:0; nocase; content:"MSNSLP/1.0 200 OK"; distance:0; nocase; classtype:policy-violation; sid:2101988; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M187"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Seattle"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037467; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET 1863 -> $HOME_NET any (msg:"GPL CHAT MSN outbound file transfer rejected"; flow:established; content:"MSG "; depth:4; content:"Content-Type|3A| application/x-msnmsgrp2p"; distance:0; nocase; content:"MSNSLP/1.0 603 Decline"; distance:0; nocase; classtype:policy-violation; sid:2101989; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M188"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 06|Tacoma"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037468; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP SITE EXEC format string attempt"; flow:to_server,established; content:"SITE"; nocase; content:"EXEC"; distance:0; nocase; pcre:"/^SITE\s+EXEC\s[^\n]*?%[^\n]*?%/smi"; classtype:bad-unknown; sid:2101971; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M189"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Olympia"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037469; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert ftp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP PASS overflow attempt"; flow:to_server,established,no_stream; content:"PASS"; nocase; isdataat:100,relative; pcre:"/^PASS\s[^\n]{100}/smi"; reference:bugtraq,10078; reference:bugtraq,10720; reference:bugtraq,1690; reference:bugtraq,3884; reference:bugtraq,8601; reference:bugtraq,9285; reference:cve,1999-1519; reference:cve,1999-1539; reference:cve,2000-1035; reference:cve,2002-0126; reference:cve,2002-0895; classtype:attempted-admin; sid:2101972; rev:18; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M190"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Spokane"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037470; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP MKD overflow attempt"; flow:to_server,established; content:"MKD"; nocase; isdataat:100,relative; pcre:"/^MKD\s[^\n]{100}/smi"; reference:bugtraq,612; reference:bugtraq,7278; reference:bugtraq,9872; reference:cve,1999-0911; reference:nessus,12108; classtype:attempted-admin; sid:2101973; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M191"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 05|Miami"; distance:4; within:12; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037471; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP REST overflow attempt"; flow:to_server,established; content:"REST"; nocase; isdataat:100,relative; pcre:"/^REST\s[^\n]{100}/smi"; reference:bugtraq,2972; reference:cve,2001-0826; classtype:attempted-admin; sid:2101974; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M192"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 07|Orlando"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037472; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP DELE overflow attempt"; flow:to_server,established; content:"DELE"; nocase; isdataat:100,relative; pcre:"/^DELE\s[^\n]{100}/smi"; reference:bugtraq,2972; reference:cve,2001-0826; reference:cve,2001-1021; classtype:attempted-admin; sid:2101975; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M193"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 05|Tampa"; distance:4; within:12; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037473; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP RMD overflow attempt"; flow:to_server,established; content:"RMD"; nocase; isdataat:100,relative; pcre:"/^RMD\s[^\n]{100}/smi"; reference:bugtraq,2972; reference:cve,2000-0133; reference:cve,2001-0826; reference:cve,2001-1021; classtype:attempted-admin; sid:2101976; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M194"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 0c|Jacksonville"; distance:4; within:19; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037474; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"GPL DELETED xp_regwrite attempt"; flow:to_server,established; content:"xp_regwrite"; nocase; classtype:web-application-activity; sid:2101977; rev:2; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M195"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 07|Chicago"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037475; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"GPL DELETED xp_regdeletekey attempt"; flow:to_server,established; content:"xp_regdeletekey"; nocase; classtype:web-application-activity; sid:2101978; rev:2; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M196"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Aurora"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037476; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER HTTP 414 Request URI Too Large"; flow:from_server,established; content:"HTTP/1.1 414 Request-URI Too Large"; depth:35; nocase; classtype:web-application-attack; sid:2012708; rev:2; metadata:created_at 2011_04_22, updated_at 2011_04_22;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M197"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 0a|Naperville"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037477; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"GPL DELETED MS Terminal server request"; flow:to_server,established; content:"|03 00 00|"; depth:3; content:"|e0 00 00 00 00 00|"; within:6; distance:2; reference:bugtraq,3099; reference:cve,2001-0540; reference:url,www.microsoft.com/technet/security/bulletin/MS01-040.mspx; classtype:protocol-command-decode; sid:2101448; rev:13; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M198"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Peoria"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|llc"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037478; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET !3389 (msg:"ET POLICY Remote Desktop Connection via non RDP Port"; flow:established,to_server; content:"|03|"; depth:1; content:"|e0|"; distance:4; within:1; content:"Cookie|3a|"; distance:5; within:7; reference:url,doc.emergingthreats.net/2007571; classtype:policy-violation; sid:2007571; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M199"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 00|"; distance:4; within:7; content:"|06 03 55 04 07 13 00|"; distance:4; within:7; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037479; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"GPL DELETED MS Remote Desktop non-encrypted session initiation attempt"; flow:to_server,established; content:"|03 00 01|"; depth:3; content:"|00|"; depth:1; offset:288; reference:url,www.microsoft.com/technet/security/bulletin/MS01-052.mspx; classtype:attempted-dos; sid:2102418; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M200"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 07|Phoenix"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037480; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"GPL POLICY MS Remote Desktop Request RDP"; flow:to_server,established; content:"|03 00 00|"; depth:3; content:"|e0 00 00 00 00 00|"; distance:2; within:6; reference:bugtraq,3099; reference:cve,2001-0540; reference:url,www.microsoft.com/technet/security/bulletin/MS01-040.mspx; classtype:protocol-command-decode; sid:2101447; rev:14; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M201"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 04|Mesa"; distance:4; within:11; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037481; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"ET POLICY MS Terminal Server Root login"; flow:established,to_server; content:"|03 00 00|"; depth:3; content:"|e0 00 00 00 00 00|"; distance:2; within:6; content:"Cookie|3a| mstshash=root|0d 0a|"; nocase; reference:cve,2001-0540; classtype:protocol-command-decode; sid:2012710; rev:1; metadata:created_at 2011_04_22, updated_at 2011_04_22;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M202"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 0a|Scottsdale"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037482; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"ET POLICY MS Remote Desktop Service User Login Request"; flow:to_server,established; content:"|03 00 00|"; depth:3; content:"|e0 00 00 00 00 00|"; distance:2; within:6; content:"Cookie|3a| mstshash=service|0d 0a|"; nocase; reference:cve,CAN-2001-0540; classtype:protocol-command-decode; sid:2012712; rev:1; metadata:created_at 2011_04_22, updated_at 2011_04_22;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M203"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 08|Chandler"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037483; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"ET POLICY MS Remote Desktop POS User Login Request"; flow:to_server,established; content:"|03 00 00|"; depth:3; content:"|e0 00 00 00 00 00|"; distance:2; within:6; content:"Cookie|3a| mstshash=pos|0d 0a|"; nocase; reference:cve,2001-0540; classtype:protocol-command-decode; sid:2012711; rev:1; metadata:created_at 2011_04_22, updated_at 2011_04_22;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M204"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0d|San Francisco"; distance:4; within:20; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037484; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Pinkslipbot Trojan Downloader"; flow:to_server,established; uricontent:"/jl/jloader.pl?u="; nocase; content:"&it=2"; nocase; http_uri; content:"&b="; nocase; http_uri; content:"&n="; nocase; http_uri; pcre:"/\x26n\x3d[a-z]{5}\d{4}/U"; reference:url,doc.emergingthreats.net/2010742; classtype:trojan-activity; sid:2010742; rev:4; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Trojan_Downloader, updated_at 2019_08_22;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M205"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0d|San Francisco"; distance:4; within:20; content:"|06 03 55 04 09 13 12|Golden Gate Bridge"; distance:4; within:25; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037485; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Adobe Flash Unicode SWF File Embedded in Office File Caution - Could be Hostile"; flow:established,from_server; flowbits:isset,OLE.CompoundFile; content:"S|00|W|00|F|00|"; reference:url,blogs.adobe.com/asset/2011/03/background-on-apsa11-01-patch-schedule.html; reference:url,bugix-security.blogspot.com/2011/03/cve-2011-0609-adobe-flash-player.html; reference:bid,46860; reference:cve,2011-0609; reference:url,www.adobe.com/support/security/advisories/apsa11-02.html; reference:cve,2011-0611; classtype:attempted-user; sid:2012622; rev:5; metadata:created_at 2011_04_01, updated_at 2011_04_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M206"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Oakland"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037486; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap SET attempt UDP 111"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:rpc-portmap-decode; sid:2101950; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M207"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 08|Berkeley"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037487; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC mountd TCP mount request"; flow:to_server,established; content:"|00 01 86 A5|"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:attempted-recon; sid:2101951; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M208"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 09|Palo Alto"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037488; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC mountd UDP mount request"; content:"|00 01 86 A5|"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:attempted-recon; sid:2101952; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M209"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0b|Los Angeles"; distance:4; within:18; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037489; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 500: (msg:"GPL DELETED AMD TCP pid request"; flow:to_server,established; content:"|00 04 93 F3|"; depth:4; offset:16; content:"|00 00 00 09|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:rpc-portmap-decode; sid:2101953; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M210"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 09|San Diego"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037490; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 500: (msg:"GPL DELETED AMD UDP pid request"; content:"|00 04 93 F3|"; depth:4; offset:12; content:"|00 00 00 09|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:rpc-portmap-decode; sid:2101954; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M211"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 08|San Jose"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037491; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 500: (msg:"GPL DELETED AMD TCP version request"; flow:to_server,established; content:"|00 04 93 F3|"; depth:4; offset:16; content:"|00 00 00 08|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:rpc-portmap-decode; sid:2101955; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M212"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Denver"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037492; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 500: (msg:"GPL DELETED AMD UDP version request"; content:"|00 04 93 F3|"; depth:4; offset:12; content:"|00 00 00 08|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,1554; reference:cve,2000-0696; classtype:rpc-portmap-decode; sid:2101956; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M213"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 07|Boulder"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037493; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC sadmind UDP PING"; content:"|00 01 87 88|"; depth:4; offset:12; content:"|00 00 00 00|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,866; classtype:attempted-admin; sid:2101957; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M214"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Aurora"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037494; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC sadmind TCP PING"; flow:to_server,established; content:"|00 01 87 88|"; depth:4; offset:16; content:"|00 00 00 00|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,866; classtype:attempted-admin; sid:2101958; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M215"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 0c|Fort Collins"; distance:4; within:19; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037495; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap NFS request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A3|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:rpc-portmap-decode; sid:2101959; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M216"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 09|New Haven"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037496; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap NFS request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 A3|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:rpc-portmap-decode; sid:2101960; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M217"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 0a|Bridgeport"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037497; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap RQUOTA request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 AB|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:rpc-portmap-decode; sid:2101961; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M218"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 08|Stamford"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037498; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap RQUOTA request TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 AB|"; within:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:rpc-portmap-decode; sid:2101962; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M219"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 07|Norwalk"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037499; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC RQUOTA getquota overflow attempt UDP"; content:"|00 01 86 AB|"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,128,0,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,864; reference:cve,1999-0974; classtype:misc-attack; sid:2101963; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M220"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Seattle"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037500; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC tooltalk UDP overflow attempt"; content:"|00 01 86 F3|"; depth:4; offset:12; content:"|00 00 00 07|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,128,0,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,122; reference:cve,1999-0003; classtype:misc-attack; sid:2101964; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M221"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 06|Tacoma"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037501; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC tooltalk TCP overflow attempt"; flow:to_server,established; content:"|00 01 86 F3|"; depth:4; offset:16; content:"|00 00 00 07|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,128,0,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,122; reference:cve,1999-0003; classtype:misc-attack; sid:2101965; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M222"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Olympia"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037502; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 109 (msg:"GPL DELETED FOLD overflow attempt"; flow:established,to_server; content:"FOLD"; nocase; isdataat:256,relative; pcre:"/^FOLD\s[^\n]{256}/smi"; reference:bugtraq,283; reference:cve,1999-0920; reference:nessus,10130; classtype:attempted-admin; sid:2101934; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M223"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Spokane"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037503; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 109 (msg:"GPL DELETED FOLD arbitrary file attempt"; flow:established,to_server; content:"FOLD"; nocase; pcre:"/^FOLD\s+\//smi"; classtype:misc-attack; sid:2101935; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M224"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 05|Miami"; distance:4; within:12; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037504; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"GPL POP3 AUTH overflow attempt"; flow:to_server,established; content:"AUTH"; nocase; isdataat:50,relative; pcre:"/^AUTH\s[^\n]{50}/smi"; reference:bugtraq,830; reference:cve,1999-0822; reference:nessus,10184; classtype:attempted-admin; sid:2101936; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M225"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 07|Orlando"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037505; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"GPL POP3 LIST overflow attempt"; flow:to_server,established; content:"LIST"; nocase; isdataat:10,relative; pcre:"/^LIST\s[^\n]{10}/smi"; reference:bugtraq,948; reference:cve,2000-0096; reference:nessus,10197; classtype:attempted-admin; sid:2101937; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M226"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 05|Tampa"; distance:4; within:12; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037506; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"GPL POP3 XTND overflow attempt"; flow:to_server,established; content:"XTND"; nocase; isdataat:50,relative; pcre:"/^XTND\s[^\n]{50}/smi"; classtype:attempted-admin; sid:2101938; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M227"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 0c|Jacksonville"; distance:4; within:19; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037507; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 67 (msg:"GPL MISC bootp hardware address length overflow"; content:"|01|"; depth:1; byte_test:1,>,6,2; reference:cve,1999-0798; classtype:misc-activity; sid:2101939; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M228"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 07|Chicago"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037508; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 67 (msg:"GPL MISC bootp invalid hardware type"; content:"|01|"; depth:1; byte_test:1,>,7,1; reference:cve,1999-0798; classtype:misc-activity; sid:2101940; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M229"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Aurora"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037509; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp any any -> any 69 (msg:"GPL TFTP GET filename overflow attempt"; content:"|00 01|"; depth:2; isdataat:100,relative; content:!"|00|"; within:100; reference:bugtraq,5328; reference:cve,2002-0813; classtype:attempted-admin; sid:2101941; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M230"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 0a|Naperville"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037510; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP RMDIR overflow attempt"; flow:to_server,established; content:"RMDIR"; nocase; isdataat:100,relative; pcre:"/^RMDIR\s[^\n]{100}/smi"; reference:bugtraq,819; classtype:attempted-admin; sid:2101942; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M231"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Peoria"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 04|corp"; nocase; distance:4; within:11; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037511; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 8888 (msg:"GPL DELETED answerbook2 admin attempt"; flow:to_server,established; content:"/cgi-bin/admin/admin"; reference:bugtraq,5383; reference:cve,2000-0696; classtype:web-application-activity; sid:2101946; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) - -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL WEB_SERVER unicode directory traversal attempt"; flow:to_server,established; content:"/..%255c.."; nocase; reference:bugtraq,1806; reference:cve,2000-0884; reference:nessus,10537; classtype:web-application-attack; sid:2101945; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) - -#alert tcp $EXTERNAL_NET any -> $HOME_NET 8888 (msg:"GPL DELETED answerbook2 arbitrary command execution attempt"; flow:to_server,established; content:"/ab2/"; content:"|3B|"; distance:1; reference:bugtraq,1556; reference:cve,2000-0697; classtype:web-application-attack; sid:2101947; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) - -alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap SET attempt TCP 111"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:rpc-portmap-decode; sid:2101949; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) - -alert ftp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP SITE NEWER overflow attempt"; flow:to_server,established; content:"SITE"; nocase; content:"NEWER"; distance:0; nocase; isdataat:100,relative; pcre:"/^SITE\s+NEWER\s[^\n]{100}/smi"; reference:bugtraq,229; reference:cve,1999-0800; classtype:attempted-admin; sid:2101920; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) - -alert ftp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP SITE ZIPCHK overflow attempt"; flow:to_server,established; content:"SITE"; nocase; content:"ZIPCHK"; distance:1; nocase; isdataat:100,relative; pcre:"/^SITE\s+ZIPCHK\s[^\n]{100}/smi"; reference:cve,2000-0040; classtype:attempted-admin; sid:2101921; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) - -alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap proxy attempt TCP"; flow:to_server,established; content:"|00 01 86 A0|"; depth:4; offset:16; content:"|00 00 00 05|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:rpc-portmap-decode; sid:2101922; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M232"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 00|"; distance:4; within:7; content:"|06 03 55 04 07 13 00|"; distance:4; within:7; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037512; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap proxy attempt UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 05|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:rpc-portmap-decode; sid:2101923; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M233"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 07|Phoenix"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037513; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC mountd TCP exportall request"; flow:to_server,established; content:"|00 01 86 A5|"; depth:4; offset:16; content:"|00 00 00 06|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:arachnids,26; classtype:attempted-recon; sid:2101925; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M234"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 04|Mesa"; distance:4; within:11; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037514; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp any any -> 212.146.0.34 1963 (msg:"GPL DELETED TCPDUMP/PCAP trojan traffic"; flow:stateless; reference:url,hlug.fscker.com; classtype:trojan-activity; sid:2101929; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M235"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 0a|Scottsdale"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037515; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP .forward"; flow:to_server,established; content:".forward"; reference:arachnids,319; classtype:suspicious-filename-detect; sid:2100334; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M236"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 08|Chandler"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037516; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP .rhosts"; flow:to_server,established; content:".rhosts"; reference:arachnids,328; classtype:suspicious-filename-detect; sid:2100335; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M237"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0d|San Francisco"; distance:4; within:20; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037517; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP ADMw0rm ftp login attempt"; flow:to_server,established; content:"USER"; nocase; content:"w0rm"; distance:1; nocase; pcre:"/^USER\s+w0rm/smi"; reference:arachnids,01; classtype:suspicious-login; sid:2100144; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M238"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0d|San Francisco"; distance:4; within:20; content:"|06 03 55 04 09 13 12|Golden Gate Bridge"; distance:4; within:25; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037518; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP ALLO overflow attempt"; flow:to_server,established; content:"ALLO"; nocase; isdataat:100,relative; pcre:"/^ALLO\s[^\n]{100}/smi"; reference:bugtraq,9953; classtype:attempted-admin; sid:2102449; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M239"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Oakland"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037519; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP CEL overflow attempt"; flow:to_server,established; content:"CEL"; nocase; isdataat:100,relative; pcre:"/^CEL\s[^\n]{100}/smi"; reference:arachnids,257; reference:bugtraq,679; reference:cve,1999-0789; reference:nessus,10009; classtype:attempted-admin; sid:2100337; rev:13; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M240"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 08|Berkeley"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037520; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP CMD overflow attempt"; flow:to_server,established; content:"CMD"; nocase; isdataat:100,relative; pcre:"/^CMD\s[^\n]{100}/smi"; classtype:attempted-admin; sid:2101621; rev:12; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M241"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 09|Palo Alto"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037521; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Trojan Downloader Win32/Small.CBA download"; flow:established,to_server; content:"popjs.asp?uid="; nocase; http_uri; content:"&tid="; nocase; http_uri; content:"&l="; nocase; http_uri; content:"&c="; http_uri; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AWin32%2FSmall.CBA&ThreatID=-2147372177; reference:url,doc.emergingthreats.net/2010569; classtype:trojan-activity; sid:2010569; rev:6; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Trojan_Downloader, updated_at 2016_07_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M242"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0b|Los Angeles"; distance:4; within:18; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037522; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $HOME_NET 749 -> $EXTERNAL_NET any (msg:"GPL EXPLOIT successful kadmind buffer overflow attempt"; flow:established,from_server; content:"*GOBBLE*"; depth:8; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:successful-admin; sid:2101900; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M243"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 09|San Diego"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037523; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $HOME_NET 751 -> $EXTERNAL_NET any (msg:"GPL EXPLOIT successful kadmind buffer overflow attempt"; flow:established,from_server; content:"*GOBBLE*"; depth:8; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:successful-admin; sid:2101901; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M244"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 08|San Jose"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037524; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"GPL IMAP lsub literal overflow attempt"; flow:to_server,established; content:"LSUB"; nocase; pcre:"/\sLSUB\s[^\n]*?\s\{/smi"; byte_test:5,>,256,0,string,dec,relative; reference:bugtraq,1110; reference:cve,2000-0284; reference:nessus,10374; classtype:misc-attack; sid:2101902; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M245"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Denver"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037525; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"GPL IMAP rename overflow attempt"; flow:established,to_server; content:"RENAME"; nocase; isdataat:100,relative; pcre:"/\sRENAME\s[^\n]{100}/smi"; reference:bugtraq,1110; reference:cve,2000-0284; reference:nessus,10374; classtype:misc-attack; sid:2101903; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M246"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 07|Boulder"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037526; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"GPL IMAP find overflow attempt"; flow:established,to_server; content:"FIND"; nocase; isdataat:100,relative; pcre:"/\sFIND\s[^\n]{100}/smi"; reference:bugtraq,1110; reference:cve,2000-0284; reference:nessus,10374; classtype:misc-attack; sid:2101904; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M247"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Aurora"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037527; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 500: (msg:"GPL DELETED AMD TCP amqproc_mount plog overflow attempt"; flow:to_server,established; content:"|00 04 93 F3|"; depth:4; offset:16; content:"|00 00 00 07|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,512,0,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,614; reference:cve,1999-0704; classtype:misc-attack; sid:2101906; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M248"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 0c|Fort Collins"; distance:4; within:19; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037528; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC CMSD UDP CMSD_CREATE buffer overflow attempt"; content:"|00 01 86 E4|"; depth:4; offset:12; content:"|00 00 00 15|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,1024,0,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,524; reference:cve,1999-0696; classtype:attempted-admin; sid:2101907; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M249"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 09|New Haven"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037529; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC CMSD TCP CMSD_CREATE buffer overflow attempt"; flow:to_server,established; content:"|00 01 86 E4|"; depth:4; offset:16; content:"|00 00 00 15|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,1024,0,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,524; reference:cve,1999-0696; classtype:attempted-admin; sid:2101908; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M250"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 0a|Bridgeport"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037530; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC CMSD TCP CMSD_INSERT buffer overflow attempt"; flow:to_server,established; content:"|00 01 86 E4|"; depth:4; offset:16; content:"|00 00 00 06|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_jump:4,0,relative,align; byte_test:4,>,1000,28,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,524; reference:cve,1999-0696; reference:url,www.cert.org/advisories/CA-99-08-cmsd.html; classtype:misc-attack; sid:2101909; rev:13; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M251"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 08|Stamford"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037531; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED sadmind UDP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt"; content:"|00 01 87 88|"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_jump:4,124,relative,align; byte_jump:4,20,relative,align; byte_test:4,>,512,4,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,866; reference:cve,1999-0977; classtype:attempted-admin; sid:2101911; rev:12; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M252"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 07|Norwalk"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037532; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC sadmind TCP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt"; flow:to_server,established; content:"|00 01 87 88|"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_jump:4,124,relative,align; byte_jump:4,20,relative,align; byte_test:4,>,512,4,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,0866; reference:bugtraq,866; reference:cve,1999-0977; classtype:attempted-admin; sid:2101912; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M253"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Seattle"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037533; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC STATD UDP stat mon_name format string exploit attempt"; content:"|00 01 86 B8|"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,100,0,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,1480; reference:cve,2000-0666; classtype:attempted-admin; sid:2101913; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M254"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 06|Tacoma"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037534; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC STATD TCP stat mon_name format string exploit attempt"; flow:to_server,established; content:"|00 01 86 B8|"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,100,0,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,1480; reference:cve,2000-0666; classtype:attempted-admin; sid:2101914; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M255"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Olympia"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037535; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC STATD UDP monitor mon_name format string exploit attempt"; content:"|00 01 86 B8|"; depth:4; offset:12; content:"|00 00 00 02|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,100,0,relative; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,1480; reference:cve,2000-0666; classtype:attempted-admin; sid:2101915; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M256"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Spokane"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037536; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC STATD TCP monitor mon_name format string exploit attempt"; flow:to_server,established; content:"|00 01 86 B8|"; depth:4; offset:16; content:"|00 00 00 02|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; byte_test:4,>,100,0,relative; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,1480; reference:cve,2000-0666; classtype:attempted-admin; sid:2101916; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M257"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 05|Miami"; distance:4; within:12; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037537; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 1900 (msg:"GPL MISC UPnP service discover attempt"; content:"M-SEARCH "; depth:9; content:"ssdp|3A|discover"; classtype:network-scan; sid:2101917; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M258"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 07|Orlando"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037538; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL SCAN SolarWinds IP scan attempt"; icode:0; itype:8; content:"SolarWinds.Net"; nocase; classtype:network-scan; sid:2101918; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M259"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 05|Tampa"; distance:4; within:12; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037539; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP CWD overflow attempt"; flow:to_server,established; content:"CWD"; nocase; isdataat:100,relative; pcre:"/^CWD\s[^\n]{100}/smi"; reference:bugtraq,11069; reference:bugtraq,1227; reference:bugtraq,1690; reference:bugtraq,6869; reference:bugtraq,7251; reference:bugtraq,7950; reference:cve,1999-0219; reference:cve,1999-1058; reference:cve,1999-1510; reference:cve,2000-1035; reference:cve,2000-1194; reference:cve,2001-0781; reference:cve,2002-0126; reference:cve,2002-0405; classtype:attempted-admin; sid:2101919; rev:24; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M260"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 0c|Jacksonville"; distance:4; within:19; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037540; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Likely Redirector to Exploit Page /in/rdrct/rckt/?"; flow:established,to_server; content:"/in/rdrct/rckt/?"; http_uri; classtype:attempted-user; sid:2012731; rev:2; metadata:created_at 2011_04_28, former_category CURRENT_EVENTS, updated_at 2011_04_28;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M261"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 07|Chicago"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037541; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Unknown .ru Exploit Redirect Page"; flow:established,to_server; content:"people/?"; http_uri; content:"&top="; http_uri; content:".ru|0d 0a|"; http_header; classtype:bad-unknown; sid:2012732; rev:2; metadata:created_at 2011_04_28, former_category CURRENT_EVENTS, updated_at 2011_04_28;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M262"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Aurora"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037542; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Vertex Trojan UA (VERTEXNET)"; flow:to_server,established; content:"User-Agent|3a| VERTEXNET"; http_header; classtype:trojan-activity; sid:2012752; rev:2; metadata:created_at 2011_04_29, updated_at 2011_04_29;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M263"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 0a|Naperville"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037543; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Gesytec ElonFmt ActiveX Component Format String Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"ELONFMTLib.ElonFmt"; nocase; distance:0; content:".GetItem1"; nocase; reference:url,exploit-db.com/exploits/17196; classtype:attempted-user; sid:2012742; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_04_29, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M264"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Peoria"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13 03|ltd"; nocase; distance:4; within:10; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037544; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Windows Help and Support Center XSS Attempt"; flow:established,to_client; content:"hcp|3A|//"; fast_pattern; nocase; content:"script"; nocase; distance:0; content:"defer"; nocase; reference:cve,2010-1885; classtype:attempted-user; sid:2012756; rev:2; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_04_29, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M265"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 00|"; distance:4; within:7; content:"|06 03 55 04 07 13 00|"; distance:4; within:7; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037545; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET ACTIVEX Microsoft Internet Explorer Tabular DataURL ActiveX Control Memory Corruption Attempt"; flow:established,to_client; content:"333C7BC4-460F-11D0-BC04-0080C7055A83"; nocase; content:"DataURL"; nocase; distance:0; content:"value=|22|"; nocase; distance:0; isdataat:100,relative; content:!"|0A|"; within:100; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*333C7BC4-460F-11D0-BC04-0080C7055A83/si"; reference:url,securitytracker.com/alerts/2010/Mar/1023773.html; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=20202; reference:url,www.metasploit.com/redmine/projects/framework/repository/revisions/9018/entry/modules/exploits/windows/browser/ms10_018_ie_tabular_activex.rb; reference:url,www.microsoft.com/technet/security/bulletin/ms10-018.mspx; reference:url,www.vupen.com/english/advisories/2010/0744; reference:url,www.kb.cert.org/vuls/id/744549; reference:cve,2010-0805; reference:url,doc.emergingthreats.net/2011007; classtype:attempted-user; sid:2011007; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M266"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 07|Phoenix"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037546; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert ip $HOME_NET any -> $EXTERNAL_NET any (msg:"GPL ATTACK_RESPONSE id check returned userid"; content:"uid="; byte_test:5,<,65537,0,relative,string; content:" gid="; within:15; byte_test:5,<,65537,0,relative,string; classtype:bad-unknown; sid:2101882; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M267"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 04|Mesa"; distance:4; within:11; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037547; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"GPL ATTACK_RESPONSE id check returned nobody"; flow:from_server,established; content:"uid="; content:"|28|nobody|29|"; classtype:bad-unknown; sid:2101883; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M268"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 0a|Scottsdale"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037548; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"GPL ATTACK_RESPONSE id check returned http"; flow:from_server,established; content:"uid="; content:"|28|http|29|"; classtype:bad-unknown; sid:2101885; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M269"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 08|Chandler"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037549; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"GPL ATTACK_RESPONSE id check returned apache"; flow:from_server,established; content:"uid="; content:"|28|apache|29|"; classtype:bad-unknown; sid:2101886; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M270"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0d|San Francisco"; distance:4; within:20; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037550; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 443 (msg:"GPL DELETED OpenSSL Worm traffic"; flow:to_server,established; content:"TERM=xterm"; nocase; reference:url,www.cert.org/advisories/CA-2002-27.html; classtype:web-application-attack; sid:2101887; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M271"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0d|San Francisco"; distance:4; within:20; content:"|06 03 55 04 09 13 12|Golden Gate Bridge"; distance:4; within:25; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037551; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP SITE CPWD overflow attempt"; flow:established,to_server; content:"SITE"; nocase; content:"CPWD"; distance:0; nocase; isdataat:100,relative; pcre:"/^SITE\s+CPWD\s[^\n]{100}/smi"; reference:bugtraq,5427; reference:cve,2002-0826; classtype:misc-attack; sid:2101888; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M272"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Oakland"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037552; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"GPL DELETED status GHBN format string attack"; content:"|00 01 86 B8|"; depth:4; offset:12; content:"|00 00 00 02|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"%x %x"; within:256; content:"|00 00 00 00|"; depth:4; offset:4; reference:bugtraq,1480; reference:cve,2000-0666; classtype:misc-attack; sid:2101890; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M273"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 08|Berkeley"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037553; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"GPL RPC status GHBN format string attack"; flow:to_server, established; content:"|00 01 86 B8|"; depth:4; offset:16; content:"|00 00 00 02|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"%x %x"; within:256; content:"|00 00 00 00|"; depth:4; offset:8; reference:bugtraq,1480; reference:cve,2000-0666; classtype:misc-attack; sid:2101891; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M274"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 09|Palo Alto"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037554; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"GPL SNMP null community string attempt"; content:"|04 01 00|"; depth:15; offset:5; reference:bugtraq,2112; reference:bugtraq,8974; reference:cve,1999-0517; classtype:misc-attack; sid:2101892; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M275"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0b|Los Angeles"; distance:4; within:18; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037555; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"GPL SNMP missing community string attempt"; content:"|04 00|"; depth:15; offset:5; reference:bugtraq,2112; reference:cve,1999-0517; classtype:misc-attack; sid:2101893; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M276"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 09|San Diego"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037556; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 749 (msg:"GPL EXPLOIT kadmind buffer overflow attempt"; flow:established,to_server; content:"|00 C0 05 08 00 C0 05 08 00 C0 05 08 00 C0 05 08|"; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:shellcode-detect; sid:2101894; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M277"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 08|San Jose"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037557; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 751 (msg:"GPL EXPLOIT kadmind buffer overflow attempt"; flow:established,to_server; content:"|00 C0 05 08 00 C0 05 08 00 C0 05 08 00 C0 05 08|"; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:shellcode-detect; sid:2101895; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M278"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Denver"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037558; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 749 (msg:"GPL EXPLOIT kadmind buffer overflow attempt"; flow:established,to_server; content:"|FF FF|KADM0.0A|00 00 FB 03|"; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:shellcode-detect; sid:2101896; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M279"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 07|Boulder"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037559; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 751 (msg:"GPL EXPLOIT kadmind buffer overflow attempt"; flow:established,to_server; content:"|FF FF|KADM0.0A|00 00 FB 03|"; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:shellcode-detect; sid:2101897; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M280"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Aurora"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037560; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 749 (msg:"GPL EXPLOIT kadmind buffer overflow attempt 2"; flow:established,to_server; content:"/shh//bi"; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:shellcode-detect; sid:2101898; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M281"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 0c|Fort Collins"; distance:4; within:19; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037561; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 751 (msg:"GPL EXPLOIT kadmind buffer overflow attempt 3"; flow:established,to_server; content:"/shh//bi"; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:shellcode-detect; sid:2101899; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M282"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 09|New Haven"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037562; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL WEB_SERVER robots.txt access"; flow:to_server,established; content:"/robots.txt"; http_uri; nocase; reference:nessus,10302; classtype:web-application-activity; sid:2101852; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M283"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 0a|Bridgeport"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037563; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 35555 (msg:"GPL DELETED win-trin00 connection attempt"; content:"png []..Ks l44"; depth:14; reference:cve,2000-0138; reference:nessus,10307; classtype:attempted-admin; sid:2101853; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M284"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 08|Stamford"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037564; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert icmp $EXTERNAL_NET any <> $HOME_NET any (msg:"GPL DELETED Stacheldraht handler->agent niggahbitch"; icmp_id:9015; itype:0; content:"niggahbitch"; reference:url,staff.washington.edu/dittrich/misc/stacheldraht.analysis; classtype:attempted-dos; sid:2101854; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M285"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0b|Connecticut"; distance:4; within:18; content:"|06 03 55 04 07 13 07|Norwalk"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037565; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert icmp $EXTERNAL_NET any <> $HOME_NET any (msg:"GPL DELETED Stacheldraht agent->handler skillz"; icmp_id:6666; itype:0; content:"skillz"; reference:url,staff.washington.edu/dittrich/misc/stacheldraht.analysis; classtype:attempted-dos; sid:2101855; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M286"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Seattle"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037566; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert icmp $EXTERNAL_NET any <> $HOME_NET any (msg:"GPL DELETED Stacheldraht handler->agent ficken"; icmp_id:6667; itype:0; content:"ficken"; reference:url,staff.washington.edu/dittrich/misc/stacheldraht.analysis; classtype:attempted-dos; sid:2101856; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M287"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 06|Tacoma"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037567; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL WEB_SERVER robot.txt access"; flow:to_server,established; content:"/robot.txt"; http_uri; nocase; reference:nessus,10302; classtype:web-application-activity; sid:2101857; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M288"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Olympia"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037568; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 8181 (msg:"GPL DELETED CISCO PIX Firewall Manager directory traversal attempt"; flow:to_server,established; content:"/pixfir~1/how_to_login.html"; reference:bugtraq,691; reference:cve,1999-0158; reference:nessus,10819; classtype:misc-attack; sid:2101858; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M289"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|Washington"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Spokane"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037569; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP SITE NEWER attempt"; flow:to_server,established; content:"SITE"; nocase; content:"NEWER"; distance:1; nocase; pcre:"/^SITE\s+NEWER/smi"; reference:cve,1999-0880; reference:nessus,10319; classtype:attempted-dos; sid:2101864; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M290"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 05|Miami"; distance:4; within:12; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037570; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert udp $EXTERNAL_NET any -> $HOME_NET 177 (msg:"GPL RPC xdmcp info query"; content:"|00 01 00 02 00 01 00|"; reference:nessus,10891; classtype:attempted-recon; sid:2101867; rev:2; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M291"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 07|Orlando"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037571; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET 8080 (msg:"GPL DELETED story.pl arbitrary file read attempt"; flow:to_server,established; content:"/story.pl"; http_uri; content:"next=../"; reference:bugtraq,3028; reference:cve,2001-0804; reference:nessus,10817; classtype:default-login-attempt; sid:2101868; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M292"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 05|Tampa"; distance:4; within:12; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037572; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 8080 (msg:"GPL DELETED story.pl access"; flow:to_server,established; uricontent:"/story.pl"; reference:bugtraq,3028; reference:cve,2001-0804; reference:nessus,10817; classtype:default-login-attempt; sid:2101869; rev:6; metadata:created_at 2010_09_23, updated_at 2019_08_22;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M293"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Florida"; distance:4; within:14; content:"|06 03 55 04 07 13 0c|Jacksonville"; distance:4; within:19; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037573; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Suspicious IAT ZwSetSystemInformation - Undocumented API Which Can be Used for Rootkit Functionality"; flowbits:isset,ET.http.binary; flow:established,to_client; content:"ZwSetSystemInformation"; nocase; fast_pattern:only; reference:url,sans.org/reading_room/whitepapers/malicious/rss/_33649; classtype:misc-activity; sid:2012769; rev:2; metadata:created_at 2011_05_03, former_category HUNTING, updated_at 2021_06_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M294"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 07|Chicago"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037574; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Suspicious IAT ZwWriteVirtualMemory - Undocumented API Which Can be Used for CnC Functionality"; flowbits:isset,ET.http.binary; flow:established,to_client; content:"ZwSystemDebugControl"; nocase; fast_pattern:only; reference:url,sans.org/reading_room/whitepapers/malicious/rss/_33649; classtype:command-and-control; sid:2012770; rev:2; metadata:created_at 2011_05_03, former_category HUNTING, updated_at 2021_06_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M295"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Aurora"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037575; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Suspicious IAT SetSfcFileException - Undocumented API Which Can be Used for Disabling Windows File Protections"; flowbits:isset,ET.http.binary; flow:established,to_client; content:"SetSfcFileException"; nocase; fast_pattern:only; reference:url,sans.org/reading_room/whitepapers/malicious/rss/_33649; classtype:misc-activity; sid:2012771; rev:2; metadata:created_at 2011_05_03, former_category HUNTING, updated_at 2021_06_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M296"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 0a|Naperville"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037576; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Suspicious IAT NtQueueApcThread - Undocumented API Which Can be Used for Thread Injection/Downloading"; flowbits:isset,ET.http.binary; flow:established,to_client; content:"NtQueueApcThread"; nocase; fast_pattern:only; reference:url,sans.org/reading_room/whitepapers/malicious/rss/_33649; classtype:misc-activity; sid:2012772; rev:2; metadata:created_at 2011_05_03, former_category HUNTING, updated_at 2021_06_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M297"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Illinois"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Peoria"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Tech"; nocase; distance:1; within:4; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037577; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Suspicious IAT NtResumeThread - Undocumented API Which Can be Used to Resume Thread Injection"; flowbits:isset,ET.http.binary; flow:established,to_client; content:"NtQueueApcThread"; nocase; fast_pattern:only; reference:url,sans.org/reading_room/whitepapers/malicious/rss/_33649; classtype:misc-activity; sid:2012773; rev:2; metadata:created_at 2011_05_03, former_category HUNTING, updated_at 2021_06_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M298"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 00|"; distance:4; within:7; content:"|06 03 55 04 07 13 00|"; distance:4; within:7; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Debug"; nocase; distance:1; within:5; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037578; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Suspicious IAT NoExecuteAddFileOptOutList - Undocumented API to Add Executable to DEP Exception List"; flowbits:isset,ET.http.binary; flow:established,to_client; content:"NoExecuteAddFileOptOutList"; nocase; fast_pattern:only; reference:url,sans.org/reading_room/whitepapers/malicious/rss/_33649; classtype:misc-activity; sid:2012774; rev:2; metadata:created_at 2011_05_03, former_category HUNTING, updated_at 2021_06_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M299"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 07|Phoenix"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Debug"; nocase; distance:1; within:5; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037579; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Suspicious IAT ModifyExecuteProtectionSupport - Undocumented API to Modify DEP"; flowbits:isset,ET.http.binary; flow:established,to_client; content:"ModifyExecuteProtectionSupport"; nocase; fast_pattern:only; reference:url,sans.org/reading_room/whitepapers/malicious/rss/_33649; classtype:misc-activity; sid:2012775; rev:2; metadata:created_at 2011_05_03, former_category HUNTING, updated_at 2021_06_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M300"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 04|Mesa"; distance:4; within:11; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Debug"; nocase; distance:1; within:5; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037580; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Suspicious IAT LdrLoadDll - Undocumented Low Level API to Load DLL"; flowbits:isset,ET.http.binary; flow:established,to_client; content:"LdrLoadDll"; nocase; fast_pattern:only; reference:url,sans.org/reading_room/whitepapers/malicious/rss/_33649; classtype:misc-activity; sid:2012776; rev:2; metadata:created_at 2011_05_03, former_category HUNTING, updated_at 2021_06_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M301"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 0a|Scottsdale"; distance:4; within:17; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Debug"; nocase; distance:1; within:5; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037581; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE SymbOS SuperFairy.D StartUpdata.ini Missing File HTTP Request"; flow:established,to_server; content:"/client/symbian/"; nocase; http_uri; content:"StartUpdata.ini"; nocase; http_uri; within:30; fast_pattern; reference:url,www.fortiguard.com/encyclopedia/virus/symbos_superfairy.d!tr.html; classtype:trojan-activity; sid:2012782; rev:2; metadata:created_at 2011_05_03, updated_at 2011_05_03;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M302"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 07|Arizona"; distance:4; within:14; content:"|06 03 55 04 07 13 08|Chandler"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Debug"; nocase; distance:1; within:5; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037582; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE SymbOS SuperFairy.D BackgroundUpdata.ini Missing File HTTP Request"; flow:established,to_server; content:"/client/symbian/BackgroundUpdata.ini"; http_uri; nocase; reference:url,www.fortiguard.com/encyclopedia/virus/symbos_superfairy.d!tr.html; classtype:trojan-activity; sid:2012783; rev:3; metadata:created_at 2011_05_03, updated_at 2011_05_03;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M303"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0d|San Francisco"; distance:4; within:20; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Debug"; nocase; distance:1; within:5; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037583; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE SymbOS SuperFairy.D active.txt Missing File HTTP Request"; flow:established,to_server; content:"/client/symbian/"; http_uri; nocase; content:"active.txt"; nocase; http_uri; within:30; fast_pattern; reference:url,www.fortiguard.com/encyclopedia/virus/symbos_superfairy.d!tr.html; classtype:trojan-activity; sid:2012784; rev:2; metadata:created_at 2011_05_03, updated_at 2011_05_03;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M304"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0d|San Francisco"; distance:4; within:20; content:"|06 03 55 04 09 13 12|Golden Gate Bridge"; distance:4; within:25; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Debug"; nocase; distance:1; within:5; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037584; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET MALWARE DNS Query for Possible FakeAV Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"antiv"; nocase; fast_pattern; distance:0; classtype:bad-unknown; sid:2012786; rev:1; metadata:created_at 2011_05_04, updated_at 2011_05_04;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M305"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 07|Oakland"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Debug"; nocase; distance:1; within:5; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037585; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"GPL IMAP fetch overflow attempt"; flow:established,to_server; content:"FETCH"; nocase; isdataat:500,relative; pcre:"/\sFETCH\s[^\n]{500}/smi"; reference:bugtraq,11775; classtype:misc-attack; sid:2103070; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M306"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 08|Berkeley"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Debug"; nocase; distance:1; within:5; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037586; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Egypack/1.0 User-Agent Likely Malware"; flow:established,to_server; content:"User-Agent|3a 20|Egypack"; http_header; reference:url,www.vbulletin.com/forum/showthread.php/338741-vBulletin-Footer-SQL-Injection-Hack; classtype:trojan-activity; sid:2012785; rev:3; metadata:created_at 2011_05_03, updated_at 2011_05_03;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M307"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 09|Palo Alto"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Debug"; nocase; distance:1; within:5; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037587; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCADA ICONICS WebHMI ActiveX Stack Overflow"; flow:to_client,established; content:"D25FCAFC-F795-4609-89BB-5F78B4ACAF2C"; nocase; content:"SetActiveXGUID"; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D25FCAFC-F795-4609-89BB-5F78B4ACAF2C/si"; reference:url,www.security-assessment.com/files/documents/advisory/ICONICS_WebHMI.pdf; reference:url,www.exploit-db.com/exploits/17240/; classtype:attempted-user; sid:2012787; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_05_04, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M308"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 0b|Los Angeles"; distance:4; within:18; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Debug"; nocase; distance:1; within:5; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037588; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET !$HTTP_PORTS (msg:"ET POLICY HTTP POST on unusual Port Possibly Hostile"; flow:established,to_server; content:"POST"; nocase; http_method; reference:url,doc.emergingthreats.net/2006409; classtype:policy-violation; sid:2006409; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M309"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 09|San Diego"; distance:4; within:16; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Debug"; nocase; distance:1; within:5; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037589; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED FakeAV AntivirusDoktor2009 User-Agent (768)"; flow:established,to_server; content:"|0d 0a|User-Agent|3a| 768"; reference:url,doc.emergingthreats.net/2010682; classtype:trojan-activity; sid:2010682; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M310"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 0a|California"; distance:4; within:17; content:"|06 03 55 04 07 13 08|San Jose"; distance:4; within:15; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Debug"; nocase; distance:1; within:5; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037590; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED FakeAV AntivirusDoktor2009 User-Agent (657)"; flow:established,to_server; content:"|0d 0a|User-Agent|3a| 657"; reference:url,doc.emergingthreats.net/2010683; classtype:trojan-activity; sid:2010683; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M311"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 06|Denver"; distance:4; within:13; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Debug"; nocase; distance:1; within:5; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037591; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Adobe Flash 0Day Exploit Attempt"; flow:established,from_server; content:"CWS|09|"; content:"|BA D5 19 5D 86 67 D5 8E 7F BC D0 3C 6E D8 E2 17 16 E8 3A 9F CF 59 B8 7B F6|"; distance:16; reference:url,www.exploit-db.com/exploits/13787/; reference:url,doc.emergingthreats.net/2011672; classtype:misc-attack; sid:2011672; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Sliver Framework TLS Certificate Observed M312"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02|US"; distance:0; content:"|06 03 55 04 08 13 08|Colorado"; distance:4; within:15; content:"|06 03 55 04 07 13 07|Boulder"; distance:4; within:14; content:"|06 03 55 04 09 13 00|"; distance:4; within:7; fast_pattern; content:"|06 03 55 04 11 13 04|"; distance:4; within:7; pcre:"/^\d{4}[01]/R"; content:"|06 03 55 04 0a 13|"; distance:3; within:6; content:"Debug"; nocase; distance:1; within:5; pcre:"/^(?:\s(?:co(?:rp)?|l(?:lc|td)|inc))?[01]/Ri"; content:"|06 03 55 04 03|"; distance:3; within:5; content:!"|2a 86 48 86 f7 0d 01 09 01|"; reference:url,github.com/BishopFox/sliver/blob/97d3da75b6e24defb3a2a97443a15a632b3a8448/server/certs/subject.go; classtype:trojan-activity; sid:2037592; rev:1; metadata:affected_product Any, attack_target Client_and_Server, created_at 2022_07_07, deployment Perimeter, performance_impact Low, signature_severity Major, tag Sliver, updated_at 2022_07_07;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Internal User may have Visited an ASProx Infected Site (ads-t.ru)"; flow:established,from_server; content:""; nocase; fast_pattern:only; reference:url,blog.armorize.com/2011/06/mass-meshing-injection-sidenamejs.html; classtype:web-application-attack; sid:2013060; rev:3; metadata:created_at 2011_06_17, updated_at 2011_06_17;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS RedDotv2 Jar March 18 2013"; flow:established,to_server; content:"/sexy.jar"; http_uri; fast_pattern:only; classtype:trojan-activity; sid:2016594; rev:7; metadata:created_at 2013_03_19, updated_at 2013_03_19;) -#alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Sidename.js Injected Script Served by Local WebServer"; flow:established,from_server; content:"/sidename.js\">"; nocase; fast_pattern:only; reference:url,blog.armorize.com/2011/06/mass-meshing-injection-sidenamejs.html; classtype:web-application-attack; sid:2013061; rev:3; metadata:created_at 2011_06_17, former_category CURRENT_EVENTS, updated_at 2011_06_17;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Lizamoon Related Compromised site served to local client"; flow:established,from_server; content:""; within:100; classtype:attempted-user; sid:2012624; rev:5; metadata:created_at 2011_04_02, updated_at 2011_04_02;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MacShield FakeAV CnC Communication"; flow:established,to_server; content:"/mac/soft.php?affid="; nocase; http_uri; fast_pattern:only; reference:url,blog.trendmicro.com/obfuscated-ip-addresses-and-affiliate-ids-in-mac-fakeav/; classtype:command-and-control; sid:2013062; rev:2; metadata:created_at 2011_06_17, former_category MALWARE, updated_at 2011_06_17;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS CritXPack Jar Request (3)"; flow:established,to_server; content:"/j17.php?i="; http_uri; content:"|29 20|Java/1"; http_user_agent; fast_pattern:only; classtype:exploit-kit; sid:2016365; rev:5; metadata:created_at 2013_02_07, former_category CURRENT_EVENTS, updated_at 2013_02_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET 8511 (msg:"ET MOBILE_MALWARE DroidKungFu Checkin 3"; flow:established,to_server; content:"POST"; http_method; content:"/search/getty.php"; reference:url,www.fortiguard.com/encyclopedia/virus/android_droidkungfu.a!tr.html; reference:url,extraexploit.blogspot.com/2011/06/droidkungfu-just-some-piece-of-code.html; reference:url,www.redmondpie.com/droidkungfu-new-hard-to-detect-android-malware-threat-on-the-loose-steals-user-data-and-more/; reference:url,blog.fortinet.com/androiddroidkungfu-attacking-from-a-mobile-device/; classtype:trojan-activity; sid:2013063; rev:2; metadata:attack_target Mobile_Client, created_at 2011_06_17, former_category MOBILE_MALWARE, updated_at 2011_06_17, mitre_tactic_id TA0037, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +#alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS c0896 Hacked Site Response (Outbound) 1"; flow:established,to_client; file_data; content:""; fast_pattern; content:"split"; distance:0; classtype:trojan-activity; sid:2017187; rev:2; metadata:created_at 2013_07_24, updated_at 2013_07_24;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED OneStep Adware related User Agent (x)"; flow:established,to_server; content:"|0d 0a|User-Agent|3a| x|0d 0a|"; nocase; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2008-112613-5052-99&tabid=2; classtype:trojan-activity; sid:2009987; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS c0896 Hacked Site Response (Outbound) 2"; flow:established,to_client; file_data; content:"#0c0896#"; fast_pattern; content:"split"; distance:0; classtype:trojan-activity; sid:2017188; rev:2; metadata:created_at 2013_07_24, updated_at 2013_07_24;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Java Exploit Attempt applet via file URI setAttribute"; flow:established,from_server; content:"setAttribute("; content:"C|3a 5c 5c|Progra"; fast_pattern; nocase; distance:0; content:"java"; nocase; distance:0; content:"jre6"; nocase; distance:0; content:"lib"; nocase; distance:0; content:"ext"; nocase; distance:0; reference:url,fhoguin.com/2011/03/oracle-java-unsigned-applet-applet2classloader-remote-code-execution-vulnerability-zdi-11-084-explained/; reference:cve,CVE-2010-4452; classtype:trojan-activity; sid:2013066; rev:3; metadata:created_at 2011_06_17, former_category CURRENT_EVENTS, updated_at 2011_06_17;) +#alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS c0896 Hacked Site Response (Outbound) 3"; flow:established,to_client; file_data; content:"/*0c0896*/"; fast_pattern; content:"split"; distance:0; classtype:trojan-activity; sid:2017189; rev:2; metadata:created_at 2013_07_24, updated_at 2013_07_24;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1064 (msg:"ET DELETED Win32/Fynloski Backdoor Keepalive Message"; flow:established,to_server; content:"KEEPALIVE"; content:"KEEPALIVE"; distance:5; within:10; content:"KEEPALIVE"; distance:5; within:10; content:"KEEPALIVE"; distance:5; within:10; content:"KEEPALIVE"; distance:5; within:10; reference:md5,baca8170608c189e2911dc4e430c7719; classtype:trojan-activity; sid:2013067; rev:2; metadata:created_at 2011_06_20, updated_at 2011_06_20;) +#alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS c0896 Hacked Site Response Octal (Outbound)"; flow:established,to_client; file_data; content:"0c0896"; fast_pattern; content:"="; distance:0; pcre:"/^[^\x22\x27\x3b]*?[\x22\x27](?P[0-7]{1,3})(?P[^0-9a-f])(?P[0-7]{1,3})(?P=sep)[0-7]{1,3}(?P=sep)(?P(?!(?P=f))[0-7]{1,3})(?P=sep)([0-7]{1,3}(?P=sep)){4}(?P=n)(?P=sep)(?P=space)(?P=sep)(?P(?!((?P=f)|(?P=n)))[0-7]{1,3})(?P=sep)(?P=z)(?P=sep)(?P=z)(?P=sep)(?P=f)(?P=sep)(?P=f)(?P=sep)(?P=f)/R"; classtype:trojan-activity; sid:2017192; rev:3; metadata:created_at 2013_07_25, updated_at 2013_07_25;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED FAKEAV Scanner Landing Page (Initializing Virus Protection System...)"; flow:established,from_server; content:"Initializing Virus Protection System..."; classtype:bad-unknown; sid:2012815; rev:3; metadata:created_at 2011_05_18, updated_at 2011_05_18;) +#alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS c0896 Hacked Site Response (Outbound) 4"; flow:established,to_client; file_data; content:"0c0896"; fast_pattern; flowbits:isset,ET.JS.Obfus.Func; classtype:trojan-activity; sid:2017246; rev:2; metadata:created_at 2013_07_30, updated_at 2013_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT FakeAV scanner page encountered Initializing Virus Protection System"; flow:to_client,established; content:"Initializing Virus Protection System..."; classtype:bad-unknown; sid:2011343; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_28, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Rawin -TDS - POST w/Java Version"; flow:established,to_server; content:"POST"; http_method; content:"&v="; http_client_body; depth:3; pcre:"/^&v=(null|(\d+\.)+?\d+)\x3b\d+\x3b\x3b\d{3,5}x\d{3,5}\x3b/P"; classtype:trojan-activity; sid:2017300; rev:2; metadata:created_at 2013_08_08, updated_at 2013_08_08;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET USER_AGENTS Suspicious User Agent (GabPath)"; flow:to_server,established; content:"User-Agent|3a| GabPath"; http_header; classtype:pup-activity; sid:2011293; rev:7; metadata:created_at 2010_09_28, former_category HUNTING, updated_at 2010_09_28;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Fake Trojan Dropper purporting to be missing application - findloader"; flow:established,to_server; content:"/findloader"; http_uri; pcre:"/findloader[^\x2f\.\?]*?\.php\?[a-z]=[^&]+$/U"; classtype:trojan-activity; sid:2017302; rev:2; metadata:created_at 2013_08_08, updated_at 2013_08_08;) -#alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL SCAN Webtrends Scanner UDP Probe"; content:"|0A|help|0A|quite|0A|"; classtype:attempted-recon; sid:2100637; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS 0f2490 Hacked Site Response (Inbound)"; flow:established,from_server; file_data; content:""; content:"#/0f2490#"; fast_pattern; distance:0; classtype:trojan-activity; sid:2017306; rev:5; metadata:created_at 2013_08_12, updated_at 2013_08_12;) -#alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC mountd UDP exportall request"; content:"|00 01 86 A5|"; depth:4; offset:12; content:"|00 00 00 06|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:attempted-recon; sid:2101926; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS 0f2490 Hacked Site Response (Outbound)"; flow:established,from_server; file_data; content:""; content:"#/0f2490#"; fast_pattern; distance:0; classtype:trojan-activity; sid:2017307; rev:5; metadata:created_at 2013_08_12, updated_at 2013_08_12;) -#alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL RPC mountd UDP export request"; content:"|00 01 86 A5|"; depth:4; offset:12; content:"|00 00 00 05|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:attempted-recon; sid:2101924; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS AutoIT C&C Check-In 2013-08-23 URL"; flow:established,to_server; content:"GET"; http_method; content:"/panel/panel.bin"; http_uri; reference:url,malwr.com/analysis/MWM3NDA2NTdhM2U4NGE0NjgwY2IzN2Y3ZDk4ZTcyMmM/; classtype:trojan-activity; sid:2017370; rev:2; metadata:created_at 2013_08_23, updated_at 2013_08_23;) -#alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED EXPLOIT statdx"; content:"/bin|C7|F|04|/sh"; classtype:attempted-admin; sid:2101282; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible J7u21 click2play bypass"; flow:established,to_client; file_data; content:" $HOME_NET 9 (msg:"GPL MISC Ascend Route"; content:"NAMENAME"; depth:50; offset:25; reference:bugtraq,714; reference:cve,1999-0060; classtype:attempted-dos; sid:2100281; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Sakura Sep 10 2013"; flow:established,from_server; file_data; content:".getVersion("; nocase; content:!"PluginDetect"; nocase; distance:-24; within:12; pcre:"/^[\r\n\s]*?(?P[\x22\x27])Java(?P=q)/Ri"; content:!"[\x22\x27])(?:(?!(?P=q)).)+?<[^\x22\x27]*?a[^\x22\x27]*?p[^\x22\x27]*?p[^\x22\x27]*?l[^\x22\x27]*?e[^\x22\x27]*?t[^\x22\x27](?:(?!(?P=q)).)+?<[^\x22\x27]*?p[^\x22\x27]*?a[^\x22\x27]*?r[^\x22\x27]*?a[^\x22\x27]*?m/Rs"; classtype:trojan-activity; sid:2017450; rev:3; metadata:created_at 2013_09_11, updated_at 2013_09_11;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"GPL TFTP root directory"; content:"|00 01|/"; depth:3; reference:cve,1999-0183; classtype:bad-unknown; sid:2100520; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS DotkaChef Payload October 09"; flow:to_server,established; content:"sm_main.mp3"; http_uri; fast_pattern; content:"Java/1."; http_header; classtype:trojan-activity; sid:2017580; rev:2; metadata:created_at 2013_10_11, updated_at 2013_10_11;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"GPL TFTP parent directory"; content:".."; offset:2; reference:cve,1999-0183; reference:cve,2002-1209; classtype:bad-unknown; sid:2100519; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS D-LINK Router Backdoor via Specific UA"; flow:to_server,established; content:"xmlset_roodkcableoj28840ybtide"; http_user_agent; reference:url,www.devttys0.com/2013/10/reverse-engineering-a-d-link-backdoor/; classtype:attempted-admin; sid:2017590; rev:3; metadata:created_at 2013_10_14, updated_at 2013_10_14;) -alert udp $EXTERNAL_NET any -> $HOME_NET 5632 (msg:"GPL POLICY PCAnywhere server response"; content:"ST"; depth:2; classtype:misc-activity; sid:2100566; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Tenda Router Backdoor 1"; content:"w302r_mfg|00|"; depth:10; reference:url,www.devttys0.com/2013/10/from-china-with-love/; classtype:attempted-admin; sid:2017623; rev:3; metadata:created_at 2013_10_21, updated_at 2013_10_21;) -alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"GPL DNS zone transfer UDP"; content:"|00 00 FC|"; offset:14; reference:cve,1999-0532; reference:nessus,10595; classtype:attempted-recon; sid:2101948; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Tenda Router Backdoor 2"; content:"rlink_mfg|00|"; depth:10; reference:url,www.devttys0.com/2013/10/from-china-with-love/; classtype:attempted-admin; sid:2017624; rev:3; metadata:created_at 2013_10_21, updated_at 2013_10_21;) -alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"GPL DNS named version attempt"; content:"|07|version"; offset:12; nocase; content:"|04|bind|00|"; offset:12; nocase; reference:nessus,10028; classtype:attempted-recon; sid:2101616; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS 81a338 Hacked Site Response (Outbound)"; flow:established,from_server; file_data; content:""; fast_pattern:only; classtype:trojan-activity; sid:2017625; rev:6; metadata:created_at 2013_10_22, updated_at 2013_10_22;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 32771 (msg:"GPL RPC portmap listing UDP 32771"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 04|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:rpc-portmap-decode; sid:2101281; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS 81a338 Hacked Site Response (Inbound)"; flow:established,from_server; file_data; content:""; fast_pattern:only; classtype:trojan-activity; sid:2017626; rev:7; metadata:created_at 2013_10_22, updated_at 2013_10_22;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 177 (msg:"GPL MISC xdmcp query"; content:"|00 01 00 03 00 01 00|"; classtype:attempted-recon; sid:2100517; rev:2; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS FlashPack Oct 23 2013"; flow:to_server,established; content:".php?cashe="; http_uri; fast_pattern:only; content:"Java/1."; http_user_agent; pcre:"/\.php\?cashe=\d+$/U"; classtype:trojan-activity; sid:2017629; rev:4; metadata:created_at 2013_10_23, updated_at 2013_10_23;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 123 (msg:"GPL EXPLOIT ntpdx overflow attempt"; dsize:>128; reference:bugtraq,2540; reference:cve,2001-0414; classtype:attempted-admin; sid:2100312; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Netgear WNDR4700 Auth Bypass"; flow:to_server,established; content:"/BRS_03B_haveBackupFile_fileRestore.html"; http_uri; nocase; reference:url,securityevaluators.com/content/case-studies/routers/netgear_wndr4700.jsp; classtype:attempted-admin; sid:2017631; rev:2; metadata:created_at 2013_10_25, updated_at 2013_10_25;) -alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"GPL RPC portmap ypupdated request UDP"; content:"|00 01 86 A0|"; depth:4; offset:12; content:"|00 00 00 03|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|00 01 86 BC|"; within:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:rpc-portmap-decode; sid:2101277; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Netgear WNDR3700 Auth Bypass"; flow:to_server,established; content:"/BRS_02_genieHelp.html"; http_uri; nocase; reference:url,shadow-file.blogspot.ro/2013/10/complete-persistent-compromise-of.html; classtype:attempted-admin; sid:2017632; rev:2; metadata:created_at 2013_10_25, updated_at 2013_10_25;) -alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"GPL DNS named iquery attempt"; content:"|09 80 00 00 00 01 00 00 00 00|"; depth:16; offset:2; reference:bugtraq,134; reference:cve,1999-0009; reference:url,www.rfc-editor.org/rfc/rfc1035.txt; classtype:attempted-recon; sid:2100252; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS SibHost Jar Request"; flow:established,to_server; content:".jar?m="; http_uri; content:"|29 20|Java/1"; http_user_agent; fast_pattern:only; pcre:"/\.jar\?m=[1-2]$/U"; classtype:trojan-activity; sid:2015951; rev:17; metadata:created_at 2012_11_28, updated_at 2012_11_28;) -alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"GPL DNS named authors attempt"; content:"|07|authors"; offset:12; nocase; content:"|04|bind|00|"; offset:12; nocase; reference:nessus,10728; classtype:attempted-recon; sid:2100256; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible SibHost PDF Request"; flow:established,to_server; content:".pdf?p=1&s="; http_uri; fast_pattern:only; pcre:"/\.pdf\?p=1&s=[1-2]$/U"; classtype:trojan-activity; sid:2016035; rev:3; metadata:created_at 2012_12_14, updated_at 2012_12_14;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Driveby Exploit Kit Browser Progress Checkin - Binary Likely Previously Downloaded"; flow:established,to_server; content:"/?"; http_uri; content:!" Java/"; http_header; pcre:"/\/\?[a-f0-9]{64}\;\d\;\d/U"; classtype:exploit-kit; sid:2013098; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_06_22, deployment Perimeter, former_category EXPLOIT_KIT, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) +#alert http any any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Alpha Networks ADSL2/2+ router remote administration password disclosure"; flow:to_server,established; content:"/APIS/returnJSON.htm"; http_uri; reference:url,packetstorm.foofus.com/1208-exploits/asl26555_pass_disclosure.txt; classtype:attempted-admin; sid:2017638; rev:2; metadata:created_at 2013_10_28, updated_at 2013_10_28;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER Muieblackcat scanner"; flow:established,to_server; content:"GET /muieblackcat HTTP/1.1"; depth:26; classtype:attempted-recon; sid:2013115; rev:3; metadata:created_at 2011_06_24, updated_at 2011_06_24;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Host Domain .bit"; flow:established,to_server; content:".bit|0D 0A|"; fast_pattern:only; http_header; pcre:"/^Host\x3a [^\r\n]+?\.bit\r\n$/Hmi"; reference:url,www.normanshark.com/blog/necurs-cc-domains-non-censorable/; classtype:bad-unknown; sid:2017644; rev:2; metadata:created_at 2013_10_30, updated_at 2013_10_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED MacDefender OS X Fake AV Scareware"; flow:established,to_server; content:"GET"; http_method; content:"affid="; http_uri; content:"data="; http_uri; content:"v="; http_uri; content:"User-Agent|3a 20|MacShield"; http_header; reference:url,blog.spiderlabs.com/2011/06/analysis-and-evolution-of-macdefender-os-x-fake-av-scareware.html; classtype:trojan-activity; sid:2012958; rev:5; metadata:created_at 2011_06_09, updated_at 2011_06_09;) +#alert tcp $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Fredcot campaign IRC CnC"; flow:to_server,established; content:"JOIN #1111 ddosit"; reference:md5,e69bbd29f2822c1846d569ace710c9d5; reference:url,permalink.gmane.org/gmane.comp.security.ids.snort.emerging-sigs/20243; classtype:command-and-control; sid:2017665; rev:3; metadata:created_at 2013_11_05, former_category CURRENT_EVENTS, updated_at 2013_11_05;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 7580 (msg:"ET SCADA Siemens FactoryLink 8 CSService Logging Buffer Overflow Vulnerability"; flow:established,to_server; content:"CSService"; nocase; isdataat:1000,relative; content:!"|0A|"; within:1000; reference:url,packetstormsecurity.org/files/view/102579/factorylink_csservice.rb.txt; classtype:denial-of-service; sid:2013120; rev:1; metadata:created_at 2011_06_28, updated_at 2011_06_28;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible WhiteLotus Java Payload"; flow:established,to_server; content:"Java/1."; http_user_agent; content:"/?"; depth:2; http_uri; pcre:"/^\/\?[A-Za-z0-9]+=(?P[^&]+)&(?P=v1)=[^\/\.]+$/U"; classtype:trojan-activity; sid:2017739; rev:4; metadata:created_at 2013_11_21, updated_at 2013_11_21;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED RiskTool.Win32.WFPDisabler Reporting"; flow:established,to_server; content:"GET"; http_method; content:"/go.asp?"; nocase; http_uri; content:"svid="; nocase; http_uri; content:"id="; nocase; http_uri; content:"tpages="; nocase; http_uri; content:"ttimes="; nocase; http_uri; content:"tzone="; nocase; http_uri; content:"tcolor="; nocase; http_uri; content:"vpage="; http_uri; nocase; reference:md5,c81be1cf10d9578803dab8c1bc62ccfa; classtype:web-application-attack; sid:2012588; rev:4; metadata:created_at 2011_03_28, updated_at 2011_03_28;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Fake Media Player malware binary requested"; flow:established,to_server; content:"&filename=Media Player "; http_uri; content:".exe"; http_uri; classtype:trojan-activity; sid:2017745; rev:2; metadata:created_at 2013_11_22, updated_at 2013_11_22;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Vilsel.ayjv Checkin (aid)"; flow:to_server,established; content:"?aid="; http_uri; content:"&si="; http_uri; content:"&rd="; http_uri; pcre:"/&si=\d+&si=\d+&rd=20\d{11}/U"; classtype:command-and-control; sid:2013122; rev:5; metadata:created_at 2011_06_29, former_category MALWARE, updated_at 2011_06_29;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS JJEncode Encoded Script Inside of PDF Likely Evil"; flow:established,from_server; flowbits:isset,ET.pdf.in.http; file_data; content:"|2c 24 24 24 24 3a 28 21 5b 5d 2b 22 22 29 5b|"; reference:md5,6776bda19a3a8ed4c2870c34279dbaa9; classtype:trojan-activity; sid:2017789; rev:4; metadata:created_at 2013_11_30, updated_at 2013_11_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Black Ice Fax Voice SDK GetFirstItem Method Remote Code Execution Exploit"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000/si"; reference:url,exploit-db.com/exploits/17416; classtype:attempted-user; sid:2013132; rev:2; metadata:created_at 2011_06_29, updated_at 2011_06_29;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Polling/Check-in/Compromise from fake DHL mailing campaign"; flow:established,to_server; content:"/golden/index.php"; http_uri; content:" MSIE 7.0"; http_header; content:"q=0.1|0d 0a|"; http_header; classtype:trojan-activity; sid:2017791; rev:2; metadata:created_at 2013_12_02, updated_at 2013_12_02;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Black Ice Fax Voice SDK GetItemQueue Method Remote Code Execution Exploit"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000/si"; reference:url,exploit-db.com/exploits/17416; classtype:attempted-user; sid:2013131; rev:2; metadata:created_at 2011_06_29, updated_at 2011_06_29;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET CURRENT_EVENTS Hostile fake DHL mailing campaign"; flow:established,to_server; content:"but no one bell unresponsive"; content:"The best regard DHL.com."; content:"filename=Notice"; classtype:trojan-activity; sid:2017792; rev:2; metadata:created_at 2013_12_02, updated_at 2013_12_02;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Black Ice Cover Page SDK DownloadImageFileURL Method Exploit"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*79956462-F148-497F-B247-DF35A095F80B/si"; reference:url,exploit-db.com/exploits/17415/; reference:cve,2008-2683; classtype:attempted-user; sid:2013130; rev:2; metadata:created_at 2011_06_29, updated_at 2011_06_29;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Safe/CritX/FlashPack Edwards Packed PluginDetect"; flow:established,to_client; file_data; content:"|7C|PluginDetect|7C|"; classtype:exploit-kit; sid:2017815; rev:2; metadata:created_at 2013_12_06, former_category CURRENT_EVENTS, updated_at 2013_12_06;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32.VB.OWR Checkin"; flow:to_server,established; content:"|12 01 00|"; depth:3; content:"|00 00 00 00 00 00 15 00 06 01 00 1B 00 01 02 00 1C 00|"; within:19; reference:md5,7684532e7e1d717427f6842e9d5ecd56; classtype:trojan-activity; sid:2013121; rev:3; metadata:created_at 2011_06_28, updated_at 2011_06_28;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS SofosFO/GrandSoft PDF"; flow:established,from_server; file_data; content:"/TM(gawgewafgwe[0].#subform[0]"; classtype:trojan-activity; sid:2017905; rev:3; metadata:created_at 2013_12_27, updated_at 2013_12_27;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FakeAV FakeAlert.Rena.n Checkin Flowbit set"; flow:established,to_server; content:"/1020000"; http_uri; depth:8; content:" HTTP/1.0|0d 0a|"; http_header; flowbits:set,ET.fakealert.rena.n; flowbits:noalert; classtype:command-and-control; sid:2013135; rev:1; metadata:created_at 2011_06_29, former_category MALWARE, updated_at 2011_06_29;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS TDS Unknown_.aso - URI - IP.aso"; flow:established,to_server; content:".aso"; http_uri; fast_pattern:only; pcre:"/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.aso$/U"; classtype:bad-unknown; sid:2017906; rev:2; metadata:created_at 2013_12_27, updated_at 2013_12_27;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE SymbOS/Yxes KernelPara.jsp CnC Checkin Message"; flow:established,to_server; content:"/KernelPara.jsp?Version="; http_uri; fast_pattern:only; content:"&PhoneType="; http_uri; reference:url,blog.fortinet.com/symbosyxes-goes-version-2/; classtype:command-and-control; sid:2013143; rev:2; metadata:attack_target Mobile_Client, created_at 2011_06_30, former_category MOBILE_MALWARE, updated_at 2011_06_30, mitre_tactic_id TA0037, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Current Asprox Spam Campaign"; flow:established,to_server; urilen:>60; content:"/viewtopic.php?"; http_uri; fast_pattern:only; pcre:"/\/viewtopic\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$/U"; classtype:trojan-activity; sid:2018041; rev:4; metadata:created_at 2014_01_30, updated_at 2014_01_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Mozilla Firefox nsTreeSelection Element invalidateSelection Remote Code Execution Attempt"; flow:established,to_client; content:"document.getElementById(|27|treeset|27|)"; nocase; content:"view.selection"; nocase; distance:0; content:"invalidateRange"; nocase; distance:0; reference:bid,41853; reference:cve,2010-2753; classtype:attempted-user; sid:2013144; rev:2; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_06_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Current Asprox Spam Campaign 2"; flow:established,to_server; urilen:>60; content:"/handler.php?"; http_uri; fast_pattern:only; pcre:"/\/handler\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$/U"; classtype:trojan-activity; sid:2018135; rev:3; metadata:created_at 2014_02_14, updated_at 2014_02_14;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Download of PDF With Compressed Flash Content"; flowbits:noalert; flow:established,to_client; content:"stream"; content:"|0A|CWS"; within:5; fast_pattern; pcre:"/stream(\x0D\x0A|\x0A)CWS/"; flowbits:set,ET.flash.pdf; reference:url,www.symantec.com/connect/blogs/analysis-zero-day-exploit-adobe-flash-and-reader; reference:url,blog.zynamics.com/2010/06/09/analyzing-the-currently-exploited-0-day-for-adobe-reader-and-adobe-flash/; classtype:misc-activity; sid:2012907; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_05_31, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS OnClick Anti-BOT TDS POST Feb 25 2014"; flow:established,to_server; content:"POST"; http_method; content:"/tds/"; http_uri; fast_pattern:only; nocase; pcre:"/\/tds\/[a-f0-9]{32}$/U"; content:"ua="; http_client_body; content:"ip="; http_client_body; classtype:trojan-activity; sid:2018177; rev:5; metadata:created_at 2014_02_26, updated_at 2014_02_26;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Adobe Multimedia Doc.media.newPlayer Memory Corruption Attempt"; flow:to_client,established; content:"PDF-"; depth:300; content:"this.media.newPlayer|28|null"; nocase; distance:0; content:"util.printd"; nocase; within:150; reference:url,www.metasploit.com/redmine/projects/framework/repository/revisions/7881/entry/modules/exploits/windows/fileformat/adobe_media_newplayer.rb; reference:url,vrt-sourcefire.blogspot.com/2009/12/adobe-reader-medianewplayer-analysis.html; reference:bid,37331; reference:cve,2009-4324; classtype:attempted-user; sid:2010495; rev:13; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS OnClick Anti-BOT TDS Hidden Form Feb 25 2014"; flow:established,from_server; file_data; content:" $HOME_NET any (msg:"ET WEB_CLIENT Adobe Shockwave rcsL Chunk Remote Code Execution Attempt"; flow:established,to_client; content:"rcsL"; content:"|FF F0 02 67|"; fast_pattern; distance:0; reference:url,www.abysssec.com/blog/2010/10/adobe-shockwave-player-rcsl-chunk-memory-corruption-0day/; reference:bid,42682; reference:cve,2010-2873; classtype:attempted-user; sid:2013069; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_06_20, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible FakeAV .exe.vbe HTTP Content-Disposition"; flow:established,to_client; content:".exe.vbe"; http_header; nocase; fast_pattern:only; pcre:"/Content-Disposition\x3a[^\r\n]*?\.exe\.vbe/Hi"; reference:url,www.malwaresigs.com/2014/02/07/fakeav-is-still-alive/; classtype:trojan-activity; sid:2018190; rev:3; metadata:created_at 2014_02_27, updated_at 2014_02_27;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Adobe Shockwave Director tSAC Chunk memory corruption Attempt"; flowbits:isset,ET.flash.pdf; flow:established,to_client; content:"tSAC|1D 02|"; fast_pattern; content:"|01 00 FF FF 11 11|"; distance:0; reference:url,www.exploit-db.com/moaub-22-adobe-shockwave-director-tsac-chunk-memory-corruption/; classtype:attempted-user; sid:2013070; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_06_20, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS CritX/SafePack/FlashPack SilverLight file as eot"; flow:established,from_server; content:"Content-Type|3a 20|application/vnd.ms-fontobject|0d 0a|"; http_header; file_data; content:"PK"; within:2; content:"AppManifest.xaml"; distance:0; fast_pattern; classtype:exploit-kit; sid:2018237; rev:2; metadata:created_at 2014_03_08, former_category CURRENT_EVENTS, updated_at 2014_03_08;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT PDF Name Representation Obfuscation of OpenAction"; flow:established,to_client; content:"obj"; content:"<<"; within:4; content:"/"; within:50; content:!"OpenAction"; within:10; content:"#"; within:28; pcre:"/\x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^OpenAction](O|#4F)(p|#70)(e|#65)(n|#6E)(A|#41)(c|#63)(t|#74)(i|#69)(o|#6F)(n|#6E)/smi"; reference:url,blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/; classtype:bad-unknown; sid:2011537; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_27, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Safe/CritX/FlashPack Common Filename javadb.php"; flow:established,to_server; content:"/javadb.php"; http_uri; fast_pattern:only; classtype:exploit-kit; sid:2018238; rev:4; metadata:created_at 2014_03_08, former_category CURRENT_EVENTS, updated_at 2014_03_08;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT PDF Name Representation Obfuscation of JS"; flow:established,to_client; content:"obj"; content:"<<"; within:4; content:"/"; within:50; content:!"JS"; within:2; content:"#"; within:4; pcre:"/\x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^JS](J|#4A)(S|#53)/smi"; reference:url,blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/; classtype:bad-unknown; sid:2011535; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_27, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Safe/CritX/FlashPack Common Filename javaim.php"; flow:established,to_server; content:"/javaim.php"; http_uri; fast_pattern:only; classtype:exploit-kit; sid:2018239; rev:2; metadata:created_at 2014_03_08, former_category CURRENT_EVENTS, updated_at 2014_03_08;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT PDF Name Representation Obfuscation of EmbeddedFile"; flow:established,to_client; content:"obj"; content:"<<"; within:4; content:"/"; within:50; content:!"EmbeddedFile"; within:12; content:"#"; within:34; pcre:"/\x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^EmbeddedFile](E|#45)(m|#6D)(b|#62)(e|#65)(d|#64)(d|#64)(e|#65)(d#64)(F|#46)(i|#69)(l|#6C)(e|#65)/smi"; reference:url,blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/; classtype:bad-unknown; sid:2011530; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_27, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Safe/CritX/FlashPack Common Filename javarh.php"; flow:established,to_server; content:"/javarh.php"; http_uri; fast_pattern:only; classtype:exploit-kit; sid:2018240; rev:2; metadata:created_at 2014_03_08, former_category CURRENT_EVENTS, updated_at 2014_03_08;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT PDF Name Representation Obfuscation of Type"; flow:established,to_client; content:"obj"; content:"<<"; within:4; content:"/"; within:50; content:!"Type"; within:4; content:"#"; within:11; pcre:"/\x3C\x3C[^>]*\x2F[^Type](T|#54)(y|#79)(p|#70)(e|#65)/smi"; reference:url,blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/; classtype:bad-unknown; sid:2011531; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_27, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http any any -> any any (msg:"ET CURRENT_EVENTS Dell Kace backdoor"; flow:established,to_server; content:"POST"; http_method; content:"/kbot_upload.php"; nocase; http_uri; content:"filename=db.php"; nocase; distance:0; http_uri; content:"machineId="; nocase; pcre:"/(?:\.\.\/)+kboxwww\/tmp\//Ri"; content:"KSudoClient.class.php"; nocase; http_client_body; content:"KSudoClient|3a 3a|RunCommand"; distance:0; http_client_body; reference:url,console-cowboys.blogspot.com/2014/03/the-curious-case-of-ninjamonkeypiratela.html; classtype:attempted-admin; sid:2018263; rev:2; metadata:created_at 2014_03_13, former_category CURRENT_EVENTS, updated_at 2014_03_13;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT PDF Name Representation Obfuscation of Javascript"; flow:established,to_client; content:"obj"; content:"<<"; within:4; content:"/"; within:50; content:!"Javascript"; within:10; content:"#"; within:28; pcre:"/\x3C\x3C[^\n]*\x2F[^Javascript](J|#4A)(a|#61)(v|#76)(a|#61)(S|#73|#53)(c|#63)(r|#72)(i|#69)(p|#70)(t|#74)/smi"; reference:url,blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/; classtype:bad-unknown; sid:2011532; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_27, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS EMET.DLL in jjencode"; flow:established,from_server; file_data; content:"|22 5c 5c 5c 5c 5c 5c 5c 5c 5c 5c 22|+"; pcre:"/^(?P.{1,10})\.\_\_\$\+(?P=var)\.\_\_\_\+(?P=var)\.\$\_\$\+\x22\x5c\x5c\x22\+(?P=var)\.\_\_\$\+(?P=var)\.\_\_\$\+(?P=var)\.\$\_\$\+\x22\x5c\x5c\x22\+(?P=var)\.\_\_\$\+(?P=var)\.\_\_\_\+(?P=var)\.\$\_\$\+\x22\x5c\x5c\x22\+(?P=var)\.\_\_\$\+(?P=var)\.\_\$\_\+(?P=var)\.\$\_\_\+\x22\.\x5c\x5c\x22\+(?P=var)\.\_\_\$\+(?P=var)\.\_\_\_\+(?P=var)\.\$\_\_\+\x22\x5c\x5c\x22\+(?P=var)\.\_\_\$\+(?P=var)\.\_\_\$\+(?P=var)\.\$\_\_\+\x22\x5c\x5c\x22\+(?P=var)\.\_\_\$\+(?P=var)\.\_\_\$\+(?P=var)\.\$\_\_\+\x22/R"; classtype:trojan-activity; sid:2018286; rev:3; metadata:created_at 2014_03_18, updated_at 2014_03_18;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT PDF Name Representation Obfuscation of URL"; flow:established,to_client; content:"obj"; content:"<<"; within:4; content:"/"; within:50; content:!"URL"; within:3; content:"#"; within:7; pcre:"/\x3C\x3C[^>]*\x2F[^URL](U|#55)(R|#52)(L|#4C)/smi"; reference:url,blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/; classtype:bad-unknown; sid:2011533; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_27, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Deep Panda WateringHole Related URI Struct"; flow:established,to_server; content:".php?v=webhp"; fast_pattern:only; http_uri; nocase; classtype:trojan-activity; sid:2018348; rev:3; metadata:created_at 2014_04_02, updated_at 2014_04_02;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE SymbOS/Yxes CnC Checkin Message"; flow:established,to_server; content:".jsp?Version="; http_uri; content:"&PhoneType="; http_uri; content:"&PhoneImei="; http_uri; content:"PhoneImsi="; http_uri; content:"&PhoneNumber="; http_uri; content:"&Succeed="; http_uri; content:"&Fail="; http_uri; content:"&Source="; http_uri; content:"&Time="; http_uri; reference:url,blog.fortinet.com/symbosyxes-goes-version-2/; classtype:command-and-control; sid:2013140; rev:3; metadata:attack_target Mobile_Client, created_at 2011_06_30, former_category MOBILE_MALWARE, updated_at 2011_06_30, mitre_tactic_id TA0037, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +#alert http $HOME_NET any -> any any (msg:"ET CURRENT_EVENTS Win32.RBrute Scan (Outgoing)"; flow:to_server,established; urilen:1; content:"/"; http_uri; content:"Microsoft-WebDAV-MiniRedir/5.1.2600"; http_user_agent; depth:35; content:"Referer|3a 20|http|3a|//"; pcre:"/^Host\x3a (?P\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(?P=ipaddr)\//Hs"; reference:md5,f8ff430aee52da3b4b1759700be9aead; reference:url,www.welivesecurity.com/2014/04/02/win32sality-newest-component-a-routers-primary-dns-changer-named-win32rbrute/; classtype:attempted-recon; sid:2018353; rev:4; metadata:created_at 2014_04_03, former_category CURRENT_EVENTS, updated_at 2014_04_03;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible CVE-2011-2110 Flash Exploit Attempt Embedded in Web Page"; flow:established,to_client; content:" any any (msg:"ET CURRENT_EVENTS Win32.RBrute Scan (incoming)"; flow:to_server,established; urilen:1; content:"/"; http_uri; content:"Microsoft-WebDAV-MiniRedir/5.1.2600"; depth:35; http_user_agent; content:"Referer|3a 20|http|3a|//"; pcre:"/^Host\x3a (?P\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(?P=ipaddr)\//Hs"; reference:md5,f8ff430aee52da3b4b1759700be9aead; reference:url,www.welivesecurity.com/2014/04/02/win32sality-newest-component-a-routers-primary-dns-changer-named-win32rbrute/; classtype:attempted-recon; sid:2018354; rev:4; metadata:created_at 2014_04_03, former_category CURRENT_EVENTS, updated_at 2014_04_03;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Possible CVE-2011-2110 Flash Exploit Attempt"; flow:established,to_server; content:"GET /"; depth:5; content:".swf?info=02"; http_uri; reference:url,www.shadowserver.org/wiki/pmwiki.php/Calendar/20110617; classtype:trojan-activity; sid:2013065; rev:4; metadata:created_at 2011_06_17, former_category CURRENT_EVENTS, updated_at 2011_06_17;) +#alert http any 80 -> any any (msg:"ET CURRENT_EVENTS Win32.RBrute http response"; flow:to_client,established; file_data; content:"kenji oke|0d 0a|"; depth:24; flowbits:isset,ET.Rbrute.incoming; reference:md5,055a9be75e469f8817c9311390a449f6; reference:url,www.welivesecurity.com/2014/04/02/win32sality-newest-component-a-routers-primary-dns-changer-named-win32rbrute/; classtype:trojan-activity; sid:2018356; rev:3; metadata:created_at 2014_04_04, updated_at 2014_04_04;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE SymbOS/Yxes Plugucsrv.sisx File Download"; flow:established,to_server; content:"plugucsrv.sisx"; http_uri; fast_pattern:only; reference:url,blog.fortinet.com/symbosyxes-goes-version-2/; classtype:trojan-activity; sid:2013141; rev:3; metadata:created_at 2011_06_30, updated_at 2011_06_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Phoenix/Fiesta URI Requested Contains /? and hex"; flow:established,to_server; content:"/?"; http_uri; fast_pattern; pcre:"/\/\?[0-9a-f]{60,66}[\;\d\x2c]*$/U"; classtype:exploit-kit; sid:2013094; rev:9; metadata:created_at 2011_06_22, former_category CURRENT_EVENTS, updated_at 2011_06_22;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED KazaaClient P2P Traffic"; flow: established; content:"Agent|3a| KazaaClient"; nocase; reference:url,www.kazaa.com/us/index.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2001812; classtype:policy-violation; sid:2001812; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"ET CURRENT_EVENTS Possible Inbound SNMP Router DoS (TTL 1)"; byte_jump:1,6; content:"|a3|"; within:1; content:"|30 0d 06 08 2b 06 01 02 01 04 02 00 02 01 01|"; distance:9; threshold: type limit, track by_src, count 1, seconds 120; classtype:attempted-dos; sid:2018568; rev:1; metadata:created_at 2014_06_17, updated_at 2014_06_17;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX LEADTOOLS Imaging LEADSmtp ActiveX SaveMessage Method Vulnerability"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F/si"; reference:bugtraq,48408; classtype:attempted-user; sid:2013163; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_07_01, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"ET CURRENT_EVENTS Possible Inbound SNMP Router DoS (Disable Forwarding)"; byte_jump:1,6; content:"|a3|"; within:1; content:"|30 0d 06 08 2b 06 01 02 01 04 01 00 02 01 02|"; distance:9; threshold: type limit, track by_src, count 1, seconds 120; classtype:attempted-dos; sid:2018569; rev:1; metadata:created_at 2014_06_17, updated_at 2014_06_17;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Ubisoft CoGSManager ActiveX RunCore method Buffer Overflow Vulnerability"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289/si"; reference:url,secunia.com/advisories/45044; classtype:attempted-user; sid:2013162; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_07_01, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Likely Evil XMLDOM Detection of Local File"; flow:from_server,established; file_data; content:"-2147023083"; nocase; fast_pattern:only; content:"res|3a 2f|"; nocase; content:" $HOME_NET any (msg:"ET ACTIVEX Ubisoft CoGSManager ActiveX Initialize method Buffer Overflow Vulnerability"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289/si"; reference:url,secunia.com/advisories/45044; classtype:attempted-user; sid:2013161; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_07_01, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible ShellCode Passed as Argument to FlashVars"; flow:from_server,established; file_data; content:",0x"; fast_pattern; content:",0x"; distance:8; within:3; content:",0x"; distance:8; within:3; content:"FlashVars"; nocase; content:").)+?FlashVars)(?:(?!<\/>).)+?value\s*?=\s*?[\x22\x27][^=\x22\x27]+=(?:0x[a-f0-9]{8},){15}/Rsi"; classtype:trojan-activity; sid:2018785; rev:3; metadata:created_at 2014_07_26, updated_at 2014_07_26;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX CygniCon CyViewer ActiveX Control SaveData Insecure Method Vulnerability"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A6FC2988-16BE-4053-BE89-F562431FD6ED/si"; reference:bugtraq,48483; classtype:attempted-user; sid:2013160; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_07_01, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Safe/CritX/FlashPack Java Payload"; flow:established,to_server; content:"/load"; http_uri; fast_pattern:only; content:".php?id="; content:"Java/1."; http_user_agent; classtype:exploit-kit; sid:2019008; rev:8; metadata:created_at 2014_08_26, former_category CURRENT_EVENTS, updated_at 2014_08_26;) -#alert http any any -> $HOME_NET any (msg:"ET EXPLOIT 2Wire Password Reset Vulnerability via GET"; flow:established,to_server; content:"/xslt?PAGE=H04_POST&THISPAGE=H04&NEXTPAGE="; http_uri; content:"&PASSWORD="; http_uri; distance:0; content:"&PASSWORD_CONF="; http_uri; distance:0; reference:url,www.seguridad.unam.mx/doc/?ap=articulo&id=196; reference:url,packetstormsecurity.org/files/view/102614/2wire-reset.rb.txt; classtype:attempted-admin; sid:2013165; rev:2; metadata:created_at 2011_07_01, updated_at 2011_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Safe/CritX/FlashPack Payload"; flow:established,to_server; content:"/load"; http_uri; fast_pattern:only; content:".php"; http_uri; pcre:"/\/load(?:fla(2001[34]|0515)|msie\d{0,2}|20132551|jimage|silver|0322|db|im|rh)\.php/U"; content:!"Referer|3a|"; http_header; classtype:exploit-kit; sid:2017813; rev:9; metadata:created_at 2013_12_06, former_category CURRENT_EVENTS, updated_at 2013_12_06;) -#alert http any any -> $HOME_NET any (msg:"ET EXPLOIT 2Wire Password Reset Vulnerability via POST"; flow:established,to_server; content:"/xslt"; http_uri; content:"PAGE=H04_POST&THISPAGE=H04&NEXTPAGE="; http_client_body; content:"&PASSWORD="; http_client_body; distance:0; content:"&PASSWORD_CONF="; http_client_body; distance:0; reference:url,www.seguridad.unam.mx/doc/?ap=articulo&id=196; reference:url,packetstormsecurity.org/files/view/102614/2wire-reset.rb.txt; classtype:attempted-admin; sid:2013166; rev:2; metadata:created_at 2011_07_01, updated_at 2011_07_01;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Offensive Security EMET Bypass Observed in BleedingLife Variant Aug 26 2014"; flow:established,to_client; file_data; content:"|22 25 75 22 2b 67 65 74 6d 6f 64 75 6c 65 77 31 2b 22 25 75 22 2b 67 65 74 6d 6f 64 75 6c 65 77 32 29|"; classtype:trojan-activity; sid:2019024; rev:3; metadata:created_at 2014_08_26, updated_at 2014_08_26;) -#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET MALWARE Backdoor Win32/IRCbot.FJ Cnc connection dns lookup"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|minerva|05|cdmon|03|org"; fast_pattern; distance:0; nocase; reference:url,www.bfk.de/bfk_dnslogger_en.html?query=minerva.cdmon.org; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3aWin32%2fIRCbot.FJ; reference:url,www.exposedbotnets.com/2011/02/minervacdmonorgbotnet-hosted-in.html; reference:md5,13e43c44681ba9acb8fd42217bd3dbd2; classtype:command-and-control; sid:2013187; rev:1; metadata:created_at 2011_07_05, former_category MALWARE, updated_at 2011_07_05;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS ScanBox Framework used in WateringHole Attacks"; flow:from_server,established; file_data; content:"scanbox.crypt._utf8_encode"; classtype:trojan-activity; sid:2019093; rev:3; metadata:created_at 2014_08_30, updated_at 2014_08_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Swizzor Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"c="; http_uri; content:"&wv="; http_uri; content:"&wd="; http_uri; content:"&ie="; http_uri; content:"User-Agent|3a| NSISDL/1.2 (Mozilla)"; http_header; reference:url,doc.emergingthreats.net/2008347; classtype:successful-recon-limited; sid:2008347; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS ScanBox Framework used in WateringHole Attacks (POST) PluginData"; flow:to_server,established; content:"POST"; http_method; content:"pluginid="; http_client_body; fast_pattern:only; content:"projectid="; http_client_body; content:"seed="; http_client_body; content:"data="; http_client_body; reference:url,www.alienvault.com/open-threat-exchange/blog/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks; classtype:trojan-activity; sid:2019095; rev:3; metadata:created_at 2014_08_30, updated_at 2014_08_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SafeFighter Fake Scanner Installation in Progress"; flow:established,to_server; content:"/safefighter.php"; nocase; http_uri; content:"User-Agent|3a| NSIS"; nocase; http_header; reference:url,doc.emergingthreats.net/2010065; classtype:trojan-activity; sid:2010065; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS ScanBox Framework used in WateringHole Attacks KeepAlive"; flow:to_server,established; content:"GET"; http_method; content:".php?seed="; http_uri; fast_pattern:only; content:"&alivetime="; http_uri; content:"&r="; http_uri; reference:url,www.alienvault.com/open-threat-exchange/blog/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks; classtype:trojan-activity; sid:2019096; rev:3; metadata:created_at 2014_08_30, updated_at 2014_08_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Client Visiting cssminibar.js Injected Website Malware Related"; flow:established,to_client; content:"/cssminibar.js|22|>"; nocase; fast_pattern:only; reference:url,blog.armorize.com/2011/06/mass-meshing-injection-sidenamejs.html; classtype:web-application-attack; sid:2013191; rev:2; metadata:created_at 2011_07_05, updated_at 2011_07_05;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible Microsoft Office PNG overflow attempt invalid tEXt chunk length"; flow:established,to_client; file_data; content:"|89 50 4E 47 0D 0A 1A 0A|"; content:"IHDR"; distance:0; content:"tEXt"; distance:13; byte_test:4,>,2147483647,-8,relative; reference:cve,2013-1331; reference:url,blogs.technet.com/b/srd/archive/2013/06/11/ms13-051-get-out-of-my-office.aspx; classtype:attempted-user; sid:2017005; rev:6; metadata:created_at 2013_06_12, updated_at 2013_06_12;) -#alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT cssminibar.js Injected Script Served by Local WebServer"; flow:established,from_server; content:"cssminibar.js|22|>"; nocase; fast_pattern:only; reference:url,blog.armorize.com/2011/06/mass-meshing-injection-sidenamejs.html; classtype:web-application-attack; sid:2013192; rev:2; metadata:created_at 2011_07_05, former_category CURRENT_EVENTS, updated_at 2011_07_05;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET CURRENT_EVENTS Possible TWiki RCE attempt"; flow:established,to_server; content:"debugenableplugins="; http_uri; pcre:"/debugenableplugins=[a-zA-Z0-9]+?\x3b/U"; reference:url,twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236; reference:cve,2014-7236; classtype:attempted-admin; sid:2019385; rev:2; metadata:created_at 2014_10_10, updated_at 2014_10_10;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MOBILE_MALWARE Android.CruseWin XML Configuration File Sent From CnC Server"; flowbits:isset,ET.And.CruseWin; flow:established,from_server; content:"http|3A|//"; nocase; content:"http|3A|//"; nocase; distance:0; content:" $EXTERNAL_NET any (msg:"ET MALWARE Trojan/Hacktool.Sniffer Initial Checkin"; flow:established,to_server; content:"/username.asp?Uid="; http_uri; fast_pattern:only; classtype:command-and-control; sid:2013198; rev:2; metadata:created_at 2011_07_05, former_category MALWARE, updated_at 2011_07_05;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS FlashPack Payload URI Struct Oct 16 2014"; flow:established,to_server; content:"/loxotrap.php"; http_uri; fast_pattern:only; classtype:trojan-activity; sid:2019456; rev:2; metadata:created_at 2014_10_16, updated_at 2014_10_16;) -#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT VSFTPD Backdoor User Login Smiley"; flow:established,to_server; content:"USER "; depth:5; content:"|3a 29|"; distance:0; classtype:attempted-admin; sid:2013188; rev:5; metadata:created_at 2011_07_05, updated_at 2011_07_05;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS BlackEnergy URI Struct Oct 17 2014 BE1"; flow:established,to_server; content:"/YXJyYWtpczAy/"; http_uri; reference:url,github.com/hosom/bro-sandworm/blob/master/sandworm.sig; classtype:trojan-activity; sid:2019461; rev:2; metadata:created_at 2014_10_17, updated_at 2014_10_17;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32.Hooker Checkin Message"; flow:established,to_server; content:"&lg="; http_uri; content:"&ntime="; http_uri; content:"&repeatip="; http_uri; content:"&rtime="; http_uri; content:"&sin="; http_uri; classtype:trojan-activity; sid:2013205; rev:3; metadata:created_at 2011_07_06, updated_at 2011_07_06;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS BlackEnergy URI Struct Oct 17 2014 BE2"; flow:established,to_server; content:"/aG91c2VhdHJlaWRlczk0/"; http_uri; reference:url,github.com/hosom/bro-sandworm/blob/master/sandworm.sig; classtype:trojan-activity; sid:2019462; rev:2; metadata:created_at 2014_10_17, updated_at 2014_10_17;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/Alworo CnC Checkin"; flow:established,to_server; content:".php?userid="; nocase; http_uri; content:"&time="; nocase; http_uri; content:"&msg="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&pauid="; nocase; http_uri; content:"&checkId="; nocase; http_uri; reference:url,us.norton.com/security_response/writeup.jsp?docid=2011-062909-5644-99&tabid=2; classtype:command-and-control; sid:2013215; rev:3; metadata:created_at 2011_07_06, updated_at 2011_07_06;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS BlackEnergy URI Struct Oct 17 2014 BE3"; flow:established,to_server; content:"/QmFzaGFyb2Z0aGVTYXJkYXVrYXJz/"; http_uri; reference:url,github.com/hosom/bro-sandworm/blob/master/sandworm.sig; classtype:trojan-activity; sid:2019463; rev:2; metadata:created_at 2014_10_17, updated_at 2014_10_17;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Backdoor.Specfix Checkin"; flow:established,to_server; content:"/AWS"; http_uri; content:".jsp?"; http_uri; content:"x-bigfix-client-string|3A|"; http_header; reference:url,us.norton.com/security_response/writeup.jsp?docid=2011-062203-3150-99&tabid=2; classtype:trojan-activity; sid:2013218; rev:2; metadata:created_at 2011_07_06, updated_at 2011_07_06;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS BlackEnergy URI Struct Oct 17 2014 BE4"; flow:established,to_server; content:"/U2FsdXNhU2VjdW5kdXMy/"; http_uri; reference:url,github.com/hosom/bro-sandworm/blob/master/sandworm.sig; classtype:trojan-activity; sid:2019464; rev:2; metadata:created_at 2014_10_17, updated_at 2014_10_17;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE JavaScript Redefinition of a HeapLib Object - Likely Malicious Heap Spray Attempt"; flow:established,to_client; content:"heap|2E|"; nocase; fast_pattern:only; pcre:"/var\x20[^\n\r]*\x3D[^\n\r]*heap\x2E/smi"; classtype:shellcode-detect; sid:2013148; rev:3; metadata:created_at 2011_06_30, updated_at 2011_06_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS BlackEnergy URI Struct Oct 17 2014 BE5"; flow:established,to_server; content:"/ZXBzaWxvbmVyaWRhbmkw/"; http_uri; reference:url,github.com/hosom/bro-sandworm/blob/master/sandworm.sig; classtype:trojan-activity; sid:2019465; rev:2; metadata:created_at 2014_10_17, updated_at 2014_10_17;) -alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"GPL TFTP Put"; content:"|00 02|"; depth:2; reference:cve,1999-0183; classtype:bad-unknown; sid:2100518; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS FlashPack Payload URI Struct Oct 22 2014"; flow:established,to_server; content:"/ldcigar.php"; http_uri; fast_pattern:only; classtype:trojan-activity; sid:2019487; rev:2; metadata:created_at 2014_10_22, updated_at 2014_10_22;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Microsoft Internet Explorer ieframe.dll Script Injection Vulnerability"; flow:to_server; content:"GET"; http_method; content:"res|3a|"; http_uri; content:"ieframe.dll"; http_uri; content:"acr_error"; pcre:"/(\<\;).+(\>\;)/Ui"; reference:bugtraq,28581; reference:url,doc.emergingthreats.net/bin/view/Main/2008170; classtype:web-application-attack; sid:2008170; rev:8; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS SSL SinkHole Cert Possible Infected Host"; flow:established,from_server; content:"|14|www.kitchensinks.n0t"; nocase; classtype:trojan-activity; sid:2019503; rev:2; metadata:created_at 2014_10_24, updated_at 2014_10_24;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/IRCBrute Checkin 2"; flow:established,to_server; content:"/Dialer_Min/telcom.asp"; nocase; http_uri; reference:url,www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~DwnLdr-IRB/detailed-analysis.aspx; classtype:command-and-control; sid:2013225; rev:3; metadata:created_at 2011_07_07, former_category MALWARE, updated_at 2011_07_07;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible FlashPack (FlashOnly) Payload Struct Nov 19 2014"; flow:established,to_server; content:"GET"; http_method; content:"/load.php"; http_uri; fast_pattern:only; pcre:"/^\/[a-z0-9]+\/load\.php$/U"; content:!"User-Agent|3a|"; http_header; content:!"Accept|3a|"; http_header; content:!"Referer|3a|"; http_header; classtype:trojan-activity; sid:2019753; rev:2; metadata:created_at 2014_11_20, updated_at 2014_11_20;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Chilkat Crypt ActiveX Control SaveDecrypted Insecure Method Vulnerability"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B70AB61-5C95-4126-9985-A32531CA8619/si"; reference:bugtraq,48585; classtype:attempted-user; sid:2013233; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_07_08, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Magnitude Flash Payload"; flow:established,to_server; urilen:34; content:"/?"; http_uri; depth:2; fast_pattern; content:!"User-Agent"; http_header; content:!"Accept"; http_header; content:!"Referer"; http_header; pcre:"/^\/\?[a-f0-9]{32}$/U"; pcre:"/^Host\x3a\x20\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3}(?:\x3a\d{1,5})?\r\n/H"; classtype:exploit-kit; sid:2019800; rev:2; metadata:created_at 2014_11_25, former_category CURRENT_EVENTS, updated_at 2014_11_25;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX IDrive Online Backup ActiveX control SaveToFile Insecure Method"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*979AE8AA-C206-40EC-ACA7-EC6B6BD7BE5E/si"; reference:url,htbridge.ch/advisory/idrive_online_backup_activex_control_insecure_method.html; classtype:attempted-user; sid:2013232; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_07_08, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS SoakSoak Malware GET request"; flow:established,to_server; content:"GET"; http_method; content:"/xteas/code"; http_uri; fast_pattern:only; pcre:"/^Host\x3a[^\r\n]+soaksoak\.ru/Hmi"; pcre:"/^\/xteas\/code$/U"; reference:url,blog.sucuri.net/2014/12/soaksoak-malware-compromises-100000-wordpress-websites.html; classtype:trojan-activity; sid:2019939; rev:3; metadata:created_at 2014_12_16, updated_at 2014_12_16;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Known Injected Credit Card Fraud Malvertisement Script"; flow:established,to_client; content:"|3C|script|3E|ba|28 27|Windows.class|27 2C 27|Windows.jar|27 29 3B 3C 2F|script|3E|"; nocase; reference:url,blogs.paretologic.com/malwarediaries/index.php/2011/07/06/stolen-credit-cards-site-injected-with-malware/; classtype:misc-activity; sid:2013244; rev:2; metadata:created_at 2011_07_11, former_category CURRENT_EVENTS, updated_at 2011_07_11;) +#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Unauthorized SSL Cert for Google Domains"; flow:established,from_server; content:"|55 04 0a|"; content:"|0a|MCSHOLDING"; distance:1; within:11; reference:url,googleonlinesecurity.blogspot.com/2015/03/maintaining-digital-certificate-security.html; classtype:trojan-activity; sid:2020736; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_03_24, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;) -alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Ruskill/Palevo Download Command"; flow:established,to_server; content:"PRIVMSG #"; depth:9; content:"|3a 5b|d=|22|http|3a|//"; distance:0; reference:md5,2d69d8d243499ab53b840c64f68cc830; reference:url,sebdraven.tumblr.com/post/6769853139/palevo-analysises; classtype:trojan-activity; sid:2013245; rev:3; metadata:created_at 2011_07_11, updated_at 2011_07_11;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS IonCube Encoded Page (no alert)"; flow:established,from_server; file_data; content:"javascript>c=|22|"; content:"|3b|eval(unescape("; flowbits:noalert; flowbits:set,ET.IonCube; classtype:trojan-activity; sid:2020993; rev:2; metadata:created_at 2015_04_24, former_category CURRENT_EVENTS, updated_at 2015_04_24;) -alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Ruskill/Palevo CnC PONG"; flow:established,to_server; content:"PONG |3a|hub.us.com"; depth:16; reference:url,ore.carnivore.it/malware/hash/d4dc8459a34ea14d856e529d3a9e0362; reference:url,sebdraven.tumblr.com/post/6769853139/palevo-analysises; classtype:command-and-control; sid:2013246; rev:2; metadata:created_at 2011_07_11, former_category MALWARE, updated_at 2011_07_11;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS CritX/SafePack/FlashPack URI Format June 17 2013 3"; flow:established,to_server; content:".php?hash="; http_uri; fast_pattern:only; pcre:"/\/(?:java(?:byte|db)|o(?:utput|ther)|r(?:hino|otat)|msie\d|load)\.php\?hash=/U"; reference:url,www.malwaresigs.com/2013/06/14/slight-change-in-flashpack-uri/; classtype:exploit-kit; sid:2017024; rev:4; metadata:created_at 2013_06_18, former_category CURRENT_EVENTS, updated_at 2013_06_18;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Zapchast Bot User-Agent"; flow:established,to_server; content:"User-Agent|3a| MJ12bot/"; http_header; reference:url,www.majestic12.co.uk/bot.php; reference:url,doc.emergingthreats.net/2007781; classtype:trojan-activity; sid:2007781; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Evil JS iframe Embedded In GIF"; flow:established,from_server; file_data; content:"GIF89a="; nocase; within:8; content:"|3b|url="; nocase; distance:0; content:"iframe"; nocase; distance:0; content:"|3b|tail="; nocase; distance:0; fast_pattern; classtype:trojan-activity; sid:2021156; rev:2; metadata:created_at 2015_05_28, updated_at 2015_05_28;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Majestic-12 Spider Bot User-Agent (MJ12bot)"; flow:to_server,established; content:"User-Agent|3a| MJ12bot"; reference:url,www.majestic12.co.uk/; reference:url,doc.emergingthreats.net/2003409; classtype:trojan-activity; sid:2003409; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS NuclearPack - PDF Naming Algorithm"; flow:established,to_client; content:"-Disposition|3a| inline"; http_header; nocase; content:".pdf"; http_header; pcre:"/=\w{8}\.pdf/Hi"; content:"|0D 0A 0D 0A|%PDF"; fast_pattern; content:"/Filter/FlateDecode"; classtype:trojan-activity; sid:2014914; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_06_16, deployment Perimeter, malware_family Nuclear, signature_severity Critical, tag Exploit_Kit, tag Nuclear, updated_at 2016_07_01;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Majestic-12 Spider Bot User-Agent Inbound (MJ12bot)"; flow:to_server,established; content:"User-Agent|3a| MJ12bot"; http_header; reference:url,www.majestic12.co.uk/; reference:url,doc.emergingthreats.net/2007762; classtype:trojan-activity; sid:2007762; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible WhiteLotus IE Payload"; flow:established,to_server; content:"GET"; http_method; content:"/?"; depth:2; http_uri; fast_pattern; content:" MSIE "; http_user_agent; content:!"Referer|3a|"; http_header; content:"|0d 0a 0d 0a|"; pcre:"/^\/\?[A-Za-z0-9]+=(?P[^&]+)&(?P=v1)=[A-Za-z0-9]+$/U"; classtype:trojan-activity; sid:2017743; rev:4; metadata:created_at 2013_11_22, updated_at 2013_11_22;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible docs.google.com Activity"; flow:established,to_server; content:"WRITELY_SID"; nocase; reference:url,docs.google.com; reference:url,doc.emergingthreats.net/2003122; classtype:policy-violation; sid:2003122; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Adobe PDF Universal 3D file corrupted download 1"; flow:established,from_server; file_data; content:"/Subtype /U3D"; content:"< $EXTERNAL_NET any (msg:"ET POLICY docs.google.com Activity"; flow:established,to_server; content:"Host|3a| docs.google.com|0d 0a|"; http_header; nocase; reference:url,docs.google.com; reference:url,doc.emergingthreats.net/2003121; classtype:policy-violation; sid:2003121; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Adobe PDF Universal 3D file corrupted download 2"; flow:established,from_server; file_data; content:"/Subtype /U3D"; content:"/Contents (a pwning u3d model) /3DI false > /3DA << /A /PO /DIS /I >> /Rect [0 0 640 480] /3DD 10 0 R /F 7 >>"; distance:0; reference:url,www.adobe.com/support/security/advisories/apsa11-04.html; classtype:bad-unknown; sid:2013997; rev:6; metadata:created_at 2011_12_08, updated_at 2011_12_08;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Guagua Trojan Update Checkin"; flow:established,to_server; content:"/update_check?version="; http_uri; content:"User-Agent|3A| Update"; http_header; classtype:command-and-control; sid:2013259; rev:3; metadata:created_at 2011_07_13, former_category MALWARE, updated_at 2011_07_13;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS JavaScript Determining OS MAC and Serving Java Archive File"; flow:established,to_client; file_data; content:" $EXTERNAL_NET any (msg:"ET MALWARE Win32/Nekill Checkin"; flow:established,to_server; content:"?v="; http_uri; content:"&mid="; http_uri; content:"&r1="; http_uri; content:"&tm="; http_uri; content:"&av="; http_uri; content:"&os="; http_uri; content:"&uid="; http_uri; content:"&cht="; http_uri; content:"&sn="; http_uri; reference:url,blog.emergingthreatspro.com/2011/07/bot-of-day-nekilla.html; classtype:command-and-control; sid:2013260; rev:3; metadata:created_at 2011_07_13, former_category MALWARE, updated_at 2011_07_13;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Scalaxy Jar file"; flow:to_client,established; file_data; content:"PK"; depth:2; content:"C1.class"; fast_pattern; distance:0; content:"C2.class"; distance:0; flowbits:isset,ET.http.javaclient.vulnerable; classtype:trojan-activity; sid:2014983; rev:3; metadata:created_at 2012_06_29, updated_at 2012_06_29;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE SymbOS/CommDN Downloading Second Stage Malware Binary"; flow:established,to_server; content:"DGOManagerServer/file/TianXiangServer2.sisx"; nocase; http_uri; reference:url,www.fortiguard.com/encyclopedia/virus/symbos_commdn.a!tr.html; classtype:trojan-activity; sid:2013261; rev:2; metadata:created_at 2011_07_13, updated_at 2011_07_13;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Hacked Website Response /*km0ae9gr6m*/ Jun 25 2012"; flow:established,from_server; file_data; content:"/*km0ae9gr6m*/"; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; classtype:trojan-activity; sid:2014984; rev:5; metadata:created_at 2012_06_29, former_category CURRENT_EVENTS, updated_at 2012_06_29;) -alert ftp any any -> $HOME_NET any (msg:"ET SCAN Nessus FTP Scan detected (ftp_anonymous.nasl)"; flow:to_server,established; content:"pass nessus@"; depth:12; nocase; reference:url,www.nessus.org/plugins/index.php?view=single&id=10079; reference:url,osvdb.org/show/osvdb/69; classtype:attempted-recon; sid:2013263; rev:3; metadata:created_at 2011_07_13, updated_at 2011_07_13;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Hacked Website Response /*qhk6sa6g1c*/ Jun 25 2012"; flow:established,from_server; file_data; content:"/*qhk6sa6g1c*/"; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; classtype:trojan-activity; sid:2014985; rev:6; metadata:created_at 2012_06_29, former_category CURRENT_EVENTS, updated_at 2012_06_29;) -alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN Nessus FTP Scan detected (ftp_writeable_directories.nasl)"; flow:to_server,established; content:"MKD"; nocase; depth:3; content:"Nessus"; nocase; reference:url,www.nessus.org/plugins/index.php?view=single&id=19782; reference:url,osvdb.org/show/osvdb/76; classtype:attempted-recon; sid:2013264; rev:2; metadata:created_at 2011_07_13, updated_at 2011_07_13;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS FoxxySoftware - Comments"; flow:established,to_client; file_data; content:"FoxxySF Website Copier"; reference:url,blog.eset.com/2012/08/07/foxxy-software-outfoxed; classtype:trojan-activity; sid:2015583; rev:4; metadata:created_at 2012_08_07, updated_at 2012_08_07;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Banker.Delf Infection variant 2 - Sending Initial Email to Owner"; flow:established,to_server; content:"X-Library|3a| Indy 9"; nocase; content:"Nome Computador|3a| "; nocase; content:"Data|3a| "; nocase; reference:url,www.avira.com/en/threats/section/details/id_vir/1836/tr_banker.delf.df735649.html; reference:url,doc.emergingthreats.net/2002978; classtype:trojan-activity; sid:2002978; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET [443,465,993,995,25] -> $HOME_NET any (msg:"ET CURRENT_EVENTS excessive fatal alerts (possible POODLE attack against client)"; flow:from_server,established; ssl_version:sslv3; content:"|15 03 00 00|"; depth:4; byte_jump:2,3,post_offset -1; isdataat:!2,relative; threshold:type both, track by_dst, count 50, seconds 300; reference:url,blog.fox-it.com/2014/10/15/poodle/; reference:url,www.openssl.org/~bodo/ssl-poodle.pdf; reference:cve,2014-3566; reference:url,askubuntu.com/questions/537196/how-do-i-patch-workaround-sslv3-poodle-vulnerability-cve-2014-3566; reference:url,www.imperialviolet.org/2014/10/14/poodle.html; classtype:policy-violation; sid:2019417; rev:4; metadata:created_at 2014_10_15, updated_at 2016_06_21;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE SymbOS/SymGam CnC Checkin"; flow:established,to_server; content:"/ddown/getvalid.aspx"; nocase; http_uri; fast_pattern:only; reference:url,www.fortiguard.com/encyclopedia/virus/symbos_symgam.a!tr.html; classtype:command-and-control; sid:2013265; rev:2; metadata:attack_target Mobile_Client, created_at 2011_07_14, former_category MOBILE_MALWARE, updated_at 2011_07_14, mitre_tactic_id TA0037, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS FAKEIE 11.0 Minimal Headers (flowbit set)"; flow:to_server,established; content:" rv|3a|11.0"; http_header; content:!"Accept"; http_header; content:!"Referer|3a|"; http_header; pcre:"/^User-Agent\x3a[^\r\n]+rv\x3a11\.0[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x3a\x20no-cache\r\n(?:\r\n)?$/H"; flowbits:set,FakeIEMinimal; flowbits:noalert; reference:url,malware-traffic-analysis.net/2014/10/01/index.html; classtype:trojan-activity; sid:2019343; rev:3; metadata:created_at 2014_10_03, updated_at 2017_02_01;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MOBILE_MALWARE SymbOS/SymGam Receiving SMS Message Template from CnC Server"; flow:established,to_client; content:""; content:""; distance:0; reference:url,www.fortiguard.com/encyclopedia/virus/symbos_symgam.a!tr.html; classtype:command-and-control; sid:2013266; rev:2; metadata:created_at 2011_07_14, former_category MOBILE_MALWARE, updated_at 2011_07_14;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Request to .in FakeAV Campaign June 19 2012 exe or zip"; flow:established,to_server; content:"setup."; fast_pattern:only; http_uri; content:".in|0d 0a|"; http_header; pcre:"/\/[a-f0-9]{16}\/([a-z0-9]{1,3}\/)?setup\.(exe|zip)$/U"; pcre:"/^Host\x3a\s.+\.in\r?$/Hmi"; reference:url,isc.sans.edu/diary/+Vulnerabilityqueerprocessbrittleness/13501; classtype:trojan-activity; sid:2014929; rev:4; metadata:created_at 2012_06_22, former_category CURRENT_EVENTS, updated_at 2017_12_11;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Hex Obfuscated JavaScript Heap Spray 41414141"; flow:established,to_client; content:"|5C|x41|5C|x41|5C|x41|5C|x41"; nocase; fast_pattern:only; reference:url,www.darkreading.com/security/vulnerabilities/221901428/index.html; classtype:shellcode-detect; sid:2013273; rev:2; metadata:created_at 2011_07_14, former_category SHELLCODE, updated_at 2017_09_08;) +#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET CURRENT_EVENTS UPS Spam Inbound"; flow:established,to_server; content:"name=|22|"; nocase; content:"UPS"; nocase; within:11; content:".zip|22|"; within:74; nocase; pcre:"/name=\x22([a-z_]{0,8})?UPS(\s|_|\-)?[a-z0-9\-_\.\s]{0,69}\.zip\x22/i"; classtype:trojan-activity; sid:2014828; rev:3; metadata:created_at 2012_05_30, former_category CURRENT_EVENTS, updated_at 2017_12_11;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Sohanad Checkin via HTTP"; flow:established,to_server; content:"GET"; http_method; content:"/cs/bux/check.php"; http_uri; content:!"User-Agent|3a| "; http_header; reference:url,doc.emergingthreats.net/2007898; classtype:command-and-control; sid:2007898; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET [139,445] -> $HOME_NET any (msg:"ET CURRENT_EVENTS CERTEGO Possible JScript Coming Over SMB v2"; flow:established,from_server; content:"|FE|SMB"; offset:4; depth:8; content:"|08 00|"; distance:8; within:10; content:"var"; distance:48; fast_pattern; content:"="; distance:0; isdataat:2,relative; reference:url,twitter.com/SettiDavide89/status/970965983228723201; reference:url,www.certego.net/it/news/quant-url/; classtype:trojan-activity; sid:2025409; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_03_06, deployment Perimeter, former_category CURRENT_EVENTS, performance_impact Moderate, signature_severity Major, updated_at 2018_03_07;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Microsoft Word RTF pFragments Stack Overflow Attempt"; flowbits:isset,OLE.CompoundFile; flow:established,to_client; content:"rtf"; nocase; content:"|7B 5C|sp|7B 5C|sn pFragments|7D 7B 5C|sv"; nocase; within:100; reference:url,labs.m86security.com/2011/07/resurrection-of-cve-2010-3333-in-the-wild/; reference:bid,44652; reference:cve,2010-3333; classtype:attempted-user; sid:2013280; rev:2; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_07_15, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Locky Payload DL Sept 26 2017 M4"; flow:established,to_server; urilen:>6; pcre:"/^(?:\/(?:(?:af|p66)\/(?=(?:[a-zA-Z]{0,12}[0-9]|(?=[a-z0-9]{0,12}[A-Z])(?=[A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(?=(?:[a-zA-Z]{0,12}[0-9]|(?=[a-z0-9]{0,12}[A-Z])(?=[A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*(?:(?P[^=&]+)=(?P=var1))?))$/U"; content:!"Referer|3a|"; http_header; content:!"Cookie|3a|"; content:"HTTP/1.1|0d 0a|Accept|3a 20|*/*|0d 0a|"; content:"Firefox"; http_user_agent; flowbits:set,ET.Locky; flowbits:noalert; classtype:trojan-activity; sid:2026462; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_10_03, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Locky, performance_impact Low, signature_severity Major, updated_at 2018_10_09;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Adobe Authplay.dll NewClass Memory Corruption Attempt"; flowbits:isset,ET.flash.pdf; flow:established,to_client; content:"|D2 60 38 40 BA 03 14 0E|"; reference:url,www.exploit-db.com/adobe-acrobat-newclass-invalid-pointer-vulnerability/; reference:bid,40586; reference:cve,2010-1297; classtype:attempted-user; sid:2013281; rev:2; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_07_15, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Locky Payload DL Sept 26 2017 M3"; flow:established,to_server; urilen:>6; content:"MSIE"; http_user_agent; fast_pattern; pcre:"/^(?:\/(?:(?:af|p66)\/(?=(?:[a-zA-Z]{0,12}[0-9]|(?=[a-z0-9]{0,12}[A-Z])(?=[A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(?=(?:[a-zA-Z]{0,12}[0-9]|(?=[a-z0-9]{0,12}[A-Z])(?=[A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*(?:(?P[^=&]+)=(?P=var1))?))$/U"; http_header_names; content:!"Referer"; content:!"Cookie"; http_start; content:"HTTP/1.1|0d 0a|Accept|3a 20|*/*|0d 0a|"; flowbits:set,ET.Locky; flowbits:noalert; classtype:trojan-activity; sid:2026461; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_10_03, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Locky, performance_impact Moderate, signature_severity Major, updated_at 2019_05_22;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Adobe Flash Player Button Remote Code Execution Attempt"; flowbits:isset,ET.flash.pdf; flow:established,to_client; content:"|07 07 02 17 07 06 1A 07 1B 1B 07 02 1C 07 07 1E|"; reference:bid,44504; reference:cve,2010-3654; classtype:attempted-user; sid:2013282; rev:2; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_07_15, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Locky Payload DL Sept 26 2017 M2"; flow:established,to_server; urilen:6<>20; pcre:"/^(?:\/(?:(?:af|p66)\/(?=(?:[a-zA-Z]{0,12}[0-9]|(?=[a-z0-9]{0,12}[A-Z])(?=[A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(?=(?:[a-zA-Z]{0,12}[0-9]|(?=[a-z0-9]{0,12}[A-Z])(?=[A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$/U"; content:!"Referer|3a|"; http_header; content:!"Cookie|3a|"; content:"HTTP/1.1|0d 0a|Accept|3a 20|*/*|0d 0a|"; content:"Firefox/54.0"; http_user_agent; classtype:trojan-activity; sid:2024768; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2017_09_26, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Locky, performance_impact Low, signature_severity Major, updated_at 2017_10_05;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Microsoft Internet Explorer Time Element Uninitialized Memory Remote Code Execution Attempt"; flow:established,to_client; content:"|2e|location|2e|reload|28 29|"; content:"implementation=|22 23|default|23|time"; nocase; content:"contenteditable=|22|true|22|"; nocase; distance:0; reference:url,labs.m86security.com/2011/06/0-day-exploit-used-in-a-targeted-attack-cve-2011-1255/; reference:bid,48206; reference:cve,2011-1255; classtype:attempted-user; sid:2013252; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_07_11, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Locky Payload DL Sept 26 2017 M1"; flow:established,to_server; urilen:6<>20; pcre:"/^(?:\/(?:(?:af|p66)\/(?=(?:[a-zA-Z]{0,12}[0-9]|(?=[a-z0-9]{0,12}[A-Z])(?=[A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(?=(?:[a-zA-Z]{0,12}[0-9]|(?=[a-z0-9]{0,12}[A-Z])(?=[A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$/U"; content:!"Referer|3a|"; http_header; content:!"Cookie|3a|"; content:"HTTP/1.1|0d 0a|Accept|3a 20|*/*|0d 0a|"; content:"MSIE 7.0"; http_user_agent; classtype:trojan-activity; sid:2024767; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2017_09_26, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Locky, performance_impact Low, signature_severity Major, updated_at 2017_10_05;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT HP OpenView Network Node Manager Toolbar.exe CGI Buffer Overflow Attempt"; flow:established,to_server; content:"/OvCgi/Toolbar.exe?"; http_uri; content:"/OvCgi/Toolbar.exe?"; isdataat:1024,relative; content:!"|0A|"; within:1024; reference:url,exploit-db.com/exploits/17536/; classtype:web-application-attack; sid:2013288; rev:3; metadata:created_at 2011_07_19, updated_at 2011_07_19;) +#alert dns $HOME_NET any -> any any (msg:"ET CURRENT_EVENTS Brushaloader Domain in DNS Lookup 2019-05-30"; dns_query; content:"canasikos.info"; nocase; isdataat:!1,relative; reference:url,twitter.com/Racco42/status/1134214372996390913; classtype:trojan-activity; sid:2027415; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_05_31, deployment Perimeter, former_category CURRENT_EVENTS, malware_family BrushaLoader, performance_impact Low, signature_severity Major, updated_at 2019_05_31;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Cycbot Pay-Per-Install Executable Download"; flow:established,to_server; content:"/adv.php?login="; http_uri; content:"&key="; http_uri; content:"&subacc="; http_uri; reference:url,www.eset.com/about/blog/blog/article/cycbot-ready-to-ride/; classtype:trojan-activity; sid:2013291; rev:2; metadata:created_at 2011_07_19, updated_at 2011_07_19;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Winwebsec/Zbot/Luder Checkin Response"; flow:established,from_server; file_data; content:"ingdx.htmA{ip}"; nocase; classtype:trojan-activity; sid:2016851; rev:4; metadata:created_at 2013_05_16, former_category CURRENT_EVENTS, updated_at 2013_05_16;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Cycbot Initial Checkin to CnC"; flow:established,to_server; content:"id="; http_uri; content:"&hwid="; http_uri; content:"&step="; http_uri; content:"&wd="; http_uri; content:"&av="; fast_pattern; http_uri; reference:url,www.eset.com/about/blog/blog/article/cycbot-ready-to-ride/; classtype:command-and-control; sid:2013292; rev:2; metadata:created_at 2011_07_19, former_category MALWARE, updated_at 2011_07_19;) +#alert http any any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Hikvision DVR Synology Recon Scan Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/k.php?h="; http_uri; depth:9; content:"ballsack"; depth:8; http_user_agent; content:!"Referer|3a 20|"; http_header; content:!"Accept|3a 20|"; http_header; reference:url,isc.sans.edu/forums/diary/More+Device+Malware+This+is+why+your+DVR+attacked+my+Synology+Disk+Station+and+now+with+Bitcoin+Miner/17879; classtype:trojan-activity; sid:2018344; rev:4; metadata:created_at 2014_04_02, former_category CURRENT_EVENTS, updated_at 2014_04_02;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 8000 (msg:"GPL DELETED nstelemetry.adp access"; flow:to_server,established; content:"/nstelemetry.adp"; reference:nessus,10753; classtype:web-application-activity; sid:2101518; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Chrome Cookie Data Theft April 06 2015"; flow:established,to_server; content:".php?type=cookie&site="; fast_pattern; http_uri; reference:url,ocelot.li/the-malware-campaign-that-went-unnoticed/; classtype:trojan-activity; sid:2020848; rev:3; metadata:created_at 2015_04_07, updated_at 2019_10_08;) -alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP SITE overflow attempt"; flow:to_server,established; content:"SITE"; nocase; isdataat:100,relative; pcre:"/^SITE\s[^\n]{100}/smi"; reference:cve,1999-0838; reference:cve,2001-0755; reference:cve,2001-0770; classtype:attempted-admin; sid:2101529; rev:12; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS NullHole URI Struct Jul 22 2015 M3"; flow:established,from_server; content:"302"; http_stat_code; content:"/e.html"; http_header; fast_pattern; pcre:"/^Location\x3a\x20[a-f0-9]{32}\/e\.html\r$/Hm"; content:"Set-Cookie|3a|"; classtype:trojan-activity; sid:2021508; rev:3; metadata:created_at 2015_07_22, former_category CURRENT_EVENTS, updated_at 2019_10_08;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 119 (msg:"GPL MISC AUTHINFO USER overflow attempt"; flow:to_server,established; content:"AUTHINFO"; nocase; content:"USER"; distance:0; nocase; isdataat:200,relative; pcre:"/^AUTHINFO\s+USER\s[^\n]{200}/smi"; reference:arachnids,274; reference:bugtraq,1156; reference:cve,2000-0341; classtype:attempted-admin; sid:2101538; rev:14; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Chrome Form Data Theft April 06 2015"; flow:established,to_server; content:".php?type=form&site="; fast_pattern; http_uri; reference:url,ocelot.li/the-malware-campaign-that-went-unnoticed/; classtype:trojan-activity; sid:2020847; rev:3; metadata:created_at 2015_04_07, former_category CURRENT_EVENTS, updated_at 2019_10_08;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"GPL SCAN Finger Version Query"; flow:to_server,established; content:"version"; classtype:attempted-recon; sid:2101541; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Fake FedEX/Pony spam campaign URI Struct 2"; flow:established,to_server; http.uri; content:"/img/info.php?info="; nocase; classtype:trojan-activity; sid:2017257; rev:3; metadata:created_at 2013_07_30, former_category CURRENT_EVENTS, updated_at 2020_04_24;) -alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP SITE CHOWN overflow attempt"; flow:to_server,established; content:"SITE"; nocase; content:"CHOWN"; distance:0; nocase; isdataat:100,relative; pcre:"/^SITE\s+CHOWN\s[^\n]{100}/smi"; reference:bugtraq,2120; reference:cve,2001-0065; classtype:attempted-admin; sid:2101562; rev:13; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Python Eval Compile seen in HTTP Request Headers"; flow:established,to_server; http.header; content:"eval(compile("; reference:url,sethsec.blogspot.com/2016/11/exploiting-python-code-injection-in-web.html; classtype:bad-unknown; sid:2026848; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2019_01_22, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, updated_at 2020_08_27;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY Majestic12 User-Agent Request Inbound"; flow:established,to_server; content:"MJ12bot/"; http_header; classtype:trojan-activity; sid:2013255; rev:4; metadata:created_at 2011_07_12, updated_at 2011_07_12;) +#alert http any any -> any 80 (msg:"ET CURRENT_EVENTS Win32.RBrute http server request"; flow:to_server,established; flowbits:set,ET.Rbrute.incoming; http.user_agent; content:"BlackBerry9000/5.0.0.93 Profile/MIDP-2.0 Configuration/CLDC-2.1 VendorID/831"; fast_pattern; nocase; reference:md5,f8ff430aee52da3b4b1759700be9aead; reference:url,www.welivesecurity.com/2014/04/02/win32sality-newest-component-a-routers-primary-dns-changer-named-win32rbrute/; classtype:trojan-activity; sid:2018355; rev:5; metadata:created_at 2014_04_04, former_category CURRENT_EVENTS, updated_at 2020_09_23;) -#alert udp $HOME_NET [!1720,!1722,!2222,!2427,!5060,1024:] -> $EXTERNAL_NET [!1720,!1722,!2427,!5060,1024:] (msg:"ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 1)"; dsize:>19; byte_test:1, &, 1, 19; threshold: type both, track by_src, count 95, seconds 50; reference:url,mtc.sri.com/Conficker/addendumC/; reference:url,doc.emergingthreats.net/2009205; reference:url,www.mandiant.com/resources/apt41-us-state-governments; reference:md5,b82456963d04f44e83442b6393face47; classtype:trojan-activity; sid:2009205; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +alert tcp any any -> any 88 (msg:"ET CURRENT_EVENTS [Fireeye] HackTool.TCP.Rubeus.[nonce 2]"; content:"|a7 06 02 04 6C 69 6C 00|"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031288; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, signature_severity Major, updated_at 2020_12_08;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Driveby bredolab request to a .ru 8080 URI"; flow:established,to_server; content:".ru|3a|8080|0D 0A|"; classtype:bad-unknown; sid:2011354; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_09_28, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) +alert udp any any -> any 88 (msg:"ET CURRENT_EVENTS [Fireeye] HackTool.UDP.Rubeus.[nonce 2]"; content:"|a7 06 02 04 6C 69 6C 00|"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031295; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, signature_severity Major, updated_at 2020_12_08;) -#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET POLICY Self Signed SSL Certificate (Persona Not Validated)"; flow:established,from_server; content:"|16 03|"; content:"|0b|"; within:7; content:"Persona Not Validated"; classtype:policy-violation; sid:2013294; rev:2; metadata:attack_target Client_Endpoint, created_at 2011_07_21, deployment Perimeter, former_category POLICY, signature_severity Informational, tag SSL_Malicious_Cert, updated_at 2017_10_12;) +alert tcp any any -> any any (msg:"ET CURRENT_EVENTS [Fireeye] POSSIBLE HackTool.TCP.Rubeus.[User32LogonProcesss]"; flow:to_server; content:"User32LogonProcesss"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031296; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, updated_at 2020_12_08;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Google Warning Infected Local User"; flow:established,from_server; content:"It appears that your computer is infected with software that intercepts your connection to Google and other sites."; classtype:trojan-activity; sid:2013318; rev:1; metadata:created_at 2011_07_26, updated_at 2011_07_26;) +alert tcp any any -> any any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.GORAT.[Build ID]"; content:"aqlKZ7wjzg0iKM00E1WB/jq9_RA46w91EKl9A02Dv/nbNdZiLsB1ci8Ph0fb64/9Ks1YxAE86iz9A0dUiDl"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031297; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, signature_severity Major, updated_at 2020_12_08;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Unicode UTF-8 Heap Spray Attempt"; flow:established,to_client; content:"u0"; nocase; content:"u0"; nocase; distance:1; within:2; content:"u0"; nocase; distance:1; within:2; content:"u0"; nocase; distance:1; within:2; pcre:"/u0[a-d]u0[a-d]u0[a-d]u0[a-d]/smi"; classtype:shellcode-detect; sid:2013319; rev:2; metadata:created_at 2011_07_27, updated_at 2011_07_27;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.SSL.BEACON.[CSBundle Ajax]"; flow:established,to_client; tls.cert_subject; content:"C=US, ST=WA, L=Seattle, O=Microsoft, OU=Information Technologies, CN=ajax.microsoft.com"; bsize:87; fast_pattern; tls.cert_issuer; content:"C=US, ST=WA, L=Seattle, O=Microsoft, OU=Information Technologies, CN=ajax.microsoft.com"; bsize:87; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031299; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_08, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Unicode UTF-16 Heap Spray Attempt"; flow:established,to_client; content:"u0"; nocase; content:"u0"; nocase; distance:3; within:2; pcre:"/u0[a-d]0[a-d]u0[a-d]0[a-d]/smi"; classtype:shellcode-detect; sid:2013320; rev:2; metadata:created_at 2011_07_27, updated_at 2011_07_27;) +alert dns any any -> any any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.DNS.BEACON.[CSBundle DNS]"; content:"|00 01 00 01|"; offset:4; depth:4; content:"|0a|_domainkey"; distance:0; content:"|00 00 10 00 01 c0 0c 00 10 00 01 00 00 00 02 01 00 ff|v=DKIM1\; p="; distance:0; fast_pattern; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031281; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_08, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Internet Explorer toStaticHTML HTML Sanitizing Information Disclosure Attempt"; flow:established,to_client; content:"toStaticHTML|28|"; fast_pattern; nocase; content:"expression|28|"; nocase; within:150; reference:bid,48199; reference:cve,2011-1252; classtype:attempted-user; sid:2013321; rev:2; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_07_27, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert udp any any -> any 88 (msg:"ET CURRENT_EVENTS [Fireeye] HackTool.UDP.Rubeus.[nonce]"; content:"|05|"; depth:30; content:"|0a|"; distance:4; within:1; content:"Z"; content:"|6C 69 6C 00|"; within:25; fast_pattern; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031269; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, signature_severity Major, updated_at 2020_12_08;) -#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Ruskill CnC Download Command 1"; flow:established,to_client; content:"|3a|["; depth:2; content:".r.getfile http|3a|//"; distance:0; classtype:command-and-control; sid:2013329; rev:3; metadata:created_at 2011_07_27, former_category MALWARE, updated_at 2011_07_27;) +alert tcp any any -> any 88 (msg:"ET CURRENT_EVENTS [Fireeye] HackTool.TCP.Rubeus.[nonce]"; content:"|05|"; depth:30; content:"|0a|"; distance:4; within:1; content:"Z"; content:"|6C 69 6C 00|"; within:25; fast_pattern; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031266; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, signature_severity Major, updated_at 2020_12_08;) -#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Ruskill CnC Download Command 2"; flow:established,to_client; content:"|3a|n"; depth:2; content:"on .dl http|3a|//"; distance:0; classtype:command-and-control; sid:2013330; rev:1; metadata:created_at 2011_07_27, former_category MALWARE, updated_at 2011_07_27;) +alert tcp any any -> any [139,445] (msg:"ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M2"; content:"|ff 53 4d 42|"; offset:4; depth:4; content:"|57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 31 00 30 00 20 00 44 00 65 00 66 00 65 00 6e 00 64 00 65 00 72|"; distance:0; fast_pattern; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031301; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, updated_at 2020_12_08;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Ruskill Reporting on Local Scans"; flow:established,to_server; content:"PRRVMSG"; depth:7; content:"Port Scan started on"; distance:0; content:"with a delay of"; distance:0; classtype:trojan-activity; sid:2013331; rev:1; metadata:created_at 2011_07_27, updated_at 2011_07_27;) +alert tcp any any -> any [139,445] (msg:"ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M1"; content:"|ff 53 4d 42|"; offset:4; depth:4; content:"|57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 55 00 70 00 64 00 61 00 74 00 65 00 20 00 43 00 6f 00 6e 00 74 00 72 00 6f 00 6c 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65|"; distance:0; fast_pattern; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031300; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, updated_at 2020_12_08;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MOBILE_MALWARE Android.AdSms XML File From CnC Server"; flow:established,from_server; content:""; content:""; content:"<|2F|mobile>"; within:50; content:""; distance:0; content:""; distance:0; content:""; distance:0; reference:url,www.fortiguard.com/encyclopedia/virus/android_adsms.a!tr.html; classtype:command-and-control; sid:2013317; rev:4; metadata:affected_product Android, attack_target Client_Endpoint, created_at 2011_07_26, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Critical, tag Android, updated_at 2016_07_01;) +alert tcp any any -> any [139,445] (msg:"ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M3"; content:"|ff 53 4d 42|"; offset:4; depth:4; content:"|57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 4c 00 69 00 63 00 65 00 6e 00 73 00 65 00 20 00 4b 00 65 00 79 00 20 00 41 00 63 00 74 00 69 00 76 00 61 00 74 00 69 00 6f 00 6e|"; distance:0; fast_pattern; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031302; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, updated_at 2020_12_08;) -alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP shadow retrieval attempt"; flow:to_server,established; content:"RETR"; nocase; content:"shadow"; classtype:suspicious-filename-detect; sid:2101928; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert tcp any any -> any [139,445] (msg:"ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M4"; content:"|ff 53 4d 42|"; offset:4; depth:4; content:"|4f 00 66 00 66 00 69 00 63 00 65 00 20 00 33 00 36 00 35 00 20 00 50 00 72 00 6f 00 78 00 79|"; distance:0; fast_pattern; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031303; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, updated_at 2020_12_08;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Adobe Reader 9.4 this.printSeps Memory Corruption Attempt"; flow:established,to_client; content:".printSeps"; nocase; pcre:"/(this|doc)\x2EprintSeps/i"; reference:bid,44638; reference:cve,2010-4091; classtype:attempted-user; sid:2011910; rev:6; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_11_09, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert tcp any any -> any [139,445] (msg:"ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M5"; content:"|ff 53 4d 42|"; offset:4; depth:4; content:"|4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 53 00 65 00 63 00 75 00 72 00 69 00 74 00 79 00 20 00 43 00 65 00 6e 00 74 00 65 00 72|"; distance:0; fast_pattern; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031304; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, updated_at 2020_12_08;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT PDF With Adobe Audition Session File Handling Memory Corruption Attempt"; flow:established,to_client; flowbits:isset,ET_Assassin.ses; content:"|43 4F 4F 4C 4E 45 53 53 50 F2 08 00|"; reference:url,exploit-db.com/exploits/17278/; reference:url,securitytracker.com/id/1025530; classtype:attempted-user; sid:2012814; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_05_18, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert tcp any any -> any [139,445] (msg:"ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M6"; content:"|ff 53 4d 42|"; offset:4; depth:4; content:"|4f 00 6e 00 65 00 44 00 72 00 69 00 76 00 65 00 20 00 53 00 79 00 6e 00 63 00 20 00 43 00 65 00 6e 00 74 00 65 00 72|"; distance:0; fast_pattern; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031305; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, updated_at 2020_12_08;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE SPR/MobileSpy Mobile Spyware Sending SMS Logs to Remote Server"; flow:established,to_server; content:"/webapi/sms.php"; http_uri; reference:url,www.fortiguard.com/encyclopedia/virus/spy_mobilespy!iphoneos.html; classtype:trojan-activity; sid:2012857; rev:3; metadata:created_at 2011_05_26, updated_at 2011_05_26;) +alert tcp any any -> any [139,445] (msg:"ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M7"; content:"|ff 53 4d 42|"; offset:4; depth:4; content:"|42 00 61 00 63 00 6b 00 67 00 72 00 6f 00 75 00 6e 00 64 00 20 00 41 00 63 00 74 00 69 00 6f 00 6e 00 20 00 4d 00 61 00 6e 00 61 00 67 00 65 00 72|"; distance:0; fast_pattern; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031306; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, updated_at 2020_12_08;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 13364 (msg:"ET EXPLOIT RXS-3211 IP Camera Password Information Disclosure Attempt"; content:"|FF FF FF FF FF FF 00 06 FF F9|"; reference:bid,47976; classtype:attempted-admin; sid:2012866; rev:2; metadata:created_at 2011_05_26, updated_at 2011_05_26;) +alert tcp any any -> any [139,445] (msg:"ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M8"; content:"|ff 53 4d 42|"; offset:4; depth:4; content:"|53 00 65 00 63 00 75 00 72 00 65 00 20 00 54 00 6f 00 6b 00 65 00 6e 00 20 00 4d 00 65 00 73 00 73 00 61 00 67 00 69 00 6e 00 67 00 20 00 53 00 65 00 72 00 76 00 69 00 63 00 65|"; distance:0; fast_pattern; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031307; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, updated_at 2020_12_08;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Possible 0x0a0a0a0a Heap Spray Attempt"; flow:established,to_client; content:"0x0a0a0a0a"; nocase; classtype:shellcode-detect; sid:2012962; rev:3; metadata:created_at 2011_06_09, updated_at 2011_06_09;) +alert tcp any any -> any [139,445] (msg:"ET CURRENT_EVENTS [Fireeye] M.HackTool.SMB.Impacket-Obfuscation.[Service Names] M9"; content:"|ff 53 4d 42|"; offset:4; depth:4; content:"|57 00 69 00 6e 00 64 00 6f 00 77 00 73 00 20 00 20 00 55 00 70 00 64 00 61 00 74 00 65|"; distance:0; fast_pattern; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031308; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, updated_at 2020_12_08;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Possible 0x0c0c0c0c Heap Spray Attempt"; flow:established,to_client; content:"0x0c0c0c0c"; nocase; classtype:shellcode-detect; sid:2012964; rev:3; metadata:created_at 2011_06_09, updated_at 2011_06_09;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original GET]"; flow:established,to_server; http.method; content:"GET"; http.accept; content:"*/*"; bsize:3; http.accept_lang; content:"en-US"; bsize:5; http.accept_enc; content:"gzip, deflate"; bsize:13; content:"Cookie|3a 20|"; content:"display-culture=en|3b|check=true|3b|lbcs=0|3b|sess-id="; content:"|3b|SIDCC=AN0-TY21iJHH32j2m|3b|FHBv3=B"; fast_pattern; http.uri; pcre:"/^\/(?:v(?:1\/buckets\/default\/ext-5dkJ19tFufpMZjVJbsWCiqDcclDw\/records|4\/links\/activity-stream|3\/links\/ping-centre)|gp\/(?:aj\/private\/reviewsGallery\/get-(?:application-resource|image-gallery-asset)s|cerberus\/gv)|en-us\/(?:p\/(?:onerf\/MeSilentPassport|book-2\/8MCPZJJCC98C)|store\/api\/checkproductinwishlist)|wp-(?:content\/themes\/am43-6\/dist\/records|includes\/js\/script\/indigo-migrate)|api2\/json\/(?:cluster\/(?:resource|task)s|access\/ticket))/"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031264; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Possible 0x0d0d0d0d Heap Spray Attempt"; flow:established,to_client; content:"0x0d0d0d0d"; nocase; classtype:shellcode-detect; sid:2012965; rev:3; metadata:created_at 2011_06_09, updated_at 2011_06_09;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES Server]"; flow:established,from_server; file.data; content:"|7b 22|meta|22 3a 7b 7d 2c 22|status|22 3a 22|OK|22 2c 22|saved|22 3a 22|1|22 2c 22|starttime|22 3a|17656184060|2c 22|id|22 3a 22 22 2c 22|vims|22 3a 7b 22|dtc|22 3a 22|"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031294; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Possible %0d%0d%0d%0d Heap Spray Attempt"; flow:established,to_client; content:"%0d%0d%0d%0d"; nocase; reference:url,www.darkreading.com/security/vulnerabilities/221901428/index.html; classtype:shellcode-detect; sid:2012966; rev:3; metadata:created_at 2011_06_09, updated_at 2011_06_09;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice Server]"; flow:established,from_server; content:"|7b 22|meta|22 3a 7b 7d 2c 22|status|22 3a 22|OK|22 2c 22|saved|22 3a 22|1|22 2c 22|starttime|22 3a|17656184060|2c 22|id|22 3a 22 22 2c 22|vims|22 3a 7b 22|dtc|22 3a 22|"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031293; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Possible %u0d%u0d%u0d%u0d UTF-8 Heap Spray Attempt"; flow:established,to_client; content:"%u0d%u0d%u0d%u0d"; nocase; reference:url,www.darkreading.com/security/vulnerabilities/221901428/index.html; classtype:shellcode-detect; sid:2012967; rev:3; metadata:created_at 2011_06_09, updated_at 2011_06_09;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES Server]"; http.response_line; content:"HTTP/1."; depth:7; http.header; content:"Accept-Ranges|3a 20|bytes"; content:"Age|3a 20|5806"; content:"Cache-Control|3a 20|public,max-age=31536000"; content:"Content-Encoding|3a 20|gzip"; content:"Content-Length|3a 20|256398"; content:"Content-Type|3a 20|application/javascript"; content:"Server|3a 20|UploadServer"; content:"Vary|3a 20|Accept-Encoding, Fastly-SSL"; content:"x-api-version|3a 20|F-X"; content:"x-cache|3a 20|HIT"; content:"x-Firefox-Spdy|3a 20|h2"; content:"x-nyt-route|3a 20|vi-assets"; content:"x-served-by|3a 20|cache-mdw17344-MDW"; content:"x-timer|3a 20|S1580937960.346550,VS0,VE0"; fast_pattern; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031267; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Possible %u0d0d%u0d0d UTF-16 Heap Spray Attempt"; flow:established,to_client; content:"%u0d0d%u0d0d"; nocase; reference:url,www.darkreading.com/security/vulnerabilities/221901428/index.html; classtype:shellcode-detect; sid:2012968; rev:3; metadata:created_at 2011_06_09, updated_at 2011_06_09;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice POST]"; flow:established,to_server; content:"|7b 22|locale|22 3a 22|en|22 2c 22|channel|22 3a 22|prod|22 2c 22|addon|22 3a 22|"; fast_pattern; content:"nid"; content:"msg-"; http.method; content:"POST"; http.uri; content:"/notification"; startswith; http.accept; content:"*/*"; http.accept_enc; content:"gzip, deflate, br"; startswith; http.accept_lang; content:"en-US"; bsize:5; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031292; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert udp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET DELETED Srizbi registering with controller"; dsize:20; content:"|2d|"; offset:6; content:"|2d|"; distance:6; within:1; content:!"|00|server."; reference:url,www.secureworks.com/research/threats/ronpaul/; reference:url,doc.emergingthreats.net/2007711; classtype:trojan-activity; sid:2007711; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server 3]"; flow:established,from_server; content:"{|22|alias|22 3a 22|apx|22|,|22|prefix|22 3a 22 22|,|22|suffix|22 3a|null,|22|suggestions|22 3a|[],|22|responseId|22 3a 22|15QE9JX9CKE2P|22|,|22|addon|22 3a 20 22|"; fast_pattern; content:"|22|,|22|shuffled|22 3a|false}"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031268; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN Potential muieblackcat scanner double-URI and HTTP library"; flow:established,to_server; content:"GET //"; depth:6; fast_pattern; content:"HTTP/1.1|0d 0a|Accept|3a| */*|0d 0a|Accept-Language|3a| en-us|0d 0a|Accept-Encoding|3a| gzip, deflate|0d 0a|Host|3a| "; http_header; content:"|0d 0a|Connection|3a| Close|0d 0a 0d 0a|"; http_header; distance:0; classtype:attempted-recon; sid:2013116; rev:5; metadata:created_at 2011_06_24, former_category SCAN, updated_at 2011_06_24;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.GORAT.[POST]"; flow:established,to_server; urilen:1; http.request_line; content:"POST / HTTP/1.1"; bsize:15; http.connection; content:"upgrade"; depth:7; http.header; content:"|0d 0a|Upgrade|3a 20|tcp/1|0d 0a|"; fast_pattern; http.header_names; content:!"Referer"; content:!"Accept"; content:!"Cookie:"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031270; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, signature_severity Major, updated_at 2020_12_09;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Dictcn Trojan Downloader Update Check to CnC"; flow:established,to_server; content:".php?cid="; http_uri; content:"&version="; http_uri; content:"&lose="; http_uri; content:"&tipsid="; http_uri; content:"&from="; http_uri; classtype:command-and-control; sid:2013323; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_07_27, deployment Perimeter, signature_severity Major, tag Trojan_Downloader, updated_at 2016_07_01;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server 2]"; flow:established,from_server; content:"|7b 22|meta|22 3a 7b 7d 2c 22|status|22 3a 22|OK|22 2c 22|saved|22 3a 22|1|22 2c 22|starttime|22 3a|17656184060|2c 22|id|22 3a 22 22 2c 22|vims|22 3a 7b 22|dtc|22 3a|"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031291; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Dictcn Trojan Downloader Receiving XML Format Update File From CnC Server"; flow:established,to_client; content:""; fast_pattern; content:"
ONLY AT USA TODAY:
$HOME_NET any (msg:"ET DELETED Dictcn Trojan Downloader Receiving XML Format Node ID File From CnC Server"; flow:established,to_client; content:""; content:"<|2F|id>"; distance:1; within:9; content:"<|2F|type><|2F|node>-->"; distance:0; content:""; distance:0; content:"<|2F|id>"; distance:1; within:9; content:"<|2F|dict>"; distance:0; classtype:command-and-control; sid:2013325; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_07_27, deployment Perimeter, signature_severity Major, tag Trojan_Downloader, updated_at 2016_07_01;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Server]"; flow:established,from_server; content:"{|22|meta|22|:{},|22|status|22 3a 22|OK|22|,|22|saved|22 3a 22|1|22|,|22|starttime|22 3a|17656184060,|22|id|22 3a 22 22|,|22|vims|22 3a|{|22|dtc|22 3a|"; fast_pattern; http.response_line; content:"HTTP/1."; depth:7; http.header; content:"Content-Type|3a 20|text/json|0d 0a|"; content:"Server|3a 20|Microsoft-IIS/10.0|0d 0a|"; content:"X-Powered-By|3a 20|ASP.NET|0d 0a|"; content:"Cache-Control|3a 20|no-cache, no-store, max-age=0, must-revalidate|0d 0a|"; content:"Pragma|3a 20|no-cache|0d 0a|"; content:"X-Frame-Options|3a 20|SAMEORIGIN|0d 0a|"; content:"Connection|3a 20|close|0d 0a|"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031275; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET USER_AGENTS Suspicious User-Agent (InetURL)"; flow:established,to_server; content:"User-Agent|3a| InetURL"; http_header; content:!"www.dell.com"; http_header; content:!"pdfmachine.com"; http_header; content:!"gs.apple.com"; http_header; threshold: type limit, count 2, track by_src, seconds 300; reference:url,doc.emergingthreats.net/bin/view/Main/2008374; classtype:trojan-activity; sid:2008374; rev:15; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category HUNTING, signature_severity Informational, tag User_Agent, updated_at 2017_10_12;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice GET]"; flow:established,to_server; content:"sess-="; content:"auth=0|3b|loc=US|7d|"; fast_pattern; http.method; content:"GET"; http.uri; pcre:"/^(?:\/updates|\/license\/eula|\/docs\/office|\/software-activation)/"; http.accept; content:"*/*"; http.accept_enc; content:"gzip, deflate, br"; startswith; http.accept_lang; content:"en-US"; bsize:5; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031290; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_CLIENT Possible IE iepeers.dll Use-after-free Code Execution Attempt"; flow:established,to_client; content:".addBehavior"; nocase; content:"|23|default|23|userdata"; nocase; within:100; content:"setAttribute"; nocase; distance:0; content:"onclick"; nocase; distance:0; reference:url,www.rec-sec.com/2010/03/10/internet-explorer-iepeers-use-after-free-exploit/; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=20052; reference:url,www.microsoft.com/technet/security/bulletin/ms10-018.mspx; reference:url,www.kb.cert.org/vuls/id/744549; reference:cve,2010-0806; reference:url,doc.emergingthreats.net/2010931; classtype:attempted-user; sid:2010931; rev:7; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES GET]"; flow:established,to_server; content:"nyt-a="; content:"nyt-gdpr=0|3b|nyt-purr=cfh|3b|nyt-geo=US}"; fast_pattern; http.method; content:"GET"; http.accept; content:"*/*"; depth:3; http.accept_enc; content:"gzip, deflate, br"; depth:17; http.accept_lang; content:"en-US,en|3b|q=0.5"; startswith; http.request_line; pcre:"/^GET\s(?:\/(?:(?:v(?:i-assets\/static-asset|[12]\/preference)|idcta\/translation)s|ads\/google))/"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031276; rev:3; metadata:attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2022_05_03, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"GPL ATTACK_RESPONSE Invalid URL"; flow:from_server,established; content:"Invalid URL"; nocase; reference:url,www.microsoft.com/technet/security/bulletin/MS00-063.mspx; classtype:attempted-recon; sid:2101200; rev:12; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[Yelp Request]"; flow:established,to_server; http.cookie; content:"hl=en|3b|bse="; startswith; fast_pattern; pcre:"/^(?:[a-zA-Z0-9+\/]{4})*(?:[a-zA-Z0-9_\/\+\-]{2}==|[a-zA-Z0-9_\/\+\-]{3}=|[a-zA-Z0-9_\/\+\-]{4})\x3b/"; content:"|3b|_gat_global=1|3b|recent_locations|3b|_gat_www=1|3b|"; endswith; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031289; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"GPL ATTACK_RESPONSE command completed"; flow:established; content:"Command completed"; nocase; reference:bugtraq,1806; classtype:bad-unknown; sid:2100494; rev:12; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle USAToday Server]"; flow:established,from_server; http.response_line; content:"HTTP/1."; depth:7; http.header; content:"Connection|3a 20|close"; content:"Content-Type|3a 20|application/json|3b 20|charset=utf-8"; content:"Content-Security-Policy|3a 20|upgrade-insecure-requests"; content:"Strict-Transport-Security|3a 20|max-age=10890000"; content:"Cache-Control|3a 20|public, immutable, max-age=315360000"; content:"Accept-Ranges|3a 20|bytes"; content:"X-Cache|3a 20|HIT, HIT"; content:"X-Timer|3a 20|S1593010188.776402,VS0,VE1"; content:"Vary|3a 20|X-AbVariant, X-AltUrl, Accept-Encoding"; fast_pattern; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031274; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"GPL ATTACK_RESPONSE command error"; flow:established; content:"Bad command or filename"; nocase; classtype:bad-unknown; sid:2100495; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle NYTIMES POST]"; flow:established,to_server; content:"|7b 22|locale|22 3a 22|en|22 2c 22|channel|22 3a 22|prod|22 2c 22|addon|22 3a|"; fast_pattern; http.method; content:"POST"; http.uri; pcre:"/^(?:\/track|\/api\/v1\/survey\/embed|\/svc\/weather\/v2)/"; http.accept; content:"*/*"; startswith; http.accept_enc; content:"gzip, deflate, br"; startswith; http.accept_lang; content:"en-US,en|3b|q=0.5"; startswith; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031287; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"GPL ATTACK_RESPONSE file copied ok"; flow:established; content:"1 file|28|s|29| copied"; nocase; reference:bugtraq,1806; reference:cve,2000-0884; classtype:bad-unknown; sid:2100497; rev:14; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.GORAT.[SID1]"; flow:established,to_server; http.start; content:"|0d 0a|Cookie: SID1="; fast_pattern; http.method; content:"GET"; http.header_names; content:!"Referer"; content:!"Accept"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031278; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, signature_severity Major, updated_at 2020_12_09;) -alert udp $HOME_NET 500 -> $EXTERNAL_NET 500 (msg:"GPL ATTACK_RESPONSE isakmp login failed"; content:"|10 05|"; depth:2; offset:17; content:"|00 00 00 01 01 00 00 18|"; within:8; distance:13; classtype:misc-activity; sid:2102043; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Stager]"; flow:established,from_client; http.accept; content:"*/*"; depth:3; http.accept_lang; content:"en-US"; depth:5; http.accept_enc; content:"gzip, deflate"; depth:13; http.cookie; content:"SIDCC=AN0-TYutOSq-fxZK6e4kagm70VyKACiG1susXcYRuxK08Y-rHysliq0LWklTqjtulAhQOPH8uA"; depth:80; fast_pattern; http.uri; content:"/api/v1/user/"; content:"/avatar/"; distance:3; within:8; pcre:"/\/api\/v1\/user\/(?:512|124)\/avatar/"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031277; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2022_04_18, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL ATTACK_RESPONSE del attempt"; flow:to_server,established; content:"&del+/s+c|3A 5C|*.*"; nocase; classtype:web-application-attack; sid:2101008; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original Stager 2]"; flow:established,from_server; http.response_line; content:"HTTP/1."; depth:7; http.header; content:"Content-Type|3a 20|text/json|0d 0a|"; content:"Server|3a 20|Microsoft-IIS/10.0|0d 0a|"; content:"X-Powered-By|3a 20|ASP.NET|0d 0a|"; content:"Cache-Control|3a 20|no-cache, no-store, max-age=0, must-revalidate|0d 0a|"; content:"Pragma|3a 20|no-cache|0d 0a|"; content:"X-Frame-Options|3a 20|SAMEORIGIN|0d 0a|"; content:"Connection|3a 20|close|0d 0a|"; content:"Content-Type|3a 20|image/gif"; file_data; content:"|01 00 01 00 00 02 01 44 00 3b|"; content:"|ff ff ff 21 f9 04 01 00 00 00 2c 00 00 00 00|"; fast_pattern; content:"|47 49 46 38 39 61 01 00 01 00 80 00 00 00 00|"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031286; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"GPL ATTACK_RESPONSE directory listing"; flow:established; content:"Volume Serial Number"; classtype:bad-unknown; sid:2101292; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[Yelp GET]"; flow:established,to_server; content:"request_origin=user"; http.method; content:"GET"; http.request_line; content:"&parent_request_id="; within:256; fast_pattern; content:"|20|HTTP/1"; within:1024; pcre:"/^GET [^\r\n]{0,256}&parent_request_id=(?:[A-Za-z0-9_\/\+\-%]{128,1024})={0,2}[^\r\n]{0,256} HTTP\/1\.[01]/"; http.header; content:"|0d 0a|Sec-Fetch-Dest|3a 20|empty|0d 0a|"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031280; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle CDN GET]"; flow:established,to_server; http.method; content:"GET"; http.accept; content:"*/*"; depth:3; http.accept_enc; content:"gzip, deflate, br"; depth:17; http.accept_lang; content:"en-US"; bsize:5; http.header; content:"client-="; fast_pattern; content:"|3b|auth=1}"; http.uri; pcre:"/^\/v1\/(?:queue|profile|docs\/wsdl|pull)/"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031282; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED RealPlayer playlist http URL overflow attempt"; flow:from_server,established; flowbits:isset,realplayer.playlist; content:"http|3A|//"; nocase; pcre:"/^http\x3a\x2f\x2f[^\n]{400}/smi"; reference:bugtraq,9579; reference:cve,2004-0258; classtype:attempted-user; sid:2102439; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice Server]"; flow:from_server,established; http.response_line; content:"HTTP/1."; depth:7; file.data; content:"|7b 22|meta|22 3a 7b 7d 2c 22|status|22 3a 22|OK|22 2c 22|saved|22 3a 22|1|22 2c 22|starttime|22 3a|17656184060|2c 22|id|22 3a 22 22 2c 22|vims|22 3a 7b 22|dtc|22 3a 22|"; fast_pattern; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031279; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_12, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED RealPlayer playlist rtsp URL overflow attempt"; flow:from_server,established; flowbits:isset,realplayer.playlist; content:"rtsp|3A|//"; nocase; pcre:"/^http\x3a\x2f\x2f[^\n]{400}/smi"; reference:bugtraq,9579; reference:cve,2004-0258; classtype:attempted-user; sid:2102440; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle USAToday GET]"; flow:established,to_server; content:"gnt_ub=86|3b|gnt_sb=18|3b|usprivacy=1YNY|3b|DigiTrust.v1.identity="; fast_pattern; content:"%3D|3b|GED_PLAYLIST_ACTIVITY=W3sidSI6IkZtTWUiLCJ0c2wiOjE1OTMwM|3b|"; http.method; content:"GET"; http.connection; content:"close"; bsize:5; http.accept; content:"*/*"; bsize:3; http.header; content:"Cookie|3a 20|"; http.request_line; pcre:"/^GET\s(?:\/USAT-GUP\/user\/|\/entertainment\/|\/entertainment\/navdd-q1a2z3Z6TET4gv2PNfXpaJAniOzOajK7M\.min\.json|\/global-q1a2z3C4M2nNlQYzWhCC0oMSEFjQbW1KA\.min\.json|\/life\/|\/news\/weather\/|\/opinion\/|\/sports\/|\/sports\/navdd-q1a2z3JHa8KzCRLOQAnDoVywVWF7UwxJs\.min\.json|\/tangstatic\/js\/main-q1a2z3b37df2b1\.min\.js|\/tangstatic\/js\/pbjsandwich-q1a2z300ab4198\.min\.js|\/tangstatic\/js\/pg-q1a2z3bbc110a4\.min\.js|\/tangsvc\/pg\/3221104001\/|\/tangsvc\/pg\/5059005002\/|\/tangsvc\/pg\/5066496002\/|\/tech\/|\/travel\/)/"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031283; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED Content-Disposition CLSID command attempt"; flow:to_client,established; content:"Content-Disposition|3A|"; nocase; pcre:"/^Content-Disposition\x3a[^\r\n]*\{[\da-fA-F]{8}(-[\da-fA-F]{4}){3}-[\da-fA-F]{12}\}/smi"; reference:bugtraq,9510; reference:cve,2004-0420; reference:url,www.microsoft.com/technet/security/bulletin/ms04-024.mspx; classtype:attempted-user; sid:2102589; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert dns any any -> any any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.DNS.BEACON.[CSBundle DNS]"; content:"|00 01 00 01|"; offset:4; depth:4; content:"|03|"; within:15; content:"|0a|_domainkey"; distance:3; within:11; content:"|00 00 10 00 01 c0 0c 00 10 00 01 00 00 00 02 01 00 ff|v=DKIM1\; p="; fast_pattern; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031265; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL WEB_CLIENT Microsoft ANI file parsing overflow"; flow:established,from_server; content:"RIFF"; nocase; content:"anih"; nocase; byte_test:4,>,36,0,relative,little; reference:cve,2004-1049; classtype:attempted-user; sid:2103079; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_23, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle Original POST]"; flow:established,to_server; content:"ses-"; content:"{|22|locale|22 3a 22|en|22|,|22|channel|22 3a 22|prod|22|,|22|addon|22 3a 22|"; fast_pattern; http.method; content:"POST"; http.accept; content:"*/*"; bsize:3; http.accept_lang; content:"en-US"; bsize:5; http.accept_enc; content:"gzip, deflate"; bsize:13; http.request_line; pcre:"/^POST\s(?:\/v4\/links\/check-activity\/check|\/v1\/stats|\/gql|\/api2\/json\/check\/ticket|\/1.5\/95648064\/storage\/history|\/1.5\/95648064\/storage\/tabs|\/u\/0\/_\/og\/botguard\/get|\/ev\/prd001001|\/ev\/ext001001|\/gp\/aw\/ybh\/handlers|\/v3\/links\/ping-beat\/check)/"; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031284; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL WEB_CLIENT PNG large colour depth download attempt"; flow:from_server,established; content:"|89|PNG|0D 0A 1A 0A|"; content:"IHDR"; within:8; byte_test:1,>,16,8,relative; reference:bugtraq,11523; reference:cve,2004-0990; reference:cve,2004-1244; reference:url,www.microsoft.com/technet/security/bulletin/MS05-009.mspx; classtype:attempted-user; sid:2103134; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_23, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS [Fireeye] Backdoor.HTTP.BEACON.[CSBundle MSOffice POST]"; flow:established,to_server; content:"{|22|locale|22 3a 22|en|22|,|22|channel|22 3a 22|prod|22|,|22|addon|22 3a 22|"; fast_pattern; content:"cli"; content:"l-"; http.request_line; content:"POST /v1/push"; depth:13; http.accept; content:"*/*"; depth:3; http.accept_enc; content:"gzip, deflate, br"; depth:17; http.accept_lang; content:"en-US"; bsize:5; reference:url,github.com/fireeye/red_team_tool_countermeasures; classtype:trojan-activity; sid:2031285; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_12_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag c2, updated_at 2020_12_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL WEB_CLIENT PNG large image height download attempt"; flow:from_server,established; content:"|89|PNG|0D 0A 1A 0A|"; content:"IHDR"; within:8; byte_test:4,>,32768,4,relative; reference:bugtraq,11481; reference:bugtraq,11523; reference:cve,2004-0599; reference:cve,2004-0990; reference:cve,2004-1244; reference:url,www.microsoft.com/technet/security/bulletin/MS05-009.mspx; classtype:attempted-user; sid:2103133; rev:6; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_23, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Obfuscated Content Using Dadongs JSXX 0.41 VIP Obfuscation Script"; flow:established,to_client; content:"document.cookie=|22|dadong"; fast_pattern; nocase; reference:url,www.kahusecurity.com/2012/chinese-pack-using-dadongs-jsxx-vip-script/; classtype:bad-unknown; sid:2014308; rev:2; metadata:created_at 2012_03_05, updated_at 2022_03_17;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL WEB_CLIENT PNG large image width download attempt"; flow:from_server,established; content:"|89|PNG|0D 0A 1A 0A|"; content:"IHDR"; within:8; byte_test:4,>,32768,0,relative; reference:bugtraq,11523; reference:cve,2004-0990; reference:cve,2004-1244; reference:url,www.microsoft.com/technet/security/bulletin/MS05-009.mspx; classtype:attempted-user; sid:2103132; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_23, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Crypto Drainer Fetch"; flow:established,to_server; http.host; content:"deep-index.moralis.io"; http.header_names; content:"|0d 0a|Content-Type|0d 0a|accept|0d 0a|x-api-key"; content:!"|0d 0a|Referer|0d 0a|"; http.uri; content:"/api/v2/"; startswith; content:"/nft?chain=eth&format=decimal"; distance:0; endswith; fast_pattern; flowbits:set,ET.crypto_drainer_fetch; reference:url,blog.confiant.com/how-one-crypto-drainer-template-facilitates-tens-of-millions-of-dollars-in-theft-66f3794aea4b; classtype:trojan-activity; sid:2037023; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_16, deployment Perimeter, deployment SSLDecrypt, former_category CURRENT_EVENTS, signature_severity Minor, updated_at 2022_06_16;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL WEB_CLIENT RealPlayer arbitrary javascript command attempt"; flow:to_client,established; content:"Content-Type|3A|"; nocase; pcre:"/^Content-Type\x3a\s*application\x2fsmi.*? $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Crypto Drainer Enumerate"; flow:established,to_server; http.host; content:"deep-index.moralis.io"; http.header_names; content:"|0d 0a|Content-Type|0d 0a|accept|0d 0a|x-api-key"; content:!"|0d 0a|Referer|0d 0a|"; http.uri; content:"/api/v2/nft"; startswith; content:"lowestprice?chain=eth&days="; distance:0; content:"&marketplace=opensea"; endswith; fast_pattern; distance:0; flowbits:isset,ET.crypto_drainer_fetch; reference:url,blog.confiant.com/how-one-crypto-drainer-template-facilitates-tens-of-millions-of-dollars-in-theft-66f3794aea4b; classtype:trojan-activity; sid:2037024; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_16, deployment Perimeter, deployment SSLDecrypt, former_category CURRENT_EVENTS, signature_severity Minor, updated_at 2022_06_16;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL WEB_CLIENT bitmap BitmapOffset integer overflow attempt"; flow:to_client,established; content:"image/bmp"; nocase; pcre:"/^Content-type\x3a\s*image\x2fbmp/smi"; pcre:"/^BM/sm"; byte_test:4,>,2147480000,8,relative,little; reference:bugtraq,9663; reference:cve,2004-0566; classtype:attempted-user; sid:2102671; rev:6; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_23, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert dns $HOME_NET any -> any any (msg:"ET CURRENT_EVENTS DNS Query for Known Hostile Domain (gooqlepics .com)"; dns.query; content:".com.ru"; fast_pattern; nocase; bsize:14; reference:url,blog.armorize.com/2011/07/willysycom-mass-injection-ongoing.html; classtype:bad-unknown; sid:2013328; rev:5; metadata:created_at 2011_07_27, former_category CURRENT_EVENTS, updated_at 2022_07_15;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL WEB_CLIENT libpng tRNS overflow attempt"; flow:to_client,established; content:"|89|PNG|0D 0A 1A 0A|"; content:"IHDR"; within:4; distance:4; content:"tRNS"; distance:0; byte_test:4,>,256,-8,relative,big; pcre:"/IHDR(?!.*?PLTE).*?tRNS/s"; reference:bugtraq,10872; reference:cve,2004-0597; classtype:attempted-user; sid:2102673; rev:6; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_23, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert dns $HOME_NET any -> any any (msg:"ET CURRENT_EVENTS DNS Query SoakSoak Malware (soaksoak .ru)"; dns.query; content:"soaksoak.ru"; fast_pattern; nocase; bsize:11; reference:url,blog.sucuri.net/2014/12/soaksoak-malware-compromises-100000-wordpress-websites.html; classtype:trojan-activity; sid:2019940; rev:2; metadata:created_at 2014_12_16, former_category CURRENT_EVENTS, updated_at 2022_07_15;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL WEB_CLIENT object type overflow attempt"; flow:from_server,established; content:"]*type\s*=[\x22\x27]\x2f{32}/smi"; reference:cve,2003-0344; reference:url,www.microsoft.com/technet/security/bulletin/MS03-020.mspx; classtype:attempted-user; sid:2103149; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_23, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert dns $HOME_NET any -> any any (msg:"ET CURRENT_EVENTS Sliver Related Domain in DNS Lookup (saleforces-it .com)"; dns.query; content:"saleforces-it.com"; nocase; bsize:17; reference:url,twitter.com/ESETresearch/status/1547943014860894210; classtype:trojan-activity; sid:2037772; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_07_15, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, updated_at 2022_07_15;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL WEB_CLIENT winamp .cda file name overflow attempt"; flow:from_server,established; content:".cda"; nocase; pcre:"/(\x5c[^\x5c]{16,}|\x2f[^\x2f]{16,})\.cda$/smi"; reference:bugtraq,11730; classtype:attempted-user; sid:2103088; rev:2; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_23, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert dns $HOME_NET any -> any any (msg:"ET CURRENT_EVENTS Sliver Related Domain in DNS Lookup"; dns.query; content:"saleforces.s3-accelerate.amazonaws.com"; nocase; bsize:38; reference:url,mobile.twitter.com/ESETresearch/status/1547943014860894210; classtype:trojan-activity; sid:2037773; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_07_15, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_07_15;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED RealPlayer playlist file URL overflow attempt"; flow:from_server,established; flowbits:isset,realplayer.playlist; content:"file|3A|//"; nocase; pcre:"/^file\x3a\x2f\x2f[^\n]{400}/smi"; reference:bugtraq,9579; reference:cve,2004-0258; classtype:attempted-user; sid:2102438; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +alert dns $HOME_NET any -> any any (msg:"ET CURRENT_EVENTS NATO Themed Maldoc Related Domain in DNS Lookup (am .my-zo .org)"; dns.query; content:"am.my-zo.org"; nocase; bsize:12; reference:url,twitter.com/souiten/status/1548963032574767104; reference:md5,4b160dea19282597342c160f44d4bdf8; reference:md5,a23a106fc8049feb296aa281ef5319a6; reference:md5,9e5500cf454bc49609bb0200f7de23c3; classtype:trojan-activity; sid:2037782; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_07_18, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Maldoc, signature_severity Major, updated_at 2022_07_18;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL WEB_CLIENT web bug 0x0 gif attempt"; flow:from_server,established; content:"Content-type|3A| image/gif"; nocase; content:"GIF"; distance:0; nocase; content:"|01 00 01 00|"; within:4; distance:3; content:","; distance:0; content:"|01 00 01 00|"; within:4; distance:4; classtype:misc-activity; sid:2102925; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_23, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +# Emerging Threats +# +# This distribution may contain rules under two different licenses. +# +# Rules with sids 1 through 3464, and 100000000 through 100000908 are under the GPLv2. +# A copy of that license is available at http://www.gnu.org/licenses/gpl-2.0.html +# +# Rules with sids 2000000 through 2799999 are from Emerging Threats and are covered under the BSD License +# as follows: +# +#************************************************************* +# Copyright (c) 2003-2022, Emerging Threats +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the +# following conditions are met: +# +# * Redistributions of source code must retain the above copyright notice, this list of conditions and the following +# disclaimer. +# * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the +# following disclaimer in the documentation and/or other materials provided with the distribution. +# * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES, +# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE +# USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +# +#************************************************************* +# +# +# +# -#alert udp $HOME_NET 49 -> $EXTERNAL_NET any (msg:"GPL DELETED xtacacs failed login response"; content:"|80 02|"; depth:2; content:"|02|"; distance:4; classtype:misc-activity; sid:2102041; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +# This Ruleset is EmergingThreats Open optimized for suricata-5.0-enhanced. -alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Dropper.Win32.Agent.bpxo Checkin"; flow:established,to_server; content:"|71 4E 6C 39 34 65 66 59 41 7A 32 32 37 4F 71 45 44 4D 50 0A|"; depth:20; reference:md5,02e447b347a90680e03c8b7d843a8e46; reference:url,www.antivirus365.org/PCAntivirus/37128.html; classtype:command-and-control; sid:2012894; rev:4; metadata:created_at 2011_05_31, former_category MALWARE, updated_at 2011_05_31;) +#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"ET DELETED MSSQL sp_replwritetovarbin - potential memory overwrite case 2"; flow:to_server,established; content:"sp_replwritetovarbin"; nocase; reference:url,archives.neohapsis.com/archives/fulldisclosure/2008-12/0239.html; reference:url,doc.emergingthreats.net/bin/view/Main/2008910; classtype:attempted-user; sid:2008910; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Bifrose Client Checkin"; flow:established,to_server; content:"|00 00 99 4F B9 74 E2 75 94 0A 5A|"; offset:2; depth:11; classtype:command-and-control; sid:2013338; rev:2; metadata:created_at 2011_08_02, former_category MALWARE, updated_at 2011_08_02;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET DELETED Unknown Keepalive out"; flow:established,to_server; dsize:5; content:"|17 24 1B 00 00|"; flowbits:isnotset,ET.teamviewerkeepaliveout; flowbits:set,ET.unknownkeepaliveup; flowbits:noalert; reference:url,doc.emergingthreats.net/bin/view/Main/2008779; classtype:unknown; sid:2008779; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FakeAV/Application JPDesk/Delf checkin"; flow:established,to_server; content:"|2f 3f|data="; http_uri; nocase; content:"jpdesk.com|0d 0a|"; nocase; http_header; pcre:"/\x2f\x3fdata\x3d[a-fA-F0-9]{60}/U"; reference:md5,08f116cf4feff245dca581244e4f509c; classtype:command-and-control; sid:2013340; rev:2; metadata:created_at 2011_08_02, former_category MALWARE, updated_at 2011_08_02;) +#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET DELETED Unknown Keepalive in"; flow:established,to_client; dsize:5; content:"|17 24 1B 00 00|"; flowbits:isnotset,ET.teamviewerkeepaliveout; flowbits:isset,ET.unknownkeepaliveup; reference:url,doc.emergingthreats.net/bin/view/Main/2008780; classtype:unknown; sid:2008780; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Backdoor W32/Phanta Checkin"; flow:established,to_server; content:"/do.php?userid="; http_uri; content:"&time="; http_uri; content:"&msg="; http_uri; content:"&ver="; http_uri; content:"&os="; http_uri; content:"&fy="; http_uri; content:"&pauid="; http_uri; content:"&checkId="; http_uri; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FPopureb.A; reference:md5,0012a0b60572dfa4f42a4325507841d8; classtype:trojan-activity; sid:2013343; rev:3; metadata:created_at 2011_08_02, updated_at 2011_08_02;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET DELETED HELO Non-Displayable Characters MailEnable Denial of Service"; flow:established,to_server; content:"HELO "; nocase; depth:60; pcre:"/^[^\n]*[\x00-\x08\x0e-\x1f]/R"; reference:cve,2006-3277; reference:bugtraq,18630; reference:url,doc.emergingthreats.net/bin/view/Main/2002998; classtype:attempted-dos; sid:2002998; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Unknown Generic Trojan Checkin"; flow:established,to_server; content:"unit_id="; http_uri; content:"&uv_id="; http_uri; content:"&uv_new="; http_uri; content:"&url="; http_uri; content:"&charset="; http_uri; content:"&hashval="; http_uri; content:"&app="; http_uri; content:"&lg="; http_uri; classtype:trojan-activity; sid:2013204; rev:3; metadata:created_at 2011_07_06, updated_at 2011_07_06;) +#alert udp $HOME_NET 123 -> $EXTERNAL_NET 123 (msg:"ET DELETED Potential Inbound NTP denial-of-service attempt (repeated mode 7 request)"; dsize:1; content:"|17|"; threshold:type limit, count 1, seconds 60, track by_src; reference:url,www.kb.cert.org/vuls/id/568372; reference:cve,2009-3563; reference:url,doc.emergingthreats.net/2010488; classtype:attempted-dos; sid:2010488; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"ET WEB_CLIENT Wordpress possible Malicious DNS-Requests - flickr.com.*"; content:"|05|flickr|03|com"; nocase; content:!"|00|"; within:1; reference:url,markmaunder.com/2011/zero-day-vulnerability-in-many-wordpress-themes/; reference:url,www.us-cert.gov/current/index.html#wordpress_themes_vulnerability; reference:url,blog.sucuri.net/2011/08/timthumb-security-vulnerability-list-of-themes-including-it.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SucuriSecurity+%28Sucuri+Security%29; classtype:web-application-attack; sid:2013353; rev:3; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2011_08_04, deployment Datacenter, former_category WEB_CLIENT, signature_severity Major, tag Wordpress, updated_at 2016_07_01;) +#alert udp $HOME_NET 123 -> $EXTERNAL_NET 123 (msg:"ET DELETED Potential Inbound NTP denial-of-service attempt (repeated mode 7 reply)"; dsize:4; content:"|97 00 00 00|"; threshold:type limit, count 1, seconds 60, track by_src; reference:url,www.kb.cert.org/vuls/id/568372; reference:cve,2009-3563; reference:url,doc.emergingthreats.net/2010489; classtype:attempted-dos; sid:2010489; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"ET WEB_CLIENT Wordpress possible Malicious DNS-Requests - picasa.com.*"; content:"|06|picasa|03|com"; nocase; content:!"|00|"; within:1; reference:url,markmaunder.com/2011/zero-day-vulnerability-in-many-wordpress-themes/; reference:url,www.us-cert.gov/current/index.html#wordpress_themes_vulnerability; reference:url,blog.sucuri.net/2011/08/timthumb-security-vulnerability-list-of-themes-including-it.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SucuriSecurity+%28Sucuri+Security%29; classtype:web-application-attack; sid:2013354; rev:3; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2011_08_04, deployment Datacenter, former_category WEB_CLIENT, signature_severity Major, tag Wordpress, updated_at 2016_07_01;) +#alert udp any any -> $HOME_NET 139 (msg:"ET DELETED Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (6)"; content:"|0B|"; offset:2; depth:1; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008695; classtype:attempted-admin; sid:2008695; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"ET WEB_CLIENT Wordpress possible Malicious DNS-Requests - blogger.com.*"; content:"|07|blogger|03|com"; nocase; content:!"|00|"; within:1; reference:url,markmaunder.com/2011/zero-day-vulnerability-in-many-wordpress-themes/; reference:url,www.us-cert.gov/current/index.html#wordpress_themes_vulnerability; reference:url,blog.sucuri.net/2011/08/timthumb-security-vulnerability-list-of-themes-including-it.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SucuriSecurity+%28Sucuri+Security%29; classtype:web-application-attack; sid:2013355; rev:3; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2011_08_04, deployment Datacenter, former_category WEB_CLIENT, signature_severity Major, tag Wordpress, updated_at 2016_07_01;) +#alert tcp any any -> $HOME_NET 445 (msg:"ET DELETED Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (21)"; flow:established,to_server; content:"|0B|"; offset:2; depth:1; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008711; classtype:attempted-admin; sid:2008711; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"ET WEB_CLIENT Wordpress possible Malicious DNS-Requests - wordpress.com.*"; content:"|09|wordpress|03|com"; nocase; content:!"|00|"; within:1; reference:url,markmaunder.com/2011/zero-day-vulnerability-in-many-wordpress-themes/; reference:url,www.us-cert.gov/current/index.html#wordpress_themes_vulnerability; reference:url,blog.sucuri.net/2011/08/timthumb-security-vulnerability-list-of-themes-including-it.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SucuriSecurity+%28Sucuri+Security%29; classtype:web-application-attack; sid:2013357; rev:1; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2011_08_04, deployment Datacenter, former_category WEB_CLIENT, signature_severity Major, tag Wordpress, updated_at 2016_07_01;) +#alert tcp any any -> $HOME_NET 139 (msg:"ET DELETED Microsoft Windows NETAPI Stack Overflow Inbound - MS08-067 (26)"; flow:established,to_server; content:"|0B|"; offset:2; depth:1; content:"|C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88|"; reference:url,www.microsoft.com/technet/security/Bulletin/MS08-067.mspx; reference:cve,2008-4250; reference:url,www.kb.cert.org/vuls/id/827267; reference:url,doc.emergingthreats.net/bin/view/Main/2008716; classtype:attempted-admin; sid:2008716; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"ET WEB_CLIENT Wordpress possible Malicious DNS-Requests - img.youtube.com.*"; content:"|03|img|07|youtube|03|com"; nocase; content:!"|00|"; within:1; reference:url,markmaunder.com/2011/zero-day-vulnerability-in-many-wordpress-themes/; reference:url,www.us-cert.gov/current/index.html#wordpress_themes_vulnerability; reference:url,blog.sucuri.net/2011/08/timthumb-security-vulnerability-list-of-themes-including-it.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SucuriSecurity+%28Sucuri+Security%29; classtype:web-application-attack; sid:2013358; rev:2; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2011_08_04, deployment Datacenter, former_category WEB_CLIENT, signature_severity Major, tag Wordpress, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED CAN-2005-0399 Gif Vuln via http"; flow: from_server,established; content:"GIF89a"; content:"|21 ff 0b|NETSCAPE2.0"; byte_test:1,!=,3,0,relative; reference:cve,2005-0399; reference:url,doc.emergingthreats.net/bin/view/Main/2001807; classtype:attempted-admin; sid:2001807; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"ET WEB_CLIENT Wordpress possible Malicious DNS-Requests - upload.wikimedia.com.*"; content:"|06|upload|09|wikimedia|03|com"; nocase; content:!"|00|"; within:1; reference:url,markmaunder.com/2011/zero-day-vulnerability-in-many-wordpress-themes/; reference:url,www.us-cert.gov/current/index.html#wordpress_themes_vulnerability; reference:url,blog.sucuri.net/2011/08/timthumb-security-vulnerability-list-of-themes-including-it.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SucuriSecurity+%28Sucuri+Security%29; classtype:web-application-attack; sid:2013359; rev:2; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2011_08_04, deployment Datacenter, former_category WEB_CLIENT, signature_severity Major, tag Wordpress, updated_at 2016_07_01;) +#alert udp $EXTERNAL_NET 1024:65535 -> $HOME_NET 1024:65535 (msg:"ET DELETED Edonkey Connect Reply and Server List"; dsize:>200; content:"|e3 0b|"; depth:2; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003313; classtype:policy-violation; sid:2003313; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FakeAV Checkin"; flow:established,to_server; content:"/ping.php?v="; http_uri; content:"&cid="; http_uri; content:"&s="; http_uri; content:"&wid="; http_uri; content:"&fid="; http_uri; content:"&step="; http_uri; classtype:command-and-control; sid:2013366; rev:2; metadata:created_at 2011_08_05, former_category MALWARE, updated_at 2011_08_05;) +#alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET DELETED Edonkey Search Request (any type file)"; dsize:>19; content:"|e3 0e|"; depth:2; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003317; classtype:policy-violation; sid:2003317; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Alunik User Agent Detected"; flow:established,to_server; content:"User-Agent|3A| Alun4ik"; http_header; classtype:trojan-activity; sid:2013377; rev:2; metadata:created_at 2011_08_05, updated_at 2011_08_05;) +#alert udp $EXTERNAL_NET 1024:65535 -> $HOME_NET 1024:65535 (msg:"ET DELETED Edonkey Search Results"; dsize:>21; content:"|e3 99|"; depth:2; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003320; classtype:policy-violation; sid:2003320; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible Trojan File Download - Rar Requested but not received"; flow:established,from_server; flowbits:isset,ET.rar_seen; flowbits:unset,ET.rar_seen; content:"200"; http_stat_code; content:"OK"; http_stat_msg; content:!"|0d 0a 0d 0a 52 61 72 21 1A 07|"; depth:300; reference:url,www.win-rar.com/index.php?id=24&kb=1&kb_article_id=162; reference:url,doc.emergingthreats.net/2008783; classtype:trojan-activity; sid:2008783; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED NE EXE OS2 file download"; flow: established; content:"MZ"; isdataat: 76,relative; content:"This program cannot be run in a DOS session."; isdataat: 6,relative; content:"NE"; distance: 0; reference:url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2000423; classtype:misc-activity; sid:2000423; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Set flow on rar file get"; flow:established,to_server; content:"GET"; http_method; content:".rar"; http_uri; content:".rar HTTP/1."; flowbits:set,ET.rar_seen; flowbits:noalert; reference:url,doc.emergingthreats.net/2008781; classtype:trojan-activity; sid:2008781; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED LX EXE OS2 file download"; flow: established; content:"MZ"; isdataat: 76,relative; content:"This program cannot be run in a DOS session."; isdataat: 6,relative; content:"LX"; distance: 0; reference:url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2000424; classtype:misc-activity; sid:2000424; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Obfuscated Javascript Often Used in Drivebys"; flow:established,from_server; content:"Content-Type|3a 20|text/html"; content:"|0d 0a|
\d{16}/R"; classtype:exploit-kit; sid:2013237; rev:5; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_07_09, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED NE EXE Windows 3.x file download"; flow: established; content:"MZ"; isdataat: 76,relative; content:"This program requires Microsoft Windows."; isdataat: 10,relative; content:"NE"; distance: 0; reference:url,www.itee.uq.edu.au/~cristina/students/david/honoursThesis96/bff.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2000425; classtype:misc-activity; sid:2000425; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Fakealert.Rena CnC Checkin 1"; flow:established,to_server; content:"/images/thanks_25.php?id="; fast_pattern:only; content:"HTTP/1.1|0d 0a|User-Agent"; content:"|20|HTTP/1.1|0d 0a|User-Agent|3a 20|Mozilla/4.0|20|(compatible|3b 20|MSIE|20|"; content:"|3b 20|Windows|20|NT|20|"; distance:0; content:")|0d 0a|Host|3a 20|"; distance:0; content:"Cache-Control|3a 20|no-cache|0d 0a 0d 0a|"; distance:0; content:!"|0d 0a|Accept"; classtype:command-and-control; sid:2013383; rev:3; metadata:created_at 2011_08_09, former_category MALWARE, updated_at 2011_08_09;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret REL TO"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $EXTERNAL_NET any (msg:"ET MALWARE Accept-encode HTTP header with UA indicating infected host"; flow:established,to_server; content:"Accept-encode|3a| "; fast_pattern; http_header; content:"Accept-Encoding|3a| "; http_header; threshold:type limit, count 1, seconds 360, track by_src; classtype:trojan-activity; sid:2013385; rev:3; metadata:created_at 2011_08_09, updated_at 2011_08_09;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Confidential COMINT"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002426; classtype:policy-violation; sid:2002426; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Adware/CommonName Reporting"; flow:established,to_server; content:"/report.asp?TB="; http_uri; content:"&status="; http_uri; content:"&data="; http_uri; content:"&BABE="; http_uri; content:"&BATCH="; http_uri; content:"&UDT="; http_uri; content:"&GRP="; http_uri; classtype:pup-activity; sid:2013389; rev:2; metadata:created_at 2011_08_10, former_category ADWARE_PUP, updated_at 2011_08_10;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Top Secret COMINT"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002427; classtype:policy-violation; sid:2002427; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User Agent 3653Client"; flow:established,to_server; content:"User-Agent|3A 20|3653Client"; http_header; classtype:trojan-activity; sid:2013390; rev:2; metadata:created_at 2011_08_10, updated_at 2011_08_10;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret COMINT"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"ET WEB_CLIENT Malicious 1px iframe related to Mass Wordpress Injections"; flow:established,from_server; content:"/?go=1|22 20|width=|22|1|22 20|height=|22|1|22|>"; fast_pattern; content:" $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret COMSEC"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User Agent ksdl_1_0"; flow:established,to_server; content:"User-Agent|3A 20|ksdl_"; http_header; classtype:trojan-activity; sid:2013404; rev:2; metadata:created_at 2011_08_11, updated_at 2011_08_11;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret IMCON"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $EXTERNAL_NET !1433 (msg:"ET MALWARE Bancos.DV MSSQL CnC Connection Outbound"; flow:to_server,established; flowbits:isset,ET.MSSQL; content:"|49 00 B4 00 4D 00 20 00 54 00 48 00 45 00 20 00 4D 00 41 00 53 00 54 00 45 00 52 00|"; classtype:command-and-control; sid:2013411; rev:1; metadata:created_at 2011_08_16, former_category MALWARE, malware_family Bancos, tag Banking_Trojan, updated_at 2018_04_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret CNWDI"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $EXTERNAL_NET any (msg:"ET DELETED Win32/TrojanDropper.Agent Checkin"; flow:established,to_server; content:".gif?aid="; http_uri; content:"&lc="; http_uri; content:"&time="; http_uri; content:"&flag="; http_uri; content:"&domain="; http_uri; classtype:trojan-activity; sid:2013402; rev:3; metadata:created_at 2011_08_11, updated_at 2011_08_11;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret TK"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"ET DELETED Possible Windows executable sent when remote host claims to send an image"; flow: established,from_server; content:"Content-Type|3a| image"; content:"|0d 0a|MZ"; within: 12; reference:url,doc.emergingthreats.net/bin/view/Main/2001685; classtype:trojan-activity; sid:2001685; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret NOFORN"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"ET WEB_CLIENT Mozilla Firefox mChannel Object Dangling Pointer Use-After-Free Memory Corruption Attempt"; flow:established,to_client; content:"QueryInterface|28|Components.interfaces.nsIChannelEventSink|29|"; nocase; content:"onChannelRedirect|28|null"; nocase; distance:0; reference:url,www.mozilla.org/security/announce/2011/mfsa2011-13.html; reference:bid,47635; reference:cve,2011-0065; classtype:attempted-user; sid:2013417; rev:2; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_08_18, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret ORCON"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"ET POLICY TeamViewer Keep-alive inbound"; flow:established,to_client; dsize:5; content:"|17 24 1B 00 00|"; flowbits:isset,ET.teamviewerkeepaliveout; threshold: type limit, count 1, seconds 120, track by_src; reference:url,www.teamviewer.com; reference:url,en.wikipedia.org/wiki/TeamViewer; reference:url,doc.emergingthreats.net/2008795; classtype:misc-activity; sid:2008795; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret PROPIN"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"ET MALWARE Trojan.Vaklik.kku Checkin Response"; flow:from_server,established; flowbits:isset,et.trojan.valkik.kku; content:"Content-Length|3a 20|88|0d 0a|"; nocase; content:"|0d 0a 0d 0a|"; distance:0; content:"|48 00 00 00|"; distance:4; within:4; flowbits:unset,et.trojan.valkik.kku; reference:md5,9688d1d37a7ced200c53ec2b9332a0ad; reference:md5,81d8a235cb5f7345b5796483abe8145f; classtype:command-and-control; sid:2012961; rev:3; metadata:created_at 2011_06_09, former_category MALWARE, updated_at 2011_06_09;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret RD"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 5"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FCB4B50A-E3F1-4174-BD18-54C3B3287258/si"; reference:url,packetstormsecurity.org/files/view/103964/teechart_pro.rb.txt; classtype:attempted-user; sid:2013432; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_08_19, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret SPECAT"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 4"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BDEB0088-66F9-4A55-ABD2-0BF8DEEC1196/si"; reference:url,packetstormsecurity.org/files/view/103964/teechart_pro.rb.txt; classtype:attempted-user; sid:2013431; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_08_19, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Secret REL TO"; flow:to_server,established; pcre:"/(? $HOME_NET any (msg:"ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 3"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FAB9B41C-87D6-474D-AB7E-F07D78F2422E/si"; reference:url,packetstormsecurity.org/files/view/103964/teechart_pro.rb.txt; classtype:attempted-user; sid:2013430; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_08_19, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Confidential COMINT"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002511; classtype:policy-violation; sid:2002511; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 2"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*536600D3-70FE-4C50-92FB-640F6BFC49AD/si"; reference:url,packetstormsecurity.org/files/view/103964/teechart_pro.rb.txt; classtype:attempted-user; sid:2013429; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_08_19, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Top Secret COMINT"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002512; classtype:policy-violation; sid:2002512; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX TeeChart Professional ActiveX Control integer overflow Vulnerability 1"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6C10489-FB89-11D4-93C9-006008A7EED4/si"; reference:url,packetstormsecurity.org/files/view/103964/teechart_pro.rb.txt; classtype:attempted-user; sid:2013428; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_08_19, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Secret COMINT"; flow:to_server,established; pcre:"/(? $HOME_NET 21 (msg:"ET FTP FTP CWD command attempt without login"; flow:established,to_server; flowbits:isnotset,ET.ftp.user.login; content:!"USER"; depth:4; content:"CWD"; nocase; reference:url,www.nsftools.com/tips/RawFTP.htm; reference:url,doc.emergingthreats.net/2010731; classtype:attempted-recon; sid:2010731; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Secret COMSEC"; flow:to_server,established; pcre:"/(? $HOME_NET any (msg:"ET FTP USER login flowbit"; flow:established,to_server; content:"USER "; nocase; depth:5; flowbits:set,ET.ftp.user.login; flowbits:noalert; reference:url,doc.emergingthreats.net/bin/view/Main/2002850; classtype:not-suspicious; sid:2002850; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Confidential COMINT"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002591; classtype:policy-violation; sid:2002591; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Mitglieder Proxy Trojan CnC"; dsize:2; byte_test:2, >, 1024, 0; threshold:type both, track by_src, count 1000, seconds 300; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Win32%2fMitglieder; classtype:command-and-control; sid:2013418; rev:5; metadata:created_at 2011_08_18, updated_at 2011_08_18;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Top Secret COMINT"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002592; classtype:policy-violation; sid:2002592; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/TrojanDownloader.Chekafe.D Initial Checkin"; flow:established,to_server; content:"/count.php?id="; http_uri; content:"&isInst="; http_uri; content:"&lockcode="; http_uri; content:"&pc="; http_uri; content:"&PcType="; http_uri; content:"&AvName="; http_uri; content:"&ProCount="; http_uri; classtype:command-and-control; sid:2013447; rev:3; metadata:created_at 2011_08_22, former_category MALWARE, updated_at 2011_08_22;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Secret COMINT"; flow:to_server,established; pcre:"/(? $EXTERNAL_NET any (msg:"ET ADWARE_PUP SurfSideKick Activity (iinfo)"; flow:established,to_server; content:"/iinfo.htm?host="; http_uri; content:"&action=update"; http_uri; content:"&ver="; http_uri; content:"&bundle="; http_uri; content:"&client="; http_uri; content:"&bp_id="; http_uri; content:"&prmerr="; http_uri; content:"&ir="; http_uri; classtype:pup-activity; sid:2013448; rev:6; metadata:created_at 2011_08_22, former_category ADWARE_PUP, updated_at 2011_08_22;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Secret TK"; flow:to_server,established; pcre:"/(? $HOME_NET any (msg:"ET MALWARE Vobfus/Changeup/Chinky Download Command"; flow:to_client,established; content:"|3a 2e|dl http|3a|"; depth:11; reference:url,www.symantec.com/connect/blogs/w32changeup-threat-profile; reference:url,doc.emergingthreats.net/2010973; reference:url,www.sunbeltsecurity.com/partnerresources/cwsandbox/md5.aspx?id=beb8bc1ba5dbd8de0761ef362bc8b0a4; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fVobfus; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2009-081806-2906-99&tabid=2; reference:md5,f8880b851ea5ed92dd97657574fb4f70; classtype:trojan-activity; sid:2010973; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Secret NOFORN"; flow:to_server,established; pcre:"/(? $EXTERNAL_NET any (msg:"ET POLICY NSPlayer User-Agent Windows Media Player streaming detected"; flow:established,to_server; content:"User-Agent|3A 20|NSPlayer|2F|"; http_header; threshold: type limit, track by_src, seconds 300, count 1; reference:url,msdn.microsoft.com/en-us/library/cc234851; classtype:policy-violation; sid:2011874; rev:3; metadata:created_at 2010_10_29, updated_at 2010_10_29;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Secret ORCON"; flow:to_server,established; pcre:"/(? $HOME_NET any (msg:"ET EXPLOIT Java Exploit Attempt applet via file URI param"; flow:established,from_server; content:"applet"; nocase; content:"file|3a|C|3a 5c|Progra"; fast_pattern; nocase; distance:0; content:"java"; nocase; distance:0; content:"jre6"; nocase; distance:0; content:"lib"; nocase; distance:0; content:"ext"; nocase; distance:0; reference:url,fhoguin.com/2011/03/oracle-java-unsigned-applet-applet2classloader-remote-code-execution-vulnerability-zdi-11-084-explained/; reference:cve,CVE-2010-4452; classtype:trojan-activity; sid:2012884; rev:3; metadata:created_at 2011_05_28, former_category CURRENT_EVENTS, updated_at 2011_05_28;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Secret SPECAT"; flow:to_server,established; pcre:"/(? $EXTERNAL_NET any (msg:"ET POLICY Facebook Like Button Clicked (1)"; flow:to_server,established; content:"/uiserver.php?social_plugin=like"; http_uri; content:"external_page_url="; http_uri; content:"Host|3a| www.facebook.com|0d 0a|"; http_header; reference:url,developers.facebook.com/docs/reference/plugins/like/; reference:url,news.cnet.com/8301-1023_3-20094866-93/facebooks-like-button-illegal-in-german-state/; classtype:policy-violation; sid:2013458; rev:2; metadata:created_at 2011_08_25, updated_at 2011_08_25;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Secret"; flow:to_server,established; pcre:"/(? $EXTERNAL_NET any (msg:"ET POLICY Facebook Like Button Clicked (2)"; flow:to_server,established; content:"/plugins/like.php?"; http_uri; content:"href="; http_uri; content:"action=like"; http_uri; content:"Host|3a| www.facebook.com|0d 0a|"; http_header; reference:url,developers.facebook.com/docs/reference/plugins/like/; reference:url,news.cnet.com/8301-1023_3-20094866-93/facebooks-like-button-illegal-in-german-state/; classtype:policy-violation; sid:2013459; rev:2; metadata:created_at 2011_08_26, updated_at 2011_08_26;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED offers.e-centives.com Coupon Printer"; flow:established,to_server; content:"|0d 0a|User-Agent\: Mozilla/4.0 (compatible\; YourApp\; AK\; Windows 95)|0d 0a|"; nocase; reference:url,offers.e-centives.com; reference:url,doc.emergingthreats.net/2010338; classtype:policy-violation; sid:2010338; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> any any (msg:"ET ADWARE_PUP Win32/Wizpop Initial Checkin"; flow:established,to_server; content:"User-Agent|3a| WizPop"; http_header; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Adware%3AWin32%2FWizpop&ThreatID=159818; classtype:pup-activity; sid:2013461; rev:3; metadata:created_at 2011_08_26, former_category MALWARE, updated_at 2011_08_26;) +#alert tcp $HOME_NET any -> 66.151.158.177 any (msg:"ET DELETED GotoMyPC Polling Client"; flow: established; threshold: type limit, track by_src, count 1, seconds 360; reference:url,doc.emergingthreats.net/2000309; classtype:policy-violation; sid:2000309; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Phoenix Landing Page Obfuscated Javascript 2"; flow:established,to_client; content:"/R"; classtype:trojan-activity; sid:2013314; rev:5; metadata:created_at 2011_07_26, updated_at 2011_07_26;) +#alert tcp 66.151.158.177 8200 -> $HOME_NET any (msg:"ET DELETED GotoMyPC poll.gotomypc.com Server Response to Polling Client OK"; flow: established,from_server; content:"cnt=0"; nocase; depth: 40; content:"eventid="; nocase; depth: 40; threshold: type limit, track by_src, count 1, seconds 360; reference:url,doc.emergingthreats.net/2002022; classtype:policy-violation; sid:2002022; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"ET DELETED MS Terminal Server User A Login, possible Morto inbound"; flow:to_server,established; content:"|03 00 00|"; depth:3; content:"|e0 00 00 00 00 00|"; offset:5; depth:6; content:"Cookie|3a| mstshash=a|0d 0a|"; nocase; reference:cve,CAN-2001-0540; classtype:protocol-command-decode; sid:2013497; rev:2; metadata:created_at 2011_08_30, updated_at 2011_08_30;) +#alert tcp $HOME_NET any <> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Gmail gtalk"; flow:established; pcre:"/\[\[\d{1,3}\,\[\\\"\w\\\"\,\\\".+@gmail.com.+\\\"\,\\\"/i"; reference:url,doc.emergingthreats.net/2003092; classtype:policy-violation; sid:2003092; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Best Pack Exploit Pack Binary Load Request"; flow:established,to_server; content:".php?e="; http_uri; content:"&o="; http_uri; content:"&b="; http_uri; content:"&id="; http_uri; pcre:"/\.php\?e=\d+&o=\w+&b=\w+&id=[0-9a-f]{32}$/U"; reference:url,www.kahusecurity.com/2011/best-pack/; classtype:bad-unknown; sid:2013489; rev:3; metadata:created_at 2011_08_30, updated_at 2011_08_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED MSN Game Loading"; flow:established,to_server; content:"|6D 73 6E 67 61 6D 65 2E 61 73 70 78|"; depth:90; reference:url,doc.emergingthreats.net/2002312; classtype:policy-violation; sid:2002312; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED PDF Name Representation Obfuscation of JBIG2Decode, Very Likely Memory Corruption Attempt"; flow:established,to_client; content:"obj"; content:"<<"; within:4; content:"/"; within:50; content:!"JBIG2Decode"; within:11; content:"#"; within:31; pcre:"/\x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^JBIG2Decode](J|#4A)(B|#42)(I|#49)(G|#47)(2|#32)(D|#44)(e|#65)(c|#63)(o|#6F)(d|#64)(e|#65)/smi"; reference:url,blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/; reference:url,blog.didierstevens.com/2009/03/01/quickpost-jbig2decode-signatures/; reference:bugtraq,33751; reference:cve,2009-0658; classtype:attempted-user; sid:2011534; rev:7; metadata:created_at 2010_09_27, updated_at 2010_09_27;) +#alert tcp $EXTERNAL_NET 5050 <> $HOME_NET any (msg:"ET DELETED Yahoo Chat Activity Inside Webmail (2)"; flow:established,to_server; content:" $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/Wizpop Checkin"; flow:established,to_server; content:"/count.asp?exe="; http_uri; content:"&act="; http_uri; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Adware%3AWin32%2FWizpop&ThreatID=159818; classtype:pup-activity; sid:2013502; rev:4; metadata:created_at 2011_08_31, former_category MALWARE, updated_at 2011_08_31;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET DELETED Possible Image Spam Inbound (simple rule)"; flow:established,to_server; content:"Content-Transfer-Encoding|3A|"; content:"AMAgAOAgAABAACBAAEBAAGBAAIBAAKBAAMBAAOBAAABgACBgAEBgAGBgAIBgAKBgAMBgAOBg"; depth:575; content:"AACAACCAAECAAGCAAICAAKCAAMCAAOCAAACgACCgAECgAGCgAICgAKCgAMCgAOCgAADAACDA"; content:"AEDAAGDAAIDAAKDAAMDAAODAAADgACDgAEDgAGDgAIDgAKDgAMDgAODgAAAAQCAAQEAAQGAA"; reference:url,doc.emergingthreats.net/2003096; classtype:misc-activity; sid:2003096; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> 11.11.11.11 55611 (msg:"ET MALWARE W32/Badlib Connectivity Check To Department of Defense Intelligence Information Systems"; flow:to_server; flags:S; reference:url,blog.eset.com/2011/08/03/win32delf-qcztrust-me-i%E2%80%99m-your-anti-virus; reference:url,www.eset.com/about/blog/blog/article/win32delf-qcz-additional-details; classtype:trojan-activity; sid:2013506; rev:1; metadata:created_at 2011_08_31, updated_at 2011_08_31;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET DELETED Possible Image Spam Inbound (complex rule)"; flow:established,to_server; content:"Content-Transfer-Encoding|3A|"; content:"AMAgAOAgAABAACBAAEBAAGBAAIBAAKBAAMBAAOBAAABgACBgAEBgAGBgAIBgAKBgAMBgAOBg"; depth:575; content:"AACAACCAAECAAGCAAICAAKCAAMCAAOCAAACgACCgAECgAGCgAICgAKCgAMCgAOCgAADAACDA"; content:"AEDAAGDAAIDAAKDAAMDAAODAAADgACDgAEDgAGDgAIDgAKDgAMDgAODgAAAAQCAAQEAAQGAA"; content:"QIAAQKAAQMAAQOAAQAAgQCAgQEAgQGAgQIAgQKAgQMAgQOAgQABAQCBAQEBAQGBAQIBAQKBA"; content:"QMBAQOBAQABgQCBgQEBgQGBgQIBgQKBgQMBgQOBgQACAQCCAQECAQGCAQICAQKCAQMCAQOCA"; content:"QACgQCCgQECgQGCgQICgQKCgQMCgQOCgQADAQCDAQEDAQGDAQIDAQKDAQMDAQODAQADgQCDg"; content:"QEDgQGDgQIDgQKDgQMDgQODgQAAAgCAAgEAAgGAAgIAAgKAAgMAAgOAAgAAggCAggEAggGAg"; content:"gIAggKAggMAggOAggABAgCBAgEBAgGBAgIBAgKBAgMBAgOBAgABggCBggEBggGBggIBggKBg"; content:"gMBggOBggACAgCCAgECAgGCAgICAgKCAgMCAgOCAgACggCCggECggGCggICggKCggMCggOCg"; content:"gADAgCDAgEDAgGDAgIDAgKDAgMDAgODAgADggCDggEDggGDggIDggKDggMDggODggAAAwCAA"; content:"wEAAwGAAwIAAwKAAwMAAwOAAwAAgwCAgwEAgwGAgwIAgwKAgwMAgwOAgwABAwCBAwEBAwGBA"; content:"wIBAwKBAwMBAwOBAwABgwCBgwEBgwGBgwIBgwKBgwMBgwOBgwACAwCCAwECAwGCAwICAwKCA"; content:"wMCAwOCAwACgwCCgwECgwGCgwICgwKCgwMCgwOCgwADAwCDAwEDAwGDAwIDAwKDAwP/78KCg"; reference:url,doc.emergingthreats.net/2003097; classtype:misc-activity; sid:2003097; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Bancos Reporting"; flow:established,to_server; content:".php?codigo="; http_uri; content:"&g_id="; http_uri; content:"&g_windows="; http_uri; content:"&func_versao_ie="; http_uri; content:"&firefox="; http_uri; content:"&primeira_versao_update="; http_uri; content:"&ultimo_acesso="; http_uri; classtype:trojan-activity; sid:2013513; rev:2; metadata:created_at 2011_08_31, former_category TROJAN, malware_family Bancos, tag Banking_Trojan, updated_at 2018_04_23;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET DELETED Possible Image Spam Inbound (3)"; flow:established,to_server; content:"Content-Transfer-Encoding|3A|"; content:"R0lGODlh"; depth:575; content:"AOAgAABAACBAAEBAAGBAAIBAAKBAAMBAAOBAAABgACBgAEBgAGBgAIBgAKBgAMBgAOBgAACAACCA"; content:"AECAAGCAAICAAKCAAMCAAOCAAACgACCgAECgAGCgAICgAKCgAMCgAOCgAADAACDAAEDAAGDAAIDA"; reference:url,doc.emergingthreats.net/2003120; classtype:misc-activity; sid:2003120; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Suspicious User-Agent FSD - Possible FakeAV Related"; flow:established,to_server; content:"User-Agent|3A 20|FSD|0D 0A|"; http_header; classtype:trojan-activity; sid:2013393; rev:4; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_08_10, deployment Perimeter, signature_severity Major, tag User_Agent, updated_at 2016_07_01;) +#alert tcp $HOME_NET any -> 76.74.9.18 $HTTP_PORTS (msg:"ET DELETED Milw0rm Exploit Archive Download"; content:"GET /sploits/milw0rm.tar.bz2"; depth:60; flow:to_server,established; reference:url,www.milw0rm.com; reference:url,doc.emergingthreats.net/2008524; classtype:misc-activity; sid:2008524; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Driveby Loader Request sn.php"; flow:established,to_server; content:"/sn.php?c="; http_uri; depth:10; content:"&t="; http_uri; pcre:"/c\x3d[0-9a-f]{100}/Ui"; classtype:trojan-activity; sid:2013519; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_09_02, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) +#alert tcp $HOME_NET any -> any !$HTTP_PORTS (msg:"ET DELETED PCMesh Anonymous Proxy client connect"; flow: from_client,established; content:"http|3a|//www.pcmesh.com|3a|80/ip-check.cgi"; depth:37; offset:4; reference:url,doc.emergingthreats.net/2003040; classtype:policy-violation; sid:2003040; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Pitbull IRCbotnet Fetch"; flow:to_server,established; content:"Accept|3a20|*/*|0d0a|User-Agent|3a20|Mozilla/5.0|0d0a|"; http_header; reference:url,en.wikipedia.org/wiki/IRC_bot; reference:url,doc.emergingthreats.net/2007626; classtype:trojan-activity; sid:2007626; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Prospero Chat Session in Progress"; flow: established,to_server; content:"PCHAT2 "; offset: 0; depth: 7; content:"v='"; nocase; offset: 8; depth: 400; content:"jv='"; nocase; offset: 8; depth: 400; content:"u='"; nocase; offset: 8; depth: 400; reference:url,www.prospero.com/technology.htm; reference:url,doc.emergingthreats.net/2001989; classtype:policy-violation; sid:2001989; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET 1024: (msg:"ET MALWARE Backdoor.Win32.Fynloski.A Command Request"; flow:to_server,established; content:"#BOT#"; depth:5; pcre:"/^\x23BOT\x23(VisitUrl|OpenUrl|Ping|RunPrompt|CloseServer|SvrUninstall|URLUpate|URLDownload)/i"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3aWin32%2fFynloski.A&ThreatID=-2147327112; reference:url,home.mcafee.com/virusinfo/virusprofile.aspx?key=570863; classtype:trojan-activity; sid:2013532; rev:2; metadata:created_at 2011_09_03, updated_at 2011_09_03;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Real.com Game Arcade Install (User agent)"; flow: established,to_server; content:"User-Agent\:"; nocase; pcre:"/User-Agent\:[^\n]+ARCADE_BUNDLE_DOWNLOADER/i"; reference:url,doc.emergingthreats.net/2003045; classtype:policy-violation; sid:2003045; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor.Win32.Fynloski.A Command Response"; flow:to_server,established; content:"#botCommand%"; depth:12; pcre:"/^\x23botCommand\x25(close\x20command|Error|Finish|Http\x20Flood|Mass\x20Download|Respond\x20\x5bOK|Syn\x20Flood|UDP\x20Flood|uninstall|Update|)/i"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3aWin32%2fFynloski.A&ThreatID=-2147327112; reference:url,home.mcafee.com/virusinfo/virusprofile.aspx?key=570863; classtype:trojan-activity; sid:2013533; rev:2; metadata:created_at 2011_09_03, updated_at 2011_09_03;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Real.com Game Arcade Install"; flow: established,to_server; content:"/gameconsole/bundlescripts/"; reference:url,doc.emergingthreats.net/2003046; classtype:policy-violation; sid:2003046; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET MALWARE Potential DNS Command and Control via TXT queries"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|00 00 10 00 01|"; threshold:type both, track by_src,count 10, seconds 300; reference:url,lists.emergingthreats.net/pipermail/emerging-sigs/2011-September/015625.html; classtype:trojan-activity; sid:2013514; rev:2; metadata:created_at 2011_09_02, updated_at 2011_09_02;) +#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET DELETED TLS/SSL Server Hello Done on Unusual Port"; flowbits:isset,BS.SSL.Server.Key; flow:established; content:"|16 03 01|"; content:"|0e|"; within:6; flowbits:set,BS.SSL.Server.Hello.Done; flowbits:noalert; reference:url,doc.emergingthreats.net/2003016; classtype:unusual-client-port-connection; sid:2003016; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TROJ_VB.FJP Generic Dowbnloader Connectivity Check to Google"; flow:established,to_server; content:"/whatever.exe"; fast_pattern; http_uri; content:"Host|3A 20|google.com|0d 0a|"; http_header; classtype:trojan-activity; sid:2013544; rev:2; metadata:created_at 2011_09_06, updated_at 2011_09_06;) +#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET DELETED TLS/SSL Server Hello Done on Unusual Port SSLv3"; flowbits:isset,BS.SSL.Server.Key; flow:established; content:"|16 03 00|"; content:"|0e|"; within:6; flowbits:set,BS.SSL.Server.Hello.Done; flowbits:noalert; reference:url,doc.emergingthreats.net/2003017; classtype:unusual-client-port-connection; sid:2003017; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp $HOME_NET any -> $EXTERNAL_NET 54 (msg:"ET MALWARE Win32.Unknown.UDP.edsm CnC traffic"; content:"|65 f2 9c 64 cf 0a 5e d3 f6 5b 2a 9f 73 3c 91 4d|"; offset:16; depth:16; threshold:type limit, track by_src, count 1, seconds 600; reference:url,xml.ssdsandbox.net/view/11c0df38d31121885a76500140780cef; classtype:command-and-control; sid:2013547; rev:2; metadata:created_at 2011_09_07, former_category MALWARE, updated_at 2011_09_07;) +#alert tcp $HOME_NET any -> any 139 (msg:"ET DELETED BugBear@MM Worm Copied to Startup Folder"; flow: established; content:"|77 00 69 00 6B 00 2E 00 65 00 78 00 65 00 00 00|"; reference:url,www.symantec.com/avcenter/venc/data/w32.bugbear@mm.html; reference:url,doc.emergingthreats.net/2001766; classtype:misc-activity; sid:2001766; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Fivfrom Downloader (Unitrix)"; flow:established,to_server; content:".php?seller="; http_uri; content:"&hash={"; http_uri; pcre:"/hash=\{[a-f0-9]+-/Ui"; classtype:trojan-activity; sid:2013555; rev:5; metadata:created_at 2011_09_10, updated_at 2011_09_10;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET DELETED Mytob.X clam SMTP Inbound"; flow:to_server,established; content:"UEsDBAoA"; content:"ojRrPyGt"; distance:8; within:16; reference:url,www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=42326; reference:url,doc.emergingthreats.net/2002892; classtype:trojan-activity; sid:2002892; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potentially Unwanted Program Storm3-607.exe Download Reporting"; flow:established,to_server; content:"GET"; http_method; content:"/Storm3-607.exe"; nocase; http_uri; content:"User-Agent|3a| InnoTools_Downloader"; http_header; classtype:trojan-activity; sid:2013560; rev:3; metadata:created_at 2011_09_12, updated_at 2011_09_12;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET DELETED Mytob.X clam SMTP Outbound"; flow:to_server,established; content:"UEsDBAoA"; content:"ojRrPyGt"; distance:8; within:16; reference:url,www3.ca.com/securityadvisor/virusinfo/virus.aspx?ID=42326; reference:url,doc.emergingthreats.net/2002893; classtype:trojan-activity; sid:2002893; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Tom Sawyer Software Possible Memory Corruption Attempt"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*658ED6E7-0DA1-4ADD-B2FB-095F08091118/si"; classtype:web-application-attack; sid:2013565; rev:2; metadata:created_at 2011_09_12, updated_at 2011_09_12;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET DELETED W32.Nugache SMTP Inbound"; flow:to_server,established; content:"RE9TIG1v"; content:"GUuDQ0KJ"; distance:1; within:9; reference:url,www.symantec.com/avcenter/venc/data/w32.nugache.a@mm.html; reference:url,doc.emergingthreats.net/2002894; classtype:trojan-activity; sid:2002894; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Tom Sawyer Possible Memory Corruption Attempt Format String Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"TomSawyer.DefaultExtFactory.5.5.3.238.VS7.1"; nocase; distance:0; classtype:attempted-user; sid:2013566; rev:2; metadata:created_at 2011_09_12, updated_at 2011_09_12;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET DELETED W32.Nugache SMTP Outbound"; flow:to_server,established; content:"RE9TIG1v"; content:"GUuDQ0KJ"; distance:1; within:9; reference:url,www.symantec.com/avcenter/venc/data/w32.nugache.a@mm.html; reference:url,doc.emergingthreats.net/2002895; classtype:trojan-activity; sid:2002895; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET 1024: -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Suspicious Win32 User Agent"; flow:to_server,established; content:"User-Agent|3a| Win32"; http_header; classtype:trojan-activity; sid:2012316; rev:3; metadata:created_at 2011_02_18, updated_at 2011_02_18;) +#alert tcp $HOME_NET !$HTTP_PORTS -> $EXTERNAL_NET 1639 (msg:"ET DELETED Bofra Victim Accessing Reactor Page"; flow: from_client,established; content:"GET "; nocase; content:"reactor"; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/w32.bofra.e@mm.html; reference:url,us.mcafee.com/virusInfo/default.asp?id=description&virus_k=129631; reference:url,doc.emergingthreats.net/2001430; classtype:trojan-activity; sid:2001430; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY PDF File Containing Javascript"; flow:established,to_client; content:"obj"; content:"<<"; within:4; content:"/JavaScript"; nocase; distance:0; pcre:"/\x3C\x3C[^>]*\x2FJavaScript/smi"; threshold:type limit, count 1, seconds 60, track by_src; classtype:misc-activity; sid:2010882; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Likely EXE Cryptor Packed Binary - Likely Malware"; flow:from_server,established; content:"|4D 5A|"; content:"|2E 70 61 63 6B 65 64|"; within: 447; reference:url,bits.packetninjas.org; reference:url,doc.emergingthreats.net/2008557; classtype:trojan-activity; sid:2008557; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Downbot/Shady Rat Remote Shell Connection"; flow:established,from_server; dsize:<90; content:"|2F 2A 0A 40 2A 2A 2A 40 2A 40 40 40 40 40 40 40 40 40 40 40|"; depth:20; flowbits:set,et.shadyratinit; reference:url,www.symantec.com/connect/blogs/truth-behind-shady-rat; classtype:trojan-activity; sid:2013379; rev:3; metadata:created_at 2011_08_09, updated_at 2011_08_09;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Gh0st Trojan CnC"; flow:established,to_server; content:"Gh0st"; depth:5; flowbits:set,ET.gh0st_client; reference:url,doc.emergingthreats.net/2010859; classtype:command-and-control; sid:2010859; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, malware_family Gh0st, malware_family PCRAT, signature_severity Critical, tag PCRAT, tag Gh0st, tag RAT, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Zugo Toolbar Spyware/Adware download request"; flow:established,to_server; content:".exe?filename="; http_uri; content:"&dddno="; http_uri; fast_pattern; content:"&channel="; http_uri; content:"&go="; http_uri; reference:url,zugo.com/privacy-policy/; classtype:pup-activity; sid:2013658; rev:2; metadata:created_at 2011_09_15, former_category ADWARE_PUP, updated_at 2011_09_15;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Gh0st Trojan CnC Response"; flow:established,from_server; content:"Gh0st"; depth:5; flowbits:isset,ET.gh0st_client; reference:url,doc.emergingthreats.net/2010860; classtype:command-and-control; sid:2010860; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, malware_family Gh0st, malware_family PCRAT, signature_severity Critical, tag PCRAT, tag Gh0st, tag RAT, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Exploit kit worms.jar"; flow:established,to_server; content:"pack200"; http_header; content:" Java/"; http_header; content:"/worms.jar"; http_uri; classtype:exploit-kit; sid:2013661; rev:2; metadata:created_at 2011_09_15, former_category EXPLOIT_KIT, updated_at 2011_09_15;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET DELETED Hupigon CnC init (variant abb)"; flow:established,to_server; dsize:4; flowbits:isnotset,ET.hupa.init; flowbits:noalert; content:"|00 00 00 00|"; flowbits:set,ET.hupa.init; reference:url,doc.emergingthreats.net/2008041; classtype:command-and-control; sid:2008041; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED PinBall Corp. Related suspicious activity"; flow:established,to_server; content:"|0d 0a|User-Agent|3a| PinBallCorp-BSAI"; reference:url,doc.emergingthreats.net/2009908; classtype:trojan-activity; sid:2009908; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 3128 (msg:"ET DELETED Likely Hupigon Post to Controller"; flow:established,to_server; content:"POST /+"; depth:7; flowbits:noalert; flowbits:set,ET.Hupinit1; reference:url,www.f-secure.com/v-descs/backdoor_w32_hupigon.shtml; reference:url,doc.emergingthreats.net/2008389; classtype:trojan-activity; sid:2008389; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"GPL ATTACK_RESPONSE id check returned web"; flow:from_server,established; content:"uid="; content:"|28|web|29|"; within:25; classtype:bad-unknown; sid:2101884; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET 3128 -> $HOME_NET any (msg:"ET DELETED Hupigon Response from Controller (YES - ~~@@)"; flow:established,from_server; flowbits:isset,ET.Hupinit1; content:"HTTP/1.0 200 OK|0d 0a 0d 0a|YES|0d 0a 7e 7e|"; depth:26; content:"@@|0d 0a 0d 0a|"; within:150; reference:url,www.f-secure.com/v-descs/backdoor_w32_hupigon.shtml; reference:url,doc.emergingthreats.net/2008390; classtype:trojan-activity; sid:2008390; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Unknown Exploit Pack Binary Load Request (server_privileges.php)"; flow:established,to_server; content:"/server_privileges.php?"; http_uri; pcre:"/\/server_privileges\.php\?[0-9a-f]{32}=\d+(&\w+)?$/U"; classtype:trojan-activity; sid:2013663; rev:2; metadata:created_at 2011_09_19, updated_at 2011_09_19;) +#alert icmp any any -> any any (msg:"ET DELETED ICMP Banking Trojan sending encrypted stolen data"; dsize:>64; itype:8; icode:0; content:"|08|"; depth:1; byte_test:4,>,64,1,little; byte_test:4,<,1500,1,little; content:"|0000|"; distance:4; within:1495; reference:url,www.websensesecuritylabs.com/alerts/alert.php?AlertID=570; reference:url,doc.emergingthreats.net/2003073; classtype:trojan-activity; sid:2003073; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Riberow.A (touch)"; flow:to_server,established; content:"/touch.php?dir="; http_uri; content:" HTTP/1.1|0d 0a|Host|3a| "; content:"|0d 0a|Pragma|3a| no-cache|0d 0a|Accept|3a| */*|0d 0a 0d 0a|"; within:70; content:!"User-Agent|3a|"; http_header; reference:md5,c55fe941b80b3e5e77be8728642d138e; classtype:trojan-activity; sid:2013671; rev:2; metadata:created_at 2011_09_19, former_category MALWARE, updated_at 2011_09_19;) +#alert tcp $HOME_NET any -> any any (msg:"ET DELETED Kaiten IRCbotnet Response"; flow:established; flowbits:isset,irc.start; content:"NOTICE|20|"; content:"|20 3A|"; within:32; pcre:"/\x20\x3A(Receiving\x20file.\x0A|Saved\x20as\x20|Spoofs\x3A\x20|Kaiten\x20wa\x20goraku|Current\x20status\x20is\x3a\x20|Removed\x20all\x20spoofs|Packeting\x20|Panning\x20|Tsunami\x20heading\x20for\x20|Unknowing\x20|Killing\x20pid\x20)/"; reference:url,en.wikipedia.org/wiki/IRC_bot; reference:url,doc.emergingthreats.net/2007622; classtype:trojan-activity; sid:2007622; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS InitiateSystemShutdown unicode attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 18|"; within:2; distance:19; classtype:protocol-command-decode; sid:2102480; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp any any -> $HOME_NET any (msg:"ET DELETED Kaiten IRCbotnet Commands"; flow:from_server,established; content:"PRIVMSG|20 21|"; pcre:"/PRIVMSG\x20\x21\S+\x20(TSUNAMI\x20|PAN\x20|UDP\x20|UNKNOWN\x20|GETSPOOFS|SPOOFS\x20)/i"; reference:url,en.wikipedia.org/wiki/IRC_bot; reference:url,doc.emergingthreats.net/2007623; classtype:trojan-activity; sid:2007623; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS InitiateSystemShutdown unicode little endian attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|18 00|"; within:2; distance:19; classtype:protocol-command-decode; sid:2102481; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET DELETED Juicopotomous to Controller"; flow:established,to_server; dsize:1; content:"|7c|"; flowbits:set,ET.unknown.setup; flowbits:noalert; reference:url,doc.emergingthreats.net/2008245; classtype:trojan-activity; sid:2008245; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS InitiateSystemShutdown attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 18|"; within:2; distance:19; classtype:protocol-command-decode; sid:2102482; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET DELETED Juicopotomous ack from Controller"; flowbits:isset,ET.unknown.setup; flow:established,from_server; dsize:<50; content:"|7d 27|"; depth:2; flowbits:set,ET.unknown.replied; reference:url,doc.emergingthreats.net/2008246; classtype:trojan-activity; sid:2008246; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS InitiateSystemShutdown little endian attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|18 00|"; within:2; distance:19; classtype:protocol-command-decode; sid:2102483; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET DELETED Juicopotomous ack to Controller"; flowbits:isset,ET.unknown.replied; flow:established,to_server; dsize:<50; content:"|7e 27|"; depth:2; reference:url,doc.emergingthreats.net/2008247; classtype:trojan-activity; sid:2008247; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS winreg unicode bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; content:"|05|"; distance:4; within:1; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; classtype:protocol-command-decode; sid:2102479; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Nine Ball Infection Ping Outbound"; icode:0; itype:8; dsize:32; content:"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"; reference:url,doc.emergingthreats.net/2011185; classtype:trojan-activity; sid:2011185; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS winreg bind attempt"; flow:established,to_server; flowbits:isset,smb.tree.create.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; content:"|05|"; distance:4; within:1; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; classtype:protocol-command-decode; sid:2102478; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Nine Ball Infection Posting Data"; flow:established,to_server; content:"POST /"; depth:6; content:"/gate/"; distance:0; content:".php"; distance:0; content:"|0d 0a 0d 0a|"; distance:0; content:"AAAAAAAACI"; distance:67; within:10; reference:url,www.martinsecurity.net/page/3; reference:url,doc.emergingthreats.net/2011187; classtype:trojan-activity; sid:2011187; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS winreg unicode create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"|5C 00|w|00|i|00|n|00|r|00|e|00|g|00 00 00|"; within:16; distance:78; nocase; flowbits:set,smb.tree.create.winreg; classtype:protocol-command-decode; sid:2102477; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Prg Trojan v0.1 Binary In Transit"; flow:to_client,established; content:"MZ"; content:"|1D B9 F2 75 62 85 5A 4F 15 48 52 1D 50 90 41 89 37 9F FF 94 CE A6 3E 63 35 AB 29 6B 30 43 2F 45 46 B0 E1 C2 11 7F 0C 55 0F C7|"; depth:128; reference:url,www.securescience.net/FILES/securescience/10378/pubMalwareCaseStudy.pdf; reference:url,doc.emergingthreats.net/2003184; classtype:trojan-activity; sid:2003184; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS winreg create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB|A2|"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"|5C|winreg|00|"; within:8; distance:78; nocase; flowbits:set,smb.tree.create.winreg; classtype:protocol-command-decode; sid:2102476; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Prg Trojan v0.2 Binary In Transit"; flow:to_client,established; content:"MZ"; content:"|13 B9 F2 75 62 85 5A 4F 15 48 19 1D 10 4F 0D 5B 04 5B 04 60 CE 5F 00 67 F5 AE 25 6B 20 41 23 B3|"; depth:128; reference:url,www.securescience.net/FILES/securescience/10378/pubMalwareCaseStudy.pdf; reference:url,doc.emergingthreats.net/2003185; classtype:trojan-activity; sid:2003185; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS C$ unicode share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,&,128,6,relative; byte_jump:2,34,little,relative; content:"C|00 24 00 00 00|"; distance:2; nocase; content:!"I|00|P|00|C|00 24 00 00 00|"; within:10; distance:-10; nocase; classtype:protocol-command-decode; sid:2102472; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Prg Trojan v0.3 Binary In Transit"; flow:to_client,established; content:"MZ"; content:"| 5E 7D 66 7D 28 40 19 88 5F 8C 13 50 15 59 08 58 3C 97 00 9B 33 A5 F9 AF 39 68 F0 9F 27 AF E9 A8 25 B7 18 B6 15 7F 0E B6 1A|"; depth:128; reference:url,www.securescience.net/FILES/securescience/10378/pubMalwareCaseStudy.pdf; reference:url,doc.emergingthreats.net/2003186; classtype:trojan-activity; sid:2003186; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB ADMIN$ unicode share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,&,128,6,relative; byte_jump:2,34,little,relative; content:"A|00|D|00|M|00|I|00|N|00 24 00 00 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2102473; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp any any -> any any (msg:"ET DELETED Generic Raider Obfuscated VBScript"; flow:established; content:"execute"; content:"|22 22 22 22 22 3A|"; offset:8; content:"function"; nocase; pcre:"/\x22\x3A(\w)\x3D\x22execute\s+\x22{5}\x3A.*\x3Aexecute\s*\x28\s*\1\s*\x29\x3Aend\s+function\x3A/s"; reference:url,bbs.duba.net/viewthread.php?tid=21892104&page=1&extra=page=1; reference:url,doc.emergingthreats.net/2008278; classtype:trojan-activity; sid:2008278; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB C$ unicode share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,&,128,6,relative; byte_jump:2,34,little,relative; content:"C|00 24 00 00 00|"; distance:2; nocase; content:!"I|00|P|00|C|00 24 00 00 00|"; within:10; distance:-10; nocase; classtype:protocol-command-decode; sid:2102470; rev:12; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Proxy.Win32.Wopla.ag Check-In"; flow:established,to_server; dsize:12; content:"|0a 00 00 00 00 00 00 00 00 00 00 00|"; reference:url,doc.emergingthreats.net/2007603; classtype:trojan-activity; sid:2007603; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB D$ unicode share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,&,128,6,relative; byte_jump:2,34,little,relative; content:"D|00 24 00 00 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2102467; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 1863 (msg:"ET DELETED Singworm MSN message Outbound"; flow:established; content:"Here are the new smiles for MSN, they are incredible!"; reference:url,doc.emergingthreats.net/2007605; classtype:trojan-activity; sid:2007605; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS ADMIN$ share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,!&,128,6,relative; byte_jump:2,34,little,relative; content:"ADMIN|24 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2102474; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET 1863 -> $HOME_NET any (msg:"ET DELETED Singworm MSN message Inbound"; flow:established; content:"Here are the new smiles for MSN, they are incredible!"; reference:url,doc.emergingthreats.net/2007606; classtype:trojan-activity; sid:2007606; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS ADMIN$ unicode share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,&,128,6,relative; byte_jump:2,34,little,relative; content:"A|00|D|00|M|00|I|00|N|00 24 00 00 00|"; distance:2; nocase; classtype:protocol-command-decode; sid:2102475; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED phpbb Session Cookie"; flow: established; content:"phpbb2mysql_data=a%3A2%3A%7Bs%3A11%3A%22autologinid%22%3Bb%3A1%3Bs%3A6%3A%22userid%22%3Bs%3A1%3A%222%22%3B%7D"; nocase; reference:url,www.waraxe.us/ftopict-555.html; reference:url,doc.emergingthreats.net/2001762; classtype:web-application-attack; sid:2001762; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS C$ share access"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBu"; within:5; distance:3; byte_test:1,!&,128,6,relative; byte_jump:2,34,little,relative; content:"C|24 00|"; distance:2; nocase; content:!"IPC|24 00|"; within:5; distance:-5; nocase; classtype:protocol-command-decode; sid:2102471; rev:12; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Spyware 2020"; flow: to_server,established; content:"|48 6F 73 74 3A 20 77 77 77 2E 32 30 32 30 73 65 61 72 63 68 2E 63 6F 6D|"; content:"|49 70 41 64 64 72|"; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.2020search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000327; classtype:trojan-activity; sid:2000327; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB CoGetInstanceFromFile attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 04|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6; classtype:protocol-command-decode; sid:2103425; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED C4tdownload.com Access, Likely Spyware"; flow: to_server,established; content:"Host|3a|"; nocase; content:".c4tdownload.com"; within:26; nocase; reference:url,sarc.com/avcenter/venc/data/adware.clickdloader.b.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001531; classtype:trojan-activity; sid:2001531; rev:14; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB CoGetInstanceFromFile little endian attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|04 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6,little; classtype:protocol-command-decode; sid:2103426; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Default-homepage-network.com Access"; flow: to_server,established; content:"wsh.RegWrite"; nocase; content:"default-homepage-network.com/start.cgi?"; nocase; reference:url,default-homepage-network.com/start.cgi?new-hkcu; reference:url,doc.emergingthreats.net/bin/view/Main/2001222; classtype:trojan-activity; sid:2001222; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB CoGetInstanceFromFile little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|01 00|"; within:2; distance:19; byte_test:4,>,128,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:2103177; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Fun Web Products MyWay Agent Traffic"; flow: to_server,established; content:"FunWebProducts-MyWay|3b|"; nocase; threshold: type limit, track by_src, count 10, seconds 60; reference:url,www.funwebproducts.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001043; classtype:policy-violation; sid:2001043; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB CoGetInstanceFromFile overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 01|"; within:2; distance:19; byte_test:4,>,128,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:2103176; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Sality Virus User Agent Detected (SPM_ID=)"; flow:established,to_server; content:"User-Agent|3a| SPM_ID="; nocase; reference:url,doc.emergingthreats.net/2003651; classtype:trojan-activity; sid:2003651; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB CoGetInstanceFromFile unicode attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 04|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8; classtype:protocol-command-decode; sid:2103427; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET DELETED MaMa CaSpEr RFI Scan"; flow:established,to_server; content:"|0D 0A|User-Agent|3a| MaMa CaSpEr|0D 0A|"; nocase; reference:url,doc.emergingthreats.net/2011176; classtype:web-application-attack; sid:2011176; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB CoGetInstanceFromFile unicode little endian attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|04 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8,little; classtype:protocol-command-decode; sid:2103428; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Adobe Macromedia Flash Player In Windows XP Remote Arbitrary Code Execution CLSID Access Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"D27CDB6E-AE6D-11cf-96B8-444553540000"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D27CDB6E-AE6D-11cf-96B8-444553540000/si"; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=19710; reference:url,www.kb.cert.org/vuls/id/204889; reference:url,www.microsoft.com/technet/security/advisory/979267.mspx; reference:url,doc.emergingthreats.net/2010666; classtype:attempted-user; sid:2010666; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB CoGetInstanceFromFile unicode little endian overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|01 00|"; within:2; distance:19; byte_test:4,>,256,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:2103179; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET DELETED WU Malicious Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"filename"; within:100; content:"WU_Details_"; within:50; pcre:"/filename\s*=\s*"WU_Details_.....\.zip/m"; reference:url,doc.emergingthreats.net/2010376; classtype:trojan-activity; sid:2010376; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB CoGetInstanceFromFile unicode overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 01|"; within:2; distance:19; byte_test:4,>,256,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:2103178; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET DELETED MySpace Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"filename"; within:100; content:"MySpace"; within:50; pcre:"/filename\s*=\s*MySpace_document_[0-9]{5}\.zip/m"; reference:url,doc.emergingthreats.net/2010629; classtype:trojan-activity; sid:2010629; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB IActivation bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103377; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET DELETED UPS Spam Inbound Variant 2"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"filename"; within:100; content:"UPS_INVOICE_NR"; within:50; pcre:"/filename=\x22UPS_INVOICE_NR\.[0-9]{4}-[0-9]{6}\.zip\x22/mi"; reference:url,doc.emergingthreats.net/201150; classtype:trojan-activity; sid:2011150; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB IActivation little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103378; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET DELETED UPS Spam Inbound Variant 3"; flow:established,to_server; content:"Content-Disposition|3a| attachment|3b|"; nocase; content:"filename=|22|UPS_LABEL_NR."; nocase; within:50; pcre:"/filename=\x22UPS_LABEL_NR\.[A-Z]+_[0-9]{4}-\d+\.ZIP\x22/i"; reference:url,doc.emergingthreats.net/2011151; classtype:trojan-activity; sid:2011151; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB IActivation unicode bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103379; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Hostile domain, NeoSploit FakeAV google.analytics.com.*.info"; flow:established,to_server; content:"GET "; nocase; depth:4; content:"|0d 0a|Host|3a| google.analytics.com."; nocase; content:".info|0d 0a|"; within:15; reference:url,www.malwaredomainlist.com/forums/index.php?action=printpage#-#-topic=3781.0; reference:url,doc.emergingthreats.net/2010866; classtype:trojan-activity; sid:2010866; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB IActivation unicode little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103380; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Possible Microsoft Windows Shortcut LNK File Automatic File Execution Attempt Via WebDAV"; flow:established,to_client; content:"T"; nocase; content:""; nocase; distance:0; content:""; nocase; distance:0; content:"shortcut"; nocase; distance:0; reference:url,support.microsoft.com/kb/2286198; reference:url,www.kb.cert.org/vuls/id/940193; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=20918; reference:cve,2010-2568; reference:url,doc.emergingthreats.net/2011239; classtype:attempted-user; sid:2011239; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB ISystemActivator bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103393; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Microsoft DirectShow ActiveX Exploit Attempt"; flow:to_client,established; content:"clsid"; nocase; content:"0955AC62-BF2E-4CBA-A2B9-A63F772D46CF"; nocase; content:"omybro"; nocase; content:"logo.gif"; nocase; reference:url,csis.dk/dk/nyheder/nyheder.asp?tekstID=799; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=18595; reference:url,doc.emergingthreats.net/2009491; classtype:web-application-attack; sid:2009491; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB ISystemActivator unicode little endian bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103396; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Vulnerable Microsoft Video ActiveX CLSID access (43)"; flow:to_client,established; content:"clsid"; nocase; content:"F9769A06-7ACA-4E39-9CFB-97BB35F0E77E"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F9769A06-7ACA-4E39-9CFB-97BB35F0E77E/si"; reference:url,microsoft.com/technet/security/advisory/972890.mspx; reference:url,doc.emergingthreats.net/2009612; classtype:web-application-attack; sid:2009612; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB InitiateSystemShutdown attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 18|"; within:2; distance:19; classtype:protocol-command-decode; sid:2102942; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Malvertising drive by kit encountered - bmb cookie"; flow:established,to_client; content:"HTTP/1"; depth:6; content:"Set-Cookie|3a| bmb="; nocase; reference:url,doc.emergingthreats.net/2011222; classtype:bad-unknown; sid:2011222; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB InitiateSystemShutdown little endian attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|18 00|"; within:2; distance:19; classtype:protocol-command-decode; sid:2102943; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Fake AV Related CSS Download"; flow:established,from_server; content:"#hello_nod32_guys_how_u_doing"; nocase; reference:url,doc.emergingthreats.net/2011670; classtype:trojan-activity; sid:2011670; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB InitiateSystemShutdown unicode attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 18|"; within:2; distance:19; classtype:protocol-command-decode; sid:2102944; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED libPNG - Possible NULL-pointer crash in png_handle_iCCP"; flow: established; content:"|89 50 4E 47 0D 0A 1A 0A|"; depth:8; byte_test:4,>,0x80000000,0,relative,big,string,hex; reference:url,www.securiteam.com/unixfocus/5ZP0C0KDPG.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001190; classtype:misc-activity; sid:2001190; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB InitiateSystemShutdown unicode little endian attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-10,relative,from_beginning; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|18 00|"; within:2; distance:19; classtype:protocol-command-decode; sid:2102945; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED libPNG - Height exceeds limit"; flow: established; content:"|89 50 4E 47 0D 0A 1A 0A|"; depth:8; byte_test:4,>,0x80000000,12,relative,big,string,hex; reference:url,www.securiteam.com/unixfocus/5ZP0C0KDPG.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001192; classtype:misc-activity; sid:2001192; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB IrotIsRunning attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 02|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:2103256; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Hidden iframe Served by nginx - Likely Hostile Code"; flow:established,to_client; content:"|0d 0a|Server|3a| nginx"; nocase; offset:15; depth:15; content:""; nocase; reference:url,doc.emergingthreats.net/2011714; classtype:bad-unknown; sid:2011714; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB IrotIsRunning little endian attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"&|00|"; within:2; distance:56; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|02 00|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:2103257; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ET DELETED Possible ASPROX Hostile JS Being Served by a Local Webserver (/ngg.js)"; flow:established,from_server; content:""; nocase; fast_pattern:only; reference:url,blog.armorize.com/2011/06/mass-meshing-injection-sidenamejs.html; classtype:web-application-attack; sid:2013060; rev:3; metadata:created_at 2011_06_17, updated_at 2011_06_17;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE IRC Channel topic scan/exploit command"; flowbits:isset,is_proto_irc; flow:to_client,established; content:"|3a|"; content:"|20|332|20|"; within: 50; content:"|2023|"; within: 20; content:"|203a|"; nocase; within:40; pcre:"/(ntscan [0-9]{1,4} [0-9]{1,4}|dcom\.self|scan\.(start|stop)|scan ([0-9]{1,3}\.[0-9]{1,3})|(advscan|asc|xscan|xploit|adv\.start) (webdav|netbios|ntpass|dcom(2|135|445|1025)|mssql|lsass|optix|upnp|dcass|beagle[12]|mydoom|netdevil|DameWare|kuang2|sub7|iis5ssl|wkssvc|wks1|mysql|wkssvcOth|wkssvcENG|arkeia|arcserve|wins|veritas|netbackup|asn))/i"; reference:url,doc.emergingthreats.net/2002029; classtype:trojan-activity; sid:2002029; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED OneStep Adware related User Agent (x)"; flow:established,to_server; content:"|0d 0a|User-Agent|3a| x|0d 0a|"; nocase; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2008-112613-5052-99&tabid=2; classtype:trojan-activity; sid:2009987; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE perlb0t/w0rmb0t Response 2"; flow:established,to_server; flowbits:isset,is_proto_irc; content:"|3A 02 03|4|5B|"; content:"|03 02|"; within: 32; pcre:"/\x3A\x02\x034\x5B(BackConnect|help|HTTP.*|SCAN|TCP.*|UDP.*|VERSION)\x5D\x03\x02/i"; reference:url,doc.emergingthreats.net/2006911; classtype:trojan-activity; sid:2006911; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 1064 (msg:"ET DELETED Win32/Fynloski Backdoor Keepalive Message"; flow:established,to_server; content:"KEEPALIVE"; content:"KEEPALIVE"; distance:5; within:10; content:"KEEPALIVE"; distance:5; within:10; content:"KEEPALIVE"; distance:5; within:10; content:"KEEPALIVE"; distance:5; within:10; reference:md5,baca8170608c189e2911dc4e430c7719; classtype:trojan-activity; sid:2013067; rev:2; metadata:created_at 2011_06_20, updated_at 2011_06_20;) -alert tcp $HOME_NET any -> $EXTERNAL_NET !6661:6668 (msg:"ET MALWARE IRC DCC chat request on non-standard port"; flow:to_server,established; content:"PRIVMSG "; nocase; depth:8; content:" |3a|.DCC CHAT chat"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2000350; classtype:policy-violation; sid:2000350; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED FAKEAV Scanner Landing Page (Initializing Virus Protection System...)"; flow:established,from_server; content:"Initializing Virus Protection System..."; classtype:bad-unknown; sid:2012815; rev:3; metadata:created_at 2011_05_18, updated_at 2011_05_18;) -alert tcp $HOME_NET any -> $EXTERNAL_NET !6661:6668 (msg:"ET MALWARE IRC DNS request on non-standard port"; flow:to_server,established; content:"USERHOST "; nocase; depth:9; reference:url,doc.emergingthreats.net/bin/view/Main/2000352; classtype:policy-violation; sid:2000352; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED EXPLOIT statdx"; content:"/bin|C7|F|04|/sh"; classtype:attempted-admin; sid:2101282; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tcp $EXTERNAL_NET !6666:7000 -> $HOME_NET any (msg:"ET DELETED IRC Name response on non-standard port"; flow: to_client,established; dsize:<128; content:"|3a|"; depth:1; content:" 302 "; content:"=+"; content:"@"; reference:url,doc.emergingthreats.net/bin/view/Main/2000346; classtype:trojan-activity; sid:2000346; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED MacDefender OS X Fake AV Scareware"; flow:established,to_server; content:"GET"; http_method; content:"affid="; http_uri; content:"data="; http_uri; content:"v="; http_uri; content:"User-Agent|3a 20|MacShield"; http_header; reference:url,blog.spiderlabs.com/2011/06/analysis-and-evolution-of-macdefender-os-x-fake-av-scareware.html; classtype:trojan-activity; sid:2012958; rev:5; metadata:created_at 2011_06_09, updated_at 2011_06_09;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Kaiten IRCbotnet login"; flow:to_server,established; content:"NICK|20|"; depth:5; content:"USER|20|"; within:32; content:"localhost|20|localhost|20 3A|"; within:32; pcre:"/NICK\x20\S+\x0AUSER\x20\S+localhost\x20localhost\x20\x3A/"; reference:url,en.wikipedia.org/wiki/IRC_bot; reference:url,doc.emergingthreats.net/2007621; classtype:trojan-activity; sid:2007621; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED RiskTool.Win32.WFPDisabler Reporting"; flow:established,to_server; content:"GET"; http_method; content:"/go.asp?"; nocase; http_uri; content:"svid="; nocase; http_uri; content:"id="; nocase; http_uri; content:"tpages="; nocase; http_uri; content:"ttimes="; nocase; http_uri; content:"tzone="; nocase; http_uri; content:"tcolor="; nocase; http_uri; content:"vpage="; http_uri; nocase; reference:md5,c81be1cf10d9578803dab8c1bc62ccfa; classtype:web-application-attack; sid:2012588; rev:4; metadata:created_at 2011_03_28, updated_at 2011_03_28;) -#alert tcp $HOME_NET any -> any any (msg:"ET DELETED Pitbull IRCbotnet Response"; flow:established; content:"PRIVMSG|20|"; content:"|3A|"; within:32; content:"4"; within:5; content:"12"; within:5; content:"|3a|"; within:5; pcre:"/\x3a.4\x7c.12.\x3a.4/"; reference:url,en.wikipedia.org/wiki/IRC_bot; reference:url,doc.emergingthreats.net/2007624; classtype:trojan-activity; sid:2007624; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32.VB.OWR Checkin"; flow:to_server,established; content:"|12 01 00|"; depth:3; content:"|00 00 00 00 00 00 15 00 06 01 00 1B 00 01 02 00 1C 00|"; within:19; reference:md5,7684532e7e1d717427f6842e9d5ecd56; classtype:trojan-activity; sid:2013121; rev:3; metadata:created_at 2011_06_28, updated_at 2011_06_28;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE psyBNC IRC Server Connection"; flow:from_server,established; content:"psyBNC@lam3rz"; depth:33; nocase; flowbits:isset,is_proto_irc; reference:url,en.wikipedia.org/wiki/PsyBNC; reference:url,doc.emergingthreats.net/2003302; classtype:misc-activity; sid:2003302; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED KazaaClient P2P Traffic"; flow: established; content:"Agent|3a| KazaaClient"; nocase; reference:url,www.kazaa.com/us/index.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2001812; classtype:policy-violation; sid:2001812; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE IRC Potential bot scan/exploit command"; flowbits:isset,is_proto_irc; flow:established,from_server; content:"PRIVMSG|20|"; depth:8; content:"|3a|"; within:30; pcre:"/(ntscan [0-9]{1,4} [0-9]{1,4}|dcom\.self|scan\.(start|stop)|scan ([0-9]{1,3}\.[0-9]{1,3})|(advscan|exploited|asc|xscan|xploit|adv\.start) (webdav|netbios|ntpass|dcom(2|135|445|1025)|mssql|lsass|optix|upnp|dcass|beagle[12]|mydoom|netdevil|DameWare|kuang2|sub7|iis5ssl|wkssvc|wks1|mysql|wkssvcOth|wkssvcENG|arkeia|arcserve|wins|veritas|netbackup|asn))/i"; reference:url,doc.emergingthreats.net/2002030; classtype:trojan-activity; sid:2002030; rev:16; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Client Visiting cssminibar.js Injected Website Malware Related"; flow:established,to_client; content:"/cssminibar.js|22|>"; nocase; fast_pattern:only; reference:url,blog.armorize.com/2011/06/mass-meshing-injection-sidenamejs.html; classtype:web-application-attack; sid:2013191; rev:2; metadata:created_at 2011_07_05, updated_at 2011_07_05;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE IRC potential bot commands"; flow:established,from_server; content:"PRIVMSG "; depth:8; content:"|3a|"; within:30; pcre:"/((\.aim\w*|ascanall|\x3agetshit200)\s+\w+)|((@kill|@get_os_version|@get_computer_name|@get_bot_version|@update|@restart|@reboot|@shutdown)\s)/i"; reference:url,doc.emergingthreats.net/2002384; classtype:trojan-activity; sid:2002384; rev:17; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32.Hooker Checkin Message"; flow:established,to_server; content:"&lg="; http_uri; content:"&ntime="; http_uri; content:"&repeatip="; http_uri; content:"&rtime="; http_uri; content:"&sin="; http_uri; classtype:trojan-activity; sid:2013205; rev:3; metadata:created_at 2011_07_06, updated_at 2011_07_06;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE IRC potential reptile commands"; flow:established,from_server; content:"PRIVMSG|20|"; depth:8; content:"|3a|"; within:30; pcre:"/\.((testdlls|threads|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|currentip)\s*[\r\n]|(iestart|ies|login|l|mirccmd|system|file\s+(cat|exists|e|del|rm|rmdir|move|copy|attrib)|down|dl\dx|update|reg\s+(query|delete|write))\s+\w+|(banner|ban|advscan|asc|scanall|sa|ntscan|nts)\s*[\n\r])/i"; reference:url,doc.emergingthreats.net/2002363; classtype:trojan-activity; sid:2002363; rev:15; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/Alworo CnC Checkin"; flow:established,to_server; content:".php?userid="; nocase; http_uri; content:"&time="; nocase; http_uri; content:"&msg="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&pauid="; nocase; http_uri; content:"&checkId="; nocase; http_uri; reference:url,us.norton.com/security_response/writeup.jsp?docid=2011-062909-5644-99&tabid=2; classtype:command-and-control; sid:2013215; rev:3; metadata:created_at 2011_07_06, updated_at 2011_07_06;) -alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely Bot Username in IRC (XP-..)"; flow:established,to_server; content:"USER XP-"; depth:8; reference:url,doc.emergingthreats.net/2008123; classtype:trojan-activity; sid:2008123; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Backdoor.Specfix Checkin"; flow:established,to_server; content:"/AWS"; http_uri; content:".jsp?"; http_uri; content:"x-bigfix-client-string|3A|"; http_header; reference:url,us.norton.com/security_response/writeup.jsp?docid=2011-062203-3150-99&tabid=2; classtype:trojan-activity; sid:2013218; rev:2; metadata:created_at 2011_07_06, updated_at 2011_07_06;) -alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely Bot Nick in IRC (USA +..)"; flow:established,to_server; content:"NICK "; depth:5; content:"USA"; within:10; reference:url,doc.emergingthreats.net/2008124; classtype:trojan-activity; sid:2008124; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Zapchast Bot User-Agent"; flow:established,to_server; content:"User-Agent|3a| MJ12bot/"; http_header; reference:url,www.majestic12.co.uk/bot.php; reference:url,doc.emergingthreats.net/2007781; classtype:trojan-activity; sid:2007781; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 6666:7000 (msg:"GPL CHAT IRC DCC chat request"; flow:to_server,established; content:"PRIVMSG "; depth:8; nocase; content:" |3A|.DCC CHAT chat"; nocase; flowbits:set,is_proto_irc; classtype:policy-violation; sid:2101640; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Majestic-12 Spider Bot User-Agent (MJ12bot)"; flow:to_server,established; content:"User-Agent|3a| MJ12bot"; reference:url,www.majestic12.co.uk/; reference:url,doc.emergingthreats.net/2003409; classtype:trojan-activity; sid:2003409; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 6666:7000 (msg:"GPL CHAT IRC DCC file transfer request"; flow:to_server,established; content:"PRIVMSG "; depth:8; nocase; content:" |3A|.DCC SEND"; nocase; flowbits:set,is_proto_irc; classtype:policy-violation; sid:2101639; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Majestic-12 Spider Bot User-Agent Inbound (MJ12bot)"; flow:to_server,established; content:"User-Agent|3a| MJ12bot"; http_header; reference:url,www.majestic12.co.uk/; reference:url,doc.emergingthreats.net/2007762; classtype:trojan-activity; sid:2007762; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Ruskill/Palevo KCIK IRC Command"; flow:established,to_server; content:"KCIK |7b|"; depth:6; reference:url,ore.carnivore.it/malware/hash/d4dc8459a34ea14d856e529d3a9e0362; reference:url,sebdraven.tumblr.com/post/6769853139/palevo-analysises; classtype:trojan-activity; sid:2013247; rev:5; metadata:created_at 2011_07_11, updated_at 2011_07_11;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible docs.google.com Activity"; flow:established,to_server; content:"WRITELY_SID"; nocase; reference:url,docs.google.com; reference:url,doc.emergingthreats.net/2003122; classtype:policy-violation; sid:2003122; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Suspicious User Agent Maxthon"; flow:to_server,established; content:"Mozilla/4.0 (compatible|3b| MSIE 6.0|3b| Windows NT 5.1|3b| SV1|3b| Maxthon"; http_header; reference:url,doc.emergingthreats.net/2011118; classtype:trojan-activity; sid:2011118; rev:4; metadata:created_at 2010_07_30, former_category HUNTING, updated_at 2021_06_23;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 8000 (msg:"GPL DELETED nstelemetry.adp access"; flow:to_server,established; content:"/nstelemetry.adp"; reference:nessus,10753; classtype:web-application-activity; sid:2101518; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32.Duqu User-Agent"; flow:to_server,established; content:"User-Agent|3A| Mozilla/5.0 (Windows|3B| U|3B| Windows NT 6.0|3B| en-US|3B| rv|3A|1.9.2.9) Gecko/20100824 Firefox/3.6.9 (.NET CLR 3.5.30729)"; http_header; reference:url,www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf; classtype:trojan-activity; sid:2013782; rev:3; metadata:created_at 2011_10_20, updated_at 2011_10_20;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Driveby bredolab request to a .ru 8080 URI"; flow:established,to_server; content:".ru|3a|8080|0D 0A|"; classtype:bad-unknown; sid:2011354; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_09_28, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Agobot-SDBot Commands"; flow:established,from_server; content:"PRIVMSG|20|"; depth:8; pcre:"/((cvar\.set)|(http\.(execute|update))|((aol)spam\.(setlist|settemplate|start|stop|setuser|setpass))|sniffer\.(addstring|delstring)|pingstop|udpstop|scan(all|stats|del|stop)|clone(stop|start)|c_(raw|mode|nick|join|part|privmsg|action))/i"; reference:url,doc.emergingthreats.net/2003157; classtype:trojan-activity; sid:2003157; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET DELETED Srizbi registering with controller"; dsize:20; content:"|2d|"; offset:6; content:"|2d|"; distance:6; within:1; content:!"|00|server."; reference:url,www.secureworks.com/research/threats/ronpaul/; reference:url,doc.emergingthreats.net/2007711; classtype:trojan-activity; sid:2007711; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE IRC Potential bot command response"; flow:established,to_server; content:"PRIVMSG "; depth:8; content:"|3a|"; within:30; pcre:"/((T?FTP)\x3a File transfer|(random|sequential) Port Scan|Random (Spreading|Scanner)|Exploiting IP|Exploiting\.\.|flooding\x3a|flood stopped|sending packets)|Random Method started|FINDFILE|Scan stopped|No scan thread found|thread\(s\) stopped|\x3aExec /i"; reference:url,doc.emergingthreats.net/2002033; classtype:trojan-activity; sid:2002033; rev:17; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Dictcn Trojan Downloader Update Check to CnC"; flow:established,to_server; content:".php?cid="; http_uri; content:"&version="; http_uri; content:"&lose="; http_uri; content:"&tipsid="; http_uri; content:"&from="; http_uri; classtype:command-and-control; sid:2013323; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_07_27, deployment Perimeter, signature_severity Major, tag Trojan_Downloader, updated_at 2016_07_01;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dropper.Win32.Npkon Client Checkin"; flow:established,to_server; content:"|40 1f|"; offset:1; depth:2; content:"|03|"; distance:1; within:1; content:"|20 00 00 00|"; distance:1; within:4; dsize:10; reference:md5,a7f4a7d08fa650a5f09a00519b944b0b; classtype:command-and-control; sid:2013793; rev:1; metadata:created_at 2011_10_24, former_category MALWARE, updated_at 2011_10_24;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Dictcn Trojan Downloader Receiving XML Format Update File From CnC Server"; flow:established,to_client; content:""; fast_pattern; content:" $HOME_NET any (msg:"ET DELETED Dictcn Trojan Downloader Receiving XML Format Node ID File From CnC Server"; flow:established,to_client; content:""; content:"<|2F|id>"; distance:1; within:9; content:"<|2F|type><|2F|node>-->"; distance:0; content:""; distance:0; content:"<|2F|id>"; distance:1; within:9; content:"<|2F|dict>"; distance:0; classtype:command-and-control; sid:2013325; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_07_27, deployment Perimeter, signature_severity Major, tag Trojan_Downloader, updated_at 2016_07_01;) -#alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL POLICY TRAFFIC Non-Standard IP protocol"; ip_proto:!1; ip_proto:!2; ip_proto:!47; ip_proto:!50; ip_proto:!51; ip_proto:!6; ip_proto:!89; ip_proto:!17; classtype:non-standard-protocol; sid:2101620; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED RealPlayer playlist http URL overflow attempt"; flow:from_server,established; flowbits:isset,realplayer.playlist; content:"http|3A|//"; nocase; pcre:"/^http\x3a\x2f\x2f[^\n]{400}/smi"; reference:bugtraq,9579; reference:cve,2004-0258; classtype:attempted-user; sid:2102439; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Trojan.SuspectCRC FakeAV Checkin"; flow:established,to_server; content:"value.php?"; http_uri; content:"md="; http_uri; content:"&pc="; http_uri; content:"User-Agent|3a| sample"; http_header; reference:md5,54c9d51661a05151e5143f4e80cbed86; classtype:command-and-control; sid:2013799; rev:3; metadata:created_at 2011_10_24, former_category MALWARE, updated_at 2011_10_24;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED RealPlayer playlist rtsp URL overflow attempt"; flow:from_server,established; flowbits:isset,realplayer.playlist; content:"rtsp|3A|//"; nocase; pcre:"/^http\x3a\x2f\x2f[^\n]{400}/smi"; reference:bugtraq,9579; reference:cve,2004-0258; classtype:attempted-user; sid:2102440; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE IRC pBot PHP Bot Commands"; flow:established,from_server; content:"PRIVMSG|20|"; depth:8; pcre:"/PRIVMSG\s+\S+\s+\x3a\s*(\.user |\.logout|\.die|\.restart|\.mail |\.dns |\.download |\.exec |\.find |\.cmd |\.php |\.tcpflood |\.udpflood |\.raw |\.rndnick|\.pscan |\.ud\.server )/i"; reference:url,doc.emergingthreats.net/2003208; classtype:trojan-activity; sid:2003208; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED Content-Disposition CLSID command attempt"; flow:to_client,established; content:"Content-Disposition|3A|"; nocase; pcre:"/^Content-Disposition\x3a[^\r\n]*\{[\da-fA-F]{8}(-[\da-fA-F]{4}){3}-[\da-fA-F]{12}\}/smi"; reference:bugtraq,9510; reference:cve,2004-0420; reference:url,www.microsoft.com/technet/security/bulletin/ms04-024.mspx; classtype:attempted-user; sid:2102589; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tcp $HOME_NET any -> any 6667 (msg:"ET DELETED Likely Botnet Activity"; flow:to_server,established; content:"PRIVMSG|20|"; depth:8; pcre:"/(cheguei gazelas|meh que tao|Status|Tempo|Total pacotes|Total bytes|M?dia de envio|portas? aberta)/i"; reference:url,doc.emergingthreats.net/bin/view/Main/2001620; classtype:string-detect; sid:2001620; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED RealPlayer playlist file URL overflow attempt"; flow:from_server,established; flowbits:isset,realplayer.playlist; content:"file|3A|//"; nocase; pcre:"/^file\x3a\x2f\x2f[^\n]{400}/smi"; reference:bugtraq,9579; reference:cve,2004-0258; classtype:attempted-user; sid:2102438; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible Redirection to Unknown Exploit Pack"; flow:established,to_client; content:"document.write|28|unescape|28 22|%3Cscript src=|27 22 20 2B 20|"; nocase; reference:url,www.kahusecurity.com/2011/malware-infection-from-new-exploit-pack/; classtype:misc-attack; sid:2013804; rev:4; metadata:created_at 2011_10_26, updated_at 2011_10_26;) +#alert udp $HOME_NET 49 -> $EXTERNAL_NET any (msg:"GPL DELETED xtacacs failed login response"; content:"|80 02|"; depth:2; content:"|02|"; distance:4; classtype:misc-activity; sid:2102041; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Silentbanker/Yaludle Checkin to C&C"; flow:to_server,established; content:"GET"; depth:3; http_method; content:".php?id="; nocase; http_uri; content:"&c="; nocase; content:"&v="; nocase; content:"&b="; nocase; content:"&z="; nocase; reference:url,doc.emergingthreats.net/2009542; classtype:trojan-activity; sid:2009542; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Backdoor W32/Phanta Checkin"; flow:established,to_server; content:"/do.php?userid="; http_uri; content:"&time="; http_uri; content:"&msg="; http_uri; content:"&ver="; http_uri; content:"&os="; http_uri; content:"&fy="; http_uri; content:"&pauid="; http_uri; content:"&checkId="; http_uri; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FPopureb.A; reference:md5,0012a0b60572dfa4f42a4325507841d8; classtype:trojan-activity; sid:2013343; rev:3; metadata:created_at 2011_08_02, updated_at 2011_08_02;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS iWare Professional SQL Injection Attempt -- index.php D ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; content:"D="; http_uri; content:"ASCII("; nocase; http_uri; content:"SELECT"; nocase; http_uri; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2006-6446; reference:url,www.securityfocus.com/bid/21467; reference:url,doc.emergingthreats.net/2006613; classtype:web-application-attack; sid:2006613; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Unknown Generic Trojan Checkin"; flow:established,to_server; content:"unit_id="; http_uri; content:"&uv_id="; http_uri; content:"&uv_new="; http_uri; content:"&url="; http_uri; content:"&charset="; http_uri; content:"&hashval="; http_uri; content:"&app="; http_uri; content:"&lg="; http_uri; classtype:trojan-activity; sid:2013204; rev:3; metadata:created_at 2011_07_06, updated_at 2011_07_06;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Lighty Variant or UltimateDefender POST"; flow:established,to_server; content:"POST"; http_method; content:".php"; content:"gd="; content:"&affid="; content:"&subid="; content:"&prov="; nocase; fast_pattern; reference:url,doc.emergingthreats.net/2008784; classtype:trojan-activity; sid:2008784; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible Trojan File Download - Rar Requested but not received"; flow:established,from_server; flowbits:isset,ET.rar_seen; flowbits:unset,ET.rar_seen; content:"200"; http_stat_code; content:"OK"; http_stat_msg; content:!"|0d 0a 0d 0a 52 61 72 21 1A 07|"; depth:300; reference:url,www.win-rar.com/index.php?id=24&kb=1&kb_article_id=162; reference:url,doc.emergingthreats.net/2008783; classtype:trojan-activity; sid:2008783; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS SnippetMaster vars.inc.php _SESSION Parameter Remote File Inclusion"; flow:to_server,established; content:"GET"; http_method; content:"/vars.inc.php?"; http_uri; nocase; content:"_SESSION[SCRIPT_PATH]="; http_uri; pcre:"/_SESSION\[SCRIPT_PATH\]=\s*(https?|ftps?|php)\x3a\//Ui"; reference:url,secunia.com/advisories/33865/; reference:url,milw0rm.com/exploits/8017; reference:url,doc.emergingthreats.net/2009179; classtype:web-application-attack; sid:2009179; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Set flow on rar file get"; flow:established,to_server; content:"GET"; http_method; content:".rar"; http_uri; content:".rar HTTP/1."; flowbits:set,ET.rar_seen; flowbits:noalert; reference:url,doc.emergingthreats.net/2008781; classtype:trojan-activity; sid:2008781; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Warezov/Stration Data Post to Controller"; flow:established,to_server; content:"/cgi-bin/pr.cgi"; http_uri; content:"POST"; http_method; reference:url,www.sophos.com/security/analyses/w32strationbo.html; reference:url,doc.emergingthreats.net/2003180; classtype:trojan-activity; sid:2003180; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/TrojanDropper.Agent Checkin"; flow:established,to_server; content:".gif?aid="; http_uri; content:"&lc="; http_uri; content:"&time="; http_uri; content:"&flag="; http_uri; content:"&domain="; http_uri; classtype:trojan-activity; sid:2013402; rev:3; metadata:created_at 2011_08_11, updated_at 2011_08_11;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Oracle AutoVue Activex Insecure method (ExportEdaBom) Format String Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"AUTOVUEX.AutoVueXCtrl.1"; nocase; distance:0; content:".ExportEdaBom"; content:"|2E 2E 2F|"; reference:url,packetstormsecurity.org/files/106065/9sg_autovueiii.tgz; classtype:attempted-user; sid:2013814; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_10_31, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http any any -> $HOME_NET any (msg:"ET DELETED Possible Windows executable sent when remote host claims to send an image"; flow: established,from_server; content:"Content-Type|3a| image"; content:"|0d 0a|MZ"; within: 12; reference:url,doc.emergingthreats.net/bin/view/Main/2001685; classtype:trojan-activity; sid:2001685; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Oracle AutoVue Activex Insecure method (ExportEdaBom)"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F/si"; reference:url,packetstormsecurity.org/files/106065/9sg_autovueiii.tgz; classtype:attempted-user; sid:2013813; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_10_31, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Mitglieder Proxy Trojan CnC"; dsize:2; byte_test:2, >, 1024, 0; threshold:type both, track by_src, count 1000, seconds 300; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Win32%2fMitglieder; classtype:command-and-control; sid:2013418; rev:5; metadata:created_at 2011_08_18, updated_at 2011_08_18;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Oracle AutoVue Activex Insecure method (Export3DBom) Format String Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"AUTOVUEX.AutoVueXCtrl.1"; nocase; distance:0; content:".Export3DBom"; content:"|2E 2E 2F|"; reference:url,packetstormsecurity.org/files/106064/9sg_autovueii.tgz; classtype:attempted-user; sid:2013812; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_10_31, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"ET DELETED MS Terminal Server User A Login, possible Morto inbound"; flow:to_server,established; content:"|03 00 00|"; depth:3; content:"|e0 00 00 00 00 00|"; offset:5; depth:6; content:"Cookie|3a| mstshash=a|0d 0a|"; nocase; reference:cve,CAN-2001-0540; classtype:protocol-command-decode; sid:2013497; rev:2; metadata:created_at 2011_08_30, updated_at 2011_08_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Oracle AutoVue Activex Insecure method (Export3DBom)"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F/si"; reference:url,packetstormsecurity.org/files/106064/9sg_autovueii.tgz; classtype:attempted-user; sid:2013811; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_10_31, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED PDF Name Representation Obfuscation of JBIG2Decode, Very Likely Memory Corruption Attempt"; flow:established,to_client; content:"obj"; content:"<<"; within:4; content:"/"; within:50; content:!"JBIG2Decode"; within:11; content:"#"; within:31; pcre:"/\x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^JBIG2Decode](J|#4A)(B|#42)(I|#49)(G|#47)(2|#32)(D|#44)(e|#65)(c|#63)(o|#6F)(d|#64)(e|#65)/smi"; reference:url,blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/; reference:url,blog.didierstevens.com/2009/03/01/quickpost-jbig2decode-signatures/; reference:bugtraq,33751; reference:cve,2009-0658; classtype:attempted-user; sid:2011534; rev:7; metadata:created_at 2010_09_27, updated_at 2010_09_27;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Oracle AutoVue Activex Insecure method (SaveViewStateToFile) Format String Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"AUTOVUEX.AutoVueXCtrl.1"; nocase; distance:0; content:".SaveViewStateToFile"; nocase; content:"|2E 2E 2F|"; reference:url,exploit-db.com/exploits/18016; classtype:attempted-user; sid:2013810; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_10_31, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Suspicious User-Agent FSD - Possible FakeAV Related"; flow:established,to_server; content:"User-Agent|3A 20|FSD|0D 0A|"; http_header; classtype:trojan-activity; sid:2013393; rev:4; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_08_10, deployment Perimeter, signature_severity Major, tag User_Agent, updated_at 2016_07_01;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Oracle AutoVue Activex Insecure method (SaveViewStateToFile)"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F/si"; reference:url,exploit-db.com/exploits/18016; classtype:attempted-user; sid:2013809; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_10_31, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Pitbull IRCbotnet Fetch"; flow:to_server,established; content:"Accept|3a20|*/*|0d0a|User-Agent|3a20|Mozilla/5.0|0d0a|"; http_header; reference:url,en.wikipedia.org/wiki/IRC_bot; reference:url,doc.emergingthreats.net/2007626; classtype:trojan-activity; sid:2007626; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Basine Trojan Checkin"; flow:established,to_server; content:"a="; http_client_body; content:"&b=reported"; http_client_body; content:"&d=report"; http_client_body; reference:url,doc.emergingthreats.net/2007692; classtype:command-and-control; sid:2007692; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET 1024: -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Suspicious Win32 User Agent"; flow:to_server,established; content:"User-Agent|3a| Win32"; http_header; classtype:trojan-activity; sid:2012316; rev:3; metadata:created_at 2011_02_18, updated_at 2011_02_18;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Bifrose Connect to Controller (PING PONG)"; flow:stateless; dsize:10; content:"PING |3a|i.|0d 0a|"; flowbits:set,ET.bifrose1; reference:url,doc.emergingthreats.net/2009128; classtype:trojan-activity; sid:2009128; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED PinBall Corp. Related suspicious activity"; flow:established,to_server; content:"|0d 0a|User-Agent|3a| PinBallCorp-BSAI"; reference:url,doc.emergingthreats.net/2009908; classtype:trojan-activity; sid:2009908; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Bifrose Response from Controller (PING PONG)"; flow:stateless; flowbits:isset,ET.bifrose1; dsize:9; content:"PONG |3a|i.|0d|"; reference:url,doc.emergingthreats.net/2009129; classtype:trojan-activity; sid:2009129; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED HTTP Request to a *.uni.cc domain"; flow:to_server,established; content:".uni.cc|0D 0A|"; http_header; classtype:bad-unknown; sid:2013248; rev:3; metadata:created_at 2011_07_11, updated_at 2011_07_11;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 81 (msg:"ET DELETED Unknown Malware Keepalive"; flow:established,to_server; content:"keepalive"; nocase; depth:9; pcre:"/keepalive([0-9]{4}|\x7c[0-9]{4})/i"; threshold: type limit, track by_src, count 1, seconds 60; classtype:trojan-activity; sid:2012409; rev:3; metadata:created_at 2011_03_02, updated_at 2011_03_02;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED SSL MiTM Vulnerable or EOL iOS 3.x device"; flow:established,to_server; content:"Mozilla/5.0 (iP"; http_header; content:" OS 3_"; http_header; distance:0; threshold:type limit, count 1, seconds 600, track by_src; reference:url,support.apple.com/kb/HT1222; reference:url,support.apple.com/kb/HT4824; reference:url,en.wikipedia.org/wiki/IOS_version_history; classtype:not-suspicious; sid:2013334; rev:4; metadata:created_at 2011_07_30, updated_at 2011_07_30;) -alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP large PWD command"; flow:to_server,established; content:"PWD"; isdataat:7,relative; content:!"|0A|"; within:7; nocase; classtype:protocol-command-decode; sid:2101624; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED SSL MiTM Vulnerable or EOL iOS 4.x device"; flow:established,to_server; content:"Mozilla/5.0 (iP"; http_header; content:" OS 4_"; http_header; distance:0; pcre:"/OS 4_[0-3]_[1-4] like/H"; threshold: type limit, count 1, seconds 600, track by_src; reference:url,support.apple.com/kb/HT1222; reference:url,support.apple.com/kb/HT4824; reference:url,en.wikipedia.org/wiki/IOS_version_history; classtype:not-suspicious; sid:2013335; rev:5; metadata:created_at 2011_07_30, updated_at 2011_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE FakeAV FakeAlertRena.n Checkin NO Response from Server"; flow:established,from_server; flowbits:isset,ET.fakealert.rena.n; content:"Content-Length|3a| 2|0d 0a 0d 0a|NO"; classtype:command-and-control; sid:2013420; rev:4; metadata:created_at 2011_08_18, former_category MALWARE, updated_at 2011_08_18;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/Rbot User-Agent (tiehttp)"; flow:established,to_server; content:"User-Agent|3A 20|tiehttp"; http_header; classtype:trojan-activity; sid:2013449; rev:3; metadata:created_at 2011_08_22, updated_at 2011_08_22;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.Kryptik/proscan.co.kr Checkin"; flow:established,to_server; content:"User-Agent|3a| proscan-down"; http_header; reference:md5,bf156b649cb5da6603a5f665a7d8f13b; classtype:command-and-control; sid:2013821; rev:2; metadata:created_at 2011_11_04, former_category MALWARE, updated_at 2011_11_04;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Driveby Download Secondary Request 4"; flow:established,to_server; content:"main.php?page="; http_uri; pcre:"/[a-f0-9]{16}$/U"; classtype:trojan-activity; sid:2013651; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_09_13, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCADA PROMOTIC ActiveX Control Insecure method (SaveCfg)"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02000002-9DFA-4B37-ABE9-1929F4BCDEA2/si"; reference:url,aluigi.altervista.org/adv/promotic_1-adv.txt; classtype:attempted-user; sid:2013878; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_11_08, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Generic Trojan Checkin"; flow: to_server,established; content:"GET"; nocase; http_method; content: ".asp?mac="; nocase; http_uri; pcre:"/mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}/iU"; content: "&ver="; nocase; http_uri; reference:url,doc.emergingthreats.net/2009412; classtype:trojan-activity; sid:2009412; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCADA PROMOTIC ActiveX Control Insecure method (AddTrend)"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02000002-9DFA-4B37-ABE9-1929F4BCDEA2/si"; reference:url,aluigi.altervista.org/adv/promotic_1-adv.txt; classtype:attempted-user; sid:2013879; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_11_08, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 9000:9002 (msg:"GPL DELETED HP JetDirect LCD modification attempt"; flow:to_server,established; content:"@PJL RDYMSG DISPLAY ="; reference:arachnids,302; reference:bugtraq,2245; classtype:misc-activity; sid:2100510; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Koobface Variant Initial Checkin"; flow:established,to_server; content:".php?datos=c|3A|"; http_uri; content:"&user="; http_uri; classtype:command-and-control; sid:2013890; rev:2; metadata:created_at 2011_11_08, former_category MALWARE, updated_at 2011_11_08;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/OpenCapture CnC Checkin"; flow:established,to_server; content:"/check_counter.php?pi="; http_uri; content:"&gu="; http_uri; content:"&ac="; http_uri; classtype:command-and-control; sid:2013722; rev:2; metadata:created_at 2011_10_01, updated_at 2011_10_01;) -alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.Win32.Svlk Client Checkin"; flow:from_client,established; dsize:12; content:"|38 0d ff 0a d7 ee 9d d7 ec 59 13 56|"; depth:12; reference:md5,c929e8c75901c7e50685df0445a38bd0; classtype:command-and-control; sid:2013891; rev:1; metadata:created_at 2011_11_09, former_category MALWARE, updated_at 2011_11_09;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET DELETED W32/iGrabber Info Stealer FTP Upload"; flow:established,to_server; content:"iGrabber Logs"; offset:4; depth:13; classtype:trojan-activity; sid:2013727; rev:1; metadata:created_at 2011_10_01, updated_at 2011_10_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Backdoor.Win32.Svlk Server Reply"; flow:from_server,established; dsize:44; content:"|33 39 0d ff 0a c4 e5 9f d5 ec 58 4a 69|"; depth:13; reference:md5,c929e8c75901c7e50685df0445a38bd0; classtype:trojan-activity; sid:2013892; rev:1; metadata:created_at 2011_11_09, updated_at 2011_11_09;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED dildo"; flow:to_client,established; content:"dildo"; nocase; classtype:policy-violation; sid:2101781; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.Win32.Svlk Client Ping"; flow:from_client,established; dsize:7; content:"|33 0D FF 0A C5 F8 C1|"; depth:7; reference:md5,c929e8c75901c7e50685df0445a38bd0; classtype:trojan-activity; sid:2013893; rev:2; metadata:created_at 2011_11_09, updated_at 2011_11_09;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED nipple clamp"; flow:to_client,established; content:"nipple"; nocase; content:"clamp"; nocase; classtype:policy-violation; sid:2101782; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Yaq Checkin"; flow:established,to_server; content:"/Submit.php?id="; http_uri; content:"&action="; http_uri; within:10; content:"&mac="; http_uri; within:10; content:"&lockcode="; http_uri; within:30; content:"&homepc="; http_uri; within:15; content:"User-Agent|3A 20|getinfo|0D 0A|"; http_header; classtype:command-and-control; sid:2013900; rev:2; metadata:created_at 2011_11_11, former_category MALWARE, updated_at 2011_11_11;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED raw sex"; flow:to_client,established; content:"raw sex"; nocase; classtype:policy-violation; sid:2101786; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User Agent GeneralDownloadApplication"; flow:established,to_server; content:"User-Agent|3A 20|GeneralDownloadApplication"; http_header; classtype:trojan-activity; sid:2013901; rev:2; metadata:created_at 2011_11_11, former_category TROJAN, updated_at 2017_11_29;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED oral sex"; flow:to_client,established; content:"oral sex"; nocase; classtype:policy-violation; sid:2101783; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.BlackControl Retrieving IP Information"; flow:established,to_server; content:"/v2/ip_query_country.php?key="; http_uri; content:"&timezone="; http_uri; content:"User-Agent|3A 20|1|0D 0A|"; http_header; fast_pattern; classtype:trojan-activity; sid:2013902; rev:3; metadata:created_at 2011_11_11, updated_at 2011_11_11;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/Parite CnC Checkin"; flow:established,to_server; content:"?MI="; http_uri; content:"&os="; http_uri; content:"&TE="; http_uri; content:"&TV="; http_uri; content:!"SeaPort/"; http_header; classtype:command-and-control; sid:2013716; rev:3; metadata:attack_target Client_Endpoint, created_at 2011_10_01, deployment Perimeter, malware_family Parite, signature_severity Major, updated_at 2017_07_17;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User Agent GetFile"; flow:established,to_server; content:"User-Agent|3A 20|GetFile|0D 0A|"; http_header; classtype:trojan-activity; sid:2013903; rev:2; metadata:created_at 2011_11_11, updated_at 2011_11_11;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED New Malware Information Post"; flow:to_server,established; content:"POST"; nocase; http_method; content:"|0d 0a|Pragma|3a| no-cache|0d 0a 0d 0a|"; http_header; content:"|C9 78 C7 02 69 06 7E 34 78 17|"; fast_pattern; reference:url,doc.emergingthreats.net/2009092; classtype:trojan-activity; sid:2009092; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Rimecud User Agent beat"; flow:established,to_server; content:"User-Agent|3A 20|beat|0D 0A|"; http_header; classtype:trojan-activity; sid:2013904; rev:2; metadata:created_at 2011_11_11, updated_at 2011_11_11;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Akamai Redswoosh CLIOnlineManager Connection Detected"; flow:established,to_server; content:"PUT "; depth:4; nocase; content:"|0d 0a|User-Agent|3a|"; content:"rswin_3725.dll"; within:30; nocase; reference:url,doc.emergingthreats.net/2011275; classtype:policy-violation; sid:2011275; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User Agent banderas"; flow:established,to_server; content:"User-Agent|3A 20|banderas"; http_header; classtype:trojan-activity; sid:2013905; rev:2; metadata:created_at 2011_11_11, updated_at 2011_11_11;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED OWASP Joomla Vulnerability Scanner Detected"; flow:established,to_server; content:"HEAD "; depth:5; content:"/joomla/"; content:"|0d 0a|User-Agent|3a| Mozilla/5.0 (Windows\; U\; Windows NT 5.2\; en-US\; rv|3a|1.9.0.3) Gecko/2008092417 Firefox/3.0.3"; pcre:"/(/joomla/admin|/joomla/administrator|/joomla/manage|/joomla/administration)/U"; threshold: type threshold, track by_dst, count 4, seconds 15; reference:url,www.owasp.org/index.php/Category%3aOWASP_Joomla_Vulnerability_Scanner_Project; reference:url,doc.emergingthreats.net/2009837; classtype:attempted-recon; sid:2009837; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Unknown Trojan Checkin 1"; flow:established,to_server; content:"/WebIpc.asp?UID="; http_uri; content:"&NAME="; http_uri; content:"&mode="; http_uri; classtype:trojan-activity; sid:2013370; rev:3; metadata:created_at 2011_08_05, updated_at 2011_08_05;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Banload iLLBrain Trojan Activity"; flow:to_server,established; content:"GET"; http_method; content:"User-Agent|3a| Microsoft URL Control"; nocase; http_uri; content:"/iLL"; http_uri; content:".xxx"; http_uri; reference:url,doc.emergingthreats.net/2008328; classtype:trojan-activity; sid:2008328; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Unknown Trojan Checkin 2"; flow:established,to_server; content:"/link32.asp?SID="; http_uri; content:"&UID="; http_uri; content:"&MID="; http_uri; classtype:trojan-activity; sid:2013371; rev:3; metadata:created_at 2011_08_05, updated_at 2011_08_05;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Worm.Win32.Koobface.C User-Agent"; flow:established,to_server; content:"|0d 0a|User-Agent|3a| Mozilla/5.01"; content:"Gecko/2005"; fast_pattern; within:50; content:"Firefox/3"; distance:5; reference:url,doc.emergingthreats.net/2008848; classtype:trojan-activity; sid:2008848; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED HTTP Request to a *.cz.tf domain"; flow:to_server,established; content:".cz.tf|0D 0A|"; http_header; classtype:bad-unknown; sid:2013836; rev:3; metadata:created_at 2011_11_05, updated_at 2011_11_05;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Nukebot related infection - Unique HTTP get request"; flow:established,to_server; content:".dll|0d 0a|e|20|HTTP/1.1"; rawbytes; content:!"User-Agent|3a|"; nocase; reference:url,www.websense.com/securitylabs/alerts/alert.php?AlertID=743; reference:url,doc.emergingthreats.net/2003432; classtype:trojan-activity; sid:2003432; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spy-Net Trojan Connection"; flow:established; content:"maininfo|7c|"; depth:9; nocase; content:"|7c|"; distance:3; reference:url,doc.emergingthreats.net/2008644; classtype:trojan-activity; sid:2008644; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Torpig Ping-Pong Keepalives Outbound"; flow:to_server; dsize:<20; content:"PONG |3a|"; depth:6; reference:url,doc.emergingthreats.net/2010824; classtype:trojan-activity; sid:2010824; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible BSNL Router DNS Change Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/dnscfg.cgi"; http_uri; content:"dnsPrimary="; http_client_body; content:"&dnsSecondary="; http_client_body; content:"&dnsDynamic="; http_client_body; content:"&dnsRefresh="; http_client_body; reference:url,www.hackersbay.in/2011/02/pwning-routersbsnl.html; classtype:attempted-user; sid:2013918; rev:3; metadata:created_at 2011_11_18, updated_at 2011_11_18;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Torpig Ping-Pong Keepalives Inbound"; flow:from_server; dsize:<20; content:"PING |3a|"; depth:6; reference:url,doc.emergingthreats.net/2010825; classtype:trojan-activity; sid:2010825; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.Emp Keepalive to CnC"; flow:established,to_server; content:"|7a 05 61 17 27 f5 09 f9 05 a2 ff 71 e0 49 96 47|"; offset:16; depth:16; dsize:48; reference:url,www.mcafee.com/threat-intelligence/malware/default.aspx?id=541210; classtype:command-and-control; sid:2013922; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_11_18, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED B0tN3t IRCbotnet"; flow:from_server,established; content:"|3a|"; offset:0; depth:1; content:"B0tN3t"; within:32; nocase; flowbits:set,irc.start; flowbits:set,is_proto_irc; reference:url,en.wikipedia.org/wiki/Botnet; reference:url,doc.emergingthreats.net/2007672; classtype:misc-activity; sid:2007672; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.Eu2 Keepalive to CnC"; flow:established,to_server; content:"|1c e9 a1 06 39 95 48 0d 64 1f 39 23 21 7f dc 43|"; offset:16; depth:16; dsize:48; classtype:command-and-control; sid:2013923; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_11_18, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED perlb0t/w0rmb0t Response (Case 1)"; flow:established,to_server; flowbits:isset,is_proto_irc; content:"|3A 02 5B|"; content:"|5B 02|"; within: 32; pcre:"/\x3A\x02\x5B(Atk33|Exploiting|Finished|GOOGLE.*|HTTP.{0,8}|PKS-SCAN.{0,20}|Results|RSH|SCAN|TCP.{0,8}|UDP.{0,8}|v6.{0,12}|VERSION)\x5D\x02/i"; reference:url,doc.emergingthreats.net/2006910; classtype:trojan-activity; sid:2006910; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.Eu3 Keepalive to CnC"; flow:established,to_server; content:"|77 1b 13 19 a2 d1 8d a1 b5 05 8f fa 3f aa c0 8a|"; offset:16; depth:16; dsize:48; classtype:command-and-control; sid:2013924; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_11_18, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED perlb0t/w0rmb0t Response (Case 3)"; flow:established,to_server; flowbits:isset,is_proto_irc; content:"|3A 02|"; content:"|02|"; within: 32; pcre:"/\x3A\x02(Alvo dos Pacotes|Conectando-se em|M.dia de envio|Tempo.*|Total .*)\x02/i"; reference:url,doc.emergingthreats.net/2006912; classtype:trojan-activity; sid:2006912; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.Eu4 Keepalive to CnC"; flow:established,to_server; content:"|ea a2 0d a1 b4 a9 a2 18 12 34 67 eb aa 6f ab 3f|"; offset:16; depth:16; dsize:48; classtype:command-and-control; sid:2013925; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_11_18, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET !6666:7000 -> $HOME_NET any (msg:"ET DELETED IRC Name response on non-standard port"; flow: to_client,established; dsize:<128; content:"|3a|"; depth:1; content:" 302 "; content:"=+"; content:"@"; reference:url,doc.emergingthreats.net/bin/view/Main/2000346; classtype:trojan-activity; sid:2000346; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Banker.OT Checkin"; flow:established,to_server; content:"POST"; http_method; content:"User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)"; http_header; content:"praquem="; http_client_body; fast_pattern; content:"&titulo="; http_client_body; content:"&texto="; http_client_body; reference:url,doc.emergingthreats.net/2007823; classtype:trojan-activity; sid:2007823; rev:8; metadata:created_at 2010_07_30, updated_at 2020_08_20;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Kaiten IRCbotnet login"; flow:to_server,established; content:"NICK|20|"; depth:5; content:"USER|20|"; within:32; content:"localhost|20|localhost|20 3A|"; within:32; pcre:"/NICK\x20\S+\x0AUSER\x20\S+localhost\x20localhost\x20\x3A/"; reference:url,en.wikipedia.org/wiki/IRC_bot; reference:url,doc.emergingthreats.net/2007621; classtype:trojan-activity; sid:2007621; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole obfuscated Javascript padded charcodes 25"; flow:established,from_server; content:"75"; depth:500; content:"86"; within:4; content:"74"; within:4; content:"92"; within:4; content:"84"; within:4; classtype:bad-unknown; sid:2013950; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_11_23, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +#alert tcp $HOME_NET any -> any any (msg:"ET DELETED Pitbull IRCbotnet Response"; flow:established; content:"PRIVMSG|20|"; content:"|3A|"; within:32; content:"4"; within:5; content:"12"; within:5; content:"|3a|"; within:5; pcre:"/\x3a.4\x7c.12.\x3a.4/"; reference:url,en.wikipedia.org/wiki/IRC_bot; reference:url,doc.emergingthreats.net/2007624; classtype:trojan-activity; sid:2007624; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Rimecud.A User-Agent (needit)"; flow:to_server,established; content:"User-Agent|3a| needit|0d 0a|"; http_header; reference:md5,1b1fff82c72277aff808291d53df7fd8; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FRimecud.A; classtype:trojan-activity; sid:2013951; rev:3; metadata:created_at 2011_11_23, updated_at 2011_11_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32.Duqu User-Agent"; flow:to_server,established; content:"User-Agent|3A| Mozilla/5.0 (Windows|3B| U|3B| Windows NT 6.0|3B| en-US|3B| rv|3A|1.9.2.9) Gecko/20100824 Firefox/3.6.9 (.NET CLR 3.5.30729)"; http_header; reference:url,www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf; classtype:trojan-activity; sid:2013782; rev:3; metadata:created_at 2011_10_20, updated_at 2011_10_20;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TR/Rimecud.aksa User-Agent (indy)"; flow:to_server,established; content:"User-Agent|3a| indy|0d 0a|"; http_header; reference:md5,1536a7072981ce5140efe6b9c193bb7e; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FRimecud.A; classtype:trojan-activity; sid:2013952; rev:3; metadata:created_at 2011_11_23, updated_at 2011_11_23;) +#alert tcp $HOME_NET any -> any 6667 (msg:"ET DELETED Likely Botnet Activity"; flow:to_server,established; content:"PRIVMSG|20|"; depth:8; pcre:"/(cheguei gazelas|meh que tao|Status|Tempo|Total pacotes|Total bytes|M?dia de envio|portas? aberta)/i"; reference:url,doc.emergingthreats.net/bin/view/Main/2001620; classtype:string-detect; sid:2001620; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Rimecud.A User-Agent (counters)"; flow:to_server,established; content:"User-Agent|3a| counters|0d 0a|"; http_header; reference:md5,60ce66bd10fcac3c97151612c8a4d343; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FRimecud.A; classtype:trojan-activity; sid:2013953; rev:3; metadata:created_at 2011_11_22, updated_at 2011_11_22;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible Redirection to Unknown Exploit Pack"; flow:established,to_client; content:"document.write|28|unescape|28 22|%3Cscript src=|27 22 20 2B 20|"; nocase; reference:url,www.kahusecurity.com/2011/malware-infection-from-new-exploit-pack/; classtype:misc-attack; sid:2013804; rev:4; metadata:created_at 2011_10_26, updated_at 2011_10_26;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Rimecud.A User-Agent (giftz)"; flow:to_server,established; content:"User-Agent|3a| giftz|0d 0a|"; http_header; reference:md5,0f726e84bae5a8d1f166bbf6d09d821b; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FRimecud.A; classtype:trojan-activity; sid:2013954; rev:2; metadata:created_at 2011_11_23, updated_at 2011_11_23;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Silentbanker/Yaludle Checkin to C&C"; flow:to_server,established; content:"GET"; depth:3; http_method; content:".php?id="; nocase; http_uri; content:"&c="; nocase; content:"&v="; nocase; content:"&b="; nocase; content:"&z="; nocase; reference:url,doc.emergingthreats.net/2009542; classtype:trojan-activity; sid:2009542; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Sality User-Agent (Internet Explorer 5.01)"; flow:established,to_server; content:"User-Agent|3A 20|Internet Explorer 5.01|0D 0A|"; http_header; classtype:trojan-activity; sid:2013963; rev:3; metadata:created_at 2011_11_23, updated_at 2011_11_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Lighty Variant or UltimateDefender POST"; flow:established,to_server; content:"POST"; http_method; content:".php"; content:"gd="; content:"&affid="; content:"&subid="; content:"&prov="; nocase; fast_pattern; reference:url,doc.emergingthreats.net/2008784; classtype:trojan-activity; sid:2008784; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Spamblockerutility.com-Hotbar User Agent (sbu-hb-)"; flow:to_server,established; content:"sbu-hb-"; http_header; pcre:"/User-Agent\x3a[^\n]+sbu-hb-/i"; reference:url,doc.emergingthreats.net/2003363; classtype:trojan-activity; sid:2003363; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 81 (msg:"ET DELETED Unknown Malware Keepalive"; flow:established,to_server; content:"keepalive"; nocase; depth:9; pcre:"/keepalive([0-9]{4}|\x7c[0-9]{4})/i"; threshold: type limit, track by_src, count 1, seconds 60; classtype:trojan-activity; sid:2012409; rev:3; metadata:created_at 2011_03_02, updated_at 2011_03_02;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS CoGetInstanceFromFile andx attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 04|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6; classtype:protocol-command-decode; sid:2103437; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Unknown Trojan Checkin 1"; flow:established,to_server; content:"/WebIpc.asp?UID="; http_uri; content:"&NAME="; http_uri; content:"&mode="; http_uri; classtype:trojan-activity; sid:2013370; rev:3; metadata:created_at 2011_08_05, updated_at 2011_08_05;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB CoGetInstanceFromFile andx attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 04|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6; classtype:protocol-command-decode; sid:2103429; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Unknown Trojan Checkin 2"; flow:established,to_server; content:"/link32.asp?SID="; http_uri; content:"&UID="; http_uri; content:"&MID="; http_uri; classtype:trojan-activity; sid:2013371; rev:3; metadata:created_at 2011_08_05, updated_at 2011_08_05;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL ACTIVEX winhelp clsid attempt"; flow:from_server,established; content:"adb880a6-d8ff-11cf-9377-00aa003b7a11"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*adb880a6-d8ff-11cf-9377-00aa003b7a11/si"; reference:bugtraq,4857; reference:cve,2002-0823; reference:url,www.ngssoftware.com/advisories/ms-winhlp.txt; classtype:attempted-user; sid:2103148; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED HTTP Request to a *.cz.tf domain"; flow:to_server,established; content:".cz.tf|0D 0A|"; http_header; classtype:bad-unknown; sid:2013836; rev:3; metadata:created_at 2011_11_05, updated_at 2011_11_05;) -#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP NextFTP client overflow"; flow:to_client,established; content:"|B4| |B4|!|8B CC 83 E9 04 8B 19|3|C9|f|B9 10|"; fast_pattern:only; reference:bugtraq,572; reference:cve,1999-0671; classtype:attempted-user; sid:2100308; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Spamblockerutility.com-Hotbar User Agent (sbu-hb-)"; flow:to_server,established; content:"sbu-hb-"; http_header; pcre:"/User-Agent\x3a[^\n]+sbu-hb-/i"; reference:url,doc.emergingthreats.net/2003363; classtype:trojan-activity; sid:2003363; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 119 (msg:"GPL MISC nntp SEARCH pattern overflow attempt"; flow:to_server,established; content:"SEARCH"; nocase; pcre:"/^SEARCH\s+[^\n]{1024}/smi"; reference:cve,2004-0574; reference:url,www.microsoft.com/technet/security/bulletin/MS04-036.mspx; classtype:attempted-admin; sid:2103078; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"GPL DELETED cmd_rootsh backdoor attempt"; flow:to_server,established; content:"cmd_rootsh"; reference:nessus,10070; reference:url,www.sans.org/y2k/TFN_toolkit.htm; reference:url,www.sans.org/y2k/fingerd.htm; classtype:attempted-admin; sid:2100320; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"GPL NETBIOS DCERPC CoGetInstanceFromFile overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|01 00|"; within:2; distance:19; byte_test:4,>,128,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:2103159; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"GPL DELETED EXPLOIT named tsig overflow attempt"; content:"|80 00 07 00 00 00 00 00 01|?|00 01 02|"; reference:bugtraq,2303; reference:cve,2001-0010; classtype:attempted-admin; sid:2100314; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"GPL NETBIOS DCERPC IActivation bind attempt"; flow:established,to_server; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; classtype:protocol-command-decode; sid:2103275; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"GPL DELETED EXPLOIT named tsig overflow attempt"; flow:to_server,established; content:"|AB CD 09 80 00 00 00 01 00 00 00 00 00 00 01 00 01| |02|a"; reference:arachnids,482; reference:bugtraq,2302; reference:cve,2001-0010; classtype:attempted-admin; sid:2100303; rev:12; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"GPL NETBIOS DCERPC IActivation little endian bind attempt"; flow:established,to_server; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; classtype:protocol-command-decode; sid:2103276; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Hiloti loader receiving payload URL"; flow:established,from_server; content:"|0d 0a 0d 0a|20|0d 0a|http|3a|//"; classtype:trojan-activity; sid:2012515; rev:5; metadata:created_at 2011_03_16, updated_at 2011_03_16;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"GPL NETBIOS DCERPC ISystemActivator path overflow attempt big endian"; flow:to_server,established; content:"|05|"; byte_test:1,<,16,3,relative; content:"|5C 00 5C 00|"; byte_test:4,>,256,-8,relative; flowbits:isset,dce.isystemactivator.bind; reference:bugtraq,8205; reference:cve,2003-0352; reference:nessus,11808; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:2103198; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Zeus POST Request to CnC"; flow:established,to_server; content:"POST"; http_method; content:" HTTP/1.1|0d 0a|Accept|3a| */*|0d 0a|User-Agent|3a| Mozilla"; fast_pattern; content:"|0d 0a|Content-Length|3a| "; distance:0; content:!"0"; within:1; content:"Connection|3a| Keep-Alive|0d 0a|"; distance:0; content:"|3a| no-cache"; distance:0; content:"|0d 0a 0d 0a|"; distance:0; content:!"Content-Type|3a| "; reference:url,www.secureworks.com/research/threats/zeus/?threat=zeus; reference:url,lists.emergingthreats.net/pipermail/emerging-sigs/2010-October/009807.html; classtype:command-and-control; sid:2011816; rev:16; metadata:created_at 2010_10_14, updated_at 2010_10_14;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"GPL NETBIOS DCERPC ISystemActivator path overflow attempt little endian"; flow:to_server,established; content:"|05|"; byte_test:1,&,16,3,relative; content:"|5C 5C|"; byte_test:4,>,256,-8,little,relative; flowbits:isset,dce.isystemactivator.bind; reference:bugtraq,8205; reference:cve,2003-0352; reference:nessus,11808; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:2103197; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Trojan Dropper User-Agent Firefox/3.6.3"; flow:established,to_server; content:"User-Agent|3A| Firefox/3.6.3"; http_header; classtype:trojan-activity; sid:2013341; rev:3; metadata:created_at 2011_08_02, updated_at 2011_08_02;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"GPL NETBIOS DCERPC IrotIsRunning attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 02|"; within:2; distance:19; byte_test:4,>,128,0,relative; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:2103238; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Altnet PeerPoints Manager Traffic User-Agent (Peer Points)"; flow: established,to_server; content:"User-Agent|3a|"; nocase; http_header; content:"Peer Points"; http_header; within:150; pcre:"/User-Agent\:[^\n]+Peer Points/iH"; reference:url,doc.emergingthreats.net/2001640; classtype:policy-violation; sid:2001640; rev:23; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"GPL NETBIOS DCERPC IrotIsRunning little endian attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|02 00|"; within:2; distance:19; byte_test:4,>,128,0,little,relative; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:2103239; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED User-Agent (BlueSky)"; flow:to_server,established; content:"User-Agent|3a| BlueSky|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2011084; classtype:trojan-activity; sid:2011084; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"GPL NETBIOS DCERPC irot bind attempt"; flow:established,to_server; content:"|05|"; depth:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:2103236; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED User-Agent (GM Login)"; flow:to_server,established; content:"User-Agent|3a| GM Login|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2011273; classtype:trojan-activity; sid:2011273; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"GPL NETBIOS DCERPC irot little endian bind attempt"; flow:established,to_server; content:"|05|"; depth:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:2103237; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED User-Agent (MSIE XPSP2)"; flow:to_server,established; content:"MSIE XPSP2"; fast_pattern:only; http_header; reference:url,doc.emergingthreats.net/2003200; classtype:trojan-activity; sid:2003200; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"GPL NETBIOS DCERPC msqueue bind attempt"; flow:to_server,established; content:"|05|"; depth:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:2103156; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Kargany Loader Obfuscated Payload Download"; flow:established,from_server; content:"Content-Disposition|3a| "; http_header; nocase; content:"windows-update-"; distance:0; http_header; content:".exe"; distance:0; http_header; content:!"|0d 0a|MZ"; classtype:trojan-activity; sid:2014019; rev:4; metadata:created_at 2011_12_10, updated_at 2011_12_10;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"GPL NETBIOS DCERPC msqueue little endian bind attempt"; flow:to_server,established; content:"|05|"; depth:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:2103157; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Zango-Hotbar User-Agent (zbu-hb-)"; flow:to_server,established; content:"zbu-hb-"; http_header; fast_pattern:only; pcre:"/User-Agent\:[^\n]+zbu-hb-/Hi"; reference:url,doc.emergingthreats.net/2003305; classtype:trojan-activity; sid:2003305; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 137 (msg:"GPL NETBIOS name query overflow attempt TCP"; flow:to_server,established; byte_test:1,&,64,2; content:" "; offset:12; isdataat:56,relative; reference:bugtraq,9624; reference:cve,2003-0825; classtype:attempted-admin; sid:2103195; rev:5; metadata:created_at 2010_09_23, former_category NETBIOS, updated_at 2017_11_10;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Unknown checkin"; flow:established,to_server; content:"POST"; http_method; content:"/c.php"; fast_pattern; http_uri; content:"User-Agent|3a| Mozilla/4.0 compatible|3b| MSIE 8.0|3b| Windows NT 5.1|3b| Trident/4.0|3b| |0d 0a|"; http_header; classtype:trojan-activity; sid:2013803; rev:5; metadata:created_at 2011_10_26, updated_at 2011_10_26;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB CoGetInstanceFromFile andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 01|"; within:2; distance:19; byte_test:4,>,128,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:2103180; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Searchmeup Spyware Install (toolbar)"; flow: to_server,established; content:"/dkprogs/toolbar.txt"; http_uri; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2001473; classtype:trojan-activity; sid:2001473; rev:9; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB CoGetInstanceFromFile little endian andx attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|04 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6,little; classtype:protocol-command-decode; sid:2103430; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED HSN.com Toolbar Spyware User-Agent (HSN)"; flow:to_server,established; content:"User-Agent|3a| "; nocase; http_header; content:"HSN"; http_header; fast_pattern:only; pcre:"/User-Agent\:[^\n]+HSN/iH"; reference:url,doc.emergingthreats.net/2003495; classtype:trojan-activity; sid:2003495; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Minor, tag Spyware_User_Agent, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB CoGetInstanceFromFile little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|01 00|"; within:2; distance:19; byte_test:4,>,128,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:2103181; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Wild Tangent Agent User-Agent (WildTangent)"; flow: to_server,established; content:"WildTangent"; fast_pattern:only; pcre:"/User-Agent\:[^\n]+Wildtangent/iH"; reference:url,doc.emergingthreats.net/2001639; classtype:trojan-activity; sid:2001639; rev:30; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB CoGetInstanceFromFile unicode andx attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 04|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8; classtype:protocol-command-decode; sid:2103431; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Blackhole Acrobat 8/9.3 PDF exploit download request 3"; flow:established,to_server; content:"/fdp2.php?f="; http_uri; reference:md5,8a33d1d36d097ca13136832aa10ae5ca; reference:cve,CVE-2011-0611; classtype:trojan-activity; sid:2014051; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_12_30, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB CoGetInstanceFromFile unicode andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 01|"; within:2; distance:19; byte_test:4,>,256,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:2103182; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Blackhole Acrobat 1-7 PDF exploit download request 3"; flow:established,to_server; content:"/fdp1.php?f="; http_uri; reference:md5,8a33d1d36d097ca13136832aa10ae5ca; reference:cve,CVE-2011-0611; classtype:trojan-activity; sid:2014052; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_12_30, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB CoGetInstanceFromFile unicode little endian andx attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|04 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8,little; classtype:protocol-command-decode; sid:2103432; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Nginx Serving PDF - Possible hostile content (PDF)"; flow:established,from_server; content:"|0d 0a|Server|3a| nginx"; depth:300; content:"%PDF-"; within:300; threshold:type limit, seconds 60, count 10, track by_src; reference:url,doc.emergingthreats.net/bin/view/Main/2009076; classtype:bad-unknown; sid:2009076; rev:16; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB IActivation andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103381; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Nginx Server in use - Often Hostile Traffic"; flow:established,from_server; content:"|0d 0a|Server|3a| nginx"; nocase; threshold:type limit, seconds 60, count 3, track by_src; reference:url,doc.emergingthreats.net/2008054; classtype:bad-unknown; sid:2008054; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB IActivation little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103382; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED FakeAV Served To Client"; flow:established,to_client; content:"HTTP/1"; depth:6; content:"Content-Disposition|3a| attachment|3b| filename="; nocase; content:"|0D 0A|Set-Cookie|3a| ds=1|0D 0A|"; nocase; reference:url,doc.emergingthreats.net/2011221; classtype:trojan-activity; sid:2011221; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB IActivation unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103383; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED MALVERTISING trafficbiztds.com - client receiving redirect to exploit kit"; flow:established,to_client; content:"domain=trafficbiztds.com"; http_cookie; content:!"google.com"; classtype:exploit-kit; sid:2011469; rev:6; metadata:created_at 2010_09_29, updated_at 2010_09_29;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB IActivation unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103384; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Nginx Serving EXE/DLL File Often Malware Related"; flow:established,to_client; content:"Server|3a| nginx"; nocase; fast_pattern; content:"MZ"; content:"This program cannot be run in DOS mode."; distance:0; isdataat:10,relative; content:"PE"; distance:0; classtype:misc-activity; sid:2012195; rev:3; metadata:created_at 2011_01_17, updated_at 2011_01_17;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB ISystemActivator andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103397; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Executable served from Amazon S3"; flow:established,to_client; content:"Server|3A| AmazonS3"; content:"MZ"; isdataat:80,relative; content:"PE"; distance:0; reference:url,blog.trendmicro.com/cybercriminals-using-amazon-web-services-aws-to-host-malware/; reference:url,www.securelist.com/en/blog/208188099/Financial_data_stealing_Malware_now_on_Amazon_Web_Services_Cloud; classtype:bad-unknown; sid:2013437; rev:5; metadata:created_at 2011_08_19, updated_at 2011_08_19;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB ISystemActivator little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103398; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED EXE Download When Server Claims To Send Audio File - DOS Mode"; flow:established,to_client; content:"Content-Type|3A 20|audio|2F|"; nocase; content:"MZ"; content:"This program cannot be run in DOS mode"; distance:0; content:"PE"; distance:0; classtype:trojan-activity; sid:2013442; rev:3; metadata:created_at 2011_08_22, updated_at 2011_08_22;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB ISystemActivator unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103399; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Zeus POST Request to CnC - content-type variation"; flow:established,to_server; content:"POST"; http_method; content:"|20|HTTP/1."; content:"|0d 0a|Accept|3a 20|*/*|0d 0a|Content-Type|3a 20|application/x-www-form-urlencoded"; distance:1; within:62; content:"|3a 20|no-cache|0d 0a|User-Agent|3a 20|Mozilla"; distance:0; content:"|0d 0a|Host|3a 20|"; distance:0; content:"Content-Length|3a 20|"; distance:0; content:!"0"; within:1; content:"|0d 0a 0d 0a|"; distance:0; content:!"Referer|3a 20|"; http_header; content:!"Accept-Language|3a 20|"; http_header; classtype:command-and-control; sid:2014104; rev:2; metadata:created_at 2012_01_10, updated_at 2012_01_10;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB ISystemActivator unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103400; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 3535 (msg:"GPL DELETED RMD / attempt"; flow:to_server,established; content:"RMD"; nocase; pcre:"/^RMD\s+\x2f$/smi"; reference:bugtraq,9159; classtype:attempted-dos; sid:2102335; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB IrotIsRunning andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 02|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:2103260; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED ypupdated arbitrary command attempt TCP"; flow:to_server,established; content:"|00 01 86 BC|"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; byte_jump:4,4,relative,align; byte_jump:4,4,relative,align; content:"|7C|"; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:misc-attack; sid:2102089; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB IrotIsRunning little endian andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|02 00|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:2103261; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert udp $HOME_NET 49 -> $EXTERNAL_NET any (msg:"GPL DELETED xtacacs accepted login response"; content:"|80 02|"; depth:2; content:"|01|"; distance:4; classtype:misc-activity; sid:2102042; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB IrotIsRunning unicode andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 02|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:2103262; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert udp $EXTERNAL_NET any -> $HOME_NET 49 (msg:"GPL DELETED xtacacs login attempt"; content:"|80 01|"; depth:2; content:"|00|"; distance:4; classtype:misc-activity; sid:2102040; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB IrotIsRunning unicode little endian andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|02 00|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:2103263; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED network-status-monitor mon-callback request TCP"; flow:to_server,established; content:"|00 03 0D|p"; depth:4; offset:16; content:"|00 00 00 01|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; classtype:rpc-portmap-decode; sid:2102038; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE oversized Security Descriptor attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"|01 00|"; within:2; distance:37; byte_jump:4,-15,little,relative,from_beginning; isdataat:4,relative; byte_test:4,>,1024,40,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103022; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED network-status-monitor mon-callback request UDP"; content:"|00 03 0D|p"; depth:4; offset:12; content:"|00 00 00 01|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:4; classtype:rpc-portmap-decode; sid:2102037; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB NT Trans NT CREATE andx oversized Security Descriptor attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-15,little,relative,from_beginning; byte_test:4,>,1024,40,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103019; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED ypserv maplist request TCP"; flow:to_server,established; content:"|00 01 86 A4|"; depth:4; offset:16; content:"|00 00 00 0B|"; within:4; distance:4; content:"|00 00 00 00|"; depth:4; offset:8; reference:cve,CAN-2002-1232; reference:bugtraq,5914; reference:bugtraq,6016; classtype:rpc-portmap-decode; sid:2102034; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB NT Trans NT CREATE DACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"|01 00|"; within:2; distance:64; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:20; byte_jump:4,20,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103034; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED FAKEAV CryptMEN inst.exe Payload Download"; flow:established,from_server; content:"Content-Disposition|3a| attachment|3b| filename="; content:"inst.exe"; distance:0; fast_pattern; classtype:trojan-activity; sid:2011923; rev:6; metadata:created_at 2010_11_11, updated_at 2010_11_11;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB NT Trans NT CREATE SACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"|01 00|"; within:2; distance:64; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103026; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET DELETED W32/Ramnit Initial CnC Connection"; flow:established,to_server; dsize:6; content:"|00 FF FB 00 00 00|"; fast_pattern:only; reference:url,contagiodump.blogspot.com/2012/01/blackhole-ramnit-samples-and-analysis.html; classtype:command-and-control; sid:2014131; rev:3; metadata:created_at 2012_01_17, updated_at 2012_01_17;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB NT Trans NT CREATE andx DACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:20; byte_jump:4,20,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103035; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED DRIVEBY Generic Java Rhino Scripting Engine Exploit Previously Requested class.class"; flow:established,to_server; content:" Java/1"; http_header; content:"/class.class"; http_uri; classtype:trojan-activity; sid:2014138; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2012_01_21, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB NT Trans NT CREATE andx SACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103027; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Spy.Lpxenur Checkin"; flow:established,to_server; content:"/data/mail.js?yaru="; http_uri; classtype:trojan-activity; sid:2013714; rev:3; metadata:created_at 2011_10_01, updated_at 2011_10_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB NT Trans NT CREATE andx invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:20; byte_jump:4,20,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:2103051; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED PoisonIvy.Esf Keepalive to CnC"; flow:established,to_server; content:"|ad 4a 6c bb a7 9c 30 3e 44 bc cf a5 db 77 3c 62|"; offset:16; depth:16; dsize:48; reference:md5,e6ca06e9b000933567a8604300094a85; classtype:command-and-control; sid:2014143; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_01_24, deployment Perimeter, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB NT Trans NT CREATE invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"|01 00|"; within:2; distance:64; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:2103042; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED PoisonIvy.Eks Keepalive to CnC"; flow:established,to_server; content:"|82 ca 6f eb 66 ed 9e 86 dc 95 29 f0 68 a2 5d b8|"; offset:16; depth:16; dsize:48; reference:md5,9a494e7a48436e6defcb44dd6f053b33; classtype:command-and-control; sid:2014144; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_01_24, deployment Perimeter, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB NT Trans NT CREATE invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"|01 00|"; within:2; distance:64; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:20; byte_jump:4,20,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:2103050; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Blink.com related Upgrade Command Given"; flowbits:isset,ET.blink.get; flow:established,from_server; content:"|0d 0a|X-Messaging|3a| This is an important download|0d 0a|Location|3a| http|3a|//"; reference:url,doc.emergingthreats.net/2007806; classtype:trojan-activity; sid:2007806; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB NT Trans NT CREATE unicode DACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"|01 00|"; within:2; distance:64; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:20; byte_jump:4,20,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103036; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32.PEx.C.91139756616/Win32.Zwangi-BU Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/?vn="; http_uri; content:"&partner="; http_uri; content:"&ptag="; http_uri; content:"&cid="; http_uri; content:"&se="; http_uri; content:"&au="; http_uri; content:"&pver="; http_uri; reference:url,threatcenter.crdf.fr/?More&ID=49889&D=CRDF.Win32.Win32.PEx.C.91139756616; reference:md5,2c969afbe71f35571d11e30f1e854b29; reference:url,www.pcsafedoctor.com/Adware/remove-AdWare.Win32.Zwangi.bu.html; classtype:trojan-activity; sid:2013789; rev:3; metadata:created_at 2011_10_21, updated_at 2011_10_21;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB NT Trans NT CREATE unicode SACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"|01 00|"; within:2; distance:64; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103028; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 3389 (msg:"ET DELETED MS Terminal Server User A Login, possible Morto Outbound"; flow:to_server,established; content:"|03 00 00|"; depth:3; content:"|e0 00 00 00 00 00|"; offset:5; depth:6; content:"Cookie|3a| mstshash=a|0d 0a|"; nocase; reference:cve,CAN-2001-0540; classtype:protocol-command-decode; sid:2013531; rev:2; metadata:created_at 2011_09_03, updated_at 2011_09_03;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB NT Trans NT CREATE unicode andx DACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:20; byte_jump:4,20,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103037; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Suspicious User-Agent (TheWorld)"; flow:established,to_server; content:"TheWorld"; http_header; pcre:"/User-Agent\x3A[^\n]+TheWorld/H"; reference:url,www.virustotal.com/file-scan/report.html?id=70e502c9b8752da6dc0ff2a41c6975d59090482d2c0758387aca1b5702f96988-1305238279; classtype:trojan-activity; sid:2013403; rev:7; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_08_11, deployment Perimeter, signature_severity Major, tag User_Agent, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB NT Trans NT CREATE unicode andx SACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103029; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 2401 (msg:"GPL DELETED CVS Max-dotdot integer overflow attempt"; flow:to_server,established; content:"Max-dotdot"; nocase; pcre:"/^Max-dotdot[\s\r\n]*\d{3,}/msi"; reference:bugtraq,10499; reference:cve,2004-0417; classtype:misc-attack; sid:2102583; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB NT Trans NT CREATE unicode andx invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; isdataat:4,relative; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:2103045; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL DELETED Samba SWAT Authorization overflow attempt"; flow:to_server,established; content:"Authorization|3A| Basic"; nocase; http_header; pcre:"/^Authorization\x3a Basic\s+=/smi"; reference:bugtraq,10780; classtype:web-application-attack; sid:2102597; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB NT Trans NT CREATE unicode andx invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; isdataat:4,relative; content:!"|00 00 00 00|"; within:4; distance:20; byte_jump:4,20,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:2103053; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 901 (msg:"GPL DELETED Samba SWAT Authorization port 901 overflow attempt"; flow:to_server,established; content:"Authorization|3A| Basic"; nocase; pcre:"/^Authorization\x3a Basic\s+=/smi"; reference:bugtraq,10780; classtype:web-application-attack; sid:2102598; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB NT Trans NT CREATE unicode invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"|01 00|"; within:2; distance:64; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:2103044; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Zeus POST Request to CnC - content-type variation"; flow:established,to_server; content:"POST"; http_method; content:"|20|HTTP/1."; content:"|0d 0a|Accept|3a 20|*/*|0d 0a|Content-Type|3a 20|application/x-www-form-urlencoded"; distance:1; within:62; content:"|3a 20|no-cache|0d 0a|User-Agent|3a 20|Mozilla"; distance:0; content:"|0d 0a|Host|3a 20|"; distance:0; content:"Content-Length|3a 20|"; distance:0; content:!"0"; within:1; content:"|0d 0a 0d 0a|"; distance:0; content:!"Referer|3a 20|"; http_header; content:!"Accept-Language|3a 20|"; http_header; content:!"Host|3a 20|update.cooliris.com|0d 0a|"; http_header; classtype:command-and-control; sid:2014106; rev:3; metadata:created_at 2012_01_10, updated_at 2012_01_10;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB NT Trans NT CREATE unicode invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"|01 00|"; within:2; distance:64; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:20; byte_jump:4,20,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:2103052; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Unknown Malware Checkin Possibly ZeuS"; flow:established,to_server; content:"POST"; http_method; content:"/rssfeed.php"; http_uri; content:"bn1="; http_client_body; content:"&sk1="; http_client_body; classtype:trojan-activity; sid:2014178; rev:2; metadata:created_at 2012_02_03, updated_at 2012_02_03;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE DACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"|01 00|"; within:2; distance:64; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:20; byte_jump:4,20,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103038; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Malicious getpvstat.php file Reporting"; flow:established,to_server; content:"GET"; http_method; content:"/getpvstat.php"; nocase; http_uri; content:"p="; nocase; http_uri; content:"jss.155game.com"; http_header; nocase; classtype:trojan-activity; sid:2014182; rev:3; metadata:created_at 2012_02_06, updated_at 2012_02_06;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE SACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"|01 00|"; within:2; distance:64; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103030; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET 8080 (msg:"ET DELETED Unknown HTTP CnC Checkin"; flow:established,to_server; content:"POST"; http_method; content:".ru|3a|8080|0D 0A|"; http_header; fast_pattern; pcre:"/Host\x3a\s[a-z]{16}\.ru/H"; classtype:command-and-control; sid:2014221; rev:3; metadata:created_at 2012_02_13, updated_at 2012_02_13;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE andx DACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:20; byte_jump:4,20,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103039; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED DRIVEBY Generic - Java Exploit Obfuscated With Allatori"; flow:established,to_client; flowbits:isset,ET.http.javaclient; content:"|0d 0a 0d 0a|PK"; content:"Allatori"; nocase; classtype:bad-unknown; sid:2014241; rev:7; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2012_02_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE andx SACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103031; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Java applet with obfuscated URL 2"; flow:established,from_server; content:" $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE andx invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:2103047; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> any any (msg:"ET DELETED Http Client Body contains pw= in cleartext"; flow:established,to_server; content:"pw="; nocase; http_client_body; classtype:policy-violation; sid:2012889; rev:3; metadata:created_at 2011_05_30, updated_at 2011_05_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE andx invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:20; byte_jump:4,20,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:2103055; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET DELETED Possible Attempt to Create MSSQL SOAP/HTTP Endpoint in URI to Allow for Operating System Interaction"; flow:established,to_server; content:"CREATE"; nocase; http_uri; content:"ENDPOINT"; nocase; http_uri; pcre:"/CREATE.+ENDPOINT/Ui"; reference:url,msdn.microsoft.com/en-us/library/ms345123.aspx; classtype:web-application-attack; sid:2011425; rev:4; metadata:created_at 2010_09_28, updated_at 2010_09_28;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"|01 00|"; within:2; distance:64; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:2103046; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Shiz or Rohimafo config download"; flow: established,to_client; content:"|21|config"; nocase; content:"|21|load"; nocase; content:"|2e|php|3f|id|3d|1|26|magic|3d|"; nocase; reference:url,asert.arbornetworks.com/2010/09/shiz-and-rohimafo-malware-cousins/; reference:md5,0bb4662b54f02c989edc520314fc20ea; reference:md5,a671eb9979505119f4106a990c4ef7ab; reference:md5,3614d4f6527d512b61c27c4e213347a6; classtype:trojan-activity; sid:2011521; rev:4; metadata:created_at 2010_09_29, updated_at 2010_09_29;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,!&,128,6,relative; content:"|01 00|"; within:2; distance:64; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:20; byte_jump:4,20,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:2103054; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Adobe 0day Shovelware"; flow:established,to_server; content:"GET"; http_method; content:!"Referer|3a|"; http_header; content:"/ppp/listdir.php?dir="; http_uri; pcre:"/\/[a-z]{2}\/[a-z]{4}01\/ppp\/listdir\.php\?dir=/Ui"; reference:url,isc.sans.org/diary.html?storyid=7747; reference:url,doc.emergingthreats.net/2010496; classtype:trojan-activity; sid:2010496; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE unicode DACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"|01 00|"; within:2; distance:64; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:20; byte_jump:4,20,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103040; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Java JAR PROPFIND via DAV possible alternative JVM exploit"; flow:established,to_server; content:"PROPFIND"; http_method; content:".jar"; http_uri; nocase; content:"User-Agent|3a| Microsoft-WebDAV-MiniRedir"; http_header; content:!"Referer|3a| "; http_header; reference:url,blogs.zdnet.com/security/?p=6082; reference:url,doc.emergingthreats.net/2011009; classtype:bad-unknown; sid:2011009; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE unicode SACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"|01 00|"; within:2; distance:64; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103032; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Cisco %u IDS evasion"; flow:to_server,established; content:"%u002F"; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2000012; classtype:attempted-dos; sid:2000012; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE unicode andx DACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:20; byte_jump:4,20,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103041; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Cisco IOS HTTP server DoS"; flow: to_server,established; content:"/TEST?/"; http_uri; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2000013; classtype:attempted-dos; sid:2000013; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE unicode andx SACL overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; byte_test:4,>,32,-16,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103033; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET DELETED Cisco IOS HTTP DoS"; flow: to_server,established; content:"/error?/"; http_uri; nocase; reference:url,www.cisco.com/warp/public/707/ioshttpserverquery-pub.shtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000009; classtype:attempted-dos; sid:2000009; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE unicode andx invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:2103049; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET DELETED Oracle WebLogic IIS connector JSESSIONID Remote Overflow Exploit"; flow:to_server,established; content:".jsp?"; nocase; http_uri; content:"JSESSIONID="; nocase; isdataat:5132; reference:cve,2008-5457; reference:url,infosec20.blogspot.com/2009/04/oracle-weblogic-iis-remote-buffer.html; reference:url,doc.emergingthreats.net/2009216; classtype:attempted-admin; sid:2009216; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE unicode andx invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:20; byte_jump:4,20,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:2103057; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Cutwail Landing Page WAIT PLEASE"; flow:established,from_server; content:"

WAIT PLEASE

"; nocase; depth:300; classtype:bad-unknown; sid:2014377; rev:2; metadata:created_at 2012_03_14, updated_at 2012_03_14;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE unicode invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"|01 00|"; within:2; distance:64; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:16; byte_jump:4,16,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:2103048; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED AdultfriendFinder.com Spyware Iframe Download"; flow:to_server,established; content:"/promo/affiframe.jsp?Pid="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002353; classtype:trojan-activity; sid:2002353; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE unicode invalid SACL ace size dos attempt"; flow:stateless; content:"|00|"; depth:1; content:"|FF|SMB|A0|"; within:5; distance:3; byte_test:1,&,128,6,relative; content:"|01 00|"; within:2; distance:64; byte_jump:4,-7,little,relative,from_beginning; content:!"|00 00 00 00|"; within:4; distance:20; byte_jump:4,20,relative,little; content:"|00 00|"; within:2; distance:-10; classtype:protocol-command-decode; sid:2103056; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Casalemedia Access, Likely Spyware"; flow: to_server,established; content:"Host|3a|"; nocase; http_header; content:".ak-networks.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001529; classtype:trojan-activity; sid:2001529; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB OpenKey andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0F|"; within:2; distance:19; byte_test:2,>,1024,20,relative; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:2103222; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Cnzz.com/Baidu Related Spyware Stat Reporting"; flow:established,to_server; content:"/stat.php?id="; nocase; http_uri; content:"&web_id="; nocase; http_uri; content:"Host|3a|"; nocase; http_header; content:!"Referer|3a| "; nocase; http_header; reference:url,vil.nai.com/vil/content/v_140364.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2003607; classtype:trojan-activity; sid:2003607; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB OpenKey little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0F 00|"; within:2; distance:19; byte_test:2,>,1024,20,relative,little; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:2103223; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Doctorpro.co.kr Related Fake Anti-Spyware Install Checkin"; flow:established,to_server; content:"/install_count.html?id="; nocase; http_uri; content:"&MAC="; nocase; http_uri; pcre:"/MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2006425; classtype:trojan-activity; sid:2006425; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB OpenKey unicode andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0F|"; within:2; distance:19; byte_test:2,>,2048,20,relative; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:2103224; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Doctorpro.co.kr Related Fake Anti-Spyware Checkin"; flow:established,to_server; content:"/access_count.html?id="; nocase; http_uri; content:"&MAC="; nocase; http_uri; pcre:"/MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2006426; classtype:trojan-activity; sid:2006426; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB OpenKey unicode little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0F 00|"; within:2; distance:19; byte_test:2,>,2048,20,relative,little; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:2103225; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED FlashPoint Agent Retrieving New Code"; flow: to_server,established; content:"/ftxmon.php?"; http_uri; reference:url,www.flashpoint.bm; reference:url,doc.emergingthreats.net/bin/view/Main/2000905; classtype:trojan-activity; sid:2000905; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB RemoteActivation andx attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6; classtype:protocol-command-decode; sid:2103413; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Landing with prototype catch"; flow:established,from_server; content:"if(window.document)try{new"; content:".prototype}catch("; distance:0; fast_pattern; classtype:bad-unknown; sid:2014369; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_03_13, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB RemoteActivation little endian andx attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6,little; classtype:protocol-command-decode; sid:2103414; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED Possible Malware Related Numerical .co Domain Lookup"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|02|co|00|"; fast_pattern; nocase; distance:0; pcre:"/\x00[0-9]{4,7}\x02co\x00/i"; reference:url,sign.kaffenews.com/?p=104; reference:url,www.isc.sans.org/diary.html?storyid=10165; classtype:bad-unknown; sid:2012144; rev:3; metadata:created_at 2011_01_05, updated_at 2011_01_05;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB RemoteActivation unicode andx attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8; classtype:protocol-command-decode; sid:2103415; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Popuptraffic.com Bot Reporting"; flow: to_server,established; content:"/scripts/click.php?"; nocase; http_uri; content:"hid="; http_uri; reference:url,popuptraffic.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000577; classtype:policy-violation; sid:2000577; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB RemoteActivation unicode little endian andx attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8,little; classtype:protocol-command-decode; sid:2103416; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Privacyprotector.com Fake Anti-Spyware Checkin"; flow: to_server,established; content:"/?action="; nocase; http_uri; content:"&type="; nocase; http_uri; content:"&pc_id="; nocase; http_uri; content:"&abbr="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003548; classtype:trojan-activity; sid:2003548; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB Session Setup NTMLSSP andx asn1 overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"s"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_test:4,&,2147483648,21,relative,little; content:!"NTLMSSP"; within:7; distance:27; asn1:double_overflow, bitstring_overflow, relative_offset 27, oversize_length 2048; reference:bugtraq,9633; reference:bugtraq,9635; reference:cve,2003-0818; reference:nessus,12052; reference:nessus,12065; reference:url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx; classtype:protocol-command-decode; sid:2103001; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED rcprograms"; flow: to_server,established; content:"update.rcprograms.com"; nocase; http_header; reference:url,sarc.com/avcenter/venc/data/adware.rcprograms.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000024; classtype:trojan-activity; sid:2000024; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB Session Setup NTMLSSP unicode andx asn1 overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"s"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_test:4,&,2147483648,21,relative,little; content:!"NTLMSSP"; within:7; distance:27; asn1:double_overflow, bitstring_overflow, relative_offset 27, oversize_length 2048; reference:bugtraq,9633; reference:bugtraq,9635; reference:cve,2003-0818; reference:nessus,12052; reference:nessus,12065; reference:url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx; classtype:protocol-command-decode; sid:2103002; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Searchmiracle.com Access, Likely Spyware"; flow: to_server,established; content:"Host|3a|"; nocase; http_header; content:".searchmiracle.com"; nocase; http_header; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.elitebar.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001532; classtype:trojan-activity; sid:2001532; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB irot andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:2103244; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Speedera Agent"; flow: to_server,established; content:"/io/downloads"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001320; classtype:trojan-activity; sid:2001320; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB irot little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:2103245; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Spylog.ru Related Spyware Checkin"; flow:established,to_server; content:"/cnt?"; nocase; http_uri; content:"cid="; nocase; http_uri; content:"&p="; nocase; http_uri; content:"&rn="; nocase; http_uri; content:"&c="; nocase; http_uri; content:"&tl="; nocase; http_uri; content:"&ls="; nocase; http_uri; content:"&ln="; nocase; http_uri; content:"&t="; nocase; http_uri; content:"&j="; nocase; http_uri; content:"&wh="; nocase; http_uri; content:"&px="; nocase; http_uri; content:"&sl="; nocase; http_uri; content:"&r="; nocase; http_uri; content:"&fr="; nocase; http_uri; content:"&pg="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2007649; classtype:trojan-activity; sid:2007649; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB irot unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:2103246; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Statblaster Receiving New configuration (allfiles)"; flow: to_server,established; content:"/updatestats/all_files"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.statblaster.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001523; classtype:policy-violation; sid:2001523; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB irot unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:2103247; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Virtumonde Spyware siae3123.exe GET"; flow: to_server,established; content:"siae3123.exe"; nocase; http_uri; reference:url,sarc.com/avcenter/venc/data/adware.virtumonde.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000306; classtype:trojan-activity; sid:2000306; rev:29; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB llsrconnect andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,52,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:2103118; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Virtumonde Spyware Information Post"; flow: to_server,established; content:"POST"; nocase; http_method; content:"e_g_StatisticsUploadDelay"; nocase; content:"g_AffiliateID"; nocase; content:"virtumonde.com"; http_header; reference:url,sarc.com/avcenter/venc/data/adware.virtumonde.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000308; classtype:trojan-activity; sid:2000308; rev:24; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB llsrconnect little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,52,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:2103119; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Weatherbug"; flow: to_server,established; content:"WxAlertIsapi"; nocase; http_uri; threshold: type limit, track by_src, count 1, seconds 3600; reference:url,doc.emergingthreats.net/bin/view/Main/2001235; classtype:misc-activity; sid:2001235; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB llsrconnect unicode andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,104,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:2103120; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Weatherbug Wxbug Capture"; flow: to_server,established; content:"GET"; nocase; http_method; content:"Host|3a|"; nocase; http_header; content:"wxbug.com"; nocase; http_header; threshold: type limit, track by_src, count 1, seconds 3600; reference:url,doc.emergingthreats.net/bin/view/Main/2002364; classtype:misc-activity; sid:2002364; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB llsrconnect unicode little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,104,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:2103121; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Weatherbug Design60 Upload Activity"; flow:established,to_server; content:"/GetDesign60.aspx?Magic="; nocase; http_uri; content:"?ZipCode="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003421; classtype:trojan-activity; sid:2003421; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB llsrpc andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:2103102; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Weatherbug Vista Gadget Activity"; flow:established,to_server; content:"/Command/VistaGadget_v"; nocase; http_uri; content:"UserId="; nocase; http_uri; content:"&AppVersion="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003534; classtype:trojan-activity; sid:2003534; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB llsrpc andx create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A2|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|5C|llsrpc|00|"; within:8; distance:51; nocase; classtype:protocol-command-decode; sid:2103092; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Yesadvertising Banking Spyware RETRIEVE"; flow: to_server,established; content:"/img1big.gif"; nocase; http_uri; reference:url,isc.sans.org/presentations/banking_malware.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2000336; classtype:trojan-activity; sid:2000336; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB llsrpc little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:2103103; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Yesadvertising Banking Spyware INFORMATION SUBMIT"; flow: to_server,established; content:"/cgi-bin/yes.pl"; nocase; http_uri; reference:url,isc.sans.org/presentations/banking_malware.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2000337; classtype:trojan-activity; sid:2000337; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB llsrpc unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:2103104; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Emo/Downloader.vr Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:".php"; http_uri; content:"v="; http_uri; content:"&rs="; http_uri; content:"&n="; http_uri; content:"&uid="; http_uri; reference:url,doc.emergingthreats.net/2008546; reference:url,www.malwaredomainlist.com/mdl.php?search=emo+&colsearch=All&quantity=50; classtype:trojan-activity; sid:2008546; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB llsrpc unicode andx create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A2|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|5C 00|l|00|l|00|s|00|r|00|p|00|c|00 00 00|"; within:16; distance:51; nocase; classtype:protocol-command-decode; sid:2103093; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Feral Checkin via HTTP"; flow:established,to_server; content:"?ucid="; nocase; http_uri; content:"&wmid="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007286; classtype:trojan-activity; sid:2007286; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB llsrpc unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:2103105; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Inject.BV Trojan User Agent Detected (faserx)"; flow:established,to_server; content:"User-Agent|3a| faser"; http_header; nocase; reference:url,doc.emergingthreats.net/2003637; classtype:trojan-activity; sid:2003637; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB msqueue andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:2103164; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED MBR Trojan (Sinowal/Mebroot/) Phoning Home"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/ld/mat"; nocase; http_uri; content:".php"; nocase; http_uri; content:"id="; http_client_body; depth:3; content:"&hit="; http_client_body; reference:url,doc.emergingthreats.net/2007747; classtype:trojan-activity; sid:2007747; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB msqueue little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:2103165; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET DELETED Unknown Web Backdoor Keep-Alive"; flow:established,to_server; urilen:13; content:"POST"; http_method; nocase; content:"/bbs/info.asp"; http_uri; classtype:trojan-activity; sid:2012250; rev:3; metadata:created_at 2011_02_02, updated_at 2011_02_02;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB msqueue unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:2103166; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Trojan/Win32.CodecPack Reporting"; flow:to_server,established; content:"GET"; nocase; http_method; content:"ADTECH|3b|"; http_uri; content:"loc=100|3b|"; http_uri; content:"target=_blank|3b|"; http_uri; content:"grp|3d 5b|group|5d 3b|"; http_uri; content:"misc="; classtype:trojan-activity; sid:2012285; rev:4; metadata:created_at 2011_02_04, updated_at 2011_02_04;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB msqueue unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:2103167; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Trojan-Clicker.Win32.Agent.qqf Checkin"; flow:to_server,established; content:"GET"; nocase; http_method; content:"|2f|sogou"; http_uri; pcre:"/\x2fsogou(config)?\x2f/Ui"; reference:md5,f468778836fd27a2ccca88c99f6dd3e9; classtype:trojan-activity; sid:2012643; rev:2; metadata:created_at 2011_04_06, updated_at 2011_04_06;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB winreg andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:2103206; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET 897 (msg:"ET DELETED Backdoor PcClient.CAK.Pakes POST on non-http Port"; flow:established,to_server; content:"POST"; nocase; http_method; content:".jsp"; nocase; depth:35; pcre:"/\/\d{8,}\/\d{4,}\/\d{4,}\.jsp/"; reference:url,doc.emergingthreats.net/2009093; classtype:trojan-activity; sid:2009093; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB winreg little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:2103207; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/Bifrose.Backdoor Checkin Attempt via Facebook"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/omaha/update.php?"; http_uri; content:"User-Agent|3A 20|Facebook Update/"; http_header; content:"winhttp|3b|"; http_header; reference:md5,61661202e320dd91e4f7e4a10616eefc; classtype:trojan-activity; sid:2014404; rev:3; metadata:created_at 2012_03_20, updated_at 2012_03_20;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB winreg unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:2103208; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED CPL Trojan Downloader Request"; flow:established,to_server; content:".cpl?|20|HTTP/1.1"; nocase; content:!"Referer|3a 20|"; http_header; classtype:trojan-activity; sid:2012910; rev:6; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_06_01, deployment Perimeter, signature_severity Major, tag Trojan_Downloader, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB winreg unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:2103209; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/UFR POST to CnC"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/ufr/ufr.php"; http_uri; content:"UFR"; http_client_body; classtype:command-and-control; sid:2013424; rev:3; metadata:created_at 2011_08_18, updated_at 2011_08_18;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS CoGetInstanceFromFile andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 01|"; within:2; distance:19; byte_test:4,>,128,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:2103188; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http any any -> $HOME_NET any (msg:"ET DELETED Windows executable sent when remote host claims to send image, Win32"; flow: established,from_server; content:"Content-Type|3a| image"; content:"|0d 0a 0d 0a|MZ"; byte_jump:4,58,relative,little; content:"PE|00 00|"; within:4; reference:url,doc.emergingthreats.net/bin/view/Main/2001684; classtype:trojan-activity; sid:2001684; rev:14; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS CoGetInstanceFromFile little endian andx attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|04 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6,little; classtype:protocol-command-decode; sid:2103438; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible Windows executable sent when remote host claims to send Javascript"; flow:established,from_server; content:"Content-Type|3a| application/"; content:"javascript|0d 0a|"; within:14; content:"MZ"; distance:0; byte_jump:4,58,relative,little; content:"PE|00 00|"; within:4; reference:url,doc.emergingthreats.net/bin/view/Main/2008367; classtype:trojan-activity; sid:2008367; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS CoGetInstanceFromFile little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|01 00|"; within:2; distance:19; byte_test:4,>,128,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:2103189; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"ET DELETED Microsoft Remote Desktop Protocol (RDP) maxChannelIds DoS Attempt 4 byte"; flow:to_server,established; content:"|03 00|"; depth:2; content:"|e0|"; distance:3; within:1; content:"|03 00|"; distance:0; content:"|f0|"; distance:3; within:1; content:"|7f 65|"; distance:1; within:2; content:"|04 01 01 04 01 01 01 01 ff 30|"; distance:3; within:10; content:"|02 04|"; distance:1; within:2; byte_test:4,<,0x06,0,relative,big; reference:url,www.msdn.microsoft.com/en-us/library/cc240836.aspx; reference:cve,2012-0002; reference:url,technet.microsoft.com/en-us/security/bulletin/ms12-020; reference:url,stratsec.blogspot.com.au/2012/03/ms12-020-vulnerability-for-breakfast.html; reference:url,aluigi.org/adv/termdd_1-adv.txt; reference:url,blog.binaryninjas.org/?p=58; reference:url,luca.ntop.org/Teaching/Appunti/asn1.html; classtype:attempted-dos; sid:2014434; rev:10; metadata:created_at 2012_03_24, updated_at 2012_03_24;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode andx attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 04|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8; classtype:protocol-command-decode; sid:2103439; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"ET DELETED Microsoft Remote Desktop Protocol (RDP) maxChannelIds DoS Attempt 3 byte"; flow:to_server,established; content:"|03 00|"; depth:2; content:"|e0|"; distance:3; within:1; content:"|03 00|"; distance:0; content:"|f0|"; distance:3; within:1; content:"|7f 65|"; distance:1; within:2; content:"|04 01 01 04 01 01 01 01 ff 30|"; distance:3; within:10; content:"|02 03|"; distance:1; within:2; byte_test:3,<,0x06,0,relative,big; reference:url,www.msdn.microsoft.com/en-us/library/cc240836.aspx; reference:cve,2012-0002; reference:url,technet.microsoft.com/en-us/security/bulletin/ms12-020; reference:url,stratsec.blogspot.com.au/2012/03/ms12-020-vulnerability-for-breakfast.html; reference:url,aluigi.org/adv/termdd_1-adv.txt; reference:url,blog.binaryninjas.org/?p=58; reference:url,luca.ntop.org/Teaching/Appunti/asn1.html; classtype:attempted-dos; sid:2014433; rev:10; metadata:created_at 2012_03_24, updated_at 2012_03_24;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 01|"; within:2; distance:19; byte_test:4,>,256,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:2103190; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/Backdoor.Kbot Config Retrieval"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/getcfg.php"; http_uri; content:"oop="; http_client_body; depth:4; reference:md5,b8ee86e57261fd3fb422a2b20a3c3e09; classtype:trojan-activity; sid:2014291; rev:4; metadata:created_at 2012_02_29, updated_at 2012_02_29;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode little endian andx attempt"; flow:established,to_server; flowbits:isset,dce.isystemactivator.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|04 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8,little; classtype:protocol-command-decode; sid:2103440; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED iframebiz - adv***.php"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/adv"; nocase; http_uri; pcre:"/adv\d+\.php/Ui"; reference:url,iframecash.biz; reference:url,isc.sans.org/diary.php?storyid=868; reference:url,doc.emergingthreats.net/bin/view/Main/2002707; classtype:trojan-activity; sid:2002707; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS CoGetInstanceFromFile unicode little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.msqueue; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|01 00|"; within:2; distance:19; byte_test:4,>,256,20,relative; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:attempted-admin; sid:2103191; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 3128:9000 (msg:"ET DELETED Possible Hupigon Connect"; flow:established,from_server; flowbits:set,ET.Hupinit2; dsize:<28; content:"HTTP/1.0 200 "; depth:13; flowbits:noalert; reference:url,doc.emergingthreats.net/2009290; classtype:trojan-activity; sid:2009290; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS IActivation andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103389; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET 3128:9000 -> $HOME_NET any (msg:"ET DELETED Hupigon CnC Client Status"; flow:established,to_server; flowbits:isset,ET.Hupinit2; dsize:<6; content:"|0d 0a|"; reference:url,doc.emergingthreats.net/2009291; classtype:command-and-control; sid:2009291; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS IActivation little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103390; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 3128:9000 (msg:"ET DELETED Hupigon CnC Server Response"; flow:established,from_server; flowbits:isset,ET.Hupinit2; dsize:3; content:"|0d 0a|"; reference:url,doc.emergingthreats.net/2009292; classtype:command-and-control; sid:2009292; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS IActivation unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103391; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED MSUpdater post-auth checkin"; flow:established,to_server; content:"/search6"; http_uri; fast_pattern; content:"?h1="; http_uri; content:"User-Agent|3a 20|Mozilla/5.0 (compatible|3b 20|Windows NT 5.2)"; http_header; reference:url,research.zscaler.com/2012/01/msupdater-trojan-and-link-to-targeted.html; reference:url,blog.seculert.com/2012/01/msupdater-trojan-and-conference-invite.html; classtype:trojan-activity; sid:2014214; rev:2; metadata:created_at 2012_02_07, updated_at 2012_02_07;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS IActivation unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B8|J|9F|M|1C|}|CF 11 86 1E 00| |AF|n|7C|W"; within:16; distance:29; flowbits:set,dce.iactivation.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103392; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ET DELETED osCommerce vulnerable web application extras update.php exists"; flow:to_client,established; content:"Select an SQL file to install"; reference:url,retrogod.altervista.org/oscommerce_22_adv.html; reference:url,doc.emergingthreats.net/2002863; classtype:attempted-recon; sid:2002863; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS ISystemActivator andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103405; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET DELETED Known Fraudulent DigiNotar SSL Certificate for google.com 2"; flow:established,from_server; content:"|0c 76 da 9c 91 0c 4e 2c 9e fe 15 d0 58 93 3c 4c|"; content:"google.com"; within:250; reference:url,www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx; classtype:misc-activity; sid:2013501; rev:2; metadata:attack_target Client_Endpoint, created_at 2011_08_30, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS ISystemActivator little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103406; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Krunchy/BZub HTTP Checkin/Update"; flow:established,to_server; content:".php?action="; http_uri; content:"&guid="; http_uri; content:"GET"; nocase; http_method; content:!"User-Agent|3a| "; http_header; reference:url,doc.emergingthreats.net/2007775; classtype:trojan-activity; sid:2007775; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS ISystemActivator unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103407; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Password Stealer Reporting - ?a=%NN&b="; flow:to_server,established; content:"POST"; nocase; http_method; content:"a=%"; http_raw_uri; content:"&b="; http_uri; pcre:"/a=\%[0-9a-fA-F]{2}\&b/Ii"; reference:url,doc.emergingthreats.net/2009082; classtype:trojan-activity; sid:2009082; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS ISystemActivator unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|A0 01 00 00 00 00 00 00 C0 00 00 00 00 00 00|F"; within:16; distance:29; flowbits:set,dce.isystemactivator.bind; flowbits:noalert; classtype:protocol-command-decode; sid:2103408; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32 Jadtre/Wapomi/Nimnul/Viking.AY ICMP ping"; icode:0; itype:8; dsize:36; content:"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"; classtype:trojan-activity; sid:2014595; rev:4; metadata:created_at 2012_04_16, updated_at 2012_04_16;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS IrotIsRunning andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 02|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:2103268; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Customer List"; flow:to_server,established; pcre:"/\Wcustomer\slist(s)?\W/ism"; reference:url,doc.emergingthreats.net/2002655; classtype:policy-violation; sid:2002655; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS IrotIsRunning little endian andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|02 00|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:2103269; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Transaction History"; flow:to_server,established; pcre:"/\Wtransaction\shistor(y|ies)\W/ism"; reference:url,doc.emergingthreats.net/2002654; classtype:policy-violation; sid:2002654; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS IrotIsRunning unicode andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 02|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:2103270; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Credit History"; flow:to_server,established; pcre:"/\Wcredit\shistor(y|ies)\W/ism"; reference:url,doc.emergingthreats.net/2002653; classtype:policy-violation; sid:2002653; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS IrotIsRunning unicode little endian andx attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.irot; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|02 00|"; within:2; distance:19; byte_jump:4,8,relative,little,align; byte_test:4,>,1024,0,little; reference:bugtraq,6005; reference:cve,2002-1561; reference:url,www.microsoft.com/technet/security/bulletin/MS03-010.mspx; classtype:protocol-command-decode; sid:2103271; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Annual Income"; flow:to_server,established; pcre:"/\Wannual\sincome(s)?\W/ism"; reference:url,doc.emergingthreats.net/2002652; classtype:policy-violation; sid:2002652; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE andx oversized Security Descriptor attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-15,little,relative,from_beginning; byte_test:4,>,1024,40,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103023; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Payment History"; flow:to_server,established; pcre:"/\Wpayment\shistory\W/ism"; reference:url,doc.emergingthreats.net/2002651; classtype:policy-violation; sid:2002651; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS NT Trans NT CREATE unicode andx oversized Security Descriptor attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A0|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:37; byte_jump:4,-15,little,relative,from_beginning; byte_test:4,>,1024,40,relative,little; reference:cve,2004-1154; classtype:protocol-command-decode; sid:2103025; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Account Balance"; flow:to_server,established; pcre:"/\Waccount\sbalance(s)?\W/ism"; reference:url,doc.emergingthreats.net/2002650; classtype:policy-violation; sid:2002650; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS OpenKey andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0F|"; within:2; distance:19; byte_test:2,>,1024,20,relative; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:2103230; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Appraisal"; flow:to_server,established; pcre:"/\Wappraisal(s)?\W/ism"; reference:url,doc.emergingthreats.net/2002649; classtype:policy-violation; sid:2002649; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS OpenKey little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0F 00|"; within:2; distance:19; byte_test:2,>,1024,20,relative,little; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:2103231; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Password"; flow:to_server,established; pcre:"/\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W/ism"; reference:url,doc.emergingthreats.net/2002648; classtype:policy-violation; sid:2002648; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS OpenKey unicode andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 0F|"; within:2; distance:19; byte_test:2,>,2048,20,relative; reference:bugtraq,1331; reference:cve,2000-0377; classtype:attempted-admin; sid:2103232; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Credit Card, JCB"; flow:to_server,established; pcre:"/\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*(?=(3[12359][0-9]{14})|(1800|2131)[0-9]{11})/ism"; reference:url,doc.emergingthreats.net/2002642; classtype:policy-violation; sid:2002642; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS OpenKey unicode little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.winreg; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|0F 00|"; within:2; distance:19; byte_test:2,>,2048,20,relative,little; reference:bugtraq,1331; reference:cve,2000-0377; reference:url,www.microsoft.com/technet/security/bulletin/MS00-040.mspx; classtype:attempted-admin; sid:2103233; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - AMA CPT Code"; flow:to_server,established; pcre:"/\Wcpt\W[\s\w,/-]*(?=[0-9]{4}[ft]|[0-9]{5})/ism"; reference:url,doc.emergingthreats.net/2002640; classtype:policy-violation; sid:2002640; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS RemoteActivation andx attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6; classtype:protocol-command-decode; sid:2103421; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - DSM-IV Code"; flow:to_server,established; pcre:"/\Wdsm\W[\s\w,/-]*(?=([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))/ism"; reference:url,doc.emergingthreats.net/2002639; classtype:policy-violation; sid:2002639; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS RemoteActivation little endian andx attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 5C|"; byte_test:4,>,256,6,little; classtype:protocol-command-decode; sid:2103422; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - ADA Procedure Code"; flow:to_server,established; pcre:"/\Wada\W[\s\w,/-]*(?=d[0-9]{4})/ism"; reference:url,doc.emergingthreats.net/2002638; classtype:policy-violation; sid:2002638; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS RemoteActivation unicode andx attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8; classtype:protocol-command-decode; sid:2103423; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - FDA NDC Code"; flow:to_server,established; pcre:"/\Wndc\W[\s\w,/-]*(?=([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))/ism"; reference:url,doc.emergingthreats.net/2002637; classtype:policy-violation; sid:2002637; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS RemoteActivation unicode little endian andx attempt"; flow:established,to_server; flowbits:isset,dce.iactivation.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; content:"|5C 00 5C 00|"; byte_test:4,>,256,8,little; classtype:protocol-command-decode; sid:2103424; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - ICD-10 Code"; flow:to_server,established; pcre:"/\Wicd\W[\s\w,/-]*(?=[a-z][0-9]{2}\.[0-9]{2})/ism"; reference:url,doc.emergingthreats.net/2002636; classtype:policy-violation; sid:2002636; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS Session Setup NTMLSSP andx asn1 overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"s"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_test:4,&,2147483648,21,relative,little; content:!"NTLMSSP"; within:7; distance:27; asn1:double_overflow, bitstring_overflow, relative_offset 27, oversize_length 2048; reference:bugtraq,9633; reference:bugtraq,9635; reference:cve,2003-0818; reference:nessus,12052; reference:nessus,12065; reference:url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx; classtype:protocol-command-decode; sid:2103004; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - HCPCS Code"; flow:to_server,established; pcre:"/\Whcpcs\W[\s\w,/-]*(?=[a-z][0-9]{10})/ism"; reference:url,doc.emergingthreats.net/2002635; classtype:policy-violation; sid:2002635; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS Session Setup NTMLSSP unicode andx asn1 overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"s"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_test:4,&,2147483648,21,relative,little; content:!"NTLMSSP"; within:7; distance:27; asn1:double_overflow, bitstring_overflow, relative_offset 27, oversize_length 2048; reference:bugtraq,9633; reference:bugtraq,9635; reference:cve,2003-0818; reference:nessus,12052; reference:nessus,12065; reference:url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx; classtype:protocol-command-decode; sid:2103005; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Date of Birth"; flow:to_server,established; pcre:"/[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(?=([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})/ism"; reference:url,doc.emergingthreats.net/2002634; classtype:policy-violation; sid:2002634; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS Trans2 FIND_FIRST2 andx attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; content:"2"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|01 00|"; within:2; distance:29; flowbits:set,smb.trans2; flowbits:noalert; classtype:protocol-command-decode; sid:2103142; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Internal Use Only"; flow:to_server,established; pcre:"/\Winternal\suse\sonly\W/ism"; reference:url,doc.emergingthreats.net/2002633; classtype:policy-violation; sid:2002633; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS irot andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:2103252; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Law Enorcement Sensitive"; flow:to_server,established; pcre:"/\Wlaw\senforcement\ssensitive\W/ism"; reference:url,doc.emergingthreats.net/2002632; classtype:policy-violation; sid:2002632; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS irot little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:2103253; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Protected"; flow:to_server,established; pcre:"/\Wprotected\W(?!/(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/2002631; classtype:policy-violation; sid:2002631; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS irot unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:2103254; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Proprietary"; flow:to_server,established; pcre:"/\Wproprietary\W(?!/(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/2002630; classtype:policy-violation; sid:2002630; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS irot unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"`|9E E7 B9|R=|CE 11 AA A1 00 00|i|01 29|?"; within:16; distance:29; flowbits:set,smb.tree.bind.irot; flowbits:noalert; classtype:protocol-command-decode; sid:2103255; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Sensitive"; flow:to_server,established; pcre:"/(? $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS llsrconnect andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,52,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:2103126; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Sealed"; flow:to_server,established; pcre:"/\Wsealed\W(?!/(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/2002628; classtype:policy-violation; sid:2002628; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS llsrconnect little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,52,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:2103127; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Top Secret"; flow:to_server,established; pcre:"/(? $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS llsrconnect unicode andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,104,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:2103128; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Confidential"; flow:to_server,established; pcre:"/(? $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS llsrconnect unicode little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,smb.tree.bind.llsrpc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 00|"; within:2; distance:19; byte_test:4,>,104,0,relative; reference:url,www.microsoft.com/technet/security/bulletin/ms05-010.mspx; classtype:attempted-admin; sid:2103129; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Restricted"; flow:to_server,established; pcre:"/(? $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS llsrpc andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:2103110; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Private"; flow:to_server,established; pcre:"/\Wprivate\W(?!/(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/2002623; classtype:policy-violation; sid:2002623; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS llsrpc andx create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"|A2|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|5C|llsrpc|00|"; within:8; distance:51; nocase; classtype:protocol-command-decode; sid:2103096; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Non-US Restricted Outbound"; flow:to_server,established; content:"Subject|3A|"; pcre:"///([A-Z]{3}\s)+RESTRICTED//X5/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002410; classtype:policy-violation; sid:2002410; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS llsrpc little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:2103111; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Non-US Confidential Outbound"; flow:to_server,established; content:"Subject|3A|"; pcre:"///([A-Z]{3}\s)+CONFIDENTIAL//X5/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002411; classtype:policy-violation; sid:2002411; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS llsrpc unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:2103112; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Non-US Top Secret Outbound"; flow:to_server,established; content:"Subject|3A|"; pcre:"///([A-Z]{3}\s)+TOP\sSECRET//X5/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002412; classtype:policy-violation; sid:2002412; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS llsrpc unicode andx create tree attempt"; flow:established,to_server; flowbits:isset,smb.tree.connect.ipc; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"|A2|"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|5C 00|l|00|l|00|s|00|r|00|p|00|c|00 00 00|"; within:16; distance:51; nocase; classtype:protocol-command-decode; sid:2103097; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Non-US Secret"; flow:to_server,established; content:"Subject|3A|"; pcre:"///([A-Z]{3}\s)+(? $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS llsrpc unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"@|FD|,4l<|CE 11 A8 93 08 00|+.|9C|m"; within:16; distance:29; flowbits:set,smb.tree.bind.llsrpc; classtype:protocol-command-decode; sid:2103113; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP NATO Restricted"; flow:to_server,established; content:"Subject|3A|"; pcre:"///((NATO\sRESTRICTED)|NR)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002414; classtype:policy-violation; sid:2002414; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS msqueue andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:2103172; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP NATO Confidential Atomal"; flow:to_server,established; content:"Subject|3A|"; pcre:"///((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002415; classtype:policy-violation; sid:2002415; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS msqueue little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:2103173; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP NATO Confidential"; flow:to_server,established; content:"Subject|3A|"; pcre:"///((NATO\sCONFIDENTIAL)|NC)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002416; classtype:policy-violation; sid:2002416; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS msqueue unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:2103174; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP NATO COSMIC Top Secret Atomal"; flow:to_server,established; content:"Subject|3A|"; pcre:"///((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002417; classtype:policy-violation; sid:2002417; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS msqueue unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; content:"|05|"; distance:4; within:1; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|B0 01|R|97 CA|Y|D0 11 A8 D5 00 A0 C9 0D 80|Q"; within:16; distance:29; flowbits:set,smb.tree.bind.msqueue; flowbits:noalert; reference:cve,2003-0995; reference:url,www.eeye.com/html/Research/Advisories/AD20030910.html; reference:url,www.microsoft.com/technet/security/bulletin/MS03-026.mspx; classtype:protocol-command-decode; sid:2103175; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP NATO Secret Atomal"; flow:to_server,established; content:"Subject|3A|"; pcre:"///((NATO\sSECRET\sATOMAL)|NSA)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002418; classtype:policy-violation; sid:2002418; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS winreg andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:2103214; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP NATO Secret"; flow:to_server,established; content:"Subject|3A|"; pcre:"///((NATO\sSECRET)|NS)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002419; classtype:policy-violation; sid:2002419; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS winreg little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:2103215; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Confidential, Electronic"; flow:to_server,established; content:"Subject|3A|"; pcre:"/QQQQ\r\n(?=(O|P|R|Z)\r\n(CC)\r\n)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002420; classtype:policy-violation; sid:2002420; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS winreg unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:2103216; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Top Secret, Electronic"; flow:to_server,established; content:"Subject|3A|"; pcre:"/QQQQ\r\n(?=(O|P|R|Z)\r\n(TT)\r\n)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002421; classtype:policy-violation; sid:2002421; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"GPL NETBIOS SMB-DS winreg unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; isdataat:4,relative; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"|01 D0 8C|3D|22 F1|1|AA AA 90 00|8|00 10 03|"; within:16; distance:29; flowbits:set,smb.tree.bind.winreg; flowbits:noalert; classtype:protocol-command-decode; sid:2103217; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Secret, Electronic"; flow:to_server,established; content:"Subject|3A|"; pcre:"/QQQQ\r\n(?=(O|P|R|Z)\r\n(SS)\r\n)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002422; classtype:policy-violation; sid:2002422; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 137 (msg:"GPL NETBIOS name query overflow attempt UDP"; byte_test:1,&,64,2; content:" "; offset:12; isdataat:56,relative; reference:bugtraq,9624; reference:cve,2003-0825; classtype:attempted-admin; sid:2103196; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Confidential REL TO"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002423; classtype:policy-violation; sid:2002423; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 42 (msg:"GPL NETBIOS WINS name query overflow attempt UDP"; byte_test:1,&,64,2; content:" "; offset:12; isdataat:56,relative; reference:bugtraq,9624; reference:cve,2003-0825; reference:url,www.microsoft.com/technet/security/bulletin/MS04-006.mspx; classtype:attempted-admin; sid:2103200; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Top Secret REL TO"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002424; classtype:policy-violation; sid:2002424; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $SQL_SERVERS 1433 -> $EXTERNAL_NET any (msg:"GPL SQL sa brute force failed login attempt"; flow:from_server,established; content:"Login failed for user 'sa'"; threshold:type threshold, track by_src, count 5, seconds 2; reference:bugtraq,4797; reference:cve,2000-1209; reference:nessus,10673; classtype:unsuccessful-user; sid:2103152; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Unclassified COMSEC"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002429; classtype:policy-violation; sid:2002429; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"GPL SCAN Finger . query"; flow:to_server,established; content:"."; reference:arachnids,130; reference:cve,1999-0198; reference:nessus,10072; classtype:attempted-recon; sid:2100333; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Confidential COMSEC"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002430; classtype:policy-violation; sid:2002430; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"GPL SCAN Finger / execution attempt"; flow:to_server,established; content:"/"; pcre:"/^\x2f/smi"; reference:cve,1999-0612; reference:cve,2000-0915; classtype:attempted-recon; sid:2103151; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Top Secret COMSEC"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002431; classtype:policy-violation; sid:2002431; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"GPL SCAN Finger 0 Query"; flow:to_server,established; content:"0"; reference:arachnids,131; reference:arachnids,378; reference:cve,1999-0197; reference:nessus,10069; classtype:attempted-recon; sid:2100332; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Top Secret CNWDI"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(?=//MR)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002434; classtype:policy-violation; sid:2002434; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"GPL SCAN Finger Account Enumeration Attempt"; flow:to_server,established; content:"a b c d e f"; nocase; reference:nessus,10788; classtype:attempted-recon; sid:2100321; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Top Secret TK"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002436; classtype:policy-violation; sid:2002436; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"GPL MISC Finger bomb attempt"; flow:to_server,established; content:"@@"; reference:arachnids,381; reference:cve,1999-0106; classtype:attempted-dos; sid:2100328; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US FGI"; flow:to_server,established; content:"Subject|3A|"; pcre:"///FGI[\s\w,/-]*(?=//X5)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002438; classtype:policy-violation; sid:2002438; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"GPL DELETED cmd_rootsh backdoor attempt"; flow:to_server,established; content:"cmd_rootsh"; reference:nessus,10070; reference:url,www.sans.org/y2k/TFN_toolkit.htm; reference:url,www.sans.org/y2k/fingerd.htm; classtype:attempted-admin; sid:2100320; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US FOUO"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002439; classtype:policy-violation; sid:2002439; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"GPL SCAN cybercop query"; flow:to_server,established; content:"|0A| "; depth:10; reference:arachnids,132; reference:cve,1999-0612; classtype:attempted-recon; sid:2100331; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Confidential NOFORN"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002440; classtype:policy-violation; sid:2002440; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"GPL SCAN cybercop redirection"; dsize:11; flow:to_server,established; content:"@localhost|0A|"; reference:arachnids,11; classtype:attempted-recon; sid:2100329; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Top Secret NOFORN"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002441; classtype:policy-violation; sid:2002441; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"GPL SCAN Finger Null Request"; flow:to_server,established; content:"|00|"; reference:arachnids,377; classtype:attempted-recon; sid:2100324; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Confidential ORCON"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002443; classtype:policy-violation; sid:2002443; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"GPL SCAN Finger Probe 0 Attempt"; flow:to_server,established; content:"0"; reference:arachnids,378; classtype:attempted-recon; sid:2100325; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Top Secret ORCON"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002444; classtype:policy-violation; sid:2002444; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"GPL SCAN Finger Redirection Attempt"; flow:to_server,established; content:"@"; reference:arachnids,251; reference:cve,1999-0105; reference:nessus,10073; classtype:attempted-recon; sid:2100330; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Unclassified PROPIN"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002446; classtype:policy-violation; sid:2002446; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"GPL MISC Finger remote command execution attempt"; flow:to_server,established; content:"|3B|"; reference:arachnids,379; reference:bugtraq,974; reference:cve,1999-0150; classtype:attempted-user; sid:2100326; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Confidential PROPIN"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002447; classtype:policy-violation; sid:2002447; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"GPL MISC Finger remote command pipe execution attempt"; flow:to_server,established; content:"|7C|"; reference:arachnids,380; reference:bugtraq,2220; reference:cve,1999-0152; classtype:attempted-user; sid:2100327; rev:10; metadata:created_at 2010_09_23, former_category MISC, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Top Secret PROPIN"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002448; classtype:policy-violation; sid:2002448; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"GPL SCAN Finger Root Query"; flow:to_server,established; content:"root"; reference:arachnids,376; classtype:attempted-recon; sid:2100323; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Confidential RD"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(?=//MR)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002450; classtype:policy-violation; sid:2002450; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"GPL SCAN Finger Search Query"; flow:to_server,established; content:"search"; reference:arachnids,375; reference:cve,1999-0259; classtype:attempted-recon; sid:2100322; rev:12; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Top Secret RD"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(?=//MR)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002451; classtype:policy-violation; sid:2002451; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL SCAN adm scan"; flow:to_server,established; content:"PASS ddd@|0A|"; reference:arachnids,332; classtype:suspicious-login; sid:2100353; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US SAMI"; flow:to_server,established; content:"Subject|3A|"; pcre:"/SAMI[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002453; classtype:policy-violation; sid:2002453; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 617 (msg:"GPL EXPLOIT Arkeia client backup system info probe"; flow:established,to_server; content:"ARKADMIN_GET_"; nocase; pcre:"/^(CLIENT|MACHINE)_INFO/Ri"; reference:bugtraq,12594; classtype:attempted-recon; sid:2103453; rev:2; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Confidential SPECAT"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002454; classtype:policy-violation; sid:2002454; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"GPL DELETED EXPLOIT named tsig overflow attempt"; content:"|80 00 07 00 00 00 00 00 01|?|00 01 02|"; reference:bugtraq,2303; reference:cve,2001-0010; classtype:attempted-admin; sid:2100314; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Top Secret SPECAT"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002455; classtype:policy-violation; sid:2002455; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"GPL DELETED EXPLOIT named tsig overflow attempt"; flow:to_server,established; content:"|AB CD 09 80 00 00 00 01 00 00 00 00 00 00 01 00 01| |02|a"; reference:arachnids,482; reference:bugtraq,2302; reference:cve,2001-0010; classtype:attempted-admin; sid:2100303; rev:12; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP US Top Secret STOP"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002457; classtype:policy-violation; sid:2002457; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"GPL DNS UDP inverse query overflow"; byte_test:1,<,16,2; byte_test:1,&,8,2; isdataat:400; reference:bugtraq,134; reference:cve,1999-0009; classtype:attempted-admin; sid:2103154; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Private"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Wprivate\W(?!/(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002458; classtype:policy-violation; sid:2002458; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"GPL NETBIOS Messenger message overflow attempt"; content:"|04 00|"; depth:2; byte_test:1,!&,16,2,relative; content:"|F8 91|{Z|00 FF D0 11 A9 B2 00 C0|O|B6 E6 FC|"; within:16; distance:22; content:"|00 00|"; within:2; distance:28; byte_jump:4,18,align,relative; byte_jump:4,8,align,relative; byte_test:4,>,1024,8,relative; reference:bugtraq,8826; reference:cve,2003-0717; classtype:attempted-admin; sid:2103235; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Restricted"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET 135 (msg:"GPL NETBIOS Messenger message little endian overflow attempt"; content:"|04 00|"; depth:2; byte_test:1,&,16,2,relative; content:"|F8 91|{Z|00 FF D0 11 A9 B2 00 C0|O|B6 E6 FC|"; within:16; distance:22; content:"|00 00|"; within:2; distance:28; byte_jump:4,18,little,align,relative; byte_jump:4,8,little,align,relative; byte_test:4,>,1024,8,little,relative; reference:bugtraq,8826; reference:cve,2003-0717; classtype:attempted-admin; sid:2103234; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Top Secret"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"GPL FTP MKD overflow"; flow:to_server,established; content:"MKD "; isdataat:100,relative; reference:bugtraq,113; reference:bugtraq,2242; reference:cve,1999-0368; classtype:attempted-admin; sid:2100349; rev:13; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Sealed"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Wsealed\W(?!/(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002463; classtype:policy-violation; sid:2002463; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP OpenBSD x86 ftpd"; flow:to_server,established; content:" |90|1|C0 99|RR|B0 17 CD 80|h|CC|sh"; fast_pattern:only; reference:arachnids,446; reference:bugtraq,2124; reference:cve,2001-0053; classtype:attempted-user; sid:2100339; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Sensitive"; flow:to_server,established; content:"Subject|3A|"; pcre:"/(? $HOME_NET any (msg:"GPL FTP SITE EXEC format string"; flow:to_server,established; content:"SITE EXEC %020d|7C|%.f%.f|7C 0A|"; depth:32; nocase; reference:arachnids,453; reference:bugtraq,1387; reference:cve,2000-0573; classtype:attempted-user; sid:2100338; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Proprietary"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Wproprietary\W(?!/(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002465; classtype:policy-violation; sid:2002465; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP PWD overflow"; flow:to_server,established; content:"PWD|0A|/i"; fast_pattern:only; classtype:attempted-admin; sid:2100340; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Protected"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Wprotected\W(?!/(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002466; classtype:policy-violation; sid:2002466; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP XXXXX overflow"; flow:to_server,established; content:"XXXXX/"; fast_pattern:only; classtype:attempted-admin; sid:2100341; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Law Enorcement Sensitive"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Wlaw\senforcement\ssensitive\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002467; classtype:policy-violation; sid:2002467; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP wu-ftpd 2.6.0 site exec format string check"; flow:to_server,established; content:"f%.f%.f%.f%.f%."; depth:32; reference:arachnids,286; reference:bugtraq,1387; reference:cve,2000-0573; classtype:attempted-recon; sid:2100346; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Internal Use Only"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Winternal\suse\sonly\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002468; classtype:policy-violation; sid:2002468; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP wu-ftpd 2.6.0 site exec format string overflow FreeBSD"; flow:to_server,established; content:"1|C0|PPP|B0|~|CD 80|1|DB|1|C0|"; depth:32; reference:arachnids,228; reference:bugtraq,1387; reference:cve,2000-0573; classtype:attempted-admin; sid:2100343; rev:12; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Date of Birth"; flow:to_server,established; content:"Subject|3A|"; pcre:"/[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(?=([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002469; classtype:policy-violation; sid:2002469; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP wu-ftpd 2.6.0 site exec format string overflow Linux"; flow:to_server,established; content:"1|C0|1|DB|1|C9 B0|F|CD 80|1|C0|1|DB|"; fast_pattern:only; reference:arachnids,287; reference:bugtraq,1387; reference:cve,2000-0573; classtype:attempted-admin; sid:2100344; rev:12; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP HCPCS Code"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Whcpcs\W[\s\w,/-]*(?=[a-z][0-9]{10})/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002470; classtype:policy-violation; sid:2002470; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP wu-ftpd 2.6.0 site exec format string overflow Solaris 2.8"; flow:to_server,established; content:"|90 1B C0 0F 82 10| |17 91 D0| |08|"; fast_pattern:only; reference:arachnids,451; reference:bugtraq,1387; reference:cve,2000-0573; classtype:attempted-user; sid:2100342; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP ICD-10 Code"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Wicd\W[\s\w,/-]*(?=[a-z][0-9]{2}\.[0-9]{2})/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002471; classtype:policy-violation; sid:2002471; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP wu-ftpd 2.6.0 site exec format string overflow generic"; flow:to_server,established; content:"SITE "; nocase; content:" EXEC "; nocase; content:" %p"; nocase; fast_pattern; reference:arachnids,285; reference:bugtraq,1387; reference:cve,2000-0573; reference:nessus,10452; classtype:attempted-admin; sid:2100345; rev:13; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP FDA NDC Code"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Wndc\W[\s\w,/-]*(?=([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002472; classtype:policy-violation; sid:2002472; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP wu-ftpd 2.6.0"; flow:to_server,established; content:"..11venglin@"; reference:arachnids,440; reference:bugtraq,1387; classtype:attempted-user; sid:2100348; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP ADA Procedure Code"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Wada\W[\s\w,/-]*(?=d[0-9]{4})/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002473; classtype:policy-violation; sid:2002473; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP serv-u directory transversal"; flow:to_server,established; content:".%20."; nocase; fast_pattern:only; reference:bugtraq,2052; reference:cve,2001-0054; classtype:bad-unknown; sid:2100360; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP DSM-IV Code"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Wdsm\W[\s\w,/-]*(?=([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002474; classtype:policy-violation; sid:2002474; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP SITE EXEC attempt"; flow:to_server,established; content:"SITE"; nocase; content:"EXEC"; distance:0; nocase; pcre:"/^SITE\s+EXEC/smi"; reference:arachnids,317; reference:bugtraq,2241; reference:cve,1999-0080; reference:cve,1999-0955; classtype:bad-unknown; sid:2100361; rev:17; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP AMA CPT Code"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Wcpt\W[\s\w,/-]*(?=[0-9]{4}[ft]|[0-9]{5})/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002475; classtype:policy-violation; sid:2002475; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert udp $HOME_NET any -> 8.8.8.8 53 (msg:"ET MALWARE TDSS DNS Based Internet Connectivity Check"; dsize:34; content:"|33 33 01 00 00 01 00 00 00 00 00 00 07|counter|05|yadro|02|ru|00 00 01 00 01|"; classtype:trojan-activity; sid:2013977; rev:1; metadata:created_at 2011_12_02, updated_at 2011_12_02;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Credit Card, JCB"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*(?=(3[12359][0-9]{14})|(1800|2131)[0-9]{11})/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002477; classtype:policy-violation; sid:2002477; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Hiloti loader receiving payload URL"; flow:established,from_server; content:"|0d 0a 0d 0a|20|0d 0a|http|3a|//"; classtype:trojan-activity; sid:2012515; rev:5; metadata:created_at 2011_03_16, updated_at 2011_03_16;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Password"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002483; classtype:policy-violation; sid:2002483; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Lilupophilupop Injected Script Being Served to Client"; flow:established,to_client; content:"|3C|script src=|22|http|3A|//lilupophilupop.com/sl.php|22|>|3C 2F|script>"; nocase; classtype:bad-unknown; sid:2013978; rev:3; metadata:created_at 2011_12_02, former_category CURRENT_EVENTS, updated_at 2011_12_02;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Appraisal"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Wappraisal(s)?\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002484; classtype:policy-violation; sid:2002484; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Lilupophilupop Injected Script Being Served from Local Server"; flow:established,from_server; content:"|3C|script src=|22|http|3A|//lilupophilupop.com/sl.php|22|>|3C 2F|script>"; nocase; classtype:bad-unknown; sid:2013979; rev:3; metadata:created_at 2011_12_02, former_category CURRENT_EVENTS, updated_at 2011_12_02;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Account Balance"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Waccount\sbalance(s)?\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002485; classtype:policy-violation; sid:2002485; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Zeus POST Request to CnC"; flow:established,to_server; content:"POST"; http_method; content:" HTTP/1.1|0d 0a|Accept|3a| */*|0d 0a|User-Agent|3a| Mozilla"; fast_pattern; content:"|0d 0a|Content-Length|3a| "; distance:0; content:!"0"; within:1; content:"Connection|3a| Keep-Alive|0d 0a|"; distance:0; content:"|3a| no-cache"; distance:0; content:"|0d 0a 0d 0a|"; distance:0; content:!"Content-Type|3a| "; reference:url,www.secureworks.com/research/threats/zeus/?threat=zeus; reference:url,lists.emergingthreats.net/pipermail/emerging-sigs/2010-October/009807.html; classtype:command-and-control; sid:2011816; rev:16; metadata:created_at 2010_10_14, updated_at 2010_10_14;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Payment History"; flow:to_server,established; content:"Subject|3A|"; content:"payment history"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2002486; classtype:policy-violation; sid:2002486; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Cacti Input Validation Attack"; flow:established,to_server; content:"GET"; http_method; content:"top_graph_header.php"; http_uri; pcre:"/top_graph_header\.php\?.*=(http|https)\x3a\//Ui"; reference:url,www.cacti.net; reference:url,www.idefense.com/application/poi/display?id=265&type=vulnerabilities; reference:url,www.idefense.com/application/poi/display?id=266&type=vulnerabilities; reference:url,doc.emergingthreats.net/2002129; classtype:web-application-activity; sid:2002129; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Annual Income"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Wannual\sincome(s)?\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002487; classtype:policy-violation; sid:2002487; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Cacti Input Validation Attack 2"; flow:established,to_server; content:"GET"; http_method; content:"config_settings.php"; http_uri; pcre:"/config_settings\.php\?.*=(http|https)\x3a\//Ui"; reference:url,www.cacti.net; reference:url,www.idefense.com/application/poi/display?id=265&type=vulnerabilities; reference:url,www.idefense.com/application/poi/display?id=266&type=vulnerabilities; classtype:web-application-activity; sid:2013993; rev:2; metadata:created_at 2011_12_07, updated_at 2011_12_07;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Credit History"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Wcredit\shistor(y|ies)\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002488; classtype:policy-violation; sid:2002488; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Likely Generic Java Exploit Attempt Request for Java to decimal host"; flow:established,to_server; content:" Java/1"; http_header; pcre:"/Host\x3a \d{8,10}(\x0d\x0a|\x3a\d{1,5}\x0d\x0a)/H"; reference:url,fhoguin.com/2011/03/oracle-java-unsigned-applet-applet2classloader-remote-code-execution-vulnerability-zdi-11-084-explained/; reference:cve,CVE-2010-4452; classtype:trojan-activity; sid:2013487; rev:5; metadata:created_at 2011_08_30, former_category CURRENT_EVENTS, updated_at 2011_08_30;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Transaction History"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Wtransaction\shistor(y|ies)\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002489; classtype:policy-violation; sid:2002489; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED TROJAN SEO HTTP REFERER landing capture rewrite, likely Fake AV"; flow:established,to_server; content:"GET"; http_method; content:"|0d 0a|Referer|3a| "; content:"search?"; nocase; within:50; content:"q="; nocase; within:100; uricontent:".com"; nocase; pcre:"/\/[a-z]+\/[a-z0-9]{120,}\/[a-z0-9]+\/.+\.com$/U"; reference:url,doc.emergingthreats.net/2011066; classtype:trojan-activity; sid:2011066; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;) +#alert tcp $SMTP_SERVERS any -> $EXTERNAL_NET 25 (msg:"ET DELETED SMTP Customer List"; flow:to_server,established; content:"Subject|3A|"; pcre:"/\Wcustomer\slist(s)?\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002490; classtype:policy-violation; sid:2002490; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE W32/Jorik DDOS Instructions From CnC Server"; flow:established,to_client; content:"|7C|ddos|7C|"; pcre:"/\x7Cddos\x7C(syn|http)\x7C/"; classtype:command-and-control; sid:2013998; rev:3; metadata:created_at 2011_12_08, former_category MALWARE, updated_at 2011_12_08;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP Non-US Restricted"; flow:to_server,established; pcre:"///([A-Z]{3}\s)+RESTRICTED//X5/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002495; classtype:policy-violation; sid:2002495; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP W32/Adware.Ibryte User-Agent (ic Windows NT 5.1 MSIE 6.0 Firefox/ Def)"; flow:established,to_server; content:"User-Agent|3A 20|ic Windows NT 5.1 MSIE 6.0 Firefox/ Def"; http_header; classtype:pup-activity; sid:2013999; rev:2; metadata:created_at 2011_12_08, former_category ADWARE_PUP, updated_at 2011_12_08;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Non-US Confidential"; flow:to_server,established; pcre:"///([A-Z]{3}\s)+CONFIDENTIAL//X5/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002496; classtype:policy-violation; sid:2002496; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE VBKrypt.dytr Checkin"; flow:to_server,established; content:"/gate.php?id="; http_uri; content:"&pc="; http_uri; content:"&os="; http_uri; content:"&version="; http_uri; content:!"User-Agent|3a|"; http_header; reference:md5,090986b0e303779bde1ddad3c65a9d78; classtype:command-and-control; sid:2014003; rev:3; metadata:created_at 2011_08_16, former_category MALWARE, updated_at 2011_08_16;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Non-US Top Secret"; flow:to_server,established; pcre:"///([A-Z]{3}\s)+TOP\sSECRET//X5/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002497; classtype:policy-violation; sid:2002497; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Trojan Dropper User-Agent Firefox/3.6.3"; flow:established,to_server; content:"User-Agent|3A| Firefox/3.6.3"; http_header; classtype:trojan-activity; sid:2013341; rev:3; metadata:created_at 2011_08_02, updated_at 2011_08_02;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Non-US Secret"; flow:to_server,established; pcre:"///([A-Z]{3}\s)+(? $HOME_NET any (msg:"ET MALWARE P2P Zeus Response From CnC"; flow:established,from_server; content:"|E5 AA C0 31|"; depth:4; content:"|5B 74|"; distance:5; within:2; content:"|C1|"; distance:4; within:2; reference:url,www.abuse.ch/?p=3499; classtype:command-and-control; sid:2013912; rev:4; metadata:created_at 2011_11_11, former_category MALWARE, updated_at 2011_11_11;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - NATO Restricted"; flow:to_server,established; pcre:"///((NATO\sRESTRICTED)|NR)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002499; classtype:policy-violation; sid:2002499; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gootkit Checkin User-Agent (Gootkit HTTP Client)"; flow:to_server,established; content:"Gootkit HTTP Client"; http_header; nocase; reference:url,doc.emergingthreats.net/2010718; classtype:command-and-control; sid:2010718; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - NATO Confidential Atomal"; flow:to_server,established; pcre:"///((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002500; classtype:policy-violation; sid:2002500; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Probable Scalaxy exploit kit Java or PDF exploit request"; flow:established,to_server; content:"/"; http_uri; offset:2; depth:3; urilen:35; pcre:"/\/[a-z]\/[0-9a-f]{32}$/U"; classtype:exploit-kit; sid:2014025; rev:1; metadata:created_at 2011_12_13, former_category EXPLOIT_KIT, updated_at 2011_12_13;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - NATO Confidential"; flow:to_server,established; pcre:"///((NATO\sCONFIDENTIAL)|NC)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002501; classtype:policy-violation; sid:2002501; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Obfuscated Base64 in Javascript probably Scalaxy exploit kit"; flow:established,from_server; content:!"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; content:"|2b 2f 3d 22 3b|"; fast_pattern; content:"<<18|7c|"; within:500; content:"<<12|7c|"; within:13; content:"<<6|7c|"; within:13; classtype:exploit-kit; sid:2014027; rev:2; metadata:created_at 2011_12_13, former_category CURRENT_EVENTS, updated_at 2011_12_13;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - NATO COSMIC Top Secret Atomal"; flow:to_server,established; pcre:"///((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002502; classtype:policy-violation; sid:2002502; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Altnet PeerPoints Manager Traffic User-Agent (Peer Points)"; flow: established,to_server; content:"User-Agent|3a|"; nocase; http_header; content:"Peer Points"; http_header; within:150; pcre:"/User-Agent\:[^\n]+Peer Points/iH"; reference:url,doc.emergingthreats.net/2001640; classtype:policy-violation; sid:2001640; rev:23; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - NATO Secret Atomal"; flow:to_server,established; pcre:"///((NATO\sSECRET\sATOMAL)|NSA)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002503; classtype:policy-violation; sid:2002503; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Antivermins.com Spyware/Adware User-Agent (AntiVermeans)"; flow:to_server,established; content:"User-Agent|3a| AntiVermeans"; nocase; http_header; reference:url,www.bleepingcomputer.com/forums/topic69886.htm; reference:url,doc.emergingthreats.net/2003531; classtype:pup-activity; sid:2003531; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - NATO Secret"; flow:to_server,established; pcre:"///((NATO\sSECRET)|NS)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002504; classtype:policy-violation; sid:2002504; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Baidu.com Agent User-Agent (Desktop Web System)"; flow:to_server,established; content:"User-Agent|3a| Desktop Web System"; nocase; http_header; reference:url,doc.emergingthreats.net/2003604; classtype:trojan-activity; sid:2003604; rev:8; metadata:created_at 2010_07_30, former_category POLICY, updated_at 2017_04_21;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Confidential, Electronic"; flow:to_server,established; pcre:"/QQQQ\r\n(?=(O|P|R|Z)\r\n(CC)\r\n)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002505; classtype:policy-violation; sid:2002505; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED User-Agent (BlueSky)"; flow:to_server,established; content:"User-Agent|3a| BlueSky|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2011084; classtype:trojan-activity; sid:2011084; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Top Secret, Electronic"; flow:to_server,established; pcre:"/QQQQ\r\n(?=(O|P|R|Z)\r\n(TT)\r\n)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002506; classtype:policy-violation; sid:2002506; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP xxxtoolbar.com Spyware Install User-Agent"; flow:to_server,established; content:"User-Agent|3a 32 8b 86 85 86 8e 85 86 8c 0d 0a|"; nocase; http_header; reference:url,doc.emergingthreats.net/2003429; classtype:pup-activity; sid:2003429; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Secret, Electronic"; flow:to_server,established; pcre:"/QQQQ\r\n(?=(O|P|R|Z)\r\n(SS)\r\n)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002507; classtype:policy-violation; sid:2002507; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Deepdo.com Toolbar/Spyware User Agent (DeepdoUpdate)"; flow:established,to_server; content:"User-Agent|3a| DeepdoUpdate/"; nocase; http_header; reference:url,doc.emergingthreats.net/2006386; classtype:pup-activity; sid:2006386; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Confidential REL TO"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002508; classtype:policy-violation; sid:2002508; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Evidencenuker.com Fake AV/Anti-Spyware User-Agent (EVNUKER)"; flow:to_server,established; content:"User-Agent|3a| EVNUKER"; nocase; http_header; reference:url,doc.emergingthreats.net/2003567; classtype:pup-activity; sid:2003569; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, signature_severity Minor, tag Spyware_User_Agent, updated_at 2016_07_01;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Top Secret REL TO"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002509; classtype:policy-violation; sid:2002509; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Internet-antivirus.com Related Fake AV User-Agent (Update Internet Antivirus)"; flow:established,to_server; content:"User-Agent|3a| Update Internet Antivirus"; http_header; reference:url,doc.emergingthreats.net/2008647; classtype:pup-activity; sid:2008647; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Unclassified COMSEC"; flow:to_server,established; pcre:"/(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002514; classtype:policy-violation; sid:2002514; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Cleancop.co.kr Fake AV User-Agent (CleancopUpdate)"; flow:established,to_server; content:"User-Agent|3a| Cleancop"; http_header; reference:url,doc.emergingthreats.net/2008484; classtype:pup-activity; sid:2008484; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Confidential COMSEC"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002515; classtype:policy-violation; sid:2002515; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchtool.co.kr Fake Product User-Agent (searchtoolup)"; flow:established,to_server; content:"User-Agent|3a| searchtool"; http_header; reference:url,doc.emergingthreats.net/2008485; classtype:pup-activity; sid:2008485; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Top Secret COMSEC"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002516; classtype:policy-violation; sid:2002516; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Dokterfix.com Fake AV User-Agent (Magic NetInstaller)"; flow:to_server,established; content:"User-Agent|3a| Magic NetInstaller|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2007977; classtype:pup-activity; sid:2007977; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Top Secret CNWDI"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(?=//MR)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002519; classtype:policy-violation; sid:2002519; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Easydownloadsoft.com Fake Anti-Virus User-Agent (IM Downloader)"; flow:established,to_server; content:"User-Agent|3a| IM Downloader|0d 0a|"; nocase; http_header; reference:url,doc.emergingthreats.net/2008000; classtype:pup-activity; sid:2008000; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Top Secret TK"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002521; classtype:policy-violation; sid:2002521; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Alfaantivirus.com Fake Anti-Virus User-Agent (IM Download)"; flow:established,to_server; content:"User-Agent|3a| IM Download|0d 0a|"; nocase; http_header; reference:url,doc.emergingthreats.net/2007759; classtype:pup-activity; sid:2007759; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US FGI"; flow:to_server,established; pcre:"///FGI[\s\w,/-]*(?=//X5)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002523; classtype:policy-violation; sid:2002523; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP IEDefender (iedefender.com) Fake Antispyware User Agent (IEDefender 2.1)"; flow:established,to_server; content:"User-Agent|3a| IEDefender "; nocase; http_header; reference:url,doc.emergingthreats.net/2007690; classtype:pup-activity; sid:2007690; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US FOUO"; flow:to_server,established; pcre:"/(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002524; classtype:policy-violation; sid:2002524; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED User-Agent (GM Login)"; flow:to_server,established; content:"User-Agent|3a| GM Login|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2011273; classtype:trojan-activity; sid:2011273; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Confidential NOFORN"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002525; classtype:policy-violation; sid:2002525; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP CoolStreaming Toolbar (Conduit related) User-Agent (Coolstreaming Tool-Bar)"; flow:to_server,established; content:"|0d 0a|User-Agent|3a| Coolstreaming"; nocase; http_header; reference:url,doc.emergingthreats.net/2003652; classtype:pup-activity; sid:2003652; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Top Secret NOFORN"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002526; classtype:policy-violation; sid:2002526; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP UbrenQuatroRusDldr Downloader User-Agent (UbrenQuatroRusDldr 096044)"; flow:established,to_server; content:"User-Agent|3a| UbrenQuatroRusDldr"; http_header; reference:url,doc.emergingthreats.net/2008202; classtype:pup-activity; sid:2008202; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Confidential ORCON"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002704; classtype:policy-violation; sid:2002704; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP BndVeano4GetDownldr Downloader User-Agent (BndVeano4GetDownldr)"; flow:established,to_server; content:"User-Agent|3a| BndVeano4GetDownldr"; http_header; reference:url,doc.emergingthreats.net/2008203; classtype:pup-activity; sid:2008203; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Top Secret ORCON"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002528; classtype:policy-violation; sid:2002528; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Geopia.com Fake Anti-Spyware/AV User-Agent (fs3update)"; flow:to_server,established; content:"User-Agent|3a| fs3update|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2007935; classtype:pup-activity; sid:2007935; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Unclassified PROPIN"; flow:to_server,established; pcre:"/(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002530; classtype:policy-violation; sid:2002530; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Geopia.com Fake Anti-Spyware/AV User-Agent (fian3manager)"; flow:to_server,established; content:"User-Agent|3a| fian3manager|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2007938; classtype:pup-activity; sid:2007938; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Confidential PROPIN"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002531; classtype:policy-violation; sid:2002531; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Movies-etc User-Agent (IOInstall)"; flow: to_server,established; content:"User-Agent|3a| IOInstall"; nocase; http_header; reference:url,www.movies-etc.com; reference:url,doc.emergingthreats.net/2002404; classtype:pup-activity; sid:2002404; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Top Secret PROPIN"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002532; classtype:policy-violation; sid:2002532; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/InternetAntivirus User-Agent (Internet Antivirus Pro)"; flow:to_server,established; content:"User-Agent|3a| Internet Antivirus"; nocase; http_header; reference:url,doc.emergingthreats.net/2010218; classtype:pup-activity; sid:2010218; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Confidential RD"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(?=//MR)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002534; classtype:policy-violation; sid:2002534; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P JoltID Agent New Code Download"; flow: established; content:"PeerEnabler"; http_header; fast_pattern:only; reference:url,www.joltid.com; reference:url,forum.treweeke.com/lofiversion/index.php/t597.html; reference:url,doc.emergingthreats.net/2001652; classtype:trojan-activity; sid:2001652; rev:34; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Top Secret RD"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(?=//MR)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002535; classtype:policy-violation; sid:2002535; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP No-ad.co.kr Fake AV Related User-Agent (U2Clean)"; flow: established,to_server; content:"User-Agent|3a| U2Clean"; http_header; reference:url,doc.emergingthreats.net/2009289; classtype:pup-activity; sid:2009289; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US SAMI"; flow:to_server,established; pcre:"/SAMI[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002537; classtype:policy-violation; sid:2002537; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Viruskill.co.kr Fake AV User-Agent Detected (virus_kill)"; flow:to_server,established; content:"User-Agent|3a| virus_kill"; http_header; reference:url,doc.emergingthreats.net/2009150; classtype:pup-activity; sid:2009150; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Confidential SPECAT"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002538; classtype:policy-violation; sid:2002538; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Doctorvaccine.co.kr Related Spyware-User Agent (ers)"; flow:established,to_server; content:"User-Agent|3a| ers|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2007809; classtype:pup-activity; sid:2007809; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Top Secret SPECAT"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002539; classtype:policy-violation; sid:2002539; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Karine.co.kr Related Spyware User Agent (chk Profile)"; flow:established,to_server; content:"User-Agent|3a| chk Profile|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2006429; classtype:pup-activity; sid:2006429; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - US Top Secret STOP"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002541; classtype:policy-violation; sid:2002541; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Pcclear.co.kr/Pcclear.com Fake AV User-Agent (PCClearPlus)"; flow:to_server,established; content:"User-Agent|3a| PCClear"; http_header; reference:url,www.pcclear.com; reference:url,www.pcclear.co.kr; reference:url,doc.emergingthreats.net/2008198; classtype:pup-activity; sid:2008198; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Private"; flow:to_server,established; pcre:"/\Wprivate\W(?!/(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002542; classtype:policy-violation; sid:2002542; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP yeps.co.kr Related User-Agent (ISecu)"; flow:established,to_server; content:"User-Agent|3a| ISecu"; http_header; reference:url,doc.emergingthreats.net/2008204; classtype:pup-activity; sid:2008204; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Restricted"; flow:to_server,established; pcre:"/(? $EXTERNAL_NET any (msg:"ET ADWARE_PUP Nguide.co.kr Fake Security Tool User-Agent (nguideup)"; flow:to_server,established; content:"User-Agent|3a| nguideup|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2007947; classtype:pup-activity; sid:2007947; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Confidential"; flow:to_server,established; pcre:"/(? $EXTERNAL_NET any (msg:"ET ADWARE_PUP Msconfig.co.kr Related User Agent (BACKMAN)"; flow:to_server,established; content:"User-Agent|3a| BACKMAN|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2007958; classtype:pup-activity; sid:2007958; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Top Secret"; flow:to_server,established; pcre:"/(? $EXTERNAL_NET any (msg:"ET ADWARE_PUP Msconfig.co.kr Related User-Agent (GLOBALx)"; flow:to_server,established; content:"User-Agent|3a| GLOBAL"; http_header; reference:url,doc.emergingthreats.net/2007959; classtype:pup-activity; sid:2007959; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Sealed"; flow:to_server,established; pcre:"/\Wsealed\W(?!/(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002547; classtype:policy-violation; sid:2002547; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Adwave/MarketScore User-Agent (WTA)"; flow: to_server,established; content:"User-Agent|3a| WTA_"; http_header; reference:url,www.adwave.com/our_mission.aspx; reference:url,www.marketscore.com; reference:url,doc.emergingthreats.net/2002394; classtype:pup-activity; sid:2002394; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Sensitive"; flow:to_server,established; pcre:"/(? $EXTERNAL_NET any (msg:"ET DELETED User-Agent (MSIE XPSP2)"; flow:to_server,established; content:"MSIE XPSP2"; fast_pattern:only; http_header; reference:url,doc.emergingthreats.net/2003200; classtype:trojan-activity; sid:2003200; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Proprietary"; flow:to_server,established; pcre:"/\Wproprietary\W(?!/(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002549; classtype:policy-violation; sid:2002549; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Msgplus.net Spyware/Adware User-Agent (MsgPlus3)"; flow:to_server,established; content:"User-Agent|3a| MsgPlus3"; nocase; http_header; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Messenger%20Plus!&threatid=14931; reference:url,doc.emergingthreats.net/2003529; classtype:pup-activity; sid:2003529; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Protected"; flow:to_server,established; pcre:"/\Wprotected\W(?!/(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002550; classtype:policy-violation; sid:2002550; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Recuva User-Agent (OpenPage) - likely trojan dropper"; flow:to_server,established; content:"User-Agent|3a| OpenPage"; http_header; reference:url,doc.emergingthreats.net/2011101; classtype:pup-activity; sid:2011101; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Law Enorcement Sensitive"; flow:to_server,established; pcre:"/\Wlaw\senforcement\ssensitive\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002551; classtype:policy-violation; sid:2002551; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Pivim Multibar User-Agent (Pivim Multibar)"; flow:established,to_server; content:"User-Agent|3a| Pivim"; http_header; reference:url,doc.emergingthreats.net/2009765; classtype:pup-activity; sid:2009765; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Internal Use Only"; flow:to_server,established; pcre:"/\Winternal\suse\sonly\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002552; classtype:policy-violation; sid:2002552; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Popupblockade.com Spyware Related User-Agent (PopupBlockade/1.63.0.2/Reg)"; flow:established,to_server; content:"User-Agent|3a| PopupBlockade"; http_header; reference:url,doc.emergingthreats.net/2008894; classtype:pup-activity; sid:2008894; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Date of Birth"; flow:to_server,established; pcre:"/[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(?=([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002553; classtype:policy-violation; sid:2002553; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP FakeAV Windows Protection Suite/ReleaseXP.exe User-Agent (Releasexp)"; flow:established,to_server; content:"User-Agent|3a| Releasexp|0d 0a|"; nocase; http_header; reference:url,doc.emergingthreats.net/2009796; classtype:pup-activity; sid:2009796; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - HCPCS Code"; flow:to_server,established; pcre:"/\Whcpcs\W[\s\w,/-]*(?=[a-z][0-9]{10})/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002554; classtype:policy-violation; sid:2002554; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP AV2010 Rogue Security Application User-Agent (AV2010)"; flow:to_server,established; content:"User-Agent|3a| AV2010|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2008656; classtype:pup-activity; sid:2008656; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - ICD-10 Code"; flow:to_server,established; pcre:"/\Wicd\W[\s\w,/-]*(?=[a-z][0-9]{2}\.[0-9]{2})/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002555; classtype:policy-violation; sid:2002555; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Generic.Malware.dld User-Agent (Sickloader)"; flow:to_server,established; content:"User-Agent|3a| Sickloader"; nocase; http_header; reference:url,doc.emergingthreats.net/2003644; classtype:pup-activity; sid:2003644; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - FDA NDC Code"; flow:to_server,established; pcre:"/\Wndc\W[\s\w,/-]*(?=([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002556; classtype:policy-violation; sid:2002556; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Speed-runner.com Fake Speed Test User-Agent (SRInstaller)"; flow:to_server,established; content:"User-Agent|3a| SRInstaller|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2008145; classtype:pup-activity; sid:2008145; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - ADA Procedure Code"; flow:to_server,established; pcre:"/\Wada\W[\s\w,/-]*(?=d[0-9]{4})/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002557; classtype:policy-violation; sid:2002557; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Speed-runner.com Fake Speed Test User-Agent (SpeedRunner)"; flow:to_server,established; content:"User-Agent|3a| SpeedRunner|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2008146; classtype:pup-activity; sid:2008146; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - DSM-IV Code"; flow:to_server,established; pcre:"/\Wdsm\W[\s\w,/-]*(?=([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002558; classtype:policy-violation; sid:2002558; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Speed-runner.com Fake Speed Test User-Agent (SRRecover)"; flow:to_server,established; content:"User-Agent|3a| SRRecover|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2008151; classtype:pup-activity; sid:2008151; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - AMA CPT Code"; flow:to_server,established; pcre:"/\Wcpt\W[\s\w,/-]*(?=[0-9]{4}[ft]|[0-9]{5})/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002559; classtype:policy-violation; sid:2002559; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Spyaxe Spyware User-Agent (spyaxe)"; flow:to_server,established; content:" spyaxe "; fast_pattern:only; http_header; reference:url,doc.emergingthreats.net/2002807; classtype:trojan-activity; sid:2002807; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Minor, tag Spyware_User_Agent, updated_at 2020_08_20;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Credit Card, JCB"; flow:to_server,established; pcre:"/\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*(?=(3[12359][0-9]{14})|(1800|2131)[0-9]{11})/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002561; classtype:policy-violation; sid:2002561; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyhealer Fake Anti-Spyware Install User-Agent (SpyHealer)"; flow:to_server,established; content:"User-Agent|3a| SpyHeal"; nocase; http_header; reference:url,doc.emergingthreats.net/2003399; classtype:pup-activity; sid:2003399; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Password"; flow:to_server,established; pcre:"/\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002567; classtype:policy-violation; sid:2002567; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (Informer from RBC)"; flow:to_server,established; content:"Informer from RBC"; fast_pattern:only; http_header; reference:url,www.kliksoftware.com; reference:url,doc.emergingthreats.net/bin/view/Main/2003205; classtype:pup-activity; sid:2003205; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Appraisal"; flow:to_server,established; pcre:"/\Wappraisal(s)?\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002568; classtype:policy-violation; sid:2002568; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (Dummy)"; flow: established,to_server; content:"User-Agent|3a| Dummy"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2007570; classtype:pup-activity; sid:2007570; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Account Balance"; flow:to_server,established; pcre:"/\Waccount\sbalance(s)?\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002569; classtype:policy-violation; sid:2002569; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (AntiSpyware) - Likely 2squared.com related"; flow: established,to_server; content:"User-Agent|3a| AntiSpyware"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2007575; classtype:pup-activity; sid:2007575; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Payment History"; flow:to_server,established; pcre:"/\Wpayment\shistory\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002570; classtype:policy-violation; sid:2002570; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (Internet Explorer (compatible))"; flow:to_server,established; content:"User-Agent|3a| Internet Explorer (compatible)|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2007772; classtype:pup-activity; sid:2007772; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Annual Income"; flow:to_server,established; pcre:"/\Wannual\sincome(s)?\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002571; classtype:policy-violation; sid:2002571; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (HTTP_CONNECT)"; flow:to_server,established; content:"User-Agent|3a| HTTP_CONNECT|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2007899; classtype:pup-activity; sid:2007899; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Credit History"; flow:to_server,established; pcre:"/\Wcredit\shistor(y|ies)\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002572; classtype:policy-violation; sid:2002572; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (popup)"; flow:to_server,established; content:"User-Agent|3a| popup|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2007946; classtype:pup-activity; sid:2007946; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Transaction History"; flow:to_server,established; pcre:"/\Wtransaction\shistor(y|ies)\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002573; classtype:policy-violation; sid:2002573; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (2 spaces)"; flow:to_server,established; content:"User-Agent|3a 20 20 0d 0a|"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2007993; classtype:pup-activity; sid:2007993; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED HTTP - Customer List"; flow:to_server,established; pcre:"/\Wcustomer\slist(s)?\W/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002574; classtype:policy-violation; sid:2002574; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (bdsclk) - Possible Admoke Admware"; flow: to_server,established; content:"User-Agent|3a| bdsclk"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2008743; classtype:pup-activity; sid:2008743; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Non-US Restricted"; flow:to_server,established; pcre:"///([A-Z]{3}\s)+RESTRICTED//X5/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002575; classtype:policy-violation; sid:2002575; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (IE_6.0)"; flow:to_server,established; content:"User-Agent|3a| IE_6.0"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2009021; classtype:pup-activity; sid:2009021; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Non-US Confidential"; flow:to_server,established; pcre:"///([A-Z]{3}\s)+CONFIDENTIAL//X5/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002576; classtype:policy-violation; sid:2002576; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (get_site1)"; flow:to_server,established; content:"User-Agent|3a| get_site"; http_header; reference:url,doc.emergingthreats.net/2009111; classtype:pup-activity; sid:2009111; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Non-US Top Secret"; flow:to_server,established; pcre:"///([A-Z]{3}\s)+TOP\sSECRET//X5/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002577; classtype:policy-violation; sid:2002577; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (GETJOB)"; flow:to_server,established; content:"User-Agent|3a| GETJOB"; http_header; reference:url,doc.emergingthreats.net/2009124; classtype:pup-activity; sid:2009124; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - Non-US Secret"; flow:to_server,established; pcre:"///([A-Z]{3}\s)+(? $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (HelpSrvc)"; flow:established,to_server; content:"User-Agent|3a| HelpSrvc|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2009439; classtype:pup-activity; sid:2009439; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - NATO Restricted"; flow:to_server,established; pcre:"///((NATO\sRESTRICTED)|NR)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002579; classtype:policy-violation; sid:2002579; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (ONANDON)"; flow:established,to_server; content:"User-Agent|3a| ONANDON|0d 0a|"; nocase; http_header; reference:url,doc.emergingthreats.net/2009995; classtype:pup-activity; sid:2009995; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - NATO Confidential Atomal"; flow:to_server,established; pcre:"///((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002580; classtype:policy-violation; sid:2002580; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (CrazyBro)"; flow:established,to_server; content:"User-Agent|3a| CrazyBro"; nocase; http_header; reference:url,doc.emergingthreats.net/2010333; reference:url,www.f-secure.com/v-descs/trojan-proxy_w32_kvadr_gen!a.shtml; reference:md5,e4664144f8e95cfec510d5efa24a35e7; reference:md5,fd2d6bb1d2a9803c49f1e175d558a934; classtype:pup-activity; sid:2010333; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - NATO Confidential"; flow:to_server,established; pcre:"///((NATO\sCONFIDENTIAL)|NC)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002581; classtype:policy-violation; sid:2002581; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Mozilla User-Agent typo (MOzilla/4.0)"; flow:to_server,established; content:"User-Agent|3a| M|4f|zilla/"; http_header; reference:url,doc.emergingthreats.net/2003513; classtype:trojan-activity; sid:2003513; rev:11; metadata:created_at 2010_07_30, former_category INFO, updated_at 2017_10_27;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - NATO COSMIC Top Secret Atomal"; flow:to_server,established; pcre:"///((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002582; classtype:policy-violation; sid:2002582; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP yeps.co.kr Related User-Agent (ISUpd)"; flow:established,to_server; content:"User-Agent|3a| ISUpd"; http_header; reference:url,doc.emergingthreats.net/2008205; classtype:pup-activity; sid:2008205; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - NATO Secret Atomal"; flow:to_server,established; pcre:"///((NATO\sSECRET\sATOMAL)|NSA)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002583; classtype:policy-violation; sid:2002583; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Kargany Loader Obfuscated Payload Download"; flow:established,from_server; content:"Content-Disposition|3a| "; http_header; nocase; content:"windows-update-"; distance:0; http_header; content:".exe"; distance:0; http_header; content:!"|0d 0a|MZ"; classtype:trojan-activity; sid:2014019; rev:4; metadata:created_at 2011_12_10, updated_at 2011_12_10;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - NATO Secret"; flow:to_server,established; pcre:"///((NATO\sSECRET)|NS)//MR/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002584; classtype:policy-violation; sid:2002584; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (dbcount)"; flow:to_server,established; content:"User-Agent|3a| dbcount|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2011679; classtype:pup-activity; sid:2011679; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Confidential, Electronic"; flow:to_server,established; pcre:"/QQQQ\r\n(?=(O|P|R|Z)\r\n(CC)\r\n)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002585; classtype:policy-violation; sid:2002585; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET ADWARE_PUP User-Agent (RangeCheck/0.1)"; flow:established,to_server; content:"User-Agent|3a| RangeCheck/0.1|0d 0a|"; nocase; http_header; reference:url,doc.emergingthreats.net/2011718; classtype:pup-activity; sid:2011718; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Top Secret, Electronic"; flow:to_server,established; pcre:"/QQQQ\r\n(?=(O|P|R|Z)\r\n(TT)\r\n)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002586; classtype:policy-violation; sid:2002586; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP WinButler User-Agent (WinButler)"; flow:to_server,established; content:"User-Agent|3a| WinButler|0d 0a|"; http_header; reference:url,www.winbutler.com; reference:url,www.prevx.com/filenames/239975745155427649-0/WINBUTLER.EXE.html; reference:url,doc.emergingthreats.net/2008190; classtype:pup-activity; sid:2008190; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Secret, Electronic"; flow:to_server,established; pcre:"/QQQQ\r\n(?=(O|P|R|Z)\r\n(SS)\r\n)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002587; classtype:policy-violation; sid:2002587; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Winsoftware.com Fake AV User-Agent (DNS Extractor)"; flow:to_server,established; content:"User-Agent|3a| DNS Extractor"; nocase; http_header; reference:url,doc.emergingthreats.net/2003567; classtype:pup-activity; sid:2003567; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Confidential REL TO"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002588; classtype:policy-violation; sid:2002588; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (Yodao Desktop Dict)"; flow:to_server,established; content:"User-Agent|3a| Yodao"; http_header; reference:url,doc.emergingthreats.net/2011123; classtype:pup-activity; sid:2011123; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Top Secret REL TO"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002589; classtype:policy-violation; sid:2002589; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Zango-Hotbar User-Agent (zbu-hb-)"; flow:to_server,established; content:"zbu-hb-"; http_header; fast_pattern:only; pcre:"/User-Agent\:[^\n]+zbu-hb-/Hi"; reference:url,doc.emergingthreats.net/2003305; classtype:trojan-activity; sid:2003305; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Unclassified COMSEC"; flow:to_server,established; pcre:"/(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002594; classtype:policy-violation; sid:2002594; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Hotbar Agent User-Agent (PinballCorp)"; flow:to_server,established; content:"User-Agent|3a| PinballCorp"; nocase; http_header; reference:url,doc.emergingthreats.net/2011691; classtype:pup-activity; sid:2011691; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Confidential COMSEC"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002595; classtype:policy-violation; sid:2002595; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (gomtour)"; flow:to_server,established; content:"User-Agent|3a| gomtour|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2011087; classtype:pup-activity; sid:2011087; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Top Secret COMSEC"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002596; classtype:policy-violation; sid:2002596; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (i-scan)"; flow:to_server,established; content:"User-Agent|3a| i-scan"; nocase; http_header; reference:url,doc.emergingthreats.net/2011105; classtype:pup-activity; sid:2011105; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Top Secret CNWDI"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(?=//MR)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002599; classtype:policy-violation; sid:2002599; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP iWon Spyware (iWonSearchAssistant)"; flow:to_server,established; content:"User-Agent|3a| iWonSearch"; http_header; reference:url,www.spywareguide.com/product_show.php?id=461; reference:url,doc.emergingthreats.net/2002169; classtype:pup-activity; sid:2002169; rev:14; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Top Secret TK"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002601; classtype:policy-violation; sid:2002601; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET ADWARE_PUP User-Agent (iexplore)"; flow:established,to_server; content:"User-Agent|3a| iexplore|0d 0a|"; nocase; http_header; reference:url,doc.emergingthreats.net/2000466; classtype:pup-activity; sid:2000466; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US FGI"; flow:to_server,established; pcre:"///FGI[\s\w,/-]*(?=//X5)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002603; classtype:policy-violation; sid:2002603; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (Download UBAgent) - lop.com and other spyware"; flow:to_server,established; content:"Download UBAgent"; http_header; fast_pattern:only; reference:url,www.spywareinfo.com/articles/lop/; reference:url,doc.emergingthreats.net/2003345; classtype:pup-activity; sid:2003345; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US FOUO"; flow:to_server,established; pcre:"/(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002604; classtype:policy-violation; sid:2002604; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Worm.Pyks HTTP C&C Traffic User-Agent (skw00001)"; flow:established,to_server; content:"|0d 0a|User-Agent|3a| skw000"; http_header; reference:url,doc.emergingthreats.net/2003588; classtype:pup-activity; sid:2003588; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Confidential NOFORN"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002605; classtype:policy-violation; sid:2002605; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (KRMAK) Butterfly Bot download"; flow:to_server,established; content:"User-Agent|3a| KRMAK"; http_header; classtype:pup-activity; sid:2011297; rev:3; metadata:created_at 2010_09_28, former_category ADWARE_PUP, updated_at 2010_09_28;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Top Secret NOFORN"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002606; classtype:policy-violation; sid:2002606; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (mrgud)"; flow:established,to_server; content:"User-Agent|3a| mrgud"; http_header; nocase; classtype:pup-activity; sid:2012172; rev:5; metadata:created_at 2011_01_12, former_category ADWARE_PUP, updated_at 2011_01_12;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Confidential ORCON"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002608; classtype:policy-violation; sid:2002608; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP Possible Windows executable sent ASCII-hex-encoded"; flow:established,from_server; content:"ascii"; http_header; nocase; content:"|0d 0a 0d 0a|4d5a"; nocase; reference:md5,513077916da4e86827a6000b40db95d5; reference:url,www.xanalysis.blogspot.com/2008/11/cve-2008-2992-adobe-pdf-exploitation.html; classtype:pup-activity; sid:2012804; rev:5; metadata:created_at 2011_05_14, former_category ADWARE_PUP, updated_at 2011_05_14;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Top Secret ORCON"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002609; classtype:policy-violation; sid:2002609; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Egspy Infection Report via HTTP"; flow:established,to_server; content:"/keylogkontrol/"; fast_pattern; http_uri; content:"User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)"; http_header; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=EgySpy&threatid=48410; reference:url,doc.emergingthreats.net/2008047; classtype:trojan-activity; sid:2008047; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Unclassified PROPIN"; flow:to_server,established; pcre:"/(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002611; classtype:policy-violation; sid:2002611; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Unknown checkin"; flow:established,to_server; content:"POST"; http_method; content:"/c.php"; fast_pattern; http_uri; content:"User-Agent|3a| Mozilla/4.0 compatible|3b| MSIE 8.0|3b| Windows NT 5.1|3b| Trident/4.0|3b| |0d 0a|"; http_header; classtype:trojan-activity; sid:2013803; rev:5; metadata:created_at 2011_10_26, updated_at 2011_10_26;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Confidential PROPIN"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002612; classtype:policy-violation; sid:2002612; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT DRIVEBY Generic Java Rhino Scripting Engine Exploit Previously Requested com.class"; flow:established,to_server; content:" Java/1"; http_header; content:"/com.class"; http_uri; classtype:exploit-kit; sid:2014031; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_12_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Top Secret PROPIN"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002613; classtype:policy-violation; sid:2002613; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT DRIVEBY Generic Java Rhino Scripting Engine Exploit Previously Requested org.class"; flow:established,to_server; content:" Java/1"; http_header; content:"/org.class"; http_uri; classtype:exploit-kit; sid:2014032; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_12_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Confidential RD"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(?=//MR)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002615; classtype:policy-violation; sid:2002615; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT DRIVEBY Generic Java Rhino Scripting Engine Exploit Previously Requested edu.class"; flow:established,to_server; content:" Java/1"; http_header; content:"/edu.class"; http_uri; classtype:exploit-kit; sid:2014033; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_12_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Top Secret RD"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(?=//MR)/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002616; classtype:policy-violation; sid:2002616; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT DRIVEBY Generic Java Rhino Scripting Engine Exploit Previously Requested net.class"; flow:established,to_server; content:" Java/1"; http_header; content:"/net.class"; http_uri; classtype:exploit-kit; sid:2014034; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_12_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US SAMI"; flow:to_server,established; pcre:"/SAMI[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002618; classtype:policy-violation; sid:2002618; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Suspicious User-Agent (Toolbar) Possibly Malware/Spyware"; flow:to_server,established; content:"User-Agent|3a| Toolbar"; http_header; content:!"cf.icq.com"; reference:url,doc.emergingthreats.net/bin/view/Main/2003463; classtype:pup-activity; sid:2003463; rev:17; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, signature_severity Major, tag User_Agent, updated_at 2016_07_01;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Confidential SPECAT"; flow:to_server,established; pcre:"/(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002619; classtype:policy-violation; sid:2002619; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Searchmeup Spyware Install (toolbar)"; flow: to_server,established; content:"/dkprogs/toolbar.txt"; http_uri; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2001473; classtype:trojan-activity; sid:2001473; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Top Secret SPECAT"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/bin/view/Main/2002620; classtype:policy-violation; sid:2002620; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED HSN.com Toolbar Spyware User-Agent (HSN)"; flow:to_server,established; content:"User-Agent|3a| "; nocase; http_header; content:"HSN"; http_header; fast_pattern:only; pcre:"/User-Agent\:[^\n]+HSN/iH"; reference:url,doc.emergingthreats.net/2003495; classtype:trojan-activity; sid:2003495; rev:11; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Minor, tag Spyware_User_Agent, updated_at 2016_07_01;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED High Ports - US Top Secret STOP"; flow:to_server,established; pcre:"/(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(?=//(25)?X[1-9])/ism"; reference:url,doc.emergingthreats.net/2002622; classtype:policy-violation; sid:2002622; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Webbuying.net Spyware Install User-Agent (wbi_v0.90)"; flow:to_server,established; content:" wbi_v0."; fast_pattern:only; http_header; pcre:"/User-Agent\:[^\n]+wbi_v\d/iH"; reference:url,doc.emergingthreats.net/2003441; classtype:pup-activity; sid:2003441; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> [69.63.176.0/20,69.63.176.0/20,204.15.20.0/22] $HTTP_PORTS (msg:"ET DELETED facebook activity"; flow:established,to_server; threshold: type both, track by_dst, count 2, seconds 120; reference:url,compnetworking.about.com/od/traceipaddresses/f/facebook-ip-address.htm; reference:url,doc.emergingthreats.net/2010952; classtype:policy-violation; sid:2010952; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Wild Tangent Agent User-Agent (WildTangent)"; flow: to_server,established; content:"WildTangent"; fast_pattern:only; pcre:"/User-Agent\:[^\n]+Wildtangent/iH"; reference:url,doc.emergingthreats.net/2001639; classtype:trojan-activity; sid:2001639; rev:30; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Generic Dropper HTTP Bot grabbing config"; flow: to_server,established; content:".txt"; nocase; http_uri; fast_pattern; content:"Pragma|3a| no-cache"; http_header; content:"User-Agent|3a| "; http_header; pcre:"/User-Agent\x3a \d{6}\x0d\x0a/H"; reference:url,doc.emergingthreats.net/2008664; classtype:trojan-activity; sid:2008664; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED DRIVEBY Blackhole PDF Exploit Request /fdp2.php"; flow:established,to_server; content:"/fdp2.php?f="; http_uri; reference:md5,8a33d1d36d097ca13136832aa10ae5ca; reference:cve,CVE-2011-0611; classtype:trojan-activity; sid:2014035; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Any, attack_target Client_Endpoint, created_at 2011_12_22, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag DriveBy, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED PeopleOnPage Ping"; flow: to_server,established; content:"Host|3a| srv.peopleonpage.com"; nocase; http_header; pcre:"/(POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/s\/l\/firstping/i"; reference:url,www.peopleonpage.com; reference:url,www.safer-networking.org/en/threats/602.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001446; classtype:policy-violation; sid:2001446; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET MALWARE Double HTTP/1.1 Header Inbound - Likely Hostile Traffic"; flow:established,to_server; content:" HTTP/1.1|20|HTTP/1.1|0d 0a|"; depth:300; classtype:bad-unknown; sid:2014047; rev:3; metadata:created_at 2011_12_30, updated_at 2011_12_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Delf Checkin via HTTP (8)"; flow:established,to_server; content:"POST"; nocase; http_method; content:".php"; http_uri; nocase; content:"User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)"; http_header; content:"name="; http_client_body; depth:5; reference:url,doc.emergingthreats.net/2008268; classtype:trojan-activity; sid:2008268; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Double HTTP/1.1 Header Outbound - Likely Infected or Hostile Traffic"; flow:established,to_server; content:" HTTP/1.1|20|HTTP/1.1|0d 0a|"; depth:300; classtype:bad-unknown; sid:2013745; rev:5; metadata:created_at 2011_10_05, updated_at 2011_10_05;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Blackhole Landing Page getElementByID Qwe - May 22nd 2012"; flow:established,to_client; content:"getElementById']('qwe')"; reference:url,blog.spiderlabs.com/2012/05/catch-me-if-you-can-trojan-banker-zeus-strikes-again-part-2-of-5-1.html; classtype:trojan-activity; sid:2014800; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_23, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Bluecoat Proxy in use"; flow:established,to_server; content:"X-BlueCoat-Via|3A|"; http_header; classtype:not-suspicious; sid:2014049; rev:2; metadata:created_at 2011_12_30, updated_at 2011_12_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Thetatic.A Client POST Get CMD Checkin"; flow:established,to_server; content:"POST"; http_method; content:"CONTENT-TYPE|3a| application/x-www-form-urlencoded"; fast_pattern; http_header; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| Win32|3b| WinHttp.WinHttpRequest.5)"; http_header; content:"cstype="; http_client_body; depth:7; content:"&authname="; distance:0; http_client_body; classtype:trojan-activity; sid:2014794; rev:4; metadata:created_at 2012_05_22, updated_at 2012_05_22;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Blackhole Acrobat 8/9.3 PDF exploit download request 3"; flow:established,to_server; content:"/fdp2.php?f="; http_uri; reference:md5,8a33d1d36d097ca13136832aa10ae5ca; reference:cve,CVE-2011-0611; classtype:trojan-activity; sid:2014051; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_12_30, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED DYNAMIC_DNS HTTP Request to a *.dyndns.* domain"; flow:established,to_server; content:".dyndns."; http_header; nocase; pcre:"/\.dyndns\.(?=(biz|info|org|tv))\x0d\x0a/iH"; classtype:bad-unknown; sid:2012927; rev:4; metadata:created_at 2011_06_03, updated_at 2011_06_03;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Blackhole Acrobat 1-7 PDF exploit download request 3"; flow:established,to_server; content:"/fdp1.php?f="; http_uri; reference:md5,8a33d1d36d097ca13136832aa10ae5ca; reference:cve,CVE-2011-0611; classtype:trojan-activity; sid:2014052; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_12_30, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED DYNAMIC_DNS HTTP Request to a *.dyndns-*.com domain"; flow:established,to_server; content:".dyndns-"; http_header; nocase; pcre:"/\.dyndns-(?=(at-home|at-work|blog|free|home|ip|mail|office|pics|remote|server|web|wiki|work))\.com\x0d\x0a/iH"; classtype:bad-unknown; sid:2012928; rev:7; metadata:created_at 2011_06_03, updated_at 2011_06_03;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Blackhole Likely Flash exploit download request score.swf"; flow:established,to_server; content:"/score.swf"; http_uri; reference:cve,CVE-2011-0611; classtype:trojan-activity; sid:2014053; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_12_30, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED CrazyWinnings.com Activity"; flow: established,to_server; content:"/scripts/protect.php?promo=promo"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001733; classtype:trojan-activity; sid:2001733; rev:8; metadata:created_at 2010_07_30, updated_at 2016_09_20;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT User-Agent used in Injection Attempts"; flow:established,to_server; content:"User-Agent|3a| MOT-MPx220/1.400 Mozilla/4.0"; http_header; reference:url,lists.emergingthreats.net/pipermail/emerging-sigs/2011-December/016882.html; classtype:trojan-activity; sid:2014054; rev:2; metadata:created_at 2011_12_30, former_category CURRENT_EVENTS, updated_at 2011_12_30;) +#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET DELETED Storm Controller Response to Drone via tcp"; flowbits:isset,BE.stormtcp.init; flow:established,from_server; dsize:4; reference:url,doc.emergingthreats.net/bin/view/Main/StormWorm; classtype:trojan-activity; sid:2007641; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Win32/Hilgild!gen.A CnC Communication"; flow:established,to_server; content:"Y|00|M|00|S|00|G|00 2e 00 2e 00 2e 00 2e 00|"; depth:16; content:"|f6 f6 f6 f6 f6 f6 f6 f6 f6|"; dsize:1024; reference:md5,d8edad03f5524369e60c69a7483f8365; classtype:command-and-control; sid:2014055; rev:1; metadata:created_at 2011_12_31, former_category MALWARE, updated_at 2011_12_31;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET DELETED Storm Making initial outbound connection"; flowbits:isnotset,BE.stormtcp.init; flow:established,to_server; dsize:4; flowbits:noalert; flowbits:set,BE.stormtcp.init; reference:url,doc.emergingthreats.net/bin/view/Main/StormWorm; classtype:trojan-activity; sid:2007640; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER Generic Web Server Hashing Collision Attack"; flow:established,to_server; content:"Content-Type|3A| application|2F|x-www-form-urlencoded"; nocase; http_header; isdataat:1500; pcre:"/([\w\x25]+=[\w\x25]*&){500}/OPsmi"; reference:cve,2011-3414; reference:url,events.ccc.de/congress/2011/Fahrplan/events/4680.en.html; reference:url,technet.microsoft.com/en-us/security/advisory/2659883; reference:url,blogs.technet.com/b/srd/archive/2011/12/29/asp-net-security-update-is-live.aspx; classtype:attempted-dos; sid:2014045; rev:3; metadata:created_at 2011_12_30, updated_at 2011_12_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Sefnit Checkin 3"; flow:established,to_server; content:"?re="; http_uri; content:"&r="; distance:0; http_uri; content:"&u="; distance:0; http_uri; content:"&cid="; distance:0; http_uri; content:"&rc="; distance:0; http_uri; content:"&pa="; distance:0; http_uri; content:"&ref1="; distance:0; http_uri; content:"&ref2="; distance:0; http_uri; classtype:trojan-activity; sid:2014246; rev:3; metadata:created_at 2012_02_21, updated_at 2012_02_21;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER Generic Web Server Hashing Collision Attack 2"; flow:established,to_server; content:"Content-Type|3A| multipart/form-data"; nocase; http_header; isdataat:5000; pcre:"/(\r\nContent-Disposition\x3a\s+form-data\x3b[^\r\n]+\r\n\r\n.+?){250}/OPsmi"; reference:cve,2011-3414; reference:url,events.ccc.de/congress/2011/Fahrplan/events/4680.en.html; reference:url,technet.microsoft.com/en-us/security/advisory/2659883; reference:url,blogs.technet.com/b/srd/archive/2011/12/29/asp-net-security-update-is-live.aspx; classtype:attempted-dos; sid:2014046; rev:3; metadata:created_at 2011_12_30, updated_at 2011_12_30;) +#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET DELETED UPS Spam Inbound Variant 4"; flow:established,to_server; content:"Content-Disposition|3a| attachment|3b|"; nocase; content:"filename=|22|UPS_AIR_CARGO_bar-coded-lot-labels-EXAMPLE.zip|22|"; nocase; within:100; classtype:trojan-activity; sid:2012235; rev:3; metadata:created_at 2011_01_27, updated_at 2011_01_27;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE PoisonIvy.Eu5 Keepalive from CnC"; flow:established,from_server; content:"|3a 62 26 fd 44 34 01 ed a1 ed 88 48 7e f4 6e ca 0d 81 aa 70 c7 da e0 1c fc f2 f1 d2 94 f6 d9 44 f6 c1 92 c4 4f d4 2d 53 a7 5f 59 fd f6 1e 9b 6f|"; depth:48; dsize:48; reference:md5,d8edad03f5524369e60c69a7483f8365; classtype:command-and-control; sid:2014057; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_12_31, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET DELETED UPS Inbound bad attachment v.4"; flow:established,to_server; content:"Content-Disposition|3a| attachment|3b|"; nocase; content:"filename=|22|UPS_AIR_CARGO_bar-coded-lot-labels-EXAMPLE.zip|22| "; nocase; within:100; classtype:trojan-activity; sid:2012442; rev:2; metadata:created_at 2011_03_09, updated_at 2011_03_09;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.Eu5 Keepalive to CnC"; flow:established,to_server; content:"|13 cb df 56 6f f3 20 08 c2 f1 ab d3 6f 75 56 a9|"; offset:16; depth:16; dsize:48; reference:md5,d8edad03f5524369e60c69a7483f8365; classtype:command-and-control; sid:2014056; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_12_31, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED FakeAvCn-A Checkin 2"; flow:established,to_server; content:"GET"; http_method; nocase; content:"/support/sr"; http_uri; fast_pattern:only; urilen:11; classtype:trojan-activity; sid:2014856; rev:2; metadata:created_at 2012_06_05, updated_at 2012_06_05;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER xp_cmdshell Attempt in Cookie"; flow:established,to_server; content:"xp_cmdshell"; nocase; http_header; pcre:"/\x0a\x0dCookie\x3a[^\n]+xp_cmdshell/i"; reference:url,www.databasejournal.com/features/mssql/article.php/3372131/Using-xpcmdshell.htm; reference:url,msdn.microsoft.com/en-us/library/ms175046.aspx; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=4072; reference:url,doc.emergingthreats.net/2010119; classtype:web-application-attack; sid:2010119; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Yahoo IM successful chat join"; flow: from_server,established; content:"YMSG"; nocase; depth: 4; content:"|00 98|"; offset: 10; depth: 2; reference:url,doc.emergingthreats.net/2001261; classtype:policy-violation; sid:2001261; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Nginx Serving PDF - Possible hostile content (PDF)"; flow:established,from_server; content:"|0d 0a|Server|3a| nginx"; depth:300; content:"%PDF-"; within:300; threshold:type limit, seconds 60, count 10, track by_src; reference:url,doc.emergingthreats.net/bin/view/Main/2009076; classtype:bad-unknown; sid:2009076; rev:16; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET 5050 -> $HOME_NET any (msg:"ET DELETED Yahoo IM successful logon"; flow: from_server,established; content:"YMSG"; nocase; depth: 4; content:"|00 01|"; offset: 10; depth: 2; reference:url,doc.emergingthreats.net/2001253; classtype:policy-violation; sid:2001253; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http any any -> $HOME_NET any (msg:"ET POLICY HTTP Redirect to IPv4 Address"; flow:established,from_server; content:"302"; http_stat_code; content:"Found"; nocase; content:"Location|3a| "; nocase; pcre:"/Location\: (http\:\/\/)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\//i"; reference:url,doc.emergingthreats.net/2011085; classtype:misc-activity; sid:2011085; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET 5050 -> $HOME_NET any (msg:"GPL DELETED Yahoo IM successful logon"; flow:from_server,established; content:"YMSG"; nocase; content:"|00 01|"; distance:6; within:2; classtype:policy-violation; sid:2102450; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Nginx Server in use - Often Hostile Traffic"; flow:established,from_server; content:"|0d 0a|Server|3a| nginx"; nocase; threshold:type limit, seconds 60, count 3, track by_src; reference:url,doc.emergingthreats.net/2008054; classtype:bad-unknown; sid:2008054; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET DELETED Storm Worm Encrypted Variant 1 Traffic (1)"; dsize:25; content:"|10 a6|"; depth:2; threshold: type both, count 2, seconds 60, track by_src; reference:url,doc.emergingthreats.net/2007701; classtype:trojan-activity; sid:2007701; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY Possible Trojan File Download bad rar file header (not a valid rar file)"; flow:established,from_server; content:"|0d 0a|Content-Type|3a| application|2f|octet-stream"; content:"|0d 0a 0d 0a 52 61 72 21|"; content:!"|1A 07|"; within:2; reference:url,www.win-rar.com/index.php?id=24&kb=1&kb_article_id=162; reference:url,doc.emergingthreats.net/2008782; classtype:trojan-activity; sid:2008782; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET DELETED Storm Worm Encrypted Variant 1 Traffic (2)"; dsize:25; content:"|10 a0|"; depth:2; threshold: type both, count 2, seconds 60, track by_src; reference:url,doc.emergingthreats.net/2007702; classtype:trojan-activity; sid:2007702; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED FakeAV Served To Client"; flow:established,to_client; content:"HTTP/1"; depth:6; content:"Content-Disposition|3a| attachment|3b| filename="; nocase; content:"|0D 0A|Set-Cookie|3a| ds=1|0D 0A|"; nocase; reference:url,doc.emergingthreats.net/2011221; classtype:trojan-activity; sid:2011221; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Armitage Exploit Request"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/bof.php"; http_uri; reference:url,doc.emergingthreats.net/2009032; classtype:trojan-activity; sid:2009032; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL WEB_CLIENT local resource redirection attempt"; flow:to_client,established; content:"Location|3A|"; nocase; pcre:"/^Location\x3a\s*URL\s*\x3a/smi"; reference:cve,2004-0549; reference:url,www.kb.cert.org/vuls/id/713878; classtype:attempted-user; sid:2102577; rev:7; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_23, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Redkit Java Exploit request to b.class"; flow:established,to_server; urilen:10; content:"/b.class"; http_uri; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2014824; rev:3; metadata:created_at 2012_05_30, updated_at 2012_05_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED MALVERTISING trafficbiztds.com - client receiving redirect to exploit kit"; flow:established,to_client; content:"domain=trafficbiztds.com"; http_cookie; content:!"google.com"; classtype:exploit-kit; sid:2011469; rev:6; metadata:created_at 2010_09_29, updated_at 2010_09_29;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Unknown Loader *.jpg?t=0.* in http_uri"; flow:established,to_server; content:".jpg?t=0."; http_uri; pcre:"/\.jpg\?t\x3d\d\.\d/U"; classtype:trojan-activity; sid:2013520; rev:4; metadata:created_at 2011_09_02, updated_at 2011_09_02;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Nginx Serving EXE/DLL File Often Malware Related"; flow:established,to_client; content:"Server|3a| nginx"; nocase; fast_pattern; content:"MZ"; content:"This program cannot be run in DOS mode."; distance:0; isdataat:10,relative; content:"PE"; distance:0; classtype:misc-activity; sid:2012195; rev:3; metadata:created_at 2011_01_17, updated_at 2011_01_17;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED MALVERTISING Malicious Advertizing URL in.cgi"; flow:to_server,established; content:"/in.cgi?"; http_uri; classtype:bad-unknown; sid:2012883; rev:6; metadata:created_at 2011_05_27, updated_at 2011_05_27;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Download of Microsft Office File From Russian Content-Language Website"; flow:established,to_client; content:"Content-Language|3A| ru"; nocase; content:"|D0 CF 11 E0 A1 B1 1A E1|"; classtype:trojan-activity; sid:2012525; rev:3; metadata:created_at 2011_03_21, updated_at 2011_03_21;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Blackhole - Landing Page Requested - /*.php?*=16HexChar"; flow:established,to_server; flowbits:set,ET.http.driveby.blackhole.uri; flowbits:noalert; urilen:23<>60; content:".php?"; http_uri; content:"="; within:8; http_uri; pcre:"/\?[a-z]{1,10}=[a-f0-9]{16}$/U"; pcre:"/[0-9]{1,16}[a-f]{1,16}[0-9]{1,16}$/U"; classtype:trojan-activity; sid:2014973; rev:18; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_06_27, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Download of Microsoft Office File From Chinese Content-Language Website"; flow:established,to_client; content:"Content-Language|3A| zh-cn"; nocase; content:"|D0 CF 11 E0 A1 B1 1A E1|"; classtype:trojan-activity; sid:2012526; rev:3; metadata:created_at 2011_03_21, updated_at 2011_03_21;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Spambot getting new exe url"; flow:established,to_server; content:"404.txt"; nocase; http_uri; content:"404"; content:!"User-Agent|3a|"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2002989; classtype:trojan-activity; sid:2002989; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Download of PDF File From Russian Content-Language Website"; flow:established,to_client; content:"Content-Language|3A| ru"; nocase; content:"%PDF-"; classtype:trojan-activity; sid:2012527; rev:3; metadata:created_at 2011_03_21, updated_at 2011_03_21;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 5250 (msg:"ET DELETED MISC Computer Associates Negative Content-Length Buffer Overflow"; flow:established,to_server; content:"Content-Length|3A|"; nocase; pcre:"/^Content-Length\x3a\s*-\d+/smi"; reference:bugtraq,16354; reference:cve,2005-3653; reference:url,doc.emergingthreats.net/bin/view/Main/2002791; classtype:web-application-attack; sid:2002791; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Download of PDF File From Chinese Content-Language Website"; flow:established,to_client; content:"Content-Language|3A| zh-cn"; nocase; content:"%PDF-"; classtype:trojan-activity; sid:2012528; rev:3; metadata:created_at 2011_03_21, updated_at 2011_03_21;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain fmacqvmqafqwmebl.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|fmacqvmqafqwmebl|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015287; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE FakeAV InstallInternetProtection Download"; flow:established,from_server; content:"|3b 20|filename=|22|InstallInternetProtection_"; nocase; classtype:trojan-activity; sid:2012696; rev:3; metadata:created_at 2011_04_21, updated_at 2011_04_21;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain hrpgglxvqwjesffr.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|hrpgglxvqwjesffr|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015288; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_SPECIFIC_APPS WordPress DB XML dump successful leakage"; flow:established,from_server; content:"|0d 0a||0d 0a|"; content:"|0d 0a|Content-Type|3a 20|text/plain|0d 0a|"; reference:url,seclists.org/fulldisclosure/2011/May/322; classtype:successful-recon-largescale; sid:2012809; rev:3; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2011_05_15, deployment Datacenter, signature_severity Major, tag Wordpress, updated_at 2016_07_01;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain rxbkqfydlnzopqrn.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|rxbkqfydlnzopqrn|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015289; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE FakeAV FakeAlertRena.n Checkin Response from Server"; flow:established,from_server; flowbits:isset,ET.fakealert.rena.n; content:"Content-Length|3a| 2|0d 0a|"; content:"|0d 0a 0d 0a|OK"; distance:0; classtype:command-and-control; sid:2013136; rev:6; metadata:created_at 2011_06_29, former_category MALWARE, updated_at 2011_06_29;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain tdsorylshsxjeawf.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|tdsorylshsxjeawf|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015290; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Dictcn Trojan Downloader Node Server Type"; flow:established,to_client; content:"Server|3A| Dict/"; fast_pattern:only; classtype:trojan-activity; sid:2013326; rev:4; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_07_27, deployment Perimeter, signature_severity Major, tag Trojan_Downloader, updated_at 2020_08_20;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain elfxqghdubihhsgd.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|elfxqghdubihhsgd|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015291; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Executable served from Amazon S3"; flow:established,to_client; content:"Server|3A| AmazonS3"; content:"MZ"; isdataat:80,relative; content:"PE"; distance:0; reference:url,blog.trendmicro.com/cybercriminals-using-amazon-web-services-aws-to-host-malware/; reference:url,www.securelist.com/en/blog/208188099/Financial_data_stealing_Malware_now_on_Amazon_Web_Services_Cloud; classtype:bad-unknown; sid:2013437; rev:5; metadata:created_at 2011_08_19, updated_at 2011_08_19;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain gqtcxunxhyujqjkf.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|gqtcxunxhyujqjkf|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015292; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED EXE Download When Server Claims To Send Audio File - DOS Mode"; flow:established,to_client; content:"Content-Type|3A 20|audio|2F|"; nocase; content:"MZ"; content:"This program cannot be run in DOS mode"; distance:0; content:"PE"; distance:0; classtype:trojan-activity; sid:2013442; rev:3; metadata:created_at 2011_08_22, updated_at 2011_08_22;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain qxggipnnfmnihkic.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|qxggipnnfmnihkic|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015293; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE SecurityDefender exe Download Likely FakeAV Install"; flow:established,from_server; content:"|0D 0A|Content-Disposition|3a| attachment|3B| filename=|22|"; content:"SecurityDefender"; nocase; within:24; content:".exe"; within:24; classtype:trojan-activity; sid:2013826; rev:3; metadata:created_at 2011_11_05, updated_at 2011_11_05;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain sdxkjaophbtufumx.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|sdxkjaophbtufumx|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015294; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY Bomgar Remote Assistance Tool Download"; flow:established,from_server; content:"filename="; content:"bomgar-scc-"; nocase; distance:0; fast_pattern; content:".exe"; nocase; distance:0; reference:url,www.bomgar.com; classtype:policy-violation; sid:2013867; rev:3; metadata:created_at 2011_11_08, updated_at 2011_11_08;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain clkujrjqvexvbmoi.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|clkujrjqvexvbmoi|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015295; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL POLICY Windows Media Video download"; flow:from_server,established; content:"Content-type|3A| video/x-ms-asf"; nocase; classtype:policy-violation; sid:2101438; rev:14; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain fqyyxagzkrpvxtki.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|fqyyxagzkrpvxtki|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015296; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Mambo Zorder zorder Parameter UNION SELECT SQL Injection Vulnerability"; flow:established,to_server; content:"GET"; http_method; content:"/administrator/index2.php?"; nocase; http_uri; content:"limit="; nocase; http_uri; content:"limitstart="; nocase; http_uri; content:"zorder="; nocase; http_uri; content:"UNION"; nocase; http_uri; content:"SELECT"; nocase; http_uri; pcre:"/UNION.+SELECT/Ui"; reference:url,dl.packetstormsecurity.net/1111-exploits/zorder-sql.txt; classtype:web-application-attack; sid:2014079; rev:4; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2012_01_03, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain owldagkyzrkhqnjo.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|owldagkyzrkhqnjo|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015297; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.Win32.Nurech Checkin UA"; flow:from_client,established; content:"User-Agent|3a| ipwf|0d 0a|"; http_header; classtype:command-and-control; sid:2014093; rev:3; metadata:created_at 2012_01_03, former_category MALWARE, updated_at 2012_01_03;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain rccjvgsgffokiwze.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|rccjvgsgffokiwze|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015298; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET 1433 (msg:"ET POLICY Outbound MSSQL Connection to Standard port (1433)"; flow:to_server,established; content:"|12 01 00|"; depth:3; content:"|00 00 00 00 00 00 15 00 06 01 00 1b 00 01 02 00 1c 00|"; distance:1; within:18; content:"|03 00|"; distance:1; within:2; content:"|00 04 ff 08 00 01 55 00 00 00|"; distance:1; within:10; flowbits:set,ET.MSSQL; classtype:bad-unknown; sid:2013410; rev:4; metadata:created_at 2011_08_16, updated_at 2011_08_16;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain blorcdyiipxcwyxv.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|blorcdyiipxcwyxv|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015299; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -alert tcp $HOME_NET any -> $EXTERNAL_NET !1433 (msg:"ET POLICY Outbound MSSQL Connection to Non-Standard Port - Likely Malware"; flow:to_server,established; content:"|12 01 00|"; depth:3; content:"|00 00 00 00 00 00 15 00 06 01 00 1b 00 01 02 00 1c 00|"; distance:1; within:18; content:"|03 00|"; distance:1; within:2; content:"|00 04 ff 08 00 01 55 00 00 00|"; distance:1; within:10; flowbits:set,ET.MSSQL; classtype:bad-unknown; sid:2013409; rev:3; metadata:created_at 2011_08_16, updated_at 2011_08_16;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain dpewaddpoewiycnj.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|dpewaddpoewiycnj|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015300; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Blackhole Exploit Kit Delivering Java Exploit to Client"; flowbits:isset,et.exploitkitlanding; flow:established,to_client; content:" $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain nwpykqeizraqthry.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|nwpykqeizraqthry|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015301; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Blackhole Acrobat 8/9.3 PDF exploit download request 2"; flow:established,to_server; content:"/2ddfp.php?f="; http_uri; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2013786; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_10_20, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain pchgijctfprxhnje.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|pchgijctfprxhnje|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015302; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Blackhole Acrobat 1-7 PDF exploit download request 2"; flow:established,to_server; content:"/1ddfp.php?f="; http_uri; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2013787; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_10_20, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain zisiiogqigzzqqeq.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|zisiiogqigzzqqeq|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015303; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Blackhole Exploit Pack HCP exploit"; flow:established,to_server; content:"/pch.php?f="; http_uri; pcre:"/pch\.php\?f=\d+$/U"; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2013548; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_09_08, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain cpittmwbqtjrjpql.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|cpittmwbqtjrjpql|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015304; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Blackhole Exploit Pack HCP exploit 2"; flow:established,to_server; content:"/hcp_vbs.php?f="; http_uri; pcre:"/hcp_vbs\.php\?f=\d+&d=\d+$/U"; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2013549; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_09_08, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain mvuvchtcxxibeubd.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|mvuvchtcxxibeubd|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015305; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Likely Blackhole Exploit Kit Driveby ?v Download Secondary Request"; flow:established,to_server; content:".php?v"; http_uri; pcre:"/\.php\?v[a-z0-9]{1,4}=[a-f0-9]{16}$/U"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2013667; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Any, attack_target Client_Endpoint, created_at 2011_09_19, deployment Perimeter, former_category EXPLOIT_KIT, malware_family Blackhole, signature_severity Critical, tag DriveBy, tag Blackhole, tag Exploit_Kit, updated_at 2021_06_23;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain oblcasnhxbbocpfj.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|oblcasnhxbbocpfj|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015306; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Saturn Exploit Kit binary download request"; flow:established,to_server; content:"/dl/"; depth:4; http_uri; fast_pattern; content:".php?"; http_uri; pcre:"/\/dl\/\w{1,4}\.php\?[0-9]$/U"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2013775; rev:2; metadata:created_at 2011_10_14, former_category EXPLOIT_KIT, updated_at 2011_10_14;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain xixftoplsduqqorx.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|xixftoplsduqqorx|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015307; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Saturn Exploit Kit probable Java MIDI exploit request"; flow:established,to_server; content:"/dl/jsm.php"; depth:14; http_uri; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2013777; rev:2; metadata:created_at 2011_10_14, former_category EXPLOIT_KIT, updated_at 2011_10_14;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain bpnqmxkpxxgbdnby.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|bpnqmxkpxxgbdnby|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015308; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT DRIVEBY SEO Exploit Kit request for PDF exploit"; flow:established,to_server; content:"POST"; http_method; content:"id="; content:"|25 32 36|np"; distance:32; within:5; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2011348; rev:4; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_09_28, deployment Perimeter, former_category EXPLOIT_KIT, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain kvzstpqmeoxtcwko.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|kvzstpqmeoxtcwko|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015309; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT SEO Exploit Kit - client exploited"; flow:established,to_server; content:"/exe.php?exp="; http_uri; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2011813; rev:6; metadata:created_at 2010_10_13, former_category EXPLOIT_KIT, updated_at 2010_10_13;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain nbqypqrjiqxlfvdj.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|nbqypqrjiqxlfvdj|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015310; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Blackhole Exploit Kit Request tkr"; flow:established,to_server; content:".php?"; http_uri; content:"src="; http_uri; distance:0; content:"&gpr="; http_uri; distance:0; content:"&tkr="; http_uri; distance:0; pcre:"/[\?&]src=\d+&gpr=\d+&tkr[ib]?=[a-f0-9]+/U"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2013363; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_08_05, deployment Perimeter, former_category EXPLOIT_KIT, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2021_06_23;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain whddmvrxufbkkoew.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|whddmvrxufbkkoew|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015311; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Unknown Exploit Kit reporting Java and PDF state"; flow:established,to_server; content:"_js?java="; http_uri; fast_pattern; content:"&adobe_pdf="; http_uri; distance:0; pcre:"/\/[a-f0-9]{60,}_js\?/U"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2013690; rev:3; metadata:created_at 2011_09_24, former_category EXPLOIT_KIT, updated_at 2011_09_24;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain ymrhcvphevonympo.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|ymrhcvphevonympo|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015312; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Unknown Exploit Kit Java requesting malicious JAR"; flow:established,to_server; content:"_jar"; http_uri; fast_pattern; content:"|20|Java/"; http_header; pcre:"/\/[a-f0-9]{60,}_jar$/U"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2013691; rev:3; metadata:created_at 2011_09_24, former_category EXPLOIT_KIT, updated_at 2011_09_24;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain jveqgnmjxkocqifr.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|jveqgnmjxkocqifr|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015313; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Unknown Exploit Kit Java requesting malicious EXE"; flow:established,to_server; content:"_exe"; http_uri; fast_pattern; content:"|20|Java/"; http_header; pcre:"/\/[a-f0-9]{60,}_exe$/U"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2013692; rev:3; metadata:created_at 2011_09_24, former_category EXPLOIT_KIT, updated_at 2011_09_24;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain lavvckpordclbduy.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|lavvckpordclbduy|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015314; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Unknown Exploit Kit request for pdf_err__Error__Unspecified"; flow:established,to_server; content:"/pdf_err__Error__Unspecified error..gif"; http_uri; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2013693; rev:7; metadata:created_at 2011_09_24, former_category EXPLOIT_KIT, updated_at 2011_09_24;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain vhhzcvbegxbjsxke.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|vhhzcvbegxbjsxke|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015315; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Phoenix-style Exploit Kit Java Request with semicolon in URI"; flow:established,to_server; content:"/?"; http_uri; content:"|3b| 1|3b| "; http_uri; content:"|29| Java/1."; http_header; pcre:"/\/\?[a-z0-9]{65,}\x3b \d\x3b \d/U"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2011988; rev:5; metadata:created_at 2010_12_01, former_category EXPLOIT_KIT, updated_at 2017_04_13;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain xmwettbvtbhvrjuo.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|xmwettbvtbhvrjuo|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015316; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Blackhole-like Java Exploit request to .jar?t="; flow:established,to_server; content:".jar?t="; http_uri; nocase; fast_pattern; content:"&h="; http_uri; distance:0; content:"|29| Java/1."; http_header; pcre:"/\.jar\?t=\d+&h=[^&]+$/Ui"; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2014094; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_01_04, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain iujniiokeyjbmerc.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|iujniiokeyjbmerc|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015317; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET EXPLOIT_KIT Document.write Long Backslash UTF-16 Encoded Content - Exploit Kit Behavior Flowbit Set"; flow:established,to_client; content:"document.write|28 22 5C|u"; nocase; isdataat:100,relative; content:!"|29|"; within:100; content:"|5C|u"; nocase; distance:4; within:2; content:"|5C|u"; nocase; distance:4; within:2; content:"|5C|u"; nocase; distance:4; within:2; content:"|5C|u"; nocase; distance:70; content:"|5C|u"; nocase; distance:4; within:2; flowbits:set,et.exploitkitlanding; flowbits:noalert; reference:url,www.kahusecurity.com/2011/elaborate-black-hole-infection/; classtype:exploit-kit; sid:2014096; rev:6; metadata:created_at 2012_01_04, former_category EXPLOIT_KIT, updated_at 2012_01_04;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain kzxrowftdocgyghs.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|kzxrowftdocgyghs|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015318; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET EXPLOIT_KIT Excessive new Array With Newline - Exploit Kit Behavior Flowbit Set"; flow:established,to_client; content:" = new Array|28 29 3B|"; nocase; content:" = new Array|28 29 3B|"; nocase; within:100; content:" = new Array|28 29 3B|"; nocase; content:" = new Array|28 29 3B|"; nocase; within:100; content:" = new Array|28 29 3B|"; nocase; content:" = new Array|28 29 3B|"; nocase; within:100; flowbits:set,et.exploitkitlanding; flowbits:noalert; reference:url,www.kahusecurity.com/2011/elaborate-black-hole-infection/; classtype:exploit-kit; sid:2014097; rev:3; metadata:created_at 2012_01_04, former_category EXPLOIT_KIT, updated_at 2012_01_04;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain gacdiuwnhonuulpe.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|gacdiuwnhonuulpe|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015319; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT DRIVEBY SEO Exploit Kit request for Java exploit"; flow:established,to_server; content:"POST"; http_method; content:"id="; http_client_body; content:"|25 32 36|j"; distance:32; within:4; http_client_body; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2011349; rev:6; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_09_28, deployment Perimeter, former_category EXPLOIT_KIT, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Query to Zeus CnC DGA Domain ifrhgnqeeotnzrmz.ru Pseudo Random Domain"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|ifrhgnqeeotnzrmz|02|ru|00|"; nocase; distance:0; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015320; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown Exploit Kit Landing Response Malicious JavaScript"; flow:established,from_server; content:""; distance:64; within:83; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2014753; rev:5; metadata:created_at 2012_05_17, updated_at 2012_05_17;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP OutBlaze.com Spyware Activity"; flow: to_server,established; content:"/scripts/adpopper/webservice.main"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002044; classtype:pup-activity; sid:2002044; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED 0day JRE 17 exploit Class 1"; flow:established,to_client; content:"|0d 0a 0d 0a|PK"; content:"|2f|Gondvv.class"; distance:0; reference:url,blog.sucuri.net/2012/08/java-zero-day-in-the-wild.html; classtype:trojan-activity; sid:2015655; rev:5; metadata:created_at 2012_08_29, updated_at 2012_08_29;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Outerinfo.com Spyware Install"; flow: to_server,established; content:"/ctxad-"; nocase; http_uri; pcre:"/ctxad-\d+\.sig/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2001495; classtype:pup-activity; sid:2001495; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED 0day JRE 17 exploit Class 2"; flow:established,to_client; content:"|0d 0a 0d 0a|PK"; content:"|2f|Gondzz.class"; distance:0; reference:url,blog.sucuri.net/2012/08/java-zero-day-in-the-wild.html; classtype:trojan-activity; sid:2015656; rev:4; metadata:created_at 2012_08_29, updated_at 2012_08_29;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP EMO/PCPrivacyCleaner Rougue Secuirty App GET Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"action="; nocase; http_uri; content:"addt="; nocase; http_uri; content:"pc|5F|id="; nocase; http_uri; content:"abbr="; nocase; http_uri; reference:url,www.spywaresignatures.com/details/pcprivacycleaner.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2008456; classtype:pup-activity; sid:2008456; rev:5; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Fake AV base64 affid initial Landing or owned Check-In, asset owned if /callback/ in URI"; flow:established,to_server; content:"/?"; http_uri; content:"=YWZmaWQ9"; http_uri; classtype:trojan-activity; sid:2015649; rev:3; metadata:created_at 2012_08_22, updated_at 2012_08_22;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Pacimedia Spyware 1"; flow:to_server,established; content:"/mcp/mcp.cgi"; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002083; classtype:pup-activity; sid:2002083; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Downloader Checkin Pattern Used by Several Trojans"; flow:established,to_server; content:".php?"; http_uri; content:"uid="; http_uri; content:"&gid="; http_uri; content:"&cid="; http_uri; content:"&rid="; http_uri; content:"&sid="; http_uri; reference:url,doc.emergingthreats.net/2008143; classtype:trojan-activity; sid:2008143; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Adware PlusDream - GET Config Download/Update"; flow:established,to_server; content:"GET"; nocase; http_method; content:".php?kind="; nocase; http_uri; content:"&pid="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&addresses="; nocase; http_uri; content:"&hdmacid="; nocase; reference:url,doc.emergingthreats.net/2009712; classtype:pup-activity; sid:2009712; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32.boCheMan-A/Dexter"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/gateway.php"; http_uri; content:"page="; depth:5; http_client_body; content:"&unm="; fast_pattern:only; http_client_body; content:"&cnm="; http_client_body; content:"&query="; http_client_body; reference:md5,ccc99c9f07e7be0f408ef3a68a9da298; classtype:trojan-activity; sid:2016019; rev:5; metadata:created_at 2012_10_06, updated_at 2012_10_06;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Popuptraffic.com Bot Reporting"; flow: to_server,established; content:"/scripts/click.php?"; nocase; http_uri; content:"hid="; http_uri; reference:url,popuptraffic.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000577; classtype:policy-violation; sid:2000577; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Kazy/Kryptor/Cycbot Trojan Checkin 3"; flow:to_server,established; content:"GET"; nocase; http_method; content:"?pr="; fast_pattern; http_uri; content:!"Accept|3a|"; http_header; pcre:"/\.(jpg|png|gif|cgi)\?pr=/U"; classtype:trojan-activity; sid:2013866; rev:6; metadata:created_at 2011_11_08, updated_at 2011_11_08;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Privacyprotector.com Fake Anti-Spyware Install"; flow: to_server,established; content:"/privacyprotectorfreesetup.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003547; classtype:pup-activity; sid:2003547; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Medialoads.com Spyware Reporting (download.cgi)"; flow: to_server,established; content:"/dw/cgi/download.cgi?"; nocase; http_uri; content:"sn="; nocase; http_uri; content:"Host|3a|config.medialoads.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001508; classtype:trojan-activity; sid:2001508; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Privacyprotector.com Fake Anti-Spyware Checkin"; flow: to_server,established; content:"/?action="; nocase; http_uri; content:"&type="; nocase; http_uri; content:"&pc_id="; nocase; http_uri; content:"&abbr="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003548; classtype:trojan-activity; sid:2003548; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED FakeAV Checkin"; flow:to_server,established; content:"GET"; http_method; content:"/?affid="; depth:8; http_uri; content:"&promo_type="; http_uri; content:"&promo_opt="; http_uri; pcre:"/^\/\?affid=\d+&promo_type=\d+&promo_opt=\d+$/U"; reference:md5,527e115876d0892c9a0ddfc96e852a16; classtype:trojan-activity; sid:2016075; rev:3; metadata:created_at 2012_12_21, updated_at 2012_12_21;) -#alert http $HOME_NET any -> any any (msg:"ET ADWARE_PUP Pynix.dll BHO Activity"; flow: established,to_server; content:"ABETTERINTERNET.EXE"; nocase; http_uri; content:"bho=PYNIX.DLL"; nocase; http_uri; reference:url,www.pynix.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001748; classtype:pup-activity; sid:2001748; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible JKDDOS download b.exe"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/b.exe"; nocase; http_uri; reference:url,asert.arbornetworks.com/2011/03/jkddos-ddos-bot-with-an-interest-in-the-mining-industry; classtype:trojan-activity; sid:2012466; rev:3; metadata:created_at 2011_03_10, updated_at 2011_03_10;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED rcprograms"; flow: to_server,established; content:"update.rcprograms.com"; nocase; http_header; reference:url,sarc.com/avcenter/venc/data/adware.rcprograms.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000024; classtype:trojan-activity; sid:2000024; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED pamdql/Sweet Orange delivering hostile XOR trojan payload from robots.php"; flow:established,to_server; content:"/robots.php?"; http_uri; classtype:exploit-kit; sid:2016092; rev:3; metadata:created_at 2012_12_28, updated_at 2012_12_28;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Rdxrp.com Traffic"; flow: to_server,established; content:"/rdxr020304.dat"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001311; classtype:pup-activity; sid:2001311; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 1"; flow:to_server,established; content:"GET"; http_method; urilen:10; content:"/start.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016257; rev:3; metadata:created_at 2013_01_24, updated_at 2013_01_24;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Regnow.com Gamehouse.com Access"; flow: to_server,established; content:"/affiliates/template.jsp?"; nocase; http_uri; content:"AID="; nocase; http_uri; reference:url,www.gamehouse.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001224; classtype:pup-activity; sid:2001224; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 2"; flow:to_server,established; content:"GET"; http_method; urilen:10; content:"/setup.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016258; rev:3; metadata:created_at 2013_01_24, updated_at 2013_01_24;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Salongas Infection"; flow: to_server,established; content:"/sp.htm?id="; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2000601; classtype:pup-activity; sid:2000601; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 3"; flow:to_server,established; content:"GET"; http_method; urilen:11; content:"/search.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016259; rev:3; metadata:created_at 2013_01_24, updated_at 2013_01_24;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Search Relevancy Spyware"; flow: established,to_server; content:"/SearchRelevancy/SearchRelevancy.dll"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.relevancy.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001696; classtype:pup-activity; sid:2001696; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 4"; flow:to_server,established; content:"GET"; http_method; urilen:9; content:"/main.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016260; rev:4; metadata:created_at 2013_01_24, updated_at 2013_01_24;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchfeed.com Spyware 1"; flow: to_server,established; content:"/rd/Clk.jsp"; http_uri; reference:url,www.searchfeed.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002296; classtype:pup-activity; sid:2002296; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 5"; flow:to_server,established; content:"GET"; http_method; urilen:10; content:"/login.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016261; rev:3; metadata:created_at 2013_01_24, updated_at 2013_01_24;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchfeed.com Spyware 2"; flow: to_server,established; content:"/rd/feed/TextFeed.jsp"; http_uri; reference:url,www.searchfeed.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002297; classtype:pup-activity; sid:2002297; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 6"; flow:to_server,established; content:"GET"; http_method; urilen:9; content:"/main.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016262; rev:4; metadata:created_at 2013_01_24, updated_at 2013_01_24;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchfeed.com Spyware 3"; flow: to_server,established; content:"/rd/feed/XMLFeed.jsp"; http_uri; reference:url,www.searchfeed.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002298; classtype:pup-activity; sid:2002298; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 7"; flow:to_server,established; content:"GET"; http_method; urilen:12; content:"/welcome.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016263; rev:4; metadata:created_at 2013_01_24, updated_at 2013_01_24;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchfeed.com Spyware 4"; flow: to_server,established; content:"/rd/feed/JavaScriptFeed.jsp"; http_uri; reference:url,www.searchfeed.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002299; classtype:pup-activity; sid:2002299; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 8"; flow:to_server,established; content:"GET"; http_method; urilen:9; content:"/file.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016264; rev:4; metadata:created_at 2013_01_24, updated_at 2013_01_24;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchfeed.com Spyware 5"; flow: to_server,established; content:"/rd/feed/JavaScriptFeedSE.jsp"; http_uri; reference:url,www.searchfeed.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002300; classtype:pup-activity; sid:2002300; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 10"; flow:to_server,established; content:"GET"; http_method; urilen:9; content:"/home.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016266; rev:3; metadata:created_at 2013_01_24, updated_at 2013_01_24;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchfeed.com Spyware 6"; flow: to_server,established; content:"/rd/SearchResults.jsp"; http_uri; reference:url,www.searchfeed.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002301; classtype:pup-activity; sid:2002301; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 11"; flow:to_server,established; content:"GET"; http_method; urilen:11; content:"/online.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016267; rev:3; metadata:created_at 2013_01_24, updated_at 2013_01_24;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchfeed.com Spyware 7"; flow: to_server,established; content:"/rd/jsp/BidRank/index.jsp"; http_uri; reference:url,www.searchfeed.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002302; classtype:pup-activity; sid:2002302; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 12"; flow:to_server,established; content:"GET"; http_method; urilen:12; content:"/install.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016268; rev:3; metadata:created_at 2013_01_24, updated_at 2013_01_24;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchfeed.com Spyware 8"; flow: to_server,established; content:"/SFToolBar.html"; http_uri; reference:url,www.searchfeed.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002303; classtype:pup-activity; sid:2002303; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Fun Web Products Adware Agent Traffic"; flow: to_server,established; content:"FunWebProducts|3b|"; nocase; http_header; threshold: type limit, track by_src, count 2, seconds 360; reference:url,www.funwebproducts.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001034; classtype:policy-violation; sid:2001034; rev:23; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchmeup Spyware Install (d.exe)"; flow: to_server,established; content:"/x30/d.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001484; classtype:pup-activity; sid:2001484; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Linux/SSHDoor.A User Login CnC Beacon"; flow:established,to_server; content:"sid="; http_uri; content:"|3A|"; http_uri; content:"&uname="; http_uri; reference:url,blog.eset.com/2013/01/24/linux-sshdoor-a-backdoored-ssh-daemon-that-steals-passwords; classtype:command-and-control; sid:2016315; rev:3; metadata:attack_target Client_Endpoint, created_at 2013_01_30, deployment Perimeter, signature_severity Major, tag c2, updated_at 2013_01_30, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchmiracle.com Spyware Install (v3cab)"; flow: to_server,established; content:"/cab/v3cab.cab"; http_uri; reference:url,www.searchmiracle.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001540; classtype:pup-activity; sid:2001540; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 20192 (msg:"ET DELETED Ranky or variant backdoor communication ping"; dsize:<6; reference:url,www.sophos.com/virusinfo/analyses/trojranckcx.html; reference:url,www.iss.net/threats/W32.Trojan.Ranky.FV.html; classtype:trojan-activity; sid:2002728; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Searchmiracle.com Access, Likely Spyware"; flow: to_server,established; content:"Host|3a|"; nocase; http_header; content:".searchmiracle.com"; nocase; http_header; reference:url,securityresponse.symantec.com/avcenter/venc/data/trojan.elitebar.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001532; classtype:trojan-activity; sid:2001532; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> 212.26.42.47 9090 (msg:"ET DELETED Possible ProFTPD Backdoor Initiate Attempt"; flow:to_server; reference:url,xorl.wordpress.com/2010/12/02/news-proftpd-owned-and-backdoored/; reference:url,sourceforge.net/mailarchive/message.php?msg_name=alpine.DEB.2.00.1012011542220.12930%40familiar.castaglia.org; reference:url,slashdot.org/story/10/12/02/131214/ProFTPDorg-Compromised-Backdoor-Distributed; classtype:trojan-activity; sid:2011992; rev:3; metadata:created_at 2010_12_02, updated_at 2010_12_02;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchmiracle.com Spyware Install (install)"; flow: to_server,established; content:"/sideb.exe"; content:"Host|3a| install.searchmiracle.com"; nocase; http_header; reference:url,www.searchmiracle.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001744; classtype:pup-activity; sid:2001744; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Android/DNightmare - Task Killer Checkin 2"; flow:established,to_server; content:"GET"; http_method; content:"/pagead/afma_load_ads.js"; nocase; http_uri; fast_pattern; content:"pagead2.googlesyndication.com"; http_header; reference:md5,745513a53af2befe3dc00d0341d80ca6; classtype:trojan-activity; sid:2016386; rev:4; metadata:created_at 2013_02_08, updated_at 2013_02_08;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Searchmiracle.com Spyware Install - silent.exe"; flow: to_server,established; content:"/silent.exe"; nocase; http_uri; reference:url,www.searchmiracle.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002091; classtype:pup-activity; sid:2002091; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Android/DNightmare -Task Killer Checkin 3"; flow:established,to_server; content:"GET"; http_method; content:"/m/gne/suggest?q="; nocase; http_uri; fast_pattern; content:"SID=DQAAAKQAAAAHga"; http_cookie; reference:md5,745513a53af2befe3dc00d0341d80ca6; classtype:trojan-activity; sid:2016387; rev:4; metadata:created_at 2013_02_08, updated_at 2013_02_08;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Search Scout Related Spyware (content)"; flow: established,to_server; content:"Host|3a| content.searchscout.com"; nocase; http_header; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.searchscout.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001650; classtype:pup-activity; sid:2001650; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible g01pack Jar download"; flow:established,from_server; flowbits:isset,ET.g01pack.Java.Image; file_data; content:"PK"; depth:2; content:".class"; fast_pattern:only; classtype:exploit-kit; sid:2016321; rev:3; metadata:created_at 2013_01_31, updated_at 2013_01_31;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Search Scout Related Spyware (results)"; flow: established,to_server; content:"Host|3a| results.searchscout.com"; nocase; http_header; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.searchscout.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001653; classtype:pup-activity; sid:2001653; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Android/DNightmare - Task Killer Checkin 1"; flow:established,to_server; content:"GET"; http_method; content:"/pagead/ads?rsp="; nocase; http_uri; fast_pattern; content:"msid=com.droiddream.advancedtaskkiller1"; nocase; http_uri; classtype:trojan-activity; sid:2016385; rev:3; metadata:created_at 2013_02_08, updated_at 2013_02_08;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Seekmo.com Spyware Data Upload"; flow:established,to_server; content:".aspx?"; http_uri; content:"eid="; http_uri; content:"&pkg_ver="; http_uri; content:"&ver="; http_uri; content:"&brand="; http_uri; content:"&mt="; http_uri; content:"&partid="; content:"&altdid="; http_uri; content:"&os="; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2008356; classtype:pup-activity; sid:2008356; rev:4; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Skype VOIP Reporting Install"; flow: to_server,established; content:"/ui/"; nocase; http_uri; content:"/installed"; http_uri; nocase; reference:url,www1.cs.columbia.edu/~library/TR-repository/reports/reports-2004/cucs-039-04.pdf; reference:url,doc.emergingthreats.net/2001596; classtype:policy-violation; sid:2001596; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Servicepack.kr Fake Patch Software Checkin"; flow:established,to_server; content:".php?kind="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&ver2="; nocase; http_uri; content:"&ver3="; nocase; http_uri; content:"&pid="; nocase; http_uri; content:"&supportid="; nocase; http_uri; content:"&uniq="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2008016; classtype:pup-activity; sid:2008016; rev:4; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Featured-Results.com Agent Reporting Data"; flow: to_server,established; content:"action=any"; nocase; http_uri; content:"country="; nocase; http_uri; pcre:"/(POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/.*perl\/fr\.pl/i"; reference:url,www.featured-results.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001293; classtype:trojan-activity; sid:2001293; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Sexmaniack Install Tracking"; flow: to_server,established; content:"/counted.php?ref="; nocase; http_uri; content:"Host|3a| counter.sexmaniack.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001460; classtype:pup-activity; sid:2001460; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET 80 (msg:"ET DELETED NPRC Malicious POST Request Possible DOJ or DOT Malware"; flow:to_server; content:"POST"; nocase; http_method; content:"POST|2C|"; fast_pattern; nocase; depth:100; content:"ACCEPT|3A|"; nocase; within:300; reference:url,www.websense.com/securitylabs/alerts/alert.php?AlertID=835; reference:url,doc.emergingthreats.net/2007748; classtype:trojan-activity; sid:2007748; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Shop At Home Select.com Install Attempt"; flow: to_server,established; content:"/mindset/bunsetup.cab"; nocase; http_uri; reference:url,www.spywareguide.com/product_show.php?id=700; reference:url,www.shopathomeselect.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000580; classtype:pup-activity; sid:2000580; rev:9; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Corpsespyware.net BlackListed Malicious Domain - google.vc"; flow:to_server,established; content:"Host|3a|"; nocase; http_header; content:"google.vc"; nocase; http_header; reference:url,www.securityfocus.com/infocus/1745; reference:url,doc.emergingthreats.net/bin/view/Main/2002765; classtype:trojan-activity; sid:2002765; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP Shop At Home Select.com Install Download"; flow: from_server,established; content:"|ab 3b d4 97 d4 a7 b4 1d da 6e 6d 0f f4 aa 4f|"; content:"|46 b3 3b 8b 38 cc 2c 2a a4 c3 07 67 67 df 65 41|"; reference:url,www.spywareguide.com/product_show.php?id=700; reference:url,www.shopathomeselect.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000581; classtype:pup-activity; sid:2000581; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Stabuniq Observed C&C POST Target /rss.php"; flow:to_server,established; content:"POST"; http_method; content:"/rss.php"; http_uri; reference:url,www.symantec.com/connect/blogs/trojanstabuniq-found-financial-institution-servers; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2012-121809-2437-99&tabid=2; reference:url,contagiodump.blogspot.com/2012/12/dec-2012-trojanstabuniq-samples.html; classtype:trojan-activity; sid:2016131; rev:3; metadata:created_at 2012_12_29, updated_at 2012_12_29;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Shop at Home Select Spyware Heartbeat"; flow: established,to_server; content:"/s.dll?MfcISAPICommand=heartbeat¶m="; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.sahagent.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001708; classtype:pup-activity; sid:2001708; rev:10; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/Stabuniq CnC POST"; flow:established,to_server; content:"POST"; http_method; content:"/rssnews.php"; http_uri; content:!"User-Agent|3A|"; http_header; content:"id="; http_client_body; depth:3; content:"&varname="; distance:0; http_client_body; content:"&comp="; distance:0; http_client_body; content:"&src="; distance:0; http_client_body; reference:url,contagiodump.blogspot.co.uk/2012/12/dec-2012-trojanstabuniq-samples.html; reference:url,www.symantec.com/connect/blogs/trojanstabuniq-found-financial-institution-servers; classtype:command-and-control; sid:2016096; rev:4; metadata:created_at 2012_12_28, updated_at 2012_12_28;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Shop at Home Select Spyware Install"; flow: established,to_server; content:"/arcadecash/setup"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.sahagent.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002037; classtype:pup-activity; sid:2002037; rev:7; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/Ponik.Downloader Randomware Download"; flow:established,to_server; urilen:>60; content:"-.php"; fast_pattern; http_uri; content:"User-Agent|3A| Mozilla/5.0 (Windows NT 6.1|3B| WOW64) AppletWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11|0D 0A|"; http_header; pcre:"/\x2F[a-z\x2D]{60,120}.+\x2D\x2Ephp$/U"; reference:url,www.symantec.com/connect/blogs/fake-adobe-flash-update-installs-ransomware-performs-click-fraud; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2012-110915-5758-99; classtype:trojan-activity; sid:2016548; rev:3; metadata:created_at 2013_03_07, updated_at 2013_03_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Shopnav Spyware Install"; flow: to_server,established; content:"/toolbarv3.cgi?UID="; nocase; http_uri; content:"&version="; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.shopnav.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002000; classtype:pup-activity; sid:2002000; rev:7; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2010_07_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;) +#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS $ORACLE_PORTS (msg:"GPL DELETED dbms_repcat.add_priority_number buffer overflow attempt"; flow:to_server,established; content:"dbms_repcat.add_priority_number"; nocase; pcre:"/((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*\2|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))/si"; reference:url,www.appsecinc.com/resources/alerts/oracle/2004-0001/25.html; classtype:attempted-user; sid:2102726; rev:2; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SideStep Bar Install"; flow: to_server,established; content:"/servlet/sbinstservlet"; nocase; http_uri; reference:url,www.sidestep.com; reference:url,www.spyany.com/program/article_spw_rm_SideStep.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001016; classtype:pup-activity; sid:2001016; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 9"; flow:to_server,established; content:"GET"; http_method; urilen:12; content:"/default.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016265; rev:4; metadata:created_at 2013_01_24, updated_at 2013_01_24;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SideStep Bar Reporting Data"; flow: to_server,established; content:"/servlet/sblogservlet"; nocase; http_uri; reference:url,www.sidestep.com; reference:url,www.spyany.com/program/article_spw_rm_SideStep.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001017; classtype:pup-activity; sid:2001017; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 13"; flow:to_server,established; content:"GET"; http_method; urilen:10; content:"/index.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016281; rev:4; metadata:created_at 2013_01_25, updated_at 2013_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SideStep Bar Reporting Data (sbstart)"; flow: to_server,established; content:"/servlet/SbStartservlet"; nocase; http_uri; reference:url,www.sidestep.com; reference:url,www.spyany.com/program/article_spw_rm_SideStep.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002821; classtype:pup-activity; sid:2002821; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/Asprox Spam Module CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/index.php"; http_uri; content:"Content-Disposition|3A| form-data|3B| name=|22|sid|22|"; http_client_body; content:"Content-Disposition|3A| form-data|3B| name=|22|up|22|"; http_client_body; distance:0; content:"Content-Disposition|3A| form-data|3B| name=|22|ping|22|"; fast_pattern:32,11; http_client_body; distance:0; content:"Content-Disposition|3A| form-data|3B| name=|22|guid|22|"; distance:0; http_client_body; reference:url,www.welivesecurity.com/2013/03/08/sinkholing-trojan-downloader-zortob-b-reveals-fast-growing-malware-threat/; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-asprox-reborn.pdf; classtype:command-and-control; sid:2016561; rev:3; metadata:attack_target Client_Endpoint, created_at 2013_03_12, deployment Perimeter, signature_severity Major, tag c2, updated_at 2013_03_12, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Smartpops.com Spyware Install rh.exe"; flow: to_server,established; content:"/install/RH/rh.exe"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.smartpops.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001505; classtype:pup-activity; sid:2001505; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED thebestsoft4u.com Spyware Install (3)"; flow: to_server,established; content:"/pr.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001486; classtype:trojan-activity; sid:2001486; rev:9; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, updated_at 2010_07_30, mitre_tactic_id TA0009, mitre_tactic_name Collection, mitre_technique_id T1005, mitre_technique_name Data_from_local_system;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Smartpops.com Spyware Install"; flow: to_server,established; content:"/install/SE/sed.exe"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.smartpops.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001516; classtype:pup-activity; sid:2001516; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Empty HTTP Content Type Server Response - Potential CnC Server"; flow:established,to_client; content:"Content-Type|3A 20 0D 0A|"; http_header; classtype:command-and-control; sid:2016712; rev:3; metadata:created_at 2013_04_04, updated_at 2013_04_04;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Smartpops.com Spyware Update"; flow: to_server,established; content:"/data/spv15.dat?v="; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.smartpops.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001513; classtype:pup-activity; sid:2001513; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Generic Backdoor Retrieve Instructions/Configs - HTTP GET"; flow:established,to_server; content:"GET"; nocase; http_method; content:".php?aid="; fast_pattern; nocase; http_uri; content:"&pid="; http_uri; content:"&kind="; nocase; http_uri; content:!"User-Agent|3a|"; http_header; reference:url,doc.emergingthreats.net/2009826; classtype:trojan-activity; sid:2009826; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Soft-Show.cn Related Fake AV Install"; flow:established,to_server; content:"/setup/setup.asp?id="; nocase; http_uri; content:"&pcid="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&taday="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2008135; classtype:pup-activity; sid:2008135; rev:4; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 447 (msg:"ET DELETED Possible Bobax/Kraken/Oderoor TCP 447 CnC Channel Outbound"; flow:established; threshold:type threshold, track by_src, count 5, seconds 60; reference:url,doc.emergingthreats.net/bin/view/Main/OdeRoor; classtype:command-and-control; sid:2008110; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Soft-Show.cn Related Fake AV Install Ad Pull"; flow:established,to_server; content:"/setup/adClick.asp?Id="; nocase; http_uri; content:"&WebId="; nocase; http_uri; content:"&sDate="; nocase; http_uri; content:"&ver="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2008148; classtype:pup-activity; sid:2008148; rev:4; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET 447 -> $HOME_NET 1024: (msg:"ET DELETED Possible Bobax/Kraken/Oderoor TCP 447 CnC Channel Inbound"; flow:established; threshold:type threshold, track by_src, count 5, seconds 60; reference:url,doc.emergingthreats.net/bin/view/Main/OdeRoor; classtype:command-and-control; sid:2008108; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Softcashier.com Spyware Install Checkin"; flow:established,to_server; content:".php?wmid="; nocase; http_uri; content:"&subid="; nocase; http_uri; content:"&pid="; nocase; http_uri; content:"&lid="; nocase; http_uri; content:"&hs="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2007861; classtype:pup-activity; sid:2007861; rev:4; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 447 (msg:"ET DELETED Bobax/Kraken/Oderoor TCP 447 CnC Channel Initial Packet Outbound"; flow:established; dsize:24; threshold:type threshold, track by_src, count 2, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/OdeRoor; classtype:command-and-control; sid:2008103; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Softwarereferral.com Adware Checkin"; flow:established,to_server; content:"wmid="; nocase; http_uri; content:"&mid="; nocase; http_uri; content:"&lid="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2007696; classtype:pup-activity; sid:2007696; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert udp $EXTERNAL_NET 447 -> $HOME_NET 1024: (msg:"ET DELETED Possible Bobax/Kraken/Oderoor UDP 447 CnC Channel Inbound"; threshold:type threshold, track by_src, count 5, seconds 60; reference:url,doc.emergingthreats.net/bin/view/Main/OdeRoor; classtype:command-and-control; sid:2008107; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Possible Spambot Pulling IP List to Spam"; flow:established,to_server; content:"/devrandom/access.php"; nocase; http_uri; fast_pattern; content:"User-Agent|3a| Mozilla/4.0 (compatible)"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2002990; classtype:pup-activity; sid:2002990; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole/Cool plugindetect in octal -2 Mar 13 2013"; flow:established,from_server; file_data; content:"0156,0142,0156,0142,073,0171"; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2016636; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_03_21, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Possible Spambot getting new exe"; flow:established,to_server; content:"/traff/ppiigg.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002991; classtype:pup-activity; sid:2002991; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole/Cool plugindetect in octal -4 Mar 22 2013"; flow:established,from_server; file_data; content:"0154,0140,0154,0140,071,0167"; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2016661; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_03_22, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Specificclick.net Spyware Activity"; flow: to_server,established; content:"/adopt.sm?"; nocase; http_uri; content:"l="; nocase; http_uri; content:"&sz="; nocase; http_uri; content:"&redir="; nocase; http_uri; content:"&nmv="; nocase; http_uri; content:"&nrsz="; nocase; http_uri; content:"&r="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003450; classtype:pup-activity; sid:2003450; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole/Cool plugindetect in octal -5 Mar 26 2013"; flow:established,from_server; file_data; content:"0153,0137,0153,0137,070,0166"; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2016678; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_03_27, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Speedera Agent"; flow: to_server,established; content:"/io/downloads"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001320; classtype:trojan-activity; sid:2001320; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole/Cool plugindetect in octal -7 Mar 30 2013"; flow:established,from_server; file_data; content:"0151,0135,0151,0135,066,0164"; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2016686; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_04_01, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Speedera Agent (Specific)"; flow: to_server,established; content:"/io/downloads/3/wsem302.dl"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001321; classtype:pup-activity; sid:2001321; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole/Cool plugindetect in octal Mar 6 2013"; flow:established,from_server; file_data; content:"0160,0144,0160,0144,075,0173"; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2016544; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_03_07, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spy-Not.com Spyware Updating"; flow:to_server,established; content:"/updates1/SKVersion.ini"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003377; classtype:pup-activity; sid:2003377; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible XDocCrypt/Dorifel Checkin"; flow:established,to_server; content:"GET"; http_method; content:"&pin="; http_uri; content:"&crc="; http_uri; content:"&uniq="; http_uri; reference:url,www.fox-it.com/en/blog/xdoccryptdorifel-document-encrypting-and-network-spreading-virus; classtype:trojan-activity; sid:2015631; rev:6; metadata:created_at 2012_08_16, updated_at 2012_08_16;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spy-Not.com Spyware Pulling Fake Sigs"; flow:to_server,established; content:"/updates1/SKSignatures.zip"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003375; classtype:pup-activity; sid:2003375; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/Nymaim Checkin"; flow:to_server,established; content:"POST"; http_method; content:"/nymain/"; http_uri; fast_pattern:only; content:"/index.php"; http_uri; content:"filename="; http_client_body; content:"&data="; http_client_body; reference:md5,b904ce55532582a6ea516399d8e4b410; classtype:trojan-activity; sid:2016752; rev:3; metadata:created_at 2012_12_12, updated_at 2012_12_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SpySherriff Spyware Activity"; flow: to_server,established; content:"/progs_exe/jbsrak/"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002984; classtype:pup-activity; sid:2002984; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED SofosFO/NeoSploit possible second stage landing page (1)"; flow:established,to_server; urilen:>40; content:".js"; http_uri; pcre:"/^\/[a-z0-9A-Z]{25,35}\/(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+(_[e7uxMhp1Kt]+)?|a2\.\.)Z(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+|a2\.\.)\//U"; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2015889; rev:9; metadata:created_at 2012_11_16, updated_at 2012_11_16;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Jupitersatellites.biz Spyware Download"; flow: to_server,established; content:"/traff/ppiigg.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002987; classtype:pup-activity; sid:2002987; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED SofosFO - Landing Page"; flow:established,to_client; file_data; content:"BillyBonnyGetDepolo"; classtype:trojan-activity; sid:2016241; rev:4; metadata:created_at 2013_01_22, updated_at 2013_01_22;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SpySheriff Intial Phone Home"; flow:established,to_server; content:"trial.php?rest="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&a="; nocase; http_uri; content:"trial.php"; nocase; content:!"User-Agent|3a| "; http_header; reference:url,vil.nai.com/vil/content/v_135033.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2003251; classtype:pup-activity; sid:2003251; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED SofosFO/NeoSploit possible second stage landing page (2)"; flow:established,to_server; urilen:>25; content:"/highlands.js"; http_uri; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2016046; rev:6; metadata:created_at 2012_12_18, updated_at 2012_12_18;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SpyShredder Fake Anti-Spyware Install Download"; flow:established,to_server; content:"&advid="; nocase; http_uri; content:"&u="; nocase; http_uri; content:"&p="; nocase; http_uri; content:"?=______"; http_uri; content:"&vs="; nocase; http_uri; content:"&YZYYYYYYYYYYYYYYYYYYYYYYYYYY"; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2007593; classtype:pup-activity; sid:2007593; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED SofosFO/NeoSploit possible landing page 10/01/12"; flow:established,to_server; urilen:51; content:"/4ff"; http_uri; depth:4; pcre:"/^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$/U"; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2015750; rev:4; metadata:created_at 2012_10_01, updated_at 2012_10_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyaxe Spyware DB Update"; flow: to_server,established; content:"/updates/database/dbver.php"; nocase; http_uri; content:"spywareaxe"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2002804; classtype:pup-activity; sid:2002804; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED SofosFO/NeoSploit possible landing page 10/01/12 (2)"; flow:established,to_server; urilen:51; content:"/504"; http_uri; depth:4; pcre:"/^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$/U"; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2015751; rev:4; metadata:created_at 2012_10_01, updated_at 2012_10_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyaxe Spyware DB Version Check"; flow: to_server,established; content:"/updates/database/dbver.dat"; nocase; http_uri; content:"spywareaxe"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2002805; classtype:pup-activity; sid:2002805; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Windows EXE with alternate byte XOR 51 - possible SofosFO/NeoSploit download"; flow:established,to_client; content:"|0d 0a|Mi"; isdataat:76,relative; content:"|54 5b 69 40 20 43 72 5c 67 41 61 5e 20 50 61 5d 6e 5c 74 13 62 56 20 41 75 5d 20 5a 6e 13 44 7c 53 13 6d 5c 64 56|"; distance:0; classtype:trojan-activity; sid:2015752; rev:3; metadata:created_at 2012_10_01, updated_at 2012_10_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyaxe Spyware Checkin"; flow: to_server,established; content:"/download.php?sid="; nocase; http_uri; content:"spyaxe"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2002806; classtype:pup-activity; sid:2002806; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Sweet Orange Java obfuscated binary (1)"; flow:established,to_client; flowbits:isset,ET.http.javaclient; file_data; content:"|22 2a|"; within:2; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2016112; rev:3; metadata:created_at 2012_12_29, updated_at 2012_12_29;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Spylog.ru Related Spyware Checkin"; flow:established,to_server; content:"/cnt?"; nocase; http_uri; content:"cid="; nocase; http_uri; content:"&p="; nocase; http_uri; content:"&rn="; nocase; http_uri; content:"&c="; nocase; http_uri; content:"&tl="; nocase; http_uri; content:"&ls="; nocase; http_uri; content:"&ln="; nocase; http_uri; content:"&t="; nocase; http_uri; content:"&j="; nocase; http_uri; content:"&wh="; nocase; http_uri; content:"&px="; nocase; http_uri; content:"&sl="; nocase; http_uri; content:"&r="; nocase; http_uri; content:"&fr="; nocase; http_uri; content:"&pg="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2007649; classtype:trojan-activity; sid:2007649; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Sweet Orange Java obfuscated binary (2)"; flow:established,to_client; flowbits:isset,ET.http.javaclient; file_data; content:"|3d 3b|"; within:2; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2016143; rev:3; metadata:created_at 2013_01_03, updated_at 2013_01_03;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyspotter.com Install"; flow: to_server,established; content:"/SpySpotterInstall.cab"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001536; classtype:pup-activity; sid:2001536; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED HTTP Request to a Zeus CnC DGA Domain ehyewyqydfpidbdp.ru"; flow:established,to_server; content:"|3a| ehyewyqydfpidbdp.ru|0D 0A|"; fast_pattern:only; http_header; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:command-and-control; sid:2015161; rev:3; metadata:created_at 2012_07_12, updated_at 2012_07_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyspotter.com Access"; flow: to_server,established; content:"Host|3a| "; http_header; content:"spyspotter.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001537; classtype:pup-activity; sid:2001537; rev:15; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Blackhole request for file containing Java payload URIs (1)"; flow:established,to_server; content:".php?asd=12gqw"; http_uri; content:"|29 20|Java/"; http_user_agent; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2015843; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_10_26, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SpywareLabs Application Install"; flow: to_server,established; content:"/DistID/BaseInstalls/V"; nocase; http_uri; content:"User-Agent|3a|"; nocase; http_header; content:"Wise"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001522; classtype:pup-activity; sid:2001522; rev:14; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Java applet with obfuscated URL Oct 19 2012"; flow:established,from_server; file_data; content:"applet"; fast_pattern; content:"&|23|48|3b|&|23|98|3b|&|23|48|3b|&|23|57|3b|&|23|48|3b|&|23|57|3b|&|23|48|3b|&|23|52|3b|&|23|49|3b|&|23|102|3b|"; within:300; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2015823; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_10_19, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyware Stormer Reporting Data"; flow: established,to_server; content:"/showme.aspx?keyword="; nocase; http_uri; content:"ecomdata1="; nocase; http_client_body; reference:url,www.spywarestormer.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001570; classtype:pup-activity; sid:2001570; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole file containing obfuscated Java payload URIs"; flow:established,from_server; file_data; content:"0b0909041f3131"; within:14; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2015844; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_10_26, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyware Stormer/Error Guard Activity"; flow: established,to_server; content:"/sell.cgi?errorguard/1/errorguard"; nocase; http_uri; reference:url,www.spywarestormer.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001571; classtype:pup-activity; sid:2001571; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Blackhole alt URL request Sep 05 2012 bv6rcs3v1ithi.php?w="; flow:established,to_server; content:"/bv6rcs3v1ithi.php?w="; http_uri; reference:url,urlquery.net/report.php?id=158608; classtype:attempted-user; sid:2015684; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_09_06, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Statblaster Receiving New configuration (allfiles)"; flow: to_server,established; content:"/updatestats/all_files"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.statblaster.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001523; classtype:policy-violation; sid:2001523; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole repetitive applet/code tag"; flow:established,from_server; file_data; content:"applet/code="; content:"/archive="; distance:0; content:".jar"; distance:0; pcre:"/applet\/code=[\x22\x27](?P[a-zA-Z0-9]+)[a-z]\.(?P=val1)[a-z][\x22\x27][^\x3e]+\.jar[\x22\x27]/"; classtype:trojan-activity; sid:2015697; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_09_12, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Statblaster.MemoryWatcher Download"; flow: to_server,established; content:"/memorywatcher.exe"; http_uri; reference:url,www.memorywatcher.com/eula.aspx; reference:url,doc.emergingthreats.net/bin/view/Main/2001442; classtype:pup-activity; sid:2001442; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Java applet with obfuscated URL 23 Aug 2012"; flow:established,from_server; content:"applet"; content:"0xb|3a|0x9|3a|0x9|3a|0x4|3a|0x1f|3a|0x31|3a|0x31|3a|"; within:200; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2015652; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_23, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SurfSidekick Activity (ipixel)"; flow: established,to_server; content:"/ipixel.htm?cid="; nocase; http_uri; content:"&pck_id="; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.surfsidekick.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001994; classtype:pup-activity; sid:2001994; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Javascript 23 Aug 2012 split join split applet"; flow:established,from_server; content:"|3c|script"; content:"split(|22|"; within:40; content:".join(|22 22|).split(|22 22 29 3b|"; within:50; classtype:trojan-activity; sid:2015651; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_23, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SurfSidekick Activity (rinfo)"; flow: established,to_server; content:"/rinfo.htm?"; nocase; http_uri; content:"host="; nocase; http_uri; content:"action="; nocase; http_uri; content:"client=SSK"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.surfsidekick.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002738; classtype:pup-activity; sid:2002738; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Landing Page ChildNodes.Length - August 13th 2012"; flow:established,to_client; content:"=0|3B|i $EXTERNAL_NET any (msg:"ET ADWARE_PUP SurfAccuracy.com Spyware Pulling Ads"; flow:to_server,established; content:"/sacc/popup.php"; nocase; http_uri; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2005-062716-0109-99; reference:url,doc.emergingthreats.net/bin/view/Main/2003391; classtype:pup-activity; sid:2003391; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Landing Page JavaScript Replace - 13th August 2012"; flow:established,to_client; file_data; content:"=document.body.childNodes["; content:"].innerHTML.replace(/"; distance:1; within:21; content:"/g,|22 22|)|3B|"; within:30; classtype:trojan-activity; sid:2015620; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_13, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SurfAssistant.com Spyware Install"; flow: to_server,established; content:"/distribution/questmod-1.dll"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.sa.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001510; classtype:pup-activity; sid:2001510; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Specific JavaScript Replace hwehes - 8th August 2012"; flow:established,to_client; content:".replace(/hwehes/g"; classtype:trojan-activity; sid:2015592; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_09, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SurfAssistant.com Spyware Reporting"; flow: to_server,established; content:"/sa/?a="; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.sa.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001514; classtype:pup-activity; sid:2001514; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Potential Blackhole Zeus Drop - 8th August 2012"; flow:established,to_client; content:"P|00|r|00|o|00|d|00|u|00|c|00|t|00|N|00|a|00|m|00|e"; content:"n|00|o|00|n|00|a|00|m|00|e"; fast_pattern; within:15; classtype:trojan-activity; sid:2015591; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_09, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SysVenFak Fake AV Package Victim Checkin (victim.php)"; flow:established,to_server; content:"/victim.php?"; http_uri; pcre:"/victim\.php\?\d\d\d\d\d/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2007945; classtype:pup-activity; sid:2007945; rev:4; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Landing Page Intial Structure - 8th August 2012"; flow:established,to_client; content:"|0d 0a 0d 0a 3C|html|3E 3C|body|3E 3C|script|3E|"; content:"=function|28 29 7B|"; fast_pattern; distance:1; within:12; classtype:trojan-activity; sid:2015590; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_09, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Sytes.net Related Spyware Reporting"; flow:to_server,established; content:"/Reporting/admin/upload.php"; nocase; http_uri; content:"POST"; nocase; http_method; content:"sytes.net"; nocase; http_header; reference:url,www.sophos.com/security/analyses/w32forbotdv.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003533; classtype:pup-activity; sid:2003533; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Blackhole Redirection Page You Will Be Forwarded - 7th August 2012"; flow:established,to_client; content:"

Please wait a moment. You will be forwarded...<|2F|h1><|2F|b>"; classtype:trojan-activity; sid:2015582; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_07, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP TargetNetworks.net Spyware Reporting (req)"; flow: to_server,established; content:"/request/req.cgi?gu="; nocase; http_uri; content:"&sid="; nocase; http_uri; content:"&kw="; nocase; http_uri; reference:url,www.targetnetworks.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001997; classtype:pup-activity; sid:2001997; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Replace JavaScript Large Obfuscated Blob - August 3rd 2012"; flow:established,to_client; file_data; content:"=|22|"; isdataat:300,relative; content:"|22|"; within:300; content:"|22|.replace(/"; distance:0; content:"/g.|22 22 29 3B|"; fast_pattern; within:30; classtype:trojan-activity; sid:2015580; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_07, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP TargetNetworks.net Spyware Reporting (tn)"; flow: to_server,established; content:"/data/tn.dat?v="; nocase; http_uri; content:"&sid="; nocase; http_uri; reference:url,www.targetnetworks.com; reference:url,doc.emergingthreats.net/bin/view/Main/2002046; classtype:pup-activity; sid:2002046; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Landing Page Applet Structure"; flow:established,to_client; file_data; content:"<|2F|script><|2F|body><|2F|html>"; distance:0; pcre:"/code\x3D\x22[a-z]{4}\x2E[a-z]{4}\x22/i"; classtype:trojan-activity; sid:2015520; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_24, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP thebestsoft4u.com Spyware Install (1)"; flow: to_server,established; content:"/pa/glx.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001482; classtype:pup-activity; sid:2001482; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Landing Page Split String Obfuscated Math Floor - July 19th 2012"; flow:established,to_client; file_data; content:"=Math|3B|"; content:"[|22|f"; distance:0; content:"|22|+|22|"; within:15; content:"r|22|]"; within:12; classtype:trojan-activity; sid:2015519; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_24, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP thebestsoft4u.com Spyware Install (2)"; flow: to_server,established; content:"/pa/proxyrnd.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001485; classtype:pup-activity; sid:2001485; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Eval Split String Obfuscation In Brackets"; flow:established,to_client; file_data; content:"[|22|e"; fast_pattern; content:"|22|+|22|"; within:11; content:"l|22|]"; within:11; pcre:"/\x7B\x22e(v|x22\x2B\x22)(v|x22\x2B\x22|a)(a|v|x22\x2B\x22)[^\x5D]*?l\x22\x5D/"; classtype:trojan-activity; sid:2015477; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_14, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Tibsystems Spyware Install (1)"; flow: to_server,established; content:"/fcgi-bin/iza2.fcgi?m="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001729; classtype:pup-activity; sid:2001729; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED BlackHole Landing Page /upinv.html"; flow:established,to_server; content:"/upinv.html"; http_uri; classtype:trojan-activity; sid:2015476; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_14, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Tibsystems Spyware Install (2)"; flow: to_server,established; content:"/tb/loader2.ocx"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001734; classtype:pup-activity; sid:2001734; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Request For Blackhole Landing Page Go.php"; flow:established,to_server; content:"/go.php?d="; http_uri; pcre:"/\x2Fgo\x2Ephp\x3Dd\x3D[a-f0-9]{16}$/U"; classtype:trojan-activity; sid:2015049; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_12, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP ToolbarPartner Spyware Spambot Retrieving Target Emails"; flow: established,to_server; content:"/mailz.php?id="; nocase; http_uri; reference:url,toolbarpartner.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001895; classtype:pup-activity; sid:2001895; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole2 - Landing Page Received"; flow:established,to_client; file_data; content:" $EXTERNAL_NET any (msg:"ET ADWARE_PUP TopMoxie Reporting Data to External Host"; flow: to_server,established; content:"/downloads/record_download.asp"; nocase; pcre:"/(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/downloads\/record_download\.asp/i"; reference:url,www.topmoxie.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000588; classtype:pup-activity; sid:2000588; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Blackhole 2.0 PDF GET request"; flow:established,to_server; content:".php?"; http_uri; content:"00020002"; http_uri; fast_pattern:only; pcre:"/\.php\?\w{2,9}\=(0[0-9a-b]|3[0-9]){5}\&\w{3,9}\=(3[0-9a-f]|4[0-9a-f])\&\w{3,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{3,9}\=(0[0-9a-b]{1,8})00020002$/U"; reference:url,fortknoxnetworks.blogspot.com/2012/11/deeper-into-blackhole-urls-and-dialects.html; classtype:attempted-user; sid:2015864; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_11_06, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Toprebates.com Install (1)"; flow: established,to_server; content:"/mailz.php?id="; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.webrebates.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001646; classtype:pup-activity; sid:2001646; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Unknown Trojan POST"; flow:established,to_server; content:"POST"; http_method; content:"Content-Length|3a| 0|0d 0a|"; http_header; content:"/a/"; http_uri; fast_pattern; content:"PHPSESSID="; http_cookie; content:!"Referer|3a 20|"; http_header; classtype:trojan-activity; sid:2016834; rev:2; metadata:created_at 2013_05_08, updated_at 2013_05_08;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Toprebates.com Install (2)"; flow: established,to_server; content:"/builds/"; nocase; http_uri; content:"AutoTrack_Install.exe"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.webrebates.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001647; classtype:pup-activity; sid:2001647; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Tornado Pack Binary Request"; flow:established,to_server; content:"GET"; http_method; content:"?o="; http_uri; content:"&t="; http_uri; content:"&i="; http_uri; content:"&e="; http_uri; reference:url,dxp2532.blogspot.com/2009/05/tornado-exploit-pack.html; classtype:trojan-activity; sid:2009389; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Toprebates.com User Confirming Membership"; flow: established,to_server; content:"/cgi/account.plx?pid="; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.webrebates.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001648; classtype:pup-activity; sid:2001648; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Zbot/Zeus C&C Access"; flow:to_server,established; content:"in.php?m=home"; http_uri; reference:url,doc.emergingthreats.net/2009175; classtype:trojan-activity; sid:2009175; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP Ezula Installer Download"; flow: from_server,established; content:"|65 5a 75 6c 61 20 49 6e 73 74 61 6c 6c 61 74 69 6f 6e 00 49|"; reference:url,www.ezula.com; reference:url,www.spyany.com/program/article_spw_rm_eZuLa.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001335; classtype:pup-activity; sid:2001335; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED TrojanSpy.KeyLogger Hangover Campaign User-Agent(wininetget/0.1)"; flow:established,to_server; content:"wininetget/"; nocase; depth:11; http_user_agent; reference:url,blogs.rsa.com/dont-fear-the-hangover-network-detection-of-hangover-malware-samples; reference:url,enterprise.norman.com/resources/files/unveiling_an_indian_cyberattack_infrastructure_appendixes.pdf; classtype:trojan-activity; sid:2016889; rev:5; metadata:created_at 2013_05_21, updated_at 2013_05_21;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spywaremover Activity"; flow: to_server,established; content:"/spywareremovers.php?"; http_uri; content:"Host|3a| topantispyware.com"; nocase; http_header; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.topantispyware.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001520; classtype:pup-activity; sid:2001520; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 2"; flow:to_server,established; pcre:"/^\d+?.\x00\x00\x00/"; byte_extract:4,-4,d_size,relative,little; byte_test:4,>,d_size,0,relative,little; content:"|78 9c|"; distance:4; within:2; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; classtype:command-and-control; sid:2016962; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_06_01, deployment Perimeter, malware_family Gh0st, malware_family PCRAT, performance_impact Significant, signature_severity Critical, tag PCRAT, tag Gh0st, tag RAT, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Topconverting Spyware Install"; flow: to_server,established; content:"/activex/weirdontheweb_topc.exe"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002004; classtype:pup-activity; sid:2002004; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert udp $EXTERNAL_NET any -> $HOME_NET 5060 (msg:"ET DELETED Possible Open SIP Relay scanner Fake Eyebeam User-Agent Detected"; content:"User-Agent|3A| eyeBeam release"; nocase; reference:url,honeynet.org.au/?q=open_sip_relay_scanner; classtype:attempted-recon; sid:2012183; rev:3; metadata:created_at 2011_01_15, updated_at 2011_01_15;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Topconverting Spyware Reporting"; flow: to_server,established; content:"/trigger.php?partner="; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002040; classtype:pup-activity; sid:2002040; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED pamdql applet with obfuscated URL"; flow:established,from_server; file_data; content:"applet"; fast_pattern; content:"103hj115hj115hj111hj57hj46hj46hj"; within:200; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2015739; rev:6; metadata:created_at 2012_09_26, updated_at 2012_09_26;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Traffic Syndicate Add/Remove"; flow: to_server,established; content:"/Support/AddRemove.aspx?id="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001313; classtype:pup-activity; sid:2001313; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED pamdql obfuscated javascript _222_ padding"; flow:established,from_server; file_data; content:"d_222_o_222_c_222_u_222_"; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2015785; rev:4; metadata:created_at 2012_10_09, updated_at 2012_10_09;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Traffic Syndicate Agent Updating (1)"; flow: to_server,established; content:"/TbLinkConfig.asmx"; nocase; http_uri; threshold: type limit, track by_src, count 1, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/2001315; classtype:pup-activity; sid:2001315; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED pamdql obfuscated javascript -_-- padding"; flow:established,from_server; file_data; content:"d-_--o-_--c-_--u-_--"; within:500; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2015801; rev:4; metadata:created_at 2012_10_16, updated_at 2012_10_16;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Traffic Syndicate Agent Updating (2)"; flow: to_server,established; content:"/TbInstConfig.asmx"; nocase; http_uri; threshold: type limit, track by_src, count 1, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/2001316; classtype:pup-activity; sid:2001316; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED pamdql obfuscated javascript __-_ padding"; flow:established,from_server; file_data; content:"d__-_o__-_c__-_u__-_m__-_e__-_n__-_t"; within:500; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2015845; rev:4; metadata:created_at 2012_10_26, updated_at 2012_10_26;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Trafficsector.com Spyware Install"; flow: to_server,established; content:"/install.php?"; nocase; http_uri; content:"afid="; nocase; http_uri; content:"&user_id="; http_uri; content:"trafficsector"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2002736; classtype:pup-activity; sid:2002736; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Softspydelete.com Fake Anti-Spyware Checkin"; flow:established,to_server; content:".php?"; nocase; http_uri; content:"a1="; nocase; http_uri; content:"&a2="; nocase; http_uri; content:"&a3="; nocase; http_uri; content:"Windows"; nocase; http_uri; content:"&a4=Build"; nocase; http_uri; content:"&a5="; nocase; http_uri; content:"&table="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2007842; classtype:trojan-activity; sid:2007842; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Transponder Spyware Activity"; flow:established,to_server; content:"/sendROIcookie.cfm?refer="; nocase; http_uri; reference:url,www.doxdesk.com/parasite/Transponder.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002320; classtype:pup-activity; sid:2002320; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Zhelatin Variant Checkin"; flow:established,to_server; content:"/adload.php?a1="; nocase; http_uri; content:"a3="; nocase; http_uri; content:"&a4="; nocase; http_uri; content:"&a5="; nocase; http_uri; content:!"User-Agent|3a|"; http_header; content:"Host|3a|"; http_header; reference:url,doc.emergingthreats.net/2003408; classtype:trojan-activity; sid:2003408; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Travel Update Spyware"; flow:established,to_server; content:"/abt?data="; nocase; http_uri; pcre:"/\/abt\?data=\S{150}/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2003297; classtype:pup-activity; sid:2003297; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED TrojanSpy.KeyLogger Hangover Campaign User-Agent(file)"; flow:established,to_server; content:"User-Agent|3a| file|0d 0a|"; nocase; http_header; reference:url,blogs.rsa.com/dont-fear-the-hangover-network-detection-of-hangover-malware-samples; reference:url,enterprise.norman.com/resources/files/unveiling_an_indian_cyberattack_infrastructure_appendixes.pdf; classtype:trojan-activity; sid:2016890; rev:3; metadata:created_at 2013_05_21, updated_at 2013_05_21;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Adware/Spyware Trymedia.com EXE download"; flow:established,to_server; content:"GET"; nocase; http_method; content:".exe?nva="; http_uri; content:"&aff="; http_uri; content:"&token="; http_uri; content:"User-Agent|3a| Macrovision_DM"; nocase; http_header; reference:url,www.browserdefender.com/site/trymedia.com; reference:url,www.threatexpert.com/reports.aspx?find=Adware.Trymedia; reference:url,doc.emergingthreats.net/2009091; classtype:pup-activity; sid:2009091; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED DNS Query for Sykipot C&C www.prettylikeher.com"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|prettylikeher|03|com"; fast_pattern; distance:0; nocase; reference:cve,CVE-2011-2462; reference:url,contagiodump.blogspot.com/2011/12/adobe-zero-day-cve-2011-2462.html; classtype:trojan-activity; sid:2014005; rev:3; metadata:created_at 2011_12_09, updated_at 2011_12_09;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP /jk/exp.wmf Exploit Code Load Attempt"; flow:to_server,established; content:"/jk/exp.wmf"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002999; classtype:pup-activity; sid:2002999; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Gator/Clarian Spyware Posting Data"; flow: to_server,established; content:"/gs_med"; nocase; http_uri; reference:url,www3.ca.com/securityadvisor/pest/content.aspx?q=67999; reference:url,doc.emergingthreats.net/bin/view/Main/2003575; classtype:trojan-activity; sid:2003575; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP PopupSh.ocx Access Attempt"; flow:to_server,established; content:"/PopupSh.ocx"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003000; classtype:pup-activity; sid:2003000; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Sakura Jar Download SET"; flow:established,to_server; content:".php"; http_uri; content:"Java/1."; http_user_agent; fast_pattern; flowbits:set,ET.Sakura.php.Java; flowbits:noalert; classtype:trojan-activity; sid:2016720; rev:5; metadata:created_at 2013_04_04, updated_at 2013_04_04;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Sidelinker.com-Upspider.com Spyware Count"; flow:established,to_server; content:"/Pro/cnt.php?mac="; nocase; http_uri; content:"&key="; nocase; http_uri; content:"&pid="; nocase; http_uri; pcre:"/\/Pro\/cnt\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d+/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2008158; classtype:pup-activity; sid:2008158; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED CrimeBoss - Java Exploit - m11.jar"; flow:established,to_server; content:"/m11.jar"; http_uri; content:"Java/1."; http_user_agent; classtype:trojan-activity; sid:2016597; rev:5; metadata:created_at 2013_03_20, updated_at 2013_03_20;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP V-Clean.com Fake AV Checkin"; flow:established,to_server; content:"/bill_mod/bill_count.php?C_FLAG="; fast_pattern; http_uri; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 5.5|3b| Windows 98)"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2008180; classtype:pup-activity; sid:2008180; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED BlackHole EK Non-standard base64 Key"; flow:established,from_server; file_data; content:"keyStr = |22|"; content:!"|22|"; within:65; content:"|22|"; distance:65; within:1; content:!"0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"; distance:-66; within:62; content:!"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"; distance:-66; within:62; content:!"abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"; distance:-66; within:62; content:!"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"; distance:-66; within:62; content:!"ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz"; distance:-66; within:62; content:!"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; distance:-66; within:62; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2017164; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_07_19, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP VPP Technologies Spyware"; flow:established,to_server; content:"/DittoIA.jsh?pid="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002348; classtype:pup-activity; sid:2002348; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Sinowal/Mebroot/Torpig Client POST"; flow:to_server,established; content:"POST"; depth:4; http_method; content:"|0d 0a|Connection|3a| close|0d 0a 0d 0a a9 3a d4 31 4b 84|"; fast_pattern; reference:url,doc.emergingthreats.net/2008520; classtype:trojan-activity; sid:2008520; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP VPP Technologies Spyware Reporting URL"; flow:established,to_server; content:"/js.vppimage?key="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2002350; classtype:pup-activity; sid:2002350; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible g01pack Exploit Pack Malicious JAR File Request"; flow:established,to_server; content:".jar"; http_uri; fast_pattern; content:"User-Agent|3a|"; nocase; http_header; content:"Java/"; within:200; http_header; pcre:"/\/[0-9a-f]{32}\.jar$/U"; reference:url,blog.tllod.com/2010/11/03/statistics-dont-lie-or-do-they/; reference:url,community.websense.com/blogs/securitylabs/archive/2011/04/19/Mass-Injections-Leading-to-g01pack-Exploit-Kit.aspx; classtype:exploit-kit; sid:2012807; rev:4; metadata:created_at 2011_05_15, updated_at 2011_05_15;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Virtumonde Spyware siae3123.exe GET"; flow: to_server,established; content:"siae3123.exe"; nocase; http_uri; reference:url,sarc.com/avcenter/venc/data/adware.virtumonde.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000306; classtype:trojan-activity; sid:2000306; rev:29; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Suspicious User Agent (iexplorer)"; flow:to_server,established; content:"User-Agent|3a 20|iexplorer|0d 0a|"; http_header; classtype:trojan-activity; sid:2016140; rev:5; metadata:created_at 2013_01_03, updated_at 2013_01_03;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Virtumonde Spyware Information Post"; flow: to_server,established; content:"POST"; nocase; http_method; content:"e_g_StatisticsUploadDelay"; nocase; content:"g_AffiliateID"; nocase; content:"virtumonde.com"; http_header; reference:url,sarc.com/avcenter/venc/data/adware.virtumonde.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000308; classtype:trojan-activity; sid:2000308; rev:24; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED PoisonIvy.fishplay Keepalive to CnC"; flow:established,to_server; content:"|77 1b 13 19 a2 d1 8d a1 b5 05 8f fa 3f aa c0 8a|"; offset:16; depth:16; dsize:48; reference:url,www.fireeye.com/resources/pdfs/fireeye-poison-ivy-report.pdf; classtype:command-and-control; sid:2017361; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_08_21, deployment Perimeter, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Virtumonde Spyware Code Download mmdom.exe"; flow: to_server,established; content:"/mmdom.exe"; nocase; http_uri; reference:url,sarc.com/avcenter/venc/data/adware.virtumonde.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001525; classtype:pup-activity; sid:2001525; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Browseraid.com Agent Updating"; flow: to_server,established; content:"/perl/uptodate.pl"; nocase; http_uri; content:"uptodate.browseraid.com"; nocase; http_header; reference:url,www.browseraid.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001304; classtype:trojan-activity; sid:2001304; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Virtumonde Spyware Code Download bkinst.exe"; flow: to_server,established; content:"/bkinst.exe"; nocase; http_uri; content:"virtumonde.com"; http_header; reference:url,www.lurhq.com/iframeads.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001526; classtype:pup-activity; sid:2001526; rev:23; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Apple CoreText Exploit Specific string"; flow:established,from_server; file_data; content:"|D8 B3 D9 85 D9 8E D9 80 D9 8E D9 91 D9 88 D9 8F D9 88 D9 8F D8 AD D8 AE 20 CC B7 CC B4 CC 90 D8 AE 20 CC B7 CC B4 CC 90 D8 AE 20 CC B7 CC B4 CC 90 D8 AE 20 D8 A7 D9 85 D8 A7 D8 B1 D8 AA D9 8A D8 AE 20 CC B7 CC B4 CC 90 D8 AE|"; reference:url,techcrunch.com/2013/08/29/bug-in-apples-coretext-allows-specific-string-of-characters-to-crash-ios-6-os-x-10-8-apps/; classtype:bad-unknown; sid:2017397; rev:2; metadata:created_at 2013_08_30, updated_at 2013_08_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Vombanetworks.com Spyware Installer Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/scripts/get_cookie.php"; nocase; http_uri; content:"vomba="; http_client_body; depth:6; content:"&ff="; content:"&vombashots="; content:"&vombashots_ff="; content:"&hwd="; content:"&ver="; content:"&vinfo=Windows"; reference:url,doc.emergingthreats.net/bin/view/Main/2007870; classtype:pup-activity; sid:2007870; rev:4; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Winsoftware.com Spyware Activity"; flow: to_server,established; content:"/?proto="; nocase; http_uri; content:"&rc="; nocase; http_uri; content:"&abbr="; nocase; http_uri; content:"platform="; nocase; http_uri; content:"&os_version="; nocase; http_uri; content:"&appid="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003471; classtype:trojan-activity; sid:2003471; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Weatherbug"; flow: to_server,established; content:"WxAlertIsapi"; nocase; http_uri; threshold: type limit, track by_src, count 1, seconds 3600; reference:url,doc.emergingthreats.net/bin/view/Main/2001235; classtype:misc-activity; sid:2001235; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Weird on the Web /180 Solutions Update"; flow: to_server,established; content:"/notifier/updates"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002041; classtype:trojan-activity; sid:2002041; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Weatherbug Wxbug Capture"; flow: to_server,established; content:"GET"; nocase; http_method; content:"Host|3a|"; nocase; http_header; content:"wxbug.com"; nocase; http_header; threshold: type limit, track by_src, count 1, seconds 3600; reference:url,doc.emergingthreats.net/bin/view/Main/2002364; classtype:misc-activity; sid:2002364; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Browseraid.com Agent Reporting Data"; flow: to_server,established; content:"/perl/ads.pl"; nocase; http_uri; reference:url,www.browseraid.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001266; classtype:trojan-activity; sid:2001266; rev:15; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Weatherbug Activity"; flow:established,to_server; content:"/WeatherWindow/WeatherWindow"; nocase; http_uri; content:"?rnd="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003420; classtype:trojan-activity; sid:2003420; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Browseraid.com User-Agent (Browser Adv)"; flow: to_server,established; content:"Browser Adv"; http_header; fast_pattern:only; reference:url,www.browseraid.com; reference:url,doc.emergingthreats.net/2001295; classtype:trojan-activity; sid:2001295; rev:24; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Weatherbug Design60 Upload Activity"; flow:established,to_server; content:"/GetDesign60.aspx?Magic="; nocase; http_uri; content:"?ZipCode="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003421; classtype:trojan-activity; sid:2003421; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Blackhole hex and wordlist initial landing and exploit path"; flow:established,to_server; urilen:>70; content:".php"; http_uri; fast_pattern:only; pcre:"/\/[a-f0-9]{5,}\/(?:[a-z]{1,16}[-_]){1,4}[a-z]{1,16}\/(?:[a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php/U"; classtype:trojan-activity; sid:2017452; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_09_11, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Weatherbug Command Activity"; flow:established,to_server; content:"/connection/connectionv"; nocase; http_uri; content:"?t="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003422; classtype:trojan-activity; sid:2003422; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Unknown Malware CnC response with exe file"; flow:from_server,established; dsize:>0; byte_jump:2,1,little,post_offset -4; isdataat:!2,relative; content:"!This program cannot be run in DOS mode."; reference:url,contagiodump.blogspot.com.br/2013/09/sandbox-miming-cve-2012-0158-in-mhtml.html; classtype:command-and-control; sid:2017414; rev:3; metadata:created_at 2013_09_04, updated_at 2013_09_04;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Weatherbug Vista Gadget Activity"; flow:established,to_server; content:"/Command/VistaGadget_v"; nocase; http_uri; content:"UserId="; nocase; http_uri; content:"&AppVersion="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003534; classtype:trojan-activity; sid:2003534; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible JavaFX Click To Run Bypass 1"; flow:established,to_client; file_data; content:"cHJlbG9hZGVyLWNsYXNz"; reference:url,seclists.org/bugtraq/2013/Jul/41; classtype:attempted-user; sid:2017494; rev:2; metadata:created_at 2013_09_20, updated_at 2013_09_20;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Webbuying.net Spyware Installing"; flow:established,to_server; content:"/inst.php?"; nocase; http_uri; content:"d="; nocase; http_uri; content:"&cl="; nocase; http_uri; content:"&l="; nocase; http_uri; content:"&e="; nocase; http_uri; content:"&v=wbi_v"; nocase; http_uri; content:"&uid="; nocase; http_uri; content:"&time="; nocase; http_uri; content:"&win="; nocase; http_uri; content:"&un=0"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003442; classtype:pup-activity; sid:2003442; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible JavaFX Click To Run Bypass 2"; flow:established,to_client; file_data; content:"wcmVsb2FkZXItY2xhc3"; reference:url,seclists.org/bugtraq/2013/Jul/41; classtype:attempted-user; sid:2017495; rev:3; metadata:created_at 2013_09_20, updated_at 2013_09_20;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Webhancer Agent Activity"; flow: to_server,established; content:"Host|3a|"; nocase; http_header; content:"webhancer.com"; nocase; http_header; within:32; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.webhancer.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001678; classtype:pup-activity; sid:2001678; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible JavaFX Click To Run Bypass 3"; flow:established,to_client; file_data; content:"ByZWxvYWRlci1jbGFzc"; reference:url,seclists.org/bugtraq/2013/Jul/41; classtype:attempted-user; sid:2017496; rev:3; metadata:created_at 2013_09_20, updated_at 2013_09_20;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Websearch.com Outbound Dialer Retrieval"; flow: to_server,established; content:"/1/rdgUS10.exe"; nocase; http_uri; reference:mcafee,131461; reference:url,doc.emergingthreats.net/bin/view/Main/2001517; classtype:pup-activity; sid:2001517; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Styx J7u21 click2play bypass"; flow:established,to_server; content:"/jplay.html"; http_uri; fast_pattern:only; classtype:trojan-activity; sid:2017508; rev:2; metadata:created_at 2013_09_24, updated_at 2013_09_24;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Weird on the Web /180 Solutions Checkin"; flow: to_server,established; content:"/notifier/config.ini?v="; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002036; classtype:pup-activity; sid:2002036; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET DELETED vBulletin Administrator Injection Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/install/upgrade.php"; http_uri; content:"username"; http_client_body; content:"password"; http_client_body; distance:0; content:"confirmpassword"; http_client_body; distance:0; reference:url,blog.imperva.com/2013/10/threat-advisory-a-vbulletin-exploit-administrator-injection.html; classtype:web-application-attack; sid:2017610; rev:2; metadata:created_at 2013_10_17, updated_at 2013_10_17;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP WhenUClick.com WhenUSave Data Retrieval (Searchdb)"; flow: to_server,established; content:"/SearchDB?update="; nocase; http_uri; reference:url,www.whenusearch.com; reference:url,www.kephyr.com/spywarescanner/library/whenusearch/index.phtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000919; classtype:pup-activity; sid:2000919; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"ET DELETED Kelihos p2p traffic detected via byte_test CnC Response"; flow:established,from_server; flowbits:isset,ET.Kelihos-P2P; byte_extract:2,2,kelihos.p2p; byte_test:2,=,kelihos.p2p,6; byte_test:2,=,kelihos.p2p,10; byte_test:2,=,kelihos.p2p,14; byte_test:2,=,kelihos.p2p,18; byte_test:2,=,kelihos.p2p,22; byte_test:2,!=,kelihos.p2p,0; byte_test:2,!=,kelihos.p2p,4; byte_test:2,!=,kelihos.p2p,8; byte_test:2,!=,kelihos.p2p,25; classtype:command-and-control; sid:2017614; rev:2; metadata:created_at 2013_10_18, updated_at 2013_10_18;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Wild Tangent Agent Installation"; flow: to_server,established; content:"/Recovery/Checkin.aspx?version"; nocase; http_uri; reference:url,www.spyany.com/program/article_spw_rm_WildTangent.html; reference:url,www.wildtangent.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001307; classtype:pup-activity; sid:2001307; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"ET DELETED Kelihos p2p traffic detected via byte_test - SET"; flow:established,to_server; dsize:100<>2000; pcre:"/^[^OGHPDTCMLUVRBAS]/"; content:!"HTTP/1."; byte_extract:2,2,kelihos.p2p; byte_test:2,=,kelihos.p2p,6; byte_test:2,=,kelihos.p2p,10; byte_test:2,=,kelihos.p2p,14; byte_test:2,=,kelihos.p2p,18; byte_test:2,=,kelihos.p2p,22; byte_test:2,!=,kelihos.p2p,0; byte_test:2,!=,kelihos.p2p,4; byte_test:2,!=,kelihos.p2p,8; byte_test:2,!=,kelihos.p2p,25; flowbits:set,ET.Kelihos-P2P; flowbits:noalert; classtype:trojan-activity; sid:2017612; rev:5; metadata:created_at 2013_10_17, updated_at 2013_10_17;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Wild Tangent Agent Checking In"; flow: to_server,established; content:"/CDADeliveries/Checkin.aspx"; nocase; http_uri; reference:url,www.spyany.com/program/article_spw_rm_WildTangent.html; reference:url,www.wildtangent.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001309; classtype:pup-activity; sid:2001309; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/Napolar Checkin"; flow:established,to_server; content:"POST"; http_method; nocase; content:"v="; depth:2; http_client_body; content:"&u="; distance:0; http_client_body; content:"&c="; distance:0; http_client_body; content:"&s={"; distance:0; http_client_body; content:"}&w="; fast_pattern; distance:0; http_client_body; content:"&b="; distance:0; http_client_body; pcre:"/&s=\{[A-Z0-9]{8}-([A-Z0-9]{4}-){3}[A-Z0-9]{12}\}&w=(\d{1,2}\.){2}\d{1,2}&b=(32|64)$/Pi"; reference:url,blog.avast.com/2013/09/25/win3264napolar-new-trojan-shines-on-the-cyber-crime-scene/; reference:url,www.welivesecurity.com/2013/09/25/win32napolar-a-new-bot-on-the-block/; reference:md5,2c344add2ee6201f4e2cdf604548408b; classtype:trojan-activity; sid:2017527; rev:3; metadata:created_at 2013_09_27, updated_at 2013_09_27;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Wild Tangent Agent Traffic"; flow: to_server,established; content:"/CDAFiles/DP/SysConfig"; nocase; http_uri; reference:url,www.spyany.com/program/article_spw_rm_WildTangent.html; reference:url,www.wildtangent.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001310; classtype:pup-activity; sid:2001310; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED NeoSploit - Obfuscated Payload Requested"; flow:established,to_server; urilen:>89; content:" Java/1"; http_header; fast_pattern:only; pcre:"/^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$/U"; classtype:attempted-user; sid:2015663; rev:4; metadata:created_at 2012_08_29, updated_at 2012_08_29;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Wild Tangent Agent"; flow: to_server,established; content:"/CDAFiles/"; nocase; http_uri; reference:url,www.spyany.com/program/article_spw_rm_WildTangent.html; reference:url,www.wildtangent.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001314; classtype:pup-activity; sid:2001314; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Daemonize Trojan Proxy Initial Checkin"; flow:established,to_server; content:"/command.php?IP="; http_uri; content:"&P1="; http_uri; content:"&P2="; http_uri; content:"&ID="; http_uri; content:"&SP="; http_uri; content:"&CT="; http_uri; content:"&L1="; http_uri; content:"&L2="; http_uri; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanProxy%3AWin32%2FDaemonize.A&ThreatID=-2147464655; classtype:trojan-activity; sid:2013541; rev:3; metadata:created_at 2011_09_06, updated_at 2011_09_06;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Wild Tangent New Install"; flow: to_server,established; content:"/NewUser/Checkin.aspx"; nocase; http_uri; reference:url,www.spyany.com/program/article_spw_rm_WildTangent.html; reference:url,www.wildtangent.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001322; classtype:pup-activity; sid:2001322; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert udp !$DNS_SERVERS any -> $DNS_SERVERS 53 (msg:"ET DELETED Wordpress possible Malicious DNS-Requests - wordpress.com.*"; content:"|09|wordpress|03|com"; nocase; content:!"|00|"; within:1; reference:url,markmaunder.com/2011/zero-day-vulnerability-in-many-wordpress-themes/; reference:url,www.us-cert.gov/current/index.html#wordpress_themes_vulnerability; reference:url,blog.sucuri.net/2011/08/timthumb-security-vulnerability-list-of-themes-including-it.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SucuriSecurity+%28Sucuri+Security%29; classtype:web-application-attack; sid:2013356; rev:2; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2011_08_04, deployment Datacenter, signature_severity Major, tag Wordpress, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Wild Tangent Install"; flow: to_server,established; content:"/updatestats/AI_Euro.exe"; nocase; http_uri; reference:mcafee,122249; reference:url,doc.emergingthreats.net/bin/view/Main/2002008; classtype:pup-activity; sid:2002008; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET DELETED Interleave basicstats.php AjaxHandler Parameter Cross Site Scripting Attempt"; flow:established,to_server; content:"/basicstats.php?"; nocase; http_uri; content:"AjaxHandler="; nocase; http_uri; pcre:"/AjaxHandler\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)/Ui"; reference:bugtraq,46771; reference:url,xforce.iss.net/xforce/xfdb/65942; reference:url,packetstorm.linuxsecurity.com/1103-exploits/Interleave5.5.0.2-xss.txt; classtype:web-application-attack; sid:2012582; rev:4; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2011_03_25, deployment Datacenter, signature_severity Major, tag XSS, tag Cross_Site_Scripting, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Windupdates.com Spyware Install"; flow: established,to_server; content:"/cab/CDTInc/ie/"; nocase; http_uri; content:".cab"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001700; classtype:pup-activity; sid:2001700; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET DELETED mySeatXT SQL Injection Attempt autocomplete.php field DELETE"; flow:established,to_server; content:"/web/classes/autocomplete.php?"; nocase; http_uri; content:"field="; nocase; http_uri; content:"DELETE"; nocase; http_uri; content:"FROM"; http_uri; nocase; pcre:"/DELETE.+FROM/Ui"; reference:url,packetstormsecurity.org/files/view/98636/mySeatXT0.164-SQL.txt; classtype:web-application-attack; sid:2012578; rev:5; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2011_03_25, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Windupdates.com Spyware Loggin Data"; flow: established,to_server; content:"/logging.php?p="; nocase; http_uri; content:"Host|3a| public.windupdates.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001701; classtype:pup-activity; sid:2001701; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET DELETED mySeatXT SQL Injection Attempt autocomplete.php field UNION SELECT"; flow:established,to_server; content:"/web/classes/autocomplete.php?"; nocase; http_uri; content:"field="; nocase; http_uri; content:"UNION"; nocase; http_uri; content:"SELECT"; http_uri; nocase; pcre:"/UNION.+SELECT/Ui"; reference:url,packetstormsecurity.org/files/view/98636/mySeatXT0.164-SQL.txt; classtype:web-application-attack; sid:2012576; rev:5; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2011_03_25, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Winfixmaster.com Fake Anti-Spyware Install"; flow: to_server,established; content:"/dispatcher.php?action="; nocase; http_uri; content:"Host|3a| www.winfix"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2003543; classtype:pup-activity; sid:2003543; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php pass UPDATE"; flow:established,to_server; content:"/auth.php?"; nocase; http_uri; content:"pass="; nocase; http_uri; content:"UPDATE"; nocase; http_uri; pcre:"/UPDATE.+SET/Ui"; reference:cve,CVE-2007-3190; reference:url,www.secunia.com/advisories/25587; reference:url,doc.emergingthreats.net/2005371; classtype:web-application-attack; sid:2005371; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Winferno Registry Fix Spyware Download"; flow: to_server,established; content:"/freeze_rpc6bundle_us/REGISTRYFIXDLL.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003353; classtype:pup-activity; sid:2003353; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php pass ASCII"; flow:established,to_server; content:"/auth.php?"; nocase; http_uri; content:"pass="; nocase; http_uri; content:"SELECT"; nocase; http_uri; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-3190; reference:url,www.secunia.com/advisories/25587; reference:url,doc.emergingthreats.net/2005370; classtype:web-application-attack; sid:2005370; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Winxdefender.com Fake AV Package Post Install Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/checkupdate.php"; nocase; http_uri; content:"User-Agent|3a| Opera"; http_header; content:"Computer ID|3a| "; http_client_body; reference:url,doc.emergingthreats.net/bin/view/Main/2008197; classtype:pup-activity; sid:2008197; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php pass DELETE"; flow:established,to_server; content:"/auth.php?"; nocase; http_uri; content:"pass="; nocase; http_uri; content:"DELETE"; nocase; http_uri; pcre:"/DELETE.+FROM/Ui"; reference:cve,CVE-2007-3190; reference:url,www.secunia.com/advisories/25587; reference:url,doc.emergingthreats.net/2005369; classtype:web-application-attack; sid:2005369; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs (1)"; flow: to_server,established; content:"/fa/evil.html"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001461; classtype:pup-activity; sid:2001461; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php pass INSERT"; flow:established,to_server; content:"/auth.php?"; nocase; http_uri; content:"pass="; nocase; http_uri; content:"INSERT"; nocase; http_uri; pcre:"/INSERT.+INTO/Ui"; reference:cve,CVE-2007-3190; reference:url,www.secunia.com/advisories/25587; reference:url,doc.emergingthreats.net/2005368; classtype:web-application-attack; sid:2005368; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs Occuring"; flow: to_server,established; content:"/fa/?d=get"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001462; classtype:pup-activity; sid:2001462; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php pass UNION SELECT"; flow:established,to_server; content:"/auth.php?"; nocase; http_uri; content:"pass="; nocase; http_uri; content:"UNION"; nocase; http_uri; pcre:"/UNION\s+SELECT/Ui"; reference:cve,CVE-2007-3190; reference:url,www.secunia.com/advisories/25587; reference:url,doc.emergingthreats.net/2005367; classtype:web-application-attack; sid:2005367; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs (2)"; flow: to_server,established; content:"src=http|3a|//xpire.info/i.exe"; nocase; http_client_body; reference:url,doc.emergingthreats.net/bin/view/Main/2001463; classtype:pup-activity; sid:2001463; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED Just For Fun Network Management System (JFFNMS) SQL Injection Attempt -- auth.php pass SELECT"; flow:established,to_server; content:"/auth.php?"; nocase; http_uri; content:"pass="; nocase; http_uri; content:"SELECT"; nocase; http_uri; pcre:"/SELECT.+FROM/Ui"; reference:cve,CVE-2007-3190; reference:url,www.secunia.com/advisories/25587; reference:url,doc.emergingthreats.net/2005366; classtype:web-application-attack; sid:2005366; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs (3)"; flow: to_server,established; content:"/i.exe"; nocase; http_uri; content:"xpire.info"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001464; classtype:pup-activity; sid:2001464; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED Jelsoft vBulletin SQL Injection Attempt -- attachment.php UPDATE"; flow:established,to_server; content:"/admincp/attachment.php?"; nocase; http_uri; content:"UPDATE"; nocase; http_uri; pcre:"/UPDATE.+SET/Ui"; reference:cve,CVE-2007-1573; reference:url,www.secunia.com/advisories/24503; reference:url,doc.emergingthreats.net/2004151; classtype:web-application-attack; sid:2004151; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs (4)"; flow: to_server,established; content:"/dl/adv121.php"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001466; classtype:pup-activity; sid:2001466; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED Jelsoft vBulletin SQL Injection Attempt -- attachment.php ASCII"; flow:established,to_server; content:"/admincp/attachment.php?"; nocase; http_uri; content:"SELECT"; nocase; http_uri; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-1573; reference:url,www.secunia.com/advisories/24503; reference:url,doc.emergingthreats.net/2004150; classtype:web-application-attack; sid:2004150; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs (5)"; flow: to_server,established; content:"/dl/adv121/x.chm"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001467; classtype:pup-activity; sid:2001467; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED Jelsoft vBulletin SQL Injection Attempt -- attachment.php DELETE"; flow:established,to_server; content:"/admincp/attachment.php?"; nocase; http_uri; content:"DELETE"; nocase; http_uri; pcre:"/DELETE.+FROM/Ui"; reference:cve,CVE-2007-1573; reference:url,www.secunia.com/advisories/24503; reference:url,doc.emergingthreats.net/2004149; classtype:web-application-attack; sid:2004149; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs CHM Exploit"; flow: to_server,established; content:"/fa/ied_s7m.chm"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001468; classtype:pup-activity; sid:2001468; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED Jelsoft vBulletin SQL Injection Attempt -- attachment.php INSERT"; flow:established,to_server; content:"/admincp/attachment.php?"; nocase; http_uri; content:"INSERT"; nocase; http_uri; pcre:"/INSERT.+INTO/Ui"; reference:cve,CVE-2007-1573; reference:url,www.secunia.com/advisories/24503; reference:url,doc.emergingthreats.net/2004148; classtype:web-application-attack; sid:2004148; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs (6)"; flow: to_server,established; content:"/fa/x.chm"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001469; classtype:pup-activity; sid:2001469; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED Jelsoft vBulletin SQL Injection Attempt -- attachment.php SELECT"; flow:established,to_server; content:"/admincp/attachment.php?"; nocase; http_uri; content:"SELECT"; nocase; http_uri; pcre:"/SELECT.+FROM/Ui"; reference:cve,CVE-2007-1573; reference:url,www.secunia.com/advisories/24503; reference:url,doc.emergingthreats.net/2004146; classtype:web-application-attack; sid:2004146; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Multiple Spyware Installs (7)"; flow: to_server,established; content:"/fa/xpl3.htm"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001470; classtype:pup-activity; sid:2001470; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Websearch.com Cab Download"; flow: to_server,established; content:"/Dnl/T_"; nocase; http_uri; pcre:"/\/\S+\.cab/Ui"; reference:mcafee,131461; reference:url,doc.emergingthreats.net/bin/view/Main/2003242; classtype:trojan-activity; sid:2003242; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Spyware Exploit"; flow: to_server,established; content:"/2DimensionOfExploitsEnc.php"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2001471; classtype:pup-activity; sid:2001471; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED AskSearch Toolbar Spyware User-Agent (AskTBar)"; flow:to_server,established; content:"|3b| AskTb"; http_header; pcre:"/User-Agent\x3a[^\n]+AskTB/iH"; reference:url,doc.emergingthreats.net/2003494; classtype:policy-violation; sid:2003494; rev:15; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Minor, tag Spyware_User_Agent, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Xpire.info Install Report"; flow: to_server,established; content:"counter.htm"; nocase; pcre:"//user\d+/counter\.htm/im"; reference:url,doc.emergingthreats.net/bin/view/Main/2001541; classtype:pup-activity; sid:2001541; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Findwhat.com Spyware (sendtracker)"; flow: to_server,established; content:"/bin/findwhat.dll?sendtracker&"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003580; classtype:trojan-activity; sid:2003580; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Yesadvertising Banking Spyware RETRIEVE"; flow: to_server,established; content:"/img1big.gif"; nocase; http_uri; reference:url,isc.sans.org/presentations/banking_malware.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2000336; classtype:trojan-activity; sid:2000336; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Nulprot Checkin Response"; flow:established,from_server; content:"200"; http_stat_code; content:"Encryption|3a| on|0d 0a|Content-Length|3a| "; http_header; depth:32; reference:url,doc.emergingthreats.net/2007669; classtype:trojan-activity; sid:2007669; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Yesadvertising Banking Spyware INFORMATION SUBMIT"; flow: to_server,established; content:"/cgi-bin/yes.pl"; nocase; http_uri; reference:url,isc.sans.org/presentations/banking_malware.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2000337; classtype:trojan-activity; sid:2000337; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Delf HTTP Post Checkin (1)"; flow:established,to_server; content:"POST"; nocase; http_method; content:".php"; http_uri; nocase; content:"Content-type|3a| image/gif"; http_header; content:"x|da|"; http_client_body; depth:2; content:"|0d 0a|Content-type|3a| image/gif|0d 0a 0d 0a|x|da|"; content:!"User-Agent|3a| "; http_header; reference:url,doc.emergingthreats.net/2007867; classtype:trojan-activity; sid:2007867; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Yourscreen.com Spyware Download"; flow: to_server,established; content:"/data/yourscreen_data.exe"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003354; classtype:pup-activity; sid:2003354; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Emo/Downloader.uxk checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:".php"; http_uri; content:"v="; http_uri; content:"&id="; http_uri; content:"&rs="; http_uri; fast_pattern; content:"&cc="; http_uri; reference:url,doc.emergingthreats.net/2008452; classtype:trojan-activity; sid:2008452; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Zenotecnico Adware"; flow: to_server,established; content:"/cl/clientdump"; http_uri; content:"zenotecnico"; nocase; http_header; reference:url,www.zenotecnico.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001947; classtype:pup-activity; sid:2001947; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert udp $HOME_NET 6345:6349 -> $EXTERNAL_NET 6345:6349 (msg:"ET DELETED UDP traffic - Likely Limewire"; threshold: type threshold,track by_src,count 40, seconds 300; reference:url,www.limewire.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001841; classtype:policy-violation; sid:2001841; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Supergames.aavalue.com Spyware"; flow: established,to_server; content:"/toolbars/msg/msg_serverside.xml"; nocase; http_uri; content:"aavalue.com"; nocase; http_header; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=EZ-Tracks%20Toolbar&threatid=41189; reference:url,doc.emergingthreats.net/bin/view/Main/2003525; classtype:pup-activity; sid:2003525; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole/Cool plugindetect in octal Jun 26 2013"; flow:established,from_server; file_data; content:"mCharCode"; pcre:"/(?P

[0-7]{3})(?P[0-7]{3})(?P=p)(?P=d)([0-7]{3}){10}(?P[0-7]{3})[0-7]{3}(?P[0-7]{3})[0-7]{3}(?P=dot)[0-7]{3}(?P=q)/R"; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2017072; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_06_27, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP adservs.com Spyware"; flow: to_server,established; content:"/binaries/relevance.dat"; http_uri; content:"adservs"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2002740; classtype:pup-activity; sid:2002740; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole/Cool plugindetect in octal Apr 18 2013"; flow:established,from_server; file_data; content:"telppa"; pcre:"/(?P

[0-7]{2,4})(?P[^0-7])(?P(?!(?P=p))[0-7]{2,4})(?P=sep)(?P=p)(?P=sep)(?P=d)(?P=sep)([0-7]{2,4}(?P=sep)){10}(?P[0-7]{2,4})(?P=sep)[0-7]{2,4}(?P=sep)(?P[0-7]{2,4})(?P=sep)[0-7]{2,4}(?P=sep)(?P=dot)(?P=sep)[0-7]{2,4}(?P=sep)(?P=q)/R"; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2016776; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_04_19, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP iframebiz - sploit.anr"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/sploit.anr"; nocase; http_uri; reference:url,iframecash.biz; reference:url,isc.sans.org/diary.php?storyid=868; reference:url,doc.emergingthreats.net/bin/view/Main/2002708; classtype:pup-activity; sid:2002708; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Taidoor Checkin"; flow:to_server,established; content:".jsp?"; fast_pattern:only; http_uri; pcre:"/^\/(?:p(?:a(?:rs|g)e|rocess)|(?:securit|quer)y|(?:defaul|abou)t|index|login|user)\.jsp\?[a-z]{2}\x3d[a-z0-9]{9}[A-F0-9]{9}$/Ui"; content:"User-Agent|3a| "; depth:12; http_header; content:!"Referer"; http_header; reference:url,contagiodump.blogspot.com.br/2013/09/sandbox-miming-cve-2012-0158-in-mhtml.html; classtype:trojan-activity; sid:2017415; rev:4; metadata:created_at 2013_09_04, updated_at 2013_09_04;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP iframebiz - loaderadv***.jar"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/loaderadv"; nocase; http_uri; pcre:"/loaderadv\d+\.jar/Ui"; reference:url,iframecash.biz; reference:url,isc.sans.org/diary.php?storyid=868; reference:url,doc.emergingthreats.net/bin/view/Main/2002709; classtype:pup-activity; sid:2002709; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Trojan.BlackRev Polling for DoS targets"; flow:established,to_server; content:"/gate.php?cmd=urls"; http_uri; fast_pattern:only; pcre:"/\/gate\.php\?cmd=urls$/U"; content:!"Referer|3a 20|"; http_header; reference:url,ddos.arbornetworks.com/2013/05/the-revolution-will-be-written-in-delphi/; classtype:trojan-activity; sid:2016900; rev:5; metadata:created_at 2013_05_21, updated_at 2013_05_21;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP iframebiz - /qwertyuiyw12ertyuytre/adv***.php"; flow:established,to_server; content:"/qwertyuiyw12ertyuytre"; nocase; http_uri; reference:url,iframecash.biz; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_DLOADR.QC&VSect=T; reference:url,doc.emergingthreats.net/bin/view/Main/2008681; classtype:pup-activity; sid:2008681; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Trojan.BlackRev Download Executable"; flow:established,to_server; content:"/gate.php?cmd=getexe"; http_uri; fast_pattern:only; pcre:"/\/gate\.php\?cmd=getexe$/U"; content:!"Referer|3a 20|"; http_header; reference:url,ddos.arbornetworks.com/2013/05/the-revolution-will-be-written-in-delphi/; classtype:trojan-activity; sid:2016901; rev:5; metadata:created_at 2013_05_21, updated_at 2013_05_21;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP K8l.info Spyware Activity"; flow: to_server,established; content:"/media/servlet/view/dynamic/url/zone?"; nocase; http_uri; content:"zid="; nocase; http_uri; content:"&pid="; nocase; http_uri; content:"&DHWidth="; nocase; http_uri; content:"&DHHeight="; nocase; http_uri; content:"Ref="; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2003451; classtype:pup-activity; sid:2003451; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/Badur.Spy User Agent HWMPro"; flow:established,to_server; content:"HWMPro"; depth:6; http_user_agent; reference:md5,234c47b5b29a2cfcc00900bbc13ea181; classtype:trojan-activity; sid:2017654; rev:4; metadata:created_at 2013_11_01, updated_at 2013_11_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (Suggestion)"; flow:to_server,established; content:"GET"; nocase; http_method; content:"User-Agent|3a| Suggestion|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2011229; classtype:pup-activity; sid:2011229; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED DRIVEBY Blackhole - Landing Page Recieved - applet and flowbit"; flow:from_server,established; flowbits:isset,et.exploitkitlanding; content:" $EXTERNAL_NET any (msg:"ET ADWARE_PUP HTML.Psyme.Gen Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/channel/channelCode.htm?"; nocase; http_uri; content:"pid="; nocase; http_uri; reference:md5,de1adb1df396863e7e3967271e7db734; classtype:pup-activity; sid:2011856; rev:3; metadata:created_at 2010_10_26, former_category ADWARE_PUP, updated_at 2010_10_26;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED HiMan EK - Payload Downloaded - EXE in ZIP Downloaded by Java"; flow:established,to_client; flowbits:isset,ET.http.javaclient; file_data; content:"PK"; within:2; content:".exe"; fast_pattern; nocase; classtype:exploit-kit; sid:2017795; rev:2; metadata:created_at 2013_12_05, updated_at 2013_12_05;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP CryptMEN HTTP library purporting to be MSIE to PHP HTTP 1.0"; flow:established,to_server; content:"|20|HTTP/1.0|0d 0a|User-Agent|3a 20|Mozilla/4.0|20|(compatible|3b 20|MSIE|20|"; http_header; content:"Host|3a 20|"; content:!"Referer|3a 20|"; http_header; content:".php?"; nocase; http_uri; classtype:pup-activity; sid:2011938; rev:5; metadata:created_at 2010_11_20, former_category ADWARE_PUP, updated_at 2010_11_20;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Landing try catch try catch math eval Aug 27 2012"; flow:established,from_server; file_data; content:"try{"; content:"|3b|}catch("; within:25; content:"){try{"; fast_pattern; within:15; content:"}catch("; within:35; content:"eval("; distance:0; classtype:bad-unknown; sid:2015654; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_27, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP CryptMEN HTTP library purporting to be MSIE to PHP HTTP 1.1"; flow:established,to_server; content:"|20|HTTP/1.1|0d 0a|User-Agent|3a 20|Mozilla/4.0|20|(compatible|3b 20|MSIE|20|"; http_header; content:"Host|3a 20|"; http_header; content:!"Referer|3a 20|"; http_header; content:".php?"; nocase; http_uri; content:!"Connection|3a| "; http_header; classtype:pup-activity; sid:2011939; rev:7; metadata:created_at 2010_11_20, former_category ADWARE_PUP, updated_at 2010_11_20;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Zbot Activity Common Download Struct"; flow:to_server,established; content:".bin"; fast_pattern; http_uri; pcre:"/\.bin$/U"; content:!"Referer|3a|"; http_header; content:!"Accept-"; http_header; content:"User-Agent|3a 20|"; http_header; depth:12; content:" MSIE "; http_header; pcre:"/^User-Agent\x3a[^\r\n]*?\sMSIE\s/H"; classtype:trojan-activity; sid:2017837; rev:3; metadata:created_at 2013_12_12, updated_at 2013_12_12;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP Suspicious Russian Content-Language Ru Which May Be Malware Related"; flow:established,to_client; content:"Content-Language|3A| ru"; nocase; http_header; fast_pattern:only; classtype:pup-activity; sid:2012228; rev:5; metadata:created_at 2011_01_25, former_category ADWARE_PUP, updated_at 2011_01_25;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/Ferret DDOS Bot CnC Beacon"; flow:established,to_server; urilen:14; content:"POST"; http_method; content:"/hor/input.php"; http_uri; content:"Mozilla Gecko Firefox 25"; http_user_agent; content:"m="; http_client_body; depth:2; content:"&h="; http_client_body; within:50; reference:md5,c49e3411294521d63c7cc28e08cf8a77; reference:url,www.arbornetworks.com/asert/2013/12/a-business-of-ferrets/; classtype:command-and-control; sid:2017883; rev:3; metadata:attack_target Client_Endpoint, created_at 2013_12_19, deployment Perimeter, signature_severity Major, tag c2, updated_at 2013_12_19, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP Suspicious Chinese Content-Language zh-cn Which May be Malware Related"; flow:established,to_client; content:"Content-Language|3A| zh-cn"; nocase; http_header; fast_pattern:only; classtype:pup-activity; sid:2012229; rev:7; metadata:created_at 2011_01_25, former_category ADWARE_PUP, updated_at 2011_01_25;) +#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET DELETED Possible Upatre Downloader SSL certificate"; flow:established,from_server; content:"|2a 86 48 86 f7 0d 01 09 01|"; pcre:"/^.{2}(?P([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.).+?\x2a\x86\x48\x86\xf7\x0d\x01\x09\x01.{2}(?P=fake_email)/Rs"; classtype:trojan-activity; sid:2017733; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_11_20, deployment Perimeter, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32-Adware.Hotclip.A Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/filetadak/app_check.php?"; nocase; http_uri; content:"kind="; nocase; http_uri; content:"pid=donkeys"; nocase; http_uri; reference:url,spydig.com/spyware-info/Win32-Adware-Hotclip-A.html; classtype:pup-activity; sid:2014069; rev:4; metadata:created_at 2012_01_02, former_category ADWARE_PUP, updated_at 2012_01_02;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED PWS-LDPinch Reporting User Activity"; flow:established,to_server; content:".php?ut="; nocase; http_uri; content:"&idr="; nocase; http_uri; content:"&lang="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&winver="; nocase; http_uri; reference:url,doc.emergingthreats.net/2002812; classtype:trojan-activity; sid:2002812; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Malicious ad_track.php file Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/ad_track.php"; nocase; http_uri; content:"etekey="; nocase; http_uri; content:"track.ete.cn"; nocase; http_header; classtype:pup-activity; sid:2014183; rev:4; metadata:created_at 2012_02_06, former_category ADWARE_PUP, updated_at 2012_02_06;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED PWS-LDPinch posting data"; flow:established,to_server; content:"POST"; nocase; http_method; content:"a="; http_client_body; nocase; content:"&b="; http_client_body; nocase; content:"&d="; http_client_body; nocase; content:".bin&"; fast_pattern; http_client_body; nocase; content:"u="; http_client_body; nocase; content:"&c="; nocase; http_client_body; reference:url,doc.emergingthreats.net/2006385; classtype:trojan-activity; sid:2006385; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely Fake Antivirus Download Antivirus_21.exe"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/download/Antivirus_"; http_uri; content:".exe"; http_uri; pcre:"/download\x2FAntivirus_\d+\x2Eexe/Ui"; reference:url,doc.emergingthreats.net/2010050; classtype:trojan-activity; sid:2010050; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED LDPinch Checkin (2)"; flow:established,to_server; content:"POST"; nocase; http_method; content:".php"; http_uri; nocase; content:"a="; http_client_body; depth:2; content:"&b="; http_client_body; nocase; content:"&d="; http_client_body; nocase; content:".bin&c="; http_client_body; reference:url,doc.emergingthreats.net/2007828; classtype:trojan-activity; sid:2007828; rev:14; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely TDSS Download (codec.exe)"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/codec.exe"; http_uri; nocase; reference:url,doc.emergingthreats.net/2010054; classtype:trojan-activity; sid:2010054; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED LDPinch Checkin (4)"; flow:established,to_server; content:"a="; content:"&b=Pinch"; nocase; distance:0; content:"&c="; distance:0; reference:url,doc.emergingthreats.net/2008061; classtype:trojan-activity; sid:2008061; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely Fake Antivirus Download AntivirusPlus.exe"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/AntivirusPlus"; http_uri; content:".exe"; http_uri; reference:url,doc.emergingthreats.net/2010062; classtype:trojan-activity; sid:2010062; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED LDPinch Checkin (8)"; flow:established,to_server; content:"/view.php"; nocase; http_uri; content:"a="; content:"&b=Passes"; distance:0; content:"&d=Pass"; distance:0; content:"&c="; distance:0; reference:url,doc.emergingthreats.net/2008091; classtype:trojan-activity; sid:2008091; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potential Fake AV GET installer.1.exe"; flow:established,to_server; content:"GET"; http_method; nocase; content:"/installer."; http_uri; nocase; content:".exe"; http_uri; nocase; pcre:"/\/installer\.\d+\.exe/Ui"; reference:url,www.malwareurl.com; reference:url,doc.emergingthreats.net/2010452; classtype:trojan-activity; sid:2010452; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED LDPinch Checkin (9)"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/gate.php"; http_uri; content:"a=&b=&d=&c="; http_client_body; reference:url,doc.emergingthreats.net/2008213; classtype:trojan-activity; sid:2008213; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potential Fake AV GET installer_1.exe"; flow:established,to_server; content:"GET"; http_method; nocase; content:"/installer_"; nocase; http_uri; content:".exe"; nocase; http_uri; pcre:"/\/installer_\d+\.exe/Ui"; reference:url,www.malwareurl.com; reference:url,doc.emergingthreats.net/2010453; classtype:trojan-activity; sid:2010453; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 82 (msg:"ET DELETED LDPinch Checkin on Port 82"; flow:established,to_server; content:".php"; nocase; content:"a="; content:"&b=Pinch"; distance:0; content:"&d="; distance:0; content:"&c="; distance:0; reference:url,doc.emergingthreats.net/2008354; classtype:trojan-activity; sid:2008354; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potential Fake AV Download (download/install.php)"; flow:established,to_server; content:"GET"; nocase; http_method; content:"download/install.php"; http_uri; pcre:"/\x0d\x0aHost\: [a-z\x2e]+(security|virus|pro|anti|scan|mypc|total|protect|check|guard|defend)/i"; reference:url,lists.emergingthreats.net/pipermail/emerging-sigs/2009-December/004891.html; reference:url,malwareurl.com; reference:url,www.malwaredomainlist.com; reference:url,doc.emergingthreats.net/2010465; classtype:trojan-activity; sid:2010465; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED LDPinch Loader Binary Request"; flow:established,to_server; content:"HTTP/1.0|0d 0a|Host|3a|"; content:".exe"; http_uri; nocase; content:"User-Agent|3a| "; http_header; content:"|0a 0a|Connection|3a| close|0d 0a 0d 0a|"; http_header; classtype:trojan-activity; sid:2013994; rev:4; metadata:created_at 2011_12_07, updated_at 2011_12_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely Fake Antivirus Download Setup_2012.exe"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/Setup_"; nocase; http_uri; content:".exe"; nocase; pcre:"/Setup_20\d+\x2Eexe/Ui"; reference:url,doc.emergingthreats.net/xxxxxxx; classtype:trojan-activity; sid:2010684; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED TROJAN LDPinch Loader Binary Request"; flow:to_server,established; content:"HTTP/1.0|0D 0A|Host|3a|"; content:".exe"; http_uri; nocase; content:"User-Agent|3a| "; http_header; content:"|0D 0A|Connection|3a| close|0D 0A 0D 0A|"; http_header; classtype:trojan-activity; sid:2014015; rev:7; metadata:created_at 2011_12_09, updated_at 2011_12_09;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Unknown Malware Download Request"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/images/GR_OLD_CR.EXE"; nocase; http_uri; reference:url,www.prevx.com/filenames/X22210989379038527-X1/GR_OLD_CR.EXE.html; reference:url,doc.emergingthreats.net/2011148; classtype:trojan-activity; sid:2011148; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED SpyEye Bot Checkin"; flow:established,to_server; content:".php?guid="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&stat="; nocase; http_uri; content:"&cpu="; nocase; http_uri; content:"&ccrc="; nocase; http_uri; reference:url,www.symantec.com/business/security_response/writeup.jsp?docid=2010-020216-0135-99; reference:url,malwareint.blogspot.com/2010/01/spyeye-new-bot-on-market.html; reference:url,doc.emergingthreats.net/2010789; reference:url,www.symantec.com/connect/blogs/spyeye-bot-versus-zeus-bot; reference:md5,2b8a408b56eaf3ce0198c9d1d8a75ec0; classtype:trojan-activity; sid:2010789; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole/Cutwail Redirection Page 1"; flow:established,from_server; content:"document.location="; depth:200; content:".php?"; within:100; pcre:"/\.php\?[^&]{1,8}=[a-f0-9]{16}[\x22\x27\x3b\x20\x0a\x0d]/"; classtype:bad-unknown; sid:2014378; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_03_14, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED PE EXE or DLL Windows file download disguised as ASCII - SET"; flow:established; content:"|34 44 35 41|"; byte_jump:8,116,relative,multiplier 2,little,string; isdataat:1,relative; flowbits:set,ET.http.binary.ASCII; flowbits:noalert; classtype:trojan-activity; sid:2017961; rev:5; metadata:created_at 2014_01_13, updated_at 2014_01_13;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Downloader Possible AV KILLER"; flow:established,to_server; content:"GET"; nocase; http_method; content:"SoftName="; http_uri; nocase; content:"SoftVersion="; http_uri; nocase; content:"UserIP="; http_uri; nocase; content:"Mac="; http_uri; nocase; reference:url,doc.emergingthreats.net/2009487; classtype:trojan-activity; sid:2009487; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Feodo Banking Trojan Receiving Configuration File"; flow:established,from_server; content:"ibanking-services.com"; nocase; content:"webcash"; nocase; distance:0; content:"/wires/"; nocase; content:"amazon.com"; nocase; distance:0; content:"EncryptPassword"; nocase; distance:0; reference:url,blog.fireeye.com/research/2010/10/feodosoff-a-new-botnet-on-the-rise.html; classtype:trojan-activity; sid:2011863; rev:5; metadata:created_at 2010_10_28, updated_at 2010_10_28;) -#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE AVKiller with Backdoor checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"id="; http_client_body; nocase; content:"&ip_int="; http_client_body; nocase; content:"&os="; http_client_body; nocase; content:"&av="; http_client_body; nocase; reference:url,doc.emergingthreats.net/2009812; classtype:command-and-control; sid:2009812; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Browlock Hostname Format US"; flow:established,to_server; content:"Host|3a 20|fbi.gov."; http_header; fast_pattern:only; classtype:trojan-activity; sid:2018006; rev:3; metadata:created_at 2014_01_23, updated_at 2014_01_23;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Antispywareexpert.com Fake AS Install Checkin"; flow:established,to_server; content:"/?action="; http_uri; content:"&pc_id="; http_uri; content:"&abbr="; http_uri; content:"&a="; http_uri; content:"&l="; http_uri; content:"&addt"; reference:url,doc.emergingthreats.net/2008502; classtype:command-and-control; sid:2008502; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert udp any 53 -> $HOME_NET any (msg:"ET DELETED Possible Zeus .ru CnC Domain Generation Algorithm (DGA) Lookup NXDOMAIN Response"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|02|ru|00|"; fast_pattern:only; pcre:"/[^a-z0-9\-\.][a-z0-9]{32,48}\x02ru\x00\x00/"; threshold: type both, track by_src, count 2, seconds 60; classtype:command-and-control; sid:2014373; rev:2; metadata:created_at 2012_03_14, updated_at 2012_03_14;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Antivirus2008 Fake AV Install Report"; flow:established,to_server; content:"?type=scanner&pin="; http_uri; content:"&lnd="; http_uri; reference:url,doc.emergingthreats.net/2008511; classtype:trojan-activity; sid:2008511; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert udp any 53 -> $HOME_NET any (msg:"ET DELETED Possible Zeus .info CnC Domain Generation Algorithm (DGA) Lookup NXDOMAIN Response"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|04|info|00|"; fast_pattern:only; pcre:"/[^a-z0-9\-\.][a-z0-9]{32,48}\x04info\x00\x00/"; threshold: type both, track by_src, count 2, seconds 60; classtype:command-and-control; sid:2014374; rev:3; metadata:created_at 2012_03_14, updated_at 2012_03_14;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Autorun.qvi Related HTTP Get on Off Port"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/get_r.php?fid="; http_uri; content:"&mac="; http_uri; within:15; content:"&version="; http_uri; distance:0; content:"&uuid="; http_uri; distance:0; reference:url,doc.emergingthreats.net/2008755; classtype:trojan-activity; sid:2008755; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert udp any 53 -> $HOME_NET any (msg:"ET DELETED Possible Zeus .biz CnC Domain Generation Algorithm (DGA) Lookup NXDOMAIN Response"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|03|biz|00|"; fast_pattern:only; pcre:"/[^a-z0-9\-\.][a-z0-9]{32,48}\x03biz\x00\x00/"; threshold: type both, track by_src, count 2, seconds 60; classtype:command-and-control; sid:2014375; rev:2; metadata:created_at 2012_03_14, updated_at 2012_03_14;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Bandook iwebho/BBB-phish trojan leaking user data"; flow:established,to_server; content:"POST"; nocase; http_method; content:"Content-Type|3a20|application/x-www-form-urlencoded|0d0a|Host|3a20|"; depth:55; http_header; content:"Content-Length|3a20|"; http_header; content:"VISITED_URL"; depth:100; http_client_body; reference:url,www.secureworks.com/research/threats/bbbphish; reference:url,doc.emergingthreats.net/2003937; classtype:trojan-activity; sid:2003937; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32.Sality.bh Checkin"; flow:to_server,established; content:"/logo.gif?"; http_uri; content:"Mozilla/4.0 (compatible|3b| MSIE 7.0|3b| Windows NT 5.1|3b| .NET CLR 1.1.4322|3b| .NET CLR 2.0.50728)|0d 0a|Host|3a| "; http_header; pcre:"/\x2flogo\x2egif\x3f([0-9a-z]){5}\x3d\d{6,7}/U"; content:!"Accept"; http_header; content:!"Connection|3a|"; http_header; reference:md5,c15f4fe2e180150dc511aa64427404c5; classtype:trojan-activity; sid:2018111; rev:3; metadata:created_at 2012_04_09, updated_at 2012_04_09;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banker.OPX HTTP Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"TIPO=CLIENTE&NOME="; nocase; http_client_body; reference:url,doc.emergingthreats.net/2007901; classtype:command-and-control; sid:2007901; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/Azbreg.Backdoor CnC Beacon"; flow:established,to_server; urilen:17; content:"/instant_messages"; http_uri; content:"sid="; http_cookie; content:"locale="; http_cookie; distance:0; content:"name="; http_cookie; distance:0; content:"password="; http_cookie; content:"uid="; http_cookie; distance:0; reference:md5,4b435a3f43d0e7ffa71453cf18804b70; classtype:command-and-control; sid:2018151; rev:2; metadata:attack_target Client_Endpoint, created_at 2014_02_18, deployment Perimeter, signature_severity Major, tag c2, updated_at 2014_02_18, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banker.ili HTTP Checkin"; flow:established,to_server; content:"/ctrl/cnt_boot.php?pgv="; http_uri; nocase; reference:url,doc.emergingthreats.net/2007940; classtype:command-and-control; sid:2007940; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Fake FedEX/Pony spam campaign URI Struct"; flow:established,to_server; content:".php?label="; http_uri; nocase; fast_pattern:only; pcre:"/\.php\?label=(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/Ui"; content:!"dynamicdrive.com"; nocase; http_header; classtype:trojan-activity; sid:2017258; rev:5; metadata:created_at 2013_07_30, updated_at 2013_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banker Trojan (General) HTTP Checkin"; flow:established,to_server; content:".php?PC="; http_uri; content:"&Data="; http_uri; content:"&Mac="; http_uri; reference:url,doc.emergingthreats.net/2007984; classtype:command-and-control; sid:2007984; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Android FakeInst.BX checkin"; flow:to_server; content:".html?c="; http_uri; content:"&o="; http_uri; distance:2; within:3; content:"&n="; http_uri; distance:0; content:"&pid="; http_uri; distance:10; within:10; content:"Apache-HttpClient"; http_user_agent; reference:md5,b2397ddc90e57f2d0eb6b0d3b8bb63f8; classtype:trojan-activity; sid:2018180; rev:6; metadata:created_at 2014_02_27, updated_at 2014_02_27;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banker.JU Related HTTP Post-infection Checkin"; flow:established,to_server; content:"/envio.php?"; http_uri; fast_pattern; content:"User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)"; http_header; content:"tipo="; http_client_body; reference:url,doc.emergingthreats.net/2008267; classtype:command-and-control; sid:2008267; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Havex Rat Check-in URI Struct"; flow:established,to_server; content:"POST"; http_method; content:!"Referer|3a 20|"; content:".php?id"; http_uri; content:"&v1="; http_uri; content:"&v2="; http_uri; content:"&q="; http_uri; pcre:"/\.php\?id=[A-F0-9]+\-[A-F0-9]+&v1=[A-F0-9]+&v2=[A-F0-9]+&q=[A-F0-9]+$/U"; reference:md5,6557d6518c3f6bcb8b1b2de77165c962; classtype:trojan-activity; sid:2018251; rev:2; metadata:created_at 2014_03_11, updated_at 2014_03_11;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Agent.zrm/Infostealer.Bancos Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"appdata="; http_uri; nocase; content:"hd="; nocase; http_uri; content:"mac="; nocase; http_uri; content:"computador="; http_uri; nocase; reference:url,doc.emergingthreats.net/2008519; classtype:command-and-control; sid:2008519; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, malware_family Bancos, tag Banking_Trojan, updated_at 2018_04_23;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32.WinSpy.pob Sending Data over SMTP 2"; flow:to_server,established; content:"Subject|3a 20|LOG|20|FILE|20 20|Current User|3a|"; reference:md5,d95845c510ec1f5ad38cb9ccab16c38b; classtype:trojan-activity; sid:2018020; rev:3; metadata:created_at 2014_01_28, updated_at 2014_01_28;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Generic Banker Trojan Downloader Config to client"; flow:established,to_client; content:"|0d 0a 0d 0a|[Controlinfo]"; nocase; content:"CntInfo="; within:9; nocase; content:"UseSepControl="; within:30; nocase; content:"Names="; within:20; reference:url,doc.emergingthreats.net/2009090; classtype:trojan-activity; sid:2009090; rev:5; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Trojan_Downloader, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED MS ANI exploit"; flow:established,from_server; content:"RIFF"; nocase; content:"ACON"; nocase; content:"anih"; nocase; byte_test:4,>,36,0,relative, little; reference:url,doc.emergingthreats.net/bin/view/Main/2003519; classtype:attempted-admin; sid:2003519; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banker/Bancos/Infostealer Possible Rootkit - HTTP HEAD Request"; flow:established,to_server; content:"HEAD"; http_method; nocase; content:".php?action="; http_uri; nocase; content:"&uid="; nocase; http_uri; content:"&locale="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&build="; nocase; http_uri; reference:url,www.pctools.com/mrc/infections/id/Trojan.Banker/; reference:url,www.anti-spyware-101.com/remove-trojanbanker; reference:url,doc.emergingthreats.net/2009750; classtype:trojan-activity; sid:2009750; rev:6; metadata:created_at 2010_07_30, former_category TROJAN, malware_family Bancos, tag Banking_Trojan, updated_at 2018_04_23;) +#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET DELETED JCE Joomla Extension User-Agent (BOT)"; flow:to_server,established; content:"BOT/0.1 (BOT for JCE)"; depth:21; http_user_agent; reference:url,exploit-db.com/exploits/17734/; reference:url,blog.spiderlabs.com/2014/03/honeypot-alert-jce-joomla-extension-attacks.html; classtype:attempted-recon; sid:2018327; rev:4; metadata:created_at 2014_03_26, updated_at 2014_03_26;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Patcher/Bankpatch Module Download Request"; flow:established,to_server; content:"/dl/AcroIEHelpe"; nocase; http_uri; content:".dll"; http_uri; nocase; pcre:"/\/dl\/AcroIEHelpe(r)?(\d)?\.dll/U"; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2008-081817-1808-99&tabid=2; reference:url,doc.emergingthreats.net/2009409; classtype:trojan-activity; sid:2009409; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET DELETED Win32/Kryptik.AZER C2 SSL Stolen Cert"; flow:established,from_server; content:"|55 04 03|"; content:"|0a|junrio.com"; distance:1; within:11; reference:md5,b27e0561283697c1fb1a973c37b52265; classtype:command-and-control; sid:2018328; rev:2; metadata:created_at 2014_03_27, updated_at 2014_03_27;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banload HTTP Checkin Detected"; flow:established,to_server; content:"php?mac="; nocase; http_uri; content:"&hdd="; nocase; http_uri; content:"++++++++"; nocase; content:"&ver="; nocase; http_uri; content:"&ie="; http_uri; nocase; reference:url,doc.emergingthreats.net/2007864; classtype:command-and-control; sid:2007864; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/ZeroAccess Counter.img Checkin"; flow:established,to_server; content:"/counter.img?theme="; fast_pattern; http_uri; content:"&digits="; http_uri; content:"&siteId="; http_uri; content:"Opera/9 (Windows NT "; http_user_agent; reference:url,malwaremustdie.blogspot.co.uk/2013/02/blackhole-of-closest-version-with.html; classtype:trojan-activity; sid:2016358; rev:5; metadata:created_at 2013_02_07, updated_at 2013_02_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banload HTTP Checkin Detected (quem=)"; flow:established,to_server; content:".php"; nocase; http_uri; content:"User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)"; http_header; content:"quem="; depth:5; http_client_body; content:"praquem="; http_client_body; fast_pattern; offset:5; nocase; reference:url,doc.emergingthreats.net/2008283; classtype:command-and-control; sid:2008283; rev:9; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED CWS Related Installer"; flow:established,to_server; content:"/image_tracker.php?l="; http_uri; fast_pattern:only; content:"&x="; http_uri; content:"&deptid="; distance:0; http_uri; content:"&page"; distance:0; http_uri; content:"&unique="; distance:0; http_uri; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453076035; reference:url,doc.emergingthreats.net/bin/view/Main/2002932; classtype:trojan-activity; sid:2002932; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE BANLOAD Downloader GET Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"mac="; http_uri; content:"sys="; http_uri; content:"yp="; http_uri; content:"rand="; http_uri; nocase; pcre:"/mac=[0-9A-Fa-f]{12}&/Ui"; reference:url,www.sophos.com/security/analyses/viruses-and-spyware/trojbanloe.html; reference:url,doc.emergingthreats.net/2009453; classtype:command-and-control; sid:2009453; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET DELETED eMule KAD Network Hello Request (2)"; dsize:27; content:"|e4 10|"; depth:2; byte_test:2,<,65535,0,relative; threshold: type limit, count 5, seconds 600, track by_src; reference:url,emule-project.net; reference:url,doc.emergingthreats.net/2009971; classtype:policy-violation; sid:2009971; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banload Checkin"; flow:to_server,established; content:"GET"; nocase; http_method; content:"c=voip&ord="; nocase; http_uri; content:"=&SCRNSZ"; http_uri; content:"&BRSRSZ="; http_uri; content:"&TIMEZONE="; http_uri; reference:url,doc.emergingthreats.net/2010266; classtype:command-and-control; sid:2010266; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Blackhole Landing to 7-8 chr folder plus index.htm or index.html"; flow:established,to_server; content:"/index.htm"; fast_pattern:only; http_uri; urilen:18<>21; content:!"search"; nocase; http_uri; pcre:"/^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/index\.html?$/U"; pcre:"/^\/[A-Za-z0-9]{7,8}\/index\.html?$/U"; classtype:bad-unknown; sid:2015709; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_09_18, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Urlzone/Bebloh Communication with Controller"; flow:established,to_server; content:"GET"; nocase; http_method; content:"?type=slg&id="; http_uri; nocase; pcre:"/\?type=slg&id=[0-9A-Z]{18}/U"; reference:url,threatinfo.trendmicro.com/vinfo/grayware/ve_graywareDetails.asp?GNAME=TSPY_BEBLOH.KO&VSect=Td; reference:url,doc.emergingthreats.net/2009351; classtype:trojan-activity; sid:2009351; rev:8; metadata:created_at 2010_07_30, former_category TROJAN, malware_family URLZone, tag Banking_Trojan, updated_at 2018_04_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Blackhole Landing to 8 chr folder plus js.js"; flow:established,to_server; content:"/js.js"; http_uri; urilen:15; pcre:"/^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/js\.js$/U"; classtype:bad-unknown; sid:2014629; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_20, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Bredavi Configuration Update Response"; flow:established,from_server; content:"|0d 0a 0d 0a 21|new_config|0a|"; nocase; reference:url,doc.emergingthreats.net/2010790; classtype:trojan-activity; sid:2010790; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED W32/Pushdo CnC Server Fake JPEG Response"; flow:established,to_client; file_data; content:""; fast_pattern:only; reference:url,securelist.com/blog/research/65240/energetic-bear-more-like-a-crouching-yeti/; reference:md5,bdd1d473a56607ec366bb2e3af5aedea; reference:url,802bba9d078a09530189e95e459adcdf; classtype:trojan-activity; sid:2018921; rev:2; metadata:created_at 2014_08_11, updated_at 2014_08_11;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.VB.CEJ HTTP Checkin"; flow:established,to_server; content:"/down"; http_uri; content:"/down/?"; http_uri; content:"s="; http_uri; content:"&t="; http_uri; content:"&v="; http_uri; pcre:"/\/down\d+\/down\/\?s=[A-F0-9]+\&t=\d+\/\d+\/20/U"; reference:url,doc.emergingthreats.net/2008087; classtype:command-and-control; sid:2008087; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET 6667 -> $HOME_NET any (msg:"ET DELETED iroffer IRC Bot offered files advertisement"; flow: from_server,established; content:"|54 6F 74 61 6C 20 4F 66 66 65 72 65 64 3A|"; depth: 500; reference:url,iroffer.org; reference:url,doc.emergingthreats.net/bin/view/Main/2000339; classtype:trojan-activity; sid:2000339; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32.Downloader.pgp Checkin"; flow:established,to_server; content:"?id="; http_uri; content:"&e="; http_uri; content:"&err="; http_uri;content:"&c="; http_uri; reference:url,doc.emergingthreats.net/2008492; classtype:trojan-activity; sid:2008492; rev:5; metadata:created_at 2010_07_30, former_category TROJAN, updated_at 2017_05_01;) +#alert tcp $EXTERNAL_NET 6667 -> $HOME_NET any (msg:"ET DELETED iroffer IRC Bot help message"; flow: from_server,established; content:"|54 6F 20 72 65 71 75 65 73 74 20 61 20 66 69 6C 65 20 74 79 70 65 3A 20 22 2F 6D 73 67|"; depth: 500; reference:url,iroffer.org; reference:url,doc.emergingthreats.net/bin/view/Main/2000338; classtype:trojan-activity; sid:2000338; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Emo/Downloader.vr Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:".php"; http_uri; content:"v="; http_uri; content:"&rs="; http_uri; content:"&n="; http_uri; content:"&uid="; http_uri; reference:url,doc.emergingthreats.net/2008546; reference:url,www.malwaredomainlist.com/mdl.php?search=emo+&colsearch=All&quantity=50; classtype:trojan-activity; sid:2008546; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp any any -> any any (msg:"ET DELETED SpamThru trojan peer exchange"; flow:established,to_server; content:"|01|hs5p|0000|"; depth:7; reference:url,www.secureworks.com/analysis/spamthru/; reference:url,doc.emergingthreats.net/2003138; classtype:trojan-activity; sid:2003138; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Generic Dropper User-Agent (XXXwww)"; flow:established,to_server; content:"User-Agent|3a| XXXwww"; http_header; classtype:trojan-activity; sid:2014387; rev:1; metadata:created_at 2012_03_16, updated_at 2012_03_16;) +#alert tcp any 25 -> any any (msg:"ET DELETED SpamThru trojan SMTP test successful"; flow:established,to_client; dsize:6; content:"XSMTPX"; reference:url,www.secureworks.com/analysis/spamthru/; reference:url,doc.emergingthreats.net/2003139; classtype:trojan-activity; sid:2003139; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Agent.cah Checkin Request"; flow:established,to_server; content:"?v="; nocase; http_uri; content:"&mid="; nocase; http_uri; content:"&r1="; nocase; http_uri; content:"&tm=201"; nocase; http_uri; content:"&av="; nocase; http_uri; content:"&os=Windows"; nocase; http_uri; content:"&uid="; nocase; http_uri; content:"cht="; http_uri; reference:url,doc.emergingthreats.net/2007644; classtype:command-and-control; sid:2007644; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp any any -> any any (msg:"ET DELETED SpamThru trojan update request"; flow:established,to_server; content:"|01|hs5p|0001|"; depth:7; reference:url,www.secureworks.com/analysis/spamthru/; reference:url,doc.emergingthreats.net/2003140; classtype:trojan-activity; sid:2003140; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dropper.Win32.VB.on Keylog/System Info Report via HTTP"; flow:established,to_server; content:"post================================"; content:"=====|0d 0a|Resource Name "; distance:0; content:"|0d 0a|User Name/Value "; distance:0; content:"*************STEAM PASSWORDS**********"; distance:0; content:"Number of procesor|3a|"; distance:0; reference:url,doc.emergingthreats.net; classtype:trojan-activity; sid:2007987; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp any any -> any any (msg:"ET DELETED SpamThru trojan AV DLL request"; flow:established,to_server; content:"|01|hs5p|0007|"; depth:7; reference:url,www.secureworks.com/analysis/spamthru/; reference:url,doc.emergingthreats.net/2003141; classtype:trojan-activity; sid:2003141; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dropper mdodo.com Related Trojan"; flow:established,to_server; content:"GET"; nocase; http_method; content:"User-Agent|3a| Mdodo"; http_header; reference:url,doc.emergingthreats.net/2008195; classtype:trojan-activity; sid:2008195; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp any any -> any any (msg:"ET DELETED SpamThru trojan spam template request"; flow:established,to_server; content:"|01|hs5p|0004|"; depth:7; reference:url,www.secureworks.com/analysis/spamthru/; reference:url,doc.emergingthreats.net/2003142; classtype:trojan-activity; sid:2003142; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dropper 6dzone.com Related Trojan"; flow:established,to_server; content:"GET"; nocase; http_method; content:"User-Agent|3a| 6dzone|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2008196; classtype:trojan-activity; sid:2008196; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp any any -> any any (msg:"ET DELETED SpamThru trojan spam run report"; flow:established,to_server; content:"|01|hs5p|0005|"; depth:7; reference:url,www.secureworks.com/analysis/spamthru/; reference:url,doc.emergingthreats.net/2003143; classtype:trojan-activity; sid:2003143; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.Duntek establishing remote connection"; flow:established,to_server; content:"rfe.php?"; nocase; http_uri; content:"cmp=dun_tekfirst"; nocase; http_uri; content:"guid="; nocase; http_uri; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2006-102514-0554-99; reference:url,doc.emergingthreats.net/2003537; classtype:trojan-activity; sid:2003537; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp any any -> any any (msg:"ET DELETED SpamThru trojan AV scan report"; flow:established,to_server; content:"|01|hs5p|0008|"; depth:7; reference:url,www.secureworks.com/analysis/spamthru/; reference:url,doc.emergingthreats.net/2003144; classtype:trojan-activity; sid:2003144; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE E-Jihad 3.0 DDoS HTTP Activity OUTBOUND"; flow:established,to_server; content:"GET"; nocase; http_method; content:"User-Agent|3a| Attacker|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:denial-of-service; sid:2007686; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED Vipdataend C&C Traffic - Status OK"; flow:established,to_server; dsize:2; content:"OK"; reference:url,doc.emergingthreats.net/2007963; classtype:trojan-activity; sid:2007963; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET MALWARE E-Jihad 3.0 DDoS HTTP Activity INBOUND"; flow:established,to_server; content:"GET"; nocase; http_method; content:"User-Agent|3a| Attacker|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:denial-of-service; sid:2007687; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED Vipdataend C&C Traffic - Checkin (variant 3)"; flow:established,to_server; dsize:<42; content:"|3a|Windows "; depth:11; offset:2; reference:url,doc.emergingthreats.net/2009037; classtype:trojan-activity; sid:2009037; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Egspy Install Report via HTTP"; flow:established,to_server; content:"/control.php?pcad="; nocase; http_uri; content:"&tarih="; nocase; http_uri; content:"&saat="; nocase; http_uri; content:"&veri="; http_uri; reference:url,doc.emergingthreats.net/2008136; classtype:trojan-activity; sid:2008136; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED Vipdataend C&C Traffic Checkin"; flow:established,to_server; dsize:<20; content:"|3a 20|"; offset:2; depth:6; content:"|20 7c 20|"; within:10; reference:url,doc.emergingthreats.net/2007962; classtype:trojan-activity; sid:2007962; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Eleonore Exploit Pack activity"; flow:established,to_server; content:"?spl="; http_uri; content:"&br="; http_uri; content:"&vers="; http_uri; content:"&s="; http_uri; pcre:"/\?spl=\d+&br=[A-Za-z]+&vers=\d\.\d&s=[a-z0-9]+[^&]$/U"; reference:url,www.offensivecomputing.net/?q=node/1419; reference:url,doc.emergingthreats.net/2010248; classtype:trojan-activity; sid:2010248; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET 1024: (msg:"ET DELETED Vipdataend C&C Traffic - Server Status OK"; flow:established,to_server; dsize:2; content:"OK"; reference:url,doc.emergingthreats.net/2007964; classtype:trojan-activity; sid:2007964; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Eleonore Exploit Pack activity variant May 2010"; flow:established,to_server; content:".php?spl="; http_uri; pcre:"/\?spl=MS[0-9]{2}-[0-9]{3}$/U"; reference:url,www.offensivecomputing.net/?q=node/1419; reference:url,doc.emergingthreats.net/2010248; classtype:trojan-activity; sid:2011128; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED Vipdataend C&C Traffic - Checkin (XY)"; flow:established,to_server; dsize:<20; content:"XY|3a|2|7c|212"; offset:0; depth:9; reference:url,doc.emergingthreats.net/2007970; classtype:trojan-activity; sid:2007970; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE FSG Packed Binary via HTTP Inbound"; flow:from_server,established; content:"|4D 5A|"; content:"|50 45 00 00 4C 01 02 00 46 53 47 21|"; distance:10; reference:url,www.securityfocus.com/infocus/1745; reference:url,doc.emergingthreats.net/2002773; classtype:trojan-activity; sid:2002773; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED Vipdataend C&C Traffic - Checkin (FYWL)"; flow:established,to_server; dsize:11; content:"FYWL|3a|2|7c|212"; offset:0; depth:11; reference:url,doc.emergingthreats.net/2008223; classtype:trojan-activity; sid:2008223; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Rogue A/V Win32/FakeXPA GET Request"; flow:to_server,established; content:"?campaign="; http_uri; content:"&country="; http_uri; content:"&counter="; http_uri; content:"&campaign="; http_uri; content:"&landid="; http_uri; reference:url,doc.emergingthreats.net/2009209; classtype:trojan-activity; sid:2009209; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED Vipdataend C&C Traffic - Checkin (XYLL)"; flow:established,to_server; dsize:11; content:"XYLL|3a|2|7c|212"; offset:0; depth:11; reference:url,doc.emergingthreats.net/2008224; classtype:trojan-activity; sid:2008224; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FAKE/ROGUE AV HTTP Post"; flow:established,to_server; content:"POST"; nocase; http_method; content:"mid="; content:"&wv="; content:"&r="; content:"&tp="; content:"&exe="; fast_pattern; content:"&ls="; content:"&uid="; reference:url,doc.emergingthreats.net/2009514; classtype:trojan-activity; sid:2009514; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET DELETED Vipdataend/Ceckno C&C Traffic - Checkin"; flow:established,to_server; dsize:<30; content:"VERSONEXc|3a|2|7c|212|7c|"; depth:16; reference:url,doc.emergingthreats.net/2008254; classtype:trojan-activity; sid:2008254; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FAKE/ROGUE AV Encoded data= HTTP POST"; flow:established,to_server; content:"POST"; nocase; http_method; content:"Cache-Control|3a 20|no-cache|0d 0a|"; http_header; content:"data=/CjEfcLas0KCj/"; http_client_body; nocase; reference:url,doc.emergingthreats.net/2009553; classtype:trojan-activity; sid:2009553; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET DELETED Delf CnC Channel Packet 1 reply"; flowbits:isset,ET.unk.1; flow:established,from_server; dsize:<15; content:"|05 00 00 00|"; depth:4; flowbits:set,ET.unk.2; reference:url,doc.emergingthreats.net/2008007; classtype:command-and-control; sid:2008007; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Fake/Rogue AV Landing Page Encountered"; flow:established,to_server; content:".php?"; nocase; http_uri; content:"land="; nocase; http_uri; content:"affid="; nocase; http_uri; pcre:"/\.php\?(land=\d+|affid=\d{5})&(land=\d+|affid=\d{5})$/Ui"; reference:url,en.wikipedia.org/wiki/Scareware; reference:url,doc.emergingthreats.net/2010347; classtype:trojan-activity; sid:2010347; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET DELETED Delf CnC Channel Checkin Replies"; flowbits:isset,ET.unk.2; flow:established,to_server; dsize:<20; content:"|09 00 00 00|"; depth:4; reference:url,doc.emergingthreats.net/2008008; classtype:command-and-control; sid:2008008; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Fake-Rean Installer Activity (Malwareurl.com Top 30)"; flow:to_server; content:"|2F|installer|2F|Installer|2E|exe"; nocase; http_uri; pcre:"/[1-3]\x2Finstaller\x2FInstaller\x2Eexe/Ui"; reference:url,www.sophos.com/security/analyses/viruses-and-spyware/trojfakereane.html?_log_from=rss; reference:url,doc.emergingthreats.net/2010221; classtype:trojan-activity; sid:2010221; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET DELETED Delf CnC Channel Packet 1"; flowbits:isnotset,ET.unk.1; flow:established,to_server; dsize:<200; content:"|8e 00 d0 00|"; depth:4; flowbits:set,ET.unk.1; flowbits:noalert; reference:url,doc.emergingthreats.net/2008006; classtype:command-and-control; sid:2008006; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Feral Checkin via HTTP"; flow:established,to_server; content:"?ucid="; nocase; http_uri; content:"&wmid="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007286; classtype:trojan-activity; sid:2007286; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET DELETED Banker.maf SMTP Checkin (Not in the Control...)"; flow:established,to_server; content:"|0a|X-Mailer|3a| Microsoft CDO for Windows 2000"; content:"|0d 0a|_-=|7c| Not in the Control System 6.0 |7c|=-_|0d 0a|.|0d 0a|"; distance:0; reference:url,doc.emergingthreats.net/2008033; classtype:trojan-activity; sid:2008033; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan-Dropper.Win32.Flystud"; flow:to_server,established; content:"loading.html?fn="; nocase; http_uri; content:"&pid="; nocase; http_uri; content:"&mid="; nocase; http_uri; content:"&cid="; nocase; http_uri; content:"&pn="; nocase; http_uri; content:"&clientid="; nocase; http_uri; content:"channel="; nocase; http_uri; content:"&stn="; nocase; http_uri; reference:url,doc.emergingthreats.net/2011086; classtype:trojan-activity; sid:2011086; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED System.Poser HTTP Checkin"; flow:established,to_server; content:"/check.php?c="; nocase; http_uri; content:"&v="; nocase; http_uri; content:"User-Agent|3a| Microsoft BITS"; http_header; reference:url,doc.emergingthreats.net/2008035; classtype:trojan-activity; sid:2008035; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Fragus Exploit Kit Landing"; flow:established,to_server; content:".php?"; nocase; http_uri; content:"id="; nocase; http_uri; content:"pid="; nocase; http_uri; content:"hello="; nocase; http_uri; pcre:"/\.php\?(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+$/Ui"; reference:url,jsunpack.jeek.org/dec/go?report=d60344851322218108076f1ad8d21435de9d5b7c; reference:url,www.malwareurl.com; reference:url,doc.emergingthreats.net/2011693; classtype:exploit-kit; sid:2011693; rev:5; metadata:created_at 2010_07_30, former_category EXPLOIT_KIT, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Nginx Server with modified version string - Often Hostile Traffic"; flow:established,from_server; content:"HTTP/1."; depth:7; content:"|0d 0a|Server|3a| nginx/"; nocase; pcre:"/Server\: nginx/[a-zA-Z]/i"; threshold:type limit, seconds 60, count 3, track by_src; reference:url,doc.emergingthreats.net/2008065; classtype:bad-unknown; sid:2008065; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Fullspace.cc or Related Checkin (1)"; flow:established,to_server; content:"/config.php?ver="; nocase; http_uri; content:"&uid="; nocase; http_uri; content:"&action="; nocase; http_uri; content:"&ras="; nocase; http_uri; content:"&verfull="; nocase; http_uri; reference:url,doc.emergingthreats.net/2008397; classtype:command-and-control; sid:2008397; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED General Downloader URL Pattern (/loader/setup.php)"; flow:established,to_server; content:"/loader/setup.php?id="; nocase; http_uri; reference:url,doc.emergingthreats.net/2008076; classtype:trojan-activity; sid:2008076; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PWS.Gamania Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"un="; http_client_body; content:"&pw="; http_client_body; content:"&sn="; http_client_body; content:"&l="; http_client_body; content:"&gd1="; http_client_body; content:"&pn="; http_client_body; reference:url,doc.emergingthreats.net/2008431; classtype:command-and-control; sid:2008431; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Xorer.ez HTTP Checkin to CnC"; flow:established,to_server; content:"/qq.html?username="; nocase; http_uri; content:"&zhaosp="; nocase; http_uri; reference:url,doc.emergingthreats.net/2008081; classtype:command-and-control; sid:2008081; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potential Gemini/Fake AV Download URL Detected"; flow:established,to_server; content:"/Layouts/Landings/CentralLandings/"; nocase; http_uri; content:"/images/"; nocase; http_uri; pcre:"/\x2FLayouts\x2FLandings\x2FCentralLandings\x2F\d+\x2Fimages\x2F/Ui"; reference:url,www.virustotal.com/analisis/c36e206c6dfe88345815da41c1b14b4f33a9636ad94dd46ce48f5b367f1c736c-1254242791; reference:url,doc.emergingthreats.net/2010450; classtype:trojan-activity; sid:2010450; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 81:90 (msg:"ET DELETED Looked.P/Gamania/Delf #108/! Style CnC Checkin"; flow:established,to_server; dsize:6; content:"#1"; depth:2; content:"/!"; distance:2; within:2; pcre:"/^\x23\d\d\d\x2f\x21/"; reference:url,doc.emergingthreats.net/bin/view/Main/Win32Looked; classtype:command-and-control; sid:2008219; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader Infostealer - GET Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"User-Agent|3a| wget 3.0|0d 0a|"; nocase; http_header; content:"aid="; nocase; http_uri; content:"os="; nocase; http_uri; content:"uid="; nocase; http_uri; reference:url,doc.emergingthreats.net/2009539; classtype:command-and-control; sid:2009539; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Winspywareprotect.com Fake AV/Anti-Spyware Secondary Checkin"; flow:established,to_server; content:"/stat.php?func=scanfinished&id="; http_uri; reference:url,doc.emergingthreats.net/2008251; classtype:trojan-activity; sid:2008251; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Win32/Agent.QBY CnC Post"; flow:established,to_server; content:"cike.php?fid="; nocase; http_uri; content: "&cid="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&tid="; nocase; http_uri; content:"&sn="; nocase; http_uri; reference:url,www.threatexpert.com/report.aspx?uid=4f05faef-6a70-4957-8990-b316d8487f63; reference:url,doc.emergingthreats.net/2010138; classtype:command-and-control; sid:2010138; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET DELETED Emogen Infection Checkin Initial Packet"; flow:established,to_server; dsize:<100; content:"|00 00 00 00 00 00|WindowsXP|00 00 00|"; flowbits:set,ET.emogen1; flowbits:noalert; reference:url,doc.emergingthreats.net/2008269; classtype:trojan-activity; sid:2008269; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Keylogger Infection Report via POST"; flow:established,to_server; content:"texto=|25 30 44 25 30 41 25 30 44 25 30 41|Computer"; content:"|25 30 44 25 30 41|IP|25 32 45 25 32 45 25 32 45 25 32 45 25 32 45|"; distance:0; reference:url,doc.emergingthreats.net/2008521; classtype:trojan-activity; sid:2008521; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET DELETED Emogen Infection Checkin CnC Keepalive"; flow:established,to_server; flowbits:isset,ET.emogen1; dsize:4; content:"test"; reference:url,doc.emergingthreats.net/2008270; classtype:command-and-control; sid:2008270; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Common Spambot HTTP Checkin"; flow:established,to_server; content:"os="; http_uri; content:"&user="; http_uri; content:"&status="; http_uri; content:"&uptime="; http_uri; content:"&cmd="; http_uri; reference:url,doc.emergingthreats.net/2008261; classtype:command-and-control; sid:2008261; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET DELETED Banker Infostealer/PRG POST on High Port"; flow:to_server,established; content:"POST"; nocase; http_method; content:"|2E|php|3F|2="; nocase; content:"|26|n="; nocase; content:"|26|v="; nocase; content:"|26|i="; nocase; content:"|26|sp="; nocase; content:"|26|lcp="; nocase; reference:url,www.securescience.net/FILES/securescience/10378/pubMalwareCaseStudy.pdf; reference:url,doc.emergingthreats.net/2008326; classtype:trojan-activity; sid:2008326; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Unnamed Generic.Malware http get"; flow:established,to_server; content:"/ww20/script.php?id="; nocase; http_uri; content:"&config="; nocase; content:!"User-Agent|3a|"; http_header; reference:url,doc.emergingthreats.net/2003431; classtype:trojan-activity; sid:2003431; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Unnamed - kuaiche.com related"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/config/fgun_install_"; http_uri; content:"User-Agent|3a| NSI SDL/1.2 (Mozilla)"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2008359; classtype:trojan-activity; sid:2008359; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Generic Trojan Checkin (double Content-Type headers)"; flow:to_server,established; content:"POST"; nocase; http_method; content:".php"; http_uri; content:"Content-Type|3a| text/html"; http_header; content:"Content-type|3a| image/gif"; http_header; reference:url,doc.emergingthreats.net/2010282; classtype:command-and-control; sid:2010282; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 8888 (msg:"ET DELETED Win32.Testlink Trojan Speed Test Start port 8888"; flow:established,to_server; dsize:25; content:"GET /test_link HTTP/1.0|0d 0a|"; reference:url,doc.emergingthreats.net/2008435; classtype:trojan-activity; sid:2008435; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gimmiv.A.dll Infection"; flow: to_server,established; content:"/test"; http_uri; content:".php"; http_uri; content:"?abc="; http_uri; content:"?def="; http_uri; reference:url,www.microsoft.com/security/portal/Entry.aspx?name=TrojanSpy%3aWin32%2fGimmiv.A; reference:url,doc.emergingthreats.net/2008689; classtype:trojan-activity; sid:2008689; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 8888 (msg:"ET DELETED Win32.Testlink Trojan Checkin port 8888"; flow:established,to_server; content:"/stat?uptime="; content:"&downlink="; distance:0; content:"&uplink="; distance:0; content:"&id="; distance:0; reference:url,doc.emergingthreats.net/2008437; classtype:trojan-activity; sid:2008437; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Glacial Dracon C&C Communication"; flow:established,to_server; content:"?id="; nocase; http_uri; content:"&ve="; nocase; http_uri; content:"&h="; nocase; http_uri; content:"&c[]="; nocase; depth:5; http_client_body; content:"&t[]="; nocase; http_client_body; content:"&u[]="; nocase; http_client_body; content:"&d[]="; nocase; http_client_body; content:"&p[]="; nocase; http_client_body; reference:md5,fd3d061ee86987e8f3f245c2dc0ceb46; reference:md5,912692cb4e3f960c9cb4bbc96fa17c9d; reference:url,doc.emergingthreats.net/2010163; classtype:command-and-control; sid:2010163; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 8888 (msg:"ET DELETED Win32.Testlink Trojan Speed Test port 8888"; flow:established,to_server; dsize:>1000; content:"Data|3a| |00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; depth:35; reference:url,doc.emergingthreats.net/2008436; classtype:trojan-activity; sid:2008436; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http any any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Possible Bobax trojan infection"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/reg|3f|u="; http_uri; content:"|26|v="; http_uri; reference:url,www.lurhq.com/bobax.html; reference:url,doc.emergingthreats.net/2001901; classtype:trojan-activity; sid:2001901; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED XPantivirus2008 Download"; flow:to_server,established; content:"GET"; depth:3; http_method; content:"XPantivirus20"; nocase; http_uri; pcre:"/XPantivirus20\d{2}_v\d{6}\.exe/Ui"; reference:url,www.theregister.co.uk/2008/08/22/anatomy_of_a_hack/page4.html; reference:url,seo.mhvt.net/blog/?p=390; reference:url,virscan.org/report/a61cd44fc387188da2ee3fbdeda10782.html; reference:url,doc.emergingthreats.net/2008516; classtype:trojan-activity; sid:2008516; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX EdrawSoft Office Viewer Component ActiveX FtpUploadFile Stack Buffer Overflow"; flow:to_client,established; content:" $EXTERNAL_NET 53 (msg:"ET DELETED Possible External Ultrasurf Anonymizer DNS Query"; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; threshold:type limit, track by_src,count 1, seconds 60; reference:url,doc.emergingthreats.net/2008533; classtype:policy-violation; sid:2008533; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX EdrawSoft Office Viewer Component ActiveX FtpUploadFile Format String Function Call Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"OfficeViewer.OfficeViewer"; nocase; distance:0; content:"FtpUploadFile"; nocase; reference:url,packetstormsecurity.org/files/109298/EdrawSoft-Office-Viewer-Component-ActiveX-5.6-Buffer-Overflow.html; classtype:attempted-user; sid:2014391; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_03_17, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 1030 (msg:"ET DELETED Ipbill.com Related Dialer Trojan Checkin"; flow:established,to_server; dsize:7; content:"|0a|"; offset:6; pcre:"/\d\d\d\d\d\d\x0a/"; flowbits:set,ET.ipbill1; reference:url,doc.emergingthreats.net/2008730; classtype:trojan-activity; sid:2008730; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Exploit kit download payload likely Hiloti Gozi FakeAV etc"; flow:to_server,established; content:"GET"; nocase; http_method; content:!"Referer|3a| "; http_header; nocase; content:"/eH"; http_uri; fast_pattern; pcre:"/\/[a-z0-9]+\.[a-z0-9]{2,4}\/eH[a-z0-9]{60,}$/Ui"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FHiloti.gen%21D; reference:url,doc.emergingthreats.net/2011103; classtype:exploit-kit; sid:2011103; rev:10; metadata:created_at 2010_07_30, former_category EXPLOIT_KIT, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET 1030 -> $HOME_NET any (msg:"ET DELETED Ipbill.com Related Dialer Trojan Server Response"; flow:established,from_server; dsize:<20; content:"|0a 5b 27|"; offset:2; depth:5; content:"|27 5d 0a|"; distance:0; flowbits:isset,ET.ipbill1; reference:url,doc.emergingthreats.net/2008731; classtype:trojan-activity; sid:2008731; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Exploit kit attack activity likely hostile"; flow:to_server,established; content:"GET"; nocase; http_method; content:!"Referer|3a| "; http_header; nocase; content:"/oH"; http_uri; fast_pattern; pcre:"/\/[a-z0-9]+\.[a-z0-9]{2,4}\/oH[a-z0-9]{60,}$/Ui"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FHiloti.gen%21D; reference:url,doc.emergingthreats.net/2011104; classtype:exploit-kit; sid:2011104; rev:10; metadata:created_at 2010_07_30, former_category EXPLOIT_KIT, updated_at 2010_07_30;) +#alert tcp any any -> any 5554 (msg:"ET DELETED Sasser FTP Traffic"; flow: to_server,established; content:"up.exe"; reference:url,vil.mcafeesecurity.com/vil/content/Print125009.htm; reference:url,doc.emergingthreats.net/2000040; classtype:misc-activity; sid:2000040; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Hitpop Checkin"; flow:established,to_server; content:"/stat.htm?id="; nocase; http_uri; content:"&agt="; nocase; http_uri; content:"&r=http"; http_uri; nocase; content:"&OS="; nocase; http_uri; content:"&ntime="; nocase; http_uri; content:"&rtime="; nocase; http_uri; reference:url,atlas-public.ec2.arbor.net/docs/Hitpop_DDoS_Malware_Analysis_PUBLIC.pdf; reference:url,doc.emergingthreats.net/2008275; classtype:command-and-control; sid:2008275; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp any any -> any 9996 (msg:"ET DELETED Sasser Transfer _up.exe"; flow: established,to_server; content:"|5F75702E657865|"; depth: 250; reference:url,vil.mcafeesecurity.com/vil/content/Print125009.htm; reference:url,doc.emergingthreats.net/2000047; classtype:misc-activity; sid:2000047; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Hupigon User Agent Detected (SykO)"; flow:established,to_server; content:"User-Agent|3a| SykO"; http_header; nocase; reference:url,doc.emergingthreats.net/2003649; classtype:trojan-activity; sid:2003649; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Dyreza RAT Checkin Response 2"; flow:established,to_client; dsize:3; content:"/1/"; reference:url,phishme.com/project-dyre-new-rat-slurps-bank-credentials-bypasses-ssl/; classtype:trojan-activity; sid:2018597; rev:4; metadata:created_at 2014_06_24, updated_at 2014_06_24;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Hupigon User Agent Detected (IE_7.0)"; flow:established,to_server; content:"User-Agent|3a| IE_7.0"; http_header; nocase; reference:url,doc.emergingthreats.net/2003932; classtype:trojan-activity; sid:2003932; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED W32/Sasser.worm.b"; flow: established; content:"|58 BC 0C FF 59 57 32 31 BD EC 34 64 6E D6 E3 8D 65 04 68 58 62 79 DF D8 2C 25 6A B5 28 BA 13 74|"; reference:url,securityresponse.symantec.com/avcenter/venc/data/w32.sasser.worm.html; reference:url,doc.emergingthreats.net/2001056; classtype:misc-activity; sid:2001056; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE KillAV/Dropper/Mdrop/Hupigon - HTTP GET"; flow:established,to_server; content:"GET"; nocase; http_method; content:".asp?mac="; nocase; http_uri; content:"&xxx="; nocase; http_uri; content:"User-Agent|3a| baidu|0d 0a|"; http_header; nocase; reference:url,doc.emergingthreats.net/2009811; classtype:trojan-activity; sid:2009811; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED W32/Sasser.worm.a"; flow: established; content:"|BC 3B 74 0B 50 8B 3D E8 46 A7 3D 09 85 B8 F8 CD 76 40 DE 7C 5B 5C D7 2A A8 E8 58 75 62 96 25 24|"; reference:url,securityresponse.symantec.com/avcenter/venc/data/w32.sasser.worm.html; reference:url,doc.emergingthreats.net/2001057; classtype:misc-activity; sid:2001057; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Inject.BV Trojan User Agent Detected (faserx)"; flow:established,to_server; content:"User-Agent|3a| faser"; http_header; nocase; reference:url,doc.emergingthreats.net/2003637; classtype:trojan-activity; sid:2003637; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert ip $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible CIA Trojan download/upload attempt"; content:"|6C 75 66 6A 65 6F 6F|"; reference:url,doc.emergingthreats.net/2001233; classtype:trojan-activity; sid:2001233; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Insidebar.co.kr Related Infection Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"e=inside&s="; http_client_body; content:"&ver="; http_client_body; content:"&p="; http_client_body; reference:url,doc.emergingthreats.net/2008760; classtype:command-and-control; sid:2008760; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Beagle User Agent Detected"; flow: to_server,established; dsize:<150; content:"User-Agent|3a| beagle_beagle"; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/w32.beagle.i@mm.html; reference:url,doc.emergingthreats.net/2001269; classtype:trojan-activity; sid:2001269; rev:17; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Klom.A Connecting to Controller"; flow:established,to_server; content:"/s_13_0?m="; nocase; http_uri; content:"r="; nocase; http_uri; content:"&a="; nocase; http_uri; content:"&os="; nocase; http_uri; reference:url,www.bitdefender.com/VIRUS-1000126-en--Trojan.Klom.A.html; reference:url,doc.emergingthreats.net/2003538; classtype:trojan-activity; sid:2003538; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET DELETED Outbound W32.Novarg.A worm"; flow: established; content:"TVqQAAMAAAAEAAAA"; content:"8AALgAAAAAAAAAQ"; within: 20; distance: 2; content:"UEUA..AEwBAW"; content:"DgAA8BCwEHAABQAAAAE"; within: 40; distance: 16; content:"ABVUFgwAAAAAABgAAAAEAAAAAAAAAAEA"; content:"ACAAADg"; within: 30; distance: 16; reference:url,securityresponse.symantec.com/avcenter/venc/data/w32.mydoom.a@mm.html; reference:url,doc.emergingthreats.net/2001273; classtype:trojan-activity; sid:2001273; rev:14; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Knockbot Proxy Response From Controller"; flow:established,from_server; content:"|0d 0a 0d 0a|command|7c|file|7c|http"; depth:250; nocase; content:"|7c|"; within:150; reference:url,www.malwaredomainlist.com/mdl.php?search=knock.php; reference:url,doc.emergingthreats.net/2010787; classtype:trojan-activity; sid:2010787; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> any 445 (msg:"ET DELETED Korgo.P offering executable"; flow: to_server,established; content:"|FF|SMB"; depth: 10; content:"|58|http"; content:".exe"; nocase; within: 36; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; reference:url,doc.emergingthreats.net/2001337; classtype:trojan-activity; sid:2001337; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32.Koblu"; flow:established,to_server; content:"GET"; nocase; http_method; content:"sid="; nocase; http_uri; content:"&sa="; nocase; http_uri; content: "&p="; http_uri; content:"&q=cards&rf="; http_uri; content:"&enc="; http_uri; content:"&enk=&xsc=&xsp=&xsm="; http_uri; reference:url,doc.emergingthreats.net/2010230; classtype:trojan-activity; sid:2010230; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> any any (msg:"ET DELETED Korgo.P binary upload"; flow: to_server,established; content:"|aa4f7ea86c90457d686868f0de687a68689768686868|"; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; reference:url,doc.emergingthreats.net/2001338; classtype:trojan-activity; sid:2001338; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Koobface fetch C&C command detected"; flow:established, to_server; content:".php"; nocase; http_uri; content:"f=0&a="; fast_pattern; content:"&v="; content:"&c="; content:"&s="; content:"&l="; content:"&ck="; content:"&c_fb="; content:"&c_ms="; content:"&c_hi="; content:"&c_be="; content:"&c_fr="; content:"&c_yb="; content:"&c_tg="; content:"&c_nl="; content:"&c_fu="; reference:url,us.trendmicro.com/imperia/md/content/us/trendwatch/researchandanalysis/the_20heart_20of_20koobface_final_1_.pdf; reference:url,doc.emergingthreats.net/2010153; classtype:command-and-control; sid:2010153; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Couponage Reporting"; flow: to_server,established; content:"/?keyword="; nocase; content:"couponage.com"; nocase; reference:url,www3.ca.com/securityadvisor/pest/pest.aspx?id=453090725; reference:url,doc.emergingthreats.net/bin/view/Main/2001455; classtype:policy-violation; sid:2001455; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Korklic.A"; flow:to_server,established; content:"GET"; nocase; http_method; content:"mode=boot&MyValue="; http_uri; content:"&code="; http_uri; pcre:"/MyValue=[a-f0-9]{2}\:[a-f0-9]{2}\:[a-f0-9]{2}\:[a-f0-9]{2}\:/Ui"; reference:url,doc.emergingthreats.net/2009003; classtype:trojan-activity; sid:2009003; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 5554 (msg:"ET DELETED Sasser FTP exploit attempt"; flow: to_server,established; dsize: >150; content:"PORT "; depth: 5; reference:url,www.lurhq.com/dabber.html; reference:url,doc.emergingthreats.net/2001548; classtype:attempted-admin; sid:2001548; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Lager Trojan Reporting Spam"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/sp/post.php"; nocase; http_uri; content:"data="; depth:400; reference:url,www.viruslist.com/en/viruses/encyclopedia?virusid=87732; reference:url,doc.emergingthreats.net/2003190; classtype:trojan-activity; sid:2003190; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED F5 BIG-IP 3DNS TCP Probe 1"; id: 1; dsize: 24; flags: S,12; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; window: 2048; reference:url,www.f5.com/f5products/v9intro/index.html; reference:url,doc.emergingthreats.net/2001609; classtype:misc-activity; sid:2001609; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET 1025:5000 (msg:"ET MALWARE Possible Web-based DDoS-command being issued"; flow: established,from_server; content: "Server|3a| nginx/0."; offset: 17; depth: 19; content: "Content-Type|3a| text/html"; content:"|3a|80|3b|255.255.255.255"; fast_pattern; reference:url,doc.emergingthreats.net/2003296; classtype:trojan-activity; sid:2003296; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED F5 BIG-IP 3DNS TCP Probe 2"; id: 2; dsize: 24; flags: S,12; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; window: 2048; reference:url,www.f5.com/f5products/v9intro/index.html; reference:url,doc.emergingthreats.net/2001610; classtype:misc-activity; sid:2001610; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED MBR Trojan (Sinowal/Mebroot/) Phoning Home"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/ld/mat"; nocase; http_uri; content:".php"; nocase; http_uri; content:"id="; http_client_body; depth:3; content:"&hit="; http_client_body; reference:url,doc.emergingthreats.net/2007747; classtype:trojan-activity; sid:2007747; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED F5 BIG-IP 3DNS TCP Probe 3"; id: 3; dsize: 24; flags: S,12; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; window: 2048; reference:url,www.f5.com/f5products/v9intro/index.html; reference:url,doc.emergingthreats.net/2001611; classtype:misc-activity; sid:2001611; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Mcboo.com/Bundlext.com related Trojan Checkin URL"; flow:established,to_server; content:"/ack.php?version="; http_uri; content:"&uid="; http_uri; content:"&status="; http_uri; reference:url,doc.emergingthreats.net/2008758; classtype:command-and-control; sid:2008758; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED JoltID Agent P2P via Proxy Server"; flow: to_server,established; content:"POST http|3a|//"; nocase; content:"|3a|3531/.pkt"; nocase; within: 20; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.p2pnetworking.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001679; classtype:trojan-activity; sid:2001679; rev:14; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MEREDROP/micr0s0fts.cn Related Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/update.asp"; http_uri; content:"ver="; http_client_body; depth:4; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; http_client_body; reference:url,doc.emergingthreats.net/2008891; classtype:command-and-control; sid:2008891; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> [208.8.81.0/24,64.68.96.0/19] 443 (msg:"ET DELETED MyWebEx Server Traffic"; flow: to_server,established; dsize: <50; content:"|17|"; offset: 0; depth: 1; threshold: type limit,track by_src, count 1, seconds 360; reference:url,www.mywebexpc.com; reference:url,doc.emergingthreats.net/2001712; classtype:policy-violation; sid:2001712; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Metajuan trojan checkin"; flow:established,to_server; content:"trafc-2/rfe"; nocase; http_uri; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2007-030112-0714-99; reference:url,doc.emergingthreats.net/2007811; classtype:command-and-control; sid:2007811; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> [208.8.81.0/24,64.68.96.0/19] $HTTP_PORTS (msg:"ET DELETED MyWebEx Installation"; flow: to_server,established; content:"/pc/r.php?AT=RS"; nocase; threshold: type limit, track by_src, count 1, seconds 30; reference:url,www.mywebexpc.com; reference:url,doc.emergingthreats.net/2001713; classtype:policy-violation; sid:2001713; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.MisleadApp Fake Security Product Install"; flow:established,to_server; content:"GET"; nocase; http_method; content:"hash?http"; nocase; http_uri; pcre:"/\/(ucleaner|udefender|ufixer)\.com\/demo\.php\?/Ui"; reference:url,doc.emergingthreats.net/2007566; classtype:trojan-activity; sid:2007566; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp [208.8.81.0/24,64.68.96.0/19] 443 -> $HOME_NET any (msg:"ET DELETED MyWebEx Incoming Connection"; flow: to_client,established; content:"|16 03|"; offset: 0; depth: 2; content:"Comodo"; nocase; depth: 240; content:"accessanywhere.com"; nocase; offset: 592; depth: 48; reference:url,www.mywebexpc.com; reference:url,doc.emergingthreats.net/2001714; classtype:policy-violation; sid:2001714; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Monkif Downloader Checkin"; flow:to_server,established; content:"/cgi/"; http_uri; content:".php?"; nocase; http_uri; content:"x640 any any (msg:"ET DELETED Spambot Suspicious 220 Banner on Local Port"; flow: established; content:"220 "; offset: 0; depth: 4; tag: session, 20, packets; reference:url,doc.emergingthreats.net/bin/view/Main/2001815; classtype:non-standard-protocol; sid:2001815; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Nanspy Bot Checkin"; flow:established,to_server; content:"HEAD"; nocase; http_method; content:"/bbcount.php?action="; http_uri; content:"&uid="; http_uri; content:"&locale="; http_uri; content:"&build="; http_uri; reference:url,doc.emergingthreats.net/2010158; classtype:command-and-control; sid:2010158; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 1345 (msg:"ET DELETED AIM Bot Outbound Control Channel Open and Login"; flow: to_server,established; content:"PASS"; nocase; pcre:"/PASS\s.*?\x0d\x0aNICK\s.*?\x0d\x0aUSER\s.*?\s\d\s\d\s\:\S/im"; reference:url,doc.emergingthreats.net/2001910; classtype:trojan-activity; sid:2001910; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Navipromo related update"; flow:established,to_client; content:"|0d 0a|Server|3a| lighttpd|0d 0a 0d 0a|_SYSTEM_DIR_"; reference:url,doc.emergingthreats.net/2009694; classtype:trojan-activity; sid:2009694; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible MSN Worm Exploit exe"; flow: established; content:"X-MMS-IM-"; depth:153; content:"http"; nocase; content:".exe"; nocase; reference:url,doc.emergingthreats.net/2002323; classtype:misc-activity; sid:2002323; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Nine Ball Infection ya.ru Post"; flow:established,to_server; content:"POST"; http_method; nocase; content:"/gate/"; http_uri; content:".php"; http_uri; content:"|0d 0a 0d 0a|"; content:"ya.ru/"; distance:67; within:6; reference:url,www.martinsecurity.net/page/3; reference:url,doc.emergingthreats.net/2011186; classtype:trojan-activity; sid:2011186; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible MSN Worm Exploit php"; flow: established; content:"X-MMS-IM-"; depth:153; content:"http"; nocase; content:".php"; nocase; reference:url,doc.emergingthreats.net/2002322; classtype:misc-activity; sid:2002322; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NoBo Downloader Dropper GET"; flow:established,to_server; content:"GET"; nocase; http_method; content:"User-Agent|3a| NoBo"; http_header; reference:url,www.spynomore.com/trojan-nobo-v1-3.htm; reference:url,doc.emergingthreats.net/2009443; classtype:trojan-activity; sid:2009443; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible MSN Worm Exploit pif"; flow: established; content:"X-MMS-IM-"; depth:153; content:"http"; nocase; content:".pif"; nocase; reference:url,doc.emergingthreats.net/2002324; classtype:misc-activity; sid:2002324; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Obitel trojan calling home"; flow:established,to_server; content:"/gate.php?hash="; http_uri; content:"/gate.php?hash="; content:" HTTP/1."; distance:8; within:16; reference:url,www.abuse.ch/?p=143; reference:url,doc.emergingthreats.net/2008405; classtype:trojan-activity; sid:2008405; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED W32.kelvir.HI"; flow: established; content:"X-MMS-IM-"; depth:153; content:"search.php?data="; reference:url,securityresponse.symantec.com/avcenter/venc/data/w32.kelvir.hi.html; reference:url,doc.emergingthreats.net/2002325; classtype:misc-activity; sid:2002325; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Oficla Russian Malware Bundle C&C instruction response with runurl"; flow:established,to_client; content:"|0d 0a 0d 0a|[info]runurl|3a|"; content:"|7c|taskid|3a|"; within:100; content:"|7c|delay|3a|"; within:30; content:"|7c|upd|3a|"; within:20; content:"[/info]"; distance:0; reference:url,malwarelab.org/2009/11/russian-malware-bundle/; reference:url,doc.emergingthreats.net/2010723; classtype:command-and-control; sid:2010723; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"ET DELETED Mercury v4.01a IMAP RENAME Buffer Overflow"; flow:established,to_server; flowbits:isset,mercury.imap.401a; content:"a001 RENAME"; pcre:"/[0-9A-Z]{240,}/smi"; reference:url,www.pmail.com/whatsnew/m32401.htm; reference:url,metasploit.com/projects/Framework/exploits.html#mercury_imap; reference:bugtraq,11775; reference:url,doc.emergingthreats.net/bin/view/Main/2002390; classtype:misc-attack; sid:2002390; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Oficla Russian Malware Bundle C&C instruction response"; flow:established,to_client; content:"|0d 0a 0d 0a|[info]kill|3a|"; content:"|7c|delay|3a|"; within:50; content:"|7c|upd|3a|"; within:20; content:"[/info]"; distance:0; reference:url,malwarelab.org/2009/11/russian-malware-bundle/; reference:url,doc.emergingthreats.net/2010724; classtype:command-and-control; sid:2010724; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $HOME_NET 143 -> $EXTERNAL_NET any (msg:"ET DELETED Vulnerable Mercury 4.01a IMAP Banner"; flow: from_server,established; content:"IMAP4rev1 Mercury/32 v4.01a server ready"; flowbits:set,mercury.imap.401a; reference:url,www.pmail.com/whatsnew/m32401.htm; reference:bugtraq,11775; reference:url,doc.emergingthreats.net/bin/view/Main/2002389; classtype:successful-recon-limited; sid:2002389; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Oficla Russian Malware Bundle C&C instruction response (2)"; flow:established,to_client; content:"|0d 0a 0d 0a|[info]delay|3a|"; content:"|7c|upd|3a|"; within:20; content:"[/info]"; distance:0; reference:url,malwarelab.org/2009/11/russian-malware-bundle/; reference:url,doc.emergingthreats.net/2010744; classtype:command-and-control; sid:2010744; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED WMF Escape Record Exploit - Web Only - all versions"; flow:established,from_server; flowbits:isnotset,emerging_wmf_http; content:"HTTP"; depth:4; nocase; flowbits:set,emerging_wmf_http; flowbits:noalert; reference:url,www.frsirt.com/english/advisories/2005/3086; reference:url,doc.emergingthreats.net/bin/view/Main/2002743; classtype:unknown; sid:2002743; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE onmuz.com Infection Activity"; flow:established,to_server; content:"pid=patchup_notpid_update^on"; http_uri; content:"/logonmuz"; http_uri; reference:url,doc.emergingthreats.net/2008973; classtype:trojan-activity; sid:2008973; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED WMF Escape Record Exploit - Web Only - version 3"; flow:established; flowbits:isset,emerging_wmf_http; flowbits:isnotset,emerging_wmf_expl; flowbits:isnotset,emerging_wmf_expl_v1; content:"|00 09 00 00 03|"; content:"|00 00|"; distance:10; within:12; flowbits:set,emerging_wmf_expl; flowbits:noalert; reference:url,www.frsirt.com/english/advisories/2005/3086; reference:url,doc.emergingthreats.net/bin/view/Main/2002741; classtype:unknown; sid:2002741; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Opachki Link Hijacker Traffic Redirection"; flow:established,to_server; content:"/?do=rphp"; nocase; http_uri; content:"&sub="; nocase; http_uri; content:"&b="; nocase; http_uri; content:"&q="; nocase; http_uri; content:"&orig="; nocase; http_uri; reference:url,www.secureworks.com/research/threats/opachki/?threat=opachki; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3aWin32%2fOpachki.A; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2009-092213-3317-99&tabid=2; reference:url,doc.emergingthreats.net/2010224; classtype:trojan-activity; sid:2010224; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED WMF Escape Record Exploit - Web Only - version 1"; flow:established; flowbits:isset,emerging_wmf_http; flowbits:isnotset,emerging_wmf_expl; flowbits:isnotset,emerging_wmf_expl_v1; content:"|00 09 00 00 01|"; content:"|00 00|"; distance:10; within:12; flowbits:set,emerging_wmf_expl_v1; flowbits:noalert; reference:url,www.frsirt.com/english/advisories/2005/3086; reference:url,doc.emergingthreats.net/bin/view/Main/2002757; classtype:unknown; sid:2002757; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Prg Trojan HTTP POST v1"; flow:established,to_server; content:"POST"; nocase; http_method; content:".php?2="; http_uri; content:"&n="; http_uri; content:"&v="; http_uri; content:"&i="; http_uri; content:"&sp="; http_uri; content:"&lcp="; http_uri; reference:url,www.securescience.net/FILES/securescience/10378/pubMalwareCaseStudy.pdf; reference:url,doc.emergingthreats.net/2007688; classtype:trojan-activity; sid:2007688; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED WMF Escape Record Exploit - Version 1"; flow:established; flowbits:isset,emerging_wmf_expl_v1; pcre:"/\x26[\x00-\xff]\x09\x00/"; flowbits:unset,emerging_wmf_http; flowbits:unset,emerging_wmf_expl; flowbits:unset,emerging_wmf_expl_v1; threshold:type limit, track by_src, count 1,seconds 120; reference:url,www.frsirt.com/english/advisories/2005/3086; reference:url,doc.emergingthreats.net/bin/view/Main/2002758; classtype:attempted-user; sid:2002758; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Prg Trojan HTTP POST version 2"; flow:established,to_server; content:"POST"; nocase; http_method; content:".php?1="; http_uri; content:"&i="; http_uri; pcre:"/\.php\?1=[a-z0-9]+_[a-z0-9_]+&i=/Ui"; reference:url,www.securescience.net/FILES/securescience/10378/pubMalwareCaseStudy.pdf; reference:url,doc.emergingthreats.net/2007724; classtype:trojan-activity; sid:2007724; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED WMF Escape Record Exploit - Version 3"; flow:established; flowbits:isset,emerging_wmf_expl; pcre:"/\x26[\x00-\xff]\x09\x00/"; flowbits:unset,emerging_wmf_http; flowbits:unset,emerging_wmf_expl; flowbits:unset,emerging_wmf_expl_v1; threshold:type limit, track by_src, count 1,seconds 120; reference:url,www.frsirt.com/english/advisories/2005/3086; reference:url,doc.emergingthreats.net/bin/view/Main/2002742; classtype:attempted-user; sid:2002742; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET 82 (msg:"ET MALWARE LD Pinch Checkin (HTTP POST on port 82)"; flow:established,to_server; content:"POST"; nocase; http_method; content:".php"; content:"a="; content:"&b="; content:"&d="; content:"&c="; nocase; reference:url,doc.emergingthreats.net/2008366; classtype:command-and-control; sid:2008366; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED VMM Detecting Torpig/Anserin/Sinowal Trojan"; flow:to_client,established; content:"|51 51 0F 01 4C 24 00 8B 44 24 02 59 59 C3 E8 ED FF FF FF 25 00 00 00 FF 33 C9 3D 00 00 00 80 0F 95 C1 8B C1 C3|"; reference:url,doc.emergingthreats.net/2003094; classtype:trojan-activity; sid:2003094; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan-PWS.Win32.VB.tr Checkin Detected"; flow:established,to_server; content:"POST"; nocase; http_method; content:".asp"; http_uri; content:"id="; content:"&tit="; content:"&comm"; content:"Run|2B|Successfully"; fast_pattern; reference:url,doc.emergingthreats.net/2008506; classtype:command-and-control; sid:2008506; rev:9; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED (UPX) VMM Detecting Torpig/Anserin/Sinowal Trojan"; flow:to_client,established; content:"|51 51 0F 01 27 00 C1 FB B5 D5 35 02 E2 C3 D1 66 25 32 BD 83 7F B7 4E 3D 06 80 0F 95 C1 8B C1 C3|"; reference:url,doc.emergingthreats.net/2003095; classtype:trojan-activity; sid:2003095; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Generic PSW Agent server reply"; flow:from_server,established; content:"200"; http_stat_code; content:"OK"; http_stat_msg; content:"|0d 0a|[Uptade]|0d 0a|Web="; content:"|0d 0a|[Guncellestirme]|0d 0a|Version="; within:100; reference:url,doc.emergingthreats.net/2008662; classtype:trojan-activity; sid:2008662; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Warezov/Stration Challenge Response"; flowbits:isset,BEposs.warezov.challenge; flow:established,from_server; dsize:4; content:"|00 00 00 00|"; reference:url,www.sophos.com/security/analyses/w32strationbo.html; reference:url,doc.emergingthreats.net/2003176; classtype:trojan-activity; sid:2003176; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PassSickle Reporting User Activity"; flow:established,to_server; content:".php?id="; nocase; http_uri; content:"&data="; nocase; http_uri; content:"PassSickle"; http_header; nocase; pcre:"/^User-Agent\:[^\n]+PassSickle/Hmi"; reference:url,doc.emergingthreats.net/2002859; classtype:trojan-activity; sid:2002859; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Warezov/Stration Challenge"; flow:established,to_server; dsize:1; content:"|38|"; flowbits:noalert; flowbits:set,BEposs.warezov.challenge; reference:url,www.sophos.com/security/analyses/w32strationbo.html; reference:url,doc.emergingthreats.net/2003175; classtype:not-suspicious; sid:2003175; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Pasta Downloader - GET Checkin to Fake GIF"; flow:established,to_server; content:"GET"; nocase; http_method; content:".gif?"; content:!"c.gif?"; nocase; http_uri; content:!"__utm.gif?"; http_uri; nocase; http_uri; content:"t="; nocase; http_uri; content:"q="; nocase; http_uri; content:"p="; nocase; http_uri; content:"pn="; nocase; http_uri; reference:url,malwarebytes.org/malwarenet.php?name=Trojan.Pasta; reference:url,doc.emergingthreats.net/2009522; classtype:command-and-control; sid:2009522; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http any any -> any $HTTP_PORTS (msg:"ET DELETED Allaple Unique HTTP Request - Possibly part of DDOS"; flow:established,to_server; content:"GET / HTTP/1.1|0d 0a|"; rawbytes; depth:20; threshold:type both, count 1, seconds 60, track by_src; reference:url,doc.emergingthreats.net/2003484; reference:url,isc.sans.org/diary.html?storyid=2451; classtype:trojan-activity; sid:2003484; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Personal Defender 2009 - prinimalka.py"; flow:established,to_server; content:"/prinimalka.py"; http_uri; reference:url,malwarebytes.besttechie.net/2008/11/03/removal-instructions-for-personal-defender-2009/; reference:url,doc.emergingthreats.net/2009405; classtype:trojan-activity; sid:2009405; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 1800 (msg:"ET DELETED TroDjan 2.0 Infection Report"; flow:established,to_server; dsize:<60; content:"Windows NT "; depth:11; reference:url,doc.emergingthreats.net/2008587; classtype:trojan-activity; sid:2008587; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Personal Defender 2009 - trash.py"; flow:established,to_server; content:"/trash.py"; http_uri; reference:url,malwarebytes.besttechie.net/2008/11/03/removal-instructions-for-personal-defender-2009/; reference:url,doc.emergingthreats.net/2009406; classtype:trojan-activity; sid:2009406; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET 1802 -> $HOME_NET any (msg:"ET DELETED TroDjan 2.0 FTP Channel Open Command"; flow:established,to_server; dsize:7; content:"ftpopen"; reference:url,doc.emergingthreats.net/2008588; classtype:trojan-activity; sid:2008588; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Phoenix Exploit Kit VBscript download"; flow:established,to_client; content:"Createobject(StrReverse("; nocase; content:"|22|tcejbOmetsySeliF.gnitpircS|22|))"; nocase; distance:0; flowbits:set,et.exploitkitlanding; reference:url,doc.emergingthreats.net/2011184; classtype:exploit-kit; sid:2011184; rev:4; metadata:created_at 2010_07_30, former_category EXPLOIT_KIT, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 8392 (msg:"ET DELETED Torpig Initial CnC Connect on port 8392"; flow:established,to_server; dsize:4; content:"|00 00 78 e3|"; flowbits:set,ET.torpig.init; reference:url,doc.emergingthreats.net/2010826; classtype:command-and-control; sid:2010826; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Piptea.a Related Trojan Checkin (3)"; flow:established,to_server; content:"/cd/un.php?id="; http_uri; content:"&ver="; http_uri; pcre:"/\/cd\/un\.php.id=[A-F0-9\-]+&ver=/U"; reference:url,doc.emergingthreats.net/2008384; classtype:command-and-control; sid:2008384; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 8392 (msg:"ET DELETED Torpig CnC Connect on port 8392"; flowbits:isset,ET.torpig.init; flow:established,to_server; content:"|00 00|"; depth:2; content:"|00 00 00|"; distance:2; within:5; flowbits:set,ET.torpig.fosure; reference:url,doc.emergingthreats.net/2010827; classtype:command-and-control; sid:2010827; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Pointfree.co.kr Trojan/Spyware Infection Checkin"; flow:established,to_server; content:"log.php?mac="; http_uri; content:"&hdd="; content:"&ver="; http_uri; content:"&ie="; http_uri; content:"&win="; http_uri; reference:url,doc.emergingthreats.net/2008972; classtype:command-and-control; sid:2008972; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET 8392 -> $HOME_NET any (msg:"ET DELETED Torpig CnC IP Report Command on port 8392"; flowbits:isset,ET.torpig.fosure; flow:established,from_server; dsize:4; content:"|00 00 00 0d|"; reference:url,doc.emergingthreats.net/2010828; classtype:command-and-control; sid:2010828; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Proxy.Win32.Agent.mx CnC Beacon"; flow:established,to_server; content:"q.php"; nocase; http_uri; content:"&m="; nocase; http_uri; content:"&a="; nocase; http_uri; content:"&x="; nocase; http_uri; content:"&i="; nocase; http_uri; reference:url,doc.emergingthreats.net/2006405; classtype:command-and-control; sid:2006405; rev:4; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2010_07_30, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +#alert tcp $EXTERNAL_NET 8392 -> $HOME_NET any (msg:"ET DELETED Torpig CnC Report Command on port 8392"; flowbits:isset,ET.torpig.fosure; flow:established,from_server; dsize:4; content:"|00 00 01 6f|"; reference:url,doc.emergingthreats.net/2010829; classtype:command-and-control; sid:2010829; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Pushdo Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"m="; http_uri; content:"&a="; http_uri; content:"&os="; http_uri; pcre:"/&os=[a-f0-9]{50}/U"; reference:url,doc.emergingthreats.net/2008493; classtype:command-and-control; sid:2008493; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Armitage Loader Check-in"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/lds.php"; http_uri; reference:url,doc.emergingthreats.net/2009036; classtype:trojan-activity; sid:2009036; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Qhosts Trojan Check-in"; flow:established,to_server; content:"POST"; nocase; http_method; content:".php"; http_uri; content:"UserID="; http_client_body; content:"&wv="; http_client_body; content:"&res="; http_client_body; content:"&lng="; http_client_body; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2003-100116-5901-99; reference:url,doc.emergingthreats.net/2009517; classtype:trojan-activity; sid:2009517; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL DELETED wu-ftp bad file completion attempt"; flow:to_server,established; content:"~"; content:"["; distance:0; reference:bugtraq,3581; reference:bugtraq,3707; reference:cve,2001-0550; reference:cve,2001-0886; classtype:misc-attack; sid:2101377; rev:18; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Rcash.co.kr Bootup Checkin via HTTP"; flow:established,to_server; content:"/install/Boot.asp?macaddr="; nocase; http_uri; content:"&partner="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007807; classtype:command-and-control; sid:2007807; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL DELETED wu-ftp bad file completion attempt with brace"; flow:to_server,established; content:"~"; content:"{"; distance:0; reference:bugtraq,3581; reference:bugtraq,3707; reference:cve,2001-0550; reference:cve,2001-0886; classtype:misc-attack; sid:2101378; rev:18; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Renos/ssd.com HTTP Checkin"; flow:established,to_server; content:"/dlp.php?"; nocase; http_uri; content:"&m="; nocase; http_uri; content:"&ydf="; nocase; http_uri; content:"&e="; nocase; http_uri; content:"&w=___"; nocase; http_uri; content:"&t="; nocase; http_uri; content:"&apzx="; nocase; http_uri; content:"&apz="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007834; classtype:command-and-control; sid:2007834; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $HOME_NET 81 -> $EXTERNAL_NET any (msg:"ET DELETED Bifrose Response from victim"; flow:established,from_server; dsize:13; content:"|09 00 00 00 9a|"; depth:5; content:"|74|"; distance:7; within:8; reference:url,doc.emergingthreats.net/2009797; classtype:trojan-activity; sid:2009797; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE RhiFrem Trojan Activity - cmd"; flow:to_server,established; content:"GET"; nocase; http_method; content:"?mod=cmd&user="; http_uri; content:"User-Agent|3A| Mozilla/5.0 Gecko/20050212 Firefox/1.5.0.2"; http_header; pcre:"/^GET\x20[^\x0D\x0A]+\x3Fmod\x3Dcmd\x26user\x3D\w+[^\x0D\x0A]*\x20HTTP\x2F1\x2E0\x0D\x0A.*\x0D\x0AHost\x3A\x20\w+/"; reference:url,www.castlecops.com/U_S_Courts_phish792683.html; reference:url,doc.emergingthreats.net/2008139; classtype:trojan-activity; sid:2008139; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Clod/Sereki Communication with C&C"; flow:established,to_server; content:".php?id="; http_uri; nocase; content:"&cnt="; http_uri; nocase; pcre:"/\.php\?id=\d+_[0-9a-f]{8}-[0-9a-f]+-[0-9a-f]{8}&cnt=/U"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3aWin32%2fSereki.A; reference:url,doc.emergingthreats.net/2010289; reference:md5,bbb6ac2181dbbe15efd13c294cb991fa; reference:md5,3c39bfc78fcf3fe805c7472296bf6319; classtype:trojan-activity; sid:2010289; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE RhiFrem Trojan Activity - log"; flow:to_server,established; content:"POST"; nocase; http_method; content:"?mod=log&user="; fast_pattern; http_uri; content:"User-Agent|3A| Mozilla/5.0 Gecko/20050212 Firefox/1.5.0.2"; http_header; pcre:"/^POST\x20[^\x0D\x0A]+\x3Fmod\x3Dlog\x26user\x3D\w+[^\x0D\x0A]*\x20HTTP\x2F1\x2E0\x0D\x0A.*\x0D\x0AHost\x3A\x20\w+.*\x0D\x0A\x0D\x0Acurr\x3D.*\x26next\x3D/"; reference:url,www.castlecops.com/U_S_Courts_phish792683.html; reference:url,doc.emergingthreats.net/2008140; classtype:trojan-activity; sid:2008140; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Clod/Sereki Checkin with C&C (noalert)"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/chck.dat"; fast_pattern; http_uri; content:!"User-Agent|3a|"; http_header; content:!"Referer|3a|"; http_header; flowbits:set,ET.clod1; flowbits:noalert; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3aWin32%2fSereki.A; reference:url,doc.emergingthreats.net/2010290; reference:md5,bbb6ac2181dbbe15efd13c294cb991fa; reference:md5,3c39bfc78fcf3fe805c7472296bf6319; classtype:trojan-activity; sid:2010290; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Fake AV CnC Checkin cycle_report"; flow:established,to_server; content:"POST"; http_method; content:"/cgi-bin/cycle_report.cgi?type=g"; nocase; http_uri; reference:md5,fa078834dd3b4c6604d12823a6f9f17e; classtype:command-and-control; sid:2011820; rev:3; metadata:created_at 2010_10_15, former_category MALWARE, updated_at 2010_10_15;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Clod/Sereki Checkin Response"; flow:established,from_server; content:"|0d 0a 0d 0a|!chckOK!"; nocase; flowbits:isset,ET.clod1; reference:url,doc.emergingthreats.net/2010291; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3aWin32%2fSereki.A; reference:md5,bbb6ac2181dbbe15efd13c294cb991fa; reference:md5,3c39bfc78fcf3fe805c7472296bf6319; classtype:trojan-activity; sid:2010291; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Comotor.A!dll Reporting 2"; flow:to_server,established; content:"GET"; nocase; http_method; content:"/cy/dl.php"; nocase; http_uri; content:"id="; http_uri; nocase; reference:md5,5e1c680e70e423dd02e31ab9d689e40b; reference:url,microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FComotor.A!dll&ThreatID=-2147346593; classtype:trojan-activity; sid:2011849; rev:4; metadata:created_at 2010_10_25, updated_at 2010_10_25;) +#alert tcp [174.129.0.0/16,67.202.0.0/18,79.125.0.0/17,184.72.0.0/15,75.101.128.0/17,174.129.0.0/16,204.236.128.0/17] any -> $HOME_NET any (msg:"ET DELETED Incoming Connection Attempt From Amazon EC2 Cloud"; flow:to_server; flags:S,12; reference:url,doc.emergingthreats.net/2010815; classtype:misc-activity; sid:2010815; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely Hostile HTTP Header GET structure"; flow:established,to_server; content:"GET"; nocase; http_method; content:"|20|HTTP/1.0|0d 0a|User-Agent|3a 20|"; fast_pattern; content:".php"; nocase; http_uri; content:"|0d 0a|Host|3a 20|"; content:"|0d 0a|Pragma|3a| no-cache|0d 0a|"; distance:0; content:!"|0d 0a|Host|3a| update.nai.com"; distance:0; content:!"|0d 0a|Host|3a 20|toolbarqueries.google."; http_header; content:!".ceipmsn.com|0d 0a|Pragma|3a 20|"; http_header; content:!"Host|3a| stats.mbamupdates.com|0d 0a|"; http_header; classtype:trojan-activity; sid:2011858; rev:12; metadata:created_at 2010_10_27, updated_at 2010_10_27;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Twitter Status Update"; flow:to_server,established; content:"POST"; http_method; content:"/status/update"; http_uri; content:"twitter.com"; nocase; content:"authenticity_token="; nocase; content:"status="; nocase; reference:url,twitter.com; reference:url,doc.emergingthreats.net/2010797; classtype:policy-violation; sid:2010797; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Feodo Banking Trojan Account Details Post"; flow:established,to_server; content:"POST"; nocase; http_method; content:"AccountSummary"; nocase; fast_pattern; content:"userid|3A|"; nocase; distance:0; content:"password|3A|"; nocase; distance:0; content:"screenid|3A|"; nocase; distance:0; content:"origination|3A|"; nocase; distance:0; reference:url,blog.fireeye.com/research/2010/10/feodosoff-a-new-botnet-on-the-rise.html#more; classtype:trojan-activity; sid:2011862; rev:4; metadata:created_at 2010_10_28, updated_at 2010_10_28;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 3531 (msg:"ET DELETED JoltID Agent Communicating TCP"; flow: to_server,established; reference:url,www.joltid.com; reference:url,forum.treweeke.com/lofiversion/index.php/t597.html; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.p2pnetworking.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000901; classtype:trojan-activity; sid:2000901; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Krap.ar Infection URL Request"; flow:established,to_server; content:"type="; http_uri; nocase; content:"email="; http_uri; nocase; content:"hwinfo="; http_uri; nocase; reference:md5,df29b9866397fd311a5259c5d4bc00dd; classtype:trojan-activity; sid:2012076; rev:2; metadata:created_at 2010_12_18, updated_at 2010_12_18;) +#alert tcp $HOME_NET any <> $EXTERNAL_NET 3531 (msg:"ET DELETED JoltID Agent Requesting File"; flow: established,to_server; content:"GIVE "; content:"User-Agent|3a|"; nocase; content:"PeerEnabler"; within:120; reference:url,www.joltid.com; reference:url,forum.treweeke.com/lofiversion/index.php/t597.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001654; classtype:trojan-activity; sid:2001654; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.BackDoor-DRV.gen.c Reporting-2"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/zok.php?"; nocase; http_uri; content:"username="; nocase; http_uri; content:"url="; nocase; http_uri; content:"sid="; nocase; http_uri; content:"tm="; nocase; http_uri; content:"hlto="; http_uri; nocase; reference:md5,d5ff6df296c068fcc0ddd303984fa6b9; classtype:trojan-activity; sid:2012114; rev:3; metadata:created_at 2010_12_30, former_category MALWARE, updated_at 2010_12_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 3531 (msg:"ET DELETED JoltID Agent Keep-Alive"; flow: to_server,established; dsize: 1; content:"|4b|"; reference:url,www.joltid.com; reference:url,forum.treweeke.com/lofiversion/index.php/t597.html; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.p2pnetworking.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001015; classtype:trojan-activity; sid:2001015; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Storm/Waledac 3.0 Checkin 1"; flow:established,to_server; content:"GET"; nocase; http_method; content:".htm"; http_uri; content:"Host|3a| "; http_header; content:"Content-Length|3a| "; http_header; content:".htm HTTP/1.1"; pcre:"/Host\x3a [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/"; pcre:"/Content-Length\x3a [1-9]/"; classtype:command-and-control; sid:2012137; rev:5; metadata:created_at 2011_01_05, former_category MALWARE, updated_at 2011_01_05;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 9295 (msg:"ET DELETED Troxen GetSpeed Request"; flow:established,to_server; content:"GetSpeed |0d 0a|"; depth:11; reference:md5,af89d15930fe59dcb621069abc83cc66; reference:url,doc.emergingthreats.net/2011233; classtype:trojan-activity; sid:2011233; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spy Banker Outbound Communication Attempt"; flow:established,to_server; content:"praquem="; nocase; content:"titulo="; distance:0; nocase; content:"Dir+System32"; nocase; distance:0; reference:md5,58b3c37b61d27cdc0a55321f4c12ef04; classtype:trojan-activity; sid:2012225; rev:4; metadata:created_at 2011_01_24, updated_at 2011_01_24;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED General Trojan FakeAV Downloader"; flow:established,to_server; content:".php?id="; http_uri; content:"&os="; http_uri; content:"&n="; http_uri; classtype:trojan-activity; sid:2011416; rev:6; metadata:created_at 2010_09_28, updated_at 2010_09_28;) -alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Banbra Banking Trojan Communication"; flow:established,to_server; content:"para="; nocase; content:"titulo="; nocase; distance:0; content:"mensagem="; nocase; distance:0; reference:md5,7ce03717d6879444d8e45b7cf6470c67; classtype:trojan-activity; sid:2012226; rev:4; metadata:created_at 2011_01_24, updated_at 2011_01_24;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED vb exploits / trojan vietshow"; flow:established,to_server; content:"GET"; http_method; content:"~vietshow/"; nocase; http_uri; classtype:bad-unknown; sid:2011897; rev:2; metadata:created_at 2010_11_09, updated_at 2010_11_09;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Hupigon.AZG Checkin"; flow:established,to_server; content:"GET"; http_method; nocase; content:"User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)|0d 0a|"; http_header; nocase; content:"eve="; nocase; http_uri; content:"username="; nocase; http_uri; content:"anma="; nocase; http_uri; content:"ver="; nocase; http_uri; reference:url,www.pandasecurity.com/homeusers/security-info/about-malware/encyclopedia/overview.aspx?idvirus=143511&sind=0; reference:url,vil.nai.com/vil/content/v_145056.htm; reference:url,doc.emergingthreats.net/2008515; classtype:command-and-control; sid:2008515; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Trojan perflogger ~duydati/inst_PCvw.exe"; flow:established,to_server; content:"GET"; http_method; content:"~duydati/inst_PCvw.exe"; nocase; http_uri; classtype:bad-unknown; sid:2011899; rev:2; metadata:created_at 2010_11_09, updated_at 2010_11_09;) -#alert http $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET DELETED Unknown Web Backdoor Keep-Alive"; flow:established,to_server; urilen:13; content:"POST"; http_method; nocase; content:"/bbs/info.asp"; http_uri; classtype:trojan-activity; sid:2012250; rev:3; metadata:created_at 2011_02_02, updated_at 2011_02_02;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Phishing ~mbscom/moneybookers/app/login/login.html"; flow:established,to_server; content:"GET"; http_method; content:"~mbscom/moneybookers/app/login/login.html"; nocase; http_uri; classtype:bad-unknown; sid:2011902; rev:2; metadata:attack_target Client_Endpoint, created_at 2010_11_09, deployment Perimeter, signature_severity Major, tag Phishing, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Trojan/Win32.CodecPack Reporting"; flow:to_server,established; content:"GET"; nocase; http_method; content:"ADTECH|3b|"; http_uri; content:"loc=100|3b|"; http_uri; content:"target=_blank|3b|"; http_uri; content:"grp|3d 5b|group|5d 3b|"; http_uri; content:"misc="; classtype:trojan-activity; sid:2012285; rev:4; metadata:created_at 2011_02_04, updated_at 2011_02_04;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Hacked server to exploits ~rio1/admin/login.php"; flow:established,to_server; content:"GET"; http_method; content:"~rio1/admin/login.php"; nocase; http_uri; classtype:bad-unknown; sid:2011901; rev:2; metadata:created_at 2010_11_09, updated_at 2010_11_09;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32 Troxen Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/report3.ashx?"; http_uri; nocase; content:"m="; nocase; http_uri; content:"mid="; nocase; http_uri; content:"d="; nocase; http_uri; content:"uid="; http_uri; nocase; reference:url,microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3aWin32/Troxen!rts; reference:md5,664a5147e6258f10893c3fd375f16ce4; classtype:trojan-activity; sid:2012289; rev:4; metadata:created_at 2011_02_04, updated_at 2011_02_04;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED iframe Phoenix Exploit & ZBot vt073pd/photo.exe"; flow:established,to_server; content:"GET"; http_method; content:"vt073pd/photo.exe"; nocase; http_uri; classtype:bad-unknown; sid:2011903; rev:2; metadata:created_at 2010_11_09, updated_at 2010_11_09;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spy.Win32.Agent.bijs Reporting 1"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/app/count/inst.php?"; http_uri; nocase; content:"ucode="; nocase; http_uri; content:"pcode="; http_uri; nocase; reference:md5,846ac24b003c6d468a833bff58db5f5c; classtype:trojan-activity; sid:2012290; rev:4; metadata:created_at 2011_02_04, updated_at 2011_02_04;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED trojan renos Flash.HD.exe"; flow:established,to_server; content:"GET"; http_method; content:"Flash.HD.exe"; nocase; http_uri; classtype:bad-unknown; sid:2011909; rev:2; metadata:created_at 2010_11_09, updated_at 2010_11_09;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spy.Win32.Agent.bijs Reporting 2"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/app/count/boot.php?"; nocase; http_uri; content:"ucode="; nocase; http_uri; content:"pcode="; nocase; http_uri; reference:md5,846ac24b003c6d468a833bff58db5f5c; classtype:trojan-activity; sid:2012288; rev:4; metadata:created_at 2011_02_04, updated_at 2011_02_04;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED fast flux rogue antivirus download.php?id=2004"; flow:established,to_server; content:"GET"; http_method; nocase; content:"download.php?id=2004"; nocase; http_uri; classtype:bad-unknown; sid:2011904; rev:3; metadata:created_at 2010_11_09, updated_at 2010_11_09;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCADA Sunway ForceControl Activex Control Remote Code Execution Vulnerability 2"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3310FA24-A027-47B3-8C49-1091077317E9/si"; reference:bugtraq,49747; classtype:attempted-user; sid:2013736; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_10_04, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED DRIVEBY SEO Client Exploited By SMB/JavaWebStart"; flow:established,to_server; content:"loadsmb.php"; http_uri; classtype:trojan-activity; sid:2011951; rev:4; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_11_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Lookup of Known BlackEnergy DDOS Botnet CnC Server greenter.ru"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|08|greenter|02|ru"; nocase; distance:0; reference:url,www.shadowserver.org/wiki/pmwiki.php/Calendar/20110116; reference:url,www.shadowserver.org/wiki/pmwiki.php/Calendar/20100913; classtype:command-and-control; sid:2012202; rev:2; metadata:created_at 2011_01_18, updated_at 2011_01_18;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED DRIVEBY SEO Client Exploited By PDF"; flow:established,to_server; content:"loadlibtiff.php"; http_uri; classtype:trojan-activity; sid:2011952; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_11_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET DELETED DNS Lookup of Twitter m28sx Worm"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"gdfgdfgdgdfgdfg|02|in|02|ua"; nocase; distance:0; reference:url,isc.sans.edu/diary.html?storyid=10297; classtype:trojan-activity; sid:2012210; rev:2; metadata:created_at 2011_01_21, updated_at 2011_01_21;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED DRIVEBY SEO Obfuscated JavaScript srctable"; flow:established,to_client; content:"var srctable=|27|"; depth:14; classtype:bad-unknown; sid:2011959; rev:4; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_11_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32.Banker.AAD CnC Communication"; flow:established,to_server; content:"filename=|22|C|3A 5C|WINDOWS|5C|system32"; nocase; http_header; content:"Content-Type|3A| C|3A 5C|WINDOWS|5C|system32"; nocase; http_header; reference:md5,8556aec7ff96824e2da9d1b948ed7029; classtype:command-and-control; sid:2012300; rev:3; metadata:created_at 2011_02_07, former_category TROJAN, updated_at 2017_03_22;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED DRIVEBY SEO Obfuscated JavaScript desttable"; flow:established,to_client; content:"var desttable=|27|"; depth:15; classtype:bad-unknown; sid:2011958; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_11_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Java Exploit Kit Success Check-in Executable Download Likely"; flow:established,to_server; content:".php?"; http_uri; content:"=javajsm"; http_uri; classtype:exploit-kit; sid:2012389; rev:3; metadata:created_at 2011_02_27, former_category EXPLOIT_KIT, updated_at 2011_02_27;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED DRIVEBY SEO Client Requesting Malicious loadpeers.php"; flow:established,to_server; content:"loadpeers.php"; http_uri; classtype:bad-unknown; sid:2011956; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_11_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Tatanga Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:".php?build="; http_uri; content:"&id="; http_uri; content:"&SA=1-0"; http_uri; content:"&SP=1-"; http_uri; reference:url,securityblog.s21sec.com/2011/02/tatanga-new-banking-trojan-with-mitb.html; reference:url,www.sophos.com/security/analyses/viruses-and-spyware/trojtatangac.html; reference:url,support.clean-mx.de/clean-mx/view_joebox.php?md5=4b5eb54de32f86819c638878ac2c7985&id=740958; reference:url,www.malware-control.com/statics-pages/06198e9b72e1bb0c256769c5754ed821.php; classtype:command-and-control; sid:2012391; rev:3; metadata:created_at 2011_02_28, former_category MALWARE, updated_at 2011_02_28;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED DRIVEBY SEO Client Requesting Malicious lib.pdf"; flow:established,to_server; content:"/files/lib.pdf"; http_uri; classtype:bad-unknown; sid:2011955; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_11_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Vilsel.akd Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/app_count/ag4_del_count.php?"; nocase; http_uri; content:"mac="; nocase; http_uri; content:"pid="; nocase; http_uri; reference:md5,2d6cede13913b17bc2ea7c7f70ce5fa8; classtype:trojan-activity; sid:2012439; rev:4; metadata:created_at 2011_03_08, updated_at 2011_03_08;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED DRIVEBY SEO Client Requesting Malicious loadjjar.php"; flow:established,to_server; content:"loadjjar.php"; http_uri; classtype:bad-unknown; sid:2011954; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_11_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.Win32.Agent.bqkb Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/updata/"; nocase; http_uri; content:"lg1="; nocase; http_uri; content:"lg2="; nocase; http_uri; content:"lg3="; nocase; http_uri; content:"lg5="; nocase; http_uri; content:"lg6="; nocase; http_uri; content:"lg7="; nocase; http_uri; reference:md5,de85ae919d48325189bead995e8052e7; classtype:trojan-activity; sid:2012440; rev:4; metadata:created_at 2011_03_08, former_category MALWARE, updated_at 2011_03_08;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED DRIVEBY SEO Client Requesting Malicious jjar.jar"; flow:established,to_server; content:"/files/jjar.jar"; http_uri; classtype:bad-unknown; sid:2011953; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_11_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Monkif Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/photo/"; http_uri; content:"6x5x5772=712x5772=716x"; http_uri; classtype:command-and-control; sid:2012505; rev:4; metadata:created_at 2011_03_15, former_category MALWARE, updated_at 2011_03_15;) +#alert tcp $HOME_NET any -> 212.26.42.47 9090 (msg:"ET DELETED ProFTPD Backdoor outbound Request Sent"; flow:established,to_server; content:"GET /AB"; reference:url,slashdot.org/story/10/12/02/131214/ProFTPDorg-Compromised-Backdoor-Distributed; reference:url,xorl.wordpress.com/2010/12/02/news-proftpd-owned-and-backdoored/; reference:url,sourceforge.net/mailarchive/message.php?msg_name=alpine.DEB.2.00.1012011542220.12930%40familiar.castaglia.org; classtype:trojan-activity; sid:2011993; rev:2; metadata:created_at 2010_12_02, updated_at 2010_12_02;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Rimecud.B Activity"; flow:to_server,established; content:"POST"; nocase; http_method; content:"&acc=ups"; http_uri; content:"&nick="; http_uri; content:"&botver=Beta&code="; http_uri; content:"User-Agent|3a 20|"; nocase; http_header; content:"|3b 20|es-ES|3b|"; distance:39; http_header; content:"plist|3d 2d 2d 2d|"; depth:9; http_client_body; content:"Passwords"; distance:0; http_client_body; reference:md5,01dd7102b9d36ec8556eed2909b74f52; classtype:trojan-activity; sid:2012517; rev:2; metadata:created_at 2011_03_17, updated_at 2011_03_17;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Possible Adobe Reader 9.4 doc.printSeps Memory Corruption Attempt"; flow:established,to_client; content:"%PDF-"; nocase; depth:300; content:"doc.printSeps"; nocase; distance:0; reference:bid,44638; reference:cve,2010-4091; classtype:attempted-user; sid:2012156; rev:2; metadata:created_at 2011_01_06, updated_at 2011_01_06;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan-Spy.Win32.Zbot.djrm Checkin"; flow:to_server,established; content:"/index.html?mac="; http_uri; content:"&ver="; http_uri; content:"&os="; http_uri; content:"&dtime="; fast_pattern; http_uri; content:"User-Agent|3a| baidu|0d 0a|"; http_header; reference:md5,b895249cce7d2c27cb9c480feb36560c; reference:md5,f70a5f52d4c0071963602c25b62865cb; classtype:command-and-control; sid:2014399; rev:3; metadata:created_at 2012_03_15, former_category MALWARE, updated_at 2012_03_15;) +#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET DELETED Post Express Inbound SPAM (possible Spyeye)"; flow:established,to_server; content:"Content-Disposition|3A|attachment|3b|"; nocase; content:"filename=|22|Post_Express_Label_"; nocase; reference:url,nakedsecurity.sophos.com/2011/02/01/outbreak-post-express-service-malware-attack-spammed-out; classtype:trojan-activity; sid:2012275; rev:2; metadata:created_at 2011_02_03, updated_at 2011_02_03;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WORM W32/Rimecud /qvod/ff.txt Checkin"; flow:established,to_server; content:"/qvod/ff.txt"; http_uri; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Worm%3AWin32%2FRimecud; reference:md5,f97e1c4aefbd2595fcfeb0f482c47517; reference:md5,f96a29bcf6cba870efd8f7dd9344c39e; reference:md5,fae8675502d909d6b546c111625bcfba; classtype:trojan-activity; sid:2014401; rev:2; metadata:created_at 2012_03_20, updated_at 2012_03_20;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Potential Trojan dropper Wlock.A (AS1680)"; flow:established,to_server; content:"GET"; http_method; nocase; content:"/pornoplayer.exe"; http_uri; nocase; reference:url,www.malwareurl.com/listing.php?domain=pworldxxx.info; classtype:trojan-activity; sid:2012301; rev:4; metadata:created_at 2011_02_07, updated_at 2011_02_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PWS-Banker.gen.b Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/curubacom.php?"; http_uri; nocase; content:"op="; http_uri; nocase; reference:md5,e3fdf31ce57b3807352971a62f85c55b; classtype:trojan-activity; sid:2012592; rev:5; metadata:created_at 2011_03_28, updated_at 2011_03_28;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Possible Fast Flux Trojan Rogue Antivirus"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/SecurIns_194.exe"; http_uri; nocase; reference:url,www.malwareurl.com/listing.php?domain=microantivirus5.com; classtype:bad-unknown; sid:2012332; rev:3; metadata:created_at 2011_02_22, updated_at 2011_02_22;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Best Spyware Scanner FaveAV Download"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/BestSpywareScanner_Setup.exe"; nocase; http_uri; classtype:trojan-activity; sid:2012590; rev:5; metadata:created_at 2011_03_28, updated_at 2011_03_28;) +#alert http $HOME_NET any -> 184.105.245.17 8080 (msg:"ET DELETED DroidDream Android Trojan info upload"; flow:to_server,established; content:"/GMServer/GMServlet"; http_uri; reference:url,androguard.blogspot.com/2011/03/droiddream.html; reference:url,blog.aegislab.com/index.php?op=ViewArticle&articleId=79&blogId=1; reference:url,blog.mylookout.com/2011/03/android-malware-droiddream-how-it-works/; reference:url,countermeasures.trendmicro.eu/google-android-rooted-backdoored-infected/; classtype:trojan-activity; sid:2012410; rev:3; metadata:created_at 2011_03_03, updated_at 2011_03_03;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP W32/PaPaPaEdge.Adware/Gambling Poker-Edge Checkin"; flow:established,to_server; content:"/xml_action.php?user="; http_uri; content:"&appid="; http_uri; content:"&hwid="; http_uri; content:"&id="; http_uri; content:".poker-edge.com|0d 0a|"; http_header; reference:md5,f9d226bf9807c72432050f7dcb396b06; classtype:pup-activity; sid:2014403; rev:2; metadata:created_at 2012_03_20, former_category ADWARE_PUP, updated_at 2012_03_20;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Fast Flux Rogue Antivirus"; flow:established,to_server; content:"GET"; nocase; http_method; content:"download/Setup_2004.exe"; nocase; http_uri; reference:url,www.malwareurl.com/listing.php?domain=spyremover-k3.com; classtype:trojan-activity; sid:2012447; rev:3; metadata:created_at 2011_03_10, updated_at 2011_03_10;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Trojan-Clicker.Win32.Agent.qqf Checkin"; flow:to_server,established; content:"GET"; nocase; http_method; content:"|2f|sogou"; http_uri; pcre:"/\x2fsogou(config)?\x2f/Ui"; reference:md5,f468778836fd27a2ccca88c99f6dd3e9; classtype:trojan-activity; sid:2012643; rev:2; metadata:created_at 2011_04_06, updated_at 2011_04_06;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Android Trojan HongTouTou Command and Control Communication"; flow:established,to_server; content:"POST"; http_method; content:"/index.aspx?im="; http_uri; nocase; content:"|0d 0a|User-Agent|3a| Apache-HttpClient"; http_header; reference:url,blog.netqin.com/en/?p=451; classtype:trojan-activity; sid:2012450; rev:4; metadata:created_at 2011_03_10, updated_at 2011_03_10;) -#alert http $HOME_NET any -> $EXTERNAL_NET 897 (msg:"ET DELETED Backdoor PcClient.CAK.Pakes POST on non-http Port"; flow:established,to_server; content:"POST"; nocase; http_method; content:".jsp"; nocase; depth:35; pcre:"/\/\d{8,}\/\d{4,}\/\d{4,}\.jsp/"; reference:url,doc.emergingthreats.net/2009093; classtype:trojan-activity; sid:2009093; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Zbot Trojan"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/games/pdf"; nocase; http_uri; content:"php?f=7"; nocase; http_uri; reference:url,www.malwareurl.com/listing.php?domain=poleoa.net; classtype:trojan-activity; sid:2012538; rev:3; metadata:created_at 2011_03_22, updated_at 2011_03_22;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Weatherbug Activity"; flow: to_server,established; content:"weatherbug.com|0d 0a|"; nocase; http_header; threshold: type limit, track by_src, count 1, seconds 3600; reference:url,doc.emergingthreats.net/bin/view/Main/2001267; classtype:misc-activity; sid:2001267; rev:18; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Rogue Antivirus"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/installer.0042.exe"; nocase; http_uri; reference:url,www.malwareurl.com/listing.php?domain=umbralinversiones.com; classtype:trojan-activity; sid:2012539; rev:3; metadata:created_at 2011_03_22, updated_at 2011_03_22;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/Bifrose.Backdoor Checkin Attempt via Facebook"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/omaha/update.php?"; http_uri; content:"User-Agent|3A 20|Facebook Update/"; http_header; content:"winhttp|3b|"; http_header; reference:md5,61661202e320dd91e4f7e4a10616eefc; classtype:trojan-activity; sid:2014404; rev:3; metadata:created_at 2012_03_20, updated_at 2012_03_20;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Win32 Backdoor Poison"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/salvando-usb.exe"; nocase; http_uri; reference:url,www.malwareurl.com/listing.php?domain=arteencueros.com; classtype:trojan-activity; sid:2012540; rev:3; metadata:created_at 2011_03_22, updated_at 2011_03_22;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Data POST to an image file (png)"; flow:established,to_server; content:"POST"; nocase; http_method; content:".png"; nocase; http_uri; content:".png HTTP"; nocase; pcre:"/\.png$/Ui"; reference:url,doc.emergingthreats.net/2010070; classtype:trojan-activity; sid:2010070; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/CazinoSilver Download VegasVIP_setup.exe"; flow:established,to_server; content:"/VegasVIP_setup.exe"; nocase; http_uri; reference:url,ddanchev.blogspot.com/2011/04/dont-play-poker-on-infected-table-part.html; classtype:trojan-activity; sid:2012685; rev:3; metadata:created_at 2011_04_12, updated_at 2011_04_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Data POST to an image file (jpeg)"; flow:established,to_server; content:"POST"; nocase; http_method; content:".jpeg"; nocase; http_uri; content:".jpeg HTTP"; nocase; pcre:"/\.jpeg$/i"; reference:url,doc.emergingthreats.net/2010068; classtype:trojan-activity; sid:2010068; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED SSL MiTM Vulnerable or EOL iOS 3.x device"; flow:established,to_server; content:"Mozilla/5.0 |28|iP"; http_header; content:" OS 3_"; http_header; distance:0; threshold: type limit, count 1, seconds 600, track by_src; reference:url,support.apple.com/kb/HT1222; reference:url,support.apple.com/kb/HT4824; reference:url,en.wikipedia.org/wiki/IOS_version_history; reference:url,github.com/jan0/isslfix; reference:cve,CVE-2011-0228; classtype:not-suspicious; sid:2013406; rev:6; metadata:created_at 2011_08_12, updated_at 2011_08_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Data POST to an image file (bmp)"; flow:established,to_server; content:"POST"; nocase; http_method; content:".bmp"; nocase; http_uri; content:".bmp HTTP"; nocase; pcre:"/\.bmp$/i"; reference:url,doc.emergingthreats.net/2010069; classtype:trojan-activity; sid:2010069; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED SSL MiTM Vulnerable or EOL iOS 4.x device"; flow:established,to_server; content:"Mozilla/5.0 (iP"; http_header; content:" OS 4_"; http_header; distance:0; pcre:"/OS 4_[0-3]_[1-4] like/H"; threshold: type limit, count 1, seconds 600, track by_src; reference:url,support.apple.com/kb/HT1222; reference:url,support.apple.com/kb/HT4824; reference:url,en.wikipedia.org/wiki/IOS_version_history; reference:url,github.com/jan0/isslfix; reference:cve,CVE-2011-0228; classtype:not-suspicious; sid:2013407; rev:6; metadata:created_at 2011_08_12, updated_at 2011_08_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan-Downloader.Win32.Small Checkin"; flow:to_server,established; content:"GET"; http_method; nocase; content:"|2e|ashx|3f|m|3d|"; http_uri; content:"|2d|"; distance:2; within:1; http_uri; content:"|26|mid|3d|"; http_uri; distance:0; content:"|26|tid|3d|"; http_uri; distance:0; content:"|26|d|3d|"; http_uri; distance:0; content:"|26|uid|3d|"; http_uri; distance:0; content:"|26|t|3d|"; http_uri; distance:0; reference:md5,48432bdd116dccb684c8cef84579b963; classtype:command-and-control; sid:2012839; rev:4; metadata:created_at 2011_05_23, former_category MALWARE, updated_at 2011_05_23;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Potential Blackhole Exploit Pack landing"; flow:established,to_server; content:".php?f="; http_uri; content:!"Cookie|3a|"; http_header; pcre:"/\.php\?f=\d+$/U"; reference:url,krebsonsecurity.com/2010/10/java-a-gift-to-exploit-pack-makers/; classtype:bad-unknown; sid:2012688; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_04_15, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gozi posting form data"; flow:established,to_server; content:"POST"; nocase; http_method; content:"name=\"upload_file\""; http_client_body; content:"URL|3a|"; http_client_body; classtype:trojan-activity; sid:2012871; rev:4; metadata:created_at 2011_05_27, updated_at 2011_05_27;) +#alert ip $HOME_NET any -> 83.236.140.90 any (msg:"ET DELETED Bundestrojaner (W32/R2D2 BTrojan) Outbound SRV-2"; threshold:type limit, track by_dst, count 1, seconds 60; reference:url,www.ccc.de/de/updates/2011/staatstrojaner; reference:url,www.ccc.de/system/uploads/76/original/staatstrojaner-report23.pdf; reference:url,www.f-secure.com/weblog/archives/00002249.html; reference:url,www.heise.de/newsticker/meldung/CCC-knackt-Staatstrojaner-1357670.html; reference:url,www.virustotal.com/file-scan/report.html?id=be36ce1e79ba6f97038a6f9198057abecf84b38f0ebb7aaa897fd5cf385d702f-1318152545; reference:url,www.ccc.de/en/updates/2011/staatstrojaner; classtype:trojan-activity; sid:2013754; rev:5; metadata:created_at 2011_10_11, updated_at 2011_10_11;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED CPL Trojan Downloader Request"; flow:established,to_server; content:".cpl?|20|HTTP/1.1"; nocase; content:!"Referer|3a 20|"; http_header; classtype:trojan-activity; sid:2012910; rev:6; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_06_01, deployment Perimeter, signature_severity Major, tag Trojan_Downloader, updated_at 2016_07_01;) +#alert ip 83.236.140.90 any -> $HOME_NET any (msg:"ET DELETED Bundestrojaner (W32/R2D2 BTrojan) Inbound SRV-2"; threshold:type limit, track by_src, count 1, seconds 60; reference:url,www.ccc.de/de/updates/2011/staatstrojaner; reference:url,www.ccc.de/system/uploads/76/original/staatstrojaner-report23.pdf; reference:url,www.f-secure.com/weblog/archives/00002249.html; reference:url,www.heise.de/newsticker/meldung/CCC-knackt-Staatstrojaner-1357670.html; reference:url,www.virustotal.com/file-scan/report.html?id=be36ce1e79ba6f97038a6f9198057abecf84b38f0ebb7aaa897fd5cf385d702f-1318152545; reference:url,www.ccc.de/en/updates/2011/staatstrojaner; classtype:trojan-activity; sid:2013753; rev:5; metadata:created_at 2011_10_11, updated_at 2011_10_11;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Generic adClicker Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"web"; http_uri; content:"getinfo"; http_uri; content:".aspx?"; http_uri; content:"ver="; http_uri; content:"User-Agent|3a| Microsoft Internet Explorer"; http_header; classtype:command-and-control; sid:2012934; rev:4; metadata:created_at 2011_06_06, former_category MALWARE, updated_at 2011_06_06;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED AirOS .css Worm Outbound Propagation Sweep"; flow:established,to_server; content:"/admin.cgi/.gif"; http_uri; pcre:"/Host\x3a ([0-9]{1,3}\.){3}[0-9]{1,3}/H"; reference:url,seclists.org/fulldisclosure/2011/Dec/419; reference:url,www.root.cz/clanky/virus-v-bezdratovych-routerech-skynet/; classtype:trojan-activity; sid:2014041; rev:6; metadata:created_at 2011_12_28, updated_at 2011_12_28;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE WebToolbar.Win32.WhenU.r Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/prod/MEADInst.exe"; http_uri; nocase; reference:md5,27867435a1b6b3f35daf13faac6f77b7; classtype:trojan-activity; sid:2013034; rev:4; metadata:created_at 2011_06_16, updated_at 2011_06_16;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED AirOS admin.cgi/css Exploit Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/etc/persistent/.skynet/install&action=cli"; http_uri; reference:url,seclists.org/fulldisclosure/2011/Dec/419; reference:url,www.root.cz/clanky/virus-v-bezdratovych-routerech-skynet/; classtype:trojan-activity; sid:2014042; rev:5; metadata:created_at 2011_12_28, updated_at 2011_12_28;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dropper.MSIL.Agent.ate Checkin"; flow:established,to_server; content:"GET"; http_method; nocase; content:"/bot.php?"; http_uri; content:"hwid="; http_uri; content:"pcname="; http_uri; reference:md5,4860e53b7e71cd57956e10ef48342b5f; classtype:command-and-control; sid:2013071; rev:4; metadata:created_at 2011_06_21, former_category MALWARE, updated_at 2011_06_21;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED PeopleOnPage Install"; flow: to_server,established; content:"/install/pop"; nocase; http_uri; reference:url,www.peopleonpage.com; reference:url,www.safer-networking.org/en/threats/602.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001445; classtype:policy-violation; sid:2001445; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"GPL DNS named version attempt"; flow:to_server,established; content:"|07|version"; offset:12; nocase; content:"|04|bind|00|"; offset:12; nocase; reference:arachnids,278; reference:nessus,10028; classtype:attempted-recon; sid:2100257; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET DELETED Storm Worm Encrypted Traffic Outbound - Likely Search by md5"; dsize:25; threshold: type threshold, count 40, seconds 60, track by_src; reference:url,doc.emergingthreats.net/2007634; classtype:trojan-activity; sid:2007634; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED W32/UFR POST to CnC"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/ufr/ufr.php"; http_uri; content:"UFR"; http_client_body; classtype:command-and-control; sid:2013424; rev:3; metadata:created_at 2011_08_18, updated_at 2011_08_18;) +#alert udp $EXTERNAL_NET 1024:65535 -> $HOME_NET 1024:65535 (msg:"ET DELETED Storm Worm Encrypted Traffic Inbound - Likely Connect Ack"; dsize:2; threshold: type threshold, count 10, seconds 60, track by_dst; reference:url,doc.emergingthreats.net/2007635; classtype:trojan-activity; sid:2007635; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Cridex.B/Feodo Checkin"; flow:to_server,established; content:"POST"; nocase; http_method; content:"/in"; offset:11; depth:3; http_uri; content:".ru"; http_header; pcre:"/\/\w{3}\/\w\d_\w\w\w\/in\/?$/Ui"; pcre:"/Host\x3a\s[a-z]{15,19}\.ru(\x3a8080)?/Hm"; reference:md5,7ed139b53e24e4385c4c59cd2aa0e5f7; reference:url,labs.m86security.com/2012/03/the-cridex-trojan-targets-137-financial-organizations-in-one-go/; reference:url,blog.fireeye.com/research/2010/10/feodosoff-a-new-botnet-on-the-rise.html; reference:url,about-threats.trendmicro.com/Malware.aspx?language=us&name=WORM_CRIDEX.IC; classtype:command-and-control; sid:2014405; rev:10; metadata:created_at 2012_02_29, former_category MALWARE, updated_at 2012_02_29;) +#alert udp $EXTERNAL_NET 1024:65535 -> $HOME_NET 1024:65535 (msg:"ET DELETED Storm Worm Encrypted Traffic Inbound - Likely Search by md5"; dsize:25; threshold: type threshold, count 40, seconds 60, track by_dst; reference:url,doc.emergingthreats.net/2007636; classtype:trojan-activity; sid:2007636; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/VB.HV Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/popcode.php?aid="; http_uri; content:"&lc="; http_uri; content:"&domain="; http_uri; reference:url,microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDropper%3AWin32%2FVB.HV; classtype:command-and-control; sid:2013456; rev:5; metadata:created_at 2011_08_24, former_category MALWARE, updated_at 2011_08_24;) +#alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET DELETED Storm Worm Encrypted Traffic Outbound - Likely Connect Ack"; dsize:2; threshold: type threshold, count 10, seconds 60, track by_src; reference:url,doc.emergingthreats.net/2007637; classtype:trojan-activity; sid:2007637; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NgrBot IRC CnC Channel Join"; flow:established,to_server; content:"PASS ngrBot"; content:"NICK"; distance:0; reference:url,stopmalvertising.com/rootkits/analysis-of-ngrbot.html; classtype:command-and-control; sid:2013451; rev:3; metadata:created_at 2011_08_24, former_category MALWARE, updated_at 2011_08_24;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED WindowsEnterpriseSuite FakeAV Dynamic User-Agent"; flow:established,to_server; content:"User-Agent|3a| We"; content:!"User-Agent|3a| Webmin|0d 0a|"; http_header; pcre:"/User-Agent\x3a We[a-z0-9]{4}\x0d\x0a/H"; reference:url,doc.emergingthreats.net/2010262; reference:md5,d9bcb4e4d650a6ed4402fab8f9ef1387; classtype:trojan-activity; sid:2010262; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $HOME_NET 8888 -> any any (msg:"ET MOBILE_MALWARE iOS Keylogger iKeyMonitor access"; flow:from_server,established; content:"/>Keystrokes - iKeyMonitor $HOME_NET any (msg:"ET DELETED Phoenix landing page - valium"; flow:established,to_client; content:"var string = val+|22|ium|22|\;"; classtype:bad-unknown; sid:2011486; rev:2; metadata:created_at 2010_09_28, updated_at 2010_09_28;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX 2X ApplicationServer TuxSystem Class ActiveX Control ImportSettings Remote File Overwrite Attempt"; flow:to_client,established; content:"CLSID"; nocase; content:"5BD64392-DA66-4852-9715-CFBA98D25296"; nocase; distance:0; content:"ImportSettings"; nocase; reference:url,www.exploit-db.com/exploits/18625/; classtype:attempted-user; sid:2014418; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_03_26, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED FakeAV client requesting fake scanner page"; flow:established,to_server; content:"/?p=p"; http_uri; content:".co.cc|0D 0A|"; http_header; classtype:bad-unknown; sid:2011373; rev:4; metadata:created_at 2010_09_28, updated_at 2010_09_28;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Trojan User-Agent (Windows Updates Manager)"; flow:to_server,established; content:"User-Agent|3a| Windows Updates Manager"; http_header; threshold: type limit, count 3, seconds 300, track by_src; reference:url,doc.emergingthreats.net/2003585; classtype:pup-activity; sid:2003585; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED DRIVEBY Fragus - landing page delivered"; flow:established,to_client; content:"|0d 0a 0d 0a|var CRYPT={signature|3a|"; classtype:bad-unknown; sid:2011330; rev:4; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_09_28, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET MALWARE Win32.PowerPointer checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:""; http_client_body; content:""; http_client_body; classtype:command-and-control; sid:2014040; rev:3; metadata:created_at 2011_12_28, former_category MALWARE, updated_at 2011_12_28;) +#alert tcp any $HTTP_PORTS -> any any (msg:"ET DELETED Malvertising DRIVEBY Fragus Admin Panel Delivered To Client"; flow:established,to_client; content:"|0D 0A 09 09|Fragus"; classtype:bad-unknown; sid:2011342; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_09_28, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan-Clicker.Win32.VB.gnf Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/channel/onSale.htm?"; nocase; http_uri; content:"pid="; nocase; http_uri; reference:url,microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanClicker%3AWin32%2FVB.GE; classtype:trojan-activity; sid:2014066; rev:4; metadata:created_at 2012_01_02, updated_at 2012_01_02;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED POST to /x48/x58/ Possible Zeus Version 3 Command and Control Server Traffic"; flow:established,to_server; content:"POST"; http_method; nocase; content:"/x48/x58/"; http_uri; nocase; content:".php"; http_uri; nocase; reference:url,www.m86security.com/labs/i/Customers-of-Global-Financial-Institution-Hit-by-Cybercrime,trace.1431~.asp; reference:url,www.m86security.com/documents/pdfs/security_labs/cybercriminals_target_online_banking.pdf; classtype:trojan-activity; sid:2011344; rev:4; metadata:created_at 2010_09_28, updated_at 2010_09_28;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TROJAN Win32.OnlineGames.Bft Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/urlrcv.php?"; nocase; http_uri; content:"mc="; nocase; http_uri; content:"sc="; nocase; http_uri; content:"uuid="; nocase; http_uri; reference:md5,e488fca95cb923a0ecd329642c076e0d; reference:url,www.thespywaredetector.com/spywareinfo.aspx?ID=1874131; classtype:trojan-activity; sid:2014084; rev:5; metadata:created_at 2012_01_03, updated_at 2012_01_03;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Zeus Version 3 Infection Posting Banking HTTP Log to Command and Control Server"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/get_dr.php?"; http_uri; nocase; content:"https|3A|//"; nocase; pcre:"/\x2Fget\x5Fdr\x2Ephp\x3F(e|ini)\x3D/Ui"; reference:url,www.m86security.com/labs/i/Customers-of-Global-Financial-Institution-Hit-by-Cybercrime,trace.1431~.asp; reference:url,www.m86security.com/documents/pdfs/security_labs/cybercriminals_target_online_banking.pdf; classtype:trojan-activity; sid:2011345; rev:5; metadata:created_at 2010_09_28, updated_at 2010_09_28;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Zeus POST Request to CnC - cookie variation"; flow:established,to_server; content:"POST"; nocase; http_method; content:"|20|HTTP/1."; content:"|0d 0a|Accept|3a 20|*/*|0d 0a|Accept-Language|3a 20|en-us|0d 0a|Cookie|3a 20|cid="; distance:1; within:51; content:"User-Agent|3a 20|Mozilla"; distance:0; content:"Host|3a 20|"; distance:0; content:"Content-Length|3a 20|"; distance:0; content:!"0"; within:1; content:"Connection|3a| Keep-Alive|0d 0a|"; distance:0; content:"|3a| no-cache|0d 0a 0d 0a|"; distance:0; reference:url,zeustracker.abuse.ch/monitor.php?search=209.59.216.103; classtype:command-and-control; sid:2014107; rev:3; metadata:created_at 2012_01_10, former_category MALWARE, updated_at 2012_01_10;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Driveby Bredolab - client requesting java exploit"; flow:established,to_server; content:"/Notes1.pdf"; depth:11; http_uri; classtype:bad-unknown; sid:2011795; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_10_09, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Delf/Troxen/Zema Reporting 1"; flow:established,to_server; content:"GET"; nocase; http_method; content:".php?m="; http_uri; content:"&s="; http_uri; content:"&v="; http_uri; content:"User-Agent|3a| build"; http_header; pcre:"/\.php\?m=[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}&[vs]=/Ui"; reference:md5,3d18363a20882bd74ae7e0f68d3ed8ef; classtype:trojan-activity; sid:2014114; rev:4; metadata:created_at 2012_01_12, updated_at 2012_01_12;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Driveby Bredolab - landing page"; flow:established,to_client; content:"Server|3a| nginx"; content:"
<"; depth:120; classtype:bad-unknown; sid:2011796; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_10_09, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Delf/Troxen/Zema Reporting 2"; flow:established,to_server; content:"GET"; nocase; http_method; content:".php?s="; http_uri; content:"&m="; http_uri; content:"User-Agent|3a| build"; http_header; pcre:"/\.php\?s=\d&m=[A-F0-9]{16}$/Ui"; reference:md5,3d18363a20882bd74ae7e0f68d3ed8ef; classtype:trojan-activity; sid:2014115; rev:3; metadata:created_at 2012_01_12, updated_at 2012_01_12;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Driveby leads to exploits aaitsol1/networks.php"; flow:established,to_server; content:"GET"; http_method; content:"~aaitsol1/networks.php"; nocase; http_uri; classtype:bad-unknown; sid:2011895; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_11_09, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SpyEye Checkin version 1.3.25 or later 2"; flow:established,to_server; content:"POST"; nocase; http_method; content:"data=6Prm67"; depth:11; http_client_body; classtype:command-and-control; sid:2014044; rev:5; metadata:created_at 2011_12_28, former_category MALWARE, updated_at 2011_12_28;) +#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED DRIVEBY SEO Landing Page Encountered"; flow:established,to_client; content:""; pcre:"/^\s*?"; distance:64; within:83; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2014753; rev:5; metadata:created_at 2012_05_17, updated_at 2012_05_17;) +#alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"ET DOS SolarWinds TFTP Server Long Write Request Denial Of Service Attempt"; content:"|00 02|"; depth:2; isdataat:1000,relative; content:!"|0A|"; within:1000; content:"NETASCII"; distance:1000; reference:url,www.exploit-db.com/exploits/13836/; reference:url,doc.emergingthreats.net/2011674; classtype:attempted-dos; sid:2011674; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED 0day JRE 17 exploit Class 1"; flow:established,to_client; content:"|0d 0a 0d 0a|PK"; content:"|2f|Gondvv.class"; distance:0; reference:url,blog.sucuri.net/2012/08/java-zero-day-in-the-wild.html; classtype:trojan-activity; sid:2015655; rev:5; metadata:created_at 2012_08_29, updated_at 2012_08_29;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 5900 (msg:"ET DOS Possible VNC ClientCutText Message Denial of Service/Memory Corruption Attempt"; flow:established,to_server; content:"|06|"; depth:1; isdataat:1000,relative; content:!"|0A|"; within:1000; reference:url,www.fortiguard.com/encyclopedia/vulnerability/vnc.server.clientcuttext.message.memory.corruption.html; reference:url,doc.emergingthreats.net/2011732; classtype:attempted-dos; sid:2011732; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED 0day JRE 17 exploit Class 2"; flow:established,to_client; content:"|0d 0a 0d 0a|PK"; content:"|2f|Gondzz.class"; distance:0; reference:url,blog.sucuri.net/2012/08/java-zero-day-in-the-wild.html; classtype:trojan-activity; sid:2015656; rev:4; metadata:created_at 2012_08_29, updated_at 2012_08_29;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 6014 (msg:"ET DOS IBM DB2 kuddb2 Remote Denial of Service Attempt"; flow:established,to_server; content:"|00 05 03 31 41|"; reference:url,www.securityfocus.com/bid/38018; reference:url,intevydis.blogspot.com/2010/01/ibm-db2-97-kuddb2-dos.html; reference:url,doc.emergingthreats.net/2010755; classtype:attempted-dos; sid:2010755; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Quarian HTTP Proxy Header"; flow:established,to_server; content:"Content_length|3A 20|"; http_header; content:"Proxy-Connetion|3A 20|"; http_header; reference:url,vrt-blog.snort.org/2012/12/quarian.html; classtype:trojan-activity; sid:2015999; rev:2; metadata:created_at 2012_12_08, updated_at 2012_12_08;) +#alert udp $EXTERNAL_NET any -> $HOME_NET 514 (msg:"ET DOS Cisco 514 UDP flood DoS"; content:"|25 25 25 25 25 58 58 25 25 25 25 25|"; reference:url,www.cisco.com/warp/public/707/IOS-cbac-dynacl-pub.shtml; reference:url,doc.emergingthreats.net/bin/view/Main/2000010; classtype:attempted-dos; sid:2000010; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT PDF /XFA and PDF-1.[0-4] Spec Violation (seen in pamdql and other EKs)"; flow:established,to_client; file_data; content:"%PDF-1."; within:7; pcre:"/^[0-4][^0-9]/R"; content:"/XFA"; distance:0; fast_pattern; pcre:"/^[\r\n\s]*[\d\x5b]/R"; classtype:exploit-kit; sid:2016001; rev:5; metadata:created_at 2012_12_08, former_category CURRENT_EVENTS, updated_at 2012_12_08;) +#alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DOS ICMP Path MTU lowered below acceptable threshold"; itype: 3; icode: 4; byte_test:2,<,576,6; byte_test:2,!=,0,7; reference:cve,CAN-2004-1060; reference:url,www.microsoft.com/technet/security/bulletin/MS05-019.mspx; reference:url,isc.sans.org/diary.php?date=2005-04-12; reference:url,doc.emergingthreats.net/bin/view/Main/2001882; classtype:denial-of-service; sid:2001882; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Fake AV base64 affid initial Landing or owned Check-In, asset owned if /callback/ in URI"; flow:established,to_server; content:"/?"; http_uri; content:"=YWZmaWQ9"; http_uri; classtype:trojan-activity; sid:2015649; rev:3; metadata:created_at 2012_08_22, updated_at 2012_08_22;) +#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"ET DOS Possible Microsoft SQL Server Remote Denial Of Service Attempt"; flow: established,to_server; content:"|10 00 00 10 cc|"; depth:5; reference:bugtraq,11265; reference:url,doc.emergingthreats.net/bin/view/Main/2001366; classtype:attempted-dos; sid:2001366; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Embedded Open Type Font file .eot seeing at Cool Exploit Kit"; flow:established,to_client; file_data; content:"|02 00 02 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00|"; offset:8; depth:18; content:"|4c 50|"; distance:8; within:2; content:"|10 00 40 00|D|00|e|00|x|00|t|00|e|00|r|00 00|"; distance:0; content:"|00|R|00|e|00|g|00|u|00|l|00|a|00|r|00|"; distance:0; content:"V|00|e|00|r|00|s|00|i|00|o|00|n|00 20 00|1|00 2e 00|0"; reference:cve,2011-3402; classtype:exploit-kit; sid:2016018; rev:2; metadata:created_at 2012_12_12, former_category CURRENT_EVENTS, updated_at 2012_12_12;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET DOS NetrWkstaUserEnum Request with large Preferred Max Len"; flow:established,to_server; content:"|ff|SMB"; content:"|10 00 00 00|"; distance:0; content:"|02 00|"; distance:14; within:2; byte_jump:4,12,relative,little,multiplier 2; content:"|00 00 00 00 00 00 00 00|"; distance:12; within:8; byte_test:4,>,2,0,relative; reference:cve,2006-6723; reference:url,doc.emergingthreats.net/bin/view/Main/2003236; classtype:attempted-dos; sid:2003236; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT MALVERTISING FlashPost - Redirection IFRAME"; flow:established,to_client; file_data; content:"{|22|iframe|22 3a|true,|22|url|22|"; within:20; classtype:bad-unknown; sid:2016022; rev:2; metadata:created_at 2012_12_13, former_category CURRENT_EVENTS, updated_at 2012_12_13;) +#alert http $EXTERNAL_NET any -> $HOME_NET 9495 (msg:"ET DOS IBM Tivoli Endpoint Buffer Overflow Attempt"; flow:established,to_server; content:"POST"; http_method; isdataat:261; content:!"|0A|"; depth:261; reference:url,zerodayinitiative.com/advisories/ZDI-11-169/; classtype:denial-of-service; sid:2012938; rev:2; metadata:created_at 2011_06_07, former_category DOS, updated_at 2011_06_07;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Metasploit -Java Atomic Exploit Downloaded"; flow:established,to_client; file_data; content:"PK"; within:2; content:"msf|2f|x|2f|"; distance:0; classtype:bad-unknown; sid:2016028; rev:2; metadata:affected_product Any, attack_target Client_and_Server, created_at 2012_12_13, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DOS Cisco Router HTTP DoS"; flow:to_server,established; content:"/%%"; http_uri; reference:url,www.cisco.com/warp/public/707/cisco-sn-20040326-exploits.shtml; classtype:attempted-dos; sid:2000006; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible NVIDIA Install Application ActiveX Control AddPackages Unicode Buffer Overflow"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"A9C8F210-55EB-4849-8807-EC49C5389A79"; nocase; distance:0; content:".AddPackages"; nocase; distance:0; reference:url,packetstormsecurity.org/files/118648/NVIDIA-Install-Application-2.1002.85.551-Buffer-Overflow.html; classtype:attempted-user; sid:2016041; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_12_14, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET DOS Netgear DG632 Web Management Denial Of Service Attempt"; flow:established,to_server; content:"POST"; http_method; content:"/cgi-bin/firmwarecfg"; http_uri; nocase; reference:url,securitytracker.com/alerts/2009/Jun/1022403.html; reference:cve,2009-2256; reference:url,doc.emergingthreats.net/2010554; classtype:attempted-dos; sid:2010554; rev:4; metadata:created_at 2010_07_30, former_category DOS, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Downloader Checkin Pattern Used by Several Trojans"; flow:established,to_server; content:".php?"; http_uri; content:"uid="; http_uri; content:"&gid="; http_uri; content:"&cid="; http_uri; content:"&rid="; http_uri; content:"&sid="; http_uri; reference:url,doc.emergingthreats.net/2008143; classtype:trojan-activity; sid:2008143; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp any any -> $HOME_NET 3389 (msg:"ET DOS Microsoft Remote Desktop (RDP) Syn then Reset 30 Second DoS Attempt"; flags:R; flow:to_server; flowbits:isset,ms.rdp.synack; flowbits:isnotset,ms.rdp.established; flowbits:unset,ms.rdp.synack; reference:cve,2012-0152; classtype:attempted-dos; sid:2014384; rev:8; metadata:created_at 2012_03_13, updated_at 2012_03_13;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Blackhole 2 Landing Page (3)"; flow:to_server,established; content:"/ngen/controlling/"; fast_pattern:only; http_uri; content:".php"; http_uri; classtype:trojan-activity; sid:2015797; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_10_13, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DOS Cisco 4200 Wireless Lan Controller Long Authorisation Denial of Service Attempt"; flow:to_server,established; content:"GET"; http_method; nocase; content:"/screens/frameset.html"; fast_pattern; http_uri; nocase; content:"Authorization|3A 20|Basic"; nocase; content:!"|0a|"; distance:2; within:118; isdataat:120,relative; pcre:"/^Authorization\x3A Basic.{120}/Hmi"; reference:url,www.securityfocus.com/bid/35805; reference:url,www.cisco.com/warp/public/707/cisco-amb-20090727-wlc.shtml; reference:cve,2009-1164; reference:url,doc.emergingthreats.net/2010674; classtype:attempted-dos; sid:2010674; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32.boCheMan-A/Dexter"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/gateway.php"; http_uri; content:"page="; depth:5; http_client_body; content:"&unm="; fast_pattern:only; http_client_body; content:"&cnm="; http_client_body; content:"&query="; http_client_body; reference:md5,ccc99c9f07e7be0f408ef3a68a9da298; classtype:trojan-activity; sid:2016019; rev:5; metadata:created_at 2012_10_06, updated_at 2012_10_06;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"ET DOS Microsoft Remote Desktop Protocol (RDP) maxChannelIds Integer indef DoS Attempt"; flow:to_server,established; content:"|03 00|"; depth:2; content:"|e0|"; distance:3; within:1; content:"|03 00|"; distance:0; content:"|f0|"; distance:3; within:1; content:"|7f 65|"; distance:1; within:2; content:"|04 01 01 04 01 01 01 01 ff 30|"; distance:3; within:10; content:"|02|"; distance:1; within:1; byte_test:1,>,0x80,0,relative; byte_test:1,<,0xFF,0,relative; byte_jump:1,0,relative, post_offset -128; byte_jump:1,-1,relative; byte_test:1,<,0x06,-1,relative,big; reference:url,www.msdn.microsoft.com/en-us/library/cc240836.aspx; reference:cve,2012-0002; reference:url,technet.microsoft.com/en-us/security/bulletin/ms12-020; reference:url,aluigi.org/adv/termdd_1-adv.txt; reference:url,blog.binaryninjas.org/?p=58; reference:url,luca.ntop.org/Teaching/Appunti/asn1.html; classtype:attempted-dos; sid:2014662; rev:1; metadata:created_at 2012_05_02, former_category DOS, updated_at 2012_05_02;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Prinimalka Get Task CnC Beacon"; flow:established,to_server; content:"/command?user_id="; fast_pattern; http_uri; content:"&version_id="; http_uri; content:"&crc="; http_uri; reference:url,ddos.arbornetworks.com/2012/10/trojan-prinimalka-bits-and-pieces/; classtype:command-and-control; sid:2016047; rev:2; metadata:attack_target Client_Endpoint, created_at 2012_12_18, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2012_12_18, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"ET DOS Microsoft Remote Desktop Protocol (RDP) maxChannelIds Negative Integer indef DoS Attempt"; flow:to_server,established; content:"|03 00|"; depth:2; content:"|e0|"; distance:3; within:1; content:"|03 00|"; distance:0; content:"|f0|"; distance:3; within:1; content:"|7f 65|"; distance:1; within:2; content:"|04 01 01 04 01 01 01 01 ff 30|"; distance:3; within:10; content:"|02|"; distance:1; within:1; byte_test:1,>,0x80,0,relative; byte_test:1,<,0xFF,0,relative; byte_jump:1,0,relative, post_offset -128; byte_jump:1,-1,relative; byte_test:1,&,0x80,-1,relative,big; reference:url,www.msdn.microsoft.com/en-us/library/cc240836.aspx; reference:cve,2012-0002; reference:url,technet.microsoft.com/en-us/security/bulletin/ms12-020; reference:url,aluigi.org/adv/termdd_1-adv.txt; reference:url,blog.binaryninjas.org/?p=58; reference:url,luca.ntop.org/Teaching/Appunti/asn1.html; classtype:attempted-dos; sid:2014663; rev:1; metadata:created_at 2012_05_02, former_category DOS, updated_at 2012_05_02;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Prinimalka Configuration Update Request"; flow:established,to_server; content:"/options?user_id="; http_uri; content:"&version_id="; http_uri; content:"&crc="; http_uri; content:"&uptime="; http_uri; content:"&port="; http_uri; content:"&ip="; http_uri; reference:url,ddos.arbornetworks.com/2012/10/trojan-prinimalka-bits-and-pieces/; classtype:trojan-activity; sid:2016048; rev:2; metadata:created_at 2012_12_18, updated_at 2012_12_18;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"ET DOS Microsoft Remote Desktop Protocol (RDP) maxChannelIds DoS Attempt Negative INT"; flow:to_server,established; content:"|03 00|"; depth:2; content:"|e0|"; distance:3; within:1; content:"|03 00|"; distance:0; content:"|f0|"; distance:3; within:1; content:"|7f 65|"; distance:1; within:2; content:"|04 01 01 04 01 01 01 01 ff 30|"; distance:3; within:10; content:"|02|"; distance:1; within:1; byte_test:1,<,0x80,0,relative,big; byte_test:1,&,0x80,1,relative,big; reference:url,www.msdn.microsoft.com/en-us/library/cc240836.aspx; reference:cve,2012-0002; reference:url,technet.microsoft.com/en-us/security/bulletin/ms12-020; reference:url,stratsec.blogspot.com.au/2012/03/ms12-020-vulnerability-for-breakfast.html; reference:url,aluigi.org/adv/termdd_1-adv.txt; reference:url,blog.binaryninjas.org/?p=58; reference:url,luca.ntop.org/Teaching/Appunti/asn1.html; classtype:attempted-dos; sid:2014430; rev:13; metadata:created_at 2012_03_20, updated_at 2012_03_20;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Prinimalka Prinimalka.py Script In CnC Beacon"; flow:established,to_server; content:"/prinimalka.py/"; http_uri; fast_pattern:only; reference:url,ddos.arbornetworks.com/2012/10/trojan-prinimalka-bits-and-pieces/; classtype:command-and-control; sid:2016049; rev:2; metadata:attack_target Client_Endpoint, created_at 2012_12_18, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2012_12_18, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +#alert icmp any any -> any any (msg:"ET DOS Microsoft Windows 7 ICMPv6 Router Advertisement Flood"; itype:134; icode:0; byte_test:1,&,0x08,2; content:"|03|"; offset:20; depth:1; byte_test:1,&,0x40,2,relative; byte_test:1,&,0x80,2,relative; threshold:type threshold, track by_src, count 10, seconds 1; reference:url,www.samsclass.info/ipv6/proj/proj8x-124-flood-router.htm; classtype:attempted-dos; sid:2014996; rev:3; metadata:created_at 2012_07_02, updated_at 2012_07_02;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown_gmf EK - Payload Download Received"; flow:established,to_client; content:".exe.crypted"; http_header; fast_pattern; content:"attachment"; http_header; classtype:exploit-kit; sid:2016053; rev:2; metadata:created_at 2012_12_18, updated_at 2012_12_18;) +#alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DOS IGMP dos attack"; fragbits:M+; ip_proto:2; reference:bugtraq,514; reference:cve,1999-0918; reference:url,www.microsoft.com/technet/security/bulletin/MS99-034.mspx; classtype:attempted-dos; sid:2100272; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Unknown_gmf EK - flsh.html"; flow:established,to_server; urilen:>80; content:"/flsh.html"; http_uri; classtype:exploit-kit; sid:2016056; rev:2; metadata:created_at 2012_12_18, updated_at 2012_12_18;) +#alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DOS Jolt attack"; dsize:408; fragbits:M; reference:cve,1999-0345; classtype:attempted-dos; sid:2100268; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32.Daws/Sanny CnC POST"; flow:established,to_server; content:"POST"; http_method; content:"/write.php"; http_uri; fast_pattern; content:"Accept-Language|3A| ko-kr"; http_header; content:"db="; http_client_body; depth:3; content:"&ch="; distance:0; http_client_body; content:"&name="; distance:0; http_client_body; content:"&email="; http_client_body; distance:0; content:"&pw="; http_client_body; distance:0; reference:url,blog.fireeye.com/research/2012/12/to-russia-with-apt.html; reference:url,contagiodump.blogspot.co.uk/2012/12/end-of-year-presents-continue.html; classtype:command-and-control; sid:2016051; rev:5; metadata:created_at 2012_12_18, former_category MALWARE, updated_at 2012_12_18;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"ET DOS Microsoft Remote Desktop Protocol (RDP) maxChannelIds DoS Attempt"; flow:to_server,established; content:"|03 00|"; depth:2; content:"|e0|"; distance:3; within:1; content:"|03 00|"; distance:0; content:"|f0|"; distance:3; within:1; content:"|7f 65|"; distance:1; within:2; content:"|04 01 01 04 01 01 01 01 ff 30|"; distance:3; within:10; content:"|02|"; distance:1; within:1; byte_test:1,<,0x80,0,relative,big; byte_jump:1,0,relative; byte_test:1,<,0x06,-1,relative,big; reference:url,www.msdn.microsoft.com/en-us/library/cc240836.aspx; reference:cve,2012-0002; reference:url,technet.microsoft.com/en-us/security/bulletin/ms12-020; reference:url,stratsec.blogspot.com.au/2012/03/ms12-020-vulnerability-for-breakfast.html; reference:url,aluigi.org/adv/termdd_1-adv.txt; reference:url,blog.binaryninjas.org/?p=58; reference:url,luca.ntop.org/Teaching/Appunti/asn1.html; classtype:attempted-dos; sid:2014431; rev:15; metadata:created_at 2012_03_20, updated_at 2012_03_20;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown_gmf EK - Server Response - Application Error"; flow:established,to_client; content:"X-Powered-By|3a| Application Error...."; http_header; classtype:exploit-kit; sid:2016054; rev:3; metadata:created_at 2012_12_18, updated_at 2012_12_18;) +alert tcp $HOME_NET 3389 -> any any (msg:"ET DOS Microsoft Remote Desktop (RDP) Syn/Ack Outbound Flowbit Set"; flow:from_server; flags:SA; flowbits:isnotset,ms.rdp.synack; flowbits:set,ms.rdp.synack; flowbits:noalert; reference:cve,2012-0152; classtype:not-suspicious; sid:2014385; rev:5; metadata:created_at 2012_03_15, updated_at 2012_03_15;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux/Chapro.A Malicious Apache Module CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/index.php"; http_uri; content:"c="; http_client_body; depth:2; content:"&version="; http_client_body; distance:0; content:"&uname="; fast_pattern; http_client_body; distance:0; reference:url,blog.eset.com/2012/12/18/malicious-apache-module-used-for-content-injection-linuxchapro-a; classtype:command-and-control; sid:2016062; rev:2; metadata:attack_target Client_Endpoint, created_at 2012_12_19, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2012_12_19, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 2049 (msg:"ET DOS FreeBSD NFS RPC Kernel Panic"; flow:to_server,established; content:"|00 01 86 a5|"; offset:16; depth:4; content:"|00 00 00 01|"; distance:4; within:4; content:"|00 00 00 00|"; offset:8; depth:4; content:"|00 00 00 00 00 00|"; offset:0; depth:6; reference:cve,2006-0900; reference:bugtraq,19017; reference:url,doc.emergingthreats.net/bin/view/Main/2002853; classtype:attempted-dos; sid:2002853; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Kazy/Kryptor/Cycbot Trojan Checkin 3"; flow:to_server,established; content:"GET"; nocase; http_method; content:"?pr="; fast_pattern; http_uri; content:!"Accept|3a|"; http_header; pcre:"/\.(jpg|png|gif|cgi)\?pr=/U"; classtype:trojan-activity; sid:2013866; rev:6; metadata:created_at 2011_11_08, updated_at 2011_11_08;) +#alert http any any -> $HOME_NET 3128 (msg:"ET DOS Squid-3.3.5 DoS"; flow:established,to_server; content:"Host|3a| "; http_header; pcre:"/^Host\x3a[^\x3a\r\n]+?\x3a[^\r\n]{6}/Hmi"; classtype:attempted-dos; sid:2017154; rev:2; metadata:created_at 2013_07_17, updated_at 2013_07_17;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT SofosFO 20 Dec 12 - .jar file request"; flow:established,to_server; urilen:>44; content:".jar"; offset:38; http_uri; content:"Java/1."; http_user_agent; pcre:"/^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.jar$/U"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2016071; rev:4; metadata:created_at 2012_12_21, updated_at 2012_12_21;) +alert udp any any -> any 123 (msg:"ET DOS Possible NTP DDoS Inbound Frequent Un-Authed MON_LIST Requests IMPL 0x02"; content:"|00 02 2A|"; offset:1; depth:3; byte_test:1,!&,128,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_dst,count 2,seconds 60; reference:url,www.symantec.com/connect/blogs/hackers-spend-christmas-break-launching-large-scale-ntp-reflection-attacks; classtype:attempted-dos; sid:2017918; rev:2; metadata:created_at 2014_01_03, updated_at 2014_01_03;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT SofosFO 20 Dec 12 - .pdf file request"; flow:established,to_server; urilen:>44; content:".pdf"; offset:38; http_uri; pcre:"/^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.pdf$/U"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2016072; rev:3; metadata:created_at 2012_12_21, updated_at 2012_12_21;) +alert udp any any -> any 123 (msg:"ET DOS Possible NTP DDoS Inbound Frequent Un-Authed MON_LIST Requests IMPL 0x03"; content:"|00 03 2A|"; offset:1; depth:3; byte_test:1,!&,128,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_dst,count 2,seconds 60; reference:url,www.symantec.com/connect/blogs/hackers-spend-christmas-break-launching-large-scale-ntp-reflection-attacks; classtype:attempted-dos; sid:2017919; rev:2; metadata:created_at 2014_01_03, updated_at 2014_01_03;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible HP ALM XGO.ocx ActiveX Control SetShapeNodeType method Remote Code Execution"; flow:to_client,established; file_data; content:"CLSID"; nocase; distance:0; content:"C3B92104-B5A7-11D0-A37F-00A0248F0AF1"; nocase; distance:0; content:".SetShapeNodeType("; nocase; distance:0; reference:url,packetstormsecurity.org/files/116848/HP-ALM-Remote-Code-Execution.html; classtype:attempted-user; sid:2016084; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_12_21, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +alert udp $HOME_NET 123 -> $EXTERNAL_NET any (msg:"ET DOS Possible NTP DDoS Multiple MON_LIST Seq 0 Response Spanning Multiple Packets IMPL 0x02"; content:"|00 02 2a|"; offset:1; depth:3; byte_test:1,&,128,0; byte_test:1,&,64,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_src,count 2,seconds 60; reference:url,www.symantec.com/connect/blogs/hackers-spend-christmas-break-launching-large-scale-ntp-reflection-attacks; classtype:attempted-dos; sid:2017920; rev:2; metadata:created_at 2014_01_03, updated_at 2014_01_03;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Cyme ChartFX client server ActiveX Control ShowPropertiesDialog arbitrary code execution"; flow:to_client,established; file_data; content:"CLSID"; nocase; distance:0; content:"E9DF30CA-4B30-4235-BF0C-7150F646606C"; nocase; distance:0; content:"ShowPropertiesDialog"; nocase; distance:0; reference:url,packetstormsecurity.org/files/117137/Cyme-ChartFX-Client-Server-Array-Indexing.html; classtype:attempted-user; sid:2016085; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_12_21, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +alert udp $HOME_NET 123 -> $EXTERNAL_NET any (msg:"ET DOS Possible NTP DDoS Multiple MON_LIST Seq 0 Response Spanning Multiple Packets IMPL 0x03"; content:"|00 03 2a|"; offset:1; depth:3; byte_test:1,&,128,0; byte_test:1,&,64,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_src,count 2,seconds 60; reference:url,www.symantec.com/connect/blogs/hackers-spend-christmas-break-launching-large-scale-ntp-reflection-attacks; classtype:attempted-dos; sid:2017921; rev:2; metadata:created_at 2014_01_03, updated_at 2014_01_03;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Backdoor.Win32.Skill.gk User-Agent"; flow:established,to_server; content:"|3b 20 3b 20|"; http_user_agent; content:"MSIE"; http_user_agent; classtype:trojan-activity; sid:2016074; rev:4; metadata:created_at 2012_12_21, updated_at 2020_08_20;) +alert udp any 123 -> any 0:1023 (msg:"ET DOS Likely NTP DDoS In Progress MON_LIST Response to Non-Ephemeral Port IMPL 0x02"; content:"|00 02 2a|"; offset:1; depth:3; byte_test:1,&,128,0; byte_test:1,&,64,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_src,count 1,seconds 120; reference:url,www.symantec.com/connect/blogs/hackers-spend-christmas-break-launching-large-scale-ntp-reflection-attacks; reference:url,en.wikipedia.org/wiki/Ephemeral_port; classtype:attempted-dos; sid:2017965; rev:3; metadata:created_at 2014_01_14, updated_at 2014_01_14;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Medialoads.com Spyware Reporting (download.cgi)"; flow: to_server,established; content:"/dw/cgi/download.cgi?"; nocase; http_uri; content:"sn="; nocase; http_uri; content:"Host|3a|config.medialoads.com"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001508; classtype:trojan-activity; sid:2001508; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert udp any 123 -> any 0:1023 (msg:"ET DOS Likely NTP DDoS In Progress PEER_LIST Response to Non-Ephemeral Port IMPL 0x02"; content:"|00 02 00|"; offset:1; depth:3; byte_test:1,&,128,0; byte_test:1,&,64,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_src,count 1,seconds 120; reference:url,community.rapid7.com/community/metasploit/blog/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks; reference:url,en.wikipedia.org/wiki/Ephemeral_port; classtype:attempted-dos; sid:2019010; rev:3; metadata:created_at 2014_08_26, updated_at 2014_08_26;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Drupal Mass Injection Campaign Inbound"; flow:established,from_server; file_data; content:"if (i5463 == null) { var i5463 = 1|3b|"; classtype:bad-unknown; sid:2016098; rev:2; metadata:created_at 2012_12_28, former_category CURRENT_EVENTS, updated_at 2012_12_28;) +alert udp any 123 -> any 0:1023 (msg:"ET DOS Likely NTP DDoS In Progress PEER_LIST Response to Non-Ephemeral Port IMPL 0x03"; content:"|00 03 00|"; offset:1; depth:3; byte_test:1,&,128,0; byte_test:1,&,64,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_src,count 1,seconds 120; reference:url,community.rapid7.com/community/metasploit/blog/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks; reference:url,en.wikipedia.org/wiki/Ephemeral_port; classtype:attempted-dos; sid:2019011; rev:3; metadata:created_at 2014_08_26, updated_at 2014_08_26;) -#alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Drupal Mass Injection Campaign Outbound"; flow:established,from_server; file_data; content:"if (i5463 == null) { var i5463 = 1|3b|"; classtype:bad-unknown; sid:2016099; rev:2; metadata:created_at 2012_12_28, former_category CURRENT_EVENTS, updated_at 2012_12_28;) +alert udp any 123 -> any 0:1023 (msg:"ET DOS Likely NTP DDoS In Progress PEER_LIST_SUM Response to Non-Ephemeral Port IMPL 0x02"; content:"|00 02 01|"; offset:1; depth:3; byte_test:1,&,128,0; byte_test:1,&,64,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_src,count 1,seconds 120; reference:url,community.rapid7.com/community/metasploit/blog/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks; reference:url,en.wikipedia.org/wiki/Ephemeral_port; classtype:attempted-dos; sid:2019012; rev:3; metadata:created_at 2014_08_26, updated_at 2014_08_26;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown EK Landing Page"; flow:established,from_server; file_data; content:" any 0:1023 (msg:"ET DOS Likely NTP DDoS In Progress PEER_LIST_SUM Response to Non-Ephemeral Port IMPL 0x03"; content:"|00 03 01|"; offset:1; depth:3; byte_test:1,&,128,0; byte_test:1,&,64,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_src,count 1,seconds 120; reference:url,community.rapid7.com/community/metasploit/blog/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks; reference:url,en.wikipedia.org/wiki/Ephemeral_port; classtype:attempted-dos; sid:2019013; rev:3; metadata:created_at 2014_08_26, updated_at 2014_08_26;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FakeAV Download antivirus-installer.exe"; flow:to_server,established; content:"/antivirus-install.exe"; http_uri; classtype:trojan-activity; sid:2016110; rev:3; metadata:created_at 2012_12_29, updated_at 2012_12_29;) +alert udp any any -> $HOME_NET 1900 (msg:"ET DOS Possible SSDP Amplification Scan in Progress"; content:"M-SEARCH * HTTP/1.1"; content:"ST|3a 20|ssdp|3a|all|0d 0a|"; nocase; distance:0; fast_pattern; threshold: type both,track by_src,count 2,seconds 60; reference:url,community.rapid7.com/community/metasploit/blog/2014/08/29/weekly-metasploit-update; classtype:attempted-dos; sid:2019102; rev:1; metadata:created_at 2014_09_03, updated_at 2014_09_03;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Advantech Studio ISSymbol ActiveX Control Multiple Buffer Overflow Attempt"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"3c9dff6f-5cb0-422e-9978-d6405d10718f"; nocase; distance:0; content:"InternationalSeparator"; nocase; distance:0; reference:url,securityfocus.com/bid/47596; classtype:attempted-user; sid:2016118; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_12_29, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET DOS Large amount of TCP ZeroWindow - Possible Nkiller2 DDos attack"; flags:A; window:0; threshold: type both, track by_src, count 100, seconds 60; reference:url,doc.emergingthreats.net/2009414; classtype:attempted-dos; sid:2009414; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Downloader.FakeFlashPlayer Clientregister.php CnC Beacon"; flow:established,to_server; content:"/clientregister.php?type="; http_uri; content:"&uniqid="; http_uri; content:"&winver="; http_uri; content:"&compusername="; http_uri; content:"&compnetname="; http_uri; classtype:command-and-control; sid:2016124; rev:2; metadata:attack_target Client_Endpoint, created_at 2012_12_29, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2012_12_29, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DOS Outbound Low Orbit Ion Cannon LOIC Tool Internal User May Be Participating in DDOS"; flow:to_server,established; content:"hihihihihihihihihihihihihihihihi"; nocase; threshold: type limit,track by_src,seconds 180,count 1; reference:url,www.isc.sans.org/diary.html?storyid=10051; classtype:trojan-activity; sid:2012048; rev:5; metadata:created_at 2010_12_13, updated_at 2010_12_13;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Downloader.FakeFlashPlayer Bitensiteler CnC Beacon"; flow:established,to_server; content:".php?type="; http_uri; content:"&uniqid="; http_uri; content:"&langid="; http_uri; content:"&ver="; http_uri; content:"bitensiteler="; http_uri; classtype:command-and-control; sid:2016126; rev:2; metadata:attack_target Client_Endpoint, created_at 2012_12_29, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2012_12_29, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DOS Inbound Low Orbit Ion Cannon LOIC DDOS Tool desu string"; flow:to_server,established; content:"desudesudesu"; nocase; threshold: type limit,track by_src,seconds 180,count 1; reference:url,www.isc.sans.org/diary.html?storyid=10051; classtype:trojan-activity; sid:2012049; rev:5; metadata:created_at 2010_12_13, updated_at 2010_12_13;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Downloader.FakeFlashPlayer Kelimeid CnC Beacon"; flow:established,to_server; content:".php?type="; http_uri; content:"&kelimeid"; http_uri; content:"&gecenzaman="; http_uri; content:"&gezilensayfa="; http_uri; content:"&delcookies="; http_uri; classtype:command-and-control; sid:2016127; rev:2; metadata:attack_target Client_Endpoint, created_at 2012_12_29, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2012_12_29, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DOS Outbound Low Orbit Ion Cannon LOIC Tool Internal User May Be Participating in DDOS desu string"; flow:to_server,established; content:"desudesudesu"; nocase; threshold: type limit,track by_src,seconds 180,count 1; reference:url,www.isc.sans.org/diary.html?storyid=10051; classtype:trojan-activity; sid:2012050; rev:5; metadata:created_at 2010_12_13, updated_at 2010_12_13;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT RedKit - Landing Page"; flow:established,to_client; file_data; content:".jar"; nocase; fast_pattern; content:".pdf"; nocase; content:"Msxml2.XMLHTTP"; nocase; classtype:exploit-kit; sid:2016128; rev:2; metadata:created_at 2012_12_29, former_category CURRENT_EVENTS, updated_at 2012_12_29;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET [22,23,80,443,10000] (msg:"ET DOS Possible Cisco PIX/ASA Denial Of Service Attempt (Hping Created Packets)"; flow:to_server; content:"|58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58|"; depth:40; content:"|58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58|"; distance:300; isdataat:300,relative; threshold: type threshold, track by_src, count 60, seconds 80; reference:url,www.securityfocus.com/bid/34429/info; reference:url,www.securityfocus.com/bid/34429/exploit; reference:url,www.cisco.com/en/US/products/products_applied_mitigation_bulletin09186a0080a99518.html; reference:cve,2009-1157; reference:url,doc.emergingthreats.net/2010624; classtype:attempted-dos; sid:2010624; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Escaped Unicode Char in Location CVE-2012-4792 EIP (Exploit Specific replace)"; flow:established,from_server; file_data; content:"jj2Ejj6Cjj6Fjj63jj61jj74jj69jj6Fjj6Ejj20jj3Djj20jj75jj6Ejj65jj73jj63jj61jj70jj65jj28jj22jj25jj75"; nocase; reference:cve,2012-4792; reference:url,github.com/rapid7/metasploit-framework/commit/6cb9106218bde56fc5e8d72c66fbba9f11c24449; reference:url,eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-relations/; classtype:attempted-user; sid:2016133; rev:3; metadata:created_at 2012_12_30, former_category CURRENT_EVENTS, updated_at 2012_12_30;) +#alert udp $HOME_NET 53 -> any any (msg:"ET DOS DNS Amplification Attack Outbound"; content:"|01 00 00 01 00 00 00 00 00 01|"; depth:10; offset:2; pcre:"/^[^\x00]+?\x00/R"; content:"|00 ff 00 01 00 00 29|"; within:7; fast_pattern; byte_test:2,>,4095,0,relative; threshold: type limit, track by_src, seconds 60, count 1; classtype:bad-unknown; sid:2016017; rev:7; metadata:created_at 2012_12_12, updated_at 2012_12_12;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Escaped Unicode Char in Location CVE-2012-4792 EIP % Hex Encode"; flow:established,from_server; file_data; content:"%2e%6c%6f%63%61%74%69%6f%6e%20%3d%20%75%6e%65%73%63%61%70%65%28%22%25%75"; nocase; reference:cve,2012-4792; reference:url,github.com/rapid7/metasploit-framework/commit/6cb9106218bde56fc5e8d72c66fbba9f11c24449; reference:url,eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-relations/; classtype:attempted-user; sid:2016134; rev:3; metadata:created_at 2012_12_30, former_category CURRENT_EVENTS, updated_at 2012_12_30;) +alert udp any any -> $HOME_NET 53 (msg:"ET DOS DNS Amplification Attack Inbound"; content:"|01 00 00 01 00 00 00 00 00 01|"; depth:10; offset:2; pcre:"/^[^\x00]+?\x00/R"; content:"|00 ff 00 01 00 00 29|"; within:7; fast_pattern; byte_test:2,>,4095,0,relative; threshold: type both, track by_dst, seconds 60, count 5; classtype:bad-unknown; sid:2016016; rev:8; metadata:created_at 2012_12_12, updated_at 2012_12_12;) -alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO PTUNNEL OUTBOUND"; itype:8; icode:0; content:"|D5 20 08 80|"; depth:4; reference:url,github.com/madeye/ptunnel; reference:url,cs.uit.no/~daniels/PingTunnel/#protocol; classtype:protocol-command-decode; sid:2016145; rev:2; metadata:created_at 2013_01_03, updated_at 2013_01_03;) +alert udp any 123 -> any 0:1023 (msg:"ET DOS Likely NTP DDoS In Progress MON_LIST Response to Non-Ephemeral Port IMPL 0x03"; content:"|00 03 2a|"; offset:1; depth:3; byte_test:1,&,128,0; byte_test:1,&,64,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_src,count 1,seconds 120; reference:url,www.symantec.com/connect/blogs/hackers-spend-christmas-break-launching-large-scale-ntp-reflection-attacks; reference:url,en.wikipedia.org/wiki/Ephemeral_port; classtype:attempted-dos; sid:2017966; rev:3; metadata:created_at 2014_01_14, updated_at 2014_01_14;) -alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO PTUNNEL INBOUND"; itype:0; icode:0; content:"|D5 20 08 80|"; depth:4; reference:url,github.com/madeye/ptunnel; reference:url,cs.uit.no/~daniels/PingTunnel/#protocol; classtype:protocol-command-decode; sid:2016146; rev:3; metadata:created_at 2013_01_03, updated_at 2013_01_03;) +alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET DOS Terse HTTP GET Likely GoodBye 5.2 DDoS tool"; flow:to_server,established; dsize:<50; content:"|20|HTTP/1.1Host|3a 20|"; threshold:type both,track by_dst,count 500,seconds 60; classtype:attempted-dos; sid:2019350; rev:2; metadata:created_at 2014_10_03, updated_at 2014_10_03;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Sony PC Companion Load method Stack-based Unicode Buffer Overload SEH"; flow:to_client,established; file_data; content:"CLSID"; nocase; distance:0; content:"EEA36793-F574-4CC1-8690-60E3511CFEAA"; nocase; distance:0; content:".Load"; nocase; distance:0; reference:url,packetstormsecurity.com/files/119022/Sony-PC-Companion-2.1-Load-Unicode-Buffer-Overflow.html; classtype:attempted-user; sid:2016160; rev:3; metadata:created_at 2013_01_05, updated_at 2013_01_05;) +alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET DOS Terse HTTP GET Likely LOIC"; flow:to_server,established; dsize:18; content:"GET / HTTP/1.1|0d 0a 0d 0a|"; depth:18; threshold:type both,track by_dst,count 500,seconds 60; classtype:attempted-dos; sid:2019346; rev:2; metadata:created_at 2014_10_03, updated_at 2014_10_03;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Sony PC Companion CheckCompatibility method Stack-based Unicode Buffer Overload"; flow:to_client,established; file_data; content:"CLSID"; nocase; distance:0; content:"A70D160E-E925-4207-803B-A0D702BEDF46"; nocase; distance:0; content:".CheckCompatibility"; nocase; distance:0; reference:url,packetstormsecurity.com/files/119023/Sony-PC-Companion-2.1-CheckCompatibility-Unicode-Buffer-Overflow.html; classtype:attempted-user; sid:2016161; rev:3; metadata:created_at 2013_01_05, updated_at 2013_01_05;) +alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET DOS HTTP GET AAAAAAAA Likely FireFlood"; flow:to_server,established; content:"GET AAAAAAAA HTTP/1.1"; content:!"Referer|3a|"; distance:0; content:!"Accept"; distance:0; content:!"|0d 0a|"; distance:0; threshold:type both,track by_dst,count 500,seconds 60; classtype:attempted-dos; sid:2019347; rev:2; metadata:created_at 2014_10_03, updated_at 2014_10_03;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Sony PC Companion Admin_RemoveDirectory Stack-based Unicode Buffer Overload SEH"; flow:to_client,established; file_data; content:"CLSID"; nocase; distance:0; content:"BBB7AA7C-DCE4-4F85-AED3-72FE3BCA4141"; nocase; distance:0; content:".Admin_RemoveDirectory"; nocase; distance:0; reference:url,packetstormsecurity.com/files/119024/Sony-PC-Companion-2.1-Admin_RemoveDirectory-Unicode-Buffer-Overflow.html; classtype:attempted-user; sid:2016162; rev:3; metadata:created_at 2013_01_05, updated_at 2013_01_05;) +alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET DOS Terse HTTP GET Likely AnonMafiaIC DDoS tool"; flow:to_server,established; dsize:20; content:"GET / HTTP/1.0|0d 0a 0d 0a 0d 0a|"; depth:20; threshold:type both,track by_dst,count 500,seconds 60; classtype:attempted-dos; sid:2019348; rev:2; metadata:created_at 2014_10_03, updated_at 2014_10_03;) -alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"ET MALWARE DNS Reply Sinkhole - Microsoft - 199.2.137.0/24"; content:"|00 01 00 01|"; content:"|00 04 c7 02 89|"; distance:4; within:5; classtype:trojan-activity; sid:2016102; rev:2; metadata:created_at 2012_12_28, updated_at 2012_12_28;) +alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET DOS Terse HTTP GET Likely AnonGhost DDoS tool"; flow:to_server,established; dsize:20; content:"GET / HTTP/1.1|0d 0a 0d 0a 0d 0a|"; depth:20; threshold:type both,track by_dst,count 500,seconds 60; classtype:attempted-dos; sid:2019349; rev:2; metadata:created_at 2014_10_03, updated_at 2014_10_03;) -#alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"ET MALWARE DNS Reply Sinkhole - Microsoft - 207.46.90.0/24"; content:"|00 01 00 01|"; content:"|00 04 cf 2e 5a|"; distance:4; within:5; classtype:trojan-activity; sid:2016103; rev:2; metadata:created_at 2012_12_28, updated_at 2012_12_28;) +alert udp any 123 -> any 0:1023 (msg:"ET DOS Likely NTP DDoS In Progress GET_RESTRICT Response to Non-Ephemeral Port IMPL 0x03"; content:"|00 03 10|"; offset:1; depth:3; byte_test:1,&,128,0; byte_test:1,&,64,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_src,count 1,seconds 120; reference:url,community.rapid7.com/community/metasploit/blog/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks; reference:url,en.wikipedia.org/wiki/Ephemeral_port; classtype:attempted-dos; sid:2019014; rev:4; metadata:created_at 2014_08_26, updated_at 2014_08_26;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Possible CrimeBoss Generic URL Structure"; flow:established,to_server; content:"/cb.php?action="; http_uri; classtype:exploit-kit; sid:2016169; rev:3; metadata:created_at 2013_01_08, updated_at 2013_01_08;) +alert udp any 123 -> any 0:1023 (msg:"ET DOS Likely NTP DDoS In Progress GET_RESTRICT Response to Non-Ephemeral Port IMPL 0x02"; content:"|00 02 10|"; offset:1; depth:3; byte_test:1,&,128,0; byte_test:1,&,64,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_src,count 1,seconds 120; reference:url,community.rapid7.com/community/metasploit/blog/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks; reference:url,en.wikipedia.org/wiki/Ephemeral_port; classtype:attempted-dos; sid:2019015; rev:4; metadata:created_at 2014_08_26, updated_at 2014_08_26;) -alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER WebShell - JSP RAT"; flow:established,to_client; file_data; content:""; classtype:attempted-user; sid:2016151; rev:3; metadata:created_at 2013_01_04, updated_at 2013_01_04;) +alert udp any any -> any 123 (msg:"ET DOS Possible NTP DDoS Inbound Frequent Un-Authed PEER_LIST Requests IMPL 0x03"; content:"|00 03 00|"; offset:1; depth:3; byte_test:1,!&,128,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_dst,count 2,seconds 60; reference:url,community.rapid7.com/community/metasploit/blog/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks; classtype:attempted-dos; sid:2019016; rev:3; metadata:created_at 2014_08_26, updated_at 2014_08_26;) -alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER WebShell - JSP File Admin"; flow:established,to_client; file_data; content:"

(L)aunch external program

"; classtype:attempted-user; sid:2016152; rev:4; metadata:created_at 2013_01_04, updated_at 2013_01_04;) +alert udp any any -> any 123 (msg:"ET DOS Possible NTP DDoS Inbound Frequent Un-Authed PEER_LIST Requests IMPL 0x02"; content:"|00 02 00|"; offset:1; depth:3; byte_test:1,!&,128,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_dst,count 2,seconds 60; reference:url,community.rapid7.com/community/metasploit/blog/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks; classtype:attempted-dos; sid:2019017; rev:3; metadata:created_at 2014_08_26, updated_at 2014_08_26;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DRIVEBY RedKit - Landing Page"; flow:established,to_client; file_data; content:".jar"; nocase; fast_pattern; content:".pdf"; nocase; content:"Msxml2.XMLHTTP"; nocase; pcre:"/\/[0-9]{3}\.jar/"; pcre:"/\/[0-9]{3}\.pdf/"; classtype:exploit-kit; sid:2016174; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2013_01_09, deployment Perimeter, former_category EXPLOIT_KIT, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) +alert udp any any -> any 123 (msg:"ET DOS Possible NTP DDoS Inbound Frequent Un-Authed PEER_LIST_SUM Requests IMPL 0x03"; content:"|00 03 01|"; offset:1; depth:3; byte_test:1,!&,128,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_dst,count 2,seconds 60; reference:url,community.rapid7.com/community/metasploit/blog/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks; classtype:attempted-dos; sid:2019018; rev:3; metadata:created_at 2014_08_26, updated_at 2014_08_26;) -alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"ET SNMP missing community string attempt 1"; content:"|30|"; depth:1; byte_test:1,!&,0x80,0,relative,big; content:"|02|"; distance:1; within:1; byte_test:1,!&,0x80,0,relative,big; byte_jump:1,0,relative; content:"|04 00|"; within:2; reference:bugtraq,2112; reference:cve,1999-0517; classtype:misc-attack; sid:2016178; rev:2; metadata:created_at 2013_01_09, updated_at 2013_01_09;) +alert udp any any -> any 123 (msg:"ET DOS Possible NTP DDoS Inbound Frequent Un-Authed PEER_LIST_SUM Requests IMPL 0x02"; content:"|00 02 01|"; offset:1; depth:3; byte_test:1,!&,128,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_dst,count 2,seconds 60; reference:url,community.rapid7.com/community/metasploit/blog/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks; classtype:attempted-dos; sid:2019019; rev:3; metadata:created_at 2014_08_26, updated_at 2014_08_26;) -alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"ET SNMP missing community string attempt 2"; content:"|30|"; depth:1; byte_test:1,&,0x80,0,relative,big; byte_jump:1,0,relative; content:"|02|"; distance:-129; within:1; byte_test:1,&,0x80,0,relative,big; byte_jump:1,0,relative; content:"|04 00|"; distance:-129; within:2; reference:bugtraq,2112; reference:cve,1999-0517; classtype:misc-attack; sid:2016179; rev:2; metadata:created_at 2013_01_09, updated_at 2013_01_09;) +alert udp any any -> any 123 (msg:"ET DOS Possible NTP DDoS Inbound Frequent Un-Authed GET_RESTRICT Requests IMPL 0x02"; content:"|00 02 10|"; offset:1; depth:3; byte_test:1,!&,128,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_dst,count 2,seconds 60; reference:url,community.rapid7.com/community/metasploit/blog/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks; classtype:attempted-dos; sid:2019021; rev:3; metadata:created_at 2014_08_26, updated_at 2014_08_26;) -#alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"ET SNMP missing community string attempt 3"; content:"|30|"; depth:1; byte_test:1,&,0x80,0,relative,big; byte_jump:1,0,relative; content:"|02|"; distance:-129; within:1; byte_test:1,!&,0x80,0,relative,big; byte_jump:1,0,relative; content:"|04 00|"; within:2; reference:bugtraq,2112; reference:cve,1999-0517; classtype:misc-attack; sid:2016180; rev:2; metadata:created_at 2013_01_09, former_category SNMP, updated_at 2017_08_24;) +alert udp any any -> any 123 (msg:"ET DOS Possible NTP DDoS Inbound Frequent Un-Authed GET_RESTRICT Requests IMPL 0x03"; content:"|00 03 10|"; offset:1; depth:3; byte_test:1,!&,128,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,&,1,0; threshold: type both,track by_dst,count 2,seconds 60; reference:url,community.rapid7.com/community/metasploit/blog/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks; classtype:attempted-dos; sid:2019020; rev:3; metadata:created_at 2014_08_26, updated_at 2014_08_26;) -alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"ET SNMP missing community string attempt 4"; content:"|30|"; depth:1; byte_test:1,!&,0x80,0,relative,big; content:"|02|"; distance:1; within:1; byte_test:1,&,0x80,0,relative,big; byte_jump:1,0,relative; content:"|04 00|"; distance:-129; within:2; reference:bugtraq,2112; reference:cve,1999-0517; classtype:misc-attack; sid:2016181; rev:2; metadata:created_at 2013_01_09, updated_at 2013_01_09;) +alert udp any 123 -> any any (msg:"ET DOS Likely NTP DDoS In Progress Multiple UNSETTRAP Mode 6 Responses"; content:"|df 00 00 04 00|"; offset:1; depth:5; byte_test:1,!&,128,0; byte_test:1,!&,64,0; byte_test:1,&,4,0; byte_test:1,&,2,0; byte_test:1,!&,1,0; threshold: type both,track by_src,count 2,seconds 60; reference:url,community.rapid7.com/community/metasploit/blog/2014/08/25/r7-2014-12-more-amplification-vulnerabilities-in-ntp-allow-even-more-drdos-attacks; classtype:attempted-dos; sid:2019022; rev:4; metadata:created_at 2014_08_26, updated_at 2014_08_26;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT probable malicious Glazunov Javascript injection"; flow:established,from_server; file_data; content:"(|22|"; distance:0; content:"|22|))|3b|"; distance:52; within:106; content:")|3b|"; within:200; fast_pattern; pcre:"/\(\x22[0-9\x3a\x3b\x3c\x3d\x3e\x3fa-k]{50,100}\x22\).{0,200}\)\x3b<\/script><\/body>/s"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2015977; rev:7; metadata:created_at 2012_12_04, updated_at 2012_12_04;) +alert udp $HOME_NET 1434 -> $EXTERNAL_NET any (msg:"ET DOS MC-SQLR Response Outbound Possible DDoS Participation"; content:"|05|"; depth:1; content:"ServerName|3b|"; nocase; content:"InstanceName|3b|"; distance:0; content:"IsClustered|3b|"; distance:0; content:"Version|3b|"; distance:0; threshold:type both,track by_src,count 30,seconds 60; reference:url,kurtaubuchon.blogspot.com.es/2015/01/mc-sqlr-amplification-ms-sql-server.html; classtype:attempted-dos; sid:2020305; rev:4; metadata:created_at 2015_01_23, updated_at 2015_01_23;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DRIVEBY SPL - Landing Page Received"; flow:established,to_client; file_data; content:"application/x-java-applet"; content:"width=|22|000"; content:"height=|22|000"; classtype:exploit-kit; sid:2016190; rev:4; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2013_01_12, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) +alert udp $EXTERNAL_NET 1434 -> $HOME_NET any (msg:"ET DOS MC-SQLR Response Inbound Possible DDoS Target"; content:"|05|"; depth:1; content:"ServerName|3b|"; nocase; content:"InstanceName|3b|"; distance:0; content:"IsClustered|3b|"; distance:0; content:"Version|3b|"; distance:0; threshold:type both,track by_dst,count 30,seconds 60; reference:url,kurtaubuchon.blogspot.com.es/2015/01/mc-sqlr-amplification-ms-sql-server.html; classtype:attempted-dos; sid:2020306; rev:3; metadata:created_at 2015_01_23, updated_at 2015_01_23;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT CoolEK - Landing Page Received"; flow:established,to_client; file_data; content:"
"; classtype:exploit-kit; sid:2016191; rev:6; metadata:created_at 2013_01_12, former_category EXPLOIT_KIT, updated_at 2013_01_12;) +alert udp $HOME_NET 5093 -> $EXTERNAL_NET any (msg:"ET DOS Possible Sentinal LM Application attack in progress Outbound (Response)"; dsize:>1390; content:"|7a 00 00 00 00 00 00 00 00 00 00 00|"; depth:12; threshold: type both,track by_src,count 10,seconds 60; classtype:attempted-dos; sid:2021170; rev:1; metadata:created_at 2015_05_29, updated_at 2015_05_29;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED DRIVEBY Unknown - Please wait..."; flow:established,to_client; file_data; content:"Please wait..."; nocase; content:"
1390; content:"|7a 00 00 00 00 00 00 00 00 00 00 00|"; depth:12; threshold: type both,track by_src,count 10,seconds 60; classtype:attempted-dos; sid:2021171; rev:1; metadata:created_at 2015_05_29, updated_at 2015_05_29;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Honeywell Tema Remote Installer ActiveX DownloadFromURL method Remote Code Execution"; flow:to_client,established; file_data; content:"CLSID"; nocase; distance:0; content:"E01DF79C-BE0C-4999-9B13-B5F7B2306E9B"; nocase; distance:0; content:".DownloadFromURL"; nocase; distance:0; reference:url,packetstormsecurity.com/files/119427/Honeywell-Tema-Remote-Installer-ActiveX-Remote-Code-Execution.html; classtype:attempted-user; sid:2016197; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_01_12, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +alert udp $EXTERNAL_NET any -> $HOME_NET 5093 (msg:"ET DOS Possible Sentinal LM Amplification attack (Request) Inbound"; dsize:6; content:"|7a 00 00 00 00 00|"; threshold: type both,track by_dst,count 10,seconds 60; classtype:attempted-dos; sid:2021172; rev:1; metadata:created_at 2015_05_29, updated_at 2015_05_29;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED FakeAV Checkin"; flow:to_server,established; content:"GET"; http_method; content:"/?affid="; depth:8; http_uri; content:"&promo_type="; http_uri; content:"&promo_opt="; http_uri; pcre:"/^\/\?affid=\d+&promo_type=\d+&promo_opt=\d+$/U"; reference:md5,527e115876d0892c9a0ddfc96e852a16; classtype:trojan-activity; sid:2016075; rev:3; metadata:created_at 2012_12_21, updated_at 2012_12_21;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DOS Skype FindCountriesByNamePattern property Buffer Overflow Attempt"; flow:to_client,established; file_data; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*22C83263-E4B8-4233-82CD-FB047C6BF13E/si"; reference:url,garage4hackers.com/f43/skype-5-x-activex-crash-poc-981.html; classtype:web-application-attack; sid:2013462; rev:3; metadata:created_at 2011_08_26, updated_at 2011_08_26;) -#alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"ET DELETED DNS Reply Sinkhole - zeus.redheberg.com - 95.130.14.32"; content:"|00 01 00 01|"; content:"|00 04 5f 82 0e 20|"; distance:4; within:6; classtype:trojan-activity; sid:2016105; rev:3; metadata:created_at 2012_12_28, updated_at 2012_12_28;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DOS Skype FindCountriesByNamePattern property Buffer Overflow Attempt Format String Function Call"; flow:to_client,established; file_data; content:"ActiveXObject"; nocase; content:"SkypePNRLib.PNR"; nocase; distance:0; content:".FindCountriesByNamePattern"; nocase; reference:url,garage4hackers.com/f43/skype-5-x-activex-crash-poc-981.html; classtype:attempted-user; sid:2013463; rev:3; metadata:created_at 2011_08_26, updated_at 2011_08_26;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Metasploit CVE-2013-0422 Landing Page"; flow:established,from_server; file_data; content:"Loading, Please Wait..."; pcre:"/[^a-zA-Z0-9_\-\.][a-zA-Z]{7}\.class/"; pcre:"/[^a-zA-Z0-9_\-\.][a-zA-Z]{8}\.jar/"; classtype:attempted-user; sid:2016227; rev:4; metadata:affected_product Any, attack_target Client_and_Server, created_at 2013_01_17, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET 10000: -> $HOME_NET 0:1023 (msg:"ET DOS Potential Tsunami SYN Flood Denial Of Service Attempt"; flags:S; flow:to_server; dsize:>900; threshold: type both, count 20, seconds 120, track by_src; reference:url,security.radware.com/uploadedFiles/Resources_and_Content/Threat/TsunamiSYNFloodAttack.pdf; classtype:attempted-dos; sid:2019404; rev:3; metadata:created_at 2014_10_15, updated_at 2014_10_15;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible KeyHelp ActiveX LaunchTriPane Remote Code Execution Vulnerability"; flow:to_client,established; file_data; content:"45E66957-2932-432A-A156-31503DF0A681"; nocase; distance:0; content:".LaunchTriPane("; nocase; distance:0; reference:url,packetstormsecurity.com/files/117293/KeyHelp-ActiveX-LaunchTriPane-Remote-Code-Execution.html; classtype:attempted-user; sid:2016236; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_01_18, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +alert udp $HOME_NET 53 -> $EXTERNAL_NET 1:1023 (msg:"ET DOS DNS Amplification Attack Possible Outbound Windows Non-Recursive Root Hint Reserved Port"; content:"|81 00 00 01 00 00|"; depth:6; offset:2; byte_test:2,>,10,0,relative; byte_test:2,>,10,2,relative; content:"|0c|root-servers|03|net|00|"; distance:0; content:"|0c|root-servers|03|net|00|"; distance:0; threshold: type both, track by_dst, seconds 60, count 5; reference:url,twitter.com/sempersecurus/status/763749835421941760; reference:url,pastebin.com/LzubgtVb; classtype:bad-unknown; sid:2023054; rev:2; metadata:attack_target Server, created_at 2016_08_12, deployment Datacenter, performance_impact Low, updated_at 2016_08_12;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Samsung Kies ActiveX PrepareSync method Buffer overflow"; flow:to_client,established; file_data; content:"CLSID"; nocase; distance:0; content:"EA8A3985-F9DF-4652-A255-E4E7772AFCA8"; nocase; distance:0; content:".PrepareSync"; nocase; distance:0; reference:url,packetstormsecurity.com/files/119423/Samsung-Kies-2.5.0.12114_1-Buffer-Overflow.html; classtype:attempted-user; sid:2016237; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_01_18, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +alert udp $EXTERNAL_NET 53 -> $HOME_NET 1:1023 (msg:"ET DOS DNS Amplification Attack Possible Inbound Windows Non-Recursive Root Hint Reserved Port"; content:"|81 00 00 01 00 00|"; depth:6; offset:2; byte_test:2,>,10,0,relative; byte_test:2,>,10,2,relative; content:"|0c|root-servers|03|net|00|"; distance:0; content:"|0c|root-servers|03|net|00|"; distance:0; threshold: type both, track by_dst, seconds 60, count 5; reference:url,twitter.com/sempersecurus/status/763749835421941760; reference:url,pastebin.com/LzubgtVb; classtype:bad-unknown; sid:2023053; rev:2; metadata:attack_target Server, created_at 2016_08_12, deployment Datacenter, performance_impact Low, updated_at 2016_08_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible JKDDOS download b.exe"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/b.exe"; nocase; http_uri; reference:url,asert.arbornetworks.com/2011/03/jkddos-ddos-bot-with-an-interest-in-the-mining-industry; classtype:trojan-activity; sid:2012466; rev:3; metadata:created_at 2011_03_10, updated_at 2011_03_10;) +alert tcp any 445 -> $HOME_NET any (msg:"ET DOS SMB Tree_Connect Stack Overflow Attempt (CVE-2017-0016)"; flow:from_server,established; content:"|FE|SMB"; offset:4; depth:4; content:"|03 00|"; distance:8; within:2; byte_test:1,&,1,2,relative; byte_jump:2,8,little,from_beginning; byte_jump:2,4,relative,little; isdataat:1000,relative; content:!"|FE|SMB"; within:1000; reference:cve,2017-0016; classtype:attempted-dos; sid:2023832; rev:3; metadata:affected_product SMBv3, attack_target Client_and_Server, created_at 2017_02_03, deployment Datacenter, signature_severity Major, updated_at 2017_02_07;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible KeyHelp ActiveX LaunchTriPane Remote Code Execution Vulnerability 2"; flow:to_client,established; file_data; content:"ActiveXObject"; nocase; content:"KeyHelp.KeyScript"; nocase; distance:0; content:".LaunchTriPane("; nocase; distance:0; reference:url,packetstormsecurity.com/files/117293/KeyHelp-ActiveX-LaunchTriPane-Remote-Code-Execution.html; classtype:attempted-user; sid:2016235; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_01_18, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +alert tcp any any -> $HOME_NET 445 (msg:"ET DOS Microsoft Windows LSASS Remote Memory Corruption (CVE-2017-0004)"; flow:established,to_server; content:"|FF|SMB|73|"; offset:4; depth:5; byte_test:1,&,0x80,6,relative; byte_test:1,&,0x08,6,relative; byte_test:1,&,0x10,5,relative; byte_test:1,&,0x04,5,relative; byte_test:1,&,0x02,5,relative; byte_test:1,&,0x01,5,relative; content:"|ff 00|"; distance:28; within:2; content:"|84|"; distance:25; within:1; content:"NTLMSSP"; fast_pattern; within:64; reference:url,github.com/lgandx/PoC/tree/master/LSASS; reference:url,support.microsoft.com/en-us/kb/3216771; reference:url,support.microsoft.com/en-us/kb/3199173; reference:cve,2017-0004; reference:url,technet.microsoft.com/library/security/MS17-004; classtype:attempted-dos; sid:2023497; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2016_11_11, deployment Perimeter, deployment Datacenter, performance_impact Low, signature_severity Major, updated_at 2017_01_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED pamdql/Sweet Orange delivering hostile XOR trojan payload from robots.php"; flow:established,to_server; content:"/robots.php?"; http_uri; classtype:exploit-kit; sid:2016092; rev:3; metadata:created_at 2012_12_28, updated_at 2012_12_28;) +#alert tcp any any -> $HOME_NET [139,445] (msg:"ET DOS Possible SMBLoris NBSS Length Mem Exhaustion Vuln Inbound"; flow:established,to_server; content:"|00 01|"; depth:2; threshold:type both,track by_dst,count 3, seconds 90; reference:url,isc.sans.edu/forums/diary/SMBLoris+the+new+SMB+flaw/22662/; classtype:trojan-activity; sid:2024510; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2017_08_02, deployment Internal, former_category DOS, performance_impact Significant, signature_severity Major, updated_at 2017_08_02;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Java applet with obfuscated URL Jan 21 2012"; flow:established,from_server; file_data; content:"applet"; content:"Dyy"; within:300; content:"Ojj"; within:200; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2016242; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_01_22, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +alert tcp any any -> $HOME_NET [139,445] (msg:"ET DOS SMBLoris NBSS Length Mem Exhaustion Attempt (PoC Based)"; flow:established,to_server; content:"|00 01 ff ff|"; depth:4; threshold:type both,track by_dst,count 30, seconds 300; reference:url,isc.sans.edu/forums/diary/SMBLoris+the+new+SMB+flaw/22662/; classtype:trojan-activity; sid:2024511; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2017_08_02, deployment Internal, former_category DOS, performance_impact Significant, signature_severity Major, updated_at 2017_08_03;) -alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER WebShell - Symlink_Sa"; flow:established,to_client; file_data; content:"Symlink_Sa"; classtype:bad-unknown; sid:2016244; rev:2; metadata:created_at 2013_01_22, updated_at 2013_01_22;) +alert udp $EXTERNAL_NET 389 -> $HOME_NET 389 (msg:"ET DOS CLDAP Amplification Reflection (PoC based)"; dsize:52; content:"|30 84 00 00 00 2d 02 01 01 63 84 00 00 00 24 04 00 0a 01 00|"; fast_pattern; threshold:type both, count 100, seconds 60, track by_src; reference:url,www.akamai.com/us/en/multimedia/documents/state-of-the-internet/cldap-threat-advisory.pdf; reference:url,packetstormsecurity.com/files/139561/LDAP-Amplication-Denial-Of-Service.html; classtype:attempted-dos; sid:2024584; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Linux, attack_target Server, created_at 2017_08_16, deployment Perimeter, former_category DOS, performance_impact Significant, signature_severity Major, updated_at 2017_08_16;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT StyX Landing Page"; flow:established,from_server; file_data; content:"|22|pdfx.ht|5C|x6dl|22|"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2016247; rev:6; metadata:created_at 2013_01_22, updated_at 2013_01_22;) +alert udp $EXTERNAL_NET any -> $HOME_NET 389 (msg:"ET DOS Potential CLDAP Amplification Reflection"; content:"objectclass0"; fast_pattern; threshold:type both, count 200, seconds 60, track by_src; reference:url,www.akamai.com/us/en/multimedia/documents/state-of-the-internet/cldap-threat-advisory.pdf; reference:url,packetstormsecurity.com/files/139561/LDAP-Amplication-Denial-Of-Service.html; classtype:attempted-dos; sid:2024585; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Linux, attack_target Client_and_Server, created_at 2017_08_16, deployment Perimeter, former_category DOS, performance_impact Significant, signature_severity Major, updated_at 2017_08_16;) -alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER WebShell - Generic - c99shell based header"; flow:established,to_client; file_data; content:"<b>Software|3a|"; content:"<b>uname -a|3a|"; content:"<b>uid="; classtype:bad-unknown; sid:2016245; rev:3; metadata:created_at 2013_01_22, updated_at 2013_01_22;) +alert udp any 11211 -> $EXTERNAL_NET any (msg:"ET DOS Possible Memcached DDoS Amplification Response Outbound"; flowbits:isset,ET.memcached.ddos; content:"STATS|20|pid"; depth:9; fast_pattern; threshold: type both, count 100, seconds 60, track by_dst; reference:url,blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/; classtype:attempted-dos; sid:2025402; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Linux, attack_target Server, created_at 2018_03_01, deployment Perimeter, former_category DOS, performance_impact Low, signature_severity Major, updated_at 2018_03_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Red Dot Exploit Kit Binary Payload Request"; flow:established,to_server; content:"/load.php?guid="; http_uri; content:"&thread="; http_uri; content:"&exploit="; http_uri; content:"&version="; http_uri; content:"&rnd="; http_uri; reference:url,malware.dontneedcoffee.com/; classtype:exploit-kit; sid:2016255; rev:2; metadata:created_at 2013_01_24, former_category EXPLOIT_KIT, updated_at 2013_01_24;) +alert udp $EXTERNAL_NET 11211 -> $HOME_NET any (msg:"ET DOS Possible Memcached DDoS Amplification Inbound"; content:"STATS|20|pid"; depth:9; fast_pattern; threshold: type both, count 100, seconds 60, track by_dst; reference:url,blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/; classtype:attempted-dos; sid:2025403; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Linux, attack_target Client_Endpoint, created_at 2018_03_01, deployment Perimeter, former_category DOS, performance_impact Low, signature_severity Major, updated_at 2018_03_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 1"; flow:to_server,established; content:"GET"; http_method; urilen:10; content:"/start.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016257; rev:3; metadata:created_at 2013_01_24, updated_at 2013_01_24;) +#alert tcp any any -> $HOME_NET 3389 (msg:"ET DOS Microsoft Remote Desktop (RDP) Session Established Flowbit Set"; flow:to_server,established; flowbits:isset,ms.rdp.synack; flowbits:unset,ms.rdp.synack; flowbits:set,ms.rdp.established; flowbits:noalert; reference:cve,2012-0152; classtype:not-suspicious; sid:2014386; rev:3; metadata:created_at 2012_03_15, former_category DOS, updated_at 2012_03_15;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 2"; flow:to_server,established; content:"GET"; http_method; urilen:10; content:"/setup.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016258; rev:3; metadata:created_at 2013_01_24, updated_at 2013_01_24;) +alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET DOS Trojan.BlackRev V1.Botnet HTTP Login POST Flood Traffic Inbound"; flow:established,to_server; threshold: type both, count 5, seconds 60, track by_src; http.method; content:"POST"; http.user_agent; content:"Mozilla/4.0 (compatible|3b 20|Synapse)"; fast_pattern; http.request_body; content:"login="; depth:6; content:"$pass="; within:50; reference:url,www.btpro.net/blog/2013/05/black-revolution-botnet-trojan/; classtype:attempted-dos; sid:2017722; rev:4; metadata:created_at 2013_11_15, updated_at 2020_04_27;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 3"; flow:to_server,established; content:"GET"; http_method; urilen:11; content:"/search.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016259; rev:3; metadata:created_at 2013_01_24, updated_at 2013_01_24;) +alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET DOS Inbound GoldenEye DoS attack"; flow:established,to_server; threshold: type both, track by_src, count 100, seconds 300; http.uri; content:"/?"; fast_pattern; depth:2; content:"="; distance:3; within:11; pcre:"/^\/\?[a-zA-Z0-9]{3,10}=[a-zA-Z0-9]{3,20}(?:&[a-zA-Z0-9]{3,10}=[a-zA-Z0-9]{3,20})*?$/"; http.header; content:"Keep|2d|Alive|3a|"; content:"Connection|3a| keep|2d|alive"; content:"Cache|2d|Control|3a|"; pcre:"/^Cache-Control\x3a\x20(?:max-age=0|no-cache)\r?$/m"; content:"Accept|2d|Encoding|3a|"; reference:url,github.com/jseidl/GoldenEye; classtype:denial-of-service; sid:2018208; rev:3; metadata:created_at 2014_03_05, updated_at 2020_04_28;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 4"; flow:to_server,established; content:"GET"; http_method; urilen:9; content:"/main.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016260; rev:4; metadata:created_at 2013_01_24, updated_at 2013_01_24;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DOS LOIC Javascript DDoS Outbound"; flow:established,to_server; threshold: type both, track by_src, count 5, seconds 60; http.method; content:"GET"; http.uri; content:"/?id="; fast_pattern; depth:5; content:"&msg="; distance:13; within:5; pcre:"/^\/\?id=[0-9]{13}&msg=/"; reference:url,isc.sans.org/diary/Javascript+DDoS+Tool+Analysis/12442; reference:url,www.wired.com/threatlevel/2012/01/anons-rickroll-botnet; classtype:attempted-dos; sid:2014141; rev:6; metadata:created_at 2012_01_23, updated_at 2020_05_06;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 5"; flow:to_server,established; content:"GET"; http_method; urilen:10; content:"/login.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016261; rev:3; metadata:created_at 2013_01_24, updated_at 2013_01_24;) +alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET DOS LOIC POST"; flow:established,to_server; threshold:type limit, track by_src, count 1, seconds 300; http.method; content:"POST"; http.request_body; content:"13"; depth:2; content:"=MSG"; fast_pattern; distance:11; within:4; pcre:"/^13\d{11}/"; classtype:web-application-attack; sid:2016030; rev:5; metadata:created_at 2012_12_14, updated_at 2020_05_06;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 6"; flow:to_server,established; content:"GET"; http_method; urilen:9; content:"/main.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016262; rev:4; metadata:created_at 2013_01_24, updated_at 2013_01_24;) +alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET DOS LOIC GET"; flow:established,to_server; threshold:type limit, track by_src, count 1, seconds 300; http.method; content:"GET"; http.uri; content:"/?msg=MSG"; classtype:web-application-attack; sid:2016031; rev:4; metadata:created_at 2012_12_14, updated_at 2020_05_06;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 7"; flow:to_server,established; content:"GET"; http_method; urilen:12; content:"/welcome.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016263; rev:4; metadata:created_at 2013_01_24, updated_at 2013_01_24;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DOS User-Agent used in known DDoS Attacks Detected outbound"; flow:established,to_server; http.user_agent; content:"Mozilla/5.0 (Windows|3b 20|U|3b 20|Windows NT 5.1|3b 20|ru|3b 20|rv|3a|1.8.1.1) Gecko/20061204 Firefox/2.0.0.1"; reference:url,www.linuxquestions.org/questions/linux-security-4/massive-ddos-need-advice-help-795298/; classtype:denial-of-service; sid:2011821; rev:4; metadata:created_at 2010_10_18, updated_at 2020_05_06;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 8"; flow:to_server,established; content:"GET"; http_method; urilen:9; content:"/file.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016264; rev:4; metadata:created_at 2013_01_24, updated_at 2013_01_24;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DOS User-Agent used in known DDoS Attacks Detected inbound"; flow:established,to_server; http.user_agent; content:"Mozilla/5.0 (Windows|3b 20|U|3b 20|Windows NT 5.1|3b 20|ru|3b 20|rv|3a|1.8.1.1) Gecko/20061204 Firefox/2.0.0.1"; reference:url,www.linuxquestions.org/questions/linux-security-4/massive-ddos-need-advice-help-795298/; classtype:denial-of-service; sid:2011822; rev:4; metadata:created_at 2010_10_18, updated_at 2020_05_06;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 10"; flow:to_server,established; content:"GET"; http_method; urilen:9; content:"/home.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016266; rev:3; metadata:created_at 2013_01_24, updated_at 2013_01_24;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DOS User-Agent used in known DDoS Attacks Detected outbound 2"; flow:established,to_server; http.user_agent; content:"Opera/9.02 (Windows NT 5.1|3b 20|U|3b 20|ru)"; reference:url,www.linuxquestions.org/questions/linux-security-4/massive-ddos-need-advice-help-795298/; classtype:denial-of-service; sid:2011823; rev:4; metadata:created_at 2010_10_18, updated_at 2020_05_06;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 11"; flow:to_server,established; content:"GET"; http_method; urilen:11; content:"/online.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016267; rev:3; metadata:created_at 2013_01_24, updated_at 2013_01_24;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DOS User-Agent used in known DDoS Attacks Detected inbound 2"; flow:established,to_server; http.user_agent; content:"Opera/9.02 (Windows NT 5.1|3b 20|U|3b 20|ru)"; reference:url,www.linuxquestions.org/questions/linux-security-4/massive-ddos-need-advice-help-795298/; classtype:denial-of-service; sid:2011824; rev:5; metadata:created_at 2010_10_18, updated_at 2020_05_06;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Kelihos.F Checkin 12"; flow:to_server,established; content:"GET"; http_method; urilen:12; content:"/install.htm"; fast_pattern:only; http_uri; content:"Host|3a| "; depth:6; http_header; content:"|0d 0a|Content-Length|3a| "; distance:7; within:26; http_header; content:"|0d 0a|User-Agent|3a| "; distance:3; within:14; http_header; pcre:"/^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H"; reference:md5,56e0e87e64299f5bb91d2183bbff7cfa; classtype:trojan-activity; sid:2016268; rev:3; metadata:created_at 2013_01_24, updated_at 2013_01_24;) +alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET DOS Possible WordPress Pingback DDoS in Progress (Inbound)"; flow:established,to_server; threshold:type both, track by_src, count 5, seconds 90; http.uri; content:"/xmlrpc.php"; nocase; http.request_body; content:"pingback.ping"; nocase; fast_pattern; classtype:attempted-dos; sid:2018277; rev:4; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2014_03_14, deployment Datacenter, signature_severity Major, tag Wordpress, updated_at 2020_05_14;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT MetaSploit CVE-2012-1723 Class File (seen in live EKs)"; flow:established,from_server; flowbits:isset,ET.http.javaclient; content:"Confuser.class"; classtype:exploit-kit; sid:2016277; rev:5; metadata:affected_product Any, attack_target Client_and_Server, created_at 2013_01_25, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DOS Linux/Tsunami DOS User-Agent (x00_-gawa.sa.pilipinas.2015) INBOUND"; flow:to_server,established; http.user_agent; content:"x00_-gawa.sa.pilipinas.2015"; reference:url,vms.drweb.com/virus/?i=4656268; classtype:attempted-dos; sid:2022760; rev:3; metadata:created_at 2016_04_26, updated_at 2020_07_07;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT MetaSploit CVE-2012-1723 Class File (seen in live EKs)"; flow:established,from_server; flowbits:isset,ET.http.javaclient; content:"ConfusingClassLoader.class"; classtype:exploit-kit; sid:2016276; rev:5; metadata:affected_product Any, attack_target Client_and_Server, created_at 2013_01_25, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 1755 (msg:"ET DOS Microsoft Streaming Server Malformed Request"; flow:established,to_server; content:"MSB "; depth:4; content:"|06 01 07 00 24 00 00 40 00 00 00 00 00 00 01 00 00 00|"; within:18; reference:bugtraq,1282; reference:url,www.microsoft.com/technet/security/bulletin/ms00-038.mspx; reference:url,doc.emergingthreats.net/bin/view/Main/2002843; classtype:attempted-dos; sid:2002843; rev:5; metadata:created_at 2010_07_30, updated_at 2020_08_20;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Aloaha PDF Crypter activex SaveToFile method arbitrary file overwrite"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"B1E7505E-BBFD-42BF-98C9-602205A1504C"; nocase; distance:0; content:".SaveToFile"; nocase; distance:0; reference:url,exploit-db.com/exploits/24319/; classtype:attempted-user; sid:2016286; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_01_25, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert tcp any any -> $HOME_NET 3000 (msg:"ET DOS ntop Basic-Auth DOS inbound"; flow:established,to_server; content:"GET "; nocase; depth:4; content:"/configNtop.html"; within:20; nocase; content:"Authorization|3a|"; nocase; content: "Basic"; within:20; content:"=="; within:100; reference:url,www.securityfocus.com/bid/36074; reference:url,www.securityfocus.com/archive/1/505862; reference:url,www.securityfocus.com/archive/1/505876; classtype:denial-of-service; sid:2011511; rev:2; metadata:created_at 2010_09_27, updated_at 2020_08_20;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE RevProxy - ClickFraud - MIDUIDEND"; flow:established,to_server; dsize:46; content:"MID"; depth:3; content:"UID"; distance:32; within:3; content:"END"; distance:5; within:3; classtype:trojan-activity; sid:2016293; rev:2; metadata:created_at 2013_01_26, updated_at 2013_01_26;) +#alert tcp $HOME_NET any -> any 3000 (msg:"ET DOS ntop Basic-Auth DOS outbound"; flow:established,to_server; content:"GET "; nocase; depth:4; content:"/configNtop.html"; within:20; nocase; content:"Authorization|3a|"; nocase; content: "Basic"; within:20; content:"=="; within:100; reference:url,www.securityfocus.com/bid/36074; reference:url,www.securityfocus.com/archive/1/505862; reference:url,www.securityfocus.com/archive/1/505876; classtype:denial-of-service; sid:2011512; rev:2; metadata:created_at 2010_09_27, updated_at 2020_08_20;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Fun Web Products Adware Agent Traffic"; flow: to_server,established; content:"FunWebProducts|3b|"; nocase; http_header; threshold: type limit, track by_src, count 2, seconds 360; reference:url,www.funwebproducts.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001034; classtype:policy-violation; sid:2001034; rev:23; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert udp $EXTERNAL_NET any -> any 11211 (msg:"ET DOS Possible Memcached DDoS Amplification Query (set)"; content:"|00 00 00 00 00 01 00|"; depth:7; fast_pattern; content:"|0d 0a|"; within:20; endswith; threshold: type both, count 100, seconds 60, track by_dst; flowbits:set,ET.memcached.ddos; reference:url,blog.cloudflare.com/memcrashed-major-amplification-attacks-from-port-11211/; classtype:attempted-dos; sid:2025401; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Linux, attack_target Server, created_at 2018_03_01, deployment Perimeter, former_category DOS, performance_impact Low, signature_severity Major, updated_at 2020_08_19;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT JDB Exploit Kit Landing Page"; flow:established,from_server; file_data; content:"Adobe Flash must be updated to view this"; content:"/lib/adobe.php?id="; distance:0; fast_pattern; pcre:"/^[a-f0-9]{32}/R"; classtype:exploit-kit; sid:2016307; rev:6; metadata:created_at 2013_01_30, former_category EXPLOIT_KIT, updated_at 2013_01_30;) +alert tcp any 445 -> $HOME_NET any (msg:"ET DOS Excessive Large Tree Connect Response"; flow:from_server,established; byte_test: 3,>,1000,1; content: "|fe 53 4d 42 40 00|"; offset: 4; depth: 6; content: "|03 00|"; offset: 16; depth:2; reference:url,isc.sans.edu/forums/diary/Windows+SMBv3+Denial+of+Service+Proof+of+Concept+0+Day+Exploit/22029/; classtype:attempted-dos; sid:2023831; rev:3; metadata:affected_product SMBv3, attack_target Client_and_Server, created_at 2017_02_03, deployment Datacenter, signature_severity Major, updated_at 2022_05_03;) -alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 3"; content:"Portable SDK for UPnP devices"; pcre:"/^Server\x3a[^\r\n]*Portable SDK for UPnP devices(\/?\s*$|\/1\.([0-5]\..|8\.0.|(6\.[0-9]|6\.1[0-7])))/m"; reference:url,community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play; reference:url,upnp.org/specs/arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,2012-5958; reference:cve,2012-5959; classtype:successful-recon-limited; sid:2016304; rev:2; metadata:created_at 2013_01_30, updated_at 2013_01_30;) +alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET DOS Bittorrent User-Agent inbound - possible DDOS"; flow:established,to_server; threshold: type both, count 1, seconds 60, track by_src; http.user_agent; content:"Bittorrent"; depth:10; reference:url,torrentfreak.com/zombie-pirate-bay-tracker-fuels-chinese-ddos-attacks-150124/; classtype:attempted-dos; sid:2020702; rev:4; metadata:created_at 2015_03_18, updated_at 2020_10_14;) -alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 2"; content:"Intel SDK for UPnP devices"; pcre:"/^Server\x3a[^\r\n]*Intel SDK for UPnP devices/mi"; reference:url,community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play; reference:url,upnp.org/specs/arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,2012-5958; reference:cve,2012-5959; classtype:successful-recon-limited; sid:2016303; rev:4; metadata:created_at 2013_01_30, updated_at 2013_01_30;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DOS HOIC with booster outbound"; flow:to_server,established; threshold: type both, count 1, seconds 60, track by_src; http.method; content:"GET"; http.header.raw; content:"If-Modified-Since|3a 20 20|"; content:"Keep-Alive|3a 20 20|"; content:"Connection|3a 20 20|"; content:"User-Agent|3a 20 20|"; http.start; content:"HTTP/1.0|0d 0a|Accept|3a 20|*/*|0d 0a|Accept-Language|3a 20|"; reference:md5,23fc64a5cac4406d7143ea26e8c4c7ab; reference:url,blog.spiderlabs.com/2012/01/hoic-ddos-analysis-and-detection.html; classtype:trojan-activity; sid:2018977; rev:5; metadata:created_at 2014_08_21, updated_at 2020_10_28;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Linux/SSHDoor.A User Login CnC Beacon"; flow:established,to_server; content:"sid="; http_uri; content:"|3A|"; http_uri; content:"&uname="; http_uri; reference:url,blog.eset.com/2013/01/24/linux-sshdoor-a-backdoored-ssh-daemon-that-steals-passwords; classtype:command-and-control; sid:2016315; rev:3; metadata:attack_target Client_Endpoint, created_at 2013_01_30, deployment Perimeter, signature_severity Major, tag c2, updated_at 2013_01_30, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET DOS HOIC with booster inbound"; flow:to_server,established; threshold: type both, count 1, seconds 60, track by_dst; http.method; content:"GET"; http.header.raw; content:"If-Modified-Since|3a 20 20|"; content:"Keep-Alive|3a 20 20|"; content:"Connection|3a 20 20|"; content:"User-Agent|3a 20 20|"; http.start; content:"HTTP/1.0|0d 0a|Accept|3a 20|*/*|0d 0a|Accept-Language|3a 20|"; reference:md5,23fc64a5cac4406d7143ea26e8c4c7ab; reference:url,blog.spiderlabs.com/2012/01/hoic-ddos-analysis-and-detection.html; classtype:trojan-activity; sid:2018978; rev:4; metadata:created_at 2014_08_21, updated_at 2020_10_28;) -alert udp $EXTERNAL_NET any -> $HOME_NET 1900 (msg:"ET DOS LibuPnP CVE-2012-5963 ST UDN Buffer Overflow"; content:"|0D 0A|ST|3A|"; nocase; pcre:"/^[^\r\n]*uuid\x3a[^\r\n\x3a]{181}/Ri"; reference:cve,CVE-2012-5963; classtype:attempted-dos; sid:2016323; rev:1; metadata:created_at 2013_01_31, updated_at 2013_01_31;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DOS High Orbit Ion Cannon (HOIC) Attack Inbound Generic Detection Double Spaced UA"; flow:established,to_server; threshold: type both, track by_src, count 225, seconds 60; http.header.raw; content:"User-Agent|3a 20 20|"; fast_pattern; reference:url,blog.spiderlabs.com/2012/01/hoic-ddos-analysis-and-detection.html; classtype:attempted-dos; sid:2014153; rev:8; metadata:created_at 2012_01_28, updated_at 2022_05_03;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Likely Blackhole Exploit Kit Driveby ?id Download Secondary Request"; flow:established,to_server; content:".php?id"; http_uri; pcre:"/^[^?#]+?\.php\?id[a-z0-9]*=[a-f0-9]{16}$/U"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2014189; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Any, attack_target Client_Endpoint, created_at 2012_02_06, deployment Perimeter, former_category EXPLOIT_KIT, malware_family Blackhole, signature_severity Critical, tag DriveBy, tag Blackhole, tag Exploit_Kit, updated_at 2021_06_23;) +alert http $EXTERNAL_NET any -> any any (msg:"ET DOS CallStranger - Attempted UPnP Reflected Amplified TCP with Multiple Callbacks (CVE-2020-12695)"; flow:established,to_server; http.method; content:"SUBSCRIBE"; http.header; content:"CALLBACK|3a 20|"; fast_pattern; nocase; content:"<http"; distance:0; content:"><http"; distance:0; pcre:"/^Callback\x3a\x20<http[^>]+><http/mi"; reference:url,github.com/yunuscadirci/CallStranger; reference:cve,2020-12695; classtype:attempted-dos; sid:2030339; rev:2; metadata:affected_product UPnP, attack_target IoT, created_at 2020_06_15, deployment Perimeter, former_category DOS, performance_impact Low, signature_severity Major, updated_at 2020_12_11;) -#alert udp $HOME_NET any -> $EXTERNAL_NET 20192 (msg:"ET DELETED Ranky or variant backdoor communication ping"; dsize:<6; reference:url,www.sophos.com/virusinfo/analyses/trojranckcx.html; reference:url,www.iss.net/threats/W32.Trojan.Ranky.FV.html; classtype:trojan-activity; sid:2002728; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert tcp-pkt any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET DOS Possible Microsoft Windows HTTP2 Reset Flood Denial of Service Inbound (CVE-2019-9514)"; flow:established,to_server; dsize:9; content:"|00 00 00 01 04 00 00 00|"; startswith; fast_pattern; threshold:type threshold, count 45, seconds 60, track by_src; reference:cve,2019-9514; classtype:denial-of-service; sid:2034093; rev:1; metadata:attack_target Server, created_at 2021_10_04, cve CVE_2019_9514, deployment Perimeter, deployment Internal, former_category DOS, signature_severity Major, tag Exploit, updated_at 2021_10_04;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Sakura/RedKit obfuscated URL"; flow:established,from_server; file_data; content:"<applet"; pcre:"/^((?!<\/applet>).)+?\/.{1,12}\/.{1,12}\x3a.{1,12}p.{1,12}t.{1,12}t.{1,12}h/Rs"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2015858; rev:3; metadata:created_at 2012_11_01, former_category EXPLOIT_KIT, updated_at 2012_11_01;) +#alert tcp any any -> any any (msg:"ET DOS Possible Apache Traffic Server HTTP2 Settings Flood Denial of Service Inbound (CVE-2019-9515)"; flow:established,to_server; content:"|04|"; offset:3; depth:1; byte_jump:3,0, post_offset 9; content:"|04|"; within:1; byte_jump:3,0, post_offset 9; content:"|04|"; within:1; byte_jump:3,0, post_offset 9; content:"|04|"; within:1; threshold:type threshold, track by_dst, count 20, seconds 10; flowbits:isset,ET.http2; flowbits:set,ET.CVE20199515; flowbits:noalert; reference:cve,2019-9515; classtype:denial-of-service; sid:2034095; rev:2; metadata:attack_target Server, created_at 2021_10_04, cve CVE_2019_9515, deployment Perimeter, deployment Internal, deprecation_reason Performance, former_category DOS, performance_impact Significant, signature_severity Major, tag Exploit, updated_at 2021_10_04;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Styx Exploit Kit Landing Applet With Getmyfile.exe Payload"; flow:established,to_client; file_data; content:"<applet"; distance:0; content:"value="; distance:0; content:"/getmyfile.exe?o="; distance:0; nocase; reference:url,malwaremustdie.blogspot.co.uk/2013/02/the-infection-of-styx-exploit-kit.html; classtype:exploit-kit; sid:2016353; rev:2; metadata:created_at 2013_02_05, former_category EXPLOIT_KIT, updated_at 2013_02_05;) +#alert tcp any any -> any any (msg:"ET DOS Possible Apache Traffic Server HTTP2 Settings Flood Error Response (CVE-2019-9515)"; flow:established,to_client; content:"|00 00 00 04 01|"; depth:5; content:"|00 00 00 04 01|"; distance:4; within:5; content:"|00 00 00 04 01|"; distance:4; within:5; threshold:type threshold, track by_src, count 20, seconds 10; flowbits:isset,ET.CVE20199515; reference:cve,2019-9515; classtype:denial-of-service; sid:2034096; rev:2; metadata:attack_target Server, created_at 2021_10_04, cve CVE_2019_9515, deployment Perimeter, deployment Internal, former_category DOS, performance_impact Moderate, signature_severity Major, tag Exploit, updated_at 2021_10_04;) -#alert tcp $HOME_NET any -> 212.26.42.47 9090 (msg:"ET DELETED Possible ProFTPD Backdoor Initiate Attempt"; flow:to_server; reference:url,xorl.wordpress.com/2010/12/02/news-proftpd-owned-and-backdoored/; reference:url,sourceforge.net/mailarchive/message.php?msg_name=alpine.DEB.2.00.1012011542220.12930%40familiar.castaglia.org; reference:url,slashdot.org/story/10/12/02/131214/ProFTPDorg-Compromised-Backdoor-Distributed; classtype:trojan-activity; sid:2011992; rev:3; metadata:created_at 2010_12_02, updated_at 2010_12_02;) +#alert udp $EXTERNAL_NET any -> $HOME_NET 1900 (msg:"ET DOS LibuPnP ST UDN Buffer Overflow (CVE-2012-5963)"; content:"|0D 0A|ST|3A|"; nocase; pcre:"/^[^\r\n]*uuid\x3a[^\r\n\x3a]{181}/Ri"; reference:cve,CVE-2012-5963; classtype:attempted-dos; sid:2016323; rev:2; metadata:created_at 2013_01_31, former_category DOS, updated_at 2013_01_31;) -#alert http $HOME_NET any -> $EXTERNAL_NET 8511 (msg:"ET MOBILE_MALWARE DroidKungFu Variant"; flow:established,to_server; content:"GET"; http_method; content:"/search/"; http_uri; content:".php?i="; http_uri; distance:0; content:"1.0|0d 0a|User-Agent|3a| unknown|0d 0a 0d 0a|"; classtype:trojan-activity; sid:2016345; rev:5; metadata:created_at 2013_02_05, former_category MOBILE_MALWARE, updated_at 2013_02_05;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DOS Miniupnpd SoapAction MethodName Buffer Overflow (CVE-2013-0230)"; flow:to_server,established; content:"POST "; depth:5; content:"|0d 0a|SOAPAction|3a|"; nocase; distance:0; pcre:"/^[^\r\n]+#[^\x22\r\n]{2049}/R"; reference:url,community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play; reference:url,upnp.org/specs/arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,CVE-2013-0230; classtype:attempted-dos; sid:2016364; rev:2; metadata:created_at 2013_02_07, former_category DOS, updated_at 2013_02_07;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT CritXPack - Landing Page - Received"; flow:established,to_client; file_data; content:"js.pd.js"; content:"|7C|applet|7C|"; classtype:exploit-kit; sid:2016356; rev:2; metadata:created_at 2013_02_07, former_category EXPLOIT_KIT, updated_at 2013_02_07;) +#alert udp any any -> $HOME_NET 1900 (msg:"ET DOS Miniupnpd M-SEARCH Buffer Overflow (CVE-2013-0229)"; content:"M-SEARCH"; depth:8; isdataat:1492,relative; content:!"|0d 0a|"; distance:1490; within:2; reference:url,community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play; reference:url,upnp.org/specs/arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,CVE-2013-0229; classtype:attempted-dos; sid:2016363; rev:3; metadata:created_at 2013_02_07, former_category DOS, updated_at 2013_02_07;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT CritXPack - URI - jpfoff.php"; flow:established,to_server; content:"/jpfoff.php?token="; http_uri; classtype:exploit-kit; sid:2016357; rev:2; metadata:created_at 2013_02_07, former_category EXPLOIT_KIT, updated_at 2013_02_07;) +#alert udp $EXTERNAL_NET any -> $HOME_NET 1900 (msg:"ET DOS LibuPnP CVE-2012-5958 ST DeviceType Buffer Overflow"; content:"|0D 0A|ST|3a|"; nocase; pcre:"/^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{181}/Ri"; content:"schemas|3a|device"; nocase; fast_pattern; reference:cve,CVE_2012-5958; reference:cve,CVE-2012-5962; classtype:attempted-dos; sid:2016322; rev:3; metadata:created_at 2013_01_31, former_category DOS, updated_at 2019_10_08;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO JAVA - ClassID"; flow:established,to_client; file_data; content:"8AD9C840-044E-11D1-B3E9-00805F499D93"; classtype:misc-activity; sid:2016360; rev:2; metadata:created_at 2013_02_07, updated_at 2013_02_07;) +#alert udp $EXTERNAL_NET any -> $HOME_NET 1900 (msg:"ET DOS LibuPnP CVE-2012-5964 ST URN ServiceType Buffer Overflow"; content:"|0D 0A|ST|3a|"; nocase; pcre:"/^[^\r\n]*urn\x3aservice\x3a[^\r\n\x3a]{181}/Ri"; content:"urn|3a|service"; nocase; fast_pattern; reference:cve,CVE-2012-5964; classtype:attempted-dos; sid:2016324; rev:3; metadata:created_at 2013_01_31, former_category DOS, updated_at 2019_10_08;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO JAVA - ClassID"; flow:established,to_client; file_data; content:"CAFEEFAC-00"; content:"-FFFF-ABCDEFFEDCBA"; distance:7; within:18; classtype:misc-activity; sid:2016361; rev:2; metadata:created_at 2013_02_07, updated_at 2013_02_07;) +#alert udp $EXTERNAL_NET any -> $HOME_NET 1900 (msg:"ET DOS LibuPnP CVE-2012-5965 ST URN DeviceType Buffer Overflow"; content:"|0D 0A|ST|3a|"; nocase; pcre:"/^[^\r\n]*urn\x3adevice\x3a[^\r\n\x3a]{181}/Ri"; content:"urn|3a|device"; nocase; fast_pattern; reference:cve,CVE-2012-5965; classtype:attempted-dos; sid:2016325; rev:3; metadata:created_at 2013_01_31, former_category DOS, updated_at 2019_10_08;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DOS CVE-2013-0230 Miniupnpd SoapAction MethodName Buffer Overflow"; flow:to_server,established; content:"POST "; depth:5; content:"|0d 0a|SOAPAction|3a|"; nocase; distance:0; pcre:"/^[^\r\n]+#[^\x22\r\n]{2049}/R"; reference:url,community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play; reference:url,upnp.org/specs/arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,CVE-2013-0230; classtype:attempted-dos; sid:2016364; rev:1; metadata:created_at 2013_02_07, updated_at 2013_02_07;) +#alert udp $EXTERNAL_NET any -> $HOME_NET 1900 (msg:"ET DOS LibuPnP CVE-2012-5961 ST UDN Buffer Overflow"; content:"|0D 0A|ST|3a|"; nocase; pcre:"/^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{1,180}\x3a[^\r\n\x3a]{181}/Ri"; content:"schemas|3a|device"; nocase; fast_pattern; reference:cve,CVE-2012-5961; classtype:attempted-dos; sid:2016326; rev:3; metadata:created_at 2013_01_31, former_category DOS, updated_at 2019_10_08;) -alert udp any any -> $HOME_NET 1900 (msg:"ET DOS Miniupnpd M-SEARCH Buffer Overflow CVE-2013-0229"; content:"M-SEARCH"; depth:8; isdataat:1492,relative; content:!"|0d 0a|"; distance:1490; within:2; reference:url,community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play; reference:url,upnp.org/specs/arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,CVE-2013-0229; classtype:attempted-dos; sid:2016363; rev:2; metadata:created_at 2013_02_07, updated_at 2013_02_07;) +# Emerging Threats +# +# This distribution may contain rules under two different licenses. +# +# Rules with sids 1 through 3464, and 100000000 through 100000908 are under the GPLv2. +# A copy of that license is available at http://www.gnu.org/licenses/gpl-2.0.html +# +# Rules with sids 2000000 through 2799999 are from Emerging Threats and are covered under the BSD License +# as follows: +# +#************************************************************* +# Copyright (c) 2003-2022, Emerging Threats +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the +# following conditions are met: +# +# * Redistributions of source code must retain the above copyright notice, this list of conditions and the following +# disclaimer. +# * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the +# following disclaimer in the documentation and/or other materials provided with the distribution. +# * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES, +# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE +# USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +# +#************************************************************* +# +# +# +# -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown_MM EK - Landing Page"; flow:established,to_client; file_data; content:"<applet "; content:"new PDFObject"; classtype:exploit-kit; sid:2016373; rev:2; metadata:created_at 2013_02_08, updated_at 2013_02_08;) +# This Ruleset is EmergingThreats Open optimized for suricata-5.0-enhanced. -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown_MM - Payload Download"; flow:established,to_client; file_data; content:"PK"; within:2; content:"stealth.exe"; within:60; classtype:exploit-kit; sid:2016377; rev:2; metadata:created_at 2013_02_08, updated_at 2013_02_08;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Java/PDF Exploit kit from /Home/games/ initial landing"; flow:established,to_server; content:"/Home/games/2fdp.php?f="; http_uri; classtype:exploit-kit; sid:2013025; rev:2; metadata:created_at 2011_06_13, former_category EXPLOIT_KIT, updated_at 2011_06_13;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible Ecava IntegraXor save method Remote ActiveX Buffer Overflow"; flow:to_client,established; file_data; content:"CLSID"; nocase; content:"520F4CFD-61C6-4EED-8004-C26D514D3D19"; nocase; distance:0; content:".save"; nocase; distance:0; reference:url,1337day.org/exploit/15398; classtype:attempted-user; sid:2016382; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_02_08, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Exploit kit mario.jar"; flow:established,to_server; content:"pack200"; http_header; content:" Java/"; http_header; content:"/mario.jar"; http_uri; classtype:exploit-kit; sid:2013024; rev:3; metadata:created_at 2011_06_13, former_category EXPLOIT_KIT, updated_at 2011_06_13;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Adobe Flash Zero Day LadyBoyle Infection Campaign"; flow:established,to_client; file_data; content:"FWS"; distance:0; content:"LadyBoyle"; distance:0; reference:md5,3de314089db35af9baaeefc598f09b23; reference:md5,2568615875525003688839cb8950aeae; reference:url,blog.fireeye.com/research/2013/02/lady-boyle-comes-to-town-with-a-new-exploit.html; reference:url,www.adobe.com/go/apsb13-04; reference:cve,2013-0633; reference:cve,2013-0633; classtype:trojan-activity; sid:2016391; rev:2; metadata:created_at 2013_02_08, former_category CURRENT_EVENTS, updated_at 2019_09_09;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Java/PDF Exploit kit initial landing"; flow:established,to_server; content:"/2fdp.php?f="; http_uri; classtype:exploit-kit; sid:2013027; rev:3; metadata:created_at 2011_06_13, former_category EXPLOIT_KIT, updated_at 2011_06_13;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Impact Exploit Kit Landing Page"; flow:established,from_server; file_data; content:"applet"; fast_pattern; content:"value"; distance:0; pcre:"/^(\s*=\s*|[\x22\x27]\s*,\s*)[\x22\x27]/R"; content:"h"; distance:8; within:1; content:"t"; distance:8; within:1; content:"t"; distance:8; within:1; content:"p"; distance:8; within:1; content:"|3a|"; distance:8; within:1; content:"/"; distance:8; within:1; classtype:exploit-kit; sid:2016393; rev:3; metadata:created_at 2013_02_09, former_category EXPLOIT_KIT, updated_at 2013_02_09;) +#alert http $HTTP_SERVERS any -> any any (msg:"ET EXPLOIT_KIT Phoenix Exploit Kit - Admin Login Page Detected Outbound"; flow:established,to_client; content:"<title>Phoenix Exploit's Kit - Log In"; classtype:exploit-kit; sid:2011280; rev:3; metadata:created_at 2010_09_28, former_category EXPLOIT_KIT, updated_at 2010_09_28;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Microsoft OLE Compound File With Flash"; flow:to_client,established; content:"CONTROL ShockwaveFlash.ShockwaveFlash"; flowbits:isset,OLE.CompoundFile; flowbits:set,OLE.WithFlash; classtype:protocol-command-decode; sid:2016395; rev:7; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2013_02_09, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Driveby Exploit Kit Browser Progress Checkin - Binary Likely Previously Downloaded"; flow:established,to_server; content:"/?"; http_uri; content:!" Java/"; http_header; pcre:"/\/\?[a-f0-9]{64}\;\d\;\d/U"; classtype:exploit-kit; sid:2013098; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_06_22, deployment Perimeter, former_category EXPLOIT_KIT, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Exploit Specific Uncompressed Flash CVE-2013-0634"; flow:established,to_client; flowbits:isset,HTTP.UncompressedFlash; file_data; content:"RegExp"; distance:0; content:"#(?i)()()(?-i)|7c 7c|"; distance:0; classtype:trojan-activity; sid:2016396; rev:5; metadata:created_at 2013_02_09, former_category CURRENT_EVENTS, updated_at 2013_02_09;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Obfuscated Javascript Often Used in Drivebys"; flow:established,from_server; content:"Content-Type|3a 20|text/html"; content:"|0d 0a|
\d{16}/R"; classtype:exploit-kit; sid:2013237; rev:5; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_07_09, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Exploit Specific Uncompressed Flash Inside of OLE CVE-2013-0634"; flow:established,to_client; flowbits:isset,OLE.WithFlash; file_data; content:"RegExp"; distance:0; content:"#(?i)()()(?-i)|7c 7c|"; distance:0; classtype:trojan-activity; sid:2016397; rev:4; metadata:created_at 2013_02_09, former_category CURRENT_EVENTS, updated_at 2013_02_09;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Exploit kit worms.jar"; flow:established,to_server; content:"pack200"; http_header; content:" Java/"; http_header; content:"/worms.jar"; http_uri; classtype:exploit-kit; sid:2013661; rev:2; metadata:created_at 2011_09_15, former_category EXPLOIT_KIT, updated_at 2011_09_15;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Android/DNightmare - Task Killer Checkin 2"; flow:established,to_server; content:"GET"; http_method; content:"/pagead/afma_load_ads.js"; nocase; http_uri; fast_pattern; content:"pagead2.googlesyndication.com"; http_header; reference:md5,745513a53af2befe3dc00d0341d80ca6; classtype:trojan-activity; sid:2016386; rev:4; metadata:created_at 2013_02_08, updated_at 2013_02_08;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Driveby Generic Java Exploit Attempt"; flow:established,to_client; content:" codebase=|22|C|3a 5c|Program Files|5c|java|5c|jre6|5c|lib|5c|ext|22| code="; nocase; reference:url,fhoguin.com/2011/03/oracle-java-unsigned-applet-applet2classloader-remote-code-execution-vulnerability-zdi-11-084-explained/; reference:cve,CVE-2010-4452; classtype:exploit-kit; sid:2013551; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_09_10, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Android/DNightmare -Task Killer Checkin 3"; flow:established,to_server; content:"GET"; http_method; content:"/m/gne/suggest?q="; nocase; http_uri; fast_pattern; content:"SID=DQAAAKQAAAAHga"; http_cookie; reference:md5,745513a53af2befe3dc00d0341d80ca6; classtype:trojan-activity; sid:2016387; rev:4; metadata:created_at 2013_02_08, updated_at 2013_02_08;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Driveby Generic Java Exploit Attempt 2"; flow:established,to_client; content:" codebase=|22|C|3a 5c|Program Files (x86)|5c|java|5c|jre6|5c|lib|5c|ext|22| code="; nocase; reference:url,fhoguin.com/2011/03/oracle-java-unsigned-applet-applet2classloader-remote-code-execution-vulnerability-zdi-11-084-explained/; reference:cve,CVE-2010-4452; classtype:exploit-kit; sid:2013552; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_09_10, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Office File With Embedded Executable"; flow:established,to_client; file_data; content:"|D0 CF 11 E0 A1 B1 1A E1|"; within:8; content:"MZ"; distance:0; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; classtype:trojan-activity; sid:2012684; rev:8; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_04_11, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Unknown Java Exploit Kit x.jar?o="; flow:established,to_server; content:"/x.jar?o="; http_uri; content:"|20|Java/"; http_header; classtype:exploit-kit; sid:2013696; rev:3; metadata:created_at 2011_09_27, former_category EXPLOIT_KIT, updated_at 2011_09_27;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible g01pack Jar download"; flow:established,from_server; flowbits:isset,ET.g01pack.Java.Image; file_data; content:"PK"; depth:2; content:".class"; fast_pattern:only; classtype:exploit-kit; sid:2016321; rev:3; metadata:created_at 2013_01_31, updated_at 2013_01_31;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Unknown Java Exploit Kit lo.class"; flow:established,to_server; content:"/lo.class"; http_uri; content:"|20|Java/"; http_header; classtype:exploit-kit; sid:2013697; rev:3; metadata:created_at 2011_09_27, former_category EXPLOIT_KIT, updated_at 2011_09_27;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Android/DNightmare - Task Killer Checkin 1"; flow:established,to_server; content:"GET"; http_method; content:"/pagead/ads?rsp="; nocase; http_uri; fast_pattern; content:"msid=com.droiddream.advancedtaskkiller1"; nocase; http_uri; classtype:trojan-activity; sid:2016385; rev:3; metadata:created_at 2013_02_08, updated_at 2013_02_08;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Unknown Java Exploit Kit lo2.jar"; flow:established,to_server; content:"/lo2.jar"; http_uri; content:"|20|Java/"; http_header; classtype:exploit-kit; sid:2013698; rev:3; metadata:created_at 2011_09_27, former_category EXPLOIT_KIT, updated_at 2011_09_27;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Flash Action Script Invalid Regex CVE-2013-0634"; flow:established,to_client; file_data; flowbits:isset,HTTP.UncompressedFlash; content:"RegExp"; distance:0; content:"#"; distance:0; pcre:"/^[\x20-\x7f]*\(\?[sxXmUJ]*i[sxXmUJ]*(\-[sxXmUJ]*)?\)[\x20-\x7f]*\(\?[sxXmUJ]*\-[sxXmUJ]*i[sxXmUJ]*\)[\x20-\x7f]*\|\|/R"; reference:cve,2013-0634; classtype:trojan-activity; sid:2016400; rev:3; metadata:created_at 2013_02_12, former_category CURRENT_EVENTS, updated_at 2013_02_12;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Probable Scalaxy exploit kit Java or PDF exploit request"; flow:established,to_server; content:"/"; http_uri; offset:2; depth:3; urilen:35; pcre:"/\/[a-z]\/[0-9a-f]{32}$/U"; classtype:exploit-kit; sid:2014025; rev:1; metadata:created_at 2011_12_13, former_category EXPLOIT_KIT, updated_at 2011_12_13;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Flash Action Script Invalid Regex CVE-2013-0634"; flow:established,to_client; file_data; flowbits:isset,OLE.WithFlash; content:"RegExp"; distance:0; content:"#"; distance:0; pcre:"/^[\x20-\x7f]*\(\?[sxXmUJ]*i[sxXmUJ]*(\-[sxXmUJ]*)?\)[\x20-\x7f]*\(\?[sxXmUJ]*\-[sxXmUJ]*i[sxXmUJ]*\)[\x20-\x7f]*\|\|/R"; reference:cve,2013-0364; classtype:trojan-activity; sid:2016401; rev:3; metadata:created_at 2013_02_12, former_category CURRENT_EVENTS, updated_at 2013_02_12;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT DRIVEBY Generic Java Rhino Scripting Engine Exploit Previously Requested com.class"; flow:established,to_server; content:" Java/1"; http_header; content:"/com.class"; http_uri; classtype:exploit-kit; sid:2014031; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_12_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT CoolEK Payload - obfuscated binary base 0"; flow:established,to_client; file_data; content:"|af 9e b6 98 09 fc ee d0|"; within:8; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2016403; rev:2; metadata:created_at 2013_02_12, former_category EXPLOIT_KIT, updated_at 2013_02_12;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT DRIVEBY Generic Java Rhino Scripting Engine Exploit Previously Requested org.class"; flow:established,to_server; content:" Java/1"; http_header; content:"/org.class"; http_uri; classtype:exploit-kit; sid:2014032; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_12_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO MPEG Download Over HTTP (1)"; flow:established,to_client; file_data; content:"|00 00 01 ba|"; depth:4; flowbits:set,ET.mpeg.HTTP; flowbits:noalert; classtype:not-suspicious; sid:2016404; rev:3; metadata:created_at 2013_02_12, updated_at 2013_02_12;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT DRIVEBY Generic Java Rhino Scripting Engine Exploit Previously Requested edu.class"; flow:established,to_server; content:" Java/1"; http_header; content:"/edu.class"; http_uri; classtype:exploit-kit; sid:2014033; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_12_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Cool Java Exploit Recent Jar (1)"; flow:established,from_server; file_data; content:"PK"; within:2; content:"SunJCE.class"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2016407; rev:3; metadata:created_at 2013_02_13, updated_at 2013_02_13;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT DRIVEBY Generic Java Rhino Scripting Engine Exploit Previously Requested net.class"; flow:established,to_server; content:" Java/1"; http_header; content:"/net.class"; http_uri; classtype:exploit-kit; sid:2014034; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_12_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"ET DNS Reply Sinkhole - sinkhole.cert.pl 148.81.111.111"; content:"|00 01 00 01|"; content:"|00 04 94 51 6f 6f|"; distance:4; within:6; classtype:trojan-activity; sid:2016413; rev:4; metadata:created_at 2013_02_15, updated_at 2013_02_15;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Saturn Exploit Kit binary download request"; flow:established,to_server; content:"/dl/"; depth:4; http_uri; fast_pattern; content:".php?"; http_uri; pcre:"/\/dl\/\w{1,4}\.php\?[0-9]$/U"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2013775; rev:2; metadata:created_at 2011_10_14, former_category EXPLOIT_KIT, updated_at 2011_10_14;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Skype VOIP Reporting Install"; flow: to_server,established; content:"/ui/"; nocase; http_uri; content:"/installed"; http_uri; nocase; reference:url,www1.cs.columbia.edu/~library/TR-repository/reports/reports-2004/cucs-039-04.pdf; reference:url,doc.emergingthreats.net/2001596; classtype:policy-violation; sid:2001596; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Saturn Exploit Kit probable Java MIDI exploit request"; flow:established,to_server; content:"/dl/jsm.php"; depth:14; http_uri; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2013777; rev:2; metadata:created_at 2011_10_14, former_category EXPLOIT_KIT, updated_at 2011_10_14;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Featured-Results.com Agent Reporting Data"; flow: to_server,established; content:"action=any"; nocase; http_uri; content:"country="; nocase; http_uri; pcre:"/(POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/.*perl\/fr\.pl/i"; reference:url,www.featured-results.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001293; classtype:trojan-activity; sid:2001293; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT DRIVEBY SEO Exploit Kit request for PDF exploit"; flow:established,to_server; content:"POST"; http_method; content:"id="; content:"|25 32 36|np"; distance:32; within:5; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2011348; rev:4; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_09_28, deployment Perimeter, former_category EXPLOIT_KIT, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"ET DNS Reply Sinkhole - Georgia Tech (2)"; content:"|00 01 00 01|"; content:"|00 04 32 3e 0c 67|"; distance:4; within:6; reference:url,virustracker.info; classtype:trojan-activity; sid:2016423; rev:6; metadata:created_at 2013_02_16, updated_at 2013_02_16;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT SEO Exploit Kit - client exploited"; flow:established,to_server; content:"/exe.php?exp="; http_uri; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2011813; rev:6; metadata:created_at 2010_10_13, former_category EXPLOIT_KIT, updated_at 2010_10_13;) -alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"ET DNS Reply Sinkhole - Georgia Tech (1)"; content:"|00 01 00 01|"; content:"|00 04 c6 3d e3 06|"; distance:4; within:6; reference:url,virustracker.info; classtype:trojan-activity; sid:2016422; rev:5; metadata:created_at 2013_02_16, updated_at 2013_02_16;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Unknown Exploit Kit reporting Java and PDF state"; flow:established,to_server; content:"_js?java="; http_uri; fast_pattern; content:"&adobe_pdf="; http_uri; distance:0; pcre:"/\/[a-f0-9]{60,}_js\?/U"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2013690; rev:3; metadata:created_at 2011_09_24, former_category EXPLOIT_KIT, updated_at 2011_09_24;) -alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"ET DNS Reply Sinkhole - 1and1 Internet AG"; content:"|00 01 00 01|"; content:"|00 04 52 a5 19 d2|"; distance:4; within:6; reference:url,virustracker.info; classtype:trojan-activity; sid:2016421; rev:5; metadata:created_at 2013_02_16, updated_at 2013_02_16;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Unknown Exploit Kit Java requesting malicious JAR"; flow:established,to_server; content:"_jar"; http_uri; fast_pattern; content:"|20|Java/"; http_header; pcre:"/\/[a-f0-9]{60,}_jar$/U"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2013691; rev:3; metadata:created_at 2011_09_24, former_category EXPLOIT_KIT, updated_at 2011_09_24;) -alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"ET DNS Reply Sinkhole - German Company"; content:"|00 01 00 01|"; content:"|00 04 52 a5 19 a7|"; distance:4; within:6; reference:url,virustracker.info; classtype:trojan-activity; sid:2016420; rev:5; metadata:created_at 2013_02_16, updated_at 2013_02_16;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Unknown Exploit Kit Java requesting malicious EXE"; flow:established,to_server; content:"_exe"; http_uri; fast_pattern; content:"|20|Java/"; http_header; pcre:"/\/[a-f0-9]{60,}_exe$/U"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2013692; rev:3; metadata:created_at 2011_09_24, former_category EXPLOIT_KIT, updated_at 2011_09_24;) -alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"ET DNS Reply Sinkhole - Zinkhole.org"; content:"|00 01 00 01|"; content:"|00 04 b0 1f 3e 4c|"; distance:4; within:6; classtype:trojan-activity; sid:2016419; rev:5; metadata:created_at 2013_02_16, updated_at 2013_02_16;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Unknown Exploit Kit request for pdf_err__Error__Unspecified"; flow:established,to_server; content:"/pdf_err__Error__Unspecified error..gif"; http_uri; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2013693; rev:7; metadata:created_at 2011_09_24, former_category EXPLOIT_KIT, updated_at 2011_09_24;) -alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"ET DNS Reply Sinkhole - Dr. Web"; content:"|00 01 00 01|"; content:"|00 04 5b e9 f4 6a|"; distance:4; within:6; reference:url,virustracker.info; classtype:trojan-activity; sid:2016418; rev:5; metadata:created_at 2013_02_16, updated_at 2013_02_16;) +alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET EXPLOIT_KIT Document.write Long Backslash UTF-16 Encoded Content - Exploit Kit Behavior Flowbit Set"; flow:established,to_client; content:"document.write|28 22 5C|u"; nocase; isdataat:100,relative; content:!"|29|"; within:100; content:"|5C|u"; nocase; distance:4; within:2; content:"|5C|u"; nocase; distance:4; within:2; content:"|5C|u"; nocase; distance:4; within:2; content:"|5C|u"; nocase; distance:70; content:"|5C|u"; nocase; distance:4; within:2; flowbits:set,et.exploitkitlanding; flowbits:noalert; reference:url,www.kahusecurity.com/2011/elaborate-black-hole-infection/; classtype:exploit-kit; sid:2014096; rev:6; metadata:created_at 2012_01_04, former_category EXPLOIT_KIT, updated_at 2012_01_04;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT CoolEK landing applet plus class Feb 18 2013"; flow:established,to_client; file_data; content:" $HOME_NET any (msg:"ET EXPLOIT_KIT Excessive new Array With Newline - Exploit Kit Behavior Flowbit Set"; flow:established,to_client; content:" = new Array|28 29 3B|"; nocase; content:" = new Array|28 29 3B|"; nocase; within:100; content:" = new Array|28 29 3B|"; nocase; content:" = new Array|28 29 3B|"; nocase; within:100; content:" = new Array|28 29 3B|"; nocase; content:" = new Array|28 29 3B|"; nocase; within:100; flowbits:set,et.exploitkitlanding; flowbits:noalert; reference:url,www.kahusecurity.com/2011/elaborate-black-hole-infection/; classtype:exploit-kit; sid:2014097; rev:3; metadata:created_at 2012_01_04, former_category EXPLOIT_KIT, updated_at 2012_01_04;) -#alert http $HOME_NET any -> $EXTERNAL_NET 80 (msg:"ET DELETED NPRC Malicious POST Request Possible DOJ or DOT Malware"; flow:to_server; content:"POST"; nocase; http_method; content:"POST|2C|"; fast_pattern; nocase; depth:100; content:"ACCEPT|3A|"; nocase; within:300; reference:url,www.websense.com/securitylabs/alerts/alert.php?AlertID=835; reference:url,doc.emergingthreats.net/2007748; classtype:trojan-activity; sid:2007748; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT DRIVEBY SEO Exploit Kit request for Java exploit"; flow:established,to_server; content:"POST"; http_method; content:"id="; http_client_body; content:"|25 32 36|j"; distance:32; within:4; http_client_body; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2011349; rev:6; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_09_28, deployment Perimeter, former_category EXPLOIT_KIT, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Backdoor.Win32.Likseput.B Checkin 2"; flow:from_server,established; file_data; content:"|3c 21 2d 2d 0d 0a 3c|img border="; nocase; content:"|2f 23|KX8|2E|"; distance:5; within:64; fast_pattern; pcre:"/^\x3c\x21\x2d\x2d\x0d\x0a\x3cimg\x20border=\d+\x20src=\x22\S+\x2f\x23KX8\x2e/mi"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3aWin32%2fLikseput.B; classtype:command-and-control; sid:2016428; rev:7; metadata:created_at 2011_03_08, former_category MALWARE, updated_at 2011_03_08;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown Exploit Kit Landing Response Malicious JavaScript"; flow:established,from_server; content:""; content:".swf"; nocase; content:".swf"; nocase; content:"vbscript"; nocase; content:"System.Net.WebClient"; nocase; content:".exe"; nocase; classtype:exploit-kit; sid:2020950; rev:3; metadata:created_at 2015_04_21, updated_at 2015_04_21;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE W32/StealRat.SpamBot CnC Server Configuration File Response"; flowbits:isset,et.stealrat.config; flow:established,to_client; file_data; content:""; within:50; content:"<|2F|dudp>"; within:100; content:""; within:50; content:"<|2F|pudp>"; within:100; content:""; within:50; content:""; within:50; content:"<|2F|dom>"; within:100; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-stealrat.pdf; classtype:command-and-control; sid:2017275; rev:2; metadata:created_at 2013_08_05, former_category MALWARE, updated_at 2013_08_05;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Nuclear EK Landing Apr 22 2015"; flow:established,from_server; content:"nginx"; http_header; file_data; content:"|0d 0a|"; within:500; content:!"|0d|"; within:500; pcre:"/^\s*[^>]*?[a-zA-Z]+\s*?=\s*?[\x22\x27](?=[a-z]{0,20}[A-Z])(?=[A-Z]{0,20}[a-z])[A-Za-z]{15,21}[\x22\x27][^>]*?>(?=[A-Za-z_]{0,200}[0-9])(?=[0-9a-z_]{0,200}[A-Z])(?=[0-9A-Z_]{0,200}[a-z])[A-Za-z0-9_]{200}/R"; classtype:exploit-kit; sid:2020975; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_04_23, deployment Perimeter, malware_family Nuclear, signature_severity Critical, tag Exploit_Kit, tag Nuclear, updated_at 2016_07_01;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Styx iframe with obfuscated Java version check Jul 04 2013"; flow:established,from_server; file_data; content:"|0d 0a|"; within:8; content:"|0d 0a|[0-9a-z]{2})(?P(?!(?P=v))[0-9a-z]{2})[0-9a-z]{2}(?P[0-9a-z]{2})[0-9a-z]{12,16}(?P=space)[0-9a-z]{2}(?P=space)(?P[0-9a-z]{2})(?P[0-9a-z]{2})(?P[0-9a-z]{2})[0-9a-z]{4}(?P=w)[0-9a-z]{10}(?P=i)(?P=n)[0-9a-z]{28}(?P=i)[0-9a-z]{2}(?P=n)[0-9a-z]{6}(?P=a)(?P=v)(?P=a)/R"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2017114; rev:5; metadata:created_at 2013_07_05, updated_at 2013_07_05;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT CottonCastle/Niteris EK Landing URI Struct April 29 2015 M2"; flow:established,to_server; content:"GET"; http_method; content:"/5/"; http_uri; fast_pattern; content:"http|3a|/"; distance:0; http_uri; pcre:"/\/5\/[a-f0-9]{32}\/\x20*http\x3a\x2f/U"; classtype:exploit-kit; sid:2021034; rev:2; metadata:created_at 2015_04_30, updated_at 2015_04_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Microsoft Script Encoder Encoded File"; flow:established,from_server; file_data; content:"#@~^"; within:4; classtype:trojan-activity; sid:2017282; rev:3; metadata:created_at 2013_08_07, updated_at 2013_08_07;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown EK Landing Page May 01 2015"; flow:from_server,established; file_data; content:"CM|3a 20|u.indexOf(|27|NT 5.1|27|) > -1"; content:"PS|3a 20|u.indexOf(|27|NT 6.|27|) > -1"; classtype:exploit-kit; sid:2021046; rev:2; metadata:created_at 2015_05_02, updated_at 2015_05_02;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED BlackHole TKR Landing Page /last/index.php"; flow:established,to_server; content:"/last/index.php"; http_uri; fast_pattern:only; classtype:trojan-activity; sid:2015475; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_14, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown EK Secondary Landing Page May 01 2015 M1"; flow:from_server,established; file_data; content:"FlashVars"; content:"sh=Y21kIC9jIGVjaG8g"; classtype:exploit-kit; sid:2021047; rev:2; metadata:created_at 2015_05_02, updated_at 2015_05_02;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible CritX/SafePack/FlashPack Jar Download"; flow:established,from_server; content:"filename=j"; http_header; content:".jar"; distance:23; within:4; http_header; pcre:"/filename=j[a-f0-9]{23}\.jar/H"; classtype:exploit-kit; sid:2017296; rev:5; metadata:created_at 2013_08_08, former_category CURRENT_EVENTS, updated_at 2013_08_08;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown EK Secondary Landing Page May 01 2015 M2"; flow:from_server,established; file_data; content:"FlashVars"; content:"sh=cG93ZXJzaGVsbC5leGUg"; classtype:exploit-kit; sid:2021048; rev:2; metadata:created_at 2015_05_02, updated_at 2015_05_02;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Rawin -TDS - POST w/Java Version"; flow:established,to_server; content:"POST"; http_method; content:"&v="; http_client_body; depth:3; pcre:"/^&v=(null|(\d+\.)+?\d+)\x3b\d+\x3b\x3b\d{3,5}x\d{3,5}\x3b/P"; classtype:trojan-activity; sid:2017300; rev:2; metadata:created_at 2013_08_08, updated_at 2013_08_08;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Magnitude EK Flash Payload ShellCode Apr 23 2015"; flow:established,from_server; file_data; content:"urlmon.dll|00|http|3a 2f|"; pcre:"/^\x2f+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x2f\??[a-f0-9]+\x7chttp\x3a\x2f/Rs"; classtype:exploit-kit; sid:2021054; rev:2; metadata:created_at 2015_05_04, former_category EXPLOIT_KIT, updated_at 2015_05_04;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Fake Trojan Dropper purporting to be missing application - findloader"; flow:established,to_server; content:"/findloader"; http_uri; pcre:"/findloader[^\x2f\.\?]*?\.php\?[a-z]=[^&]+$/U"; classtype:trojan-activity; sid:2017302; rev:2; metadata:created_at 2013_08_08, updated_at 2013_08_08;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DNSChanger EK Secondary Landing May 12 2015 M2"; flow:established,from_server; file_data; content:"&|22|+DetectRTC.isWebSocketsSupported+|22|&|22|+"; nocase; content:"CryptoJSAesJson"; nocase; classtype:exploit-kit; sid:2021110; rev:2; metadata:created_at 2015_05_16, updated_at 2015_05_16;) -#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS 0f2490 Hacked Site Response (Inbound)"; flow:established,from_server; file_data; content:""; content:"#/0f2490#"; fast_pattern; distance:0; classtype:trojan-activity; sid:2017306; rev:5; metadata:created_at 2013_08_12, updated_at 2013_08_12;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Likely Evil JS used in Unknown EK Landing"; flow:established,from_server; file_data; content:"|74 3d 75 74 66 38 74 6f 31 36 28 78 78 74 65 61 5f 64 65 63 72 79 70 74 28 62 61 73 65 36 34 64 65 63 6f 64 65 28 74 29 2c|"; nocase; classtype:exploit-kit; sid:2021217; rev:2; metadata:created_at 2015_06_09, updated_at 2015_06_09;) -#alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS 0f2490 Hacked Site Response (Outbound)"; flow:established,from_server; file_data; content:""; content:"#/0f2490#"; fast_pattern; distance:0; classtype:trojan-activity; sid:2017307; rev:5; metadata:created_at 2013_08_12, updated_at 2013_08_12;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT KaiXin Landing M4"; flow:established,from_server; file_data; content:"|76 68 7a 32 7a 3d 27 27 3b 74 72 79 7b 77 69 6e 64 6f 77|"; classtype:exploit-kit; sid:2021291; rev:4; metadata:created_at 2015_06_18, updated_at 2015_06_18;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible FortDisco Wordpress Brute-force Site list download 10+ wp-login.php"; flow:established,to_client; file_data; content:"/wp-login.php|0d 0a|"; nocase; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; reference:url,www.arbornetworks.com/asert/2013/08/fort-disco-bruteforce-campaign/; reference:md5,722a1809bd4fd75743083f3577e1e6a4; classtype:trojan-activity; sid:2017310; rev:3; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2013_08_12, deployment Datacenter, former_category CURRENT_EVENTS, signature_severity Major, tag Wordpress, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Likely CottonCastle/Niteris EK Response June 19 2015"; flow:established,from_server; content:"Refresh|3a 20|"; http_header; content:"|3b 20|url"; distance:0; http_header; content:"/999/00000/|0d 0a|"; distance:0; http_header; fast_pattern; pcre:"/^Refresh\x3a\x20\d+\x3b\x20url[^\r\n]+\/999\/00000\/\r?$/Hm"; classtype:exploit-kit; sid:2021306; rev:2; metadata:created_at 2015_06_19, updated_at 2015_06_19;) -alert ip $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DDoS.Win32.Agent.bay Covert Channel (VERSONEX and Mr.Black)"; content:"VERSONEX|3a|"; depth:64; fast_pattern; content:"Mr.Black"; within:50; classtype:trojan-activity; sid:2017315; rev:2; metadata:created_at 2013_08_12, updated_at 2013_08_12;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Suspicious JS Observed in Unknown EK Landing"; flow:established,from_server; file_data; content:"|64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 58 4f 52 28 75 6e 65 73 63 61 70 65 28 73 74 72 48 54 4d 4c 29|"; nocase; classtype:exploit-kit; sid:2021313; rev:2; metadata:created_at 2015_06_19, updated_at 2015_06_19;) -alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE python shell spawn attempt"; flow:established,to_client; content:"pty|2e|spawn|2822|/bin/sh|2229|"; depth:64; classtype:trojan-activity; sid:2017317; rev:2; metadata:created_at 2013_08_12, updated_at 2013_08_12;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT KaiXin Secondary Landing Page June 22 2015"; flow:established,from_server; file_data; content:"return binary_to_base64|28|"; content:"return "; pcre:"/^\s*?[\x22\x27][^\x22\x27a-f0-9]68[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]70[^\x22\x27a-f0-9]3a[^\x22\x27a-f0-9]2f[^\x22\x27a-f0-9]2f[^\x22\x27]+?[^\x22\x27a-f0-9]00[\x22\x27]/Ri"; classtype:exploit-kit; sid:2021320; rev:2; metadata:created_at 2015_06_23, updated_at 2015_06_23;) -#alert http $EXTERNAL_NET any -> $HOME_NET 8300 (msg:"ET WEB_SERVER Novell GroupWise Messenger Accept Language Buffer Overflow"; flow:established,to_server; content:"Accept-Language"; nocase; pcre:"/^Accept-Language\:[^\n]*?[^,\;\n]{17}/mi"; reference:cve,2006-0992; reference:bugtraq,17503; reference:url,doc.emergingthreats.net/2002865; classtype:attempted-user; sid:2002865; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT suspicious VBE-encoded script (seen in Sundown EK)"; flow:established,from_server; file_data; content:"Script.Encode"; content:""; distance:0; classtype:command-and-control; sid:2017526; rev:3; metadata:created_at 2013_09_25, former_category MALWARE, updated_at 2013_09_25;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Disdain EK Flash Exploit M3 Aug 23 2017"; flow:established,from_server; flowbits:isset,ET.DisDain.EK; file_data; content:"FWS"; within:3; classtype:exploit-kit; sid:2024611; rev:2; metadata:created_at 2017_08_23, updated_at 2017_08_23;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL WEB_CLIENT Windows Media Player directory traversal via Content-Disposition attempt"; flow:from_server,established; file_data; content:"Content-Disposition|3A|"; nocase; pcre:"/filename=[^\x3b\x3a\r\n]*(\x2e\x2e|\x25\x32\x65)/smi"; reference:bugtraq,7517; reference:cve,2003-0228; reference:url,www.microsoft.com/technet/security/bulletin/MS03-017.mspx; classtype:attempted-user; sid:2103192; rev:6; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_23, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT BegOp Exploit Kit Payload"; flow:established,from_server; content:"Content-Type|3a| image/"; http_header; fast_pattern:only; file_data; content:"M"; within:1; content:!"Z"; within:1; content:"Z"; distance:1; within:1; classtype:exploit-kit; sid:2015783; rev:6; metadata:created_at 2012_10_06, former_category EXPLOIT_KIT, updated_at 2017_09_08;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT LightsOut EK Payload Download"; flow:to_server,established; content:".php?dwl="; http_uri; fast_pattern:only; nocase; pcre:"/\.php\?dwl=[a-z]+$/U"; reference:url,blogs.cisco.com/security/watering-hole-attacks-target-energy-sector; classtype:exploit-kit; sid:2017529; rev:4; metadata:created_at 2013_09_30, former_category CURRENT_EVENTS, updated_at 2013_09_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT HoeflerText Chrome Popup DriveBy Download Attempt 1"; flow:established,to_client; file_data; content:"The |22|HoeflerText|22| font wasn't found"; nocase; fast_pattern; content:"you have to update the |22|Chrome Font Pack|22|"; distance:0; nocase; content:"Click on the Chrome_Font.exe"; distance:0; nocase; content:"Latest version"; distance:0; nocase; content:"href=|22|http"; distance:0; nocase; content:"window.chrome"; distance:0; nocase; reference:url,www.proofpoint.com/us/threat-insight/post/EITest-Nabbing-Chrome-Users-Chrome-Font-Social-Engineering-Scheme; classtype:exploit-kit; sid:2024238; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_04_24, deployment Perimeter, former_category CURRENT_EVENTS, performance_impact Moderate, signature_severity Major, updated_at 2017_09_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Possible LightsOut EK info3i.html"; flow:to_server,established; content:"/info3i.html"; http_uri; fast_pattern:only; nocase; reference:url,blogs.cisco.com/security/watering-hole-attacks-target-energy-sector; classtype:exploit-kit; sid:2017530; rev:2; metadata:created_at 2013_09_30, former_category CURRENT_EVENTS, updated_at 2013_09_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT HoeflerText Chrome Popup DriveBy Download Attempt 2"; flow:established,to_client; file_data; content:"The |22|HoeflerText|22| font was not found"; nocase; fast_pattern; content:"you have to update the |22|Chrome Font Pack|22|"; distance:0; nocase; content:"To install |22|HoeflerText|22| font for your PC"; distance:0; nocase; content:"Download the .js"; distance:0; nocase; content:".attr('href',"; distance:0; nocase; metadata: former_category CURRENT_EVENTS; reference:url,www.proofpoint.com/us/threat-insight/post/EITest-Nabbing-Chrome-Users-Chrome-Font-Social-Engineering-Scheme; classtype:exploit-kit; sid:2024700; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_09_12, deployment Perimeter, former_category CURRENT_EVENTS, performance_impact Low, signature_severity Major, updated_at 2017_09_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Possible LightsOut EK info3i.php"; flow:to_server,established; content:"/info3i.php"; http_uri; fast_pattern:only; nocase; reference:url,blogs.cisco.com/security/watering-hole-attacks-target-energy-sector; classtype:exploit-kit; sid:2017531; rev:4; metadata:created_at 2013_09_30, former_category CURRENT_EVENTS, updated_at 2013_09_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT RIG EK encrypted payload Sept 11 (1)"; flow:established,to_client; file_data; content:"|8d b1 8a d0 36 8d 5d bf|"; within:8; classtype:exploit-kit; sid:2024691; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2017_09_11, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Exploit_Kit_RIG, performance_impact Low, signature_severity Major, tag Exploit_kit_RIG, updated_at 2017_09_12;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Possible LightsOut EK inden2i.html"; flow:to_server,established; content:"/inden2i.html"; http_uri; fast_pattern:only; nocase; reference:url,blogs.cisco.com/security/watering-hole-attacks-target-energy-sector; classtype:exploit-kit; sid:2017532; rev:4; metadata:created_at 2013_09_30, former_category CURRENT_EVENTS, updated_at 2013_09_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT CottonCastle/Niteris EK Exploit URI Struct June 19 2015"; flow:established,to_server; content:"?time="; http_uri; fast_pattern; content:"&stamp="; distance:0; http_uri; content:"."; distance:0; http_uri; pcre:"/^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}(?:[a-f0-9]{8})?\.[a-z]+\?time=[^&]+&stamp=[a-z]*\d+(?:\.[a-z]*\d+)+$/U"; classtype:exploit-kit; sid:2021307; rev:3; metadata:created_at 2015_06_19, former_category CURRENT_EVENTS, updated_at 2015_06_19;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Possible LightsOut EK leks.html"; flow:to_server,established; content:"/leks.html"; http_uri; fast_pattern:only; nocase; reference:url,blogs.cisco.com/security/watering-hole-attacks-target-energy-sector; classtype:exploit-kit; sid:2017534; rev:4; metadata:created_at 2013_09_30, former_category CURRENT_EVENTS, updated_at 2013_09_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT CottonCastle/Niteris EK Flash Exploit URI Struct June 19 2015"; flow:established,to_server; content:"GET"; http_method; content:"/%"; http_header; content:"http%3A%2F%2F"; distance:2; within:13; nocase; http_header; fast_pattern; pcre:"/^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}(?:[a-f0-9]{8})?\//U"; content:"Referer|3a 20|http"; http_header; pcre:"/^[^\r\n]+\/%(?:3A|20)http%3A%2F%2F/Hmi"; classtype:exploit-kit; sid:2021309; rev:3; metadata:created_at 2015_06_19, former_category CURRENT_EVENTS, updated_at 2015_06_19;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Possible LightsOut EK negc.html"; flow:to_server,established; content:"/negc.html"; http_uri; fast_pattern:only; nocase; reference:url,blogs.cisco.com/security/watering-hole-attacks-target-energy-sector; classtype:exploit-kit; sid:2017535; rev:4; metadata:created_at 2013_09_30, former_category CURRENT_EVENTS, updated_at 2013_09_30;) +#alert http $HOME_NET any -> [31.184.192.0/19] 80 (msg:"ET EXPLOIT_KIT Possible EITest Flash Redirect Sep 19 2016"; flow:established,to_server; urilen:1; content:"x-flash-version|3a 20|"; http_header; content:!"/crossdomain.xml"; http_header; content:!".swf"; http_header; nocase; content:!".flv"; http_header; nocase; content:!"[DYNAMIC]"; http_header; content:!"|0d 0a|Cookie|3a|"; classtype:exploit-kit; sid:2023249; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_09_19, deployment Perimeter, malware_family EvilTDS, malware_family EITest, performance_impact Low, signature_severity Major, tag Redirector_07012016, updated_at 2016_09_19;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Possible LightsOut EK negq.html"; flow:to_server,established; content:"/negq.html"; http_uri; fast_pattern:only; nocase; reference:url,blogs.cisco.com/security/watering-hole-attacks-target-energy-sector; classtype:exploit-kit; sid:2017536; rev:4; metadata:created_at 2013_09_30, former_category CURRENT_EVENTS, updated_at 2013_09_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Jan 27 2016 (Evil Keitaro FB Set)"; flow:established,to_server; urilen:>5; content:"/?3b"; http_uri; depth:4; pcre:"/^\/\?3b[A-Z0-9a-z]{2}(&subid=[^&]*)?$/U"; flowbits:set,ET.Keitaro; flowbits:noalert; classtype:exploit-kit; sid:2022464; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_01_28, deployment Perimeter, signature_severity Major, tag Redirector, updated_at 2016_07_01;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Possible LightsOut EK leks.jar"; flow:to_server,established; content:"/leks.jar"; http_uri; fast_pattern:only; nocase; reference:url,blogs.cisco.com/security/watering-hole-attacks-target-energy-sector; classtype:exploit-kit; sid:2017537; rev:4; metadata:created_at 2013_09_30, former_category CURRENT_EVENTS, updated_at 2013_09_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Feb 24 2016 (Evil Keitaro FB Set)"; flow:established,to_server; urilen:7; content:"/xLMCJ4"; http_uri; flowbits:set,ET.Keitaro; flowbits:noalert; classtype:exploit-kit; sid:2025038; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_02_26, deployment Perimeter, former_category EXPLOIT_KIT, signature_severity Major, tag Redirector, updated_at 2017_11_27;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Possible LightsOut EK start.jar"; flow:to_server,established; content:"/start.jar"; http_uri; fast_pattern:only; nocase; reference:url,blogs.cisco.com/security/watering-hole-attacks-target-energy-sector; classtype:exploit-kit; sid:2017538; rev:4; metadata:created_at 2013_09_30, former_category CURRENT_EVENTS, updated_at 2013_09_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Feb 29 2016 (Evil Keitaro FB Set)"; flow:established,to_server; urilen:5; content:"/5c2C"; http_uri; flowbits:set,ET.Keitaro; flowbits:noalert; classtype:exploit-kit; sid:2025039; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_03_01, deployment Perimeter, former_category EXPLOIT_KIT, signature_severity Major, tag Redirector, updated_at 2017_11_27;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Possible LightsOut EK stoq.jar"; flow:to_server,established; content:"/stoq.jar"; http_uri; fast_pattern:only; nocase; reference:url,blogs.cisco.com/security/watering-hole-attacks-target-energy-sector; classtype:exploit-kit; sid:2017539; rev:4; metadata:created_at 2013_09_30, former_category CURRENT_EVENTS, updated_at 2013_09_30;) +#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT g01pack Exploit Kit Landing Page (2)"; flow:established,to_server; urilen:>2; content:"/ HTTP/1."; pcre:"/^\/[a-z]+\/$/U"; content:".mine.nu|0d 0a|"; http_header; nocase; fast_pattern:only; classtype:exploit-kit; sid:2015758; rev:3; metadata:created_at 2012_10_04, former_category EXPLOIT_KIT, updated_at 2018_03_15;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Possible LightsOut EK erno_rfq.html"; flow:to_server,established; content:"/erno_rfq.html"; http_uri; fast_pattern:only; nocase; reference:url,blogs.cisco.com/security/watering-hole-attacks-target-energy-sector; classtype:exploit-kit; sid:2017540; rev:4; metadata:created_at 2013_09_30, former_category CURRENT_EVENTS, updated_at 2013_09_30;) +#alert http $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET EXPLOIT_KIT CottonCastle/Niteris EK Landing Aug 17 2015"; flow:established,from_server; file_data; content:"ScriptEngineMajorVersion"; nocase; content:"ScriptEngineMinorVersion"; nocase; content:"ScriptEngineBuildVersion"; nocase; fast_pattern; content:"d27cdb6e-ae6d-11cf-96b8-444553540000"; nocase; classtype:exploit-kit; sid:2021638; rev:3; metadata:created_at 2015_08_17, former_category CURRENT_EVENTS, updated_at 2018_04_03;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Possible LightsOut EK inden2i.php"; flow:to_server,established; content:"/inden2i.php"; http_uri; fast_pattern:only; nocase; reference:url,blogs.cisco.com/security/watering-hole-attacks-target-energy-sector; classtype:exploit-kit; sid:2017541; rev:4; metadata:created_at 2013_09_30, former_category CURRENT_EVENTS, updated_at 2013_09_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Underminer EK IE Exploit"; flow:established,to_client; file_data; content:"IE=EmulateIE9"; nocase; content:"\s*<\/body>/Rsi"; classtype:exploit-kit; sid:2025911; rev:1; metadata:affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2018_07_26, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag Underminer_EK, updated_at 2018_07_26;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Possible LightsOut EK gami.html"; flow:to_server,established; content:"/gami.html"; http_uri; fast_pattern:only; nocase; reference:url,blogs.cisco.com/security/watering-hole-attacks-target-energy-sector; classtype:exploit-kit; sid:2017542; rev:4; metadata:created_at 2013_09_30, former_category CURRENT_EVENTS, updated_at 2013_09_30;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Underminer EK Flash Exploit"; flow:established,to_client; file_data; content:"D27CDB6E-AE6D-11cf-96B8-444553540000"; nocase; fast_pattern; content:"]*? name\s*=\s*[\x22\x27]flashvars)[^>]*? value\s*=\s*[\x22\x27]url=https?\x3a[^\x22\x27]*?\.wasm/Rsi"; classtype:exploit-kit; sid:2025914; rev:3; metadata:affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2018_07_26, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag Underminer_EK, updated_at 2018_07_27;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Possible LightsOut EK gami.jar"; flow:to_server,established; content:"/gami.jar"; http_uri; fast_pattern:only; nocase; reference:url,blogs.cisco.com/security/watering-hole-attacks-target-energy-sector; classtype:exploit-kit; sid:2017543; rev:4; metadata:created_at 2013_09_30, former_category CURRENT_EVENTS, updated_at 2013_09_30;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Spelevo EK Landing M1"; flow:from_server,established; file_data; content:"|554778315a326c75524756305a574e30|"; content:"-=8))%256)|3b|}"; content:"+=72){"; content:"[0] < 21) return false|3b|"; content:",[0] > 31) return false|3b|"; distance:0; content:"[0] == 31 &&"; content:"[3] > 153) return false|3b|"; distance:0; content:"flash"; nocase; classtype:exploit-kit; sid:2027072; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_11, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Spleevo_EK, performance_impact Moderate, signature_severity Major, updated_at 2019_03_11;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT CVE-2013-3893 IE Memory Corruption Vulnerability"; flow:established,to_client; file_data; content:"outer"; nocase; pcre:"/^(?:Text|HTML)/Ri"; content:"onlosecapture"; nocase; fast_pattern; pcre:"/^(:?([\x22\x27][\r\n\s]*?\])?[\r\n\s]*?=|[\x22\x27][\r\n\s]*?\,)[\r\n\s]*?(?!function)(?P[^\r\n\s]+)\b.+?function[\r\n\s]+(?P=func)[\r\n\s]*?\([^\)]*?\)[\r\n\s]*?\{((?!function).)*?(\b(?P[^\r\n\s\=]+)[\r\n\s]*?=[\r\n\s]*?(\x22\x22|\x27\x27))?((?!function).)*?document\.write\([\r\n\s]*?(\x22\x22|\x27\x27|(?P=var))[\r\n\s]*?\)/Rsi"; reference:cve,2013-3893; reference:url,blogs.technet.com/b/srd/archive/2013/09/17/cve-2013-3893-fix-it-workaround-available.aspx; classtype:attempted-user; sid:2017480; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2013_09_18, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Spelevo EK Landing M2"; flow:from_server,established; file_data; content:"|516248566e615735455a58526c5933|"; content:"-=8))%256)|3b|}"; content:"+=72){"; content:"[0] < 21) return false|3b|"; content:",[0] > 31) return false|3b|"; distance:0; content:"[0] == 31 &&"; content:"[3] > 153) return false|3b|"; distance:0; content:"flash"; nocase; classtype:exploit-kit; sid:2027073; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_11, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Spleevo_EK, performance_impact Moderate, signature_severity Major, updated_at 2019_03_11;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT CVE-2013-3893 IE Memory Corruption Vulnerability"; flow:established,to_client; file_data; content:"outer"; nocase; pcre:"/^(?:Text|HTML)/Ri"; content:"onlosecapture"; fast_pattern; nocase; pcre:"/^(:?([\x22\x27][\r\n\s]*?\])?[\r\n\s]*?=|[\x22\x27][\r\n\s]*?\,)[\r\n\s]*?function[\r\n\s]*?\([^\)]*?\)[\r\n\s]*?\{.*?(\b(?P[^\r\n\s\=]+)[\r\n\s]*?=[\r\n\s]*?(\x22\x22|\x27\x27))?.*?document\.write\([\r\n\s]*?(\x22\x22|\x27\x27|(?P=var))[\r\n\s]*?\)/Rsi"; reference:cve,2013-3893; reference:url,blogs.technet.com/b/srd/archive/2013/09/17/cve-2013-3893-fix-it-workaround-available.aspx; classtype:attempted-user; sid:2017478; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2013_09_18, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Spelevo EK Landing M3"; flow:from_server,established; file_data; content:"|427364576470626b526c6447566a64|"; content:"-=8))%256)|3b|}"; content:"+=72){"; content:"[0] < 21) return false|3b|"; content:",[0] > 31) return false|3b|"; distance:0; content:"[0] == 31 &&"; content:"[3] > 153) return false|3b|"; distance:0; content:"flash"; nocase; classtype:exploit-kit; sid:2027074; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_03_11, former_category CURRENT_EVENTS, malware_family Spleevo_EK, performance_impact Moderate, signature_severity Major, updated_at 2019_03_11;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Blackhole EK Jar Download URI Struct"; flow:established,to_server; content:"Java/1."; http_user_agent; fast_pattern:only; content:".php?"; http_uri; pcre:"/\/(?:[^\/]+?\/[a-z]{2,16}[_-][a-z]{2,16}([_-][a-z]{2,16})*?|[a-z]{16,20}\/[a-z]{16,20}|closest\/[a-z0-9]+)\.php\?[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+&[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+$/U"; classtype:exploit-kit; sid:2017140; rev:10; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_07_13, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DRIVEBY Unknown - news=1 in http_cookie"; flow:established,to_client; content:"Set-Cookie|3a| news=1"; http_raw_header; classtype:exploit-kit; sid:2014438; rev:10; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2012_03_28, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Obfuscated http 2 digit sep in applet (Seen in HiMan EK)"; flow:established,from_server; file_data; content:"\d{2})t(?P=sep)t(?P=sep)p(?P=sep)\x3a/R"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2017551; rev:2; metadata:created_at 2013_10_02, updated_at 2013_10_02;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Nuclear EK Landing Apr 08 2015"; flow:established,from_server; content:"Server|3a 20|nginx"; http_header; file_data; content:"Q|22|"; fast_pattern; content:"length"; pcre:"/^\s*?\<\s*?10/Rs"; content:"replace"; within:500; pcre:"/^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22(?:\!(?:\x22\s*?\+\s*?\x22)?)?Q(?:\x22\s*?\+\s*?\x22)?Q\x22/Rs"; classtype:exploit-kit; sid:2020865; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_04_09, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Nuclear, signature_severity Critical, tag Exploit_Kit, tag Nuclear, updated_at 2022_05_03;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible CritX/SafePack/FlashPack EXE Download"; flow:established,from_server; content:"filename=e"; http_header; content:".exe"; distance:23; within:4; http_header; pcre:"/filename=e[a-f0-9]{23}\.exe/H"; classtype:exploit-kit; sid:2017297; rev:6; metadata:created_at 2013_08_08, former_category CURRENT_EVENTS, updated_at 2013_08_08;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Cool Exploit Kit iframe with obfuscated Java version check Jun 26 2013"; flow:established,from_server; file_data; content:""; within:500; content:!"|0d|"; within:500; pcre:"/^\s*[^>]*?[a-zA-Z]+\s*?=\s*?[\x22\x27](?=[a-z]{0,20}[A-Z])(?=[A-Z]{0,20}[a-z])[A-Za-z]{15,21}[\x22\x27][^>]*?>(?=[A-Za-z_]{0,200}[0-9])(?=[0-9a-z_]{0,200}[A-Z])(?=[0-9A-Z_]{0,200}[a-z])[A-Za-z0-9_]{200}/R"; classtype:exploit-kit; sid:2020975; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_04_23, deployment Perimeter, malware_family Nuclear, signature_severity Critical, tag Exploit_Kit, tag Nuclear, updated_at 2016_07_01;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Cisco Security Manager Path Traversal - athena (CVE-2020-27130)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/athena/"; fast_pattern; content:"|2e 2e 2f|"; reference:cve,2020-27130; classtype:attempted-admin; sid:2035105; rev:2; metadata:attack_target Server, created_at 2022_02_04, cve CVE_2020_27130, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_02_04;) -#alert http $HOME_NET any -> $EXTERNAL_NET !80 (msg:"ET DELETED Job314/Neutrino Reboot EK Payload Nov 20 2014"; flow:established,to_server; content:!"Referer|3a|"; http_header; content:!"Accept-"; http_header; content:"Windows NT"; fast_pattern:only; http_header; content:"User-Agent|3a 20|Mozilla"; content:"GET"; http_method; pcre:"/^\/(?:[a-z]+\.[a-z]+\d?\?(?:[a-z]+\x3d(?:[a-z]+|[0-9]+)&){2,}[a-z]+=(?:[a-z]+|[0-9]+)|(?:[a-z]+\x2f(?:[a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f(?:[a-z]+|[0-9]+)\x2f?)$/U"; classtype:exploit-kit; sid:2020388; rev:8; metadata:created_at 2015_02_10, former_category CURRENT_EVENTS, updated_at 2018_06_18;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT VMware SD-WAN Orchestrator SQL Injection (CVE-2020-3984)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/portal/"; http.request_body; content:"softwareUpdate/getSoftwareUpdates"; fast_pattern; content:"|22|modulus|22 3a|"; content:"UNION SELECT"; nocase; distance:0; reference:cve,2020-3984; classtype:attempted-admin; sid:2035104; rev:2; metadata:attack_target Server, created_at 2022_02_04, cve CVE_2020_3984, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_02_04;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ransomware CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 bf 88 cb e4 d5 79 99 98|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:command-and-control; sid:2021016; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_04_28, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, tag Ransomware, updated_at 2016_07_01, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT VMware SD-WAN Orchestrator Path Traversal (CVE-2020-4000)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"portal/rest/meta/"; fast_pattern; content:"?"; content:"|2e 2e 2f|"; reference:cve,2020-4000; classtype:attempted-admin; sid:2035103; rev:2; metadata:attack_target Server, created_at 2022_02_04, cve CVE_2020_4000, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_02_04;) -#alert udp any 53 -> $HOME_NET any (msg:"ET DELETED Team Cymru Sinkhole DNS Reply"; content:"|00 01 00 01|"; content:"|00 04 26 E5 46 04|"; distance:4; within:6; classtype:trojan-activity; sid:2021020; rev:1; metadata:created_at 2015_04_28, updated_at 2015_04_28;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT VMware SD-WAN Orchestrator Authentication Bypass (CVE-2020-4001)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"|2f|login|2f|doResetPassword|2e|html"; http.request_body; content:"super|40|velocloud|2e|net"; fast_pattern; content:"|7b|CLEAR|7b|"; nocase; content:"logicalId"; nocase; reference:cve,2020-4001; classtype:attempted-admin; sid:2035102; rev:2; metadata:attack_target Server, created_at 2022_02_04, cve CVE_2020_4001, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_02_04;) -alert udp any 53 -> $HOME_NET any (msg:"ET MALWARE Kaspersky Sinkhole DNS Reply"; content:"|00 01 00 01|"; content:"|00 04 5F D3 AC 8F|"; distance:4; within:6; classtype:trojan-activity; sid:2021021; rev:1; metadata:created_at 2015_04_28, updated_at 2015_04_28;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Citrix App Delivery Controller and Citrix Gateway M1 (CVE-2019-19781)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/newbm.pl"; nocase; fast_pattern; endswith; http.header_names; content:"|0d 0a|NSC_USER|0d 0a|"; nocase; content:"|0d 0a|NSC_NONCE|0d 0a|"; nocase; http.request_body; content:"template.new"; nocase; content:"url="; nocase; reference:url,github.com/trustedsec/cve-2019-19781; reference:cve,2019-19781; classtype:attempted-admin; sid:2034279; rev:2; metadata:attack_target Server, created_at 2021_10_28, cve CVE_2019_19781, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_02_04;) -alert udp any 53 -> $HOME_NET any (msg:"ET MALWARE Wapack Labs Sinkhole DNS Reply"; content:"|00 01 00 01|"; content:"|00 04 17 FD 2E 40|"; distance:4; within:6; classtype:trojan-activity; sid:2021022; rev:1; metadata:created_at 2015_04_28, updated_at 2015_04_28;) +alert http any any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Possible Citrix Application Delivery Controller Arbitrary Code Execution Attempt (CVE-2019-19781)"; flow:established,to_server; http.uri; content:"/vpns/"; nocase; fast_pattern; http.uri.raw; content:"/../"; reference:url,support.citrix.com/article/CTX267679; reference:cve,2019-19781; classtype:attempted-admin; sid:2029206; rev:5; metadata:attack_target Server, created_at 2019_12_30, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_02_05;) -#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Malicious SSL Cert (KINS C2)"; flow:established,from_server; content:"|55 04 03|"; content:"|0f|terriblekira.su"; distance:1; within:16; reference:md5,f752cfdc6aa1d3eac013201357ada0f6; classtype:domain-c2; sid:2021031; rev:1; metadata:attack_target Client_and_Server, created_at 2015_04_30, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Possible Citrix Application Delivery Controller Arbitrary Code Execution Attempt (CVE-2019-19781) M4"; flow:established,to_server; http.uri; content:"/vpns/"; nocase; fast_pattern; http.uri.raw; pcre:"/(?:(?:%2F|\/)(?:\.|%2E){2}(?:%2F|\/))/i"; reference:url,support.citrix.com/article/CTX267679; reference:cve,2019-19781; classtype:attempted-admin; sid:2035109; rev:2; metadata:attack_target Server, created_at 2022_02_05, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_02_05;) -#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Malicious SSL Cert (KINS C2)"; flow:established,from_server; content:"|55 04 03|"; content:"|0b|lidline.com"; distance:1; within:112; reference:md5,f752cfdc6aa1d3eac013201357ada0f6; classtype:domain-c2; sid:2021032; rev:1; metadata:attack_target Client_and_Server, created_at 2015_04_30, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Citrix Application Delivery Controller Arbitrary Code Execution Attempt Scanner Attempt (CVE-2019-19781)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/vpns/cfg/smb.con"; nocase; fast_pattern; http.uri.raw; pcre:"/(?:(?:%2F|\/)(?:\.|%2E){2}(?:%2F|\/))/i"; reference:url,github.com/trustedsec/cve-2019-19781; reference:cve,2019-19781; classtype:attempted-admin; sid:2035110; rev:2; metadata:created_at 2022_02_05, cve CVE_2019_19781, updated_at 2022_02_05;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT CottonCastle/Niteris EK Landing URI Struct April 29 2015 M2"; flow:established,to_server; content:"GET"; http_method; content:"/5/"; http_uri; fast_pattern; content:"http|3a|/"; distance:0; http_uri; pcre:"/\/5\/[a-f0-9]{32}\/\x20*http\x3a\x2f/U"; classtype:exploit-kit; sid:2021034; rev:2; metadata:created_at 2015_04_30, updated_at 2015_04_30;) +alert http $HTTP_SERVERS any -> any any (msg:"ET EXPLOIT Citrix Application Delivery Controller Arbitrary Code Execution Attempt Scanner Attempt - Server Response (CVE-2019-19781)"; flow:established,to_client; http.stat_code; content:"200"; http.header; content:"Via|3a 20|NS-CACHE-"; http.response_body; content:"|5b|global|5d|"; startswith; content:"encrypt passwords"; distance:0; fast_pattern; reference:url,github.com/trustedsec/cve-2019-19781; reference:cve,2019-19781; classtype:attempted-admin; sid:2035111; rev:2; metadata:attack_target Server, created_at 2022_02_05, cve CVE_2019_19781, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_02_05;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT CottonCastle/Niteris EK Landing April 29 2015"; flow:established,from_server; file_data; content:"lortnoCgA.lortnoCgA"; content:"reverse"; classtype:exploit-kit; sid:2021039; rev:2; metadata:created_at 2015_04_30, updated_at 2015_04_30;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Cisco Viptela vManage Directory Traversal (CVE-2020-27128)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/dataservice/statistics/download/dr/filelist"; fast_pattern; http.request_body; content:"|2f 2e 2e 2f|"; reference:cve,2020-27128; classtype:web-application-attack; sid:2035136; rev:2; metadata:attack_target Server, created_at 2022_02_08, cve CVE_2020_27128, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_02_08;) -alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Session Traversal Utilities for NAT (STUN Binding Response)"; content:"|01 01 00 44|"; depth:4; content:"|00 01 00 08|"; distance:16; within:4; threshold:type limit, track by_src, count 1, seconds 60; reference:url,tools.ietf.org/html/rfc5389; classtype:protocol-command-decode; sid:2018908; rev:2; metadata:created_at 2014_08_07, updated_at 2014_08_07;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Cisco SD-WAN vManage Software Directory Traversal (CVE-2020-26073)"; flow:established,to_server; http.request_line; content:"GET /dataservice/disasterrecovery/download/token/"; startswith; fast_pattern; pcre:"/^(%2E%2E%2F|\.\.\/)/Ri"; reference:cve,2020-26073; classtype:web-application-attack; sid:2035137; rev:2; metadata:attack_target Server, created_at 2022_02_08, cve CVE_2020_26073, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_02_08;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown EK Landing Page May 01 2015"; flow:from_server,established; file_data; content:"CM|3a 20|u.indexOf(|27|NT 5.1|27|) > -1"; content:"PS|3a 20|u.indexOf(|27|NT 6.|27|) > -1"; classtype:exploit-kit; sid:2021046; rev:2; metadata:created_at 2015_05_02, updated_at 2015_05_02;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Microsoft Exchange Server OWA GetWacUrl Information Disclosure Attempt (CVE-2020-17143)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/owa/service.svc"; fast_pattern; http.header; content:"Action|3a 20|GetWacIframeUrlForOneDrive"; nocase; content:"|22|EndPointUrl|22 3a 22|"; nocase; reference:cve,2020-17143; classtype:web-application-attack; sid:2035138; rev:2; metadata:attack_target Server, created_at 2022_02_08, cve CVE_2020_17143, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_02_08;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown EK Secondary Landing Page May 01 2015 M1"; flow:from_server,established; file_data; content:"FlashVars"; content:"sh=Y21kIC9jIGVjaG8g"; classtype:exploit-kit; sid:2021047; rev:2; metadata:created_at 2015_05_02, updated_at 2015_05_02;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible SAP ICM MPI Desynchronization Scanning Activity (CVE-2022-22536) M1"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/sap/public/bc/ur/Login/assets/corbu/sap_logo.png"; fast_pattern; http.content_len; byte_test:0,>=,82642,0,string,dec; reference:cve,2022-22536; classtype:attempted-admin; sid:2035182; rev:2; metadata:attack_target Server, created_at 2022_02_11, cve CVE_2022_22536, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_02_11;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown EK Secondary Landing Page May 01 2015 M2"; flow:from_server,established; file_data; content:"FlashVars"; content:"sh=cG93ZXJzaGVsbC5leGUg"; classtype:exploit-kit; sid:2021048; rev:2; metadata:created_at 2015_05_02, updated_at 2015_05_02;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible SAP ICM MPI Desynchronization Scanning Activity (CVE-2022-22536) M2"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/sap/admin/public/default.html?"; fast_pattern; http.content_len; byte_test:0,>=,82642,0,string,dec; reference:cve,2022-22536; classtype:attempted-admin; sid:2035183; rev:2; metadata:attack_target Server, created_at 2022_02_11, cve CVE_2022_22536, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_02_11;) -alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux.Trojan.IptabLex Variant Checkin"; flow:to_server,established; dsize:157; content:"|77|"; depth:1; pcre:"/^[\x01\x03\x08\x09\x0b]\x00/R"; content:"|20 40 20|"; distance:0; content:"Hz"; nocase; within:15; reference:md5,019765009f7142a89af15aaaac7400cc; reference:url,blog.malwaremustdie.org/2014/06/mmd-0025-2014-itw-infection-of-elf.html; classtype:command-and-control; sid:2021050; rev:1; metadata:created_at 2015_05_04, former_category MALWARE, updated_at 2015_05_04;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Moxa MxView RCE Attempt (CVE-2021-38454)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"api/sites/site/"; fast_pattern; pcre:"/^[a-zA-Z0-9]{5,45}/R"; content:"/ping"; endswith; reference:cve,2021-38454; classtype:attempted-admin; sid:2035194; rev:2; metadata:attack_target Server, created_at 2022_02_14, cve CVE_2021_38454, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_02_14;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Linux.Mumblehard Spam Command CnC"; flow:to_server,established; content:"POST / HTTP/1."; depth:14; content:"|0d 0a 0d 0a 0f 0f|"; pcre:"/^\d{1,3}[0-2]/R"; reference:url,www.welivesecurity.com/wp-content/uploads/2015/04/mumblehard.pdf; reference:md5,86f0b0b74fe8b95b163a1b31d76f7917; classtype:command-and-control; sid:2021053; rev:1; metadata:created_at 2015_05_04, former_category MALWARE, updated_at 2015_05_04;) +alert tcp $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Oracle Weblogic Server Deserialization RCE T3 (CVE-2015-4852)"; flow:established,to_server; content:"|00 00|"; startswith; content:"|01 65|"; distance:2; within:2; content:"|ac ed 00|"; distance:0; content:"weblogic.rjvm.ClassTableEntry"; fast_pattern; distance:0; reference:cve,2015-4852; reference:url,www.exploit-db.com/exploits/46628; classtype:attempted-admin; sid:2035204; rev:1; metadata:created_at 2022_02_15, cve CVE_2015_4852, former_category EXPLOIT, updated_at 2022_02_15;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Magnitude EK Flash Payload ShellCode Apr 23 2015"; flow:established,from_server; file_data; content:"urlmon.dll|00|http|3a 2f|"; pcre:"/^\x2f+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x2f\??[a-f0-9]+\x7chttp\x3a\x2f/Rs"; classtype:exploit-kit; sid:2021054; rev:2; metadata:created_at 2015_05_04, former_category EXPLOIT_KIT, updated_at 2015_05_04;) +alert tcp-pkt any any -> [$HTTP_SERVERS,$HOME_NET] 1024: (msg:"ET EXPLOIT Possible Zerologon Phase 1/3 - NetrServerReqChallenge with 0x00 Client Challenge (CVE-2020-1472)"; flow:established,to_server; flowbits:isset,dcerpc.rpcnetlogon; flowbits:isnotset,dcerpc.rpcnetlogon.netrsrvreqchal.nullcc; flowbits:set,dcerpc.rpcnetlogon.netrsrvreqchal.nullcc; content:"|05 00 00|"; startswith; fast_pattern; content:"|04 00|"; offset:22; depth:2; content:"|00 00 00 00 00 00 00 00|"; endswith; threshold: type limit, count 1, seconds 30, track by_src; reference:url,www.secura.com/blog/zero-logon; reference:cve,2020-1472; reference:url,thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/; classtype:attempted-admin; sid:2030870; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Server, created_at 2020_09_14, cve CVE_2020_1472, deployment Perimeter, deployment Internal, former_category EXPLOIT, performance_impact Significant, signature_severity Major, updated_at 2022_02_22;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dyre Downloading Mailer 2"; flow:established,to_server; content:"GET"; http_method; content:".tar"; http_uri; content:!"Accept"; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; content:"User-Agent|3a 20|Mozilla/5.0 (Windows NT 6.1|3b 20|WOW64|3b 20|Trident/7.0|3b 20|SLCC2|3b 20|.NET CLR 2.0.50727|3b 20|.NET CLR 3.5.30729|3b 20|.NET CLR 3.0.30729|3b 20|Media Center PC 6.0|3b 20|.NET4.0E|3b 20|.NET4.0C|3b 20|rv|3a|11.0) like Gecko|0d 0a|Host|3a|"; http_header; depth:195; pcre:"/^[^\r\n]+\r\n(?:\r\n)?$/RHi"; pcre:"/\.tar$/U"; reference:url,www.seculert.com/blog/2015/04/new-dyre-version-evades-sandboxes.html; reference:md5,999bc5e16312db6abff5f6c9e54c546f; classtype:trojan-activity; sid:2021056; rev:5; metadata:created_at 2015_05_04, former_category MALWARE, updated_at 2015_05_04;) +alert tcp-pkt any any -> [$HTTP_SERVERS,$HOME_NET] 1024: (msg:"ET EXPLOIT Zerologon Phase 2/3 - NetrServerAuthenticate2 Request with 0x00 Client Challenge and Sign and Seal Disabled (CVE-2020-1472) M2"; flow:established,to_server; flowbits:isset,dcerpc.rpcnetlogon; flowbits:isset,dcerpc.rpcnetlogon.netrsrvreqchal.nullcc; flowbits:set,dcerpc.rpcnetlogon.netrsrvrauth.nosignnoseal; content:"|05 00 00|"; startswith; fast_pattern; content:"|0f 00|"; offset:22; depth:2; content:"|00 00 00 00 00 00 00 00|"; distance:0; content:!"|00 00|"; within:2; isdataat:!8,relative; byte_test:1,!&,0x40,6,relative; threshold: type both, count 5, seconds 30, track by_src; reference:url,www.secura.com/blog/zero-logon; reference:url,dirkjanm.io/a-different-way-of-abusing-zerologon/; reference:cve,2020-1472; reference:url,thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/; classtype:attempted-admin; sid:2035259; rev:2; metadata:attack_target Server, created_at 2022_02_22, cve CVE_2020_1472, deployment Internal, former_category EXPLOIT, performance_impact Significant, signature_severity Major, updated_at 2022_02_22;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Angler EK XTEA encrypted binary (23)"; flow:established,to_client; file_data; content:"|08 fe 4a ac c6 d6 06 8d|"; distance:1728; within:8; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2021059; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_05_06, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Angler, signature_severity Critical, tag Angler, tag Exploit_Kit, updated_at 2018_06_18;) +alert tcp-pkt any any -> [$HTTP_SERVERS,$HOME_NET] 1024: (msg:"ET EXPLOIT Zerologon Phase 3/3 - NetrLogonSamLogonWithFlags Request with 0x00 Client Credentials (CVE-2020-1472)"; flow:established,to_server; flowbits:isset,dcerpc.rpcnetlogon; flowbits:isset,dcerpc.rpcnetlogon.netrsrvrauth.nosignnoseal; content:"|05 00 00|"; startswith; fast_pattern; content:"|2d 00|"; offset:22; depth:2; content:"|00 00 00 00 00 00 00 00 00 00 00 00|"; distance:0; content:!"|00 00 00 00|"; within:4; content:"|00 00 00 00 00 00 00 00 00 00 00 00|"; distance:4; within:12; reference:url,www.secura.com/blog/zero-logon; reference:url,dirkjanm.io/a-different-way-of-abusing-zerologon/; reference:cve,2020-1472; reference:url,thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/; classtype:attempted-admin; sid:2035263; rev:2; metadata:attack_target Server, created_at 2022_02_22, cve CVE_2020_1472, deployment Internal, former_category EXPLOIT, performance_impact Significant, signature_severity Major, updated_at 2022_02_22;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Ursnif SSL Cert"; flow:established,from_server; content:"|55 04 03|"; content:"|16|athereforeencourage.pw"; distance:1; within:23; classtype:trojan-activity; sid:2021061; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_06, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;) +alert tcp-pkt any any -> [$HTTP_SERVERS,$HOME_NET] 1024: (msg:"ET EXPLOIT Zerologon Phase 2/3 - NetrServerAuthenticate2 Request with 0x00 Client Challenge and Sign and Seal Disabled (CVE-2020-1472) M1"; flow:established,to_server; flowbits:isset,dcerpc.rpcnetlogon; flowbits:isset,dcerpc.rpcnetlogon.netrsrvreqchal.nullcc; flowbits:set,dcerpc.rpcnetlogon.netrsrvrauth.nosignnoseal; content:"|05 00 00|"; startswith; fast_pattern; content:"|0f 00|"; offset:22; depth:2; content:"|00 00 00 00 00 00 00 00|"; distance:0; content:!"|00 00|"; within:2; isdataat:!5,relative; byte_test:1,!&,0x40,3,relative; threshold: type both, count 5, seconds 30, track by_src; reference:url,www.secura.com/blog/zero-logon; reference:url,dirkjanm.io/a-different-way-of-abusing-zerologon/; reference:cve,2020-1472; reference:url,thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/; classtype:attempted-admin; sid:2035258; rev:2; metadata:attack_target Server, created_at 2022_02_22, cve CVE_2020_1472, deployment Internal, former_category EXPLOIT, performance_impact Significant, signature_severity Major, updated_at 2022_02_22;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ransomware CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 8d 3d d5 97 44 08 33 d8|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:command-and-control; sid:2021063; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_07, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, tag Ransomware, updated_at 2016_07_01, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;) +alert tcp-pkt any any -> [$HTTP_SERVERS,$HOME_NET] 1024: (msg:"ET EXPLOIT Zerologon Phase 2/3 - NetrServerAuthenticate3 Request with 0x00 Client Challenge and Sign and Seal Disabled (CVE-2020-1472) M1"; flow:established,to_server; flowbits:isset,dcerpc.rpcnetlogon; flowbits:isset,dcerpc.rpcnetlogon.netrsrvreqchal.nullcc; flowbits:set,dcerpc.rpcnetlogon.netrsrvrauth.nosignnoseal; content:"|05 00 00|"; startswith; fast_pattern; content:"|1a 00|"; offset:22; depth:2; content:"|00 00 00 00 00 00 00 00|"; distance:0; content:!"|00 00|"; within:2; isdataat:!5,relative; byte_test:1,!&,0x40,3,relative; threshold: type both, count 5, seconds 30, track by_src; reference:url,www.secura.com/blog/zero-logon; reference:url,dirkjanm.io/a-different-way-of-abusing-zerologon/; reference:cve,2020-1472; reference:url,thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/; classtype:attempted-admin; sid:2035260; rev:2; metadata:attack_target Server, created_at 2022_02_22, cve CVE_2020_1472, deployment Internal, former_category EXPLOIT, performance_impact Significant, signature_severity Major, updated_at 2022_02_22;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response"; flow:established,to_client; flowbits:isset,http.dottedquadhost; file_data; content:"MZ"; within:2; content:"PE|00 00|"; distance:0; classtype:bad-unknown; sid:2021076; rev:2; metadata:created_at 2015_05_08, former_category INFO, updated_at 2015_05_08;) +alert tcp-pkt any any -> [$HTTP_SERVERS,$HOME_NET] 1024: (msg:"ET EXPLOIT Zerologon Phase 2/3 - NetrServerAuthenticate3 Request with 0x00 Client Challenge and Sign and Seal Disabled (CVE-2020-1472) M2"; flow:established,to_server; flowbits:isset,dcerpc.rpcnetlogon; flowbits:isset,dcerpc.rpcnetlogon.netrsrvreqchal.nullcc; flowbits:set,dcerpc.rpcnetlogon.netrsrvrauth.nosignnoseal; content:"|05 00 00|"; startswith; fast_pattern; content:"|1a 00|"; offset:22; depth:2; content:"|00 00 00 00 00 00 00 00|"; distance:0; content:!"|00 00|"; within:2; isdataat:!8,relative; byte_test:1,!&,0x40,6,relative; threshold: type both, count 5, seconds 30, track by_src; reference:url,www.secura.com/blog/zero-logon; reference:url,dirkjanm.io/a-different-way-of-abusing-zerologon/; reference:cve,2020-1472; reference:url,thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/; classtype:attempted-admin; sid:2035261; rev:2; metadata:attack_target Server, created_at 2022_02_22, cve CVE_2020_1472, deployment Internal, former_category EXPLOIT, performance_impact Significant, signature_severity Major, updated_at 2022_02_22;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Likely Trojan Multi-part Macro Download M1"; flow:established,from_server; file_data; content:"PAB0AGUAeAB0ADEAMAA+ACQA"; within:24; classtype:trojan-activity; sid:2020911; rev:3; metadata:created_at 2015_04_15, former_category CURRENT_EVENTS, updated_at 2015_04_15;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache APISIX Admin API Authentication Bypass (CVE-2022-24112) M1"; flow:established,to_server; http.request_line; content:"POST /apisix/batch-requests HTTP/1.1"; fast_pattern; http.request_body; content:"X-Real-IP"; nocase; content:"api_key=edd1c9f034335f136f87ad84b625c8f1"; distance:0; content:"filter_func"; reference:cve,2022-24112; classtype:attempted-admin; sid:2035272; rev:2; metadata:attack_target Server, created_at 2022_02_22, cve CVE_2022_24112, deployment Perimeter, deployment Internal, former_category EXPLOIT, performance_impact Low, signature_severity Major, tag Exploit, updated_at 2022_02_22;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED Cryptolocker .onion Proxy Domain (24u4jf7s4regu6hn)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|24u4jf7s4regu6hn"; fast_pattern; distance:0; nocase; reference:md5,36095572717aee2399b6bdacef936e22; classtype:trojan-activity; sid:2021085; rev:1; metadata:created_at 2015_05_09, updated_at 2015_05_09;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache APISIX Admin API Authentication Bypass (CVE-2022-24112) M2"; flow:established,to_server; http.request_line; content:"POST /apisix/batch-requests HTTP/1.1"; fast_pattern; http.request_body; content:"X-Real-IP"; nocase; content:"api_key=edd1c9f034335f136f87ad84b625c8f1"; distance:0; content:"script"; reference:cve,2022-24112; classtype:attempted-admin; sid:2035273; rev:2; metadata:attack_target Server, created_at 2022_02_22, cve CVE_2022_24112, deployment Perimeter, deployment Internal, former_category EXPLOIT, performance_impact Low, signature_severity Major, tag Exploit, updated_at 2022_02_22;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS CritX/SafePack/FlashPack URI Format June 17 2013 3"; flow:established,to_server; content:".php?hash="; http_uri; fast_pattern:only; pcre:"/\/(?:java(?:byte|db)|o(?:utput|ther)|r(?:hino|otat)|msie\d|load)\.php\?hash=/U"; reference:url,www.malwaresigs.com/2013/06/14/slight-change-in-flashpack-uri/; classtype:exploit-kit; sid:2017024; rev:4; metadata:created_at 2013_06_18, former_category CURRENT_EVENTS, updated_at 2013_06_18;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Extensis Portfolio Unrestricted File Upload (CVE-2022-24252)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/FileTransfer/upload?sessionId="; fast_pattern; content:"&action=customPreview"; content:"&catalogId="; http.request_body; content:"filename="; content:"\\.."; within:25; reference:url,whiteoaksecurity.com/blog/extensis-portfolio-vulnerability-disclosure/; classtype:attempted-admin; sid:2035274; rev:2; metadata:attack_target Server, created_at 2022_02_22, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_02_22;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|10 62 16 fe 1e af 85 65 68 82 0d d7 6f 8e 27 33 02|"; content:"|55 04 03|"; distance:0; content:"|0d|mainbytes.com"; distance:1; within:14; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021086; rev:2; metadata:attack_target Client_and_Server, created_at 2015_05_11, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT TOTOLINK Realtek SDK RCE (CVE-2019-19824)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/boafrm/formSysCmd"; fast_pattern; http.request_body; content:"Run|2b|Command|26|sysCmd|3d|"; nocase; reference:cve,2019-19824; classtype:attempted-admin; sid:2035282; rev:2; metadata:attack_target Server, created_at 2022_02_23, cve CVE_2019_19824, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_02_23;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ransomware CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 a5 12 0c 27 cc 24 bb ef|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:command-and-control; sid:2021087; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_11, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, tag Ransomware, updated_at 2016_07_01, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;) +alert tcp any any -> $HOME_NET 445 (msg:"ET EXPLOIT Suspicious SVCCTL CreateService Command via SMB - Observed Zerologon Post Compromise Activity"; flow:established,to_server; content:"SMB"; depth:8; content:"|09 00|"; distance:8; within:2; content:"|05 00 00|"; distance:0; content:"|0c 00|"; distance:19; within:2; content:"|15 00 00 00 00 00 00 00 15 00 00 00|"; within:32; pcre:"/^(?:[A-Z]\x00){20}\x00\x00/R"; content:"|15 00 00 00 00 00 00 00 15 00 00 00|"; fast_pattern; distance:6; within:12; pcre:"/^(?:[A-Z]\x00){20}\x00\x00/R"; content:"|03 00 00 00|"; distance:10; within:4; reference:url,thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/; reference:md5,59e7f22d2c290336826700f05531bd30; classtype:attempted-admin; sid:2035287; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Server, created_at 2022_02_25, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2022_02_25;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING SUSPICIOUS Possible Office Doc with Embedded VBA Project"; flow:established,from_server; flowbits:isset,et.http.PK; file_data; content:"/vbaProject"; nocase; pcre:"/\d*?\.bin/Ri"; flowbits:set,et.DocVBAProject; classtype:bad-unknown; sid:2019835; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2014_12_02, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert smb any any -> $HOME_NET 445 (msg:"ET EXPLOIT CreateService via SMB to Reset-ComputerMachinePassword - Observed Post Zerologon Activity"; flow:established,to_server; content:"SMB"; depth:8; content:"|09 00|"; distance:8; within:2; content:"|05 00 00|"; distance:0; content:"|0c 00|"; distance:19; within:2; content:"|00|R|00|e|00|s|00|e|00|t|00|-|00|C|00|o|00|m|00|p|00|u|00|t|00|e|00|r|00|M|00|a|00|c|00|h|00|i|00|n|00|e|00|P|00|a|00|s|00|s|00|w|00|o|00|r|00|d|00|"; nocase; distance:0; reference:url,thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/; classtype:attempted-admin; sid:2035285; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Server, created_at 2022_02_24, deployment Internet, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2022_02_25;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING SUSPICIOUS Possible Office Doc with Embedded VBA Project"; flow:established,from_server; flowbits:isset,et.http.PK; file_data; content:"_VBA_PROJECT"; nocase; flowbits:set,et.DocVBAProject; classtype:bad-unknown; sid:2019836; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2014_12_02, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Linux/Attempted Hosts File Exfil"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"?url=file|3a 2f 2f 2f|etc|2f|hosts"; endswith; http.header_names; content:!"Referer"; classtype:attempted-admin; sid:2035315; rev:2; metadata:affected_product Linux, attack_target Server, created_at 2022_02_28, deployment Perimeter, former_category EXPLOIT, signature_severity Major, updated_at 2022_02_28;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Download file with BITS via LNK file (Likely Malicious)"; flow:established,from_server; file_data; content:"|4c 00 00 00|"; within:4; content:"|00|b|00|i|00|t|00|s|00|a|00|d|00|m|00|i|00|n|00|"; nocase; content:"|00|t|00|r|00|a|00|n|00|s|00|f|00|e|00|r|00|"; nocase; classtype:trojan-activity; sid:2021092; rev:2; metadata:created_at 2015_05_13, former_category MALWARE, updated_at 2015_05_13;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT VMware Spring Cloud Gateway Code Injection (CVE-2022-22947) (set)"; flow:established,to_server; flowbits:set,ET.vmware.2022.22947; http.request_line; content:"POST /actuator/gateway/routes/"; startswith; fast_pattern; http.request_body; content:"|22|filters|22 3a|"; nocase; content:"|22 23 7b|"; within:115; reference:cve,2022-22947; classtype:attempted-admin; sid:2035380; rev:2; metadata:attack_target Server, created_at 2022_03_02, cve CVE_2022_22947, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_02;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Dridex Remote Macro Download"; flow:established,from_server; file_data; content:"(Chr(77) & Chr(105) & Chr(99) & Chr(114) & Chr(111) & Chr(115) & Chr(111) & Chr(102) & Chr(116) & Chr(46) & Chr(88) & Chr(77) & Chr(76) & Chr(72) & Chr(84) & Chr(84) & Chr(80)"; nocase; classtype:trojan-activity; sid:2021093; rev:2; metadata:created_at 2015_05_13, former_category CURRENT_EVENTS, updated_at 2015_05_13;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT VMware Spring Cloud Gateway Code Injection (CVE-2022-22947)"; flow:established,to_server; flowbits:isset,ET.vmware.2022.22947; http.request_line; content:"POST /actuator/gateway/refresh"; startswith; fast_pattern; http.request_body; content:"|22|filters|22 3a|"; nocase; content:"|22 23 7b|"; within:115; reference:cve,2022-22947; classtype:attempted-admin; sid:2035381; rev:2; metadata:attack_target Server, created_at 2022_03_02, cve CVE_2022_22947, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_02;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Malware CnC)"; flow:from_server,established; content:"|55 04 03|"; content:"|0b|roobox.info"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021096; rev:3; metadata:attack_target Client_and_Server, created_at 2015_05_14, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Zabbix v5.4.0 - 5.4.8 SSO/SALM Auth Bypass (CVE-2022-23131) M1"; flow:established,to_server; http.uri; content:"/index_sso.php"; startswith; http.cookie; content:"zbx_session="; content:"InVzZXJuYW1lX2F0dHJpYnV0ZSI6"; distance:0; fast_pattern; pcre:"/(?:InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)/"; reference:url,blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage; reference:cve,2022-23131; classtype:trojan-activity; sid:2035371; rev:2; metadata:attack_target Server, created_at 2022_03_02, cve CVE_2022_23131, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_02;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Ruckguv.A SSL Cert"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|11 21 e9 a1 69 3a 6e e9 a8 fb a3 ba 5b ee 9d 6e 60 02|"; fast_pattern; content:"|55 04 03|"; content:"|15|elyseeinvestments.com"; distance:1; within:22; reference:md5,1225b8c9b52d4828b9031267939e8260; classtype:trojan-activity; sid:2021097; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_14, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Zabbix v5.4.0 - 5.4.8 SSO/SALM Auth Bypass (CVE-2022-23131) M2"; flow:established,to_server; http.uri; content:"/index_sso.php"; startswith; http.cookie; content:"zbx_session="; content:"J1c2VybmFtZV9hdHRyaWJ1dGUiO"; distance:0; fast_pattern; pcre:"/(?:InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)/"; reference:url,blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage; reference:cve,2022-23131; classtype:trojan-activity; sid:2035372; rev:2; metadata:created_at 2022_03_02, cve CVE_2022_23131, updated_at 2022_03_02;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Win32/Troldesh.A SSL Cert"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|00 bf 81 b3 c2 61 36 e4 9d|"; fast_pattern; content:"|55 04 03|"; content:"|16|www.jyxc3nn7eu2iqd.net"; distance:1; within:23; reference:md5,3358793e79042faa2298856373e644dc; classtype:trojan-activity; sid:2021098; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_15, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Zabbix v5.4.0 - 5.4.8 SSO/SALM Auth Bypass (CVE-2022-23131) M3"; flow:established,to_server; http.uri; content:"/index_sso.php"; startswith; http.cookie; content:"zbx_session="; content:"idXNlcm5hbWVfYXR0cmlidXRlIj"; distance:0; fast_pattern; pcre:"/(?:InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)/"; reference:url,blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage; reference:cve,2022-23131; classtype:trojan-activity; sid:2035373; rev:2; metadata:created_at 2022_03_02, cve CVE_2022_23131, updated_at 2022_03_02;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Rofin.A CnC traffic (OUTBOUND)"; flow:to_server,established; dsize:>11; content:"|dd aa 99 66|"; depth:4; byte_jump:4,4,relative,little,from_beginning, post_offset -2; isdataat:!2,relative; reference:md5,6b71398418c7c6b01cf8abb105bc884d; classtype:command-and-control; sid:2020671; rev:3; metadata:created_at 2015_03_11, former_category MALWARE, updated_at 2015_03_11;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine (Log Poisoning) (CVE-2020-16152) M1"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/login.php5"; http.request_body; content:"|3c 3f|php|20|system|28 24 5f|POST|5b 27|"; nocase; fast_pattern; reference:cve,2020-16152; classtype:attempted-admin; sid:2035401; rev:2; metadata:attack_target Server, created_at 2022_03_07, cve CVE_2020_16152, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_07;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex CnC)"; flow:established,from_server; content:"|55 04 08|"; content:"|07|Glasgow"; distance:1; within:8; content:"|55 04 07|"; distance:0; content:"|06|Glasgo"; distance:1; within:7; content:"|55 04 0a|"; distance:0; content:"|0b|Green Peace"; distance:1; within:12; reference:md5,3cecc935eb92ed03dc9908fc96b0f795; classtype:domain-c2; sid:2021102; rev:2; metadata:attack_target Client_and_Server, created_at 2015_05_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine (LFI) (CVE-2020-16152) M2"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/action.php5"; http.request_body; content:"|2f 2e 2e 2f 2e 2e|"; fast_pattern; content:"/tmp/messages"; reference:cve,2020-16152; classtype:attempted-admin; sid:2035402; rev:2; metadata:attack_target Server, created_at 2022_03_07, cve CVE_2020_16152, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_07;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ransomware CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ea 29 4d 2c d5 53 a8 8e|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:command-and-control; sid:2021109; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_16, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, tag Ransomware, updated_at 2016_07_01, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Azure Automation Authentication Bypass"; flow:established,to_server; http.uri; content:"/oauth2/token"; http.request_body; content:"resource"; content:"management.azure.com"; within:60; fast_pattern; http.header; content:"metadata"; nocase; content:!"X-IDENTITY-HEADER"; nocase; reference:url,orca.security/resources/blog/autowarp-microsoft-azure-automation-service-vulnerability/; classtype:attempted-admin; sid:2035403; rev:2; metadata:attack_target Server, created_at 2022_03_07, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_07;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE TROJ_NAIKON.A SSL Cert"; flow:established,from_server; content:"|55 04 03|"; content:"|04|donc"; fast_pattern; distance:1; within:5; content:"|55 04 0b|"; content:"|03|abc"; distance:1; within:4; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/targeted-attack-campaign-hides-behind-ssl-communication/; classtype:trojan-activity; sid:2016795; rev:5; metadata:attack_target Client_Endpoint, created_at 2013_04_27, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Interactsh CnC Activity"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"|2e|php|3f|Event|3d|"; fast_pattern; pcre:"/^(?:\x3b|\x0a|\x26|\x60|\x7C|\x24)/R"; http.header_names; content:!"Referer"; threshold:type limit, seconds 600, count 5, track by_src; reference:url,unit42.paloaltonetworks.com/exploits-interactsh/; classtype:attempted-admin; sid:2034200; rev:3; metadata:affected_product Web_Server_Applications, attack_target Server, created_at 2021_10_15, cve CVE_2020_28188, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_03_09;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DNSChanger EK Secondary Landing May 12 2015 M2"; flow:established,from_server; file_data; content:"&|22|+DetectRTC.isWebSocketsSupported+|22|&|22|+"; nocase; content:"CryptoJSAesJson"; nocase; classtype:exploit-kit; sid:2021110; rev:2; metadata:created_at 2015_05_16, updated_at 2015_05_16;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Oracle Access Manager RCE Attempt (CVE-2021-35587)"; flow:established,to_server; http.request_line; content:"POST /oam/server/opensso/sessionservice HTTP/1.1"; fast_pattern; http.request_body; content:"svcid"; content:"|5b|CDATA"; content:"requester|3d|"; distance:0; nocase; reference:cve,2021-35587; classtype:attempted-admin; sid:2035429; rev:2; metadata:attack_target Server, created_at 2022_03_10, cve CVE_2021_35587, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_10;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; within:30; content:"|55 04 0a|"; distance:0; content:"|13|Widgets Numbers PTY"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021112; rev:2; metadata:attack_target Client_and_Server, created_at 2015_05_18, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Netgear R6260 Mini_httpd Buffer Overflow Attempt - Possible RCE (CVE-2021-34979)"; flow:established,to_server; http.header; content:"SOAPAction|3a 20|"; content:"urn:NETGEAR-ROUTER:service:"; within:30; fast_pattern; content:!"|0d 0a|"; within:131; pcre:"/^SOAPAction\x3a\x20\x22?urn\x3aNETGEAR-ROUTER\x3aservice\x3a.{128,}(?!:\d#)/Hm"; http.request_body; content:"|3c 3f|xml"; startswith; reference:url,nstarke.github.io/netgear/nday/2022/03/13/reverse-engineering-a-netgear-nday.html; reference:cve,2021-34979; classtype:trojan-activity; sid:2035446; rev:1; metadata:attack_target Networking_Equipment, created_at 2022_03_14, cve CVE_2021_34979, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2022_03_14;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|14|srv2415.domain.local"; distance:1; within:21; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021113; rev:2; metadata:attack_target Client_and_Server, created_at 2015_05_18, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT TP-LINK TL-WR840N RCE Inbound (CVE-2022-25064)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cgi?2&2"; fast_pattern; http.request_body; content:"|0d 0a|X_TP_FirewallEnabled"; content:"|0d 0a|X_TP_ExternalIPv6Address="; distance:0; pcre:"/^(?:\x3b|\x0a|\x26|\x60|\x7C|\x24)/R"; reference:cve,2022-25064; classtype:attempted-admin; sid:2035455; rev:1; metadata:created_at 2022_03_15, cve CVE_2022_25064, former_category EXPLOIT, updated_at 2022_03_15;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; within:30; content:"|55 04 0a|"; distance:0; content:"|11|Facebook Porn PTY"; distance:1; within:18; classtype:domain-c2; sid:2021106; rev:3; metadata:attack_target Client_and_Server, created_at 2015_05_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Internet Explorer Memory Corruption Vulnerability (CVE-2015-2444)"; flow:from_server,established; file_data; content:"|3c 66 6f 72 6d 3e 3c 73 74 79 6c 65 3e 66 6f 72 6d 7b 2d 6d 73 2d 62 65 68 61 76 69 6f 72 3a 75 72 6c 28 22 63 22 29 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 66 6f 72 6d 3e|"; nocase; fast_pattern; reference:cve,2015-2444; classtype:attempted-user; sid:2021713; rev:4; metadata:created_at 2015_08_25, updated_at 2022_03_17;) -#alert ip $HOME_NET any -> [199.2.137.0/24,207.46.90.0/24] any (msg:"ET MALWARE Connection to Microsoft Sinkhole IP (Possbile Infected Host)"; threshold:type limit,track by_src,seconds 3600,count 1; classtype:trojan-activity; sid:2016999; rev:4; metadata:created_at 2013_06_11, updated_at 2013_06_11;) +alert smb any any -> $HOME_NET any (msg:"ET EXPLOIT Possible Successful ETERNALROMANCE MS17-010 - Windows Executable Observed"; flow:to_server,established; flowbits:isset,ETPRO.ETERNALROMANCE; content:"|FF|SMB|26 00 00 00 00|"; offset:4; depth:9; content:"|4d 5a|"; distance:0; content:"This program cannot be run"; nocase; distance:0; fast_pattern; classtype:trojan-activity; sid:2024207; rev:3; metadata:attack_target SMB_Server, created_at 2017_04_17, deployment Internal, former_category EXPLOIT, signature_severity Critical, updated_at 2022_03_17;) -alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"ET MALWARE DNS Reply Sinkhole - Microsoft - 131.253.18.11-12"; content:"|00 01 00 01|"; content:"|00 04 83 fd 12|"; distance:4; within:5; byte_test:1,>,10,0,relative; byte_test:1,<,13,0,relative; threshold: type limit, count 1, seconds 120, track by_src; classtype:trojan-activity; sid:2016101; rev:6; metadata:created_at 2012_12_28, updated_at 2012_12_28;) +#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Java Exploit Campaign SetAttribute Java Applet"; flow:established,to_client; file_data; content:"document.createElement(|22|applet|22|)|3B|"; fast_pattern; distance:0; nocase; content:".setAttribute(|22|code"; distance:0; nocase; content:".class|22 29 3B|"; nocase; within:50; content:".setAttribute(|22|archive"; nocase; distance:0; content:"document.createElement|22|param"; nocase; distance:0; reference:url,ondailybasis.com/blog/?p=1593; classtype:trojan-activity; sid:2015883; rev:3; metadata:created_at 2012_11_14, former_category CURRENT_EVENTS, updated_at 2022_03_17;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible APT17 CnC Content in Public Website"; flow:from_server,established; file_data; content:"@MICR0S0FT"; pcre:"/^[a-zA-Z0-9]{8}/R"; content:"C0RP0RATI0N"; within:11; reference:url,github.com/fireeye/iocs/tree/master/APT17; classtype:targeted-activity; sid:2021116; rev:2; metadata:created_at 2015_05_19, former_category MALWARE, updated_at 2015_05_19;) +alert smb any any -> $HOME_NET any (msg:"ET EXPLOIT Possible ETERNALBLUE MS17-010 Heap Spray"; flow:to_server,established; content:"|ff|SMB|33 00 00 00 00 18 07 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 08 ff fe 00 08|"; offset:4; depth:30; fast_pattern; content:"|00 09 00 00 00 10|"; distance:1; within:6; content:"|00 00 00 00 00 00 00 10|"; within:8; content:"|00 00 00 10|"; distance:4; within:4; pcre:"/^[a-zA-Z0-9+/]{1000,}/R"; threshold: type both, track by_src, count 3, seconds 30; classtype:trojan-activity; sid:2024217; rev:4; metadata:attack_target SMB_Server, created_at 2017_04_17, deployment Internal, former_category EXPLOIT, signature_severity Critical, updated_at 2022_03_17;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 c2 19 ef 92 11 51 27 f3|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021121; rev:2; metadata:attack_target Client_and_Server, created_at 2015_05_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Firefox PDF.js Same-Origin-Bypass CVE-2015-4495 M1"; flow:established,from_server; file_data; content:"|76 69 65 77 2d 73 6f 75 72 63 65 3a|"; nocase; content:"|61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 6f 7a 2d 70 6c 61 79 70 72 65 76 69 65 77 2d 70 64 66 6a 73|"; fast_pattern; nocase; content:"|73 61 6e 64 62 6f 78 43 6f 6e 74 65 78 74|"; nocase; content:"return "; pcre:"/\We[\s\x22\x27,+]*?v[\s\x22\x27,+]*?a[\s\x22\x27,+]*?l\W/"; reference:cve,2015-4495; classtype:attempted-user; sid:2021601; rev:3; metadata:created_at 2015_08_10, updated_at 2022_03_17;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Angler EK XTEA encrypted binary (24)"; flow:established,to_client; file_data; content:"|51 cb 7b fc 19 9b 77 fb|"; distance:40; within:8; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2021126; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_05_21, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Angler, signature_severity Critical, tag Angler, tag Exploit_Kit, updated_at 2018_06_18;) +alert tcp any any -> $HOME_NET 88 (msg:"ET EXPLOIT Possible GoldenPac Priv Esc in-use"; flow:established,to_server; content:"|a0 07 03 05 00 50 80 00 00|"; content:"|a8 05 30 03 02 01 17|"; endswith; threshold: type limit, track by_src, seconds 60, count 1; reference:url,code.google.com/p/impacket/source/browse/trunk/examples/goldenPac.py; reference:cve,CVE-2014-6324; classtype:attempted-admin; sid:2019922; rev:4; metadata:created_at 2014_12_12, updated_at 2022_03_24;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Angler EK XTEA encrypted binary (25)"; flow:established,to_client; file_data; content:"|51 cb 7b fc 19 9b 77 fb|"; distance:1424; within:8; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2021127; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_05_21, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Angler, signature_severity Critical, tag Angler, tag Exploit_Kit, updated_at 2018_06_18;) +alert tcp any any -> $HOME_NET 445 (msg:"ET EXPLOIT Samba Arbitrary Module Loading Vulnerability M2 (NT Create AndX .so) (CVE-2017-7494)"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"|05 00|"; distance:8; within:2; content:"|00 2e 00 73 00 6f 00|"; fast_pattern; endswith; reference:cve,2017-7494; classtype:attempted-admin; sid:2024384; rev:3; metadata:affected_product Linux, attack_target Server, created_at 2017_06_16, deployment Perimeter, deployment Internal, former_category EXPLOIT, performance_impact Moderate, signature_severity Major, updated_at 2022_03_24;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE JavaScriptBackdoor SSL Cert"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 b7 2f ae e8 e2 55 b5 bf|"; distance:0; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|My Company Ltd"; distance:1; within:15; reference:md5,2a63b3a621d8e555734582d83b5e06a5; classtype:trojan-activity; sid:2021134; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_21, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Observed Orange LiveBox Router Information Leakage Attempt (CVE-2018-20377)"; flow:established,to_server; http.request_line; content:"GET|20|"; startswith; content:"/get_getnetworkconf.cgi|20|HTTP/1.1"; fast_pattern; endswith; http.header_names; content:!"Referer"; reference:url,badpackets.net/over-19000-orange-livebox-adsl-modems-are-leaking-their-wifi-credentials; reference:cve,2018-20377; classtype:trojan-activity; sid:2029091; rev:2; metadata:affected_product Router, attack_target Client_Endpoint, created_at 2019_12_03, deployment Perimeter, former_category EXPLOIT, signature_severity Major, updated_at 2022_03_24;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Likely Dridex SSL Cert"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; within:30; content:"|55 04 08|"; distance:0; content:"|07|Montana"; distance:1; within:8; content:"|55 04 07|"; distance:0; content:"|09|Liverpool"; distance:1; within:10; content:"|55 04 03|"; distance:0; content:"|0e|southnorth.org"; distance:1; within:15; fast_pattern; reference:md5,440e5c0aee33cba3c4707ada0856ff6d; classtype:trojan-activity; sid:2021145; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_26, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Microsoft SQL RCE Attempt (CVE-2020-0618)"; flow:established,to_server; urilen:37; http.method; content:"POST"; http.uri; content:"/ReportServer/pages/ReportViewer.aspx"; http.request_body; content:"NavigationCorrector|24|PageState|3d|NeedsCorrection|26|NavigationCorrector|24|ViewState|3d|"; startswith; fast_pattern; content:"|26 5f 5f|VIEWSTATE|3d|"; endswith; http.header_names; content:!"Referer|0d 0a|"; reference:url,github.com/euphrat1ca/CVE-2020-0618; classtype:web-application-attack; sid:2029476; rev:2; metadata:affected_product Web_Server_Applications, attack_target Client_Endpoint, created_at 2020_02_18, deployment Perimeter, former_category ATTACK_RESPONSE, signature_severity Major, updated_at 2022_03_24;) -alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Linux/Moose Telnet CnC Beacon"; flow:established,to_server; dsize:40; content:"|0e 00 00 00|"; offset:4; depth:4; fast_pattern; content:!"|00|"; within:1; content:!"|00|"; distance:3; within:1; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; distance:4; within:28; content:!"|00 00 00 00|"; depth:4; reference:url,welivesecurity.com/wp-content/uploads/2015/05/Dissecting-LinuxMoose.pdf; classtype:command-and-control; sid:2021149; rev:1; metadata:attack_target Client_Endpoint, created_at 2015_05_26, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_05_26, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +alert http $EXTERNAL_NET any -> any any (msg:"ET EXPLOIT Online Scheduling System 1.0 - Authentication Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/Online%20Scheduling%20System/login.php"; fast_pattern; http.request_body; content:"username="; depth:9; nocase; content:"&password="; nocase; distance:0; content:"&lgn=Login"; nocase; endswith; reference:url,www.exploit-db.com/exploits/48409; classtype:attempted-admin; sid:2030094; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Web_Server, created_at 2020_05_04, deployment Perimeter, signature_severity Major, updated_at 2022_03_24;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Likely Malicious Redirect SSL Cert"; flow:established,from_server; content:"|55 04 03|"; content:"|14|formationtraffic.com"; distance:1; within:21; classtype:trojan-activity; sid:2021146; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_05_26, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2019_09_10;) +#alert dns $EXTERNAL_NET any -> any any (msg:"ET EXPLOIT Possible DNS BIND TSIG Denial of Service Attempt (CVE-2020-8617)"; content:"|00|"; distance:0; byte_extract:1,1,rec_name,relative; content:"|00 00 fa 00 ff|"; distance:rec_name; within:5; fast_pattern; content:"|00 10 00 00|"; endswith; reference:cve,2020-8617; classtype:denial-of-service; sid:2030221; rev:2; metadata:attack_target DNS_Server, created_at 2020_05_26, deployment Datacenter, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2022_03_24;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|17|ns343677.ip-94-23-16.eu"; distance:1; within:24; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021154; rev:3; metadata:attack_target Client_and_Server, created_at 2015_05_28, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT D-Link Router DNS Changer Exploit Attempt"; flow:established,to_server; http.uri; content:"/dnscfg.cgi?dnsPrimary="; fast_pattern; content:"&dnsSecondary="; distance:0; content:"&dnsDynamic=0&dnsRefresh=1"; endswith; reference:url,csirt.bank.gov.ua/en/news/44; classtype:attempted-admin; sid:2027906; rev:4; metadata:attack_target Client_Endpoint, created_at 2019_08_23, deployment Perimeter, former_category EXPLOIT, performance_impact Moderate, signature_severity Major, updated_at 2022_03_24;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Yakes CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 bd 4b 4b 98 c9 8b 2f 20|"; within:35; content:"|2a 86 48 86 f7 0d 01 09 01|"; distance:0; content:"|13|webmaster@localhost"; distance:1; within:20; reference:md5,6cdd93dcb1c54a4e2b036d2e13b51216; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021155; rev:2; metadata:attack_target Client_and_Server, created_at 2015_05_28, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT TOTOLINK Router DNS Changer Exploit Attempt"; flow:established,to_server; http.uri; content:"/boafrm/formbasetcpipsetup?dnsmode=dnsmanual&dns1="; fast_pattern; content:"&dns2="; distance:0; content:"&dns3="; distance:0; content:"&dnsrefresh=1"; endswith; reference:url,csirt.bank.gov.ua/en/news/44; classtype:attempted-admin; sid:2027910; rev:4; metadata:attack_target Client_Endpoint, created_at 2019_08_23, deployment Perimeter, former_category EXPLOIT, performance_impact Moderate, signature_severity Major, updated_at 2022_03_24;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Evil JS iframe Embedded In GIF"; flow:established,from_server; file_data; content:"GIF89a="; nocase; within:8; content:"|3b|url="; nocase; distance:0; content:"iframe"; nocase; distance:0; content:"|3b|tail="; nocase; distance:0; fast_pattern; classtype:trojan-activity; sid:2021156; rev:2; metadata:created_at 2015_05_28, updated_at 2015_05_28;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT DSLink 260E Router DNS Changer Exploit Attempt"; flow:established,to_server; http.uri; content:"/action?dns_status=1&dns_poll_timeout="; fast_pattern; content:"&id="; distance:0; content:"&dns_serv_ip_1="; distance:0; content:"&dns_serv_ip_2="; distance:0; content:"&dns_serv_ip_3="; distance:0; content:"&dns_serv_ip_4="; distance:0; content:"&priority=1&cmdadd=add"; endswith; reference:url,csirt.bank.gov.ua/en/news/44; classtype:attempted-admin; sid:2027908; rev:8; metadata:attack_target Client_Endpoint, created_at 2019_08_23, deployment Perimeter, former_category EXPLOIT, performance_impact Moderate, signature_severity Major, updated_at 2022_03_24;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED External IP Lookup - whoer.net"; flow:established,to_server; content:"Host|3a 20|whoer.net|0d 0a|"; http_header; content:!"Referer|3a|"; http_header; classtype:external-ip-check; sid:2021161; rev:2; metadata:created_at 2015_05_29, updated_at 2015_05_29;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT FatPipe Unrestricted File Upload"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/fpui/"; nocase; fast_pattern; content:"|2e|jsp"; within:30; endswith; reference:url,ic3.gov/Media/News/2021/211117-2.pdf; classtype:attempted-admin; sid:2034531; rev:3; metadata:created_at 2021_11_22, updated_at 2022_03_24;) -alert udp $HOME_NET 5093 -> $EXTERNAL_NET any (msg:"ET DOS Possible Sentinal LM Application attack in progress Outbound (Response)"; dsize:>1390; content:"|7a 00 00 00 00 00 00 00 00 00 00 00|"; depth:12; threshold: type both,track by_src,count 10,seconds 60; classtype:attempted-dos; sid:2021170; rev:1; metadata:created_at 2015_05_29, updated_at 2015_05_29;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT NodeBB Path Traversal (CVE-2021-43788)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"nodebb|2e|org|2f 3f 5b 5b 2e 2e 2f|"; nocase; fast_pattern; content:"|3a|"; content:"|5d 5d|"; within:50; endswith; reference:url,blog.sonarsource.com/nodebb-remote-code-execution-with-one-shot; reference:cve,2021-43788; classtype:attempted-admin; sid:2034590; rev:2; metadata:attack_target Server, created_at 2021_12_06, cve CVE_2021_43788, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_24;) -alert udp $EXTERNAL_NET 5093 -> $HOME_NET any (msg:"ET DOS Possible Sentinal LM Amplification attack (Response) Inbound"; dsize:>1390; content:"|7a 00 00 00 00 00 00 00 00 00 00 00|"; depth:12; threshold: type both,track by_src,count 10,seconds 60; classtype:attempted-dos; sid:2021171; rev:1; metadata:created_at 2015_05_29, updated_at 2015_05_29;) +alert tcp-pkt any any -> [$HTTP_SERVERS,$HOME_NET] 1024: (msg:"ET EXPLOIT Zerologon Phase 3/3 - Malicious NetrServerPasswordSet2 (CVE-2020-1472)"; flow:established,to_server; flowbits:isset,dcerpc.rpcnetlogon; flowbits:isset,dcerpc.rpcnetlogon.netrsrvreqchal.nullcc; content:"|05 00 00|"; startswith; content:"|1e 00|"; offset:22; depth:2; content:"|24 00 00 00 06|"; distance:0; fast_pattern; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; endswith; reference:url,www.secura.com/blog/zero-logon; reference:url,dirkjanm.io/a-different-way-of-abusing-zerologon/; reference:cve,2020-1472; reference:url,thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/; classtype:attempted-admin; sid:2035262; rev:3; metadata:attack_target Server, created_at 2022_02_22, cve CVE_2020_1472, deployment Internal, former_category EXPLOIT, performance_impact Significant, signature_severity Major, updated_at 2022_03_24;) -alert udp $EXTERNAL_NET any -> $HOME_NET 5093 (msg:"ET DOS Possible Sentinal LM Amplification attack (Request) Inbound"; dsize:6; content:"|7a 00 00 00 00 00|"; threshold: type both,track by_dst,count 10,seconds 60; classtype:attempted-dos; sid:2021172; rev:1; metadata:created_at 2015_05_29, updated_at 2015_05_29;) +alert smb $HOME_NET any -> any any (msg:"ET EXPLOIT Possible ETERNALCHAMPION MS17-010 Sync Response"; flow:from_server,established; flowbits:isset,ET.ETERNALCHAMPIONsync; content:"|ff|SMB|25 00 00 00 00 98 03 c0 00 00 00 00 00 00 00 00 00 00 00 00|"; offset:4; depth:24; fast_pattern; content:"|7c 00|"; distance:32; within:2; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; within:20; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; distance:100; within:20; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; distance:100; within:20; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; distance:100; within:20; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; endswith; classtype:trojan-activity; sid:2024213; rev:5; metadata:attack_target SMB_Server, created_at 2017_04_17, deployment Internal, former_category EXPLOIT, signature_severity Critical, updated_at 2022_03_24;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Downloader CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ea d4 96 1c 0a 8b 6f a4|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021175; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_02, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT WatchGuard CVE-2022-26318 RCE Attempt M1"; flow:established,to_server; http.request_line; content:"POST /agent/login"; startswith; nocase; http.request_body; content:"|3c|methodName|3e|"; content:"login|3c 2f|methodName|3e|"; within:50; fast_pattern; nocase; content:"|3c|member|3e 3c|value|3e 3c|"; distance:0; nocase; content:!"|3e|"; within:400; reference:url,www.greynoise.io/blog/watchguard-cve-2022-26318-rce-detection-iocs-and-prevention-for-defenders; reference:cve,2022-26318; classtype:attempted-admin; sid:2035633; rev:2; metadata:attack_target Networking_Equipment, created_at 2022_03_29, cve CVE_2022_26318, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category EXPLOIT, signature_severity Major, updated_at 2022_03_29;) -alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible BlackEnergy Accessing SMB/SMB2 Named Pipe (ASCII)"; flow:to_server,established; content:"SMB"; offset:5; depth:4; content:"{AA0EED25-4167-4CBB-BDA8-9A0F5FF93EA8}"; distance:0; nocase; reference:url,cyberx-labs.com/wp-content/uploads/2015/05/BlackEnergy-CyberX-Report_27_May_2015_FINAL.pdf; classtype:trojan-activity; sid:2021179; rev:1; metadata:created_at 2015_06_04, updated_at 2015_06_04;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT WatchGuard CVE-2022-26318 RCE Attempt M2"; flow:established,to_server; http.request_line; content:"POST /agent/login"; startswith; fast_pattern; http.content_len; byte_test:0,>,450,0,string,dec; http.request_body; content:"|3c|methodName|3e|"; nocase; content:"login|3c 2f|methodName|3e|"; within:50; nocase; reference:url,attackerkb.com/topics/t8Nrnu99ZE/cve-2022-26318; reference:url,www.greynoise.io/blog/watchguard-cve-2022-26318-rce-detection-iocs-and-prevention-for-defenders; reference:cve,2022-26318; classtype:attempted-admin; sid:2035634; rev:2; metadata:attack_target Networking_Equipment, created_at 2022_03_29, cve CVE_2022_26318, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2022_03_29;) -alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible BlackEnergy Accessing SMB/SMB2 Named Pipe (Unicode)"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"{|00|A|00|A|00|0|00|E|00|E|00|D|00|2|00|5|00|-|00|4|00|1|00|6|00|7|00|-|00|4|00|C|00|B|00|B|00|-|00|B|00|D|00|A|00|8|00|-|00|9|00|A|00|0|00|F|00|5|00|F|00|F|00|9|00|3|00|E|00|A|00|8|00|}"; distance:0; nocase; reference:url,cyberx-labs.com/wp-content/uploads/2015/05/BlackEnergy-CyberX-Report_27_May_2015_FINAL.pdf; classtype:trojan-activity; sid:2021180; rev:1; metadata:created_at 2015_06_04, updated_at 2015_06_04;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible WatchGuard CVE-2022-26318 RCE Attempt M3"; flow:established,to_server; http.request_line; content:"POST /agent/login"; startswith; fast_pattern; http.content_len; byte_test:0,>,450,0,string,dec; http.header; content:"Content-Encoding|3a 20|gzip"; http.request_body; content:"|1f 8b|"; startswith; reference:url,attackerkb.com/topics/t8Nrnu99ZE/cve-2022-26318; reference:url,www.greynoise.io/blog/watchguard-cve-2022-26318-rce-detection-iocs-and-prevention-for-defenders; reference:cve,2022-26318; classtype:attempted-admin; sid:2035635; rev:2; metadata:attack_target Networking_Equipment, created_at 2022_03_29, cve CVE_2022_26318, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category EXPLOIT, signature_severity Major, updated_at 2022_03_29;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; within:30; content:"|55 04 0a|"; distance:0; content:"|0b|YouPorn Ltd"; distance:1; within:12; content:"|55 04 03|"; distance:0; content:"|0b|pornhub.xxx"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021186; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_05, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Microsoft Exchange Pre-Auth Path Confusion M1 (CVE-2021-31207)"; flow:established,to_server; http.uri; content:"/autodiscover"; nocase; fast_pattern; content:"Email=autodiscover/"; nocase; flowbits:set,ET.cve.2021.34473; reference:cve,2021-31207; classtype:attempted-admin; sid:2033681; rev:4; metadata:affected_product MS_Exchange, attack_target Server, created_at 2021_08_09, cve CVE_2021_31207, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_29;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Angler EK Exploit URI Struct May 28 2015 M1"; flow:to_server,established; urilen:>51; content:"."; http_uri; offset:49; depth:1; content:!"/"; http_uri; offset:1; pcre:"/^\/(?=[a-z0-9_-]{0,47}?[A-Z][a-z0-9_-]{0,46}?[A-Z])(?=[A-Z0-9_-]{0,47}?[a-z][A-Z0-9_-]{0,46}?[a-z])(?=[A-Za-z_-]{0,47}?[0-9][A-Za-z_-]{0,46}?[0-9])[A-Za-z0-9_-]{48}\.[a-z]{2,25}\d?\??/U"; pcre:"/^Referer\x3a\x20http\x3a\x2f\x2f?[^\x2f]+\/[a-z]{3,20}((?P[_-]?)[a-z]{3,20}(?P=sep)(?:[a-z]{3,20}(?P=sep))?)?[a-z]{3,20}\/\d{10,20}(?:\x3a\d{1,5})?\r$/Hm"; flowbits:set,AnglerEK.Struct; classtype:exploit-kit; sid:2021157; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_05_28, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Angler, signature_severity Critical, tag Angler, tag Exploit_Kit, updated_at 2018_06_18;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Microsoft Exchange SUID Disclosure via SSRF Inbound M1 (CVE-2021-31207)"; flow:established,to_server; http.uri; content:"/autodiscover"; nocase; content:"Email=autodiscover/"; nocase; content:"/mapi/emsmdb"; nocase; distance:0; fast_pattern; reference:cve,2021-31207; classtype:attempted-admin; sid:2033701; rev:3; metadata:affected_product MS_Exchange, attack_target Server, created_at 2021_08_10, cve CVE_2021_31207, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_29;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0b|povawfas.us"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021192; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Microsoft Exchange SUID Disclosure via SSRF Inbound M2 (CVE-2021-31207)"; flow:established,to_server; http.uri; content:"/autodiscover"; nocase; content:"/mapi/emsmdb"; nocase; distance:0; fast_pattern; http.cookie; content:"Email=autodiscover/"; nocase; reference:cve,2021-31207; classtype:attempted-admin; sid:2035648; rev:2; metadata:affected_product MS_Exchange, attack_target Server, created_at 2022_03_29, cve CVE_2021_31207, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_29;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gootkit CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 fb 01 dc 12 42 31 23 93|"; distance:0; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|My Company Ltd"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021193; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Microsoft Exchange RCE Inbound M2 (CVE-2021-34473)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/autodiscover.json?"; content:"/PowerShell/"; nocase; distance:0; content:"X-Rps-CAT="; distance:0; fast_pattern; content:"Email="; distance:0; content:"autodiscover/"; distance:0; within:20; reference:cve,2021-34473; classtype:attempted-admin; sid:2033711; rev:2; metadata:affected_product MS_Exchange, attack_target Server, created_at 2021_08_12, cve CVE_2021_34473, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_29;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Qadars WebInject SSL Cert"; flow:established,from_server; content:"|55 04 03|"; content:"|1e|www.freechristmasgifts2014.com"; distance:1; within:31; reference:md5,06588acf0112a84fe5f684bbafd7dc00; classtype:trojan-activity; sid:2021194; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_06_08, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Microsoft Exchange RCE Inbound M3 (CVE-2021-34473)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/autodiscover.json?"; content:"/PowerShell/"; nocase; distance:0; content:"X-Rps-CAT="; distance:0; fast_pattern; http.cookie; content:"Email="; content:"autodiscover/"; distance:0; within:20; reference:cve,2021-34473; classtype:attempted-admin; sid:2035649; rev:2; metadata:affected_product MS_Exchange, attack_target Server, created_at 2022_03_29, cve CVE_2021_34473, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_29;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Spy.Shiz CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|01 01|"; distance:18; within:2; content:"|55 04 03|"; distance:0; content:"|0d|web.gibnos.pw"; distance:1; within:14; reference:md5,c8131a48e834291be6c7402647250e73; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021196; rev:3; metadata:attack_target Client_and_Server, created_at 2015_06_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Microsoft Exchange Mailbox Enumeration Inbound (CVE-2021-34473)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ews/exchange.asmx"; nocase; fast_pattern; http.request_body; content:""; distance:0; content:""; distance:0; reference:cve,2021-34473; classtype:attempted-admin; sid:2035650; rev:2; metadata:affected_product MS_Exchange, attack_target Server, created_at 2022_03_29, cve CVE_2021_34473, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_29;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0b|povawer.biz"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021197; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT TerraMaster TOS Unauthenticated Command Injection Inbound M1 (CVE-2022-24989)"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/module/api.php?mobile/createRaid"; fast_pattern; http.request_body; content:"raidtype|27 3a 20 27|"; nocase; pcre:"/^(?:\x3b|\x0a|\x26|\x60|\x7c|\x24)/R"; reference:cve,2022-24989; classtype:attempted-admin; sid:2035629; rev:2; metadata:attack_target Server, created_at 2022_03_29, cve CVE_2022_24989, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_29;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0a|laxitr.biz"; distance:1; within:11; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021198; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT TerraMaster TOS Unauthenticated Command Injection Inbound M2 (CVE-2022-24989)"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/module/api.php?mobile/createRaid"; fast_pattern; http.request_body; content:"raidtype="; nocase; pcre:"/^(?:\x3b|\x0a|\x26|\x60|\x7c|\x24)/R"; reference:cve,2022-24989; classtype:attempted-admin; sid:2035630; rev:2; metadata:attack_target Server, created_at 2022_03_29, cve CVE_2022_24989, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_29;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0b|dazopla.biz"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021199; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT TerraMaster TOS Information Leak Inbound (CVE-2022-24990)"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/module/api.php?mobile/webNasIPS"; fast_pattern; reference:cve,2022-24990; classtype:attempted-recon; sid:2035631; rev:1; metadata:attack_target Server, created_at 2022_03_29, cve CVE_2022_24990, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_29;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0b|gipladfe.us"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021208; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Spring Cloud Connector RCE Inbound (CVE-2022-22963)"; flow:to_server,established; http.header; content:"spring.cloud.function.routing-expression|3a|"; fast_pattern; reference:cve,2022-22963; classtype:attempted-admin; sid:2035670; rev:1; metadata:attack_target Server, created_at 2022_03_31, cve CVE_2022_22963, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_31;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0a|lazeca.biz"; distance:1; within:11; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021209; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT NetGear R6700v3 upnpd Buffer Overflow Inbound (CVE-2022-27643)"; flow:to_server,established; http.method; content:"POST"; http.header; content:"SOAPAction|3a|"; nocase; content:"urn:NETGEARROUTER:service:ParentalControl:1#Authenticate"; fast_pattern; nocase; pcre:"/^SOAPAction\x3a\s?urn\x3aNETGEARROUTER\x3aservice\x3aParentalControl\x3a1#Authenticate/Hmi"; http.request_body; content:""; nocase; pcre:"/^[^<]{30,}<\/NewMACAddress>/Ri"; reference:url,blog.relyze.com/2022/03/cve-2022-27643-netgear-r6700v3-upnpd.html; reference:cve,2022-27643; classtype:attempted-admin; sid:2035717; rev:1; metadata:attack_target Networking_Equipment, created_at 2022_04_03, cve CVE_2022_27643, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2022_04_03;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0a|zolaxap.us"; distance:1; within:11; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021210; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert tcp any any -> $HOME_NET any (msg:"ET EXPLOIT Redis RCE Attempt (CVE-2022-0543) M1"; flow:established,to_server; content:"package|2e|loadlib|28|"; fast_pattern; content:"liblua"; distance:0; content:".popen|28|"; distance:0; reference:url,blogs.juniper.net/en-us/security/muhstik-gang-targets-redis-servers; reference:url,www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce; reference:cve,2022-0543; classtype:attempted-admin; sid:2035718; rev:2; metadata:affected_product Redis, attack_target Server, created_at 2022_04_04, cve CVE_2022_0543, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_04_04;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0c|babapoti.biz"; distance:1; within:13; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021211; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert tcp any any -> $HOME_NET any (msg:"ET EXPLOIT Possible Redis RCE Attempt - Dynamic Importing of liblua (CVE-2022-0543)"; flow:established,to_server; content:"package|2e|loadlib|28|"; fast_pattern; content:"liblua"; within:500; reference:url,blogs.juniper.net/en-us/security/muhstik-gang-targets-redis-servers; reference:url,www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce; reference:cve,2022-0543; classtype:attempted-admin; sid:2035720; rev:2; metadata:affected_product Redis, created_at 2022_04_04, cve CVE_2022_0543, former_category EXPLOIT, updated_at 2022_04_04;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|09|poknop.us"; distance:1; within:10; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021212; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert tcp any any -> $HOME_NET any (msg:"ET EXPLOIT Redis RCE Attempt (CVE-2022-0543) M2"; flow:established,to_server; content:"package|2e|loadlib|28|"; fast_pattern; content:"liblua"; within:500; content:".execute|28|"; distance:0; reference:url,blogs.juniper.net/en-us/security/muhstik-gang-targets-redis-servers; reference:url,www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce; reference:cve,2022-0543; classtype:attempted-admin; sid:2035719; rev:2; metadata:affected_product Redis, attack_target Server, created_at 2022_04_04, cve CVE_2022_0543, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_04_04;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Executable Downloaded from Google Cloud Storage"; flow:established,to_client; content:"x-goog-generation|3a 20|"; http_header; fast_pattern; content:"x-goog-metageneration|3a 20|"; http_header; content:"x-goog-stored-content-encoding|3a 20|"; http_header; content:"x-goog-stored-content-length|3a 20|"; http_header; content:"x-goog-hash|3a 20|"; http_header; file_data; content:"MZ"; within:2; reference:md5,e742e844d0ea55ef9f1c68491c702120; classtype:trojan-activity; sid:2021216; rev:3; metadata:created_at 2015_06_09, updated_at 2015_06_09;) +alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Gitlab Login Attempt with hard-coded password (CVE-2022-1162)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/users/sign_in"; http.request_body; content:"&user%5Bpassword%5D=123qweQWE%21%40%23"; fast_pattern; pcre:"/^0+(?:&|$)/R"; reference:url,about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-released/#static-passwords-inadvertently-set-during-omniauth-based-registration; reference:cve,2022-1162; classtype:attempted-user; sid:2035750; rev:1; metadata:attack_target Server, created_at 2022_04_05, cve CVE_2022_1162, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_04_05;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Likely Evil JS used in Unknown EK Landing"; flow:established,from_server; file_data; content:"|74 3d 75 74 66 38 74 6f 31 36 28 78 78 74 65 61 5f 64 65 63 72 79 70 74 28 62 61 73 65 36 34 64 65 63 6f 64 65 28 74 29 2c|"; nocase; classtype:exploit-kit; sid:2021217; rev:2; metadata:created_at 2015_06_09, updated_at 2015_06_09;) +alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Gitlab Login Attempt with hard-coded password (CVE-2022-1162)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/users/sign_in"; http.request_body; content:"|26|user|5b|password|5d 3d|123qweQWE|21 40 23|"; fast_pattern; pcre:"/^0+(?:&|$)/R"; reference:url,about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-released/#static-passwords-inadvertently-set-during-omniauth-based-registration; reference:cve,2022-1162; classtype:attempted-user; sid:2035751; rev:1; metadata:attack_target Server, created_at 2022_04_05, cve CVE_2022_1162, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_04_05;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|55 04 03|"; content:"|10|www.carinsup.com"; distance:1; within:17; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021220; rev:3; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Totolink - Command Injection Attempt Inbound (CVE-2022-26210)"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/cgi-bin/cstecgi.cgi"; http.request_body; content:"setUpgradeFW"; fast_pattern; content:"FileName|3a 20 3a|"; distance:0; pcre:"/^(?:\x3b|\x0a|\x26|\x60|\x7c|\x24)/R"; reference:cve,2022-26210; classtype:attempted-admin; sid:2035744; rev:2; metadata:attack_target Networking_Equipment, created_at 2022_04_05, cve CVE_2022_26210, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2022_04_05;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0a|polasde.us"; distance:1; within:11; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021221; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Totolink - Command Injection Attempt Inbound (CVE-2022-26186)"; flow:to_server,established; http.uri; content:"/cgi-bin/cstecgi.cgi?exportOvpn"; fast_pattern; content:"="; pcre:"/^(?:\x3b|\x0a|\x26|\x60|\x7c|\x24)/R"; reference:cve,2022-26186; classtype:attempted-admin; sid:2035745; rev:1; metadata:attack_target Networking_Equipment, created_at 2022_04_05, cve CVE_2022_26186, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2022_04_05;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0a|paxerba.us"; distance:1; within:11; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021222; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Totolink - Command Injection Attempt Inbound (CVE-2022-25075)"; flow:to_server,established; http.uri; content:"/cgi-bin/downloadFlile.cgi"; fast_pattern; content:"="; pcre:"/^(?:\x3b|\x0a|\x26|\x60|\x7c|\x24)/R"; reference:cve,2022-25075; classtype:attempted-admin; sid:2035746; rev:1; metadata:attack_target Networking_Equipment, created_at 2022_04_05, cve CVE_2022_25075, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2022_04_05;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0b|molared.biz"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021223; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT D-Link - RCE Attempt Inbound (CVE-2021-45382)"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/ddns_check.ccp"; fast_pattern; http.request_body; content:"&ddnsHostName="; pcre:"/^(?:\x3b|\x0a|\x26|\x60|\x7c|\x24)/R"; reference:cve,2021-45382; classtype:attempted-admin; sid:2035747; rev:1; metadata:attack_target Networking_Equipment, created_at 2022_04_05, cve CVE_2021_45382, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2022_04_05;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0b|halowsin.us"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021224; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 1 Pattern Set Inbound (CVE-2022-22965)"; flow:to_server,established; http.uri; content:"pipeline.first.pattern="; fast_pattern; classtype:attempted-admin; sid:2035674; rev:2; metadata:attack_target Server, created_at 2022_03_31, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_04_06;) -alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 1"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021230; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 2 Suffix Set Inbound (CVE-2022-22965)"; flow:to_server,established; http.uri; content:"pipeline.first.suffix="; fast_pattern; classtype:attempted-admin; sid:2035675; rev:2; metadata:attack_target Server, created_at 2022_03_31, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_04_06;) -alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 2"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"{AB6172ED-8105-4996-9D2A-597B5F827501}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021231; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 3 Directory Set Inbound (CVE-2022-22965)"; flow:to_server,established; http.uri; content:"pipeline.first.directory="; fast_pattern; classtype:attempted-admin; sid:2035676; rev:2; metadata:attack_target Server, created_at 2022_03_31, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_04_06;) -alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 3"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"{0710880F-3A55-4A2D-AA67-1123384FD859}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021232; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 4 Prefix Set Inbound (CVE-2022-22965)"; flow:to_server,established; http.uri; content:"pipeline.first.prefix="; fast_pattern; classtype:attempted-admin; sid:2035677; rev:2; metadata:attack_target Server, created_at 2022_03_31, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_04_06;) -alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 4"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"{6C51A4DB-E3DE-4FEB-86A4-32F7F8E73B99}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021233; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible SpringCore RCE/Spring4Shell Inbound (CVE-2022-22965)"; flow:to_server,established; http.request_body; content:"pipeline.first.pattern="; fast_pattern; content:"pipeline.first.suffix="; content:"pipeline.first.directory="; content:"pipeline.first.prefix="; classtype:attempted-admin; sid:2035678; rev:2; metadata:attack_target Server, created_at 2022_03_31, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_04_06;) -alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 5"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"{7F9BCFC0-B36B-45EC-B377-D88597BE5D78}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021234; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT VMWare Server-side Template Injection RCE (CVE-2022-22954)"; flow:established,to_server; http.uri; content:"/catalog-portal/"; http.request_body; content:"%24%7b%22%66%72%65%65%6d%61%72%6b%65%72%2e%74%65%6d%70%6c%61%74%65%2e%75%74%69%6c%69%74%79%2e%45%78%65%63%75%74%65%22"; nocase; fast_pattern; content:"%6e%65%77%28%29"; nocase; within:200; reference:url,www.vmware.com/security/advisories/VMSA-2022-0011.html; reference:cve,2022-22954; classtype:attempted-admin; sid:2035876; rev:2; metadata:affected_product VMware, attack_target Server, created_at 2022_04_08, cve CVE_2022_22954, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category EXPLOIT, signature_severity Major, updated_at 2022_04_08;) -alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 6"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"{57D2DE92-CE17-4A57-BFD7-CD3C6E965C6A}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021235; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT VMWare Server-side Template Injection RCE (CVE-2022-22954)"; flow:established,to_server; http.uri; content:"/catalog-portal/"; http.request_body; content:"|24 7b 22|freemarker|2e|template|2e|utility|2e|Execute|22|"; nocase; fast_pattern; content:"new|28 29 28|"; nocase; within:200; reference:url,www.vmware.com/security/advisories/VMSA-2022-0011.html; reference:cve,2022-22954; classtype:attempted-admin; sid:2035875; rev:2; metadata:affected_product VMware, attack_target Server, created_at 2022_04_08, cve CVE_2022_22954, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category EXPLOIT, signature_severity Major, updated_at 2022_04_08;) -alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 1"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"|00|{|00|A|00|A|00|F|00|F|00|C|00|4|00|F|00|0|00|-|00|E|00|0|00|4|00|B|00|-|00|4|00|C|00|7|00|C|00|-|00|B|00|4|00|0|00|A|00|-|00|B|00|4|00|5|00|D|00|E|00|9|00|7|00|1|00|E|00|8|00|1|00|E|00|}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021236; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT VMWare Server-side Template Injection RCE (CVE-2022-22954)"; flow:established,to_server; http.uri; content:"/catalog-portal/"; content:"|24 7b 22|freemarker|2e|template|2e|utility|2e|Execute|22|"; distance:0; nocase; fast_pattern; content:"new|28 29 28|"; nocase; within:200; reference:url,www.vmware.com/security/advisories/VMSA-2022-0011.html; reference:cve,2022-22954; classtype:attempted-admin; sid:2035874; rev:2; metadata:affected_product VMware, attack_target Server, created_at 2022_04_08, cve CVE_2022_22954, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2022_04_08;) -alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 2"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"|00|{|00|A|00|B|00|6|00|1|00|7|00|2|00|E|00|D|00|-|00|8|00|1|00|0|00|5|00|-|00|4|00|9|00|9|00|6|00|-|00|9|00|D|00|2|00|A|00|-|00|5|00|9|00|7|00|B|00|5|00|F|00|8|00|2|00|7|00|5|00|0|00|1|00|}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021237; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;) +alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible OpenSSL Infinite Loop Inducing Cert Inbound via TCP (CVE-2022-0778)"; flow:established,to_server; content:"|30 82|"; content:"|30 0a 06 08 2a 86 48 ce 3d 04 03|"; distance:0; content:"|2a 86 48 ce 3d 01 01 02 02 02 b9|"; distance:0; fast_pattern; content:"|20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17|"; within:36; content:"|20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; within:36; content:"|04 03|"; distance:23; within:2; content:"|00 08|"; distance:1; within:2; reference:url,www.rtcsec.com/article/exploiting-cve-2022-0778-in-openssl-vs-webrtc-platforms/; reference:url,github.com/drago-96/CVE-2022-0778/; reference:cve,2022-0778; classtype:denial-of-service; sid:2035887; rev:2; metadata:affected_product OpenSSL, attack_target Server, created_at 2022_04_11, cve CVE_2022_0778, deployment Perimeter, deployment Internal, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2022_04_11;) -alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 3"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"|00|{|00|0|00|7|00|1|00|0|00|8|00|8|00|0|00|F|00|-|00|3|00|A|00|5|00|5|00|-|00|4|00|A|00|2|00|D|00|-|00|A|00|A|00|6|00|7|00|-|00|1|00|1|00|2|00|3|00|3|00|8|00|4|00|F|00|D|00|8|00|5|00|9|00|}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021238; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;) +alert udp any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible OpenSSL Infinite Loop Inducing Cert Inbound via UDP (CVE-2022-0778)"; content:"|30 82|"; content:"|30 0a 06 08 2a 86 48 ce 3d 04 03|"; distance:0; content:"|2a 86 48 ce 3d 01 01 02 02 02 b9|"; distance:0; fast_pattern; content:"|20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 17|"; within:36; content:"|20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; within:36; content:"|04 03|"; distance:23; within:2; content:"|00 08|"; distance:1; within:2; reference:url,www.rtcsec.com/article/exploiting-cve-2022-0778-in-openssl-vs-webrtc-platforms/; reference:url,github.com/drago-96/CVE-2022-0778/; reference:cve,2022-0778; classtype:denial-of-service; sid:2035888; rev:2; metadata:affected_product OpenSSL, attack_target Server, created_at 2022_04_11, cve CVE_2022_0778, deployment Perimeter, deployment Internal, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2022_04_11;) -alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 4"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"|00|{|00|6|00|C|00|5|00|1|00|A|00|4|00|D|00|B|00|-|00|E|00|3|00|D|00|E|00|-|00|4|00|F|00|E|00|B|00|-|00|8|00|6|00|A|00|4|00|-|00|3|00|2|00|F|00|7|00|F|00|8|00|E|00|7|00|3|00|B|00|9|00|9|00|}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021239; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;) +alert http $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible NGINX Reference LDAP Query Injection Attack"; flow:established,to_server; http.header; content:"|0d 0a|X-Ldap-Template|3a 20|"; fast_pattern; nocase; content:"|28 7c|"; distance:0; within:5; http.header_names; content:!"Referer|0d 0a|"; reference:url,github.com/nginxinc/nginx-ldap-auth/issues/93; classtype:attempted-admin; sid:2035897; rev:2; metadata:attack_target Web_Server, created_at 2022_04_12, deployment Perimeter, former_category EXPLOIT, signature_severity Major, updated_at 2022_04_18;) -alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 5"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"|00|{|00|7|00|F|00|9|00|B|00|C|00|F|00|C|00|0|00|-|00|B|00|3|00|6|00|B|00|-|00|4|00|5|00|E|00|C|00|-|00|B|00|3|00|7|00|7|00|-|00|D|00|8|00|8|00|5|00|9|00|7|00|B|00|E|00|5|00|D|00|7|00|8|00|}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021240; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Grafana 8.x Path Traversal (CVE-2021-43798)"; flow:established,to_server; http.method; content:"GET"; http.uri.raw; content:"/public/plugins/"; fast_pattern; content:"|2f 2e 2e 2f|"; distance:0; within:40; reference:url,github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p; classtype:attempted-admin; sid:2034629; rev:2; metadata:attack_target Server, created_at 2021_12_07, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_04_14;) -alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 6"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"|00|{|00|5|00|7|00|D|00|2|00|D|00|E|00|9|00|2|00|-|00|C|00|E|00|1|00|7|00|-|00|4|00|A|00|5|00|7|00|-|00|B|00|F|00|D|00|7|00|-|00|C|00|D|00|3|00|C|00|6|00|E|00|9|00|6|00|5|00|C|00|6|00|A|00|}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021241; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT SEOWON INTECH SLC-130/SLR-120S RCE Inbound M1 (CVE-2020-17456)"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/system_log.cgi"; http.request_body; content:"&pingIpAddr="; fast_pattern; content:"%3B%"; distance:0; within:5; nocase; reference:cve,2020-17456; classtype:attempted-admin; sid:2035950; rev:2; metadata:attack_target Networking_Equipment, created_at 2022_04_14, cve CVE_2020_17456, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2022_04_14;) -#alert tcp any any -> any [139,445] (msg:"ET DELETED Possible Duqu 2.0 Accessing SMB/SMB2 backdoor"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"tttttttt"; nocase; distance:0; fast_pattern; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021243; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT SEOWON INTECH SLC-130/SLR-120S RCE Inbound M2 (CVE-2020-17456)"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/system_log.cgi"; http.request_body; content:"&pingIpAddr="; fast_pattern; pcre:"/^(?:\x3b|\x0a|\x26|\x60|\x7C|\x24)/R"; reference:cve,2020-17456; classtype:attempted-admin; sid:2035951; rev:1; metadata:created_at 2022_04_14, cve CVE_2020_17456, updated_at 2022_04_14;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Dridex Download June 10 2015"; flow:established,from_server; content:"filename=|22|crypted.120.exe|22|"; http_header; nocase; classtype:trojan-activity; sid:2021244; rev:2; metadata:created_at 2015_06_11, updated_at 2015_06_11;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT SEOWON INTECH SLC-130 RCE Inbound (No CVE)"; flow:to_server,established; http.method; content:"POST"; http.uri; http.request_body; content:"&queriesCnt="; fast_pattern; pcre:"/^(?:\x3b|\x0a|\x26|\x60|\x7C|\x24)/R"; classtype:attempted-admin; sid:2035952; rev:1; metadata:attack_target Networking_Equipment, created_at 2022_04_14, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2022_04_14;) -#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET DELETED Cryptolocker C2 SSL cert serial"; flow:established,to_client; content:"|b3 b2 82 08 58 32 5e 8e|"; fast_pattern:only; reference:url,www.hybrid-analysis.com/sample/3ebc6999da89eaf44d94195b588cb869d894ca754a248b074893d11f6dd19188?environmentId=4; reference:md5,2c339dbb40b3b19ee275e4c7c1c17a18; classtype:command-and-control; sid:2021253; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_06_11, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT D-Link DWR Command Injection Inbound (CVE-2018-10823)"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/chkisg.htm"; content:"%3FSip%"; fast_pattern; nocase; distance:0; content:"%7C"; nocase; distance:0; reference:cve,2018-10823; classtype:attempted-admin; sid:2035953; rev:1; metadata:attack_target Networking_Equipment, created_at 2022_04_14, cve CVE_2018_10823, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2022_04_14;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Torrentlocker C2 SSL cert"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 b3 b2 82 08 58 32 5e 8e|"; within:35; fast_pattern; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; threshold: type limit, track by_src, count 1, seconds 60; reference:md5,77c99b6f06fe443b72a0efaf8f285e4d; classtype:command-and-control; sid:2021260; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_06_12, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT iRZ Mobile Router RCE Inbound M1 (CVE-2022-27226)"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/api/crontab"; fast_pattern; http.request_body; content:"|22|tasks|22 3a|"; content:"|22|command|22 3a|"; reference:cve,2022-27226; classtype:attempted-admin; sid:2035954; rev:1; metadata:attack_target Networking_Equipment, created_at 2022_04_14, cve CVE_2022_27226, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2022_04_14;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED DRIVEBY Angler EK Landing URI Struct Feb 21"; flow:established,to_server; urilen:<28; content:"/lists/"; depth:7; http_uri; pcre:"/^\/lists\/\d{15}(?:\d{5})?$/U"; classtype:exploit-kit; sid:2020497; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Any, attack_target Client_Endpoint, created_at 2015_02_22, deployment Perimeter, malware_family Angler, signature_severity Major, tag Angler, tag DriveBy, tag Exploit_Kit, updated_at 2018_06_18;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Razer Sila Router - Command Injection Attempt Inbound (No CVE)"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/ubus/"; http.request_body; content:"|22|exec|22|,|7b 22|command|22 3a 22|"; reference:url,www.exploit-db.com/exploits/50865; classtype:attempted-admin; sid:2035955; rev:1; metadata:attack_target Networking_Equipment, created_at 2022_04_14, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2022_04_14;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Redkit Jar Naming Pattern March 03 2013"; flow:established,to_server; content:".jar"; http_uri; nocase; content:"Java/1."; http_user_agent; pcre:"/^\/[a-z0-9]{2}\.jar$/U"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2016588; rev:15; metadata:created_at 2013_03_15, updated_at 2013_03_15;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Razer Sila Router - LFI Attempt Inbound (No CVE)"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/ubus/"; http.request_body; content:"|22|read|22|,|7b 22|path|22 3a 22|"; reference:url,www.exploit-db.com/exploits/50864; classtype:attempted-admin; sid:2035956; rev:1; metadata:attack_target Networking_Equipment, created_at 2022_04_14, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2022_04_14;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Angler EK Landing URI Struct Jun 11"; flow:to_server,established; urilen:>22; content:"/?"; offset:12; depth:86; fast_pattern; pcre:"/^\/[a-z]{3,20}(?P[_-])[a-z]{3,20}(?P=sep)[a-z]{3,20}(?:(?P=sep)[a-z]{3,20}\/\?[a-z]{6,}=\d{15,20}|(?:(?P=sep)[a-z]{3,20})?\/\?[a-z]{6,}=\d{10,13})$/U"; pcre:"/Referer\x3a\x20http\x3a\x2f+(?P[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(?!(?:(?P=refhost)|www\.))/Hsi"; flowbits:set,AnglerEK; classtype:exploit-kit; sid:2021248; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_06_11, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Angler, signature_severity Critical, tag Angler, tag Exploit_Kit, updated_at 2018_06_18;) +alert http $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M1"; flow:established,to_server; http.uri.raw; pcre:"/^\/(?:icons|cgi-bin)/"; content:"/.%2e/%2e%2e/%2e%2e/%2e%2e/"; reference:url,httpd.apache.org/security/vulnerabilities_24.html; reference:url,twitter.com/HackerGautam/status/1445412108863041544; reference:cve,2021-41773; classtype:attempted-admin; sid:2034124; rev:4; metadata:affected_product Apache_HTTP_server, attack_target Web_Server, created_at 2021_10_05, cve CVE_2021_41773, deployment Perimeter, deployment Internet, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2022_04_18;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Angler EK Landing URI Struct Jun 11 M2"; flow:to_server,established; urilen:>22; content:"/?"; offset:12; depth:86; fast_pattern; pcre:"/^\/[a-z]{3,20}(?P[_-])[a-z]{3,20}(?P=sep)[a-z]{3,20}(?:(?P=sep)[a-z]{3,20}\/\?[a-z]{6,}=\d{15,20}|(?:(?P=sep)[a-z]{3,20})?\/\?[a-z]{6,}=\d{10,13})$/U"; pcre:"/Host\x3a\x20(?!www\.)(?P[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f(?!(?P=refhost))/Hsi"; flowbits:set,AnglerEK; classtype:exploit-kit; sid:2021266; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_06_14, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Angler, signature_severity Critical, tag Angler, tag Exploit_Kit, updated_at 2018_06_18;) +alert http $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M2"; flow:established,to_server; http.uri.raw; pcre:"/^\/(?:icons|cgi-bin)/"; content:"/.%2e/.%2e/.%2e/.%2e/"; reference:url,httpd.apache.org/security/vulnerabilities_24.html; reference:url,github.com/iilegacyyii/PoC-CVE-2021-41773/blob/main/CVE-2021-41773.py; reference:cve,2021-41773; classtype:attempted-admin; sid:2034125; rev:4; metadata:affected_product Apache_HTTP_server, attack_target Web_Server, created_at 2021_10_05, cve CVE_2021_41773, deployment Perimeter, deployment Internet, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2022_04_18;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Angler EK Landing URI Struct Jun 11 M3"; flow:to_server,established; urilen:>22; content:"/?"; offset:12; depth:86; fast_pattern; pcre:"/^\/[a-z]{3,20}(?P[_-])[a-z]{3,20}(?P=sep)[a-z]{3,20}(?:(?P=sep)[a-z]{3,20}\/\?[a-z]{6,}=\d{15,20}|(?:(?P=sep)[a-z]{3,20})?\/\?[a-z]{6,}=\d{10,13})$/U"; content:!"Referer|3a|"; http_header; pcre:"/^Host\x3a\x20(?!www\.)[^\x2e]+(?:\.[^\x2e\r\n]+){2,}\r$/Hmi"; flowbits:set,AnglerEK; classtype:exploit-kit; sid:2021267; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_06_14, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Angler, signature_severity Critical, tag Angler, tag Exploit_Kit, updated_at 2018_06_18;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Apache HTTP Server 2.4.49 - Path Traversal Attempt (CVE-2021-41773) M3"; flow:established,to_server; http.uri.raw; pcre:"/^\/(?:icons|cgi-bin)/"; content:"/.%2e/%2e%2e/.%2e/"; reference:cve,2021-41773; classtype:attempted-admin; sid:2034128; rev:2; metadata:affected_product Apache_HTTP_server, attack_target Web_Server, created_at 2021_10_06, cve CVE_2021_41773, deployment Perimeter, deployment Internet, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2022_04_18;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TeslaCrypt MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|12 2a 2e|pillspharm24.com"; distance:1; within:19; reference:md5,1b4e97af9f327126146338b8cd21dd86; classtype:domain-c2; sid:2021273; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded WebUI Login Attempt M1"; flow:established,to_server; http.header; content:"Authorization|3a 20|Basic|20|YWRtaW46ezEyMjEzQkQxLTY5QzctNDg2Mi04NDNELTI2MDUwMEQxREE0MH0|3d|"; fast_pattern; reference:url,github.com/mcw0/PoC/blob/master/TVT_and_OEM_IPC_NVR_DVR_RCE_Backdoor_and_Information_Disclosure.txt; classtype:attempted-admin; sid:2036254; rev:1; metadata:affected_product DVR, attack_target Networking_Equipment, created_at 2022_04_19, deployment Perimeter, deployment Internal, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2022_04_19;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Backdoor.Elise SSL Cert"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; within:30; content:"|55 04 03|"; distance:0; content:"|0b|eric-office"; distance:1; within:12; reference:md5,8334f346585aa27ac6ae86e5adcaefa2; reference:url,github.com/pan-unit42/iocs/tree/master/lotusblossom; classtype:trojan-activity; sid:2021279; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_06_16, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;) +alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Stack Overflow in Base64 Authorization Mechanism M1"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Authorization|3a 20|Basic|20|YWRtaW46"; fast_pattern; content:!"|0d 0a|"; within:500; http.request_body; content:"|3c 3f|xml|20|"; startswith; content:"clientType|3d 22|WEB|22|"; distance:0; reference:url,github.com/mcw0/PoC/blob/master/TVT_and_OEM_IPC_NVR_DVR_RCE_Backdoor_and_Information_Disclosure.txt; classtype:attempted-admin; sid:2036255; rev:1; metadata:affected_product DVR, attack_target Networking_Equipment, created_at 2022_04_19, deployment Perimeter, deployment Internal, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2022_04_19;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Angler EK XTEA encrypted binary (16) M2"; flow:established,to_client; file_data; content:"|51 cb 7b fc 19 9b 77 fb|"; within:2048; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2021280; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_06_16, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Angler, signature_severity Critical, tag Angler, tag Exploit_Kit, updated_at 2018_06_18;) +alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Stack Overflow in Base64 Authorization Mechanism M2"; flow:established,to_server; http.method; content:"POST"; http.cookie; content:"auInfo|3d|YWRtaW46"; fast_pattern; content:!"|3b|"; within:500; http.request_body; content:"|3c 3f|xml|20|"; startswith; content:"clientType|3d 22|WEB|22|"; distance:0; reference:url,github.com/mcw0/PoC/blob/master/TVT_and_OEM_IPC_NVR_DVR_RCE_Backdoor_and_Information_Disclosure.txt; classtype:attempted-admin; sid:2036256; rev:1; metadata:affected_product DVR, attack_target Networking_Equipment, created_at 2022_04_19, deployment Perimeter, deployment Internal, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2022_04_19;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Angler EK XTEA encrypted binary (11) M2"; flow:established,to_client; file_data; content:"|08 fe 4a ac c6 d6 06 8d|"; within:2048; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2021281; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_06_16, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Angler, signature_severity Critical, tag Angler, tag Exploit_Kit, updated_at 2018_06_18;) +alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Shenzhen TVT DVR/NVR/IPC WebUI RCE ADD Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/editBlackAndWhiteList"; bsize:22; http.request_body; content:"clientType|3d 22|WEB|22 3e|"; content:"|3c|addressType|3e|ip|3c 2f|addressType|3e 3c|ip|3e|"; distance:0; fast_pattern; pcre:"/^(?:[\x60\x3b\x7c]|%60|%3b|%7c|%26|(?:[\x3c\x3e\x24]|%3c|%3e|%24)(?:\x28|%28))/R"; reference:url,github.com/mcw0/PoC/blob/master/TVT_and_OEM_IPC_NVR_DVR_RCE_Backdoor_and_Information_Disclosure.txt; classtype:attempted-admin; sid:2036253; rev:2; metadata:created_at 2022_04_19, updated_at 2022_04_19;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Fake AV Phone Scam Landing June 16 2015 M3"; flow:established,to_client; file_data; content:"Virus Firewall Alert!"; nocase; fast_pattern:16,20; content:"myFunction|28 29|"; distance:0; content:"popup-mac-warning.png"; nocase; distance:0; classtype:social-engineering; sid:2021287; rev:2; metadata:created_at 2015_06_17, updated_at 2015_06_17;) +alert tcp any any -> $HOME_NET 4567 (msg:"ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded Credential ConfigSyncProc Login Attempt"; flow:established,to_server; stream_size:server,<,5; dsize:38; content:"{D79E94C5-70F0-46BD-965B-E17497CCB598}"; startswith; flowbits:set,ET.tvt_stage1; reference:url,raw.githubusercontent.com/mcw0/PoC/master/TVT_and_OEM_IPC_NVR_DVR_RCE_Backdoor_and_Information_Disclosure.txt; classtype:trojan-activity; sid:2036272; rev:1; metadata:affected_product DVR, attack_target Networking_Equipment, created_at 2022_04_19, deployment Perimeter, deployment Internal, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2022_04_19;) -#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Netwire RAT Client Check-in 2"; flow:established,to_server; dsize:5; content:"|01 00 00 00 02|"; flowbits:isset,ET.NetwireRAT.Client; reference:md5,acccfa6107c712a63b1473d524461163; classtype:trojan-activity; sid:2021290; rev:1; metadata:created_at 2015_06_17, former_category TROJAN, updated_at 2017_12_11;) +alert tcp any any -> $HOME_NET 4567 (msg:"ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded Credential ConfigSyncProc System Details Request"; flow:established,to_server; content:"GET /"; startswith; content:"|0d 0a|{D79E94C5-70F0-46BD-965B-E17497CCB598}|20|1|0d 0a 0d 0a|"; fast_pattern; flowbits:isset,ET.tvt_stage1; reference:url,raw.githubusercontent.com/mcw0/PoC/master/TVT_and_OEM_IPC_NVR_DVR_RCE_Backdoor_and_Information_Disclosure.txt; classtype:trojan-activity; sid:2036273; rev:1; metadata:affected_product DVR, attack_target Networking_Equipment, created_at 2022_04_19, deployment Perimeter, deployment Internal, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2022_04_19;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT KaiXin Landing M4"; flow:established,from_server; file_data; content:"|76 68 7a 32 7a 3d 27 27 3b 74 72 79 7b 77 69 6e 64 6f 77|"; classtype:exploit-kit; sid:2021291; rev:4; metadata:created_at 2015_06_18, updated_at 2015_06_18;) +alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Shenzhen TVT DVR/NVR/IPC Hardcoded WebUI Login Attempt M2"; flow:established,to_server; http.header; content:"Authorization|3a 20|Basic|20|cm9vdDp7MTIyMTNCRDEtNjlDNy00ODYyLTg0M0QtMjYwNTAwRDFEQTQwfQ|3d 3d|"; fast_pattern; reference:url,github.com/mcw0/PoC/blob/master/TVT_and_OEM_IPC_NVR_DVR_RCE_Backdoor_and_Information_Disclosure.txt; classtype:attempted-admin; sid:2036274; rev:1; metadata:affected_product DVR, attack_target Networking_Equipment, created_at 2022_04_19, deployment Perimeter, deployment Internal, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2022_04_20;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Likely CottonCastle/Niteris EK Response June 19 2015"; flow:established,from_server; content:"Refresh|3a 20|"; http_header; content:"|3b 20|url"; distance:0; http_header; content:"/999/00000/|0d 0a|"; distance:0; http_header; fast_pattern; pcre:"/^Refresh\x3a\x20\d+\x3b\x20url[^\r\n]+\/999\/00000\/\r?$/Hm"; classtype:exploit-kit; sid:2021306; rev:2; metadata:created_at 2015_06_19, updated_at 2015_06_19;) +alert tcp any any -> $HOME_NET 4567 (msg:"ET EXPLOIT Shenzhen TVT DVR/NVR/IPC ConfigSyncProc RCE Attempt"; flow:established,to_server; content:"GET /saveSystemConfig"; depth:21; content:"|0d 0a|{D79E94C5-70F0-46BD-965B-E17497CCB598}|20|2|0d 0a 0d 0a|DAAAAAEAAAADAAAAIQACAAEABA"; distance:0; fast_pattern; flowbits:isset,ET.tvt_stage1; reference:url,raw.githubusercontent.com/mcw0/PoC/master/TVT_and_OEM_IPC_NVR_DVR_RCE_Backdoor_and_Information_Disclosure.txt; classtype:trojan-activity; sid:2036275; rev:1; metadata:affected_product DVR, attack_target Networking_Equipment, created_at 2022_04_19, deployment Perimeter, deployment Internal, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2022_04_19;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Likely Malicious wininet UA Downloading EXE"; flow:established,from_server; flowbits:isset,ET.wininet.UA; file_data; content:"MZ"; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; classtype:trojan-activity; sid:2021312; rev:2; metadata:created_at 2015_06_19, former_category CURRENT_EVENTS, updated_at 2015_06_19;) +alert http any any -> $HOME_NET any (msg:"ET EXPLOIT WSO2 Server RCE (CVE-2022-29464)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/fileupload/toolsAny"; startswith; bsize:20; http.request_body; content:"name=|22 2e 2e 2f 2e 2e 2f 2e 2e 2f 2e 2e 2f|repository/deployment/server/"; fast_pattern; content:".jsp|22 0d 0a|"; distance:0; reference:url,github.com/hakivvi/CVE-2022-29464; reference:cve,CVE-2022-29464; reference:cve,2022-29464; classtype:trojan-activity; sid:2036378; rev:2; metadata:affected_product HTTP_Server, attack_target Web_Server, created_at 2022_04_26, cve CVE_2022_29464, deployment Internet, former_category EXPLOIT, signature_severity Major, updated_at 2022_04_26;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Suspicious JS Observed in Unknown EK Landing"; flow:established,from_server; file_data; content:"|64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 58 4f 52 28 75 6e 65 73 63 61 70 65 28 73 74 72 48 54 4d 4c 29|"; nocase; classtype:exploit-kit; sid:2021313; rev:2; metadata:created_at 2015_06_19, updated_at 2015_06_19;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT [ConnectWise CRU] Java ECDSA (Psychic) TLS Signature (CVE-2022-21449)"; flow:established, to_client; content:"|16 03 03|"; content:"|0c|"; distance:2; within:1; content:"|04 03 00 08 30 06 02 01 00 02 01 00|"; distance:0; tag:session,5,packets; reference:url,github.com/thack1/CVE-2022-21449; reference:cve,2022-21449; classtype:targeted-activity; sid:2036377; rev:1; metadata:created_at 2022_04_26, cve CVE_2022_21449, updated_at 2022_04_26;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Downloader.Win32.Adload (KaiXin Payload) Checkin Response"; flow:established,from_server; file_data; content:"[Config]|0d 0a|"; within:10; content:"[Process]|0d 0a|1="; distance:0; reference:md5,c45810710617f0149678cc1c6cbec7a6; classtype:command-and-control; sid:2021301; rev:4; metadata:created_at 2015_06_18, former_category MALWARE, updated_at 2015_06_18;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT [ConnectWise CRU] Java ECDSA (Psychic) Signed JWT Bypass (CVE-2022-21449)"; flow:established, to_server; http.header; content:"Authorization|3a 20|Bearer|20|"; pcre:"/(yJ0eXAiOiJKV1Qi|InR5cCI6IkpXVCJ)/HR"; content:"JhbGciOiJFUzI1Ni"; distance:0; fast_pattern; content:"MAYCAQACAQA|0d 0a|"; endswith; tag:session,5,packets; reference:cve,CVE-2022-21449; reference:cve,2022-21449; classtype:web-application-activity; sid:2036392; rev:3; metadata:affected_product Java, attack_target Server, created_at 2022_04_27, cve CVE_2022_21449, deployment Perimeter, former_category EXPLOIT, signature_severity Major, updated_at 2022_04_29, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Spy.Shiz CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|09|howtoe.pw"; distance:1; within:14; reference:md5,40368db3a68f2db17853750e68cfc662; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021314; rev:3; metadata:attack_target Client_and_Server, created_at 2015_06_22, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible VMware Workspace ONE Access RCE via Server-Side Template Injection Inbound (CVE-2022-22954)"; flow:to_server,established; http.uri; content:"/catalog-portal/ui/oauth/verify?"; http.uri.raw; content:"&deviceUdid=%24%7b"; fast_pattern; nocase; reference:cve,2022-22954; classtype:attempted-admin; sid:2036416; rev:1; metadata:attack_target Server, created_at 2022_04_29, cve CVE_2022_22954, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_04_29;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Possible Sinkhole)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ef ee 78 a7 ef c6 52 20|"; within:35; content:"|55 04 03|"; distance:0; content:"|0c|mainsinkhole"; distance:1; within:13; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021315; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_22, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert udp any any -> $HOME_NET 12345 (msg:"ET EXPLOIT [PwnedPiper] Exploitation Attempt - Large Malformed Translogic Packet (CVE-2021-37164)"; dsize:>369; content:"TLPU"; startswith; fast_pattern; reference:cve,2021-37164; reference:url,www.armis.com/pwnedPiper; classtype:attempted-admin; sid:2033662; rev:2; metadata:attack_target Server, created_at 2021_08_03, cve CVE_2021_37164, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_05_03;) -alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux/ChinaZ DDoS Bot Checkin 2"; flow:established,to_server; content:"*"; pcre:"/^\d+/R"; content:"MHZ|00 00 00 00|"; fast_pattern; within:7; content:"MB|00 00 00 00|"; distance:0; content:"M|00 00 00 00|"; distance:0; content:"|3b|"; distance:0; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/R"; reference:url,blog.malwaremustdie.org/2015/06/the-elf-chinaz-reloaded.html; classtype:command-and-control; sid:2021316; rev:1; metadata:created_at 2015_06_22, former_category MALWARE, updated_at 2015_06_22;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Oracle BI Publisher Authentication Bypass (CVE-2019-2616)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/xmlpserver/ReportTemplateService.xls"; bsize:37; fast_pattern; http.header_names; content:!"Referer"; http.request_body; content:"|3c 21|DOCTYPE|20|soap|3a|envelope|20|PUBLIC|20 22 2d 2f 2f|B|2f|A|2f|EN|22 20 22|http"; startswith; reference:url,nvd.nist.gov/vuln/detail/CVE-2019-2616; reference:cve,2019-2616; classtype:attempted-admin; sid:2034199; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2021_10_15, cve CVE_2019_2616, deployment Perimeter, former_category EXPLOIT, signature_severity Major, updated_at 2022_05_03;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT KaiXin Secondary Landing Page June 22 2015"; flow:established,from_server; file_data; content:"return binary_to_base64|28|"; content:"return "; pcre:"/^\s*?[\x22\x27][^\x22\x27a-f0-9]68[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]70[^\x22\x27a-f0-9]3a[^\x22\x27a-f0-9]2f[^\x22\x27a-f0-9]2f[^\x22\x27]+?[^\x22\x27a-f0-9]00[\x22\x27]/Ri"; classtype:exploit-kit; sid:2021320; rev:2; metadata:created_at 2015_06_23, updated_at 2015_06_23;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Ultimate POS 4.4 Cross-Site Scripting (XSS) - Outbound"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/products"; startswith; http.content_type; content:"multipart/form-data"; startswith; http.cookie; content:"ultimate_pos_session=eyJpdiI6Il"; startswith; fast_pattern; content:"SIsInZhbHVlIjoi"; distance:30; within:20; content:"_token=null&name="; distance:0; content:"|22 3e 3c|iframe src="; distance:0; content:"submit_type=submit"; endswith; reference:url,exploit-db.com/exploits/50492; classtype:attempted-admin; sid:2034481; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2021_11_15, deployment Perimeter, former_category EXPLOIT, signature_severity Major, updated_at 2022_05_03;) -#alert tcp $HOME_NET any -> [88.53.215.64,217.96.33.164,203.131.222.102,208.105.226.235,212.31.102.100,58.185.154.99,200.87.126.116] any (msg:"ET MALWARE Sony Breach Wiper Callout"; flow:established; threshold:type limit,count 2,track by_src,seconds 300; reference:url,krebsonsecurity.com/2014/12/sony-breach-may-have-exposed-employee-healthcare-salary-data; classtype:trojan-activity; sid:2019848; rev:3; metadata:created_at 2014_12_03, updated_at 2014_12_03;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Ultimate POS 4.4 Cross-Site Scripting (XSS) - Inbound"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/products"; startswith; http.content_type; content:"multipart/form-data"; startswith; http.cookie; content:"ultimate_pos_session=eyJpdiI6Il"; startswith; fast_pattern; content:"SIsInZhbHVlIjoi"; distance:30; within:20; content:"_token=null&name="; distance:0; content:"|22 3e 3c|iframe src="; distance:0; content:"submit_type=submit"; endswith; reference:url,exploit-db.com/exploits/50492; classtype:attempted-admin; sid:2034482; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2021_11_15, deployment Perimeter, former_category EXPLOIT, signature_severity Major, updated_at 2022_05_03;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT suspicious VBE-encoded script (seen in Sundown EK)"; flow:established,from_server; file_data; content:"Script.Encode"; content:""; content:"getEnvInfo"; content:"getPlatform"; content:"]*?\ssrc\s*?=\s*?[\x22\x27][^\x22\x27]*?\.swf[\x22\x27])(?=[^>]*?\swidth\s*?=\s*?[\x22\x27]0[\x22\x27])[^>]*?\sheight\s*?=\s*?[\x22\x27]0[\x22\x27]/Ri"; classtype:trojan-activity; sid:2021595; rev:2; metadata:created_at 2015_08_04, former_category CURRENT_EVENTS, updated_at 2015_08_04;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP STAT ? dos attempt"; flow:to_server,established; content:"STAT"; nocase; pcre:"/^STAT\s+[^\n]*\x3f/smi"; reference:bugtraq,4482; reference:cve,2002-0073; reference:nessus,10934; reference:url,www.microsoft.com/technet/security/bulletin/MS02-018.mspx; classtype:attempted-dos; sid:2101778; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; within:30; content:"|55 04 0a|"; distance:0; content:"|08|Monsanto"; distance:1; within:9; content:"|55 04 0b|"; distance:0; content:"|0b|SmartPhones"; distance:1; within:12; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021596; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_05, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP CWD .... attempt"; flow:to_server,established; content:"CWD "; content:" ...."; reference:bugtraq,4884; classtype:denial-of-service; sid:2101779; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0f|enfinetoner.com"; distance:1; within:16; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021598; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_05, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP command overflow attempt"; flow:to_server,established,no_stream; dsize:>100; reference:bugtraq,4638; reference:cve,2002-0606; classtype:protocol-command-decode; sid:2101748; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|10|ta-portfolio.com"; distance:1; within:17; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021599; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_05, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP CWD ~ attempt"; flow:to_server,established; content:"CWD "; content:" ~|0D 0A|"; reference:bugtraq,2601; reference:cve,2001-0421; classtype:denial-of-service; sid:2101728; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Styx Exploit Kit - HTML"; flow:to_server,established; urilen:>300; content:".htm"; fast_pattern:only; http_uri; pcre:"/^\/[a-zA-Z0-9_\x2f-]{300,}\.html?$/U"; content:"/"; http_uri; offset:1; content:"_"; http_uri; offset:1; content:"-"; offset:1; http_uri; classtype:exploit-kit; sid:2017841; rev:4; metadata:created_at 2013_12_12, former_category EXPLOIT_KIT, updated_at 2021_06_23;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP APPE overflow attempt"; flow:to_server,established; content:"APPE"; nocase; isdataat:100,relative; pcre:"/^APPE\s[^\n]{100}/smi"; reference:bugtraq,8315; reference:bugtraq,8542; reference:cve,2000-0133; reference:cve,2003-0466; classtype:attempted-admin; sid:2102391; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0b|gallinj.com"; distance:1; within:12; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021602; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_10, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP CWD ~ attempt"; flow:to_server,established; content:"CWD"; nocase; pcre:"/^CWD\s+~/smi"; reference:bugtraq,2601; reference:bugtraq,9215; reference:cve,2001-0421; classtype:denial-of-service; sid:2101672; rev:12; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ransomware CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 d5 e5 ff f2 10 0a 35 d0|"; distance:0; fast_pattern; content:"|55 04 06|"; distance:0; content:"|02|XX"; distance:1; within:3; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:command-and-control; sid:2021603; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_08_10, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, tag Ransomware, updated_at 2016_07_01, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP large SYST command"; flow:to_server,established; dsize:10; content:"SYST"; nocase; classtype:protocol-command-decode; sid:2101625; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|13|www.enfinetoner.com"; distance:1; within:20; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021604; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_10, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP invalid MODE"; flow:to_server,established; content:"MODE"; nocase; pcre:"/^MODE\s+[^ABSC]{1}/msi"; classtype:protocol-command-decode; sid:2101623; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Firefox PDF.js Same-Origin-Bypass CVE-2015-4495 M2"; flow:established,from_server; file_data; content:"|77 69 6e 64 6f 77 73 5f 73 65 61 72 63 68 5f 61 6e 64 5f 75 70 6c 6f 61 64 5f 69 6e 5f 61 70 70 5f 64 61 74 61 5f 62 79 5f 64 69 73 6b|"; nocase; content:"|64 71 2e 61 77 61 69 74 41 6c 6c 28 63 61 6c 6c 62 61 63 6b 29|"; nocase; reference:url,nakedsecurity.sophos.com/2015/08/07/firefox-zero-day-hole-used-against-windows-and-linux-to-steal-passwords/; reference:cve,2015-4495; classtype:attempted-user; sid:2021606; rev:2; metadata:created_at 2015_08_11, updated_at 2015_08_11;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP RNFR ././ attempt"; flow:to_server,established; content:"RNFR "; nocase; content:" ././"; nocase; classtype:misc-attack; sid:2101622; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET MALWARE APT Lurker GET CnC Beacon"; flow:established,to_server; content:"GET /"; depth:5; content:".php HTTP/1."; distance:0; fast_pattern; content:!"Accept"; distance:0; content:!"Referer|3a|"; distance:0; content:"HOST|3a|"; distance:3; within:5; pcre:"/^[^\r\n]+\r\nUser-Agent\x3a[^\r\n]+\r\n(?:\r\n)?$/Rmi"; reference:md5,c5a8e09295b852a6e32186374b66e1a7; reference:url,blogs.rsa.com/wp-content/uploads/2015/05/RSA-IR-Case-Study.pdf; classtype:targeted-activity; sid:2021585; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_08_03, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_08_03, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP SITE overflow attempt"; flow:to_server,established; content:"SITE"; nocase; isdataat:100,relative; pcre:"/^SITE\s[^\n]{100}/smi"; reference:cve,1999-0838; reference:cve,2001-0755; reference:cve,2001-0770; classtype:attempted-admin; sid:2101529; rev:12; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)"; flow:established,from_server; content:"|55 04 03|"; content:"|0c|ghheranon.ad"; distance:1; within:13; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021613; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_11, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_01_15, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP SITE CHOWN overflow attempt"; flow:to_server,established; content:"SITE"; nocase; content:"CHOWN"; distance:0; nocase; isdataat:100,relative; pcre:"/^SITE\s+CHOWN\s[^\n]{100}/smi"; reference:bugtraq,2120; reference:cve,2001-0065; classtype:attempted-admin; sid:2101562; rev:13; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)"; flow:established,from_server; content:"|55 04 03|"; content:"|0b|idcythef.tj"; distance:1; within:12; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021614; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_11, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_01_15, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP shadow retrieval attempt"; flow:to_server,established; content:"RETR"; nocase; content:"shadow"; classtype:suspicious-filename-detect; sid:2101928; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Dridex Downloader SSL Certificate"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 92 14 63 ad 72 a8 8a 36|"; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0d|Casino Royale"; distance:1; within:14; classtype:trojan-activity; sid:2021615; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_08_12, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"ET FTP FTP CWD command attempt without login"; flow:established,to_server; flowbits:isnotset,ET.ftp.user.login; content:!"USER"; depth:4; content:"CWD"; nocase; reference:url,www.nsftools.com/tips/RawFTP.htm; reference:url,doc.emergingthreats.net/2010731; classtype:attempted-recon; sid:2010731; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Magnitude EK (formerly Popads) - Font Exploit - 32HexChar.eot"; flow:established,to_server; urilen:>36; content:".eot"; http_uri; fast_pattern:only; pcre:"/\/[a-f0-9]{32}\.eot$/U"; content:!"fonts.gstatic.com|0d 0a|"; http_header; content:!".fitbit.com|0d 0a|"; http_header; classtype:exploit-kit; sid:2016155; rev:7; metadata:created_at 2013_01_04, updated_at 2013_01_04;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET FTP USER login flowbit"; flow:established,to_server; content:"USER "; nocase; depth:5; flowbits:set,ET.ftp.user.login; flowbits:noalert; reference:url,doc.emergingthreats.net/bin/view/Main/2002850; classtype:not-suspicious; sid:2002850; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; within:30; content:"|55 04 0a|"; distance:0; content:"|0d|Casino Royale"; distance:1; within:14; content:"|55 04 0b|"; distance:0; content:"|05|poker"; distance:1; within:6; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021622; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_13, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP FTP 'STOR 1MB' possible warez site"; flow:to_server,established; content:"STOR"; nocase; content:"1MB"; distance:1; nocase; classtype:misc-activity; sid:2100543; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ransomware CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 f6 23 8b 36 d0 72 53 df|"; distance:0; fast_pattern; content:"|55 04 06|"; distance:0; content:"|02|XX"; distance:1; within:3; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:command-and-control; sid:2021623; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_08_13, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, tag Ransomware, updated_at 2016_07_01, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP FTP 'RETR 1MB' possible warez site"; flow:to_server,established; content:"RETR"; nocase; content:"1MB"; distance:1; nocase; classtype:misc-activity; sid:2100544; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi)"; flow:established,from_server; content:"|55 04 03|"; content:"|15|presidentjunction.org"; distance:1; within:22; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021633; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP FTP 'CWD / ' possible warez site"; flow:to_server,established; content:"CWD"; nocase; content:"/ "; distance:1; classtype:misc-activity; sid:2100545; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi)"; flow:established,from_server; content:"|55 04 03|"; content:"|13|tradingdelivery.com"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021635; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP FTP 'CWD ' possible warez site"; flow:to_server,established; content:"CWD "; depth:5; nocase; classtype:misc-activity; sid:2100546; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 c1 e2 af 07 71 4b 6c 75|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021636; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP FTP 'MKD .' possible warez site"; flow:to_server,established; content:"MKD ."; depth:5; nocase; classtype:misc-activity; sid:2100548; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Redyms CnC)"; flow:established,from_server; content:"|55 04 06|"; content:"|02|US"; distance:1; within:3; content:!"|55 04 08|"; distance:0; content:"|55 04 0a|"; distance:0; content:"|0e|MyCompany Inc."; distance:1; within:15; content:"|55 04 03|"; content:"|02|*."; distance:1; within:3; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021634; rev:3; metadata:attack_target Client_and_Server, created_at 2015_08_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP FTP anonymous login attempt"; flow:to_server,established; content:"USER "; depth:5; nocase; content:"anon"; distance:0; classtype:misc-activity; sid:2100553; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS IRC - NICK and Possible Windows XP/7"; flow:established,to_server; content:"NICK "; depth:5; pcre:"/^[^\r\n]*(?:W(?:in(?:dows)?)?[^a-z0-9]?(XP|[7-8])|Vista)/Ri"; content:!"|20|XP/7"; classtype:bad-unknown; sid:2017321; rev:8; metadata:created_at 2013_08_13, former_category INFO, updated_at 2013_08_13;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP MKD space space possible warez site"; flow:to_server,established; content:"MKD "; depth:5; nocase; classtype:misc-activity; sid:2100547; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET EXPLOIT_KIT CottonCastle/Niteris EK Landing Aug 17 2015"; flow:established,from_server; file_data; content:"ScriptEngineMajorVersion"; nocase; content:"ScriptEngineMinorVersion"; nocase; content:"ScriptEngineBuildVersion"; nocase; fast_pattern; content:"d27cdb6e-ae6d-11cf-96b8-444553540000"; nocase; classtype:exploit-kit; sid:2021638; rev:2; metadata:created_at 2015_08_17, former_category CURRENT_EVENTS, updated_at 2018_04_03;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP large PWD command"; flow:to_server,established; content:"PWD"; isdataat:7,relative; content:!"|0A|"; within:7; nocase; classtype:protocol-command-decode; sid:2101624; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET EXPLOIT_KIT CottonCastle/Niteris EK Secondary Landing URI Struct Aug 17 2015"; flow:established,to_server; content:"GET"; http_method; content:".html&"; http_uri; fast_pattern; content:"/"; distance:-47; http_uri; pcre:"/\/\d\/?[A-Z]+\/[a-f0-9]{32}(?:[a-f0-9]{8})?\.html&[a-z]+=[^&]+&[a-z]+=\d{3}\.\d{3}\.\d{3,}(?:\.\d{3,})?$/U"; classtype:exploit-kit; sid:2021639; rev:2; metadata:created_at 2015_08_17, updated_at 2015_08_17;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP NextFTP client overflow"; flow:to_client,established; content:"|B4| |B4|!|8B CC 83 E9 04 8B 19|3|C9|f|B9 10|"; fast_pattern:only; reference:bugtraq,572; reference:cve,1999-0671; classtype:attempted-user; sid:2100308; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET EXPLOIT_KIT CottonCastle/Niteris EK Exploit URI Struct Aug 17 2015"; flow:established,to_server; content:"GET"; http_method; content:"Referer|3a|"; http_header; content:"|3a|443/"; distance:0; http_header; fast_pattern; pcre:"/\/\d\/?[A-Z]+\/[a-f0-9]{40}\/$/U"; flowbits:set,ET.CottonCasle.Exploit; classtype:exploit-kit; sid:2021640; rev:2; metadata:created_at 2015_08_17, updated_at 2015_08_17;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP MKD overflow"; flow:to_server,established; content:"MKD "; isdataat:100,relative; reference:bugtraq,113; reference:bugtraq,2242; reference:cve,1999-0368; classtype:attempted-admin; sid:2100349; rev:13; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (euro-rafting.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|euro-rafting|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021646; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP OpenBSD x86 ftpd"; flow:to_server,established; content:" |90|1|C0 99|RR|B0 17 CD 80|h|CC|sh"; fast_pattern:only; reference:arachnids,446; reference:bugtraq,2124; reference:cve,2001-0053; classtype:attempted-user; sid:2100339; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (holidayapartments-Paris.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|holidayapartments-Paris|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021647; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP SITE EXEC format string"; flow:to_server,established; content:"SITE EXEC %020d|7C|%.f%.f|7C 0A|"; depth:32; nocase; reference:arachnids,453; reference:bugtraq,1387; reference:cve,2000-0573; classtype:attempted-user; sid:2100338; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (paris-holidayapartments.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|paris-holidayapartments|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021648; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP PWD overflow"; flow:to_server,established; content:"PWD|0A|/i"; fast_pattern:only; classtype:attempted-admin; sid:2100340; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (franceholidayapartments.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|17|franceholidayapartments|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021649; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP XXXXX overflow"; flow:to_server,established; content:"XXXXX/"; fast_pattern:only; classtype:attempted-admin; sid:2100341; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (apartmentsin-paris.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|apartmentsin-paris|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021650; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP wu-ftpd 2.6.0 site exec format string check"; flow:to_server,established; content:"f%.f%.f%.f%.f%."; depth:32; reference:arachnids,286; reference:bugtraq,1387; reference:cve,2000-0573; classtype:attempted-recon; sid:2100346; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (raftingholiday.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|raftingholiday|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021651; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP wu-ftpd 2.6.0 site exec format string overflow FreeBSD"; flow:to_server,established; content:"1|C0|PPP|B0|~|CD 80|1|DB|1|C0|"; depth:32; reference:arachnids,228; reference:bugtraq,1387; reference:cve,2000-0573; classtype:attempted-admin; sid:2100343; rev:12; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (eurorafting-tr.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|eurorafting-tr|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021652; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP wu-ftpd 2.6.0 site exec format string overflow Linux"; flow:to_server,established; content:"1|C0|1|DB|1|C9 B0|F|CD 80|1|C0|1|DB|"; fast_pattern:only; reference:arachnids,287; reference:bugtraq,1387; reference:cve,2000-0573; classtype:attempted-admin; sid:2100344; rev:12; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (turkeyextremerafting.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|turkeyextremerafting|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021653; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP wu-ftpd 2.6.0 site exec format string overflow Solaris 2.8"; flow:to_server,established; content:"|90 1B C0 0F 82 10| |17 91 D0| |08|"; fast_pattern:only; reference:arachnids,451; reference:bugtraq,1387; reference:cve,2000-0573; classtype:attempted-user; sid:2100342; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (raftingtours-turkey.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|raftingtours-turkey|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021654; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP wu-ftpd 2.6.0 site exec format string overflow generic"; flow:to_server,established; content:"SITE "; nocase; content:" EXEC "; nocase; content:" %p"; nocase; fast_pattern; reference:arachnids,285; reference:bugtraq,1387; reference:cve,2000-0573; reference:nessus,10452; classtype:attempted-admin; sid:2100345; rev:13; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (divextreme-ar.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|divextreme-ar|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021655; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP wu-ftpd 2.6.0"; flow:to_server,established; content:"..11venglin@"; reference:arachnids,440; reference:bugtraq,1387; classtype:attempted-user; sid:2100348; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (crazy-jump.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|crazy-jump|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021656; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP serv-u directory transversal"; flow:to_server,established; content:".%20."; nocase; fast_pattern:only; reference:bugtraq,2052; reference:cve,2001-0054; classtype:bad-unknown; sid:2100360; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (dive-extreme.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|dive-extreme|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021657; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP SITE EXEC attempt"; flow:to_server,established; content:"SITE"; nocase; content:"EXEC"; distance:0; nocase; pcre:"/^SITE\s+EXEC/smi"; reference:arachnids,317; reference:bugtraq,2241; reference:cve,1999-0080; reference:cve,1999-0955; classtype:bad-unknown; sid:2100361; rev:17; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (tandemskydive-ar.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|tandemskydive-ar|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021658; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP XCWD overflow attempt"; flow:to_server,established; content:"XCWD"; nocase; isdataat:100,relative; pcre:"/^XCWD\s[^\n]{100}/smi"; reference:bugtraq,11542; reference:bugtraq,8704; classtype:attempted-admin; sid:2102344; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (skydivelessons.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|skydivelessons|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021660; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP STOR overflow attempt"; flow:to_server,established; content:"STOR"; nocase; isdataat:100,relative; pcre:"/^STOR\s[^\n]{100}/smi"; reference:bugtraq,8668; reference:cve,2000-0133; classtype:attempted-admin; sid:2102343; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (bungee4you-br.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|bungee4you-br|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021661; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP SITE CHMOD overflow attempt"; flow:to_server,established; content:"SITE"; nocase; content:"CHMOD"; distance:0; nocase; isdataat:100,relative; pcre:"/^SITE\s+CHMOD\s[^\n]{100}/smi"; reference:bugtraq,10181; reference:bugtraq,9483; reference:bugtraq,9675; reference:cve,1999-0838; reference:nessus,12037; classtype:attempted-admin; sid:2102340; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (brazil-crazybungee.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|brazil-crazybungee|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021662; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP LIST buffer overflow attempt"; flow:to_server,established; content:"LIST"; nocase; isdataat:100,relative; pcre:"/^LIST\s[^\n]{100,}/smi"; reference:bugtraq,10181; reference:bugtraq,6869; reference:bugtraq,7251; reference:bugtraq,7861; reference:bugtraq,8486; reference:bugtraq,9675; reference:cve,1999-0349; reference:cve,1999-1510; reference:cve,2000-0129; reference:url,www.microsoft.com/technet/security/bulletin/MS99-003.mspx; classtype:misc-attack; sid:2102338; rev:14; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (bungeejumping-br.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|bungeejumping-br|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021663; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP RENAME format string attempt"; flow:to_server,established; content:"RENAME"; nocase; pcre:"/^RENAME\s[^\n]*?%[^\n]*?%/smi"; reference:bugtraq,9262; classtype:misc-attack; sid:2102333; rev:2; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (groupbungee-br.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|groupbungee-br|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021664; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP MKDIR format string attempt"; flow:to_server,established; content:"MKDIR"; nocase; pcre:"/^MKDIR\s[^\n]*?%[^\n]*?%/smi"; reference:bugtraq,9262; classtype:misc-attack; sid:2102332; rev:2; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (divextreme-au.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|divextreme-au|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021665; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP PASS format string attempt"; flow:to_server,established; content:"PASS"; nocase; pcre:"/^PASS\s[^\n]*?%[^\n]*?%/smi"; reference:bugtraq,7474; reference:bugtraq,9262; reference:bugtraq,9800; reference:cve,2000-0699; classtype:misc-attack; sid:2102179; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (crazyjump-uy.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|crazyjump-uy|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021666; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP USER format string attempt"; flow:to_server,established; content:"USER"; nocase; pcre:"/^USER\s[^\n]*?%[^\n]*?%/smi"; reference:bugtraq,7474; reference:bugtraq,7776; reference:bugtraq,9262; reference:bugtraq,9402; reference:bugtraq,9600; reference:bugtraq,9800; reference:cve,2004-0277; reference:nessus,10041; reference:nessus,11687; classtype:misc-attack; sid:2102178; rev:17; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (stuntjumps.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0a|stuntjumps|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021667; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP CWD Root directory transversal attempt"; flow:to_server,established; content:"CWD"; nocase; content:"C|3A 5C|"; distance:1; fast_pattern; reference:bugtraq,7674; reference:cve,2003-0392; reference:nessus,11677; classtype:protocol-command-decode; sid:2102125; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (tandemskydive-au.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|tandemskydive-au|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021668; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP MDTM overflow attempt"; flow:to_server,established; content:"MDTM"; nocase; isdataat:100,relative; pcre:"/^MDTM\s[^\n]{100}/smi"; reference:bugtraq,9751; reference:cve,2001-1021; reference:cve,2004-0330; reference:nessus,12080; classtype:attempted-admin; sid:2102546; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (groupdive-au.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|groupdive-au|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021669; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP RETR format string attempt"; flow:to_server,established; content:"RETR"; nocase; pcre:"/^RETR\s[^\n]*?%[^\n]*?%/smi"; reference:bugtraq,9800; classtype:attempted-admin; sid:2102574; rev:2; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (au-skydivelessons.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|au-skydivelessons|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021670; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP CWD ..."; flow:to_server,established; content:"CWD"; nocase; content:"..."; distance:0; pcre:"/^CWD\s[^\n]*?\.\.\./smi"; reference:bugtraq,9237; classtype:bad-unknown; sid:2101229; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (bungee4you-uy.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0d|bungee4you-uy|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021671; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP CWD ~root attempt"; flow:to_server,established; content:"CWD"; nocase; content:"~root"; distance:1; nocase; pcre:"/^CWD\s+~root/smi"; reference:arachnids,318; reference:cve,1999-0082; classtype:bad-unknown; sid:2100336; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (uruguay-crazybungee.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|13|uruguay-crazybungee|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021672; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP NLST overflow attempt"; flow:to_server,established; content:"NLST"; nocase; isdataat:100,relative; pcre:"/^NLST\s[^\n]{100}/smi"; reference:bugtraq,10184; reference:bugtraq,7909; reference:bugtraq,9675; reference:cve,1999-1544; classtype:attempted-admin; sid:2102374; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (bungeejumping-uy.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|bungeejumping-uy|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021673; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP PORT bounce attempt"; flow:to_server,established; content:"PORT"; nocase; ftpbounce; pcre:"/^PORT/smi"; classtype:misc-attack; sid:2103441; rev:2; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (groupbungee-uy.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0e|groupbungee-uy|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021674; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP REST with numeric argument"; flow:to_server,established; content:"REST"; nocase; pcre:"/REST\s+[0-9]+\n/i"; reference:bugtraq,7825; classtype:attempted-recon; sid:2103460; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (circlesofourlives-ir.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|14|circlesofourlives-ir|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021675; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP RETR overflow attempt"; flow:to_server,established; content:"RETR"; nocase; isdataat:100,relative; pcre:"/^RETR\s[^\n]{100}/smi"; reference:bugtraq,8315; reference:cve,2003-0466; reference:cve,2004-0287; reference:cve,2004-0298; classtype:attempted-admin; sid:2102392; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (clickflowers-hk.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0f|clickflowers-hk|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021676; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP RNFR overflow attempt"; flow:to_server,established; content:"RNFR"; nocase; isdataat:100,relative; pcre:"/^RNFR\s[^\n]{100}/smi"; classtype:attempted-admin; sid:2103077; rev:2; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (cropcirclestours.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|cropcirclestours|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021677; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP RNTO overflow attempt"; flow:to_server,established; content:"RNTO"; nocase; isdataat:100,relative; pcre:"/^RNTO\s[^\n]{100}/smi"; reference:bugtraq,8315; reference:cve,2000-0133; reference:cve,2001-1021; reference:cve,2003-0466; classtype:attempted-admin; sid:2102389; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (irelancropcircles.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|irelancropcircles|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021678; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP STAT overflow attempt"; flow:to_server,established; content:"STAT"; nocase; isdataat:100,relative; pcre:"/^STAT\s[^\n]{100}/smi"; reference:bugtraq,3507; reference:bugtraq,8542; reference:cve,2001-0325; reference:cve,2001-1021; reference:url,labs.defcom.com/adv/2001/def-2001-31.txt; classtype:attempted-admin; sid:2101379; rev:13; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (ir-cool.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|07|ir-cool|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021679; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP STOU overflow attempt"; flow:to_server,established; content:"STOU"; nocase; isdataat:100,relative; pcre:"/^STOU\s[^\n]{100}/smi"; reference:bugtraq,8315; reference:cve,2003-0466; classtype:attempted-admin; sid:2102390; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (magnificentcircles.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|12|magnificentcircles|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021680; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP XMKD overflow attempt"; flow:to_server,established; content:"XMKD"; nocase; isdataat:100,relative; pcre:"/^XMKD\s[^\n]{100}/smi"; reference:bugtraq,7909; reference:cve,2000-0133; reference:cve,2001-1021; classtype:attempted-admin; sid:2102373; rev:5; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (china-flowershop.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|china-flowershop|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021681; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP format string attempt"; flow:to_server,established; content:"%"; fast_pattern:only; pcre:"/\s+.*?%.*?%/smi"; classtype:string-detect; sid:2102417; rev:2; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (hongkong-bouquets.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|11|hongkong-bouquets|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021682; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP format string attempt"; flow:to_server,established; content:"%p"; nocase; reference:nessus,10452; reference:bugtraq,1387; reference:bugtraq,2240; reference:bugtraq,726; reference:cve,2000-0573; reference:cve,1999-0997; classtype:attempted-admin; sid:2101530; rev:14; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (beautifuldaisies.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|beautifuldaisies|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021683; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP passwd retrieval attempt"; flow:to_server,established; content:"RETR"; nocase; content:"passwd"; reference:arachnids,213; classtype:suspicious-filename-detect; sid:2100356; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert udp $HOME_NET any -> any 53 (msg:"ET DELETED APT Cheshire Cat DNS Lookup (rosesinchina.com)"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|0c|rosesinchina|03|com|00|"; nocase; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3981; classtype:targeted-activity; sid:2021684; rev:1; metadata:created_at 2015_08_18, former_category TROJAN, updated_at 2018_01_10;) +#alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"GPL FTP FTP Bad login"; flow:from_server,established; content:"530 "; depth:4; pcre:"/^530\s+(Login|User)/smi"; classtype:bad-unknown; sid:2100491; rev:10; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|10|lastinstanse.com"; distance:1; within:17; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021686; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_19, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP FTP no password"; flow:from_client,established; content:"PASS"; nocase; pcre:"/^PASS\s*\n/smi"; reference:arachnids,322; classtype:unknown; sid:2100489; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|13|deliverytrading.com"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021687; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_19, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP MKD / possible warez site"; flow:to_server,established; content:"MKD"; nocase; content:"/ "; distance:1; classtype:misc-activity; sid:2100554; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 f3 d9 2f af b4 8c 02 29|"; within:35; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021688; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_19, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP FTP anonymous ftp login attempt"; flow:to_server,established; content:"USER"; nocase; content:" ftp|0D 0A|"; nocase; classtype:misc-activity; sid:2101449; rev:9; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|1c|contrarypresidentstspea.info"; distance:1; within:29; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021695; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP FTP file_id.diz access possible warez site"; flow:to_server,established; content:"RETR"; nocase; content:"file_id.diz"; distance:1; nocase; classtype:suspicious-filename-detect; sid:2101445; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Possible TDS Redirecting to EK Aug 19 2015"; flow:established,from_server; file_data; content:"|27|ad|27|+|27|dEv|27|+|27|entListe|27|+|27|ner|27|"; content:"|27|att|27|+|27|achEve|27|+|27|nt|27|"; content:"|27|DOMCo|27|+|27|ntentL|27|+|27|oad|27|+|27|ed|27|"; classtype:exploit-kit; sid:2021696; rev:2; metadata:created_at 2015_08_20, updated_at 2015_08_20;) +#alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP LIST integer overflow attempt"; flow:to_server,established; content:"LIST"; nocase; pcre:"/^LIST\s+\x22-W\s+\d/smi"; reference:bugtraq,8875; reference:cve,2003-0853; reference:cve,2003-0854; classtype:misc-attack; sid:2102272; rev:6; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -alert tcp $EXTERNAL_NET 25565 -> $HOME_NET any (msg:"ET GAMES MINECRAFT Server response inbound"; flow:established,from_server; content:"|7B 22|"; depth:10; classtype:policy-violation; sid:2021701; rev:1; metadata:created_at 2015_08_21, updated_at 2015_08_21;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP authorized_keys file transferred"; flow:to_server,established; content:"authorized_keys"; classtype:suspicious-filename-detect; sid:2101927; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tcp $HOME_NET 25565 -> $EXTERNAL_NET any (msg:"ET GAMES MINECRAFT Server response outbound"; flow:established,from_server; content:"|7B 22|"; depth:10; classtype:policy-violation; sid:2021702; rev:1; metadata:created_at 2015_08_21, former_category GAMES, updated_at 2015_08_21;) +#alert tcp any any -> $HOME_NET 21 (msg:"ET FTP ProFTPD Backdoor Inbound Backdoor Open Request (ACIDBITCHEZ)"; flow:established,to_server; content:"HELP "; depth:5; content:"ACIDBITCHEZ"; distance:0; nocase; reference:url,slashdot.org/story/10/12/02/131214/ProFTPDorg-Compromised-Backdoor-Distributed; reference:url,xorl.wordpress.com/2010/12/02/news-proftpd-owned-and-backdoored/; reference:url,sourceforge.net/mailarchive/message.php?msg_name=alpine.DEB.2.00.1012011542220.12930%40familiar.castaglia.org; classtype:trojan-activity; sid:2011994; rev:5; metadata:created_at 2010_12_02, former_category FTP, updated_at 2010_12_02;) -#alert http $HOME_NET any -> $EXTERNAL_NET ![80,8080,3128,3129] (msg:"ET DELETED Job314/Neutrino Reboot EK Payload Aug 19 2015"; flow:established,to_server; content:!"Referer|3a|"; http_header; content:!"Accept-"; http_header; content:"Windows NT"; fast_pattern:only; http_header; content:"User-Agent|3a 20|Mozilla"; content:"GET"; http_method; pcre:"/^\/(?:[a-z]{3,20}\/(?:(?:[a-z\d+]*?[A-Z])(?:[A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/(?:[a-z]{3,20}-)+[a-z]{3,20}|(?:[a-z]{3,20}-)+\d+|(?:[a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/(?:[a-z]{3,20}\/)+(?:[a-z]{3,20}-)+[a-z]{3,20}\.html)$/U"; pcre:"/^Host\x3a[^\r\n]*?\x3a(?!(80(?:80)|312[89]))\d+\r$/Hm"; classtype:exploit-kit; sid:2021694; rev:5; metadata:created_at 2015_08_19, former_category CURRENT_EVENTS, updated_at 2018_06_18;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP USER overflow attempt"; flow:to_server,established,no_stream; content:"USER|20|"; nocase; isdataat:100,relative; pcre:"/^USER\x20[^\x00\x20\x0a\x0d]{100}/smi"; reference:bugtraq,10078; reference:bugtraq,1227; reference:bugtraq,1504; reference:bugtraq,1690; reference:bugtraq,4638; reference:bugtraq,7307; reference:bugtraq,8376; reference:cve,1999-1510; reference:cve,1999-1514; reference:cve,1999-1519; reference:cve,1999-1539; reference:cve,2000-0479; reference:cve,2000-0656; reference:cve,2000-0761; reference:cve,2000-0943; reference:cve,2000-1035; reference:cve,2000-1194; reference:cve,2001-0256; reference:cve,2001-0794; reference:cve,2001-0826; reference:cve,2002-0126; reference:cve,2002-1522; reference:cve,2003-0271; reference:cve,2004-0286; classtype:attempted-admin; sid:2101734; rev:36; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|55 04 03|"; content:"|0e|mojojantes.com"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021703; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_24, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP STAT * dos attempt"; flow:to_server,established; content:"STAT"; nocase; pcre:"/^STAT\s+[^\n]*\x2a/smi"; reference:bugtraq,4482; reference:cve,2002-0073; reference:nessus,10934; reference:url,www.microsoft.com/technet/security/bulletin/MS02-018.mspx; classtype:attempted-dos; sid:2101777; rev:12; metadata:created_at 2010_09_23, former_category FTP, updated_at 2020_08_20;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 91 48 c0 28 b4 2b 86 c7|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021704; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_24, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP iss scan"; flow:to_server,established; content:"pass -iss@iss"; fast_pattern; reference:arachnids,331; classtype:suspicious-login; sid:2100354; rev:8; metadata:created_at 2010_09_23, updated_at 2019_10_08;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ursnif CnC)"; flow:from_server,established; content:"|55 04 03|"; content:"|0d|serenyefa.com"; distance:1; within:14; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021705; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_24, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP pass wh00t"; flow:to_server,established; content:"pass wh00t"; nocase; fast_pattern; reference:arachnids,324; classtype:suspicious-login; sid:2100355; rev:8; metadata:created_at 2010_09_23, updated_at 2019_10_08;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi CnC)"; flow:from_server,established; content:"|55 04 03|"; content:"|1a|becomesthelegislatures.org"; distance:1; within:27; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021706; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_24, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP piss scan"; flow:to_server,established; content:"pass -cklaus"; fast_pattern; classtype:suspicious-login; sid:2100357; rev:8; metadata:created_at 2010_09_23, updated_at 2019_10_08;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT HT SWF Exploit RIP M2"; flow:established,from_server; file_data; content:""; content:"return navigator.appName"; content:"return navigator.platform|3b|"; content:"clsid|3a|D27CDB6E-AE6D-11cf-96B8-444553540000"; nocase; classtype:trojan-activity; sid:2021710; rev:2; metadata:created_at 2015_08_25, former_category CURRENT_EVENTS, updated_at 2015_08_25;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP saint scan"; flow:to_server,established; content:"pass -saint"; fast_pattern; reference:arachnids,330; classtype:suspicious-login; sid:2100358; rev:8; metadata:created_at 2010_09_23, updated_at 2019_10_08;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 c3 f0 c2 3d 49 5e bb 16|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021717; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP satan scan"; flow:to_server,established; content:"pass -satan"; fast_pattern; reference:arachnids,329; classtype:suspicious-login; sid:2100359; rev:8; metadata:created_at 2010_09_23, updated_at 2019_10_08;) -alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE EvilGrab/Vidgrab Checkin"; flow:to_server,established; content:"|7c 28|"; pcre:"/^\d{1,3}\x2e\d{1,3}\x2e\d{1,3}\x2e\d{1,3}/R"; content:"|29 7c|"; within:2; pcre:"/^\d{1,5}/R"; content:"|7c|Win"; within:4; reference:url,contagiodump.blogspot.com.br/2013/09/sandbox-miming-cve-2012-0158-in-mhtml.html; classtype:command-and-control; sid:2017413; rev:3; metadata:created_at 2013_09_04, former_category MALWARE, updated_at 2013_09_04;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP tar parameters"; flow:to_server,established; content:" --use-compress-program "; nocase; fast_pattern; reference:arachnids,134; reference:bugtraq,2240; reference:cve,1999-0202; reference:cve,1999-0997; classtype:bad-unknown; sid:2100362; rev:15; metadata:created_at 2010_09_23, updated_at 2019_10_08;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 b6 45 0c e4 b7 4c af d5|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021722; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_27, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL FTP invalid MDTM command attempt"; flow:to_server,established; content:"MDTM"; fast_pattern; nocase; pcre:"/^MDTM \d+[-+]\D/smi"; reference:bugtraq,9751; reference:cve,2001-1021; reference:cve,2004-0330; classtype:attempted-admin; sid:2102416; rev:8; metadata:created_at 2010_09_23, updated_at 2019_10_08;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|16|hasselbladolsonson.com"; distance:1; within:23; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021721; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_27, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET FTP Outbound Java Downloading jar over FTP"; flow:to_server,established; flowbits:isset,ET.Java.FTP.Logon; content:".jar"; nocase; fast_pattern; content:"RETR "; pcre:"/^[^\r\n]+\.jar/Ri"; classtype:misc-activity; sid:2016688; rev:3; metadata:created_at 2013_03_29, updated_at 2019_10_08;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0a|ssldata.ru"; distance:1; within:11; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021720; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_27, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET FTP Outbound Java Anonymous FTP Login"; flow:to_server,established; content:"USER anonymous|0d 0a|PASS Java1."; fast_pattern; pcre:"/^\d\.\d(_\d+)?\@\r\n/R"; flowbits:set,ET.Java.FTP.Logon; classtype:misc-activity; sid:2016687; rev:4; metadata:created_at 2013_03_29, updated_at 2022_03_17;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Cryptowall docs campaign Aug 2015 encrypted binary (1)"; flow:established,to_client; file_data; content:"|65 5d d1 c6 b0 88 68 62|"; within:8; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2021725; rev:2; metadata:created_at 2015_08_27, former_category EXPLOIT_KIT, updated_at 2015_08_27;) +# Emerging Threats +# +# This distribution may contain rules under two different licenses. +# +# Rules with sids 1 through 3464, and 100000000 through 100000908 are under the GPLv2. +# A copy of that license is available at http://www.gnu.org/licenses/gpl-2.0.html +# +# Rules with sids 2000000 through 2799999 are from Emerging Threats and are covered under the BSD License +# as follows: +# +#************************************************************* +# Copyright (c) 2003-2022, Emerging Threats +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the +# following conditions are met: +# +# * Redistributions of source code must retain the above copyright notice, this list of conditions and the following +# disclaimer. +# * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the +# following disclaimer in the documentation and/or other materials provided with the distribution. +# * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES, +# INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +# DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +# SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE +# USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +# +#************************************************************* +# +# +# +# -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Magnitude/Hunter EK IE Exploit Aug 23 2015"; flow:from_server,established; file_data; content:"|22 3a 22 4d 4f 56 20 5b 45 43 58 2b 30 43 5d 2c 45 41 58 22|"; fast_pattern; content:"|22 3a 22 76 69 72 74 75 61 6c 70 72 6f 74 65 63 74 22|"; classtype:exploit-kit; sid:2021707; rev:3; metadata:created_at 2015_08_24, former_category EXPLOIT_KIT, updated_at 2015_08_24;) +# This Ruleset is EmergingThreats Open optimized for suricata-5.0-enhanced. -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Alphacrypt/TeslaCrypt Ransomware CnC Beacon Response"; flow:established,to_client; file_data; content:"---!!!INSERTED!!!---"; within:20; reference:md5,ee90ec9935c7b8e1a5dad364d4545851; classtype:command-and-control; sid:2021724; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_08_28, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_08_28, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Battle.net Starcraft login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"RATS"; offset:12; depth:12; reference:url,doc.emergingthreats.net/bin/view/Main/2002101; classtype:policy-violation; sid:2002101; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Dridex SSL Cert Aug 12 2015"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; distance:9; within:25; content:"|55 04 06|"; distance:0; content:"|02|US"; distance:1; within:3; content:"|55 04 08|"; distance:0; content:"|07|Arizona"; fast_pattern; distance:1; within:8; content:"|55 04 07|"; distance:0; content:"|0a|Scottsdale"; distance:1; within:11; content:"|55 04 0a|"; distance:0; pcre:"/^.{2}(?!GoDaddy)[A-Z][a-z]+\s[A-Z][a-z]+\s(?:NL|Pty|Inc|Corp|Ltd)/Rs"; content:"|55 04 03|"; distance:0; pcre:"/^.{2}[a-z]{5,}\.[a-z]{2}\x30/Rs"; classtype:trojan-activity; sid:2021621; rev:6; metadata:attack_target Client_Endpoint, created_at 2015_08_13, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Battle.net Brood War login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"PXES"; offset:12; depth:12; reference:url,doc.emergingthreats.net/bin/view/Main/2002102; classtype:policy-violation; sid:2002102; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE PawnStorm Java Class Stage 1 M1 Aug 28 2015"; flow:established,from_server; file_data; content:"|01 00 08 47 4f 47 4f 47 4f 47 4f|"; content:"|01 00 0c 6a 61 76 61 2f 6e 65 74 2f 55 52 4c|"; content:"|01 00 0f 53 74 61 72 74 69 6e 67 20 41 70 70 6c 65 74|"; classtype:targeted-activity; sid:2021726; rev:2; metadata:created_at 2015_08_28, former_category CURRENT_EVENTS, updated_at 2015_08_28;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Battle.net Diablo login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"LTRD"; offset:12; depth:12; reference:url,doc.emergingthreats.net/bin/view/Main/2002103; classtype:policy-violation; sid:2002103; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE PawnStorm Java Class Stage 2 M1 Aug 28 2015"; flow:established,from_server; file_data; content:"|01 00 0e 4c 50 68 61 6e 74 6f 6d 53 75 70 65 72 3b|"; fast_pattern; content:"|01 00 32 4c 6a 61 76 61 2f 75 74 69 6c 2f 63 6f 6e 63 75 72 72 65 6e 74 2f 61 74 6f 6d 69 63 2f 41 74 6f 6d 69 63 52 65 66 65 72 65 6e 63 65 41 72 72 61 79 3b|"; classtype:targeted-activity; sid:2021727; rev:2; metadata:created_at 2015_08_28, former_category CURRENT_EVENTS, updated_at 2015_08_28;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Battle.net Diablo 2 login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"VD2D"; offset:12; depth:12; reference:url,doc.emergingthreats.net/bin/view/Main/2002104; classtype:policy-violation; sid:2002104; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE PawnStorm Java Class Stage 2 M2 Aug 28 2015"; flow:established,from_server; file_data; content:"|01 00 0a 63 6f 72 6d 61 63 2e 6d 63 72|"; classtype:targeted-activity; sid:2021728; rev:2; metadata:created_at 2015_08_28, former_category CURRENT_EVENTS, updated_at 2015_08_28;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Battle.net Diablo 2 Lord of Destruction login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"PX2D"; offset:12; depth:12; reference:url,doc.emergingthreats.net/bin/view/Main/2002105; classtype:policy-violation; sid:2002105; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 b4 ff d7 c2 ee b9 dd f0|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021731; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_31, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Battle.net Warcraft 2 login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"NB2W"; offset:12; depth:12; reference:url,doc.emergingthreats.net/bin/view/Main/2002106; classtype:policy-violation; sid:2002106; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 d7 5d 30 37 a7 6b 0d 17|"; within:35; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021732; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_31, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Battle.net Warcraft 3 login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"3RAW"; offset:12; depth:12; reference:url,doc.emergingthreats.net/bin/view/Main/2002107; classtype:policy-violation; sid:2002107; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|bri-secure.com"; distance:1; within:15; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021733; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_31, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net old game version"; flow:established,from_server; content:"|FF 51|"; depth:2; content:"|00 01 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002109; classtype:policy-violation; sid:2002109; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|12|kingddomdirect.com"; distance:1; within:19; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021734; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_31, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net invalid version"; flow:established,from_server; content:"|FF 51 08 00 01 01 00 00|"; reference:url,doc.emergingthreats.net/bin/view/Main/2002110; classtype:policy-violation; sid:2002110; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Aug 31 2015 T2 (BizCN)"; flow:from_server,established; file_data; content:"|3d 27 44 4f 4d 43 6f 27 2b 27 6e 74 65 6e 74 4c 27 2b 27 6f 61 64 27 2b 27 65 64 27 3b 66 6b 3d 77 69 6e 64 6f 77 3b|"; classtype:exploit-kit; sid:2021740; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2015_09_01, deployment Perimeter, signature_severity Major, tag Redirector, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net invalid cdkey"; flow:established,from_server; content:"|FF 51 09 00 00 02 00 00|"; reference:url,doc.emergingthreats.net/bin/view/Main/2002111; classtype:policy-violation; sid:2002111; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Double-Encoded Reverse Base64/Dean Edwards Packed JavaScript Observed in Unknown EK Feb 16 2015 b64 1 M2"; flow:established,from_server; file_data; content:"CZsUGLrxyYsEGLwhibvlGdj5WdmhCbhZXZ"; classtype:exploit-kit; sid:2020426; rev:3; metadata:created_at 2015_02_16, updated_at 2015_02_16;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net cdkey in use"; flow:established,from_server; content:"|FF 51|"; depth:2; content:"|01 02 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002112; classtype:policy-violation; sid:2002112; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET [443,4443] -> $HOME_NET any (msg:"ET MALWARE Possible Dyre SSL Cert Aug 31 2015"; flow:established,from_server; content:".com"; content:"|16|"; content:"|0b|"; within:8; content:"|02 09 00|"; distance:17; within:3; content:"|06 03 55 04 06 13 02|"; distance:0; pcre:"/^[A-Z]{2}[01]/R"; content:"|55 04 08|"; distance:0; byte_test:1,>,9,1,relative; byte_test:1,<,121,1,relative; pcre:"/^.{2}[A-Z]{10,120}/R"; content:"|55 04 07|"; distance:0; content:"|55 04 0a|"; distance:0; content:"|55 04 03|"; byte_extract:1,1,cnlength,relative; content:!"|2e|"; within:cnlength; content:"|55 04 0b|"; distance:0; content:"|2a 86 48 86 f7 0d 01 09 01|"; fast_pattern; distance:0; pcre:"/^.{2}[a-z]+@[a-z]+\.com[01]/R"; reference:md5,26e83fa8b2f3eccfe975cd451933ae63; reference:url,us-cert.gov/ncas/alerts/TA14-300A; classtype:trojan-activity; sid:2021736; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_08_31, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net banned key"; flow:established,from_server; content:"|FF 51 09 00 02 02 00 00|"; reference:url,doc.emergingthreats.net/bin/view/Main/2002113; classtype:policy-violation; sid:2002113; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET [443,4443] -> $HOME_NET any (msg:"ET MALWARE Possible Dyre SSL Cert Aug 31 2015"; flow:established,from_server; content:".com"; content:"|16|"; content:"|0b|"; within:8; content:"|02 09 00|"; distance:17; within:3; content:"|06 03 55 04 06 13 02|"; distance:0; pcre:"/^[A-Z]{2}/R"; content:"|55 04 08|"; distance:0; pcre:"/^.{2}(?P[A-Z][a-z]+).*?\x55\x04\x07.{2}(?P=state)\x0a/Rsi"; content:"|55 04 0a|"; distance:0; content:"|55 04 03|"; byte_extract:1,1,cnlength,relative; content:!"|2e|"; within:cnlength; content:"|55 04 0b|"; distance:0; content:"|2a 86 48 86 f7 0d 01 09 01|"; distance:0; fast_pattern; pcre:"/^.{2}[a-z]+@[a-z]+\.com[01]/R"; reference:md5,26e83fa8b2f3eccfe975cd451933ae63; reference:url,us-cert.gov/ncas/alerts/TA14-300A; classtype:trojan-activity; sid:2021735; rev:4; metadata:attack_target Client_Endpoint, created_at 2015_08_31, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net wrong product"; flow:established,from_server; content:"|FF 51 09 00 03 02 00 00|"; reference:url,doc.emergingthreats.net/bin/view/Main/2002114; classtype:policy-violation; sid:2002114; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Boaxxe.BR CnC Beacon"; flow:established,to_server; content:"|7c|CM01|7c|CM02|7c|CM03|7c|"; content:!">"; reference:md5,ec38ae7c35be4d7f8103bf1db692d2f8; classtype:command-and-control; sid:2021748; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_09_08, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_09_08, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net user in channel"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|01 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002118; classtype:policy-violation; sid:2002118; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ef 7e c0 ae 97 cf ff 23|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021750; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net user joined channel"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|02 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002140; classtype:policy-violation; sid:2002140; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 d4 45 4d a6 49 0c f1 ed|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021751; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net user left channel"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|03 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002141; classtype:policy-violation; sid:2002141; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED possible Sofacy encrypted binary (1)"; flow:established,to_client; file_data; content:"|57 46 e8 67 27 3d 66 1a|"; within:8; flowbits:set,et.exploitkitlanding; reference:url,labsblog.f-secure.com/2015/09/08/sofacy-recycles-carberp-and-metasploit-code/; reference:url,www.isightpartners.com/2015/07/microsoft-office-zero-day-cve-2015-2424-leveraged-by-tsar-team/; classtype:targeted-activity; sid:2021755; rev:2; metadata:created_at 2015_09_09, former_category EXPLOIT_KIT, updated_at 2019_09_10;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net received whisper message"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|04 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002142; classtype:policy-violation; sid:2002142; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Android Stagefright MP4 CVE-2015-1538 - ROP"; flow:established,from_server; file_data; content:"|00 00 00 18 66 74 79 70|mp4"; within:13; content:"|98 2A 00 B0 B3 38 00 B0|"; fast_pattern; content:"|00 10 00 00 07 00 00 00 03 D0 00 D0 04 D0 00 D0 44 11 00 B0|"; distance:4; within:20; reference:cve,2015-1538; reference:url,blog.zimperium.com/the-latest-on-stagefright-cve-2015-1538-exploit-is-now-available-for-testing-purposes/; classtype:attempted-user; sid:2021758; rev:2; metadata:created_at 2015_09_10, updated_at 2015_09_10;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net received server broadcast"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|06 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002143; classtype:policy-violation; sid:2002143; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Android Stagefright MP4 CVE-2015-1538 - STSC"; flow:established,from_server; file_data; content:"stsc|00 00 00 00 C0 00 00 03|"; fast_pattern; content:!"|00 00 00 00|"; within:4; pcre:"/^(?P.{4})(?P.{4})(?P=addr2)(?P=addr1)/Rsi"; reference:cve,2015-1538; reference:url,blog.zimperium.com/the-latest-on-stagefright-cve-2015-1538-exploit-is-now-available-for-testing-purposes/; classtype:attempted-user; sid:2021759; rev:2; metadata:created_at 2015_09_10, updated_at 2015_09_10;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net joined channel"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|07 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002144; classtype:policy-violation; sid:2002144; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Waledac 2.0/Storm Worm 3.0 GET request detected"; flow:established; content:"GET"; nocase; http_method; urilen:1; content:"/"; http_uri; content:"|0d 0a|Content-Length|3a| "; http_header; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 8.0|3b| Windows NT 6.1|3b| Trid"; http_header; content:"ent/4.0)|0d 0a 0d 0a 01 02 01 01 01 01 02 01|"; fast_pattern; http_header; within:20; classtype:trojan-activity; sid:2012136; rev:10; metadata:created_at 2011_01_05, updated_at 2011_01_05;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net user had a flags update"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|09 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002145; classtype:policy-violation; sid:2002145; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0a|fiopol.xyz"; distance:1; within:11; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021767; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_14, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net sent a whisper"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|0a 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002146; classtype:policy-violation; sid:2002146; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|13|online.creditoc.com"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021769; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_14, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net channel full"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|0d 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002147; classtype:policy-violation; sid:2002147; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|12|static.coopsrv.com"; distance:1; within:19; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021770; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_14, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net channel doesn't exist"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|0e 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002148; classtype:policy-violation; sid:2002148; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e4 20 1c 21 75 01 8e 93|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021771; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_14, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net channel is restricted"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|0f 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002149; classtype:policy-violation; sid:2002149; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE PE EXE or DLL Windows file download Text"; flow:established,from_server; file_data; content:"4D5A"; distance:0; byte_jump:8,114,relative,multiplier 2,little,string,hex; content:"50450000"; distance:-126; within:8; classtype:trojan-activity; sid:2021774; rev:2; metadata:created_at 2015_09_15, updated_at 2015_09_15;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net informational message"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|12 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002150; classtype:policy-violation; sid:2002150; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|12|stat.coopswiss.com"; distance:1; within:19; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021776; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net error message"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|13 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002151; classtype:policy-violation; sid:2002151; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|13|online.centersu.com"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021777; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net 'emote' message"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|17 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002152; classtype:policy-violation; sid:2002152; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Cryptowall docs campaign Sept 2015 encrypted binary (1)"; flow:established,to_client; file_data; content:"|23 31 f9 4f 62 57 73 67|"; within:8; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2021778; rev:2; metadata:created_at 2015_09_15, former_category EXPLOIT_KIT, updated_at 2015_09_15;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Battle.net outgoing chat message"; flow:established,to_server; content:"|FF 0E|"; depth:2; reference:url,doc.emergingthreats.net/bin/view/Main/2002119; classtype:policy-violation; sid:2002119; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|menardgevu.com"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021779; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 3724 (msg:"ET GAMES World of Warcraft connection"; flow:established,to_server; content:"|00|"; depth:1; content:"|25 00|WoW|00|"; distance:1; within:7; reference:url,doc.emergingthreats.net/bin/view/Main/2002138; classtype:policy-violation; sid:2002138; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|19|menardgevu.com"; distance:1; within:26; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021780; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $EXTERNAL_NET 3724 -> $HOME_NET any (msg:"ET GAMES World of Warcraft failed logon"; flow:established,from_server; content:"|01 0A|"; depth:2; reference:url,doc.emergingthreats.net/bin/view/Main/2002139; classtype:policy-violation; sid:2002139; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0d|feedfeed.name"; distance:1; within:14; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021781; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Guild Wars connection"; flow:established,to_server; content:"|01 00 00 00 00 F1 00 10 00 01 00 00 00 00 00 00 00 00 00 00 00|"; reference:url,doc.emergingthreats.net/bin/view/Main/2002154; classtype:policy-violation; sid:2002154; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|my.ubscard.com"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021782; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net incoming chat message"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|05 00 00 00|"; offset:4; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2002170; classtype:policy-violation; sid:2002170; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|19|disaallowmediapartners.mn"; distance:1; within:26; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021783; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert udp $HOME_NET any -> $EXTERNAL_NET 27015 (msg:"ET GAMES Steam connection"; content:"getchallengesteam"; reference:url,doc.emergingthreats.net/bin/view/Main/2002155; classtype:policy-violation; sid:2002155; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Shifu CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 f2 49 34 bb 25 38 61 40|"; within:35; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021784; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_09_22, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert tcp $HOME_NET any -> $EXTERNAL_NET 27020:27050 (msg:"ET GAMES STEAM Connection (v2)"; flow:established,to_server; content:"|00 00 00 03|"; dsize:4; reference:url,doc.emergingthreats.net/bin/view/Main/2003089; classtype:policy-violation; sid:2003089; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Angler EK Exploit Download"; flow:established,to_server; urilen:15; content:"Java/1."; http_header; content:"/0"; depth:2; http_uri; pcre:"/^\/0[a-z0-9]{13}$/U"; classtype:exploit-kit; sid:2017570; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_10_08, deployment Perimeter, malware_family Angler, signature_severity Critical, tag Angler, tag Exploit_Kit, updated_at 2018_06_18;) +#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak3 Connect"; content:"|00 00 00 00 02 9d 74 8b 45 aa 7b ef b9 9e fe ad 08 19 ba cf 41 e0 16 a2|"; offset:8; depth:24; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011733; classtype:policy-violation; sid:2011733; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tcp any any -> $HOME_NET 80 (msg:"ET MALWARE SYNful Knock Cisco IOS Router Implant CnC Beacon (INBOUND)"; flow:established,to_server; content:"|00 00 00 00|text|00|"; byte_jump:4,0,relative,post_offset -1; isdataat:!2,relative; reference:url,fireeye.com/blog/threat-research/2015/09/synful_knock_-_acis.html; classtype:command-and-control; sid:2021785; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_09_16, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_09_16, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Connection/Login"; content:"|f4 be 03 00|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011734; classtype:policy-violation; sid:2011734; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible TDSS Base64 Encoded Command 3"; flow:established,to_server; content:"ZEV4ZWN"; http_uri; classtype:trojan-activity; sid:2012923; rev:3; metadata:created_at 2011_06_02, updated_at 2011_06_02;) +#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Connection/Login Replay"; content:"|f4 be 04 00|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011735; classtype:policy-violation; sid:2011735; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible TDSS Base64 Encoded Command 1"; flow:established,to_server; content:"Q21kRXhl"; http_uri; classtype:trojan-activity; sid:2012921; rev:3; metadata:created_at 2011_06_02, updated_at 2011_06_02;) +#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Connection/Ping"; content:"|f4 be 01 00|"; depth:4; threshold:type limit, count 1, seconds 300, track by_src; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011736; classtype:policy-violation; sid:2011736; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible TDSS Base64 Encoded Command 2"; flow:established,to_server; content:"bWRFeGVj"; http_uri; classtype:trojan-activity; sid:2012922; rev:3; metadata:created_at 2011_06_02, updated_at 2011_06_02;) +#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Connection/Ping Reply"; content:"|f4 be 02 00|"; depth:4; threshold:type limit, count 1, seconds 300, track by_src; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011737; classtype:policy-violation; sid:2011737; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Iron Tiger DNSTunnel Retrieving CnC"; flow:established,from_server; file_data; content:"$$$$$$$$$$"; fast_pattern; pcre:"/^(?:#+[A-Z]+)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?:\x3a\d{1,5})?\${10}/R"; reference:md5,2c65085e7c71fa2c02c9b65e9b747e5b; reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-iron-tiger.pdf; classtype:command-and-control; sid:2021789; rev:2; metadata:created_at 2015_09_17, former_category MALWARE, updated_at 2015_09_17;) +#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Standard/Channel List"; content:"|f0 be 06 00|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011739; classtype:policy-violation; sid:2011739; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert udp $HOME_NET any -> $EXTERNAL_NET !53 (msg:"ET MALWARE PlugX UDP CnC Beacon"; dsize:36; content:"|00 00 50 00 02 00 00 00 00 04 00 00 00 10 00 00 00 00 00 00|"; depth:20; content:!"|00 00|"; within:2; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00|"; distance:3; within:13; reference:md5,2c65085e7c71fa2c02c9b65e9b747e5b; reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-iron-tiger.pdf; classtype:command-and-control; sid:2021791; rev:1; metadata:attack_target Client_Endpoint, created_at 2015_09_17, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_09_17, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Standard/Player List"; content:"|f0 be 07 00|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011740; classtype:policy-violation; sid:2011740; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"GPL NETBIOS SMB Session Setup NTMLSSP unicode asn1 overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMBs"; within:5; distance:3; byte_test:1,&,128,6,relative; byte_test:4,&,2147483648,48,relative,little; content:!"NTLMSSP"; within:7; distance:54; asn1:double_overflow, bitstring_overflow, relative_offset 54, oversize_length 2048; reference:bugtraq,9633; reference:bugtraq,9635; reference:cve,2003-0818; reference:nessus,12052; reference:nessus,12065; reference:url,www.microsoft.com/technet/security/bulletin/MS04-007.mspx; classtype:protocol-command-decode; sid:2103000; rev:8; metadata:created_at 2010_09_23, updated_at 2010_09_23;) +#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Standard/Login End"; content:"|f0 be 08 00|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011741; classtype:policy-violation; sid:2011741; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0c|nntpdinfo.pw"; distance:1; within:13; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021797; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_17, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Standard/New Player Joined"; content:"|f0 be 64 00|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011742; classtype:policy-violation; sid:2011742; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|15|reportingdelivery.com"; distance:1; within:22; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021798; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_17, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Standard/Player Left"; content:"|f0 be 65 00|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011743; classtype:policy-violation; sid:2011743; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|11|localinstanse.net"; distance:1; within:18; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021799; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_17, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Standard/Change Status"; content:"|f0 be 30 01|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011744; classtype:policy-violation; sid:2011744; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|12|healthweather.name"; distance:1; within:19; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021801; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Standard/Known Player Update"; content:"|f0 be 68 00|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011745; classtype:policy-violation; sid:2011745; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 f0 83 4c 61 ec 09 e6 03|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021802; rev:3; metadata:attack_target Client_and_Server, created_at 2015_09_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Standard/Disconnect"; content:"|f0 be 2c 01|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011746; classtype:policy-violation; sid:2011746; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 d3 1b a5 8f 1d d7 30 48|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021803; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 ACK"; content:"|f1 be|"; depth:2; dsize:16; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011747; classtype:policy-violation; sid:2011747; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 f1 03 f7 ce 62 9d fb 5a|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021804; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert tcp $HOME_NET any -> $EXTERNAL_NET 20000 (msg:"ET GAMES Gold VIP Club Casino Client in Use"; flow:established,to_server; dsize:25; content:"Gold VIP Club Casino"; reference:url,doc.emergingthreats.net/2007746; classtype:policy-violation; sid:2007746; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Rovnix CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|0f|cherniypoyas.ru"; distance:1; within:16; reference:md5,080db9578ea797cd231bc1160d3824f1; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021805; rev:3; metadata:attack_target Client_and_Server, created_at 2015_09_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET GAMES TrackMania Request Connect"; flow:to_server,established; content:"POST"; http_method; content:"/online_game/request.php"; http_uri; content:"User-Agent|3a| GameBox"; http_header; content:"Connect"; nocase; http_client_body; reference:url,www.trackmania.com; reference:url,doc.emergingthreats.net/2011752; classtype:policy-violation; sid:2011752; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|12|sslsecureserver.eu"; distance:1; within:19; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021809; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_22, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"ET GAMES Battle.net Warcraft 3 The Frozen throne login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"PX3W"; offset:12; depth:12; reference:url,doc.emergingthreats.net/bin/view/Main/2002108; classtype:policy-violation; sid:2002108; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0c|uplinkadv.eu"; distance:1; within:13; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021810; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_22, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net failed account login (OLS) wrong password"; flow:established,from_server; content:"|FF 3A 08 00 02 00 00 00|"; reference:url,doc.emergingthreats.net/bin/view/Main/2002115; classtype:policy-violation; sid:2002115; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Meterpreter or Other Reverse Shell SSL Cert"; flow:established,from_server; content:"|0b|"; content:"|04 08 bb 00 ee|"; distance:23; within:5; fast_pattern; content:"|55 04 06 13 00|"; distance:0; content:"|55 04 08 13 00|"; distance:0; content:"|55 04 07 13 00|"; distance:0; content:"|55 04 0a 13 00|"; distance:0; content:"|55 04 0b 13 00|"; distance:0; content:"|55 04 03 13 00|"; distance:0; reference:md5,c3f76f444edf0b90b887d7979342e9f0; classtype:trojan-activity; sid:2035651; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_09_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"ET GAMES Battle.net failed account login (NLS) wrong password"; flow:established,from_server; content:"|FF 54 1C 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; reference:url,doc.emergingthreats.net/bin/view/Main/2002116; classtype:policy-violation; sid:2002116; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Spy.Shiz CnC)"; flow:established,from_server; content:"|55 1d 11|"; content:"|10|blatnoidomen.com"; distance:5; within:22; fast_pattern; reference:url,sslbl.abuse.ch; reference:md5,8217cc4fc3d5781206becbef148154ea; classtype:domain-c2; sid:2021815; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET GAMES TeamSpeak2 Standard/Login Part 2"; flow:established; content:"|f0 be 05 00|"; depth:4; reference:url,teamspeak.com; reference:url,doc.emergingthreats.net/2011738; classtype:policy-violation; sid:2011738; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Spy.Shiz CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 fc 56 1e 02 6c d4 e2 22|"; within:35; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; reference:md5,e448572aea062241c80dd2a15562e968; classtype:domain-c2; sid:2021816; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert udp $EXTERNAL_NET any -> $HOME_NET 7787 (msg:"GPL GAMES Unreal Tournament secure overflow attempt"; content:"|5C|secure|5C|"; nocase; pcre:"/\x5csecure\x5c[^\x00]{50}/smi"; reference:bugtraq,10570; reference:cve,2004-0608; classtype:misc-attack; sid:2103080; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|11|www.fortamola.com"; distance:1; within:18; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021817; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert udp any any -> $HOME_NET 27901 (msg:"ET GAMES Alien Arena 7.30 Remote Code Execution Attempt"; content:"print|0A 5C|"; isdataat:257,relative; pcre:"/\x5C[^\x5C\x00]{257}/"; reference:url,www.packetstormsecurity.org/0910-advisories/alienarena-exec.txt; reference:url,doc.emergingthreats.net/2010156; classtype:misc-attack; sid:2010156; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|15|business--testing.com"; distance:1; within:22; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021818; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET GAMES PunkBuster Server webkey Buffer Overflow"; flow:established,to_server; content:"/pbsvweb"; http_uri; nocase; content:"webkey="; nocase; isdataat:500,relative; content:!"|0A|"; within:500; content:!"&"; within:500; reference:url,aluigi.altervista.org/adv/pbwebbof-adv.txt; reference:url,doc.emergingthreats.net/2002947; classtype:attempted-admin; sid:2002947; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 96 99 38 87 d8 6a ee a7|"; within:35; fast_pattern; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; reference:md5,ead31d4cbbd79466359d46694a9d56d3; classtype:domain-c2; sid:2021819; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +alert tcp $EXTERNAL_NET 25565 -> $HOME_NET any (msg:"ET GAMES MINECRAFT Server response inbound"; flow:established,from_server; content:"|7B 22|"; depth:10; classtype:policy-violation; sid:2021701; rev:1; metadata:created_at 2015_08_21, updated_at 2015_08_21;) -#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Ransomware Win32/WinPlock.A CnC Beacon 3"; flow:established,to_server; content:"POST"; http_method; urilen:1; content:!"Referer|3a|"; http_header; content:"unit_action="; depth:12; http_client_body; fast_pattern; reference:md5,b8a1012e3afc6eabb7819ce4d8e2b93b; classtype:command-and-control; sid:2021823; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_09_23, deployment Perimeter, signature_severity Major, tag c2, updated_at 2015_09_23, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;) +#alert tcp $HOME_NET 25565 -> $EXTERNAL_NET any (msg:"ET GAMES MINECRAFT Server response outbound"; flow:established,from_server; content:"|7B 22|"; depth:10; classtype:policy-violation; sid:2021702; rev:1; metadata:created_at 2015_08_21, former_category GAMES, updated_at 2015_08_21;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 82 a8 3c 4c d7 28 96 34|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021824; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $EXTERNAL_NET 6112 -> $HOME_NET !443 (msg:"ET GAMES Battle.net connection reset (possible IP-Ban)"; flow:to_client; flags:R,12; reference:url,doc.emergingthreats.net/bin/view/Main/2002117; classtype:policy-violation; sid:2002117; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|10|e-securepass.com"; distance:1; within:17; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021825; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET GAMES TrackMania Ad Report"; flow:to_server,established; content:"GET"; offset:0; depth:3; content:"/online_game/ad_report.php"; http_uri; content:"|0d 0a|User-Agent|3a| GameBox"; content:"protocol="; http_uri; content:"author="; http_uri; content:"login="; http_uri; content:"zone="; http_uri; reference:url,www.trackmania.com; reference:url,doc.emergingthreats.net/2011758; classtype:policy-violation; sid:2011758; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|1a|contactexchangenetwork.biz"; distance:1; within:27; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021826; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET GAMES TrackMania Game Launch"; flow:to_server,established; content:"GET"; offset:0; depth:3; content:"/online_game/launcher_init.php?"; http_uri; content:"|0d 0a|User-Agent|3a| GameBox"; content:"game="; http_uri; content:"lang="; http_uri; content:"protocol="; http_uri; content:"distro="; http_uri; content:"osdesc="; http_uri; reference:url,www.trackmania.com; reference:url,doc.emergingthreats.net/2011748; classtype:policy-violation; sid:2011748; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;) -#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|10|cserhtmlordi.net"; distance:1; within:17; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021827; rev:2; metadata:attack_target Client_and_Server, created_at 2015_09_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET GAMES TrackMania Game Check for Patch"; flow:to_server,established; content:"GET"; offset:0; depth:3; content:"/online_game/patch.php?"; http_uri; content:"game="; http_uri; content:"lang="; http_uri; content:"protocol="; http_uri; content:"distro="; http_uri; content:"osdesc="; http_uri; reference:url,www.trackmania.com; reference:url,doc.emergingthreats.net/2011749; classtype:policy-violation; sid:2011749; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;) -#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e8 06 34 93 99 f8 54 f2|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0b|Companyname"; distance:1; within:12; reference:md5,c7872508eededb17cf864886270fd3e9; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021828; rev:3; metadata:attack_target Client_and_Server, created_at 2015_09_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;) +#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET GAMES TrackMania Request GetConnectionAndGameParams"; flow:to_server,established; content:"POST"; offset:0; depth:4; content:"/online_game/request.php"; http_uri; content:"|0d 0a|User-Agent|3a| GameBox"; content:"GetConnectionAndGameParams"; nocase; reference:url,www.trackmania.com; reference:url,doc.emergingthreats.net/2011750; classtype:policy-violation; sid:2011750; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible Angler EK Redirector Sept 25 2015"; flow:to_client,established; file_data; content:""; pcre:"/^(?:(?!<\/body).)+?Content\s*?loading.*?Please wait.*?|22 29 3b 7d|"; classtype:bad-unknown; sid:2011978; rev:5; metadata:created_at 2010_11_24, former_category CURRENT_EVENTS, updated_at 2010_11_24;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious BITS EXE DL From Dotted Quad"; flow:established,to_server; http.uri; content:".exe"; nocase; content:!".gvt1.com/"; http.user_agent; content:"Microsoft BITS/"; depth:15; fast_pattern; http.host; content:!"download.windowsupdate.com"; content:!"download.adobe.com"; pcre:"/^(?:\d{1,3}\.){3}\d{1,3}(?:\x3a\d{1,5})?$/"; classtype:misc-activity; sid:2022858; rev:6; metadata:created_at 2016_06_03, former_category INFO, updated_at 2020_09_02;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Compressed Adobe Flash File Embedded in XLS FILE Caution - Could be Exploit"; flow:established,from_server; file_data; content:"|0D 0A 0D 0A D0 CF 11 E0 A1 B1 1A E1|"; content:"|45 57 73 09|"; distance:0; reference:url,blogs.adobe.com/asset/2011/03/background-on-apsa11-01-patch-schedule.html; reference:url,bugix-security.blogspot.com/2011/03/cve-2011-0609-adobe-flash-player.html; reference:bid,46860; reference:cve,2011-0609; classtype:attempted-user; sid:2012503; rev:5; metadata:created_at 2011_03_15, former_category CURRENT_EVENTS, updated_at 2011_03_15;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Microsoft Malware Protection User-Agent Observed to Non-Microsoft Domain"; flow:to_server,established; http.user_agent; content:"MpCommunication"; depth:15; fast_pattern; http.host; content:!".microsoft.com"; isdataat:!1,relative; classtype:misc-activity; sid:2030850; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_09_09, deployment Perimeter, former_category HUNTING, signature_severity Major, updated_at 2020_09_09;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DRIVEBY ACH - Redirection"; flow:from_server,established; file_data; content:"NACHA"; classtype:exploit-kit; sid:2013474; rev:5; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_08_26, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS .exe Downloaded from SVN/HTTP on GoogleCode"; flow:established,to_server; http.uri; content:"/svn/"; nocase; content:".exe"; distance:0; nocase; fast_pattern; http.host; content:".googlecode.com"; endswith; classtype:trojan-activity; sid:2018191; rev:4; metadata:created_at 2014_02_27, former_category CURRENT_EVENTS, updated_at 2020_09_13;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Phoenix Java MIDI Exploit Received By Vulnerable Client"; flow:established,to_client; flowbits:isset,ET.http.javaclient.vulnerable; file_data; content:"META-INF/services/javax.sound.midi.spi.MidiDeviceProvider"; classtype:bad-unknown; sid:2013484; rev:4; metadata:created_at 2011_08_29, former_category CURRENT_EVENTS, updated_at 2011_08_29;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com)"; flow:established,to_server; threshold:type both,track by_src,count 2,seconds 10; http.start; content:"GET / HTTP/1.1|0d 0a|Host|3a 20|google.com|0d 0a 0d 0a|"; depth:36; endswith; classtype:bad-unknown; sid:2018430; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2014_04_30, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, tag Web_Client_Attacks, updated_at 2020_09_14;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Phoenix Java MIDI Exploit Received"; flow:established,to_client; flowbits:isset,ET.http.javaclient; file_data; content:"META-INF/services/javax.sound.midi.spi.MidiDeviceProvider"; classtype:bad-unknown; sid:2013485; rev:4; metadata:created_at 2011_08_29, former_category CURRENT_EVENTS, updated_at 2011_08_29;) +alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Suspicious double Server Header"; flow:from_server,established; http.header_names; content:"|0d 0a|Server|0d 0a|"; content:"Server|0d 0a|"; distance:0; http.response_line; content:"HTTP/1.1 200"; depth:12; endswith; classtype:trojan-activity; sid:2012707; rev:7; metadata:created_at 2011_04_22, former_category MALWARE, updated_at 2020_09_14;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Phoenix landing page JAVASMB"; flow:established,to_client; file_data; content:"JAVASMB()"; classtype:bad-unknown; sid:2013486; rev:4; metadata:created_at 2011_08_30, former_category CURRENT_EVENTS, updated_at 2011_08_30;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious User-Agent Containing .exe"; flow:established,to_server; http.uri; content:!"CTX_"; http.header; content:!"lnssatt.exe"; http.user_agent; content:".exe"; nocase; endswith; fast_pattern; content:!"|5C|Citrix|5C|ICA Client|5C|"; nocase; content:!"vsee.exe"; nocase; http.host; content:!"gfi.com"; content:!"pandasoftware.com"; classtype:trojan-activity; sid:2013224; rev:16; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_07_07, deployment Perimeter, former_category POLICY, signature_severity Informational, tag User_Agent, updated_at 2020_09_14;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Crimepack Java exploit attempt(2)"; flow:from_server,established; file_data; content:"PK"; content:"META-INF/MANIFEST"; within:50; content:"PK"; within:150; nocase; content:"Exploit|24 31 24 31 2E|class"; distance:0; fast_pattern; classtype:web-application-attack; sid:2013662; rev:2; metadata:created_at 2011_09_16, former_category CURRENT_EVENTS, updated_at 2011_09_16;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING HTTP request for resource ending in .scr"; flow:established,to_server; http.uri; content:".scr"; endswith; fast_pattern; http.host; content:!"kaspersky.com"; classtype:misc-activity; sid:2018231; rev:7; metadata:attack_target Client_Endpoint, created_at 2014_03_07, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_09_15;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole landing page with malicious Java applet"; flow:established,from_server; file_data; content:""; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2013700; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_09_28, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.ml)"; flow:established,to_client; tls.cert_subject; content:".ml"; endswith; tls.cert_issuer; content:"Let's Encrypt"; classtype:bad-unknown; sid:2025189; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_01_09, deployment Perimeter, former_category INFO, signature_severity Minor, updated_at 2020_09_16;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Adobe PDF Universal 3D file corrupted download 1"; flow:established,from_server; file_data; content:"/Subtype /U3D"; content:"< $HOME_NET any (msg:"ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.gdn)"; flow:established,to_client; tls.cert_subject; content:".gdn"; endswith; tls.cert_issuer; content:"Let's Encrypt"; classtype:bad-unknown; sid:2025190; rev:3; metadata:attack_target Client_Endpoint, created_at 2018_01_09, deployment Perimeter, former_category INFO, signature_severity Minor, updated_at 2020_09_16;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Adobe PDF Universal 3D file corrupted download 2"; flow:established,from_server; file_data; content:"/Subtype /U3D"; content:"/Contents (a pwning u3d model) /3DI false > /3DA << /A /PO /DIS /I >> /Rect [0 0 640 480] /3DD 10 0 R /F 7 >>"; distance:0; reference:url,www.adobe.com/support/security/advisories/apsa11-04.html; classtype:bad-unknown; sid:2013997; rev:6; metadata:created_at 2011_12_08, updated_at 2011_12_08;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.gq)"; flow:established,to_client; tls.cert_subject; content:".gq"; endswith; tls.cert_issuer; content:"Let's Encrypt"; classtype:bad-unknown; sid:2025191; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_01_09, deployment Perimeter, former_category HUNTING, signature_severity Minor, updated_at 2020_09_16;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT MALVERTISING Alureon Malicious IFRAME"; flow:established,to_client; file_data; content:"name=\"Twitter\" scrolling=\"auto\" frameborder=\"no\" align=\"center\" height = \"1px\" width = \"1px\">"; classtype:bad-unknown; sid:2014039; rev:5; metadata:created_at 2011_12_22, former_category CURRENT_EVENTS, updated_at 2011_12_22;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.ga)"; flow:established,to_client; tls.cert_subject; content:".ga"; endswith; tls.cert_issuer; content:"Let's Encrypt"; classtype:bad-unknown; sid:2025192; rev:3; metadata:attack_target Client_Endpoint, created_at 2018_01_09, deployment Perimeter, former_category INFO, signature_severity Minor, updated_at 2020_09_16;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown Java Exploit Version Check with hidden applet"; flow:established,from_server; file_data; content:"deployJava.versionCheck|28|"; content:" $HOME_NET any (msg:"ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.cf)"; flow:established,to_client; tls.cert_subject; content:".cf"; endswith; tls.cert_issuer; content:"Let's Encrypt"; classtype:bad-unknown; sid:2025193; rev:3; metadata:attack_target Client_Endpoint, created_at 2018_01_09, deployment Perimeter, former_category INFO, signature_severity Minor, updated_at 2020_09_16;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Likely Driveby Delivered Malicious PDF"; flow:established,from_server; file_data; content:"%PDF"; depth:4; content:"/Author (yvp devo)/Creator (bub lob)"; distance:0; classtype:trojan-activity; sid:2014142; rev:5; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2012_01_23, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)"; flow:established,to_client; tls.cert_subject; content:".xyz"; endswith; tls.cert_issuer; content:"Let's Encrypt"; classtype:bad-unknown; sid:2025194; rev:3; metadata:attack_target Client_Endpoint, created_at 2018_01_09, deployment Perimeter, former_category INFO, signature_severity Minor, updated_at 2020_09_16;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DRIVEBY Unknown Landing Page Received"; flow:established,from_server; file_data; content:" $EXTERNAL_NET any (msg:"ET HUNTING Request for .bin with BITS/ User-Agent"; flow:established,to_server; http.uri; content:".bin"; endswith; http.user_agent; content:"Microsoft BITS/"; depth:15; fast_pattern; http.host; content:!"microsoft.com"; content:!"pdfcomplete.com"; content:!"mymitchell.com"; content:!"azureedge.net"; http.accept; content:"*/*"; depth:3; endswith; http.header_names; content:!"Referer"; classtype:bad-unknown; sid:2024420; rev:10; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Microsoft_Word, attack_target Client_Endpoint, created_at 2017_06_23, deployment Perimeter, former_category MALWARE, performance_impact Moderate, signature_severity Major, updated_at 2020_09_16;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DRIVEBY Java Rhino Scripting Engine Exploit Downloaded"; flow:established,from_server; flowbits:isset,ET.http.javaclient; file_data; content:"PK"; within:2; content:"com.class"; content:"edu.class"; content:"net.class"; content:"org.class"; classtype:exploit-kit; sid:2014243; rev:5; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2012_02_20, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious POST With Reference to WINDOWS Folder Possible Malware Infection"; flow:established,to_server; http.method; content:"POST"; nocase; http.host; content:!"nvidia.com"; endswith; content:!"dc.services.visualstudio.com"; endswith; content:!".avg.com"; endswith; content:!"bitdefender.net"; endswith; content:!"svc.iolo.com"; endswith; content:!".lavasoft.com"; endswith; content:!"canonicalizer.ucsuri.tcs"; http.request_body; content:"C|3A 5C 5C|WINDOWS|5C|"; fast_pattern; nocase; classtype:trojan-activity; sid:2011341; rev:17; metadata:created_at 2010_09_28, former_category MALWARE, updated_at 2020_09_16;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DRIVEBY Java Atomic Exploit Downloaded"; flow:established,from_server; flowbits:isset,ET.http.javaclient; file_data; content:"PK"; within:2; content:",CAFEBABE00000030007A0A002500300A003100320700"; distance:0; classtype:exploit-kit; sid:2014295; rev:6; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2012_02_29, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Malformed Double Accept Header"; flow:established,to_server; http.user_agent; content:!"-DRM"; http.host; content:!"buhphone.ru"; content:!"www.backupmaker.com"; content:!"ati.com"; content:!"amd.com"; endswith; http.accept; content:"Accept|3a 20|"; fast_pattern; reference:url,doc.emergingthreats.net/2008975; classtype:policy-violation; sid:2008975; rev:18; metadata:created_at 2010_07_30, former_category POLICY, updated_at 2020_09_16;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DRIVEBY Incognito libtiff PDF Exploit Recieved"; flow:established,from_server; content:"Content-Disposition|3a| inline"; nocase; content:".pdf"; distance:0; file_data; content:"%PDF-"; depth:5; content:"< $HOME_NET any (msg:"ET HUNTING Suspicious EXE Download Content-Type image/jpeg"; flow:established,to_client; flowbits:isnotset,ET.http.binary; flowbits:isnotset,ET.INFO.WindowsUpdate; flowbits:set,ET.http.binary; http.content_type; content:"image/jpeg"; depth:10; endswith; file.data; content:"MZ"; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; fast_pattern; classtype:policy-violation; sid:2026537; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_10_23, deployment Perimeter, former_category POLICY, performance_impact Moderate, signature_severity Major, updated_at 2020_09_16;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole qwe123 PDF"; flow:established,from_server; file_data; content:"%PDF-1.6"; depth:8; content:"|20 28|qwe123"; classtype:trojan-activity; sid:2014368; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_03_13, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possibly Suspicious Request for Putty.exe from Non-Standard Download Location"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/putty.exe"; nocase; endswith; http.host; content:!"the.earth.li"; classtype:bad-unknown; sid:2026570; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_11_02, deployment Perimeter, former_category INFO, signature_severity Minor, updated_at 2020_09_16;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Exploit Kit Delivering JAR Archive to Client"; flow:established,to_client; flowbits:isset,et.exploitkitlanding; file_data; content:"|50 4B 03 04 14 00 08 00 08 00|"; within:10; classtype:exploit-kit; sid:2014526; rev:3; metadata:created_at 2012_04_06, former_category EXPLOIT_KIT, updated_at 2012_04_06;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Observed Suspicious SSL Cert (External IP Lookup - ident .me)"; flow:established,to_client; tls.cert_subject; content:"CN=ident.me"; nocase; endswith; classtype:external-ip-check; sid:2026743; rev:4; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2018_12_26, deployment Perimeter, former_category POLICY, performance_impact Low, signature_severity Informational, updated_at 2020_09_16;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT TDS Sutra - page redirecting to a SutraTDS"; flow:established,to_client; file_data; content:"?igc.ni/"; distance:0; classtype:exploit-kit; sid:2014549; rev:3; metadata:created_at 2012_04_12, updated_at 2012_04_12;) +alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.icu)"; flow:established,to_client; tls.cert_subject; content:".icu"; endswith; tls.cert_issuer; content:"Let's Encrypt"; classtype:bad-unknown; sid:2026890; rev:3; metadata:attack_target Client_Endpoint, created_at 2019_02_06, deployment Perimeter, former_category INFO, signature_severity Minor, updated_at 2020_09_16;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Modified Metasploit Jar"; flow:from_server,established; flowbits:isset,ET.http.javaclient.vulnerable; file_data; content:"msf|2f|x|2f|Payload"; classtype:trojan-activity; sid:2014560; rev:7; metadata:affected_product Any, attack_target Client_and_Server, created_at 2012_04_13, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, former_category CURRENT_EVENTS, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Request for Doc to IP Address with Terse Headers"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".doc"; fast_pattern; nocase; endswith; http.host; pcre:"/^(?:\d{1,3}\.){3}\d{1,3}$/"; http.header_names; content:"|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|"; endswith; classtype:bad-unknown; sid:2025162; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_12_21, deployment Perimeter, former_category INFO, signature_severity Minor, updated_at 2020_09_17;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT landing page with malicious Java applet"; flow:established,from_server; file_data; content:"code="; distance:0; content:"xploit.class"; distance:2; within:18; classtype:bad-unknown; sid:2014561; rev:6; metadata:created_at 2012_04_13, former_category CURRENT_EVENTS, updated_at 2012_04_13;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious svchost.exe in URI - Possible Process Dump/Trojan Download"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/svchost.exe"; nocase; fast_pattern; endswith; classtype:bad-unknown; sid:2016696; rev:16; metadata:created_at 2013_04_02, former_category INFO, updated_at 2020_09_17;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS JavaScript Determining OS MAC and Serving Java Archive File"; flow:established,to_client; file_data; content:" $EXTERNAL_NET any (msg:"ET HUNTING Suspicious explorer.exe in URI"; flow:established,to_server; urilen:<100; http.method; content:"GET"; http.uri; content:"/explorer.exe"; nocase; endswith; fast_pattern; reference:md5,de1bc32ad135b14ad3a5cf72566a63ff; classtype:bad-unknown; sid:2016700; rev:16; metadata:created_at 2013_04_02, former_category INFO, updated_at 2020_09_17;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Italian Spam Campaign ZIP with EXE Containing Many Underscores"; flow:from_server,established; file_data; content:"|50 4b 03 04|"; within:4; byte_test:2,>,50,22,relative; content:"|5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 5f 2e|exe"; distance:22; within:150; classtype:trojan-activity; sid:2014577; rev:5; metadata:created_at 2012_04_16, former_category CURRENT_EVENTS, updated_at 2012_04_16;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious winlogin.exe in URI"; flow:established,to_server; urilen:<100; http.method; content:"GET"; http.uri; content:"/winlogon.exe"; nocase; endswith; fast_pattern; reference:md5,fd95cc0bb7d3ea5a0c86d45570df5228; reference:md5,09330c596a33689a610a1b183a651118; classtype:bad-unknown; sid:2016697; rev:16; metadata:created_at 2013_04_02, former_category INFO, updated_at 2020_09_17;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Nikjju Mass Injection Compromised Site Served To Local Client"; flow:established,from_server; file_data; content:""; distance:1; within:10; classtype:attempted-user; sid:2014607; rev:10; metadata:created_at 2012_04_17, former_category CURRENT_EVENTS, updated_at 2012_04_17;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious services.exe in URI"; flow:established,to_server; urilen:<100; http.method; content:"GET"; http.uri; content:"/services.exe"; nocase; endswith; fast_pattern; reference:md5,145c06300d61b3a0ce2c944fe7cdcb96; classtype:bad-unknown; sid:2016698; rev:16; metadata:created_at 2013_04_02, former_category INFO, updated_at 2020_09_17;) -#alert http $HOME_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Nikjju Mass Injection Internal WebServer Compromised"; flow:established,from_server; file_data; content:""; distance:1; within:10; classtype:attempted-user; sid:2014608; rev:9; metadata:created_at 2012_04_17, former_category CURRENT_EVENTS, updated_at 2012_04_17;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious smss.exe in URI"; flow:established,to_server; urilen:<100; http.method; content:"GET"; http.uri; content:"/smss.exe"; nocase; endswith; fast_pattern; reference:md5,450dbe96d7f4108474071aca5826fc43; classtype:bad-unknown; sid:2016701; rev:15; metadata:created_at 2013_04_02, former_category INFO, updated_at 2020_09_17;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Landing Page Obfuscated Please wait Message"; flow:established,to_client; file_data; content:"Please|3A|wait|3A|page|3A|is|3A|loading"; flowbits:set,et.exploitkitlanding; reference:url,isc.sans.edu/diary.html?storyid=13051; classtype:trojan-activity; sid:2014659; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_30, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious csrss.exe in URI"; flow:established,to_server; urilen:<100; http.method; content:"GET"; http.uri; content:"/csrss.exe"; nocase; fast_pattern; endswith; reference:md5,21a069667a6dba38f06765e414e48824; classtype:bad-unknown; sid:2016702; rev:15; metadata:created_at 2013_04_02, former_category INFO, updated_at 2020_09_17;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole - Jar File Naming Algorithm"; flow:established,to_client; content:"Content-Disposition|3a| inline"; http_header; nocase; content:".jar"; http_header; fast_pattern; pcre:"/=[0-9a-f]{8}\.jar/H"; file_data; content:"PK"; depth:2; classtype:trojan-activity; sid:2014664; rev:11; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_02, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious rundll32.exe in URI"; flow:established,to_server; urilen:<100; http.method; content:"GET"; http.uri; content:"/rundll32.exe"; nocase; fast_pattern; endswith; reference:md5,ea3dec87f79ff97512c637a5c8868a7e; classtype:bad-unknown; sid:2016703; rev:15; metadata:created_at 2013_04_02, former_category INFO, updated_at 2022_05_03;) -alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DRIVEBY Generic - Redirection to Kit - BrowserDetect with var stopit"; flow:established,from_server; file_data; content:"var stopit = BrowserDetect.browser"; distance:0; classtype:exploit-kit; sid:2014665; rev:5; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2012_05_02, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious lsass.exe in URI"; flow:established,to_server; urilen:<100; http.method; content:"GET"; http.uri; content:"/lsass.exe"; nocase; endswith; fast_pattern; reference:md5,d929747212309559cb702dd062fb3e5d; classtype:bad-unknown; sid:2016699; rev:16; metadata:created_at 2013_04_02, former_category INFO, updated_at 2020_09_17;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED DRIVEBY Blackhole - Injected Page Leading To Driveby"; flow:established,to_client; file_data; content:"/images.php?t="; distance:0; fast_pattern; content:"width=\"1\" height=\"1\""; within:100; classtype:trojan-activity; sid:2014666; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Any, attack_target Client_Endpoint, created_at 2012_05_03, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag DriveBy, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious HTTP POST to Free Web Host Atwebpages"; flow:established,to_server; http.method; content:"POST"; http.host; content:".atwebpages.com"; fast_pattern; classtype:misc-activity; sid:2030890; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_09_21, deployment Perimeter, signature_severity Informational, updated_at 2020_09_21;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Try App.title Catch - May 22nd 2012"; flow:established,to_client; file_data; content:"try{app.title}catch("; reference:url,blog.spiderlabs.com/2012/05/catch-me-if-you-can-trojan-banker-zeus-strikes-again-part-2-of-5-1.html; classtype:trojan-activity; sid:2014801; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_23, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;) +alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS msctcd.exe in URI Probable Process Dump/Trojan Download"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/msctcd.exe"; nocase; fast_pattern; endswith; reference:url,alienvault.com/open-threat-exchange/blog/microsoft-office-zeroday-used-to-attack-pakistani-targets; classtype:trojan-activity; sid:2017672; rev:4; metadata:created_at 2013_11_06, former_category CURRENT_EVENTS, updated_at 2020_09_21;) -#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Landing Page Obfuscated Javascript Blob"; flow:established,to_client; file_data; content:"
 $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS taskmgr.exe in URI Probable Process Dump/Trojan Download"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/taskmgr.exe"; nocase; fast_pattern; endswith; reference:url,alienvault.com/open-threat-exchange/blog/microsoft-office-zeroday-used-to-attack-pakistani-targets; classtype:trojan-activity; sid:2017673; rev:4; metadata:created_at 2013_11_06, former_category CURRENT_EVENTS, updated_at 2020_09_21;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole RawValue Specific Exploit PDF"; flow:established,to_client; file_data; content:"%PDF-"; depth:5; content:"|2E|rawValue|5D 5B|0|5D 2E|split|28 27 2D 27 29 3B|"; distance:0; reference:cve,2010-0188; classtype:trojan-activity; sid:2014821; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_30, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS wsqmocn.exe in URI Probable Process Dump/Trojan Download"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/wsqmocn.exe"; nocase; fast_pattern; endswith; reference:url,alienvault.com/open-threat-exchange/blog/microsoft-office-zeroday-used-to-attack-pakistani-targets; classtype:trojan-activity; sid:2017674; rev:4; metadata:created_at 2013_11_06, former_category CURRENT_EVENTS, updated_at 2020_09_21;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Malicious PDF asdvsa"; flow:established,from_server; file_data; content:"obj"; content:"<<"; within:4; content:"(asdvsa"; within:80; classtype:trojan-activity; sid:2014823; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_30, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS connhost.exe in URI Probable Process Dump/Trojan Download"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/connhost.exe"; nocase; fast_pattern; endswith; reference:url,alienvault.com/open-threat-exchange/blog/microsoft-office-zeroday-used-to-attack-pakistani-targets; classtype:trojan-activity; sid:2017675; rev:4; metadata:created_at 2013_11_06, former_category CURRENT_EVENTS, updated_at 2020_09_21;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Landing Page Script Profile ASD"; flow:established,to_client; file_data; content:"pre id=|22|asd|22|"; classtype:trojan-activity; sid:2014825; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_05_30, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS lgfxsrvc.exe in URI Probable Process Dump/Trojan Download"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/lgfxsrvc.exe"; nocase; fast_pattern; endswith; classtype:trojan-activity; sid:2017676; rev:4; metadata:created_at 2013_11_06, former_category CURRENT_EVENTS, updated_at 2020_09_22;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT php with eval/gzinflate/base64_decode possible webshell"; flow:to_client,established; file_data; content:" $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS wimhost.exe in URI Probable Process Dump/Trojan Download"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/wimhost.exe"; nocase; fast_pattern; endswith; reference:url,alienvault.com/open-threat-exchange/blog/microsoft-office-zeroday-used-to-attack-pakistani-targets; classtype:trojan-activity; sid:2017677; rev:4; metadata:created_at 2013_11_06, former_category CURRENT_EVENTS, updated_at 2020_09_22;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Obfuscated Javascript redirecting to Blackhole June 7 2012"; flow:established,from_server; file_data; content:"st=\"no3"; content:"3rxtc\"\;Date"; distance:12; within:60; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2014873; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_06_08, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS winlog.exe in URI Probable Process Dump/Trojan Download"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/winlog.exe"; nocase; fast_pattern; endswith; reference:url,alienvault.com/open-threat-exchange/blog/microsoft-office-zeroday-used-to-attack-pakistani-targets; classtype:trojan-activity; sid:2017679; rev:4; metadata:created_at 2013_11_06, former_category CURRENT_EVENTS, updated_at 2020_09_22;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Obfuscated Javascript redirecting to badness 21 June 2012"; flow:established,from_server; file_data; content:"javascript'>var wow="; content:"Date&&"; distance:12; within:60; classtype:bad-unknown; sid:2014930; rev:4; metadata:created_at 2012_06_22, former_category CURRENT_EVENTS, updated_at 2012_06_22;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS waulct.exe in URI Probable Process Dump/Trojan Download"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/waulct.exe"; nocase; fast_pattern; endswith; reference:url,alienvault.com/open-threat-exchange/blog/microsoft-office-zeroday-used-to-attack-pakistani-targets; classtype:trojan-activity; sid:2017680; rev:4; metadata:created_at 2013_11_06, former_category CURRENT_EVENTS, updated_at 2020_09_22;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Landing Please wait a moment Jun 20 2012"; flow:established,to_client; file_data; content:"Please wait a moment. You will be forwarded..."; classtype:trojan-activity; sid:2014931; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_06_22, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS alg.exe in URI Probable Process Dump/Trojan Download"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/alg.exe"; nocase; fast_pattern; endswith; reference:url,alienvault.com/open-threat-exchange/blog/microsoft-office-zeroday-used-to-attack-pakistani-targets; classtype:trojan-activity; sid:2017681; rev:4; metadata:created_at 2013_11_06, former_category CURRENT_EVENTS, updated_at 2020_09_22;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Generic - PDF with NEW PDF EXPLOIT"; flow:established,to_client; file_data; content:"%PDF"; depth:4; fast_pattern; content:"NEW PDF EXPLOIT"; classtype:trojan-activity; sid:2014966; rev:3; metadata:created_at 2012_06_26, former_category CURRENT_EVENTS, updated_at 2012_06_26;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS mssrs.exe in URI Probable Process Dump/Trojan Download"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/mssrs.exe"; nocase; fast_pattern; endswith; reference:url,alienvault.com/open-threat-exchange/blog/microsoft-office-zeroday-used-to-attack-pakistani-targets; classtype:trojan-activity; sid:2017682; rev:4; metadata:created_at 2013_11_06, former_category CURRENT_EVENTS, updated_at 2020_09_22;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CURRENT_EVENTS Scalaxy Jar file"; flow:to_client,established; file_data; content:"PK"; depth:2; content:"C1.class"; fast_pattern; distance:0; content:"C2.class"; distance:0; flowbits:isset,ET.http.javaclient.vulnerable; classtype:trojan-activity; sid:2014983; rev:3; metadata:created_at 2012_06_29, updated_at 2012_06_29;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS winhosts.exe in URI Probable Process Dump/Trojan Download"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/winhosts.exe"; nocase; fast_pattern; endswith; reference:url,alienvault.com/open-threat-exchange/blog/microsoft-office-zeroday-used-to-attack-pakistani-targets; classtype:trojan-activity; sid:2017683; rev:4; metadata:created_at 2013_11_06, former_category CURRENT_EVENTS, updated_at 2020_09_22;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Hacked Website Response /*km0ae9gr6m*/ Jun 25 2012"; flow:established,from_server; file_data; content:"/*km0ae9gr6m*/"; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; classtype:trojan-activity; sid:2014984; rev:5; metadata:created_at 2012_06_29, former_category CURRENT_EVENTS, updated_at 2012_06_29;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS winhost(32|64).exe in URI"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/winhost"; nocase; fast_pattern; pcre:"/\/winhost(?:32|64)\.(exe|pack)$/i"; classtype:trojan-activity; sid:2017842; rev:4; metadata:created_at 2013_12_12, former_category CURRENT_EVENTS, updated_at 2020_09_22;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Hacked Website Response /*qhk6sa6g1c*/ Jun 25 2012"; flow:established,from_server; file_data; content:"/*qhk6sa6g1c*/"; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; classtype:trojan-activity; sid:2014985; rev:6; metadata:created_at 2012_06_29, former_category CURRENT_EVENTS, updated_at 2012_06_29;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS pony.exe in URI"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/pony."; nocase; fast_pattern; pcre:"/\/pony\.(exe|pack)$/i"; classtype:trojan-activity; sid:2017843; rev:4; metadata:created_at 2013_12_12, former_category CURRENT_EVENTS, updated_at 2020_09_22;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Runforestrun Malware Campaign Infected Website Landing Page Obfuscated String JavaScript DGA"; flow:established,to_client; file_data; content:"*/window.eval(String.fromCharCode("; isdataat:80,relative; content:!")"; within:80; pcre:"/\x2A[a-z0-9]{10}\x2A\x2Fwindow\x2Eeval\x28String\x2EfromCharCode\x28[0-9]{1,3}\x2C[0-9]{1,3}\x2C/sm"; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; classtype:trojan-activity; sid:2014998; rev:3; metadata:created_at 2012_07_03, former_category CURRENT_EVENTS, updated_at 2012_07_03;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Possible Process Dump in POST body"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"System Idle Process"; fast_pattern; reference:url,www.securelist.com/en/blog/208214213/The_Icefog_APT_Hits_US_Targets_With_Java_Backdoor; classtype:trojan-activity; sid:2017968; rev:6; metadata:created_at 2014_01_15, former_category INFO, updated_at 2020_09_22;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Split String Obfuscation of Eval 1"; flow:established,to_client; file_data; content:"e|22|+|22|va"; pcre:"/(\x3D|\x5B\x22])e\x22\x2B\x22va/"; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2015012; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_03, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS EXE Download from Google Common Data Storage with no Referer"; flow:established,to_server; http.uri; content:".exe"; fast_pattern; http.host; content:"commondatastorage.googleapis.com"; bsize:32; http.header_names; content:!"Referer|0d 0a|"; reference:md5,9fcbc6def809520e77dd7af984f82fd5; reference:md5,71e752dd4c4df15a910c17eadb8b15ba; classtype:trojan-activity; sid:2018556; rev:4; metadata:created_at 2014_06_11, former_category CURRENT_EVENTS, updated_at 2020_09_24;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Split String Obfuscation of Eval 2"; flow:established,to_client; file_data; content:"e|22|+|22|v|22|+|22|a"; pcre:"/(\x3D|\x5B\x22])e\x22\x2B\x22v\x22\x2B\x22a/"; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2015013; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_03, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS *.rar.exe in HTTP URL"; flow:to_server,established; http.uri; content:".rar.exe"; fast_pattern; nocase; endswith; classtype:bad-unknown; sid:2020386; rev:4; metadata:created_at 2015_02_09, former_category POLICY, updated_at 2020_09_29;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Landing Page Eval Variable Obfuscation 1"; flow:established,to_client; file_data; content:"=|22|ev|22 3B|"; content:"+|22|al|22|"; distance:0; pcre:"/\x2B\x22al\x22(\x3B|\x5D)/"; classtype:trojan-activity; sid:2015025; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_06, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious SWF filename movie(dot)swf in doc root"; flow:established,to_server; urilen:10; http.uri; content:"/movie.swf"; fast_pattern; classtype:trojan-activity; sid:2021414; rev:4; metadata:created_at 2015_07_15, former_category CURRENT_EVENTS, updated_at 2020_10_01;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Landing Page Eval Variable Obfuscation 2"; flow:established,to_client; file_data; content:"=|22|e|22 3B|"; content:"+|22|val|22|"; distance:0; pcre:"/\x2B\x22val\x22(\x3B|\x5D)/"; classtype:trojan-activity; sid:2015026; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_06, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Suspicious HTTP Refresh to SMS Aug 16 2016"; flow:established,from_server; http.stat_code; content:"200"; http.content_type; content:"text/html"; startswith; file.data; content:"]+url=sms\x3a/Rsi"; content:"url=sms|3a|"; nocase; fast_pattern; classtype:social-engineering; sid:2023068; rev:4; metadata:attack_target Client_Endpoint, created_at 2016_08_16, deployment Perimeter, former_category PHISHING, performance_impact Low, signature_severity Major, tag Phishing, updated_at 2020_10_06;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED 09 July 2012 Blackhole Landing Page - Please Wait Loading"; flow:established,from_server; file_data; content:"Please wait, the page is loading..."; nocase; content:"x-java-applet"; distance:0; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2015048; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_07_10, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Google Adwords Conversion not from Google"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/pagead/conversion_async.js"; endswith; fast_pattern; http.host; content:!"googleadservices.com"; content:!"doubleclick.net"; content:!"google.com"; classtype:bad-unknown; sid:2030980; rev:1; metadata:attack_target Client_Endpoint, created_at 2020_10_06, deployment Perimeter, deployment SSLDecrypt, former_category HUNTING, performance_impact Moderate, signature_severity Informational, updated_at 2020_10_06;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Unknown_s=1 - Landing Page - 10HexChar Title and applet"; flow:established,to_client; file_data; content:"[a-f0-9]{10}<\/title>/"; classtype:trojan-activity; sid:2015053; rev:6; metadata:created_at 2012_07_12, former_category CURRENT_EVENTS, updated_at 2012_07_12;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Request for Pdf.exe Observed in Zeus/Luminosity Link"; flow:established,to_server; http.uri; content:"/pdf.exe"; fast_pattern; classtype:trojan-activity; sid:2018080; rev:6; metadata:created_at 2014_02_05, former_category MALWARE, updated_at 2020_10_07;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Unknown_s=1 - Landing Page - 100HexChar value and applet"; flow:established,to_client; file_data; content:" $EXTERNAL_NET any (msg:"ET HUNTING Possible EXE Download From Suspicious TLD (.science) - set"; flow:established,to_server; flowbits:set,ET.SuspExeTLDs; flowbits:noalert; http.host; content:".science"; fast_pattern; endswith; reference:url,www.spamhaus.org/statistics/tlds/; classtype:misc-activity; sid:2023454; rev:4; metadata:affected_product Any, attack_target Client_and_Server, created_at 2016_10_27, former_category INFO, signature_severity Minor, updated_at 2020_10_07;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT c3284d malware network iframe"; flow:established,to_client; file_data; content:"|22| name=|22|Twitter|22| scrolling=|22|auto|22| frameborder=|22|no|22| align=|22|center|22| height=|22|2|22| width=|22|2|22|>"; classtype:trojan-activity; sid:2015057; rev:4; metadata:created_at 2012_07_12, former_category CURRENT_EVENTS, updated_at 2012_07_12;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible EXE Download From Suspicious TLD (.top) - set"; flow:established,to_server; flowbits:set,ET.SuspExeTLDs; flowbits:noalert; http.host; content:".top"; fast_pattern; endswith; reference:url,www.spamhaus.org/statistics/tlds/; classtype:misc-activity; sid:2023455; rev:4; metadata:affected_product Any, attack_target Client_and_Server, created_at 2016_10_27, former_category INFO, signature_severity Minor, updated_at 2020_10_07;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DoSWF Flash Encryption (Used in KaiXin Exploit Kit)"; flow:to_client,established; file_data; content:"CWS"; depth:3; content:" $HOME_NET any (msg:"ET CURRENT_EVENTS FoxxySoftware - Comments"; flow:established,to_client; file_data; content:"FoxxySF Website Copier"; reference:url,blog.eset.com/2012/08/07/foxxy-software-outfoxed; classtype:trojan-activity; sid:2015583; rev:4; metadata:created_at 2012_08_07, updated_at 2012_08_07;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible EXE Download From Suspicious TLD (.download) - set"; flow:established,to_server; flowbits:set,ET.SuspExeTLDs; flowbits:noalert; http.host; content:".download"; fast_pattern; endswith; reference:url,www.spamhaus.org/statistics/tlds/; classtype:misc-activity; sid:2023457; rev:4; metadata:affected_product Any, attack_target Client_and_Server, created_at 2016_10_27, former_category INFO, signature_severity Minor, updated_at 2020_10_07;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Redirection Page Try Math.Round Catch - 7th August 2012"; flow:established,to_client; file_data; content:"try{"; content:"=Math.round|3B|}catch("; distance:0; classtype:trojan-activity; sid:2015586; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_07, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible EXE Download From Suspicious TLD (.biz) - set"; flow:established,to_server; flowbits:set,ET.SuspExeTLDs; flowbits:noalert; http.host; content:".biz"; endswith; reference:url,www.spamhaus.org/statistics/tlds/; classtype:misc-activity; sid:2023459; rev:4; metadata:affected_product Any, attack_target Client_and_Server, created_at 2016_10_27, former_category INFO, signature_severity Minor, updated_at 2020_10_07;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DRIVEBY SPL - Landing Page Received"; flow:established,to_client; file_data; content:"application/x-java-applet"; content:"width=|22|0|22| height=|22|0|22|>"; fast_pattern; within:100; classtype:exploit-kit; sid:2015605; rev:6; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2012_08_10, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible EXE Download From Suspicious TLD (.accountant) - set"; flow:established,to_server; flowbits:set,ET.SuspExeTLDs; flowbits:noalert; http.host; content:".accountant"; endswith; reference:url,www.spamhaus.org/statistics/tlds/; classtype:misc-activity; sid:2023460; rev:4; metadata:affected_product Any, attack_target Client_and_Server, created_at 2016_10_27, former_category INFO, signature_severity Minor, updated_at 2020_10_07;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Blackhole Landing Page Hwehes String - August 13th 2012"; flow:established,to_client; file_data; content:"hwehes"; content:"hwehes"; distance:0; content:"hwehes"; distance:0; content:"hwehes"; distance:0; classtype:trojan-activity; sid:2015622; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_08_13, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible EXE Download From Suspicious TLD (.click) - set"; flow:established,to_server; flowbits:set,ET.SuspExeTLDs; flowbits:noalert; http.host; content:".click"; endswith; reference:url,www.spamhaus.org/statistics/tlds/; classtype:misc-activity; sid:2023461; rev:4; metadata:affected_product Any, attack_target Client_and_Server, created_at 2016_10_27, former_category INFO, signature_severity Minor, updated_at 2020_10_07;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DRIVEBY SweetOrange - Java Exploit Downloaded"; flow:established,from_server; file_data; content:".classPK"; content:".mp4PK"; fast_pattern; within:80; classtype:exploit-kit; sid:2017476; rev:6; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2013_09_18, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible EXE Download From Suspicious TLD (.link) - set"; flow:established,to_server; flowbits:set,ET.SuspExeTLDs; flowbits:noalert; http.host; content:".link"; endswith; reference:url,www.spamhaus.org/statistics/tlds/; classtype:misc-activity; sid:2023462; rev:4; metadata:affected_product Any, attack_target Client_and_Server, created_at 2016_10_27, former_category INFO, signature_severity Minor, updated_at 2020_10_07;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown Java Exploit Kit applet landing"; flow:established,from_server; file_data; content:"|0d 0a||0d 0a||0d 0a||0d 0a|"; distance:0; classtype:exploit-kit; sid:2013699; rev:3; metadata:created_at 2011_09_27, former_category EXPLOIT_KIT, updated_at 2011_09_27;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible EXE Download From Suspicious TLD (.win) - set"; flow:established,to_server; flowbits:set,ET.SuspExeTLDs; flowbits:noalert; http.host; content:".win"; endswith; reference:url,www.spamhaus.org/statistics/tlds/; classtype:misc-activity; sid:2023463; rev:4; metadata:affected_product Any, attack_target Client_and_Server, created_at 2016_10_27, former_category INFO, signature_severity Minor, updated_at 2020_10_07;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT MALVERTISING OpenX BrowserDetect.init Download"; flow:established,to_client; content:"OAID="; http_cookie; file_data; content:"BrowserDetect.init"; classtype:bad-unknown; sid:2014038; rev:6; metadata:created_at 2011_12_22, former_category CURRENT_EVENTS, updated_at 2011_12_22;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS Possible Evil Download wsf Double Ext No Referer"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".wsf"; nocase; fast_pattern; pcre:"/\/[^\x2f]+\.[^\x2f]+\.wsf$/i"; http.header; content:!"User-Agent|3a 20 2a|"; classtype:trojan-activity; sid:2022271; rev:5; metadata:created_at 2015_12_17, former_category INFO, updated_at 2020_10_08;)
 
-#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Shifu CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|10|licensecheck.bit"; distance:1; within:17; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022208; rev:1; metadata:attack_target Client_and_Server, created_at 2015_12_02, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible EXE Download From Suspicious TLD (.men) - set"; flow:established,to_server; flowbits:set,ET.SuspExeTLDs; flowbits:noalert; http.host; content:".men"; endswith; reference:url,www.spamhaus.org/statistics/tlds/; classtype:misc-activity; sid:2025495; rev:4; metadata:created_at 2018_04_16, former_category INFO, updated_at 2020_10_10;)
 
-#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Shifu CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e2 81 a8 a0 05 4c c8 8b|"; within:35; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022212; rev:3; metadata:attack_target Client_and_Server, created_at 2015_12_02, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible EXE Download From Suspicious TLD (.webcam) - set"; flow:established,to_server; flowbits:set,ET.SuspExeTLDs; flowbits:noalert; http.host; content:".webcam"; endswith; reference:url,www.spamhaus.org/statistics/tlds/; classtype:misc-activity; sid:2025497; rev:4; metadata:created_at 2018_04_16, former_category INFO, updated_at 2020_10_10;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Excel with Embedded .emf object downloaded"; flow:established,to_client; file_data; content:"|0D 0A 0D 0A D0 CF 11 E0 A1 B1 1A E1|"; content:"| 50 4B 03 04 |"; content:"|2F 6D 65 64 69 61 2F 69 6D 61 67 65 |"; within:64; content:"| 2E 65 6D 66 |"; within:15; classtype:bad-unknown; sid:2012504; rev:8; metadata:created_at 2011_03_15, former_category CURRENT_EVENTS, updated_at 2011_03_15;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible EXE Download From Suspicious TLD (.yokohama) - set"; flow:established,to_server; flowbits:set,ET.SuspExeTLDs; flowbits:noalert; http.host; content:".yokohama"; endswith; reference:url,www.spamhaus.org/statistics/tlds/; classtype:misc-activity; sid:2025498; rev:4; metadata:created_at 2018_04_16, former_category INFO, updated_at 2020_10_10;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux/KDefend Checkin"; flow:established,to_server; content:"c|00|h|00|i|00|n|00|a|00 00 00|"; offset:16; depth:12; fast_pattern; content:"|20|MB|00|"; within:10; content:"/proc/stat|00|cpu|00|"; within:21; reference:url,blog.malwaremustdie.org/2015/12/mmd-0045-2015-kdefend-new-elf-threat.html; classtype:command-and-control; sid:2022219; rev:3; metadata:created_at 2015_12_04, former_category MALWARE, updated_at 2015_12_04;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible EXE Download From Suspicious TLD (.tokyo) - set"; flow:established,to_server; flowbits:set,ET.SuspExeTLDs; flowbits:noalert; http.host; content:".tokyo"; endswith; reference:url,www.spamhaus.org/statistics/tlds/; classtype:misc-activity; sid:2025499; rev:4; metadata:created_at 2018_04_16, former_category INFO, updated_at 2020_10_10;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Adware.iBryte.B Install"; flow:to_server,established; content:"GET"; http_method; content:"/impression.do"; http_uri; fast_pattern:only; content:"event="; http_uri; content:"_id="; http_uri; content:!"Referer|3a|"; http_header; reference:md5,1497c33eede2a81627c097aad762817f; classtype:trojan-activity; sid:2018194; rev:9; metadata:created_at 2012_02_13, updated_at 2012_02_13;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible EXE Download From Suspicious TLD (.gq) - set"; flow:established,to_server; flowbits:set,ET.SuspExeTLDs; flowbits:noalert; http.host; content:".gq"; endswith; reference:url,www.spamhaus.org/statistics/tlds/; classtype:misc-activity; sid:2025500; rev:4; metadata:created_at 2018_04_16, former_category HUNTING, updated_at 2020_10_10;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Blank User-Agent (descriptor but no string)"; flow:to_server,established; content:"User-Agent|3a 0d 0a|"; http_header; content:!"check.googlezip.net|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2008066; classtype:pup-activity; sid:2008066; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Possible EXE Download From Suspicious TLD (.work) - set"; flow:established,to_server; flowbits:set,ET.SuspExeTLDs; flowbits:noalert; http.host; content:".work"; endswith; reference:url,www.spamhaus.org/statistics/tlds/; classtype:misc-activity; sid:2025501; rev:4; metadata:created_at 2018_04_16, former_category INFO, updated_at 2020_10_10;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|baknsystem.com"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022078; rev:3; metadata:attack_target Client_and_Server, created_at 2015_11_12, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Mozilla User-Agent Separator - likely Fake (Mozilla/4.0+(compatible +MSIE+)"; flow:to_server,established; http.user_agent; content:"Mozilla/4.0+(compatible|3b|+MSIE+/"; depth:31; fast_pattern; reference:url,doc.emergingthreats.net/2003530; classtype:trojan-activity; sid:2003530; rev:16; metadata:created_at 2010_07_30, former_category INFO, updated_at 2020_10_16;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0c|coughweb.biz"; distance:1; within:13; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022226; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious User-Agent (c \windows)"; flow:to_server,established; threshold: type limit, count 2, track by_src, seconds 300; http.user_agent; content:"c|3a 5c|"; depth:3; reference:url,doc.emergingthreats.net/bin/view/Main/2008043; classtype:trojan-activity; sid:2008043; rev:14; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category USER_AGENTS, signature_severity Major, tag User_Agent, updated_at 2020_10_16;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gootkit MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|14|www.gooodlaosadf.com"; distance:1; within:21; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022230; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious User-Agent (NULL)"; flow:established,to_server; threshold: type limit, count 2, track by_src, seconds 300; http.user_agent; content:"NULL"; depth:4; reference:url,doc.emergingthreats.net/bin/view/Main/2008488; classtype:trojan-activity; sid:2008488; rev:11; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category USER_AGENTS, signature_severity Major, tag User_Agent, updated_at 2020_10_17;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gootkit CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e9 41 89 47 37 8f 56 41|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022231; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious User-Agent (C slash)"; flow:established,to_server; threshold:type limit,count 2,track by_src,seconds 300; http.header; content:!"|5c|Citrix|5c|"; content:!"|5c|Panda S"; nocase; content:!"|5c|Mapinfo"; nocase; http.user_agent; content:"C|3a 5c|"; depth:3; fast_pattern; classtype:trojan-activity; sid:2008512; rev:19; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category USER_AGENTS, signature_severity Major, tag User_Agent, updated_at 2020_10_17;)
 
-#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Zeus CnC)"; flow:from_server,established; content:"|55 04 03|"; content:"|09|Cyxuzoidv"; distance:1; within:10; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022233; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious User Agent (_)"; flow:to_server,established; http.user_agent; content:"_"; depth:1; endswith; reference:url,doc.emergingthreats.net/bin/view/Main/2007942; classtype:trojan-activity; sid:2007942; rev:10; metadata:created_at 2010_07_30, former_category USER_AGENTS, updated_at 2020_10_17;)
 
-#alert tls $EXTERNAL_NET [80,443] -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gootkit CnC)"; flow:established,from_server; content:"|55 04 07|"; content:"|0b|los Angeles"; distance:1; within:12; fast_pattern; content:"|55 04 03|"; distance:0; content:"|0c|*.google.com"; distance:1; within:13; content:"@google.com"; distance:0; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022235; rev:3; metadata:attack_target Client_and_Server, created_at 2015_12_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)"; flow:established,to_server; http.uri; content:!"/CallParrotWebClient/"; http.header.raw; content:!"Cookie|3a 20|PREF|3d|ID|3d|"; nocase; http.user_agent; content:"Mozilla/4.0"; fast_pattern; nocase; bsize:11; http.host; content:!"www.google.com"; content:!"secure.logmein.com"; content:!"weixin.qq.com"; content:!"slickdeals.net"; content:!"cloudera.com"; content:!"secure.digitalalchemy.net.au"; content:!".ksmobile.com"; content:!"gstatic.com"; content:!".cmcm.com"; content:!".deckedbuilder.com"; content:!".mobolize.com"; content:!"wq.cloud.duba.net"; content:!"infoc2.duba.net"; content:!".bitdefender.net"; reference:url,doc.emergingthreats.net/2003492; classtype:bad-unknown; sid:2003492; rev:34; metadata:created_at 2010_07_30, former_category HUNTING, updated_at 2020_10_21;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Excel Online Phish Landing 2015-12-08"; flow:to_client,established; file_data; content:"id=|22|sfm_excel_body|22|"; nocase; fast_pattern; content:"method=|22|post|22|"; nocase; distance:0; content:"name=|22|Email|22|"; nocase; distance:0; content:"name=|22|Password|22|"; nocase; distance:0; content:"type=|22|password|22|"; nocase; distance:0; content:"Keep me signed in"; nocase; distance:0; classtype:social-engineering; sid:2031692; rev:4; metadata:created_at 2015_12_08, former_category PHISHING, updated_at 2015_12_08;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Request to .XYZ Domain with Minimal Headers"; flow:established,to_server; http.host; content:".xyz"; fast_pattern; endswith; http.header_names; content:"|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|"; depth:22; endswith; classtype:bad-unknown; sid:2031088; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_10_23, deployment Perimeter, signature_severity Major, updated_at 2020_10_23;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED EXE Download Request To Wordpress Folder Likely Malicious"; flow:established,to_server; content:"GET"; http_method; content:"/wp-"; http_uri; content:".exe"; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; pcre:"/\.exe(?:\?[0-9])?$/U"; pcre:"/\/wp-(?:content|admin|includes)\//U"; reference:md5,1828f7090d0ad2844d3d665d2f41f911; classtype:trojan-activity; sid:2022239; rev:4; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2015_12_09, deployment Datacenter, former_category TROJAN, signature_severity Major, tag Wordpress, updated_at 2018_07_18;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Request to .TOP Domain with Minimal Headers"; flow:established,to_server; http.host; content:".top"; fast_pattern; endswith; http.header_names; content:"|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|"; depth:22; endswith; classtype:bad-unknown; sid:2031089; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_10_23, deployment Perimeter, signature_severity Major, updated_at 2020_10_23;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Possible CryptoWall encrypted download"; flow:to_client,established; file_data; byte_test:1,<,12,0; content:"|00 00 00|"; distance:1; within:3; byte_test:1,<,127,0,relative; byte_test:1,>,48,0,relative; byte_jump:1,0,from_beginning,post_offset 5; byte_test:1,=,0,0,relative; pcre:"/^[\x00-\x0c]\x00\x00\x00[a-z0-9]{6,12}\x00/s"; classtype:trojan-activity; sid:2018788; rev:3; metadata:created_at 2014_07_28, updated_at 2014_07_28;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Request to 000webhostapp Domain with Minimal Headers"; flow:established,to_server; http.host; content:".000webhostapp.com"; endswith; fast_pattern; http.header_names; content:"|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|"; depth:22; endswith; classtype:bad-unknown; sid:2031090; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_10_23, deployment Perimeter, signature_severity Major, updated_at 2020_10_23;)
 
-#alert udp $HOME_NET any -> any [5060,5061,5600] (msg:"ET MALWARE Ponmocup plugin #2600 (SIP scanner)"; content:"User-Agent|3a| Zoiper for Windows rev.1812|0d0a|"; threshold: type limit, count 1, seconds 3600, track by_src; reference:url,blog.Fox-IT.com/2015/12/02/ponmocup-a-giant-hiding-in-the-shadows; classtype:trojan-activity; sid:2022206; rev:2; metadata:created_at 2015_12_02, updated_at 2015_12_02;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Request to .ML Domain with Minimal Headers"; flow:established,to_server; http.host; content:".ml"; fast_pattern; endswith; http.header_names; content:"|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|"; depth:22; endswith; classtype:bad-unknown; sid:2031091; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_10_23, deployment Perimeter, signature_severity Major, updated_at 2020_10_23;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Evil Redirector Leading to EK Mar 06 2015"; flow:established,to_server; content:"/counter.php?referrer=http"; http_uri; classtype:exploit-kit; sid:2020638; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2015_03_07, deployment Perimeter, signature_severity Major, tag Redirector, updated_at 2016_07_01;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Request to .CF Domain with Minimal Headers"; flow:established,to_server; http.host; content:".cf"; fast_pattern; endswith; http.header_names; content:"|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|"; depth:22; endswith; classtype:bad-unknown; sid:2031092; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_10_23, deployment Perimeter, signature_severity Major, updated_at 2020_10_23;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|19|www.benvenuittopronto.com"; distance:1; within:26; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022248; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_14, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Request to .GQ Domain with Minimal Headers"; flow:established,to_server; http.host; content:".gq"; fast_pattern; endswith; http.header_names; content:"|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|"; depth:22; endswith; classtype:bad-unknown; sid:2031093; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_10_23, deployment Perimeter, signature_severity Major, updated_at 2020_10_23;)
 
-#alert tls $EXTERNAL_NET [80,443] -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gootkit CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ca a8 d2 15 e5 c6 b7 72|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022249; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_14, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Request to .TK Domain with Minimal Headers"; flow:established,to_server; http.host; content:".tk"; fast_pattern; endswith; http.header_names; content:"|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|"; depth:22; endswith; classtype:bad-unknown; sid:2031094; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_10_23, deployment Perimeter, signature_severity Major, updated_at 2020_10_23;)
 
-#alert tls $EXTERNAL_NET [80,443] -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gootkit CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|10|theliveguard.net"; distance:1; within:17; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022250; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_14, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Request to .GA Domain with Minimal Headers"; flow:established,to_server; http.host; content:".ga"; fast_pattern; endswith; http.header_names; content:"|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|"; depth:22; endswith; classtype:bad-unknown; sid:2031095; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_10_23, deployment Perimeter, signature_severity Major, updated_at 2020_10_23;)
 
-#alert tls $EXTERNAL_NET [80,443] -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gootkit CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|televcheck.com"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022251; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_14, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert tls any any -> any any (msg:"ET HUNTING Suspicious TLS SNI Request for Root"; flow:established,to_server; tls.sni; content:"Root"; depth:4; endswith; nocase; classtype:bad-unknown; sid:2029191; rev:2; metadata:attack_target Client_Endpoint, created_at 2019_12_23, deployment Perimeter, deployment Internal, former_category HUNTING, signature_severity Minor, updated_at 2020_10_26;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|12|welcomefreinds.com"; distance:1; within:19; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022252; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_14, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET HUNTING Suspicious Chmod Usage in URI (Inbound)"; flow:to_server,established; http.uri; content:"chmod"; fast_pattern; nocase; pcre:"/^(?:\+|\x2520|\x24IFS|\x252B|\s)+(?:x|[0-9]{3,4})/Ri"; content:!"&launchmode="; content:!"/chmod/"; content:!"searchmod"; reference:url,doc.emergingthreats.net/2009363; classtype:attempted-admin; sid:2009363; rev:10; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category HUNTING, signature_severity Minor, updated_at 2020_10_27;)
 
-#alert tls $EXTERNAL_NET [80,443] -> $HOME_NET any (msg:"ET MALWARE Possible Gootkit CnC SSL Cert M1"; flow:established,from_server; content:"|09 00|"; content:"|55 04 06|"; distance:0; content:"|02|"; distance:1; within:1; content:"|55 04 08|"; distance:0; content:"|55 04 07|"; distance:0; content:"|04|Asia"; distance:1; within:5; fast_pattern; content:"|55 04 0a|"; pcre:"/^.{3}(?P[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](?P=var)/Rsm"; content:"|55 04 0b|"; content:"|2a 86 48 86 f7 0d 01 09 01|"; distance:0; classtype:command-and-control; sid:2022253; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_12_14, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Chmod Usage in URI (Outbound)"; flow:to_server,established; http.uri; content:"chmod"; fast_pattern; nocase; content:!"&launchmode="; content:!"/chmod/"; content:!"searchmod"; pcre:"/^(?:\+|\x2520|\x24IFS|\x252B|\s)+(?:x|[0-9]{3,4})/Ri"; classtype:attempted-admin; sid:2029216; rev:3; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2019_12_31, deployment Perimeter, signature_severity Major, updated_at 2022_05_03;)
 
-#alert tls $EXTERNAL_NET [80,443] -> $HOME_NET any (msg:"ET MALWARE Possible Gootkit CnC SSL Cert M2"; flow:established,from_server; content:"|09 00|"; content:"|55 04 06|"; distance:0; content:"|02|"; distance:1; within:1; content:"|55 04 08|"; distance:0; content:"|55 04 07|"; distance:0; content:"|0d|North America"; distance:1; within:14; fast_pattern; content:"|55 04 0a|"; pcre:"/^.{3}(?P[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](?P=var)/Rsm"; content:"|55 04 0b|"; content:"|2a 86 48 86 f7 0d 01 09 01|"; distance:0; classtype:command-and-control; sid:2022254; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_12_14, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Improperly Spaced Accept Header in User-Agent"; flow:established,to_server; http.user_agent; content:"Accept|3a|*/*"; classtype:misc-activity; sid:2031120; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_10_27, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_10_27;)
 
-#alert tls $EXTERNAL_NET [80,443] -> $HOME_NET any (msg:"ET MALWARE Possible Gootkit CnC SSL Cert M3"; flow:established,from_server; content:"|09 00|"; content:"|55 04 06|"; distance:0; content:"|02|"; distance:1; within:1; content:"|55 04 08|"; distance:0; content:"|55 04 07|"; distance:0; content:"|06|Africa"; distance:1; within:7; fast_pattern; content:"|55 04 0a|"; pcre:"/^.{3}(?P[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](?P=var)/Rsm"; content:"|55 04 0b|"; content:"|2a 86 48 86 f7 0d 01 09 01|"; distance:0; classtype:command-and-control; sid:2022255; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_12_14, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
+alert http $HOME_NET any -> any any (msg:"ET HUNTING Suspicious PHP Code in HTTP POST (Outbound)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:" $HOME_NET any (msg:"ET MALWARE Possible Gootkit CnC SSL Cert M4"; flow:established,from_server; content:"|09 00|"; content:"|55 04 06|"; distance:0; content:"|02|"; distance:1; within:1; content:"|55 04 08|"; distance:0; content:"|55 04 07|"; distance:0; content:"|06|Europe"; distance:1; within:7; fast_pattern; content:"|55 04 0a|"; pcre:"/^.{3}(?P[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](?P=var)/Rsm"; content:"|55 04 0b|"; content:"|2a 86 48 86 f7 0d 01 09 01|"; distance:0; classtype:command-and-control; sid:2022256; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_12_14, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET HUNTING Suspicious PHP Code in HTTP POST (Inbound)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:" $HOME_NET any (msg:"ET MALWARE Possible Gootkit CnC SSL Cert M5"; flow:established,from_server; content:"|09 00|"; content:"|55 04 06|"; distance:0; content:"|02|"; distance:1; within:1; content:"|55 04 08|"; distance:0; content:"|55 04 07|"; distance:0; content:"|09|Australia"; distance:1; within:10; fast_pattern; content:"|55 04 0a|"; pcre:"/^.{3}(?P[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](?P=var)/Rsm"; content:"|55 04 0b|"; content:"|2a 86 48 86 f7 0d 01 09 01|"; distance:0; classtype:command-and-control; sid:2022257; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_12_14, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
+alert http $HOME_NET any -> any any (msg:"ET HUNTING Suspicious PHP Code in HTTP POST (Outbound)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:" $HOME_NET any (msg:"ET MALWARE Possible Gootkit CnC SSL Cert M6"; flow:established,from_server; content:"|09 00|"; content:"|55 04 06|"; distance:0; content:"|02|"; distance:1; within:1; content:"|55 04 08|"; distance:0; content:"|55 04 07|"; distance:0; content:"|0d|South America"; distance:1; within:14; fast_pattern; content:"|55 04 0a|"; pcre:"/^.{3}(?P[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](?P=var)/Rsm"; content:"|55 04 0b|"; content:"|2a 86 48 86 f7 0d 01 09 01|"; distance:0; classtype:command-and-control; sid:2022258; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_12_14, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET HUNTING Suspicious PHP Code in HTTP POST (Inbound)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:" $HOME_NET any (msg:"ET MALWARE Possible Gootkit CnC SSL Cert M7"; flow:established,from_server; content:"|09 00|"; content:"|55 04 06|"; distance:0; content:"|02|"; distance:1; within:1; content:"|55 04 08|"; distance:0; content:"|55 04 07|"; distance:0; content:"|0a|Antarctica"; distance:1; within:11; fast_pattern; content:"|55 04 0a|"; pcre:"/^.{3}(?P[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](?P=var)/Rsm"; content:"|55 04 0b|"; content:"|2a 86 48 86 f7 0d 01 09 01|"; distance:0; classtype:command-and-control; sid:2022259; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_12_14, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Telegram API Certificate Observed"; flow:established,to_client; tls.cert_subject; content:"CN=api.telegram.org"; fast_pattern; nocase; endswith; classtype:misc-activity; sid:2029322; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_01_27, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_10_27;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|checkstat99.com"; distance:1; within:16; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022267; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_16, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1"; flow:established,to_server; http.method; content:"POST"; http.user_agent; content:"|20|MSIE|20|"; nocase; fast_pattern; content:!"Mozilla/4.0 (compatible|3b 20|MSIE|20|6.0|3b 20|DynGate)"; content:!"Windows Live Messenger"; content:!"MS Web Services Client Protocol"; http.host; content:!"groove.microsoft.com"; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/"; http.request_body; content:!"grooveDNS|3a|//"; http.header_names; content:!"X-Requested-With"; nocase; content:!"Accept-Encoding"; content:!"Referer"; classtype:bad-unknown; sid:2018358; rev:10; metadata:created_at 2014_04_04, former_category INFO, updated_at 2020_11_03;)
 
-#alert http [$EXTERNAL_NET,!208.85.44.0/24] $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Angler encrypted payload Nov 23 (3)"; flow:established,to_client; file_data; content:"|dc 18 02|"; distance:4; within:3; pcre:"/^(?:\x62|\x1b)/R"; classtype:trojan-activity; sid:2022140; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_11_24, deployment Perimeter, malware_family Angler, signature_severity Critical, tag Angler, tag Exploit_Kit, updated_at 2016_07_01;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Redirect to Joom AG Hosted Document - Potential Phishing"; flow:to_client,established; http.stat_code; content:"302"; http.location; content:"https://view.joomag.com/"; fast_pattern; startswith; classtype:misc-activity; sid:2031173; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_11_04, deployment Perimeter, former_category HUNTING, signature_severity Informational, tag Phishing, updated_at 2020_11_04;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Malware CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 85 47 00 43 cf a7 86 ee|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,d90c0177437c4cf588de4e60ab233fe1; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022275; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_17, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> any any (msg:"ET HUNTING Generic IOT Downloader Malware in POST (Inbound)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"wget"; content:".sh|3b 20|chmod +x|20|"; within:200; fast_pattern; content:"|3b 20|./"; within:100; classtype:bad-unknown; sid:2029011; rev:3; metadata:affected_product Linux, attack_target IoT, created_at 2019_11_20, deployment Perimeter, signature_severity Minor, updated_at 2020_11_04;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|14|lililililililili.com"; distance:1; within:21; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022276; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_17, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Generic IOT Downloader Malware in POST (Outbound)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"wget"; content:".sh|3b 20|chmod +x|20|"; within:200; fast_pattern; content:"|3b 20|./"; within:100; classtype:bad-unknown; sid:2029009; rev:3; metadata:affected_product Linux, attack_target IoT, created_at 2019_11_20, deployment Perimeter, former_category HUNTING, signature_severity Major, updated_at 2020_11_04;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|11|intelliadsign.net"; distance:1; within:18; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022277; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_17, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Proxifier DL (non-browser observed in maldoc campaigns)"; flow:established,to_server; http.uri; content:"/distr/Proxifier"; nocase; depth:16; fast_pattern; http.host; content:"proxifier.com"; endswith; http.header_names; content:!"User-Agent|0d 0a|"; nocase; content:!"Referer|0d 0a|"; content:!"Accept-"; content:!"Cookie|0d 0a|"; reference:md5,2a0728a6edab6921520a93e10a86d4b2; classtype:trojan-activity; sid:2023138; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_08_26, deployment Perimeter, former_category CURRENT_EVENTS, performance_impact Low, signature_severity Major, tag MalDoc, updated_at 2020_11_05;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0b|boistey.biz"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022278; rev:1; metadata:attack_target Client_and_Server, created_at 2015_12_17, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING SUSPICIOUS Firesale gTLD IE Flash request to set non-standard filename (some overlap with 2021752)"; flow:established,to_server; http.uri; content:!".swf"; nocase; content:!".flv"; nocase; content:!"/crossdomain.xml"; http.header; content:"x-flash-version|3a|"; fast_pattern; content:!"/crossdomain.xml"; content:!".swf"; nocase; content:!".flv"; nocase; content:!"[DYNAMIC]"; content:!"sync-eu.exe.bid"; http.host; pcre:"/^[^\r\n]+\.(?:s(?:(?:(?:cien|pa)c|it)e|tream)|c(?:l(?:ick|ub)|ountry|ricket)|m(?:(?:aiso|e)n|o(?:bi|m))|p(?:r(?:ess|o)|arty|ink|w)|r(?:e(?:[dn]|view)|acing)|w(?:eb(?:site|cam)|in)|b(?:(?:outiq|l)ue|id)|d(?:ownload|ate|esi)|(?:accountan|hos)t|l(?:o(?:an|l)|ink)|t(?:rade|ech|op)|v(?:oyage|ip)|g(?:dn|b)|online|faith|kim|xyz)/i"; http.header_names; content:!"|0d 0a|Cookie|0d 0a|"; classtype:trojan-activity; sid:2022894; rev:8; metadata:created_at 2016_06_14, former_category CURRENT_EVENTS, updated_at 2020_11_05;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0b|ssl-tree.ru"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022286; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_18, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Observed Suspicious Reversed String Inbound (StrReverse)"; flow:established,to_client; http.stat_code; content:"200"; file.data; content:"esreveRrtS"; nocase; classtype:bad-unknown; sid:2036336; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_03_18, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_09;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0b|foenglera.com"; distance:1; within:14; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022287; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_18, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING HTTP POST to XYZ TLD Containing Pass - Possible Phishing"; flow:established,to_server; http.method; content:"POST"; http.host; content:".xyz"; endswith; fast_pattern; http.request_body; content:"pass"; nocase; classtype:misc-activity; sid:2031189; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_11_09, deployment Perimeter, former_category HUNTING, signature_severity Critical, tag Phishing, updated_at 2020_11_12, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
 
-alert tcp any any -> $HOME_NET 23 (msg:"ET EXPLOIT Juniper ScreenOS telnet Backdoor Default Password Attempt"; flow:established,to_server; content:"|3c 3c 3c 20 25 73 28 75 6e 3d 27 25 73 27 29 20 3d 20 25 75|"; fast_pattern; threshold: type limit, count 1, seconds 60, track by_src; reference:cve,2015-7755; reference:url,community.rapid7.com/community/infosec/blog/2015/12/20/cve-2015-7755-juniper-screenos-authentication-backdoor; classtype:attempted-admin; sid:2022291; rev:1; metadata:created_at 2015_12_21, updated_at 2015_12_21;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious POST Request with Possible COVID-19 Domain M2"; http.method; content:"POST"; http.host; content:"corona"; content:!".jhu.edu"; endswith; content:!".ncsc.gov.ie"; endswith; content:!".nhs.wales"; endswith; content:!".govt.nz"; endswith; content:!".nhp.gov.in"; endswith; content:!".oracle.com"; endswith; content:!".cdc.gov"; endswith; classtype:bad-unknown; sid:2029714; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_03_23, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_11;)
 
-#alert tls $EXTERNAL_NET [80,443] -> $HOME_NET any (msg:"ET MALWARE Possible Gootkit CnC SSL Cert M8"; flow:established,from_server; content:"|09 00|"; content:"|55 04 06|"; distance:0; content:"|02|"; distance:1; within:1; content:"|55 04 08|"; distance:0; content:"|55 04 07|"; distance:0; content:"|0f|Central America"; distance:1; within:16; fast_pattern; content:"|55 04 0a|"; pcre:"/^.{3}(?P[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](?P=var)/Rsm"; content:"|55 04 0b|"; content:"|2a 86 48 86 f7 0d 01 09 01|"; distance:0; classtype:command-and-control; sid:2022292; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_12_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious POST Request with Possible COVID-19 Domain M1"; http.method; content:"POST"; http.host; content:"covid"; content:!".jhu.edu"; endswith; content:!".ncsc.gov.ie"; endswith; content:!".nhs.wales"; endswith; content:!".govt.nz"; endswith; content:!".nhp.gov.in"; endswith; content:!".oracle.com"; endswith; content:!".cdc.gov"; endswith; classtype:bad-unknown; sid:2029713; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_03_23, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_11;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0f|rommen-haft.com"; distance:1; within:16; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022293; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_22, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M2"; http.method; content:"GET"; http.host; content:"corona"; content:!".jhu.edu"; endswith; content:!".ncsc.gov.ie"; endswith; content:!".nhs.wales"; endswith; content:!".govt.nz"; endswith; content:!".nhp.gov.in"; endswith; content:!".oracle.com"; endswith; content:!".cdc.gov"; endswith; classtype:bad-unknown; sid:2029712; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_03_23, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_11;)
 
-#alert ip $HOME_NET any -> [206.72.206.74,206.72.206.75,206.72.206.76,206.72.206.77,206.72.206.78,66.45.241.130,66.45.241.131,66.45.241.132,66.45.241.133,66.45.241.134] any (msg:"ET MALWARE Kelihos CnC Server Activity"; threshold: type limit, track by_src, seconds 3600, count 1; flowbits:set,ET.Evil; reference:url,blog.malwaremustdie.org/2015/12/mmd-0046-2015-kelihos-cnc-activity-on.html; classtype:command-and-control; sid:2022294; rev:1; metadata:created_at 2015_12_22, former_category MALWARE, updated_at 2015_12_22;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious GET Request with Possible COVID-19 Domain M1"; http.method; content:"GET"; http.host; content:"covid"; content:!".jhu.edu"; endswith; content:!".ncsc.gov.ie"; endswith; content:!".nhs.wales"; endswith; content:!".govt.nz"; endswith; content:!".nhp.gov.in"; endswith; content:!".oracle.com"; endswith; content:!".cdc.gov"; endswith; classtype:bad-unknown; sid:2029711; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_03_23, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_11;)
 
-alert tcp $HOME_NET 22 -> $EXTERNAL_NET any (msg:"ET POLICY FOX-SRT - Juniper ScreenOS SSH World Reachable"; flow:to_client,established; content:"SSH-2.0-NetScreen"; reference:cve,2015-7755; reference:url,kb.juniper.net/JSA10713; classtype:policy-violation; sid:2022299; rev:2; metadata:created_at 2015_12_22, updated_at 2015_12_22;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious POST Request with Possible COVID-19 URI M2"; http.method; content:"POST"; http.uri; content:"corona"; nocase; http.host; content:!".jhu.edu"; endswith; content:!".ncsc.gov.ie"; endswith; content:!".nhs.wales"; endswith; content:!".govt.nz"; endswith; content:!".nhp.gov.in"; endswith; content:!".oracle.com"; endswith; content:!".cdc.gov"; endswith; classtype:bad-unknown; sid:2029756; rev:3; metadata:attack_target Client_Endpoint, created_at 2020_03_28, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Mon Dec 21 2015 5"; flow:from_server,established; file_data; content:"|3f 22 5c 78|"; fast_pattern; byte_test:1,>,0x2f,-5,relative; byte_test:1,<,0x3a,-5,relative; content:"var "; pcre:"/^\s*?[a-z]+\s*?=\s*?\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?(?<=[\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?(?<=[\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?(?<=[\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b]/Rsi"; reference:url,blog.sucuri.net/2015/12/evolution-of-pseudo-darkleech.html; classtype:exploit-kit; sid:2022290; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2015_12_21, deployment Perimeter, signature_severity Major, tag Redirector, updated_at 2016_07_01;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious POST Request with Possible COVID-19 URI M1"; http.method; content:"POST"; http.uri; content:"covid"; nocase; http.host; content:!".jhu.edu"; endswith; content:!".ncsc.gov.ie"; endswith; content:!".nhs.wales"; endswith; content:!".govt.nz"; endswith; content:!".nhp.gov.in"; endswith; content:!".oracle.com"; endswith; content:!".cdc.gov"; endswith; classtype:bad-unknown; sid:2029755; rev:3; metadata:attack_target Client_Endpoint, created_at 2020_03_28, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_11;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|givemyporn.com"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022301; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_22, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious GET Request with Possible COVID-19 URI M2"; http.method; content:"GET"; http.uri; content:"corona"; nocase; http.host; content:!".jhu.edu"; endswith; content:!".ncsc.gov.ie"; endswith; content:!".nhs.wales"; endswith; content:!".govt.nz"; endswith; content:!".nhp.gov.in"; endswith; content:!".oracle.com"; endswith; content:!".cdc.gov"; endswith; classtype:bad-unknown; sid:2029754; rev:3; metadata:attack_target Client_Endpoint, created_at 2020_03_28, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_11;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|10|qiqiqiqiqiqi.com"; distance:1; within:17; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022302; rev:1; metadata:attack_target Client_and_Server, created_at 2015_12_22, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious GET Request with Possible COVID-19 URI M1"; http.method; content:"GET"; http.uri; content:"covid"; nocase; http.host; content:!".jhu.edu"; endswith; content:!".ncsc.gov.ie"; endswith; content:!".nhs.wales"; endswith; content:!".govt.nz"; endswith; content:!".nhp.gov.in"; endswith; content:!".oracle.com"; endswith; content:!".cdc.gov"; endswith; classtype:bad-unknown; sid:2029753; rev:3; metadata:created_at 2020_03_28, former_category HUNTING, updated_at 2020_11_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DOS Skype FindCountriesByNamePattern property Buffer Overflow Attempt"; flow:to_client,established; file_data; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*22C83263-E4B8-4233-82CD-FB047C6BF13E/si"; reference:url,garage4hackers.com/f43/skype-5-x-activex-crash-poc-981.html; classtype:web-application-attack; sid:2013462; rev:3; metadata:created_at 2011_08_26, updated_at 2011_08_26;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING Observed DNS Query for OpenNIC Alternative DNS TLD (.parody)"; dns.query; content:".parody"; nocase; endswith; reference:url,wiki.opennic.org/opennic/dot; classtype:bad-unknown; sid:2029954; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_20, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_16;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DOS Skype FindCountriesByNamePattern property Buffer Overflow Attempt Format String Function Call"; flow:to_client,established; file_data; content:"ActiveXObject"; nocase; content:"SkypePNRLib.PNR"; nocase; distance:0; content:".FindCountriesByNamePattern"; nocase; reference:url,garage4hackers.com/f43/skype-5-x-activex-crash-poc-981.html; classtype:attempted-user; sid:2013463; rev:3; metadata:created_at 2011_08_26, updated_at 2011_08_26;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING Observed DNS Query for OpenNIC Alternative DNS TLD (.libre)"; dns.query; content:".libre"; nocase; endswith; reference:url,wiki.opennic.org/opennic/dot; classtype:bad-unknown; sid:2029958; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_20, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_16;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Foxit PDF Reader Authentication Bypass Attempt"; flow:established,to_client; file_data; content:"%PDF-"; within:5; content:"Type/Action"; distance:0; nocase; content:"Launch"; nocase; within:40; content:"NewWindow true"; nocase; distance:0; pcre:"/Type\x2FAction.+Launch.+\x28\x2F[a-z]\x2F[a-z].+NewWindow\x20true/si"; reference:url,www.coresecurity.com/content/foxit-reader-vulnerabilities#lref.4; reference:cve,2009-0836; reference:url,doc.emergingthreats.net/2010878; classtype:attempted-user; sid:2010878; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING Observed DNS Query for OpenNIC Alternative DNS TLD (.bbs)"; dns.query; content:".bbs"; nocase; endswith; reference:url,wiki.opennic.org/opennic/dot; classtype:bad-unknown; sid:2029960; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_20, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_16;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Microsoft Office Word 2007 sprmCMajority Buffer Overflow Attempt"; flow:established,to_client; file_data; content:"|0D 0A 0D 0A D0 CF 11 E0 A1 B1 1A E1|"; content:"|47 CA FF|"; content:"|3E C6 FF|"; distance:0; isdataat:84,relative; content:!"|0A|"; within:84; reference:url,www.exploit-db.com/moaub11-microsoft-office-word-sprmcmajority-buffer-overflow/; reference:url,www.microsoft.com/technet/security/Bulletin/MS10-056.mspx; reference:bid,42136; reference:cve,2010-1900; classtype:attempted-user; sid:2011478; rev:6; metadata:created_at 2010_09_29, updated_at 2010_09_29;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING Observed DNS Query for OpenNIC Alternative DNS TLD (.null)"; dns.query; content:".null"; nocase; endswith; reference:url,wiki.opennic.org/opennic/dot; classtype:bad-unknown; sid:2029963; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_20, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_16;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Microsoft Windows Common Control Library Heap Buffer Overflow"; flow:established,from_server; content:"Content-Type|3a| image/svg|2b|xml"; nocase; file_data; content:"|3c|svg xmlns="; nocase; distance:0; content:"style|3d 22|fill|3a 20 23|ffffff|22|"; nocase; distance:0; content:"transform"; nocase; distance:0; pcre:"/^=\s*\x22\s*[^\s\x22\x28]{1000}/iR"; reference:bugtraq,43717; reference:url,www.microsoft.com/technet/security/bulletin/MS10-081.mspx; classtype:attempted-admin; sid:2012174; rev:9; metadata:created_at 2011_01_12, updated_at 2011_01_12;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING Observed DNS Query for OpenNIC Alternative DNS TLD (.pirate)"; dns.query; content:".pirate"; nocase; endswith; reference:url,wiki.opennic.org/opennic/dot; classtype:bad-unknown; sid:2029964; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_20, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_16;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ASCII Executable Inside of MSCOFF File DL Over HTTP"; flow:established,from_server; flowbits:isset,et.MCOFF; file_data; content:"|34 64 35 61|"; content:"|35 34 36 38 36 39 37 33 32 30 37 30 37 32 36 66 36 37 37 32 36 31 36 64 32 30|"; distance:38; reference:md5,f4ee917a481e1718ccc749d2d4ceaa0e; classtype:trojan-activity; sid:2022303; rev:3; metadata:created_at 2015_12_23, updated_at 2015_12_23;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING Observed DNS Query for OpenNIC Alternative DNS TLD (.oss)"; dns.query; content:".oss"; nocase; endswith; reference:url,wiki.opennic.org/opennic/dot; classtype:bad-unknown; sid:2029966; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_20, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_16;)
 
-#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:from_server,established; content:"|09 00 97 ae 20 7e 61 5f 58 15|"; fast_pattern; content:"|55 04 06|"; distance:0; content:"|02|XX"; distance:1; within:3; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022305; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING Observed DNS Query for OpenNIC Alternative DNS TLD (.epic)"; dns.query; content:".epic"; nocase; endswith; reference:url,wiki.opennic.org/opennic/dot; classtype:bad-unknown; sid:2029967; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_20, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_16;)
 
-#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:from_server,established; content:"|09 00 a6 75 8f 19 30 3e 46 58|"; fast_pattern; content:"|55 04 06|"; distance:0; content:"|02|XX"; distance:1; within:3; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022307; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_24, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING Observed DNS Query for OpenNIC Alternative DNS TLD (.indy)"; dns.query; content:".indy"; nocase; endswith; reference:url,wiki.opennic.org/opennic/dot; classtype:bad-unknown; sid:2029968; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_20, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_16;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|monosuflex.com"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022308; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_24, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING Observed DNS Query for OpenNIC Alternative DNS TLD (.gopher)"; dns.query; content:".gopher"; nocase; endswith; reference:url,wiki.opennic.org/opennic/dot; classtype:bad-unknown; sid:2029969; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_20, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_16;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Powersploit Framework Script Downloaded"; flow:to_client,established; file_data; content:"function Invoke-"; depth:16; content:"|0a 7b 0a 3c 23 0a 2e 53 59 4e 4f 50 53 49 53 0a|"; distance:0; content:"|0a|PowerSploit Function|3a 20|"; distance:0; reference:md5,0aa391dc6d9ebec2f5d0ee6b4a4ba1fa; classtype:trojan-activity; sid:2022309; rev:2; metadata:created_at 2015_12_24, updated_at 2015_12_24;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING Observed DNS Query for EmerDNS TLD (.coin)"; dns.query; content:".coin"; nocase; endswith; reference:url,wiki.opennic.org/opennic/dot; reference:url,emercoin.com/en/documentation/blockchain-services/emerdns/emerdns-introduction; classtype:bad-unknown; sid:2029971; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_20, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_16;)
 
-#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET POLICY Lets Encrypt Free SSL Cert Observed"; flow:established,from_server; content:"|55 04 0a|"; content:"|0d|Let|27|s Encrypt"; distance:1; within:14; reference:url,letsencrypt.org/about/; classtype:policy-violation; sid:2022218; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_12_04, deployment Perimeter, former_category POLICY, signature_severity Informational, tag SSL_Malicious_Cert, updated_at 2017_10_12;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING Observed DNS Query for EmerDNS TLD (.emc)"; dns.query; content:".emc"; nocase; endswith; reference:url,wiki.opennic.org/opennic/dot; reference:url,emercoin.com/en/documentation/blockchain-services/emerdns/emerdns-introduction; classtype:bad-unknown; sid:2029972; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_20, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_16;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Mon Dec 26 2015"; flow:to_server,established; content:"/st1.phtml"; http_uri; classtype:exploit-kit; sid:2022312; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2015_12_28, deployment Perimeter, signature_severity Major, tag Redirector, updated_at 2016_07_01;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING Observed DNS Query for EmerDNS TLD (.bazar)"; dns.query; content:".bazar"; nocase; endswith; reference:url,wiki.opennic.org/opennic/dot; reference:url,emercoin.com/en/documentation/blockchain-services/emerdns/emerdns-introduction; classtype:bad-unknown; sid:2029973; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_20, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2020_11_16;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Mon Dec 26 2015 2"; flow:to_server,established; content:"/lobo.phtml"; http_uri; classtype:exploit-kit; sid:2022313; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2015_12_28, deployment Perimeter, signature_severity Major, tag Redirector, updated_at 2016_07_01;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING Observed DNS Query for FurNIC TLD (.fur)"; dns.query; content:".fur"; nocase; endswith; reference:url,wiki.opennic.org/opennic/dot; classtype:bad-unknown; sid:2029974; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_20, deployment Perimeter, signature_severity Informational, updated_at 2020_11_16;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Anonisma Paypal Phishing Loading Page 2015-12-29"; flow:from_server,established; file_data; content:"Logging in"; nocase; fast_pattern; content:".php?cmd=_"; nocase; distance:0; content:"Hold a while"; nocase; distance:0; content:"Still loading after a few seconds"; nocase; distance:0; classtype:social-engineering; sid:2031706; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_12_29, deployment Perimeter, former_category PHISHING, signature_severity Major, tag Phishing, updated_at 2016_07_01;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious User-Agent (1 space)"; flow:to_server,established; http.header; content:"User-Agent|3a 20 0d 0a|"; http.host; content:!"connectivitycheck.gstatic.com"; endswith; content:!".mcafee.com"; content:!"deezer.com"; endswith; content:!"googlezip.net"; content:!"metrics.tbliab.net"; endswith; content:!"dajax.com"; endswith; content:!"update.eset.com"; endswith; content:!".sketchup.com"; endswith; content:!".yieldmo.com"; endswith; content:!"ping-start.com"; endswith; content:!".bluekai.com"; content:!".stockstracker.com"; content:!".doubleclick.net"; content:!".pingstart.com"; content:!".colis-logistique.com"; content:!"android-lrcresource.wps.com"; content:!"track.package-buddy.com"; content:!"talkgadget.google.com"; endswith; content:!".visualstudio.com"; endswith; content:!".slack-edge.com"; endswith; content:!".slack.com"; endswith; content:!".lifesizecloud.com"; endswith; reference:url,doc.emergingthreats.net/bin/view/Main/2007994; classtype:unknown; sid:2007994; rev:24; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category INFO, signature_severity Major, tag User_Agent, updated_at 2020_11_17;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING PHOEN!X Apple Phish Landing Page 2015-12-29"; flow:from_server,established; file_data; content:"<title>iTunes"; nocase; fast_pattern; content:"Enter Your Password"; nocase; distance:0; content:"<!-- PHOEN!X -->"; nocase; distance:0; classtype:social-engineering; sid:2031693; rev:2; metadata:created_at 2015_12_29, former_category PHISHING, updated_at 2015_12_29;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (cookies.txt) M2"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name="; content:".zip|22 0d 0a|"; within:150; content:"|0d 0a|PK"; distance:0; content:"cookies.txt"; distance:26; within:50; nocase; fast_pattern; classtype:trojan-activity; sid:2027104; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag Stealer, updated_at 2020_11_18;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING PHOEN!X Phish Loading Page 2015-12-29"; flow:from_server,established; file_data; content:"<title>Checking Informations"; content:"http-equiv=|22|refresh|22|"; classtype:social-engineering; sid:2031694; rev:2; metadata:created_at 2015_12_29, former_category PHISHING, updated_at 2015_12_29;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name="; content:".zip|22 0d 0a|"; within:150; content:"|0d 0a|PK"; distance:0; content:"passwords.txt"; distance:26; within:50; nocase; fast_pattern; classtype:trojan-activity; sid:2027106; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag Stealer, updated_at 2020_11_18;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0f|1terabitbit.com"; distance:1; within:16; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022321; rev:2; metadata:attack_target Client_and_Server, created_at 2015_12_31, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (wallet.dat) M2"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name="; content:".zip|22 0d 0a|"; within:150; content:"|0d 0a|PK"; distance:0; content:"wallet.dat"; distance:26; within:50; nocase; fast_pattern; classtype:trojan-activity; sid:2027115; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag Stealer, updated_at 2020_11_18;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|gatecheck.info"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022322; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name="; content:".zip|22 0d 0a|"; within:150; content:"|0d 0a|PK"; distance:0; content:"screenshot."; distance:26; within:300; nocase; fast_pattern; pcre:"/^(?:(?:jp|pn)g|bmp)/Ri"; classtype:trojan-activity; sid:2027108; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag Stealer, updated_at 2020_11_18;)
 
-#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (BlackEnergy CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 85 9e 1d 11 4a f9 72 62|"; distance:0; fast_pattern; content:"|55 04 06|"; distance:0; content:"|02|XX"; distance:1; within:3; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021624; rev:2; metadata:attack_target Client_and_Server, created_at 2015_08_13, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (cookie.txt) M2"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name="; content:".zip|22 0d 0a|"; within:150; content:"|0d 0a|PK"; distance:0; content:"cookie.txt"; distance:26; within:50; nocase; fast_pattern; classtype:trojan-activity; sid:2027270; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2019_04_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag T1005, tag Data_from_local_system, tag Collection, updated_at 2020_11_18;)
 
-#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET DELETED Malicious SSL certificate detected (Possible Sinkhole)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 0a|"; distance:0; content:"|0a|infosec.jp"; distance:1; within:11; content:"|55 04 03|"; distance:0; content:"|0e|www.infosec.jp"; distance:1; within:15; content:"snowyowl@jpnsec.com"; distance:0; reference:md5,ef5fa2378307338d4e75dece88158d77; classtype:domain-c2; sid:2022324; rev:3; metadata:attack_target Client_and_Server, created_at 2016_01_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_01_15, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (ccdata.txt) M2"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name="; content:".zip|22 0d 0a|"; within:150; content:"|0d 0a|PK"; distance:0; content:"ccdata.txt"; distance:26; within:50; nocase; fast_pattern; classtype:trojan-activity; sid:2027272; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2019_04_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag T1005, tag Data_from_local_system, tag Collection, updated_at 2020_11_18;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE BlackEnergy SSL Cert"; flow:from_server,established; content:"|09 00 e3 6e 25 fe 3f fa 53 80|"; fast_pattern; content:"|55 04 06|"; distance:0; content:"|02|XX"; distance:1; within:3; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; reference:url,welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/; classtype:trojan-activity; sid:2022327; rev:2; metadata:attack_target Client_Endpoint, created_at 2016_01_05, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (google_chrome_default_) M2"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name="; content:".zip|22 0d 0a|"; within:150; content:"|0d 0a|PK"; distance:0; content:"google_chrome_default_"; distance:26; within:100; nocase; fast_pattern; pcre:"/^(?:logins|c(?:cdata|ookie))/Ri"; classtype:trojan-activity; sid:2027277; rev:3; metadata:attack_target Client_and_Server, created_at 2019_04_24, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag T1002, tag data_compressed, updated_at 2020_11_18;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0f|ibsecurity.info"; distance:1; within:16; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022328; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_05, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (Mozilla_Firefox_Cookies) M2"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name="; content:".zip|22 0d 0a|"; within:150; content:"|0d 0a|PK"; distance:0; content:"Mozilla_Firefox_Cookies"; distance:26; within:100; nocase; fast_pattern; classtype:trojan-activity; sid:2027279; rev:3; metadata:attack_target Client_and_Server, created_at 2019_04_24, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag T1002, tag data_compressed, updated_at 2020_11_18;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0a|ibcsec.xyz"; distance:1; within:11; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022329; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_05, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Accept in HTTP POST - Possible Alphacrypt/TeslaCrypt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php"; endswith; http.accept; pcre:"/^(?!m(?:ultipart|essage|odel)|a(?:pplication|udio|ccept)|(?:exampl|imag)e|video|text|\*)/i"; http.header_names; content:"|0d 0a|Accept|0d 0a|"; depth:10; fast_pattern; content:!"Referer"; content:"Accept"; reference:md5,35a6de1e8dbea19bc44cf49ae0cae59e; classtype:trojan-activity; sid:2022502; rev:7; metadata:created_at 2016_02_11, former_category MALWARE, updated_at 2022_05_03;)
 
-#alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NanoLocker Check-in (ICMP) M2"; itype:8; icode:0; dsize:26<>35; content:"|33|"; depth:1; pcre:"/^(?=[A-F1-9]*?[a-km-zGHJ-NP-Z])[a-km-zA-HJ-NP-Z1-9]{25,34}(?:64)?$/R"; reference:md5,24273ce5ca8e84c52b270b52659304a8; reference:url,blog.emsisoft.com/2016/01/01/meet-ransom32-the-first-javascript-ransomware/; classtype:trojan-activity; sid:2022330; rev:2; metadata:created_at 2016_01_05, updated_at 2016_01_05;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING Suspicious Domain Request for Possible COVID-19 Domain M2"; dns.query; content:"corona"; nocase; content:!".jhu.edu"; isdataat:!1,relative; content:!".ncsc.gov.ie"; isdataat:!1,relative; content:!".nhs.wales"; isdataat:!1,relative; content:!".govt.nz"; isdataat:!1,relative; content:!".nhp.gov.in"; isdataat:!1,relative; content:!".oracle.com"; isdataat:!1,relative; content:!".cdc.gov"; isdataat:!1,relative; content:!"covid19.wisc.edu"; isdataat:!1,relative; content:!"services.corona.be"; isdataat:!1,relative; classtype:bad-unknown; sid:2029710; rev:5; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_03_23, deployment Perimeter, signature_severity Informational, updated_at 2020_11_20;)
 
-alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NanoLocker Check-in (ICMP) M1"; itype:8; icode:0; dsize:26<>35; content:"|31|"; depth:1; pcre:"/^(?=[A-F1-9]*?[a-km-zGHJ-NP-Z])[a-km-zA-HJ-NP-Z1-9]{25,34}(?:64)?$/R"; reference:md5,24273ce5ca8e84c52b270b52659304a8; reference:url,blog.emsisoft.com/2016/01/01/meet-ransom32-the-first-javascript-ransomware/; classtype:trojan-activity; sid:2022331; rev:3; metadata:created_at 2016_01_05, updated_at 2016_01_05;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Suspicious Redirect to Download EXE from Bitbucket"; flow:established,to_client; http.stat_code; content:"302"; http.location; content:"https://bitbucket.org"; startswith; content:".exe"; endswith; classtype:bad-unknown; sid:2026515; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_10_17, deployment Perimeter, former_category INFO, signature_severity Minor, updated_at 2020_12_22;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE ELF.MrBlack DOS.TF Variant"; flow:established,to_server; content:"Linux_"; offset:8; depth:6; content:"TF-"; distance:58; within:3; fast_pattern; reference:url,blog.malwaremustdie.org/2016/01/mmd-0048-2016-ddostf-new-elf-windows.html; classtype:trojan-activity; sid:2022336; rev:2; metadata:created_at 2016_01_07, updated_at 2016_01_07;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious HTTP POST Only Containing Password - Possible Phishing"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"password="; nocase; depth:9; fast_pattern; content:!"&"; distance:0; classtype:credential-theft; sid:2031523; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2021_01_14, deployment Perimeter, former_category HUNTING, signature_severity Critical, tag Phishing, updated_at 2021_01_14, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Jan 6th 2016 M1"; flow:established,to_server; urilen:18; content:"GET"; http_method; content:"/switch/cookie.php"; depth:18; http_uri; fast_pattern; classtype:exploit-kit; sid:2022338; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_01_07, deployment Perimeter, signature_severity Major, tag Redirector, updated_at 2016_07_01;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious HTTP POST Only Containing Pass - Possible Phishing"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"pass="; nocase; depth:5; fast_pattern; content:!"&"; distance:0; classtype:credential-theft; sid:2031524; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2021_01_14, deployment Perimeter, former_category HUNTING, signature_severity Critical, tag Phishing, updated_at 2021_01_14, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dridex Download 6th Jan 2016 Flowbit"; flow:established,to_server; content:"POST"; http_method; content:".php"; http_uri; pcre:"/\.php$/U"; content:"Content-Length|3a 20|0|0d 0a|"; content:"MSIE 7.0"; http_header; fast_pattern:only; content:!"Referer|3A|"; http_header; pcre:"/Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}(?:\x3a\d{1,5})?\r\n/H"; flowbits:set,et.dridexdoc; flowbits:noalert; classtype:trojan-activity; sid:2022339; rev:2; metadata:created_at 2016_01_07, former_category CURRENT_EVENTS, updated_at 2016_01_07;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious POST to Wordpress Folder - Possible Successful Banking Phish"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/wp-"; depth:4; http.request_body; content:"pin="; depth:4; fast_pattern; classtype:credential-theft; sid:2031547; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2021_01_26, deployment Perimeter, former_category HUNTING, signature_severity Major, tag Phishing, updated_at 2021_01_26;)
 
-#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE W32/Dridex Binary Download 6th Jan 2016"; flowbits:isset,et.dridexdoc; flow:established,to_client; content:"Content-Disposition|3A| attachment|3B| filename="; http_header; content:".exe"; http_header; fast_pattern; file_data; content:"MZ"; within:2; content:"This program"; within:100; classtype:trojan-activity; sid:2022340; rev:4; metadata:created_at 2016_01_07, former_category CURRENT_EVENTS, updated_at 2016_01_07;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious POST Format"; flow:established,to_server; http.method; content:"POST"; http.request_line; content:"/upload/upload.php HTTP/1.0"; fast_pattern; http.content_type; content:"application/x-www-form-urlencoded"; bsize:33; reference:url,norfolkinfosec.com/dprk-malware-targeting-security-researchers/; reference:url,blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/; classtype:bad-unknown; sid:2031558; rev:1; metadata:created_at 2021_01_26, former_category HUNTING, updated_at 2021_01_26;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Jan 6th 2016 M2"; flow:established,from_server; content:"Content-Type|3a 20|application/javascript|3b|"; http_header; file_data; content:"var iframe"; within:13; pcre:"/^\s*?=\s*?[\x22\x27]<iframe\s*?src\s*?=/R"; content:":-"; pcre:"/^\d{3,}/R"; content:"</iframe>"; pcre:"/^\s*?/Rs"; content:"document.write(iframe)|3b|"; isdataat:!2,relative; classtype:exploit-kit; sid:2022341; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_01_08, deployment Perimeter, signature_severity Major, tag Redirector, updated_at 2016_07_01;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious POST Format"; flow:established,to_server; http.method; content:"POST"; http.request_line; content:"/download/download.asp HTTP/1.0"; fast_pattern; http.content_type; content:"application/x-www-form-urlencoded"; bsize:33; reference:url,norfolkinfosec.com/dprk-malware-targeting-security-researchers/; reference:url,blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/; classtype:bad-unknown; sid:2031559; rev:1; metadata:created_at 2021_01_26, former_category HUNTING, updated_at 2021_01_26;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Job314/Neutrino Reboot EK Landing Jan 07 2015"; flow:established,from_server; content:"nginx"; http_header; nocase; file_data; content:"value=|22|#ffffff|22|"; nocase; content:"<html>"; pcre:"/^\s*?<body>\s*?<script>(?:\s*var\s+[a-z]+\s*?=\s*?\d+\s*?\x3b\s*?){3,}\s*?<\/script>/Rs"; content:"<object"; pcre:"/^(?=(?:(?!<\/object>).)*?<param(?=[^>]*?name\s*?=\s*?\x22bgcolor\x22)[^>]*?value\s*?=\s*?\x22#ffffff\x22)(?:(?!<\/object>).)*?<param(?=[^>]*?name\s*?=\s*?\x22movie\x22)[^>]*?value\s*?=\s*?\x22\/(?:[a-z]{3,20}\/(?:(?=[a-z\d+]*?[A-Z])(?=[A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/(?:[a-z]{3,20}-)+[a-z]{3,20}|(?:[a-z]{3,20}-)+\d+|(?=[a-z\d]*?[A-Z]{2}\d+))(?:\.swf)?|\d+\/\d+\/\d+\/(?:[a-z]{3,20}\/)+(?:[a-z]{3,20}-)+[a-z]{3,20}(?:\.html)?(?:\.swf)?)\x22/Rsi"; content:"</object>"; distance:0; pcre:"/^\s*?<\/body>\s*?\s*?<\/html>\s*?$/Rs"; content:"allowScriptAccess"; fast_pattern:only; flowbits:set,ET.Neutrino; classtype:exploit-kit; sid:2025040; rev:3; metadata:created_at 2016_01_08, former_category CURRENT_EVENTS, updated_at 2018_06_18;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious POST Format"; flow:established,to_server; http.method; content:"POST"; http.request_line; content:"/upload/upload.asp HTTP/1.0"; fast_pattern; http.content_type; content:"application/x-www-form-urlencoded"; bsize:33; reference:url,norfolkinfosec.com/dprk-malware-targeting-security-researchers/; reference:url,blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/; classtype:bad-unknown; sid:2031560; rev:1; metadata:created_at 2021_01_26, former_category HUNTING, updated_at 2021_01_26;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Job314/Neutrino Reboot EK Flash Exploit Jan 07 2015 M1"; flow:established,to_server; content:"x-flash-version|3a|"; http_header; fast_pattern; content:!"|0d 0a|Cookie|3a|"; pcre:"/^\/(?:[a-z]{3,20}\/(?:(?=[a-z\d+]*?[A-Z])(?=[A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/(?:[a-z]{3,20}-)+[a-z]{3,20}|(?:[a-z]{3,20}-)+\d+|(?=[a-z\d]*?[A-Z]{2}\d+))(?:\.swf)?|\d+\/\d+\/\d+\/(?:[a-z]{3,20}\/)+(?:[a-z]{3,20}-)+[a-z]{3,20}(?:\.html)?(?:\.swf)?)$/U"; pcre:"/Host\x3a\x20(?P<host>[^\x3a\r\n]+)(?:\x3a\d{1,5})?\r\n.*?Referer\x3a\x20http\x3a\x2f\x2f(?P=host)\/(?:[a-z]{3,20}\/(?:(?=[a-z\d+]*?[A-Z])(?=[A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/(?:[a-z]{3,20}-)+[a-z]{3,20}|(?:[a-z]{3,20}-)+\d+|(?:[a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/(?:[a-z]{3,20}\/)+(?:[a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n/Hsi"; flowbits:set,ET.Neutrino; classtype:exploit-kit; sid:2025041; rev:2; metadata:created_at 2016_01_08, former_category CURRENT_EVENTS, updated_at 2018_06_18;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Use of rzd URL Shortener Service"; flow:established,to_server; http.method; content:"HEAD"; http.host; content:"rzd.ac"; bsize:6; fast_pattern; classtype:policy-violation; sid:2031647; rev:1; metadata:created_at 2021_02_22, former_category HUNTING, updated_at 2021_02_22;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Bulta CnC Beacon"; flow:established,to_server; content:"|1f 93 97 d3 94 01 69 49 4d 7b a7 ac f6 7a|"; depth:14; reference:md5,8dd612b14a2a448e8b1b6f3d09909e45; classtype:command-and-control; sid:2022345; rev:2; metadata:attack_target Client_Endpoint, created_at 2016_01_09, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2016_01_09, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Hidden embedded HTML Document"; flow:established,to_client; file.data; content:"<embed src=|27|data|3a|text/html|3b|base64|2c|PCFET0NUWVBFIGh0bWw+"; content:"|27 20|height|3d 27|0|27 20|frameborder|3d 27|0|27 3e 3c 2f|embed|3e|"; within:6000; reference:url,cujo.com/dns-hijacking-attacks-on-home-routers-in-brazil/; classtype:bad-unknown; sid:2031803; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2021_03_03, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2021_03_03;)
 
-#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET COINMINER CoinMiner Malicious Authline Seen in JAR Backdoor"; flow:established,to_server; content:"{|22|id|22 3A|"; depth:6; content:"|22|method|22 3a 20 22|mining.authorize|22 2c|"; within:100; content:"|22|params|22|"; within:50; content:"|5b 22|CGX2U2oeocN3DTJhyPG2cPg7xpRRTzNZkz|22 2c 20 22|"; distance:0; reference:url,research.zscaler.com/2013/12/bitcoin-mining-operation-seen-across.html; reference:url,blog.malwaremustdie.org/2016/01/mmd-0049-2016-case-of-java-trojan.html; classtype:coin-mining; sid:2022349; rev:1; metadata:attack_target Client_Endpoint, created_at 2016_01_12, deployment Perimeter, former_category COINMINER, signature_severity Major, tag Coinminer, updated_at 2016_01_12, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Glitch Hosted GET Request - Possible Phishing Landing"; flow:established,to_server; urilen:1; http.method; content:"GET"; http.host; content:".glitch.me"; fast_pattern; pcre:"/^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$/"; classtype:social-engineering; sid:2031917; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2021_03_10, deployment Perimeter, deployment SSLDecrypt, former_category HUNTING, signature_severity Critical, tag Phishing, updated_at 2021_03_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
 
-#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Blackhole Loading Gif Inline Image"; flow:established,from_server; content:"background|3a|url(data|3a|image/gif|3b|base64,R0lGODlhEAAQAAAAACH/C05FVFNDQVBFMi4wAwH//"; classtype:trojan-activity; sid:2014842; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_06_01, deployment Perimeter, malware_family Blackhole, signature_severity Critical, tag Blackhole, tag Exploit_Kit, updated_at 2018_01_25;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing"; dns.query; content:".glitch.me"; pcre:"/^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$/"; classtype:social-engineering; sid:2031918; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2021_03_10, deployment Perimeter, former_category HUNTING, signature_severity Critical, tag Phishing, updated_at 2021_03_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FakeM RAT CnC Beacon"; flow:established,to_server; content:"<html><title>"; depth:13; content:""; within:48; content:!""; content:"|f6 f6 f6 f6 f6 f6 f6 f6 f6 f6 f6 f6 f6 f6 f6 f6 f6 f6 f6 f6|"; distance:0; reference:md5,3e008471eaa5e788c41c2a0dff3d1a89; classtype:command-and-control; sid:2014636; rev:5; metadata:attack_target Client_Endpoint, created_at 2012_04_25, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2012_04_25, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing"; flow:established,to_server; tls.sni; content:".glitch.me"; endswith; pcre:"/^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$/"; classtype:social-engineering; sid:2031919; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2021_03_10, deployment Perimeter, former_category HUNTING, signature_severity Critical, tag Phishing, updated_at 2021_03_10, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ELF.STD.ddos Checkin"; flow:established,to_server; dsize:28; content:"2-1Q3@@4V-9-W$p#=A#9c=#W~,|0d 0a|"; reference:url,www.kernelmode.info/forum/viewtopic.php?f=16&t=2747&start=20#p27639; classtype:command-and-control; sid:2022367; rev:2; metadata:created_at 2016_01_14, former_category MALWARE, updated_at 2016_01_14;)
+alert tls any any -> $HOME_NET any (msg:"ET HUNTING Observed Suspicious SSL Cert (Metasploit Self Signed CA)"; flow:from_server,established; tls.cert_issuer; content:"CN=MetasploitSelfSignedCA"; classtype:policy-violation; sid:2031932; rev:1; metadata:attack_target Client_and_Server, created_at 2021_03_11, deployment Perimeter, deployment Internet, deployment Internal, former_category POLICY, signature_severity Informational, updated_at 2021_03_11;)
 
-alert ssh any $SSH_PORTS -> any any (msg:"ET EXPLOIT Possible CVE-2016-0777 Server Advertises Suspicious Roaming Support"; flow:established,to_client; content:"|14|"; offset:6; content:"resume@appgate.com"; distance:0; content:!"AppGateSSH_5.2"; reference:cve,2016-0777; reference:url,www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-0778/openssh-cve-2016-0777-cve-2016-0778.txt; classtype:attempted-user; sid:2022369; rev:2; metadata:created_at 2016_01_15, updated_at 2016_01_15;)
+alert tls any any -> $HOME_NET any (msg:"ET HUNTING Observed Suspicious SSL Cert (Metasploit in TLS Subject)"; flow:from_server,established; tls.cert_subject; content:"Metasploit"; nocase; classtype:policy-violation; sid:2031933; rev:2; metadata:attack_target Client_and_Server, created_at 2021_03_11, deployment Perimeter, deployment Internet, deployment Internal, former_category POLICY, signature_severity Informational, updated_at 2021_03_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET !7680 (msg:"ET P2P BitTorrent peer sync"; flow:established; content:"|00 00 00 0d 06 00|"; depth:6; threshold: type limit, track by_dst, seconds 300, count 1; reference:url,bitconjurer.org/BitTorrent/protocol.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000334; classtype:policy-violation; sid:2000334; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Possible Phishing Page - Page Saved with SingleFile Extension"; flow:to_client,established; file.data; content:"Page saved with SingleFile"; fast_pattern; content:"|0d 0a 20|url|3a 20|"; distance:0; content:"|0d 0a 20|saved date|3a 20|"; distance:0; reference:url,chrome.google.com/webstore/detail/singlefile/mpiodijhokgodhhofbcjdecpffjipkle?hl=en; classtype:misc-activity; sid:2032082; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2021_03_16, deployment Perimeter, former_category HUNTING, signature_severity Critical, tag Phishing, updated_at 2021_03_16, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET 7680 (msg:"ET P2P MS WUDO Peer Sync"; flow:established; content:"|00 00 00 0d 06 00|"; depth:6; reference:url,bitconjurer.org/BitTorrent/protocol.html; reference:url,windows.microsoft.com/en-us/windows-10/windows-update-delivery-optimization-faq; classtype:policy-violation; sid:2022371; rev:1; metadata:created_at 2016_01_15, updated_at 2016_01_15;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Generic Powershell DownloadString Command"; flow:established,to_client; flowbits:isset,ET.PS.Download; http.stat_code; content:"200"; file.data; content:".DownloadString("; nocase; fast_pattern; classtype:bad-unknown; sid:2032169; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2021_03_18, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_03_18;)
 
-alert tcp any any -> any $SSH_PORTS (msg:"ET EXPLOIT Possible CVE-2016-0777 Client Sent Roaming Resume Request"; flow:established,to_server; content:"|14|"; offset:6; content:"roaming@appgate.com"; distance:0; content:!"AppGateSSH_5.2"; reference:cve,2016-0777; reference:url,www.qualys.com/2016/01/14/cve-2016-0777-cve-2016-0778/openssh-cve-2016-0777-cve-2016-0778.txt; classtype:attempted-user; sid:2022370; rev:2; metadata:created_at 2016_01_15, updated_at 2016_01_15;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Generic Powershell DownloadFile Command"; flow:established,to_client; flowbits:isset,ET.PS.Download; http.stat_code; content:"200"; file.data; content:".DownloadFile("; nocase; fast_pattern; classtype:bad-unknown; sid:2032170; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2021_03_18, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_03_18;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; distance:9; within:25; content:"|30 09 06 03 55 04 06 13 02|PA|31|"; distance:0; fast_pattern; content:!"|55 04 08|"; distance:0; content:!"|55 04 07|"; distance:0; content:"|55 04 0a|"; distance:0; pcre:"/^.{2}(?!GoDaddy)[A-Z][a-z]+\s[A-Z][a-z]+\s(?:NL|Pty|Inc|Corp|Ltd)/Rs"; content:"|55 04 03|"; distance:0; pcre:"/^.{2}[a-z]{5,}\.[a-z]{2,3}[01]/R"; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022385; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Generic Powershell Starting Wscript Process"; flow:established,to_client; flowbits:isset,ET.PS.Download; http.stat_code; content:"200"; file.data; content:"start-process wscript"; nocase; fast_pattern; classtype:bad-unknown; sid:2032171; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2021_03_18, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_03_18;)
 
-#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Qadars CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|0c|relaxsaz.com"; distance:1; within:13; reference:md5,9b8fed949202b860d49f326d5e33bb35; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022386; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Generic Powershell Launching Hidden Window"; flow:established,to_client; flowbits:isset,ET.PS.Download; http.stat_code; content:"200"; file.data; content:"-windowstyle hidden"; nocase; fast_pattern; classtype:bad-unknown; sid:2032172; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2021_03_18, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_03_18;)
 
-#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Qadars CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|0d|contora24.com"; distance:1; within:14; reference:md5,9b8fed949202b860d49f326d5e33bb35; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022387; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Terse Request for EXE from DigitalOcean Spaces"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".exe"; endswith; http.host; content:".digitaloceanspaces.com"; endswith; fast_pattern; http.header_names; content:!"|0d 0a|User-Agent|0d 0a|"; content:!"|0d 0a|Referer|0d 0a|"; content:!"|0d 0a|Accept"; classtype:bad-unknown; sid:2032359; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_04_01, deployment Perimeter, deployment SSLDecrypt, former_category HUNTING, performance_impact Low, signature_severity Informational, updated_at 2021_04_01;)
 
-#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Qadars CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|14|websecuranalitic.com"; distance:1; within:21; reference:md5,105213be0a168d5e3eb0e4ff0262cf12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022388; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Observed POST to xsph .ru Domain"; flow:established,to_server; http.method; content:"POST"; http.host; content:".xsph.ru"; endswith; fast_pattern; http.header_names; content:!"Referer"; classtype:bad-unknown; sid:2032531; rev:1; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2021_04_08, deployment Perimeter, former_category HUNTING, signature_severity Major, updated_at 2021_04_08;)
 
-#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Qadars CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|10|moneyclass24.com"; distance:1; within:17; reference:md5,105213be0a168d5e3eb0e4ff0262cf12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022389; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING SSL/TLS Certificate Observed (OpenNIC Project API)"; flow:established,to_client; tls.cert_subject; content:"CN=api.opennicproject.org"; bsize:25; fast_pattern; reference:url,wiki.opennic.org/API; classtype:bad-unknown; sid:2032744; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_04_12, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2021_04_12;)
 
-#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Qadars CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|07|vle.cli"; distance:1; within:8; reference:md5,678129a67898174fdb7e8c70ebcca6c3; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022390; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING HTTP Request for OpenNIC API GeoIP Request"; flow:established,to_server; http.uri; content:"/geoip"; nocase; startswith; http.host; content:"api.opennicproject.org"; bsize:22; fast_pattern; reference:url,wiki.opennic.org/API; classtype:bad-unknown; sid:2032745; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_04_12, deployment Perimeter, deployment SSLDecrypt, former_category INFO, performance_impact Low, signature_severity Informational, updated_at 2021_04_12;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|1E|www.nonewhateverplanred.juegos"; distance:1; within:31; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022391; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Netlify Hosted GET Request - Possible Phishing Landing"; flow:established,to_server; http.method; content:"GET"; http.host; content:".netlify.app"; pcre:"/^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$/"; classtype:social-engineering; sid:2032758; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2021_04_14, deployment Perimeter, former_category HUNTING, signature_severity Critical, tag Phishing, updated_at 2021_04_14, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|1E|www.removenationalstiff.taipei"; distance:1; within:31; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022392; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING Suspicious Netlify Hosted DNS Request - Possible Phishing Landing"; dns.query; content:".netlify.app"; pcre:"/^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$/"; classtype:social-engineering; sid:2032759; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2021_04_14, deployment Perimeter, former_category HUNTING, signature_severity Critical, tag Phishing, updated_at 2021_04_14, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|20|www.fightingmotioncertainly.page"; distance:1; within:33; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022393; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Netlify Hosted TLS SNI Request - Possible Phishing Landing"; flow:established,to_server; tls.sni; content:".netlify.app"; pcre:"/^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$/"; classtype:social-engineering; sid:2032760; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2021_04_14, deployment Perimeter, former_category HUNTING, signature_severity Critical, tag Phishing, updated_at 2021_04_14, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0D|dinuspuka.net"; distance:1; within:14; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022394; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+#alert dns $HOME_NET any -> any any (msg:"ET HUNTING Malformed Domain Name in DNS Query (Domain Length Exceeds 253 Bytes)"; dns.query; bsize:>253; classtype:bad-unknown; sid:2032779; rev:1; metadata:created_at 2021_04_19, former_category HUNTING, updated_at 2021_04_19;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0D|popredrak.com"; distance:1; within:14; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022395; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Base64 Encoded Server Response (success)"; flow:established,from_server; file.data; content:"c3VjY2Vzcw=="; depth:12; classtype:bad-unknown; sid:2032883; rev:1; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2021_04_28, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_04_28;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0b|vorlager.ru"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022396; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious GET Request for .x86"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".x86"; endswith; fast_pattern; http.header_names; content:!"Referer"; classtype:bad-unknown; sid:2032924; rev:1; metadata:affected_product Linux, affected_product IoT, attack_target Client_Endpoint, created_at 2021_05_10, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_05_10;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; distance:9; within:25; content:"|30 09 06 03 55 04 06 13 02|IR|31|"; distance:0; fast_pattern; content:!"|55 04 08|"; distance:0; content:!"|55 04 07|"; distance:0; content:"|55 04 0a|"; distance:0; pcre:"/^.{2}(?!GoDaddy)[A-Z][a-z]+\s[A-Z][a-z]+\s(?:NL|Pty|Inc|Corp|Ltd)/Rs"; content:"|55 04 03|"; distance:0; pcre:"/^.{2}[a-z]{5,}\.[a-z]{2,3}[01]/R"; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022397; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_22, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious GET Request for .x64"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".x64"; endswith; fast_pattern; http.header_names; content:!"Referer"; classtype:bad-unknown; sid:2032925; rev:1; metadata:affected_product Linux, affected_product IoT, attack_target Client_Endpoint, created_at 2021_05_10, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_05_10;)
 
-#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Qadars CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|0d|kuklovodw.com"; distance:1; within:14; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022404; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Possible ELF executable sent when remote host claims to send a Text File"; flow:established,from_server; http.header; content:"Content-Type|3a 20|text/plain"; file.data; content:"|7f 45 4c 46|"; startswith; fast_pattern; isdataat:3000,relative; classtype:bad-unknown; sid:2032973; rev:1; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2021_05_18, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_05_18;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; distance:9; within:25; content:"|30 09 06 03 55 04 06 13 02|BW|31|"; distance:0; fast_pattern; content:!"|55 04 08|"; distance:0; content:!"|55 04 07|"; distance:0; content:"|55 04 0a|"; distance:0; pcre:"/^.{2}(?!GoDaddy)[A-Z][a-z]+\s[A-Z][a-z]+\s(?:NL|Pty|Inc|Corp|Ltd)/Rs"; content:"|55 04 03|"; distance:0; pcre:"/^.{2}[a-z]{5,}\.[a-z]{2,3}[01]/R"; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022408; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_26, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Office Doc Retrieving Shortened URL (bit .do)"; flow:established,to_server; http.method; content:"GET"; http.user_agent; content:"|3b 20|ms-office|3b 20|"; http.host; content:"bit.do"; bsize:6; fast_pattern; reference:md5,04a303e67b4a2f9f7bb532779aef2c72; classtype:bad-unknown; sid:2033133; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_06_10, deployment Perimeter, former_category HUNTING, performance_impact Low, signature_severity Informational, updated_at 2021_06_10;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE CenterPOS User Agent Observed"; flow:established,to_server; content:"User-Agent|3a 20|IDOSJNDX|0d 0a|"; fast_pattern; flowbits:set,ET.centerpos; reference:md5,0e278436fb49f9ab0d1a3da792cfb0c3; reference:url,www.fireeye.com/blog/threat-research/2016/01/centerpos_an_evolvi.html; classtype:trojan-activity; sid:2022468; rev:2; metadata:created_at 2016_01_29, updated_at 2019_10_23;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING URL Shortening Service Used by Curl (ic9 .in)"; flow:established,to_server; http.user_agent; content:"curl/"; startswith; http.host; content:"ic9.in"; bsize:6; fast_pattern; classtype:bad-unknown; sid:2033134; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_06_10, deployment Perimeter, former_category HUNTING, performance_impact Low, signature_severity Informational, updated_at 2021_06_10;)
 
-#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Qadars CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|buhzgalter.com"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022474; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_29, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+#alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspected DNS CnC via TXT queries"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|00 00 10 00 01|"; threshold:type both, track by_src,count 500, seconds 300; classtype:bad-unknown; sid:2033185; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_06_24, deployment Perimeter, deployment Internal, former_category HUNTING, performance_impact Significant, updated_at 2021_06_24;)
 
-#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ursnif Injects)"; flow:from_server,established; content:"|55 04 03|"; content:"|0f|docknetwork.com"; distance:1; within:17; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022475; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_29, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http any any -> [$HTTP_SERVERS,$HOME_NET] any (msg:"ET HUNTING Possible REvil 0day Exploitation Activity Inbound"; flow:established,to_server; content:"|0a|procCreate|28 22|Archive"; content:"procStep|28|"; distance:0; within:50; content:"+++SQLCMD|3a 22|+"; distance:0; within:100; content:"|22|DELETE|20|FROM"; reference:url,blog.truesec.com/2021/07/04/kaseya-supply-chain-attack-targeting-msps-to-deliver-revil-ransomware/; classtype:bad-unknown; sid:2033236; rev:1; metadata:created_at 2021_07_05, former_category HUNTING, updated_at 2021_07_05;)
 
-#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Angler EK encrypted payload Oct 19 (4)"; flow:established,to_client; file_data; content:"|05 9d 45|"; distance:4; within:4; pcre:"/^(?:\x76|\x0f)/R"; classtype:exploit-kit; sid:2021973; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_10_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Angler, signature_severity Critical, tag Angler, tag Exploit_Kit, updated_at 2018_06_18;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING jpg download from fileupload .site"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".jpg"; endswith; http.host; content:"fileupload.site"; bsize:15; fast_pattern; http.header_names; content:!"Referer"; classtype:bad-unknown; sid:2033287; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_07_09, deployment Perimeter, former_category HUNTING, performance_impact Low, signature_severity Informational, updated_at 2021_07_09;)
 
-#alert tls $EXTERNAL_NET [80,443] -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gootkit CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|0d|macroflex.net"; distance:1; within:14; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022476; rev:2; metadata:attack_target Client_and_Server, created_at 2016_01_29, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Windows Commands in POST Body (nltest)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"nltest /domain_trusts"; nocase; fast_pattern; http.header_names; content:!"Referer|0d 0a|"; classtype:bad-unknown; sid:2033379; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2021_07_21, deployment Perimeter, former_category HUNTING, signature_severity Minor, updated_at 2021_07_21;)
 
-alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET SCAN Possible WordPress xmlrpc.php BruteForce in Progress - Response"; flow:established,from_server; flowbits:isset,ET.XMLRPC.PHP; file_data; content:"faultCode"; content:"403"; content:"Incorrect username or password."; threshold:type both, track by_src, count 5, seconds 120; reference:url,isc.sans.edu/diary/+WordPress+brute+force+attack+via+wp.getUsersBlogs/18427; classtype:attempted-admin; sid:2018755; rev:5; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2014_07_23, deployment Datacenter, signature_severity Major, tag Wordpress, updated_at 2016_07_01;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Windows Commands in POST Body (ipconfig)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"ipconfig /all"; nocase; fast_pattern; http.header_names; content:!"Referer|0d 0a|"; classtype:bad-unknown; sid:2033380; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2021_07_21, deployment Perimeter, former_category HUNTING, signature_severity Minor, updated_at 2021_07_21;)
 
-#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Zeus CnC)"; flow:from_server,established; content:"|55 04 03|"; content:"|13|ashirimi-critism.kz"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022478; rev:2; metadata:attack_target Client_and_Server, created_at 2016_02_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Windows Commands in POST Body (net view)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"net view /all"; nocase; fast_pattern; http.header_names; content:!"Referer|0d 0a|"; classtype:bad-unknown; sid:2033381; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2021_07_21, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_07_21;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Possible Mobile Malware POST of IMEI International Mobile Equipment Identity in URI"; flow:established,to_server; content:"POST"; http_method; content:"imei="; nocase; http_uri; pcre:"/imei=\d{2}-?\d{6}-?\d{6,}-?\d{1,}/Ui"; content:!"Host|3a 20|iphone-wu.apple.com"; http_header; reference:url,www.met.police.uk/mobilephone/imei.htm; classtype:trojan-activity; sid:2012848; rev:3; metadata:created_at 2011_05_25, updated_at 2011_05_25;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Windows Commands in POST Body (net config)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"net config workstation"; nocase; fast_pattern; http.header_names; content:!"Referer|0d 0a|"; classtype:bad-unknown; sid:2033382; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2021_07_21, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_07_21;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux/ChinaZ 2.0 DDoS Bot Checkin 3"; flow:established,to_server; content:"*"; pcre:"/^\d+/R"; content:"MHZ|00 00 00 00|"; within:7; content:"MB|00 00 00 00|"; distance:0; content:"|28|null|29 00 00 00 00|"; fast_pattern; distance:0; reference:url,blog.malwaremustdie.org/2015/06/the-elf-chinaz-reloaded.html; classtype:command-and-control; sid:2021526; rev:2; metadata:created_at 2015_07_23, former_category MALWARE, updated_at 2015_07_23;)
+alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET HUNTING .exec in HTTP URI Inbound - Possible Exploit Activity"; flow:established,to_server; http.uri; content:".exec|28|"; fast_pattern; classtype:bad-unknown; sid:2033406; rev:2; metadata:created_at 2021_07_24, former_category HUNTING, updated_at 2021_07_24;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; distance:9; within:25; content:"|30 09 06 03 55 04 06 13 02|KM|31|"; distance:0; fast_pattern; content:!"|55 04 08|"; distance:0; content:!"|55 04 07|"; distance:0; content:"|55 04 0a|"; distance:0; pcre:"/^.{2}(?!GoDaddy)[A-Z][a-z]+\s[A-Z][a-z]+\s(?:NL|Pty|Inc|Corp|Ltd)/Rs"; content:"|55 04 03|"; distance:0; pcre:"/^.{2}[a-z]{5,}\.[a-z]{2,3}[01]/R"; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022489; rev:2; metadata:attack_target Client_and_Server, created_at 2016_02_04, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET HUNTING .exec in HTTP Header Inbound - Possible Exploit Activity"; flow:established,to_server; http.header; content:".exec|28|"; fast_pattern; classtype:bad-unknown; sid:2033407; rev:2; metadata:created_at 2021_07_24, former_category HUNTING, updated_at 2021_07_24;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED APT.Fexel Checkin"; flow:established,to_server; content:"agtid="; http_header; content:"08x"; http_client_body; reference:md5,70e87b2898333e11344b16a72183f8e9; reference:url,www.fireeye.com/blog/technical/cyber-exploits/2013/09/operation-deputydog-zero-day-cve-2013-3893-attack-against-japanese-targets.html; classtype:targeted-activity; sid:2019469; rev:6; metadata:created_at 2014_10_17, updated_at 2014_10_17;)
+alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET HUNTING NOP Sled in HTTP Header Inbound - Possible Exploit Activity"; flow:established,to_server; http.header; content:"|90 90 90 90 90 90 90 90 90 90 90|"; fast_pattern; classtype:bad-unknown; sid:2033430; rev:1; metadata:created_at 2021_07_26, former_category HUNTING, updated_at 2021_07_26;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Feb 07 2016"; flow:established,to_server; content:"/QrQ8Gr"; http_uri; urilen:7; classtype:exploit-kit; sid:2022496; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_02_09, deployment Perimeter, signature_severity Major, tag Redirector, updated_at 2016_07_01;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Screenshot Uploaded to Discord"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/webhooks"; http.host; content:"discord.com"; http.request_body; content:"filename="; content:"screenshot."; within:12; fast_pattern; reference:md5,19917b254644d1039dd31d0a488ddeeb; classtype:bad-unknown; sid:2033447; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_07_27, deployment Perimeter, deployment SSLDecrypt, former_category HUNTING, signature_severity Informational, updated_at 2021_07_27;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"ET POLICY RDP disconnect request"; flow: to_server,established; content:"|03|"; offset: 0; depth: 1; content:"|80|"; offset: 5; depth: 1; reference:url,doc.emergingthreats.net/2001331; classtype:misc-activity; sid:2001331; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Base64 Encoded Windows IP Configuration Output in HTTP POST M1"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"V2luZG93cyBJUCBDb25maWd1cmF0aW9uDQoNCiAgIEhvc3QgTmFtZSAuI"; classtype:bad-unknown; sid:2033734; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_08_16, deployment Perimeter, former_category HUNTING, performance_impact Low, signature_severity Informational, updated_at 2021_08_16;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"ET POLICY RDP connection request"; flow: to_server,established; content:"|03|"; offset: 0; depth: 1; content:"|E0|"; offset: 5; depth: 1; reference:url,doc.emergingthreats.net/2001329; classtype:misc-activity; sid:2001329; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Base64 Encoded Windows IP Configuration Output in HTTP POST M2"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"aW5kb3dzIElQIENvbmZpZ3VyYXRpb24NCg0KICAgSG9zdCBOYW1lIC4g"; classtype:bad-unknown; sid:2033735; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_08_16, deployment Perimeter, former_category HUNTING, performance_impact Low, signature_severity Informational, updated_at 2021_08_16;)
 
-#alert tcp any [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $HOME_NET any (msg:"ET EXPLOIT FREAK Weak Export Suite From Server (CVE-2015-0204)"; flow:established,from_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|02|"; distance:3; within:1; byte_jump:1,37,relative; content:"|00 03|"; within:2; fast_pattern; threshold:type limit,track by_dst,count 1,seconds 1200; reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html; reference:cve,2015-0204; reference:cve,2015-1637; classtype:bad-unknown; sid:2020630; rev:6; metadata:created_at 2015_03_06, updated_at 2015_03_06;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Base64 Encoded Windows IP Configuration Output in HTTP POST M3"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"dpbmRvd3MgSVAgQ29uZmlndXJhdGlvbg0KDQogICBIb3N0IE5hbWUgLi"; classtype:bad-unknown; sid:2033736; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_08_16, deployment Perimeter, former_category HUNTING, performance_impact Low, signature_severity Informational, updated_at 2021_08_16;)
 
-#alert tcp any [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $HOME_NET any (msg:"ET EXPLOIT FREAK Weak Export Suite From Server (CVE-2015-0204)"; flow:established,from_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|02|"; distance:3; within:1; byte_jump:1,37,relative; content:"|00 0B|"; within:2; fast_pattern; threshold:type limit,track by_dst,count 1,seconds 1200; reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html; reference:cve,2015-0204; reference:cve,2015-1637; classtype:bad-unknown; sid:2020668; rev:2; metadata:created_at 2015_03_11, updated_at 2015_03_11;)
+alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET HUNTING NOP Sled in HTTP URI Inbound - Possible Exploit Activity"; flow:established,to_server; http.uri.raw; content:"|90 90 90 90 90 90 90 90 90 90 90|"; fast_pattern; classtype:bad-unknown; sid:2033431; rev:3; metadata:created_at 2021_07_26, former_category HUNTING, updated_at 2021_08_18;)
 
-#alert tcp any [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $HOME_NET any (msg:"ET EXPLOIT FREAK Weak Export Suite From Server (CVE-2015-0204)"; flow:established,from_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|02|"; distance:3; within:1; byte_jump:1,37,relative; content:"|00 28|"; within:2; fast_pattern; threshold:type limit,track by_dst,count 1,seconds 1200; reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html; reference:cve,2015-0204; reference:cve,2015-1637; classtype:bad-unknown; sid:2020664; rev:4; metadata:created_at 2015_03_11, updated_at 2015_03_11;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Base64 Encoded whoami in HTTP Server Response"; flow:established,to_client; file.data; content:"d2hvYW1p"; reference:md5,a6828081717974a89792548e1e31f29a; reference:url,twitter.com/fr0s7_/status/1428326979527381000; classtype:bad-unknown; sid:2033745; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_08_19, deployment Perimeter, former_category HUNTING, performance_impact Low, signature_severity Major, updated_at 2021_08_19;)
 
-#alert tcp any [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $HOME_NET any (msg:"ET EXPLOIT FREAK Weak Export Suite From Server (CVE-2015-0204)"; flow:established,from_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|02|"; distance:3; within:1; byte_jump:1,37,relative; content:"|00 14|"; within:2; fast_pattern; threshold:type limit,track by_dst,count 1,seconds 1200; reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html; reference:cve,2015-0204; reference:cve,2015-1637; classtype:bad-unknown; sid:2020660; rev:4; metadata:created_at 2015_03_11, updated_at 2015_03_11;)
+alert http any any -> $HOME_NET any (msg:"ET HUNTING Suspicious Request to iplogger .org Contains Period"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"|2e|"; http.host; content:"iplogger|2e|org"; bsize:12; fast_pattern; reference:md5,dcef208fcdac3345c6899a478d16980f; classtype:bad-unknown; sid:2033859; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2021_09_01, deployment Perimeter, former_category HUNTING, signature_severity Major, updated_at 2021_09_01;)
 
-#alert tcp any [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $HOME_NET any (msg:"ET EXPLOIT FREAK Weak Export Suite From Server (CVE-2015-0204)"; flow:established,from_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|02|"; distance:3; within:1; byte_jump:1,37,relative; content:"|00 06|"; within:2; fast_pattern; threshold:type limit,track by_dst,count 1,seconds 1200; reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html; reference:cve,2015-0204; reference:cve,2015-1637; classtype:bad-unknown; sid:2020631; rev:6; metadata:created_at 2015_03_06, updated_at 2015_03_06;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (Chrome_Default.txt)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"PK|03 04|"; content:"Chrome_Default.txt"; nocase; distance:0; fast_pattern; classtype:bad-unknown; sid:2033886; rev:1; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2021_09_02, deployment Perimeter, former_category HUNTING, signature_severity Minor, updated_at 2021_09_02;)
 
-#alert tcp any [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $HOME_NET any (msg:"ET EXPLOIT FREAK Weak Export Suite From Server (CVE-2015-0204)"; flow:established,from_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|02|"; distance:3; within:1; byte_jump:1,37,relative; content:"|00 17|"; within:2; fast_pattern; threshold:type limit,track by_dst,count 1,seconds 1200; reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html; reference:cve,2015-0204; reference:cve,2015-1637; classtype:bad-unknown; sid:2020669; rev:2; metadata:created_at 2015_03_11, updated_at 2015_03_11;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (Cookies/Firefox_)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"PK|03 04|"; content:"Cookies/Firefox_"; nocase; distance:0; fast_pattern; content:".default.txt"; within:25; classtype:bad-unknown; sid:2033887; rev:1; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2021_09_02, deployment Perimeter, former_category HUNTING, signature_severity Minor, updated_at 2021_09_02;)
 
-#alert tcp any [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $HOME_NET any (msg:"ET EXPLOIT FREAK Weak Export Suite From Server (CVE-2015-0204)"; flow:established,from_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|02|"; distance:3; within:1; byte_jump:1,37,relative; content:"|00 29|"; within:2; fast_pattern; threshold:type limit,track by_dst,count 1,seconds 1200; reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html; reference:cve,2015-0204; reference:cve,2015-1637; classtype:bad-unknown; sid:2020665; rev:4; metadata:created_at 2015_03_11, updated_at 2015_03_11;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (History/Firefox_)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"PK|03 04|"; content:"History/Firefox_"; nocase; distance:0; fast_pattern; content:".default.txt"; within:25; classtype:bad-unknown; sid:2033888; rev:1; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2021_09_02, deployment Perimeter, former_category HUNTING, signature_severity Minor, updated_at 2021_09_02;)
 
-#alert tcp any [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $HOME_NET any (msg:"ET EXPLOIT FREAK Weak Export Suite From Server (CVE-2015-0204)"; flow:established,from_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|02|"; distance:3; within:1; byte_jump:1,37,relative; content:"|00 0E|"; within:2; fast_pattern; threshold:type limit,track by_dst,count 1,seconds 1200; reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html; reference:cve,2015-0204; reference:cve,2015-1637; classtype:bad-unknown; sid:2020633; rev:6; metadata:created_at 2015_03_06, updated_at 2015_03_06;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Observed Suspicious Request nc.exe in URI"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/nc.exe"; fast_pattern; nocase; endswith; http.header_names; content:!"Referer"; classtype:bad-unknown; sid:2033891; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2021_09_02, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_09_02;)
 
-#alert tcp any [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $HOME_NET any (msg:"ET EXPLOIT FREAK Weak Export Suite From Server (CVE-2015-0204)"; flow:established,from_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|02|"; distance:3; within:1; byte_jump:1,37,relative; content:"|00 08|"; within:2; fast_pattern; threshold:type limit,track by_dst,count 1,seconds 1200; reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html; reference:cve,2015-0204; reference:cve,2015-1637; classtype:bad-unknown; sid:2020632; rev:5; metadata:created_at 2015_03_06, updated_at 2015_03_06;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Inbound Powershell Creating .hta File"; flow:established,to_client; file.data; content:".hta|22 3b|"; content:"|28|New-Object|20|-COM"; classtype:bad-unknown; sid:2033956; rev:1; metadata:created_at 2021_09_15, former_category HUNTING, updated_at 2021_09_15;)
 
-#alert tcp any [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $HOME_NET any (msg:"ET EXPLOIT FREAK Weak Export Suite From Server (CVE-2015-0204)"; flow:established,from_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|02|"; distance:3; within:1; byte_jump:1,37,relative; content:"|00 11|"; within:2; fast_pattern; threshold:type limit,track by_dst,count 1,seconds 1200; reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html; reference:cve,2015-0204; reference:cve,2015-1637; classtype:bad-unknown; sid:2020659; rev:4; metadata:created_at 2015_03_11, updated_at 2015_03_11;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Inbound Powershell Creating .lnk File"; flow:established,to_client; file.data; content:".lnk|22|"; content:"|28|New-Object|20|-COM|20|WScript.Shell|29|.CreateShortcut|28|"; classtype:bad-unknown; sid:2033957; rev:1; metadata:created_at 2021_09_15, former_category HUNTING, updated_at 2021_09_15;)
 
-#alert tcp any [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $HOME_NET any (msg:"ET EXPLOIT FREAK Weak Export Suite From Server (CVE-2015-0204)"; flow:established,from_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|02|"; distance:3; within:1; byte_jump:1,37,relative; content:"|00 27|"; within:2; fast_pattern; threshold:type limit,track by_dst,count 1,seconds 1200; reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html; reference:cve,2015-0204; reference:cve,2015-1637; classtype:bad-unknown; sid:2020663; rev:4; metadata:created_at 2015_03_11, updated_at 2015_03_11;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING DNS Lookup for 8+ hexadecimal only duckdns domain"; dns.query; content:".duckdns.org"; fast_pattern; pcre:"/^[a-f0-9]{8,}\.duckdns\.org$/"; reference:md5,cfaed1a20d1d7e877f58d54272361df1; classtype:bad-unknown; sid:2033959; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_09_16, deployment Perimeter, former_category HUNTING, performance_impact Moderate, signature_severity Major, updated_at 2021_09_16;)
 
-#alert udp $EXTERNAL_NET 32768:61000 -> $HOME_NET 1024:65535 (msg:"ET INFO SOCKSv5 UDP Proxy Inbound Connect Request (Linux Source)"; content:"|00 00|"; depth:2; content:"|01|"; offset:3; depth:1; threshold:type both, track by_dst, count 1, seconds 900; reference:url,handlers.sans.org/wsalusky/rants/; reference:url,en.wikipedia.org/wiki/SOCKS; reference:url,ss5.sourceforge.net/socks4.protocol.txt; reference:url,ss5.sourceforge.net/socks4A.protocol.txt; reference:url,www.ietf.org/rfc/rfc1928.txt; reference:url,www.ietf.org/rfc/rfc1929.txt; reference:url,www.ietf.org/rfc/rfc1961.txt; reference:url,www.ietf.org/rfc/rfc3089.txt; reference:url,doc.emergingthreats.net/bin/view/Main/2003287; classtype:protocol-command-decode; sid:2003287; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2017_10_27;)
+alert dns $HOME_NET any -> any any (msg:"ET HUNTING Telegram API Domain in DNS Lookup"; dns.query; content:"api.telegram.org"; nocase; bsize:16; classtype:misc-activity; sid:2033966; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_09_16, deployment Perimeter, former_category HUNTING, performance_impact Low, signature_severity Informational, updated_at 2021_09_16;)
 
-#alert tcp any [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $HOME_NET any (msg:"ET EXPLOIT FREAK Weak Export Suite From Server (CVE-2015-0204)"; flow:established,from_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|02|"; distance:3; within:1; byte_jump:1,37,relative; content:"|00 2A|"; within:2; fast_pattern; threshold:type limit,track by_dst,count 1,seconds 1200; reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html; reference:cve,2015-0204; reference:cve,2015-1637; classtype:bad-unknown; sid:2020666; rev:4; metadata:created_at 2015_03_11, updated_at 2015_03_11;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)"; flow:established,to_server; tls.sni; content:"api.telegram.org"; bsize:16; fast_pattern; classtype:misc-activity; sid:2033967; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_09_16, deployment Perimeter, former_category HUNTING, performance_impact Low, signature_severity Informational, updated_at 2021_09_16;)
 
-#alert tcp any [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $HOME_NET any (msg:"ET EXPLOIT FREAK Weak Export Suite From Server (CVE-2015-0204)"; flow:established,from_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|02|"; distance:3; within:1; byte_jump:1,37,relative; content:"|00 2B|"; within:2; fast_pattern; threshold:type limit,track by_dst,count 1,seconds 1200; reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html; reference:cve,2015-0204; reference:cve,2015-1637; classtype:bad-unknown; sid:2020667; rev:4; metadata:created_at 2015_03_11, updated_at 2015_03_11;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Generic Phishkit Javascript Response with Phishy Text"; flow:established,to_client; http.stat_code; content:"200"; file.data; content:"click OK or reload"; nocase; fast_pattern; content:"longtime to request"; nocase; reference:url,blog.group-ib.com/perswaysion; classtype:misc-activity; sid:2034003; rev:2; metadata:attack_target Client_Endpoint, created_at 2021_09_21, deployment Perimeter, former_category PHISHING, signature_severity Informational, updated_at 2021_09_22;)
 
-#alert udp $EXTERNAL_NET 1024:5000 -> $HOME_NET 1024:65535 (msg:"ET INFO SOCKSv5 UDP Proxy Inbound Connect Request (Windows Source)"; content:"|00 00|"; depth:2; content:"|01|"; offset:3; depth:1; threshold:type both, track by_dst, count 1, seconds 900; reference:url,handlers.sans.org/wsalusky/rants/; reference:url,en.wikipedia.org/wiki/SOCKS; reference:url,ss5.sourceforge.net/socks4.protocol.txt; reference:url,ss5.sourceforge.net/socks4A.protocol.txt; reference:url,www.ietf.org/rfc/rfc1928.txt; reference:url,www.ietf.org/rfc/rfc1929.txt; reference:url,www.ietf.org/rfc/rfc1961.txt; reference:url,www.ietf.org/rfc/rfc3089.txt; reference:url,doc.emergingthreats.net/bin/view/Main/2003286; classtype:protocol-command-decode; sid:2003286; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2017_10_27;)
+#alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Observed AutoDesk Domain in TLS SNI (autodesk360 .com)"; flow:established,to_server; tls.sni; dotprefix; content:".autodesk360.com"; endswith; fast_pattern; classtype:bad-unknown; sid:2034097; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_10_04, deployment Perimeter, former_category HUNTING, performance_impact Low, signature_severity Informational, updated_at 2021_10_04;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Fiesta Payload/Exploit URI Struct M3"; flow:established,to_server; urilen:40<>65; content:"3"; http_uri; offset:40; depth:10; pcre:"/^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(?P[\x2c\x3b])3(?:(?P=sep)|\d)*?$/U"; content:!"computerwoche.de|0d 0a|"; http_header; classtype:exploit-kit; sid:2020998; rev:5; metadata:created_at 2015_04_24, updated_at 2015_04_24;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Observed AutoDesk Domain in TLS SNI (api .autodesk .com)"; flow:established,to_server; tls.sni; content:"developer.api.autodesk.com"; bsize:26; fast_pattern; classtype:bad-unknown; sid:2034098; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_10_04, deployment Perimeter, former_category HUNTING, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2021_10_04;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Fiesta Payload/Exploit URI Struct M4"; flow:established,to_server; urilen:40<>65; content:"4"; http_uri; offset:40; depth:10; pcre:"/^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(?P[\x2c\x3b])4(?:(?P=sep)|\d)*?$/U"; classtype:exploit-kit; sid:2020999; rev:4; metadata:created_at 2015_04_24, updated_at 2015_04_24;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Set flow on bmp file get"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".bmp"; http.request_line; content:".bmp HTTP/1."; fast_pattern; flowbits:set,ET.bmp_seen; flowbits:noalert; reference:url,doc.emergingthreats.net/2009083; classtype:not-suspicious; sid:2009083; rev:8; metadata:created_at 2010_07_30, former_category HUNTING, updated_at 2021_10_08;)
 
-#alert tcp any [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $HOME_NET any (msg:"ET EXPLOIT FREAK Weak Export Suite From Server (CVE-2015-0204)"; flow:established,from_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|02|"; distance:3; within:1; byte_jump:1,37,relative; content:"|00 26|"; within:2; fast_pattern; threshold:type limit,track by_dst,count 1,seconds 1200; reference:url,blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html; reference:cve,2015-0204; reference:cve,2015-1637; classtype:bad-unknown; sid:2020662; rev:5; metadata:created_at 2015_03_11, updated_at 2015_03_11;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING [@Silv0123] Possible Fake Microsoft Office User-Agent Observed"; flow:established,to_server; http.user_agent; content:"Microsoft Office"; startswith; fast_pattern; pcre:"/^[^\x3b\x2f\x28]+$/R"; content:!"2014"; endswith; content:!"Discovery"; endswith; content:!"OneNote"; endswith; reference:url,twitter.com/silv0123/status/1437869745961832455; classtype:bad-unknown; sid:2033960; rev:3; metadata:created_at 2021_09_16, former_category HUNTING, updated_at 2021_10_25;)
 
-#alert tcp any [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $HOME_NET any (msg:"ET EXPLOIT Logjam Weak DH/DHE Export Suite From Server"; flow:established,from_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|02|"; distance:3; within:1; byte_jump:1,37,relative; content:"|00 63|"; within:2; fast_pattern; threshold:type limit,track by_dst,count 1,seconds 1200; reference:url,weakdh.org; classtype:bad-unknown; sid:2021124; rev:2; metadata:created_at 2015_05_20, updated_at 2015_05_20;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Terse HTTP Request to textbin"; flow:established,to_server; http.request_line; content:"GET /raw/"; startswith; http.host; content:"textbin.net"; bsize:11; fast_pattern; http.header_names; content:"|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|"; bsize:22; classtype:bad-unknown; sid:2034461; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_11_15, deployment Perimeter, deployment SSLDecrypt, former_category HUNTING, signature_severity Informational, updated_at 2021_11_15;)
 
-#alert tcp any [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $HOME_NET any (msg:"ET EXPLOIT Logjam Weak DH/DHE Export Suite From Server"; flow:established,from_server; content:"|16 03|"; depth:2; byte_test:1,<,4,0,relative; content:"|02|"; distance:3; within:1; byte_jump:1,37,relative; content:"|00 65|"; within:2; fast_pattern; threshold:type limit,track by_dst,count 1,seconds 1200; reference:url,weakdh.org; classtype:bad-unknown; sid:2021125; rev:2; metadata:created_at 2015_05_20, updated_at 2015_05_20;)
+alert http $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET HUNTING Possible UPnP UUID Overflow Exploit Attempt from External Host - SUBSCRIBE/UNSUBSCRIBE"; flow:established,to_server; http.method; content:"SUBSCRIBE"; http.header; content:"UUID|3a 20|"; fast_pattern; pcre:"/^[^\r\n]{100,}/R"; classtype:unknown; sid:2034495; rev:1; metadata:created_at 2021_11_18, former_category HUNTING, updated_at 2021_11_18;)
 
-#alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 3306 (msg:"ET EXPLOIT MySQL Heap based buffer overrun Exploit Specific"; flow:to_server,established; byte_test:3,>,10000,0,little; content:"|00 03|"; offset:3; depth:2; pcre:"/^(USE|PASS|SELECT|UPDATE|INSERT|ASCII|SHOW|CREATE|DESCRIBE|DROP|ALTER)\s+?(.{1})\2{300}/Ri"; reference:url,archives.neohapsis.com/archives/fulldisclosure/2012-12/0006.html; classtype:attempted-user; sid:2015987; rev:3; metadata:created_at 2012_12_05, updated_at 2012_12_05;)
+alert http [$HOME_NET,$HTTP_SERVERS] any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET HUNTING Possible UPnP UUID Overflow Exploit Attempt from Internal Host - SUBSCRIBE/UNSUBSCRIBE"; flow:established,to_server; http.method; content:"SUBSCRIBE"; http.header; content:"UUID|3a 20|"; fast_pattern; pcre:"/^[^\r\n]{100,}/R"; classtype:unknown; sid:2034496; rev:1; metadata:created_at 2021_11_18, former_category HUNTING, updated_at 2021_11_18;)
 
-#alert udp $EXTERNAL_NET any -> $HOME_NET 500 (msg:"GPL EXPLOIT ISAKMP delete hash with empty hash attempt"; content:"|08|"; depth:1; offset:16; content:"|0C|"; depth:1; offset:28; content:"|00 04|"; depth:2; offset:30; reference:bugtraq,9416; reference:bugtraq,9417; reference:cve,2004-0164; classtype:misc-attack; sid:2102413; rev:11; metadata:created_at 2010_09_23, updated_at 2010_09_23;)
+alert http $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET HUNTING Possible UPnP UUID Overflow Exploit Attempt from External Host - NOTIFY"; flow:established,to_server; http.method; content:"NOTIFY"; http.header; content:"UUID|3a 20|"; fast_pattern; pcre:"/^[^\r\n]{100,}/R"; classtype:unknown; sid:2034497; rev:1; metadata:created_at 2021_11_18, former_category HUNTING, updated_at 2021_11_18;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET !80 (msg:"ET EXPLOIT_KIT Probable Nuclear exploit kit landing page"; flow:established,to_server; content:".html"; http_uri; content:"GET"; http_method; pcre:"/^\/[0-9a-f]{32}\.html$/U"; content:"Referer|3a|"; http_header; classtype:exploit-kit; sid:2016952; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_05_31, deployment Perimeter, former_category EXPLOIT_KIT, malware_family Nuclear, signature_severity Critical, tag Exploit_Kit, tag Nuclear, updated_at 2016_07_01;)
+alert http [$HOME_NET,$HTTP_SERVERS] any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET HUNTING Possible UPnP UUID Overflow Exploit Attempt from Internal Host - NOTIFY"; flow:established,to_server; http.method; content:"NOTIFY"; http.header; content:"UUID|3a 20|"; fast_pattern; pcre:"/^[^\r\n]{100,}/R"; classtype:unknown; sid:2034498; rev:1; metadata:created_at 2021_11_18, former_category HUNTING, updated_at 2021_11_18;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET 2200 (msg:"ET EXPLOIT Computer Associates BrightStor ARCserve Backup for Laptops LGServer.exe DoS"; flow:established,to_server; content:"|ff ff ff ff|"; offset:16; depth:4; reference:url,www.securityfocus.com/archive/1/archive/1/458650/100/0/threaded; reference:url,doc.emergingthreats.net/bin/view/Main/2003379; classtype:attempted-dos; sid:2003379; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING curl User-Agent to Dotted Quad"; flow:established,to_server; http.user_agent; content:"curl/"; startswith; nocase; fast_pattern; http.host; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/"; classtype:bad-unknown; sid:2034567; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_12_01, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2021_12_01;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Successful WZ-REKLAMA Phish 2016-01-08"; flow:to_client,established; file_data; content:"|0d 0a||0d 0a|"; nocase; within:100; classtype:bad-unknown; sid:2025267; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_01_30, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2018_01_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.wwwhost .biz Domain"; flow:established,to_server; http.host; content:".wwwhost.biz"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036063; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Impots.gouv.fr Phishing Landing 2018-01-30"; flow:established,to_client; file_data; content:" any any (msg:"ET INFO DYNAMIC_DNS Query to a *.moneyhome .biz Domain"; dns.query; content:".moneyhome.biz"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036064; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Turbotax Phishing Landing 2018-01-30"; flow:established,to_client; file_data; content:"My TurboTax"; nocase; fast_pattern; content:"Login to your MyTurboTax account to start"; nocase; distance:0; content:"User ID"; nocase; distance:0; content:"Email Password"; nocase; distance:0; classtype:social-engineering; sid:2025269; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_01_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_01_30;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.moneyhome .biz Domain"; flow:established,to_server; http.host; content:".moneyhome.biz"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036065; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Bank of America Phishing Landing 2018-01-30"; flow:established,to_client; file_data; content:"<title"; nocase; content:"Bank of America|20 7c 20|Online Banking"; nocase; within:40; fast_pattern; content:"CONTENT=|22|Unrecognized computer"; nocase; distance:0; content:"SiteKey Challenge Questions"; nocase; distance:0; classtype:social-engineering; sid:2025270; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_01_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_01_30;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.port25 .biz Domain"; dns.query; content:".port25.biz"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036066; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Capital One Phishing Landing - Title over non SSL"; flow:established,to_client; file_data; content:"<title>Online Banking - Capital One 360"; nocase; classtype:social-engineering; sid:2025271; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_01_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_01_30;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.port25 .biz Domain"; flow:established,to_server; http.host; content:".port25.biz"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036067; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Verizon Wireless Phishing Landing 2018-01-30"; flow:established,to_client; file_data; content:""; within:300; fast_pattern; content:"var bundle|3b|(function(){function a(b){var c=|22 22 3b|for(var d=0,e=b.length|3b|d=55296?b[d]|3a|String.fromCharCode"; distance:0; classtype:social-engineering; sid:2025299; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_02, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_02;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.changeip .biz Domain"; flow:established,to_server; http.host; content:".changeip.biz"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036085; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Wells Fargo Phishing Landing 2018-02-02 M9"; flow:established,to_client; file_data; content:"Wells Fargo - Security Upgrade"; classtype:social-engineering; sid:2025300; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_02, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_02;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.almostmy .com Domain"; dns.query; content:".almostmy.com"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036086; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Wells Fargo Phishing Landing 2018-02-02 M10"; flow:established,to_client; file_data; content:"Wells Fargo Email Verification"; nocase; fast_pattern; content:"input[type=email], input[type=password]"; nocase; distance:0; classtype:social-engineering; sid:2025301; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_02, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_02;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.almostmy .com Domain"; flow:established,to_server; http.host; content:".almostmy.com"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036087; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Download of PDF With Uncompressed Flash Content flowbit set"; flow:established,to_client; content:"stream"; content:"|0a|FWS"; within:5; fast_pattern; pcre:"/stream(\x0D\x0A|\x0A)FWS/"; flowbits:set,ET.flash.pdf; flowbits:noalert; reference:url,www.symantec.com/connect/blogs/analysis-zero-day-exploit-adobe-flash-and-reader; reference:url,blog.zynamics.com/2010/06/09/analyzing-the-currently-exploited-0-day-for-adobe-reader-and-adobe-flash/; classtype:misc-activity; sid:2012906; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_05_31, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.ocry .com Domain"; dns.query; content:".ocry.com"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036088; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible MeltDown PoC Download In Progress"; flow:established,from_server; flowbits:isset,ET.http.binary; file_data; content:"|57 53 41 50 41 51|"; content:"|0F AE F0|"; distance:50; within:53; content:"|0F AE|"; distance:15; within:12; pcre:"/^[\x30-\x3f\x7D]/Rs"; content:"|0F AE F0 0F 31|"; distance:45; within:25; content:"|0F AE F0 0F 31|"; distance:17; within:12; reference:cve,2017-5754; classtype:attempted-admin; sid:2025195; rev:2; metadata:attack_target Client_Endpoint, created_at 2018_01_10, deployment Perimeter, former_category EXPLOIT, malware_family MeltDown_Exploit, performance_impact Low, signature_severity Major, updated_at 2018_02_06;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.ocry .com Domain"; flow:established,to_server; http.host; content:".ocry.com"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036089; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Spectre PoC Download In Progress"; flow:established,from_server; flowbits:isset,ET.http.binary; file_data; content:"|E7 03 00 00|"; content:"|48 0F AE|"; distance:17; within:9; pcre:"/^[\x30-\x3f\x7D]/Rs"; content:"|48 0F AE 3D|"; distance:41; within:10; content:"|48 98|"; distance:64; within:22; content:"|0F 01 F9|"; distance:50; within:9; content:"|0F 01 F9|"; distance:30; within:9; reference:cve,2017-5753; reference:cve,2017-5715; classtype:attempted-admin; sid:2025196; rev:2; metadata:attack_target Client_Endpoint, created_at 2018_01_10, deployment Perimeter, former_category EXPLOIT, malware_family Spectre_Exploit, performance_impact Low, signature_severity Major, updated_at 2018_02_02;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.ourhobby .com Domain"; dns.query; content:".ourhobby.com"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036090; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Banque Populaire Phishing Landing 2018-02-05"; flow:established,to_client; file_data; content:".logo_banque"; nocase; content:",.authentif p.num_carte"; nocase; fast_pattern; content:"<title"; content:"Authentification"; nocase; within:20; classtype:social-engineering; sid:2025306; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_05, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_05;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.ourhobby .com Domain"; flow:established,to_server; http.host; content:".ourhobby.com"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036091; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Paypal Phishing Landing 2018-02-05"; flow:established,to_client; file_data; content:"PayPaI"; nocase; fast_pattern; content:"application-name content=PayPaI>"; nocase; distance:0; classtype:social-engineering; sid:2025307; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_05, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_05;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.dnsfailover .net Domain"; dns.query; content:".dnsfailover.net"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036092; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Generic Antibots Phishing Landing 2018-02-05"; flow:established,to_client; file_data; content:""; within:100; classtype:social-engineering; sid:2025308; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_05, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_05;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.dnsfailover .net Domain"; flow:established,to_server; http.host; content:".dnsfailover.net"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036093; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Facebook Upgrade Payment Phishing Landing 2018-02-05"; flow:established,to_client; file_data; content:"ONE MORE STEP"; content:" any any (msg:"ET INFO DYNAMIC_DNS Query to a *.ygto .com Domain"; dns.query; content:".ygto.com"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036094; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Yahoo Account Verification Phishing Landing 2018-02-05"; flow:established,to_client; file_data; content:" $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.ygto .com Domain"; flow:established,to_server; http.host; content:".ygto.com"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036095; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Google/Adobe Shared Document Phishing Landing 2018-02-05"; flow:established,to_client; file_data; content:" any any (msg:"ET INFO DYNAMIC_DNS Query to a *.gettrials .com Domain"; dns.query; content:".gettrials.com"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036096; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Orange Phishing Landing 2018-02-05 (FR)"; flow:established,to_client; file_data; content:" $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.gettrials .com Domain"; flow:established,to_server; http.host; content:".gettrials.com"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036097; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE [PTsecurity] DorkBot.Downloader CnC Response"; flow:established,to_client; dsize:517; content:"|45 36 27 18|"; depth:4; fast_pattern; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; distance:0; reference:url,www.freebuf.com/articles/terminal/153428.html; reference:url,research.checkpoint.com/dorkbot-an-investigation/; classtype:command-and-control; sid:2025152; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_12_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2018_02_05;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.4dq .com Domain"; dns.query; content:".4dq.com"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036098; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE [PTsecurity] DorkBot.Downloader CnC Beacon"; flow:established,to_server; dsize:170; content:"|45 36 27 18 08 20|"; depth:6; fast_pattern; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; distance:0; reference:url,www.freebuf.com/articles/terminal/153428.html; reference:url,research.checkpoint.com/dorkbot-an-investigation/; classtype:command-and-control; sid:2025153; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_12_15, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2018_02_05, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.4dq .com Domain"; flow:established,to_server; http.host; content:".4dq.com"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036099; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Spectre Kernel Memory Leakage JavaScript (POC Based)"; flow:established,from_server; file_data; content:" any any (msg:"ET INFO DYNAMIC_DNS Query to a *.4pu .com Domain"; dns.query; content:".4pu.com"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036100; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Spectre Kernel Memory Leakage JavaScript"; flow:established,from_server; file_data; content:"[^\s]+)\s*=[^\x5b]+?\x5b\s*(?P=var)\s*?\|\s*?0\s*?\]\s*?\x3b\s*?/Rsi"; content:"^="; distance:0; pcre:"/^\s*[^\s]+\x5b\s*?[^\x5d\x7c]+\x7c\s*?0\s*?\x5d\s*?\x7c\s*?0\s*?\x3b/Rsi"; reference:cve,2017-5753; reference:cve,2017-5715; reference:url,github.com/cgvwzq/spectre; classtype:attempted-user; sid:2025185; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_01_04, deployment Perimeter, former_category WEB_CLIENT, performance_impact Low, signature_severity Major, updated_at 2018_02_06;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.4pu .com Domain"; flow:established,to_server; http.host; content:".4pu.com"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036101; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Office 365 Phishing Landing 2018-02-06"; flow:established,to_client; file_data; content:"content=|22|Connecting to PDSA"; nocase; within:600; content:"Sign In"; nocase; distance:0; content:"function LoginErrors(){this.userNameFormatError"; nocase; distance:0; fast_pattern; classtype:social-engineering; sid:2025316; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_06, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_06;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.dsmtp .com Domain"; dns.query; content:".dsmtp.com"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036102; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY [Fidelis] Abnormal x509v3 SubjectKeyIdentifier extension"; flow:established,from_server; dsize:>768; content:"|16 03|"; depth:2; content:"|06 03 55 1d 0e 04|"; offset:336; pcre:"/^.\x04[^\x08\x10\x14\x20\x30\x40]/R"; threshold: type limit, track by_src, seconds 30, count 1; reference:url,www.fidelissecurity.com/threatgeek/2018/02/exposing-x509-vulnerabilities; classtype:misc-attack; sid:2025319; rev:2; metadata:attack_target Client_Endpoint, created_at 2018_02_06, deployment Perimeter, former_category POLICY, signature_severity Major, updated_at 2018_02_07;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.dsmtp .com Domain"; flow:established,to_server; http.host; content:".dsmtp.com"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036103; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY [Fidelis] Abnormal Very Long x509v3 SubjectKeyIdentifier Extension"; flow:established,from_server; dsize:>768; content:"|16 03|"; depth:2; content:"|06 03 55 1d 0e 04|"; offset:336; pcre:"/^[\x80-\xff]/R"; threshold: type limit, track by_src, seconds 30, count 1; reference:url,www.fidelissecurity.com/threatgeek/2018/02/exposing-x509-vulnerabilities; classtype:misc-attack; sid:2025320; rev:2; metadata:attack_target Client_Endpoint, created_at 2018_02_06, deployment Perimeter, former_category POLICY, signature_severity Major, updated_at 2018_02_07;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.dsmtp .com Domain"; dns.query; content:".dsmtp.com"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036104; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Google Drive Phishing Landing 2018-02-07"; flow:established,to_client; file_data; content:"Google|20 7c 20|Drive , Safe"; nocase; fast_pattern; content:"your email provider"; nocase; distance:0; classtype:social-engineering; sid:2025322; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_07, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_07;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.dsmtp .com Domain"; flow:established,to_server; http.host; content:".dsmtp.com"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036105; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Dropbox Business Phishing Landing 2018-02-07"; flow:established,to_client; file_data; content:"<title>DropBox Buisness"; nocase; classtype:social-engineering; sid:2025323; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_07, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_07;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.mynumber .org Domain"; dns.query; content:".mynumber.org"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036106; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Apple Phishing Landing 2018-02-07"; flow:established,to_client; file_data; content:"Apple - Login"; nocase; content:"href=|22|incorrect_files/"; nocase; distance:0; classtype:social-engineering; sid:2025324; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_07, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_07;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.mynumber .org Domain"; flow:established,to_server; http.host; content:".mynumber.org"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036107; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Mailbox Verification Phishing Landing 2018-01-31"; flow:established,to_client; file_data; content:"<title"; nocase; content:"Mail Verification"; nocase; within:50; fast_pattern; content:"your mailbox"; nocase; distance:0; content:"email password"; nocase; distance:0; content:"All rights reserved"; nocase; distance:0; classtype:social-engineering; sid:2025278; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_01_31, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_01_31;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.rebatesrule .net Domain"; dns.query; content:".rebatesrule.net"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036108; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Mailbox Upgrade Phishing Landing 2018-02-05"; flow:established,to_client; file_data; content:"<title"; nocase; content:"Mail Settings|20 7c 20|Email"; nocase; within:40; fast_pattern; classtype:social-engineering; sid:2025310; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_05, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_05;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.rebatesrule .net Domain"; flow:established,to_server; http.host; content:".rebatesrule.net"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036109; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Dropbox Business Phishing Landing 2018-02-07"; flow:established,to_client; file_data; content:"background-color|3a 20|#ffffff|3b|border|3a 20|1px solid #d0d4d9|3b|box-shadow|3a 20|4px 4px 4px #d0d4d9|3b|"; nocase; content:"id=|22|wk|22 20|name=|22|wk|22 20|method=|22|post|22|"; nocase; distance:0; fast_pattern; content:"Sign In To View"; nocase; distance:0; classtype:social-engineering; sid:2025325; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_07, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_07;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.ezua .com Domain"; dns.query; content:".ezua.com"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036110; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Outlook Web App Phishing Landing 2018-02-07"; flow:established,to_client; file_data; content:"<title>Sign in"; nocase; content:"border|3a 20|1px solid #848484|3b|"; nocase; distance:0; content:"background-color|3a 20|#fff3c0|3b|"; nocase; distance:0; content:"left|3a|389px|3b 20|top|3a|0px|3b 20|width|3a|507px|3b 20|height|3a|474px|3b 20|z-index|3a|0"; nocase; distance:0; content:" $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.ezua .com Domain"; flow:established,to_server; http.host; content:".ezua.com"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036111; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Chase Phishing Landing 2018-02-07"; flow:established,to_client; file_data; content:"Chase Online - Logon"; nocase; fast_pattern; content:"<!--POH-->"; nocase; distance:0; content:"function AllowNoDups()"; nocase; distance:0; classtype:social-engineering; sid:2025328; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_07, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_07;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.sendsmtp .com Domain"; dns.query; content:".sendsmtp.com"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036112; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Mailbox Verification Phishing Landing 2018-02-07"; flow:established,to_client; file_data; content:"<title>Admin|20 7c 20|Upgrade|3b|"; nocase; fast_pattern; classtype:social-engineering; sid:2025329; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_07, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_07;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.sendsmtp .com Domain"; flow:established,to_server; http.host; content:".sendsmtp.com"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036113; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING ASB Bank Phishing Landing 2018-02-09 M2"; flow:established,to_client; file_data; content:"ASB Bank - Log in"; nocase; fast_pattern; content:"<img src=|22|https://online.asb.co.nz/auth/img/logo-asb.png|22 20|alt=|22|ASB Logo|22|"; nocase; distance:0; content:".php|22 20|autocomplete=|22|off|22 20|aria-autocomplete=|22|none|22|>"; nocase; distance:0; classtype:social-engineering; sid:2025336; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_09, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2018_02_09, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.ssmailer .com Domain"; dns.query; content:".ssmailer.com"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036114; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING ASB Bank Phishing Landing 2018-02-09 M1"; flow:established,to_client; file_data; content:"<title>ASB Bank - Log in"; nocase; fast_pattern; content:"<img src=|22|logo-asb.png|22 20|alt=|22|ASB Logo|22|"; nocase; distance:0; content:".php|22 20|id=|22|login|22 20|autocomplete=|22|off|22|"; nocase; distance:0; classtype:social-engineering; sid:2025334; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_09, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2018_02_09, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.ssmailer .com Domain"; flow:established,to_server; http.host; content:".ssmailer.com"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036115; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Wells Fargo Phishing Landing 2018-02-09"; flow:established,to_client; file_data; content:"<title>Wells Fargo Online"; nocase; fast_pattern; content:"View Your Accounts"; nocase; distance:0; content:"placeholder=|22|Personal ID"; nocase; distance:0; content:"Connection Secured"; nocase; distance:0; classtype:social-engineering; sid:2025337; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_09, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_09;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.trickip .net Domain"; dns.query; content:".trickip.net"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036116; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING LinkedIn Phishing Landing 2018-02-09 M1"; flow:established,to_client; file_data; content:" $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.trickip .net Domain"; flow:established,to_server; http.host; content:".trickip.net"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036117; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Facebook Phishing Landing 2018-02-09"; flow:established,to_client; file_data; content:"Facebook"; nocase; fast_pattern; content:"We didn't recognize your email address or phone number"; nocase; distance:0; content:"theForm.pass.value.length"; nocase; distance:0; classtype:social-engineering; sid:2025339; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_09, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_09;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.trickip .org Domain"; dns.query; content:".trickip.org"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036118; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Mailbox Revalidation Phishing Landing 2018-02-09"; flow:established,to_client; file_data; content:"Re-Validate Your Mailbox"; nocase; fast_pattern; classtype:social-engineering; sid:2025340; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_09, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_09;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.trickip .org Domain"; flow:established,to_server; http.host; content:".trickip.org"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036119; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Facebook Phishing Landing 2018-02-12"; flow:established,to_client; file_data; content:"hackgallo10k.png"; within:500; nocase; fast_pattern; content:"Facebook application"; nocase; distance:0; classtype:social-engineering; sid:2025341; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_11, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_11;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.dnsrd .com Domain"; dns.query; content:".dnsrd.com"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036120; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING OneDrive Phishing Landing 2018-02-12"; flow:established,to_client; file_data; content:" $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.dnsrd .com Domain"; flow:established,to_server; http.host; content:".dnsrd.com"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036121; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Wells Fargo Phishing Landing 2018-02-12"; flow:established,to_client; file_data; content:" any any (msg:"ET INFO DYNAMIC_DNS Query to a *.lflinkup .com Domain"; dns.query; content:".lflinkup.com"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036122; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Facebook Phishing Landing 2018-02-13 M1"; flow:established,to_client; file_data; content:" $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.lflinkup .com Domain"; flow:established,to_server; http.host; content:".lflinkup.com"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036123; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Facebook Phishing Landing 2018-02-13 M2"; flow:established,to_client; file_data; content:" any any (msg:"ET INFO DYNAMIC_DNS Query to a *.lflinkup .net Domain"; dns.query; content:".lflinkup.net"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036124; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Dropbox/OneDrive Phishing Landing 2018-02-07"; flow:established,to_client; file_data; content:" $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.lflinkup .net Domain"; flow:established,to_server; http.host; content:".lflinkup.net"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036125; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING LinkedIn Phishing Landing 2018-02-13"; flow:established,to_client; file_data; content:"Business|20 7c 20|LinkedIn"; nocase; fast_pattern; content:"<title>Sign Up"; nocase; distance:0; classtype:social-engineering; sid:2025349; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_13, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_13;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.lflinkup .org Domain"; dns.query; content:".lflinkup.org"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036126; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Wells Fargo Phishing Landing 2018-02-13"; flow:established,to_client; file_data; content:" $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.lflinkup .org Domain"; flow:established,to_server; http.host; content:".lflinkup.org"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036127; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Capital One Phishing Landing 2018-02-13 M2"; flow:established,to_client; file_data; content:""; nocase; distance:0; classtype:social-engineering; sid:2025352; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_13, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_13;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.lflink .com Domain"; dns.query; content:".lflink.com"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036128; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Capital One Phishing Landing 2018-02-13 M1"; flow:established,to_client; file_data; content:"ng-app=|22|signInControllerApp|22|"; nocase; within:100; content:"Sign In"; nocase; distance:0; content:"href=|22|index_fichiers/favicon.ico"; nocase; distance:0; content:"usabilla_live_button_container"; nocase; distance:0; fast_pattern; classtype:social-engineering; sid:2025350; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_13, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_13;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.lflink .com Domain"; flow:established,to_server; http.host; content:".lflink.com"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036129; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic Email Validation Phishing Landing 2018-02-13"; flow:established,to_client; file_data; content:"function validateForm()"; nocase; content:"email.match(/fuck"; nocase; distance:0; content:"email.match(/asshole"; nocase; distance:0; content:"email.match(/dickhead"; nocase; distance:0; fast_pattern; classtype:social-engineering; sid:2025353; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_13, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_13;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.b0tnet .com Domain"; dns.query; content:".b0tnet.com"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036130; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Dropbox Phishing Landing 2018-02-14"; flow:established,to_client; file_data; content:".hny-htirfw"; nocase; fast_pattern; within:100; content:"class=|22|psw_error"; nocase; distance:0; classtype:social-engineering; sid:2025355; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_14, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_14;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.b0tnet .com Domain"; flow:established,to_server; http.host; content:".b0tnet.com"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036131; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Linkedin Phishing Landing 2018-02-14"; flow:established,to_client; file_data; content:"Business|20 7c 20|LinkedIn"; nocase; content:"function MM_validateForm()"; nocase; distance:0; content:"#a11y-content"; nocase; distance:0; classtype:social-engineering; sid:2025356; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_14, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_14;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to a *.changeip .net Domain"; dns.query; content:".changeip.net"; fast_pattern; nocase; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036132; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Facebook Phishing Landing 2018-02-14"; flow:established,to_client; file_data; content:"Account Recovery Information"; nocase; fast_pattern; content:"Account Recovery Information"; nocase; distance:0; content:"facebook account has been disabled"; nocase; distance:0; classtype:social-engineering; sid:2025357; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_14, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_02_14;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.changeip .net Domain"; flow:established,to_server; http.host; content:".changeip.net"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036133; rev:1; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Cloned Website Phishing Landing - Saved Website Comment Observed"; flow:established,to_client; file_data; content:""; nocase; distance:0; fast_pattern; content:""; nocase; fast_pattern; content:"name=|22 41 6e 6f 6e 69 73 6d 61 22|"; nocase; distance:0; content:"class=|22 41 6e 6f 6e 69 73 6d 61|"; nocase; distance:0; classtype:social-engineering; sid:2025572; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_05_09, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_05_09;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO File Retrieved from File Sharing Site (cloudme .com)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/v1/ws2/|3a|"; startswith; fast_pattern; http.header_names; content:!"Referer|0d 0a|"; content:"|0d 0a|Sec-Fetch-Site|0d 0a|Sec-Fetch-Mode|0d 0a|Sec-Fetch-User|0d 0a|Sec-Fetch-Dest|0d 0a|Accept-Encoding|0d 0a|"; classtype:bad-unknown; sid:2036424; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_04_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_04_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Paypal Phishing Landing 2018-05-09"; flow:established,to_client; file_data; content:"class=|22 61 2d 6e 2d 6f 2d 6e 2d 69 2d 73 2d 6d 2d 61 22|"; nocase; fast_pattern; content:"id=|22 62 6f 74 64 6b 68 6f 6c 22|"; nocase; distance:0; classtype:social-engineering; sid:2025573; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_05_09, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_05_09;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Splashtop Domain in DNS Lookup (splashtop .eu)"; dns.query; dotprefix; content:".splashtop.eu"; endswith; fast_pattern; reference:url,support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services-; classtype:misc-activity; sid:2035764; rev:2; metadata:attack_target Client_and_Server, created_at 2022_04_05, deployment Perimeter, former_category INFO, performance_impact Low, signature_severity Informational, updated_at 2022_05_02;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Chalbhai (Multibrand) Phishing Landing 2018-05-10"; flow:established,to_client; file_data; content:"function unhideBody()"; nocase; fast_pattern; content:"bodyElems"; distance:0; pcre:"/^\s*=\s*document\s*\.\s*getElementsByTagName\s*\(\s*[\x22\x27]body[\x22\x27]/Ri"; content:"bodyElems[0]"; distance:0; pcre:"/^\s*\.\s*style\s*\.\s*visibility\s*=\s*[\x22\x27]visible[\x22\x27]/Ri"; content:"style=|22|visibility:hidden|22 20|onload=|22|unhideBody()|22|"; nocase; distance:0; content:"
 any any (msg:"ET INFO ET INFO URL Shortening Service Domain in DNS Lookup (s59 .site)"; dns.query; content:"s59.site"; fast_pattern; classtype:bad-unknown; sid:2035870; rev:3; metadata:attack_target Client_Endpoint, created_at 2022_04_07, deployment Perimeter, former_category INFO, performance_impact Low, signature_severity Informational, updated_at 2022_05_02;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT PDF With Embedded U3D"; flow:established,to_client; content:"obj"; content:"<<"; within:4; content:"/U3D"; within:64; reference:url,www.adobe.com/support/security/advisories/apsa11-04.html; reference:cve,2018-4989; reference:cve,2018-4987; classtype:bad-unknown; sid:2013995; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_12_08, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, tag Web_Client_Attacks, updated_at 2018_05_16;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)"; dns.query; dotprefix; content:"discordapp.com"; endswith; reference:md5,03f93498e1006ffa3a1f9fcb6170525a; classtype:misc-activity; sid:2035466; rev:2; metadata:created_at 2022_03_15, updated_at 2022_05_02;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Javascript obfuscation using app.setTimeOut in PDF in Order to Run Code"; flow:established,to_client; content:"PDF-"; depth:300; content:"app.setTimeOut("; nocase; distance:0; reference:url,www.h-online.com/security/features/CSI-Internet-PDF-timebomb-1038864.html?page=4; reference:url,www.vicheck.ca/md5query.php?hash=6932d141916cd95e3acaa3952c7596e4; reference:cve,2018-4980; reference:cve,2018-4961; classtype:bad-unknown; sid:2011868; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_10_29, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, tag Web_Client_Attacks, updated_at 2018_05_16;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Observed Discord Domain in DNS Lookup (discord .com)"; dns.query; dotprefix; content:"discord.com"; endswith; reference:md5,03f93498e1006ffa3a1f9fcb6170525a; classtype:misc-activity; sid:2035465; rev:2; metadata:created_at 2022_03_15, updated_at 2022_05_02;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; within:30; content:"|55 04 0a|"; distance:0; content:"|0f|Global Security"; distance:1; within:16; fast_pattern; content:"|55 04 0b|"; distance:0; content:"|0d|IT Department"; distance:1; within:14; content:"|55 04 03|"; distance:0; content:"|0b|example."; distance:1; within:9; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021013; rev:7; metadata:attack_target Client_and_Server, created_at 2015_04_27, deployment Perimeter, deprecation_reason False_Positive, former_category MALWARE, malware_family TrickBot, malware_family Dridex, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2018_05_17, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Splashtop Domain in DNS Lookup (splashtop .com)"; dns.query; dotprefix; content:".splashtop.com"; endswith; fast_pattern; reference:url,support-splashtopbusiness.splashtop.com/hc/en-us/articles/115001811966-What-are-the-Firewall-Exceptions-and-IP-addresses-of-Splashtop-servers-Services-; classtype:misc-activity; sid:2035762; rev:2; metadata:attack_target Client_and_Server, created_at 2022_04_05, deployment Perimeter, former_category INFO, performance_impact Low, signature_severity Informational, updated_at 2022_05_02;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Vibem.C CnC Activity"; flow:established,to_server; content:"|63 76 c4 52 99 1d 04 80 a9 1b 2d|"; depth:11; content:!"|00|"; reference:md5,bef6faabe3d80037c18fa7b806f4488e; classtype:command-and-control; sid:2025581; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_05_18, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2018_05_18;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.4nmn .com Domain"; flow:established,to_server; http.host; content:".4nmn.com"; endswith; reference:url,alviy.com/redirect/4nmn.com; classtype:bad-unknown; sid:2036469; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_05_05, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_05_05;)
 
-alert dns $HOME_NET any -> any any (msg:"ET POLICY DNS Query For Browser Cryptocurrency Mining Domain"; content:"|06|static|0a|reasedoper|02|pw|00|"; fast_pattern; nocase; reference:url,www.welivesecurity.com/2017/09/14/cryptocurrency-web-mining-union-profit/; classtype:trojan-activity; sid:2024779; rev:5; metadata:affected_product Web_Browsers, created_at 2017_09_27, former_category POLICY, malware_family CoinMiner, updated_at 2018_05_23;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to 4nmn .com Domain"; dns.query; dotprefix; content:".4nmn.com"; nocase; endswith; reference:url,alviy.com/redirect/4nmn.com; classtype:misc-activity; sid:2036470; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_05_05, deployment Perimeter, signature_severity Informational, updated_at 2022_05_05;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Malicious Chrome Extension Click Fraud Activity via Websocket"; flow:established,to_client; content:"|7b 22|id|22 3a|"; within:10; content:"|2c 22|data|22 3a 7b 22|method|22 3a 22|GET|22 2c 22|url|22 3a 22|"; distance:0; content:"|22 2c 22|headers|22 3a 7b 22|"; distance:0; content:"|2c 22|timeout|22 3a|30000|2c 22|body|22 3a 22|"; distance:0; fast_pattern; threshold: type both, track by_dst, count 1, seconds 120; reference:url,www.icebrg.io/index.php?p=blog/malicious-chrome-extensions-enable-criminals-to-impact-over-half-a-million-users-and-global-businesses; reference:url,www.icebrg.io/blog/more-extensions-more-money-more-problems; classtype:trojan-activity; sid:2025221; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2018_01_18, deployment Perimeter, former_category TROJAN, performance_impact Moderate, signature_severity Major, updated_at 2018_06_11;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Trend Micro Phishing Simulation Service"; flow:established,to_client; http.stat_code; content:"200"; file.data; content:"You could have been phished"; nocase; content:"Trend Micro Phish Insight provides a phishing simulation service"; nocase; fast_pattern; threshold:type limit, count 1, seconds 600, track by_src; classtype:social-engineering; sid:2036506; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_05_06, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_05_06;)
 
-alert tcp-pkt $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Cryptocurrency Miner Checkin"; flow:established,to_server; content:"|7b 22|id|22 3a|"; nocase; depth:6; content:"|22|jsonrpc|22 3a|"; nocase; distance:0; content:"|22 2c 22|method|22 3a 22|login|22 2c 22|params|22 3a|"; fast_pattern; content:"|22|pass|22 3a 22|"; nocase; content:"|22|agent|22 3a 22|"; nocase; content:!"<title"; nocase; content:!"<script"; nocase; content:!"<html"; nocase; classtype:policy-violation; sid:2024792; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_10_02, deployment Perimeter, former_category POLICY, signature_severity Minor, updated_at 2018_06_15;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO External IP Lookup Domain Domain in DNS Lookup (ipbase .com)"; dns.query; content:"ipbase.com"; nocase; bsize:10; classtype:bad-unknown; sid:2036560; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_05_11, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_05_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET !80 (msg:"ET DELETED Job314/Neutrino Reboot EK Flash Exploit Nov 20 2014"; flow:established,to_server; content:"x-flash-version|3a|"; fast_pattern:only; http_header; pcre:"/^\/(?:[a-z]+\.(?![Ss][Ww][Ff])[a-z]+\d?\?(?:[a-z]+\x3d(?:[a-z]+|[0-9]+)&){2,}[a-z]+=(?:[a-z]+|[0-9]+)|(?:[a-z]+\x2f(?:[a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f(?:[a-z]+|[0-9]+)\x2f?)$/U"; pcre:"/^Referer\x3a[^\r\n]+\x3a\d+\/(?:[a-z]+\.(?![Ss][Ww][Ff])[a-z]+\d?\?(?:[a-z]+\x3d(?:[a-z]+|[0-9]+)&){2,3}|(?:[a-z]+\x2f(?:[a-z]+|[0-9]+)\x2f){3})/Hm"; classtype:exploit-kit; sid:2019763; rev:9; metadata:created_at 2014_11_21, former_category CURRENT_EVENTS, updated_at 2020_08_20;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed External IP Lookup Domain (ipbase .com in TLS SNI)"; flow:established,to_server; tls.sni; content:"ipbase.com"; bsize:10; fast_pattern; classtype:bad-unknown; sid:2036561; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_05_11, deployment Perimeter, signature_severity Major, updated_at 2022_05_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Neutrino EK Posting Plugin-Detect Data May 15 2013"; flow:established,to_server; content:"POST"; nocase; http_method; pcre:"/^\/[a-z][a-z0-9]+$/U"; content:"XMLHttpRequest"; nocase; http_header; fast_pattern:only; pcre:"/^Referer\x3a[^\r\n]+[?&][a-z]+=\d+\r$/Hmi"; content:"=%25"; http_client_body; pcre:"/=%25[0-9A-F]{2}%25[0-9A-F]{2}/P"; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2016853; rev:16; metadata:created_at 2013_05_16, former_category CURRENT_EVENTS, updated_at 2020_08_20;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO External File Sharing Service Domain (api .anonfile .com in TLS SNI)"; flow:established,to_server; tls.sni; content:"api.anonfile.com"; bsize:16; fast_pattern; classtype:bad-unknown; sid:2036562; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_05_11, deployment Perimeter, former_category INFO, signature_severity Major, updated_at 2022_05_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Neutrino EK Landing Landing URI Struct (fb set)"; flow:to_server,established; content:!"Cookie|3a|"; content:"Windows NT"; http_header; fast_pattern:only; content:"User-Agent|3a 20|Mozilla"; content:"GET"; http_method; pcre:"/^User-agent\x3a\x20[^\r\n]*?(?:MSIE|rv\x3a11|Edge\/)/Hmi"; pcre:"/^\/(?:[a-z]{3,20}\/(?:(?=[a-z\d+]*?[A-Z])(?=[A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/(?:[a-z]{3,20}-)+[a-z]{3,20}|(?:[a-z]{3,20}-)+\d+|(?:[a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/(?:[a-z]{3,20}\/)+(?:[a-z]{3,20}-)+[a-z]{3,20}\.html)$/U"; content:!"Cookie|3a|"; flowbits:set,Neutrino.URI.Primer; flowbits:noalert; classtype:exploit-kit; sid:2025064; rev:6; metadata:attack_target Client_Endpoint, created_at 2016_06_24, deployment Perimeter, former_category CURRENT_EVENTS, performance_impact Moderate, signature_severity Major, tag Neutrino, updated_at 2020_08_20;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO External File Sharing Domain in DNS Lookup (anonfile .com)"; dns.query; dotprefix; content:".anonfile.com"; nocase; endswith; classtype:bad-unknown; sid:2036563; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_05_11, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_05_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Angler EK Landing Nov 18 2013"; flow:established,from_server; file_data; content:"<title>"; content:"soft apple."; fast_pattern; distance:0; content:""; distance:0; content:"AgControl.AgControl"; nocase; content:"Math.floor"; nocase; classtype:exploit-kit; sid:2017729; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_11_20, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Angler, signature_severity Critical, tag Angler, tag Exploit_Kit, updated_at 2020_08_20;)
+alert tcp $EXTERNAL_NET any -> [$HOME_NET,$HTTP_SERVERS] 4369 (msg:"ET INFO External Host Querying Erlang Port Mapper Daemon"; flow:established,to_server; dsize:3; content:"|00 01 6e|"; fast_pattern; classtype:misc-activity; sid:2036651; rev:1; metadata:created_at 2022_05_23, updated_at 2022_05_23;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Angler EK Oct 22 2014"; flow:established,from_server; content:"Expires|3a| Sat, 26 Jul"; http_header; content:"Last-Modified|3a| Sat, 26 Jul 2040 05|3a|00"; http_header; fast_pattern:15,20; classtype:exploit-kit; sid:2019488; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_10_22, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Angler, signature_severity Critical, tag Angler, tag Exploit_Kit, updated_at 2020_08_20;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed Anonymous File Sharing Service (fromsmash .com in TLS SNI)"; flow:established,to_server; tls.sni; content:"fromsmash.com"; bsize:13; fast_pattern; classtype:bad-unknown; sid:2036665; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_05_24, deployment Perimeter, former_category INFO, signature_severity Major, updated_at 2022_05_24;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Ecessa WANWorx WVR-30 Cross-Site Request Forgery"; flow:from_server,established; file_data; content:"method"; nocase; content:"POST"; content:"user_username"; content:"user_passwd"; content:"checked"; content:"savecrtcfg"; fast_pattern; classtype:web-application-attack; sid:2025737; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_06_25, deployment Perimeter, former_category EXPLOIT, signature_severity Major, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Anonymous File Sharing Domain in DNS Lookup (fromsmash .com)"; dns.query; content:"fromsmash.com"; nocase; bsize:13; classtype:bad-unknown; sid:2036666; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_05_24, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_05_24;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Intex Router N-150 Cross-Site Request Forgery"; flow:from_server,established; file_data; content:"method"; nocase; content:"POST"; content:"PPW"; content:"submit"; content:"SSID"; content:"isp"; content:"WAN"; content:"wirelesspassword"; fast_pattern; content:"name"; content:"value"; classtype:web-application-attack; sid:2025739; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_06_25, deployment Perimeter, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Possible JARM Fingerprinting Client Hello via tls1_2_forward"; flow:established,to_client; tls.version:1.2; content:"|00 16 00 33 00 67 c0 9e c0 a2 00 9e 00 39 00 6b c0 9f c0 a3 00 9f 00 45 00 be 00 88 00 c4 00 9a c0 08 c0 09 c0 23 c0 ac c0 ae c0 2b c0 0a c0 24 c0 ad c0 af c0 2c c0 72 c0 73 cc a9 13 02 13 01 cc 14 c0 07 c0 12 c0 13 c0 27 c0 2f c0 14 c0 28 c0 30 c0 60 c0 61 c0 76 c0 77 cc a8 13 05 13 04 13 03 cc 13 c0 11 00 0a 00 2f 00 3c c0 9c c0 a0 00 9c 00 35 00 3d c0 9d c0 a1 00 9d 00 41 00 ba 00 84 00 c0 00 07 00 04 00 05|"; fast_pattern; content:"|02|hq|03|h2c|02|h2|06|spdy/3|06|spdy/2|06|spdy/1|08|http/1.1|08|http/1.0|08|http/0.9"; content:"|03 03 03 02 03 01|"; endswith; reference:url,engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a; classtype:misc-activity; sid:2036690; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_05_25, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_05_25;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING [eSentire] Wells Fargo Phishing Landing 2018-06-20"; flow:established,to_client; file_data; content:"Wells Fargo |3a| Banking|2c|"; nocase; fast_pattern; content:"content=|22|WELLS FARGO BANK|22|"; nocase; distance:0; classtype:social-engineering; sid:2025624; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_06_25, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_06_25;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Possible JARM Fingerprinting Client Hello via tls1_2_reverse"; flow:established,to_client; content:"|16 03 03|"; startswith; content:"|00 05 00 04 00 07 00 c0 00 84 00 ba 00 41 00 9d c0 a1 c0 9d 00 3d 00 35 00 9c c0 a0 c0 9c 00 3c 00 2f 00 0a c0 11 cc 13 13 03 13 04 13 05 cc a8 c0 77 c0 76 c0 61 c0 60 c0 30 c0 28 c0 14 c0 2f c0 27 c0 13 c0 12 c0 07 cc 14 13 01 13 02 cc a9 c0 73 c0 72 c0 2c c0 af c0 ad c0 24 c0 0a c0 2b c0 ae c0 ac c0 23 c0 09 c0 08 00 9a 00 c4 00 88 00 be 00 45 00 9f c0 a3 c0 9f 00 6b 00 39 00 9e c0 a2 c0 9e 00 67 00 33 00 16|"; fast_pattern; content:"|08|http/0.9|08|http/1.0|08|http/1.1|06|spdy/1|06|spdy/2|06|spdy/3|02|h2|03|h2c|02|hq"; content:"|03 01 03 02 03 03|"; endswith; reference:url,engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a; classtype:misc-activity; sid:2036691; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_05_25, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_05_25;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING [eSentire] OneDrive Phishing Landing 2018-06-15"; flow:established,to_client; file_data; content:"<title>One Drive Cloud Document Sharing"; nocase; fast_pattern; content:"Select with email provider below"; nocase; distance:0; content:"Login with Office 365"; nocase; distance:0; classtype:social-engineering; sid:2025625; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_06_25, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2018_06_25, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Possible JARM Fingerprinting Client Hello via tls1_2_top_half"; flow:established,to_client; tls.version:1.2; content:"|c0 12 c0 07 cc 14 13 01 13 02 cc a9 c0 73 c0 72 c0 2c c0 af c0 ad c0 24 c0 0a c0 2b c0 ae c0 ac c0 23 c0 09 c0 08 00 9a 00 c4 00 88 00 be 00 45 00 9f c0 a3 c0 9f 00 6b 00 39 00 9e c0 a2 c0 9e 00 67 00 33 00 16|"; fast_pattern; content:"|08|http/0.9|08|http/1.0|08|http/1.1|06|spdy/1|06|spdy/2|06|spdy/3|02|h2|03|h2c|02|hq"; reference:url,engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a; classtype:misc-activity; sid:2036692; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_05_25, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_05_25;)
 
-alert udp any 67 -> any 68 (msg:"ET EXPLOIT DynoRoot DHCP - Client Command Injection"; content:"|02|"; depth:1; content:"|35 01 05 fc|"; distance:0; content:"|2f|bin|2f|sh"; fast_pattern; distance:0; reference:url,exploit-db.com/exploits/44652/; reference:cve,2018-1111; classtype:attempted-admin; sid:2025765; rev:2; metadata:attack_target Networking_Equipment, created_at 2018_06_29, deployment Datacenter, former_category EXPLOIT, performance_impact Low, signature_severity Critical, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Possible JARM Fingerprinting Client Hello via tls1_2_bottom_half"; flow:established,to_client; tls.version:1.2; content:"|c0 13 c0 27 c0 2f c0 14 c0 28 c0 30 c0 60 c0 61 c0 76 c0 77 cc a8 13 05 13 04 13 03 cc 13 c0 11 00 0a 00 2f 00 3c c0 9c c0 a0 00 9c 00 35 00 3d c0 9d c0 a1 00 9d 00 41 00 ba 00 84 00 c0 00 07 00 04 00 05|"; fast_pattern; content:"|08|http/0.9|08|http/1.0|06|spdy/1|06|spdy/2|06|spdy/3|03|h2c|02|hq"; reference:url,engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a; classtype:misc-activity; sid:2036693; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_05_25, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_05_25;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET 8888 (msg:"ET EXPLOIT CloudMe Sync Buffer Overflow"; flow:established,to_server; content:"|fe e7 d1 61 a8 98 03 69 10 06 e7 6f 6f 0a c4 61 5a ea c8 68 e1 52 d6 68 a2 7c fa 68 ff fd ff ff|"; fast_pattern; distance:0; content:"|92 70 b4 6e 47 27 d5 68 ff ff ff ff bc 48 f9 68|"; distance:0; content:"|3c 06 f8 68 72 a4 f9 68 c0 ff ff ff 92 70 b4 6e|"; distance:0; content:"|ab 57 f0 61 a3 ef b5 6e  d1 14 dc 61 0c ed b4 64 45 62 ba 61|"; distance:0; content:"|90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90|"; distance:0; reference:url,exploit-db.com/exploits/44784/; reference:cve,2018-6892; classtype:attempted-admin; sid:2025766; rev:2; metadata:attack_target Server, created_at 2018_06_29, cve CVE_2018_6892, deployment Perimeter, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Possible JARM Fingerprinting Client Hello via tls1_2_middle_out"; flow:established,to_client; tls.version:1.2; content:"|c0 12 c0 13 c0 07 c0 27 cc 14 c0 2f 13 01 c0 14 13 02 c0 28 cc a9 c0 30 c0 73 c0 60 c0 72 c0 61 c0 2c c0 76 c0 af c0 77 c0 ad cc a8 c0 24 13 05 c0 0a 13 04 c0 2b 13 03 c0 ae cc 13 c0 ac c0 11 c0 23 00 0a c0 09 00 2f c0 08 00 3c 00 9a c0 9c 00 c4 c0 a0 00 88 00 9c 00 be 00 35 00 45 00 3d 00 9f c0 9d c0 a3 c0 a1 c0 9f 00 9d 00 6b 00 41 00 39 00 ba 00 9e 00 84 c0 a2 00 c0 c0 9e 00 07 00 67 00 04 00 33 00 05 00 16|"; fast_pattern; content:"|02|hq|03|h2c|06|spdy/3|06|spdy/2|06|spdy/1|08|http/1.0|08|http/0.9"; reference:url,engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a; classtype:misc-activity; sid:2036694; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_05_25, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_05_25;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS DAMICMS Cross-Site Request Forgery (Add Admin)"; flow:from_server,established; file_data; content:"history.pushState"; content:"/admin.php?s=/Admin/doadd|22| method=|22|POST|22|>"; nocase; fast_pattern; content:"name=|22|username|22|"; content:"name=|22|password|22|"; reference:url,exploit-db.com/exploits/44960/; classtype:web-application-attack; sid:2025771; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_07_02, deployment Perimeter, former_category WEB_SPECIFIC_APPS, performance_impact Low, signature_severity Major, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Possible JARM Fingerprinting Client Hello via tls1_1_middle_out"; flow:established,to_client; tls.version:1.1; content:"|00 16 00 33 00 67 c0 9e c0 a2 00 9e 00 39 00 6b c0 9f c0 a3 00 9f 00 45 00 be 00 88 00 c4 00 9a c0 08 c0 09 c0 23 c0 ac c0 ae c0 2b c0 0a c0 24 c0 ad c0 af c0 2c c0 72 c0 73 cc a9 13 02 13 01 cc 14 c0 07 c0 12 c0 13 c0 27 c0 2f c0 14 c0 28 c0 30 c0 60 c0 61 c0 76 c0 77 cc a8 13 05 13 04 13 03 cc 13 c0 11 00 0a 00 2f 00 3c c0 9c c0 a0 00 9c 00 35 00 3d c0 9d c0 a1 00 9d 00 41 00 ba 00 84 00 c0 00 07 00 04 00 05|"; fast_pattern; content:"|08|http/0.9|08|http/1.0|08|http/1.1|06|spdy/1|06|spdy/2|06|spdy/3|02|h2|03|h2c|02|hq"; reference:url,engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a; classtype:misc-activity; sid:2036695; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_05_25, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_05_25;)
 
-alert ftp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT FTPShell client Stack Buffer Overflow"; flow:established,from_server; content:"220|20 22|"; isdataat:400,relative; content:!"|00|"; within:400; content:!"|22|"; within:400; content:!"|0b|"; within:400; content:!"|0a|"; within:400; content:!"|0d|"; within:400; content:"|ed 2e 45 22 20|"; fast_pattern; distance:400; reference:url,2018-8733; reference:cve,2018-8734; reference:cve,2018-8735; reference:cve,2018-7573; reference:url,exploit-db.com/exploits/44968/; classtype:attempted-user; sid:2025779; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_07_03, deployment Perimeter, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Possible JARM Fingerprinting Client Hello via tls1_3_forward"; flow:established,to_client; tls.version:1.3; content:"|00 16 00 33 00 67 c0 9e c0 a2 00 9e 00 39 00 6b c0 9f c0 a3 00 9f 00 45 00 be 00 88 00 c4 00 9a c0 08 c0 09 c0 23 c0 ac c0 ae c0 2b c0 0a c0 24 c0 ad c0 af c0 2c c0 72 c0 73 cc a9 13 02 13 01 cc 14 c0 07 c0 12 c0 13 c0 27 c0 2f c0 14 c0 28 c0 30 c0 60 c0 61 c0 76 c0 77 cc a8 13 05 13 04 13 03 cc 13 c0 11 00 0a 00 2f 00 3c c0 9c c0 a0 00 9c 00 35 00 3d c0 9d c0 a1 00 9d 00 41 00 ba 00 84 00 c0 00 07 00 04 00 05|"; fast_pattern; content:"|02|hq|03|h2c|02|h2|06|spdy/3|06|spdy/2|06|spdy/1|08|http/1.1|08|http/1.0|08|http/0.9"; content:"|03 04 03 03 03 02 03 01|"; endswith; reference:url,engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a; classtype:misc-activity; sid:2036696; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_05_25, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_05_25;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible ModSecurity 3.0.0 Cross-Site Scripting"; flow:established,from_server; file_data; content:"onError"; content:"prompt"; fast_pattern; content:"img"; pcre:"/^\s*((?!>).)+?\s*src\s*=\s*[\x22\x27]\s*[^\x27\x28]+?[\x22\x27]\s*onError\s*=\s*prompt\s*\x28\s*[^)]*?(?:document|s(?:cript|tyle\x3D)|on(?:mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))/Rsi"; reference:cve,2018-13065; reference:url,exploit-db.com/exploits/44970/; classtype:attempted-user; sid:2025781; rev:2; metadata:attack_target Client_Endpoint, created_at 2018_07_03, deployment Perimeter, former_category EXPLOIT, performance_impact Moderate, signature_severity Critical, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Possible JARM Fingerprinting Client Hello via tls1_3_reverse"; flow:established,to_client; content:"|16 03 01|"; startswith; content:"|00 05 00 04 00 07 00 c0 00 84 00 ba 00 41 00 9d c0 a1 c0 9d 00 3d 00 35 00 9c c0 a0 c0 9c 00 3c 00 2f 00 0a c0 11 cc 13 13 03 13 04 13 05 cc a8 c0 77 c0 76 c0 61 c0 60 c0 30 c0 28 c0 14 c0 2f c0 27 c0 13 c0 12 c0 07 cc 14 13 01 13 02 cc a9 c0 73 c0 72 c0 2c c0 af c0 ad c0 24 c0 0a c0 2b c0 ae c0 ac c0 23 c0 09 c0 08 00 9a 00 c4 00 88 00 be 00 45 00 9f c0 a3 c0 9f 00 6b 00 39 00 9e c0 a2 c0 9e 00 67 00 33 00 16|"; fast_pattern; content:"|08|http/0.9|08|http/1.0|08|http/1.1|06|spdy/1|06|spdy/2|06|spdy/3|02|h2|03|h2c|02|hq"; content:"|03 01 03 02 03 03 03 04|"; endswith; reference:url,engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a; classtype:misc-activity; sid:2036697; rev:1; metadata:created_at 2022_05_25, updated_at 2022_05_25;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET EXPLOIT Oracle Weblogic Server Deserialization Remote Command Execution"; flow:established,to_server; content:"java.rmi.registry.Registry"; fast_pattern; content:"java.lang.reflect.Proxy"; content:"java.rmi.server.RemoteObjectInvocationHandler"; content:"UnicastRef"; reference:url,exploit-db.com/exploits/44553/; reference:cve,2018-2628; classtype:attempted-user; sid:2025788; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_07_05, deployment Perimeter, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Possible JARM Fingerprinting Client Hello via tls1_3_reverse"; flow:established,to_client; content:"|16 03 01|"; startswith; content:"|00 05 00 04 00 07 00 c0 00 84 00 ba 00 41 00 9d c0 a1 c0 9d 00 3d 00 35 00 9c c0 a0 c0 9c 00 3c 00 2f 00 0a c0 11 cc 13 13 03 13 04 13 05 cc a8 c0 77 c0 76 c0 61 c0 60 c0 30 c0 28 c0 14 c0 2f c0 27 c0 13 c0 12 c0 07 cc 14 13 01 13 02 cc a9 c0 73 c0 72 c0 2c c0 af c0 ad c0 24 c0 0a c0 2b c0 ae c0 ac c0 23 c0 09 c0 08 00 9a 00 c4 00 88 00 be 00 45 00 9f c0 a3 c0 9f 00 6b 00 39 00 9e c0 a2 c0 9e 00 67 00 33 00 16|"; fast_pattern; content:"|08|http/0.9|08|http/1.0|08|http/1.1|06|spdy/1|06|spdy/2|06|spdy/3|02|h2|03|h2c|02|hq"; content:"|03 01 03 02 03 03 03 04|"; endswith; reference:url,engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a; classtype:misc-activity; sid:2036698; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_05_25, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_05_25;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Adobe Acrobat PDF Reader use after free JavaScript engine (CVE-2017-16393)"; flow:established,from_server; flowbits:isset,ET.pdf.in.http; file_data; content:"this.addAnnot"; nocase; content:"this.addField"; nocase; content:".popupRect"; nocase; content:".setAction("; nocase; content:"OnFocus"; nocase; content:"setFocus"; nocase; pcre:"/\s+?(?P<var1>[^\s\x3d]+?)\s*?=\s*?this\.addAnnot.+?(?P=var1)\s*\x2epopupRect\s*?=\s*?0x4000/si"; pcre:"/\s+?(?P<var2>[^\s\x3d]+?)\s*?=\s*?this\.addField.+?(?P=var2)\s*\x2e\s*setAction\s*?\x28\s*?[\x22\x27]\s*?OnFocus[^\x29]+popupOpen\s*?=\s*?true/si"; reference:cve,2017-16393; classtype:attempted-user; sid:2025091; rev:3; metadata:affected_product Adobe_Reader, attack_target Client_Endpoint, created_at 2017_11_14, deployment Perimeter, former_category WEB_CLIENT, performance_impact Low, signature_severity Major, tag Web_Client_Attacks, updated_at 2017_11_29;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Possible JARM Fingerprinting Client Hello via tls1_3_invalid"; flow:established,to_client; content:"|16 03 01|"; startswith; content:"|00 16 00 33 00 67 c0 9e c0 a2 00 9e 00 39 00 6b c0 9f c0 a3 00 9f 00 45 00 be 00 88 00 c4 00 9a c0 08 c0 09 c0 23 c0 ac c0 ae c0 2b c0 0a c0 24 c0 ad c0 af c0 2c c0 72 c0 73 cc a9 cc 14 c0 07 c0 12 c0 13 c0 27 c0 2f c0 14 c0 28 c0 30 c0 60 c0 61 c0 76 c0 77 cc a8 cc 13 c0 11 00 0a 00 2f 00 3c c0 9c c0 a0 00 9c 00 35 00 3d c0 9d c0 a1 00 9d 00 41 00 ba 00 84 00 c0 00 07 00 04 00 05|"; fast_pattern; content:"|08|http/0.9|08|http/1.0|08|http/1.1|06|spdy/1|06|spdy/2|06|spdy/3|02|h2|03|h2c|02|hq"; content:"|03 01 03 02 03 03 03 04|"; endswith; reference:url,engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a; classtype:misc-activity; sid:2036699; rev:1; metadata:created_at 2022_05_25, updated_at 2022_05_25;)
 
-alert smtp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Exim Internet Mailer Remote Code Execution"; flow:established,to_server; content:"JHtydW57L2Jpbi9iYXNoIC1jICIvYmluL2Jhc2ggLWkgPiYgL2Rldi90Y3Av"; reference:cve,2018-6789; reference:url,exploit-db.com/exploits/44571/; classtype:attempted-user; sid:2025793; rev:2; metadata:attack_target SMTP_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Possible JARM Fingerprinting Client Hello via tls1_3_middle_out"; flow:established,to_client; content:"|16 03 01|"; startswith; content:"|c0 12 c0 13 c0 07 c0 27 cc 14 c0 2f 13 01 c0 14 13 02 c0 28 cc a9 c0 30 c0 73 c0 60 c0 72 c0 61 c0 2c c0 76 c0 af c0 77 c0 ad cc a8 c0 24 13 05 c0 0a 13 04 c0 2b 13 03 c0 ae cc 13 c0 ac c0 11 c0 23 00 0a c0 09 00 2f c0 08 00 3c 00 9a c0 9c 00 c4 c0 a0 00 88 00 9c 00 be 00 35 00 45 00 3d 00 9f c0 9d c0 a3 c0 a1 c0 9f 00 9d 00 6b 00 41 00 39 00 ba 00 9e 00 84 c0 a2 00 c0 c0 9e 00 07 00 67 00 04 00 33 00 05 00 16|"; fast_pattern; content:"|02|hq|03|h2c|02|h2|06|spdy/3|06|spdy/2|06|spdy/1|08|http/1.1|08|http/1.0|08|http/0.9"; content:"|03 04 03 03 03 02 03 01|"; endswith; reference:url,engineering.salesforce.com/easily-identify-malicious-servers-on-the-internet-with-jarm-e095edac525a; classtype:misc-activity; sid:2036700; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_05_25, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_05_25;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET 9000 (msg:"ET EXPLOIT xdebug OS Command Execution"; flow:established,to_server; content:"eval -i 1 --|0d 0a|ZmlsZV9wdXRfY29udGVudH"; reference:url,exploit-db.com/exploits/44568/; classtype:attempted-user; sid:2025794; rev:2; metadata:attack_target Web_Server, created_at 2018_07_09, deployment Perimeter, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Bablosoft BAS Related SSL Cert (bablosoft .com)"; flow:established,to_client; tls.cert_subject; content:"CN=bablosoft.com"; bsize:16; fast_pattern; reference:url,team-cymru.com/blog/2022/05/25/bablosoft-lowering-the-barrier-of-entry-for-malicious-actors/; classtype:bad-unknown; sid:2036686; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_05_26, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_05_26;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT bin bash base64 encoded Remote Code Execution 3"; flow:established,to_server; content:"vYmluL2Jhc2"; classtype:attempted-user; sid:2025806; rev:2; metadata:attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Potential External VMware vRealize Automation Authentication Bypass Vulnerability"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/SAAS/auth/login/embeddedauthbroker/callback"; fast_pattern; http.content_type; content:"application/x-www-form-urlencoded"; http.request_body; content:"protected_state"; content:"userstore"; content:"username"; content:"password"; content:"userstoreDisplay"; content:"horizonRelayState"; content:"stickyConnectorId"; content:"action"; reference:url,horizon3.ai/vmware-authentication-bypass-vulnerability-cve-2022-22972-technical-deep-dive/; classtype:attempted-admin; sid:2036725; rev:1; metadata:affected_product VMware, created_at 2022_05_27, former_category INFO, signature_severity Informational, updated_at 2022_05_27;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT php script base64 encoded Remote Code Execution 3"; flow:established,to_server; content:"vKjw/cGhwI"; classtype:attempted-user; sid:2025809; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DNS Query to a *.ngrok domain (ngrok.io)"; dns.query; content:".ngrok.io"; fast_pattern; endswith; nocase; classtype:policy-violation; sid:2022642; rev:6; metadata:created_at 2016_03_23, former_category POLICY, updated_at 2020_09_17;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT php script double base64 encoded Remote Code Execution 3"; flow:established,to_server; content:"MeW84UDNCb2ND"; classtype:attempted-user; sid:2025812; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET INFO Powershell Base64 Decode Command Inbound"; flow:established,from_server; file.data; content:"[System.Text.Encoding]"; nocase; content:"[System.Convert]::FromBase64String"; nocase; fast_pattern; within:100; classtype:misc-activity; sid:2036760; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_02, deployment Perimeter, former_category INFO, signature_severity Minor, updated_at 2022_06_02;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Generic system shell command to php base64 encoded Remote Code Execution 1"; flow:established,to_server; content:"c3lzdGVtKCIgcGhw"; classtype:attempted-user; sid:2025795; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Anonymous File Sharing Domain in DNS Lookup (fromsmash .co)"; dns.query; dotprefix; content:".fromsmash.co"; nocase; endswith; classtype:bad-unknown; sid:2036870; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_06, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_06;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Generic system shell command to php base64 encoded Remote Code Execution 2"; flow:established,to_server; content:"N5c3RlbSgiIHBoc"; classtype:attempted-user; sid:2025796; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Anonymous File Sharing Service in SSL Cert (fromsmash .co)"; flow:established,to_client; tls.cert_subject; content:"CN=fromsmash.co"; bsize:15; fast_pattern; classtype:bad-unknown; sid:2036871; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_06, deployment Perimeter, former_category INFO, signature_severity Informational, tag SSL_Malicious_Cert, updated_at 2022_06_06;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Generic system shell command to php base64 encoded Remote Code Execution 3"; flow:established,to_server; content:"zeXN0ZW0oIiBwaH"; classtype:attempted-user; sid:2025797; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Peer-to-Peer File Sharing Service Domain in DNS Lookup (ipfs .io)"; dns.query; content:"ipfs.io"; nocase; bsize:7; classtype:bad-unknown; sid:2036873; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_06, deployment Perimeter, former_category INFO, signature_severity Major, updated_at 2022_06_06;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Generic system shell command to php base64 encoded Remote Code Execution 4"; flow:established,to_server; content:"c3lzdGVtKCJwaH"; classtype:attempted-user; sid:2025798; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed Peer-to-Peer File Sharing Service Domain (ipfs .io in TLS SNI)"; flow:established,to_server; tls.sni; content:"ipfs.io"; bsize:7; fast_pattern; classtype:bad-unknown; sid:2036874; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_06, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_06;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Generic system shell command to php base64 encoded Remote Code Execution 5"; flow:established,to_server; content:"N5c3RlbSgicGhw"; classtype:attempted-user; sid:2025799; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Out-of-Band Interaction Domain in DNS Lookup (oast .pro)"; dns.query; dotprefix; content:".oast.pro"; nocase; endswith; classtype:bad-unknown; sid:2036890; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_07, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_07;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Generic system shell command to php base64 encoded Remote Code Execution 6"; flow:established,to_server; content:"zeXN0ZW0oInBoc"; classtype:attempted-user; sid:2025800; rev:2; metadata:created_at 2018_07_09, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Out-of-Band Interaction Domain in DNS Lookup (oast .live)"; dns.query; dotprefix; content:".oast.live"; nocase; endswith; classtype:bad-unknown; sid:2036891; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_07, deployment Perimeter, former_category ATTACK_RESPONSE, signature_severity Informational, updated_at 2022_06_07;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT file_put_contents php base64 encoded Remote Code Execution 1"; flow:established,to_server; content:"ZmlsZV9wdXRfY29udGVudH"; classtype:attempted-user; sid:2025801; rev:2; metadata:affected_product Web_Server_Applications, affected_product PHP, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Out-of-Band Interaction  Domain in DNS Lookup (oast .online)"; dns.query; dotprefix; content:".oast.site"; nocase; endswith; classtype:bad-unknown; sid:2036892; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_07, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_07;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT file_put_contents php base64 encoded Remote Code Execution 2"; flow:established,to_server; content:"ZpbGVfcHV0X2NvbnRlbnRz"; classtype:attempted-user; sid:2025802; rev:2; metadata:affected_product Web_Server_Applications, affected_product PHP, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Out-of-Band Interaction Domain in DNS Lookup (oast .fun)"; dns.query; dotprefix; content:".oast.fun"; nocase; endswith; classtype:bad-unknown; sid:2036893; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_07, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_07;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT file_put_contents php base64 encoded Remote Code Execution 3"; flow:established,to_server; content:"maWxlX3B1dF9jb250ZW50c"; classtype:attempted-user; sid:2025803; rev:2; metadata:affected_product Web_Server_Applications, affected_product PHP, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Out-of-Band Interaction Domain in DNS Lookup (oast .me)"; dns.query; dotprefix; content:".oast.me"; nocase; endswith; classtype:bad-unknown; sid:2036894; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_07, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_07;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT bin bash base64 encoded Remote Code Execution 1"; flow:established,to_server; content:"L2Jpbi9iYXNo"; classtype:attempted-user; sid:2025804; rev:2; metadata:attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Out-of-Band Interaction Domain in DNS Lookup (oastify .com)"; dns.query; dotprefix; content:".oastify.com"; nocase; endswith; classtype:bad-unknown; sid:2036895; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_07, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_07;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT bin bash base64 encoded Remote Code Execution 2"; flow:established,to_server; content:"9iaW4vYmFza"; classtype:attempted-user; sid:2025805; rev:2; metadata:attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Out-of-Band Interaction Domain in DNS Lookup (requestbin .net)"; dns.query; content:"requestbin.net"; nocase; bsize:14; classtype:bad-unknown; sid:2036896; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_07, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_07;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT php script base64 encoded Remote Code Execution 1"; flow:established,to_server; content:"Lyo8P3BocC"; classtype:attempted-user; sid:2025807; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Observed DNS Query to DynDNS Domain (linkpc .net)"; dns.query; content:".linkpc.net"; nocase; endswith; content:!"www.linkpc.net"; classtype:bad-unknown; sid:2034458; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2021_11_15, deployment Perimeter, former_category POLICY, performance_impact Low, signature_severity Informational, updated_at 2021_11_15;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT php script base64 encoded Remote Code Execution 2"; flow:established,to_server; content:"8qPD9waHAg"; classtype:attempted-user; sid:2025808; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO MediaFire file download service access"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/?"; http.host; content:"mediafire.com"; reference:url,doc.emergingthreats.net/2009303; classtype:policy-violation; sid:2009303; rev:6; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, deployment SSLDecrypt, former_category POLICY, signature_severity Informational, updated_at 2022_06_09;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT php script double base64 encoded Remote Code Execution 1"; flow:established,to_server; content:"THlvOFAzQm9jQ"; classtype:attempted-user; sid:2025810; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Self-Hosted Git Service Domain in DNS Lookup (gitea .com)"; dns.query; content:"gitea.com"; nocase; bsize:9; classtype:bad-unknown; sid:2036938; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_09, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_09;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT php script double base64 encoded Remote Code Execution 2"; flow:established,to_server; content:"x5bzhQM0JvY0"; classtype:attempted-user; sid:2025811; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed Self-Hosted Git Service Domain (gitea .com in TLS SNI)"; flow:established,to_server; tls.sni; content:"gitea.com"; bsize:9; fast_pattern; classtype:bad-unknown; sid:2036939; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_09, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_09;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT php script double base64 encoded Remote Code Execution 4"; flow:established,to_server; content:"OHFQRDl3YUhBZ"; classtype:attempted-user; sid:2025813; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO External IP Lookup Domain in DNS Lookup (ip .bablosoft .com)"; dns.query; content:"ip"; nocase; content:".bablosoft.com"; distance:1; nocase; pcre:"/^ip[23]?\.bablosoft\.com$/"; threshold:type limit,track by_src,count 1,seconds 60; classtype:bad-unknown; sid:2036685; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_05_26, deployment Perimeter, former_category INFO, performance_impact Low, signature_severity Informational, updated_at 2022_06_09;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT php script double base64 encoded Remote Code Execution 5"; flow:established,to_server; content:"hxUEQ5d2FIQW"; classtype:attempted-user; sid:2025814; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Psiphon VPN Related Activity (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/"; bsize:1; http.header_names; content:"|0d 0a|Content-Length|0d 0a|Content-Type|0d 0a|Cookie|0d 0a|Accept-Encoding|0d 0a 0d 0a|"; fast_pattern; content:!"Referer"; http.content_type; content:"application/octet-stream"; bsize:24; http.cookie; pcre:"/^[A-Z]=[A-Za-z/+0-9=]{200,400}$/"; reference:md5,912e361d280d881980caca25cd0b80d4; classtype:bad-unknown; sid:2037033; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_17, deployment Perimeter, former_category INFO, performance_impact Moderate, signature_severity Informational, updated_at 2022_06_17;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT php script double base64 encoded Remote Code Execution 6"; flow:established,to_server; content:"4cVBEOXdhSEFn"; classtype:attempted-user; sid:2025815; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)"; dns.query; content:"ipwho.is"; nocase; bsize:8; classtype:bad-unknown; sid:2037042; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_21, deployment Perimeter, former_category MALWARE, signature_severity Informational, updated_at 2022_06_21;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT php script double base64 encoded Remote Code Execution 7"; flow:established,to_server; content:"dktqdy9jR2h3S"; classtype:attempted-user; sid:2025816; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Commonly Abused File Sharing Domain in DNS Lookup (ftpupload .net)"; dns.query; content:"ftpupload.net"; nocase; bsize:13; reference:md5,ddc7091a431c36c35adbc0d1ccfbfa3a; classtype:bad-unknown; sid:2037077; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_06_22, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_22;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT php script double base64 encoded Remote Code Execution 8"; flow:established,to_server; content:"ZLancvY0dod0"; classtype:attempted-user; sid:2025817; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharepointin .com)"; dns.query; dotprefix; content:".sharepointin.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037159; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT php script double base64 encoded Remote Code Execution 9"; flow:established,to_server; content:"2S2p3L2NHaHdJ"; classtype:attempted-user; sid:2025818; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_09, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (templatern .com)"; dns.query; dotprefix; content:".templatern.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037160; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT [eSentire] Fake Flash Update 2018-07-09"; flow:established,to_client; file_data; content:"<title>Critical error!"; nocase; fast_pattern; content:"Your player version"; nocase; distance:0; content:"has a critical vulnerability"; nocase; distance:0; content:"FlashPlayer.exe"; nocase; distance:0; classtype:trojan-activity; sid:2025647; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_07_10, deployment Perimeter, former_category CURRENT_EVENTS, performance_impact Moderate, signature_severity Major, updated_at 2018_07_10;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (prizegives .com)"; dns.query; dotprefix; content:".prizegives.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037161; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert udp any any -> $HOME_NET 4070 (msg:"ET EXPLOIT HID VertX and Edge door controllers command_blink_on Remote Command Execution"; content:"command_blink_on|3b|"; fast_pattern; content:"|60|"; within:44; reference:url,exploit-db.com/exploits/44992/; classtype:attempted-user; sid:2025821; rev:2; metadata:attack_target IoT, created_at 2018_07_10, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (shareholds .com)"; dns.query; dotprefix; content:".shareholds.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037162; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert udp any any -> $HOME_NET 4070 (msg:"ET SCAN HID VertX and Edge door controllers discover"; dsize:<45; content:"discover|3b|013|3b|"; reference:url,exploit-db.com/exploits/44992/; classtype:attempted-recon; sid:2025822; rev:2; metadata:attack_target IoT, created_at 2018_07_10, deployment Datacenter, former_category SCAN, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (mesharepoint .com)"; dns.query; dotprefix; content:".mesharepoint.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037163; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING [eSentire] Adobe Phishing Landing 2018-07-04"; flow:from_server,established; content:"<title>PDF Online"; nocase; fast_pattern; content:"Please Enter Your receiving Email Address"; nocase; distance:0; content:"method=|22|post|22|"; nocase; classtype:social-engineering; sid:2025648; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_07_10, deployment Perimeter, former_category CURRENT_EVENTS, performance_impact Moderate, signature_severity Minor, updated_at 2018_07_10;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (prizewings .com)"; dns.query; dotprefix; content:".prizewings.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037164; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET NETBIOS Microsoft Windows RRAS SMB Remote Code Execution"; flow:established,to_server; content:"|21 00 00 00 10 27 00 00 a4 86 01 00 41 41 41 41 04 00 00 00 41 41 41 41 a4 86 01 00 ad 0b 2d 06 d0 ba 61 41 41 90 90 90 90 90|"; reference:cve,2017-11885; reference:url,exploit-db.com/exploits/44616/; classtype:attempted-user; sid:2025824; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2018_07_11, deployment Perimeter, deployment Datacenter, former_category NETBIOS, performance_impact Low, signature_severity Major, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (doctricant .com)"; dns.query; dotprefix; content:".doctricant.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037165; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE [eSentire] Win32/Spy.Banker.ADIO CnC Checkin"; flow:to_server,established; dsize:<35; content:"|3c 7c|"; depth:2; content:"|7c 3e|OPERADOR|3c 7c 3e|"; fast_pattern; distance:0; reference:md5,f45991556122b07d501fa995bd4e74a7; classtype:command-and-control; sid:2025652; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_07_11, deployment Perimeter, former_category MALWARE, malware_family Banking_Trojan, signature_severity Major, updated_at 2018_07_11;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharession .com)"; dns.query; dotprefix; content:".sharession.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037166; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS cmd powershell base64 encoded to Web Server 1"; flow:established,to_server; content:"Y21kIC9jIHBvd2Vyc2hlbGwuZXhl"; classtype:attempted-user; sid:2025827; rev:1; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_12, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharepointle .com)"; dns.query; dotprefix; content:".sharepointle.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037167; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS cmd powershell base64 encoded to Web Server 2"; flow:established,to_server; content:"NtZCAvYyBwb3dlcnNoZWxsLmV4Z"; classtype:attempted-user; sid:2025828; rev:1; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_12, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (mcsharepoint .com)"; dns.query; dotprefix; content:".mcsharepoint.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037168; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS cmd powershell base64 encoded to Web Server 3"; flow:established,to_server; content:"jbWQgL2MgcG93ZXJzaGVsbC5leG"; classtype:attempted-user; sid:2025829; rev:1; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_12, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_07_18;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (officenced .com)"; dns.query; dotprefix; content:".officenced.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037169; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Execve(/bin/sh) Shellcode"; content:"|31 c0 50 68 2f 2f 73 68 68 2f 62 69 6e 89 e3 50 53 89 e1 b0 0b cd 80|"; classtype:shellcode-detect; sid:2025695; rev:1; metadata:affected_product Linux, attack_target Server, created_at 2018_07_13, deployment Perimeter, former_category SHELLCODE, performance_impact Low, updated_at 2018_07_13;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (templatent .com)"; dns.query; dotprefix; content:".templatent.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037170; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $HOME_NET 445 -> any any (msg:"ET POLICY SMB Remote AT Scheduled Job Pipe Creation"; flow:established,to_client; content:"SMB"; depth:8; content:"\\PIPE\\atsvc|00|"; distance:0; classtype:bad-unknown; sid:2025714; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Client, created_at 2018_07_16, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2018_07_16;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharepointen .com)"; dns.query; dotprefix; content:".sharepointen.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037171; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY SMB Executable File Transfer"; flow:established,to_server; content:"SMB"; depth:8; content:"MZ"; distance:0; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; flowbits:set,ET.smb.binary; classtype:bad-unknown; sid:2025699; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Client, created_at 2018_07_16, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2018_07_16;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (officence .com)"; dns.query; dotprefix; content:".officence.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037172; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY SMB NT Create AndX Request For an Executable File"; flow:established,to_server; content:"SMB|A2|"; depth:9; content:"|2E|exe|00|"; nocase; distance:0; classtype:bad-unknown; sid:2025700; rev:2; metadata:attack_target SMB_Client, created_at 2018_07_16, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2018_07_16;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (templateau .com)"; dns.query; dotprefix; content:".templateau.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037173; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY SMB2 NT Create AndX Request For an Executable File"; flow:established,to_server; content:"SMB"; depth:8; content:"|05 00|"; distance:8; within:2; content:"|00 2E 00|e|00|x|00|e|00|"; nocase; distance:0; classtype:bad-unknown; sid:2025701; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Client, created_at 2018_07_16, deployment Perimeter, former_category POLICY, signature_severity Minor, updated_at 2018_07_16;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharesbyte .com)"; dns.query; dotprefix; content:".sharesbyte.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037174; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY SMB2 NT Create AndX Request For an Executable File In a Temp Directory"; flow:established,to_server; content:"SMB"; depth:8; content:"|05 00|"; distance:8; within:2; content:"t|00|e|00|m|00|p|00|\\|00|"; nocase; distance:0; content:"|00 2E 00|e|00|x|00|e|00|"; nocase; distance:0; classtype:trojan-activity; sid:2025703; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Client, created_at 2018_07_16, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2018_07_16;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (officences .com)"; dns.query; dotprefix; content:".officences.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037175; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY SMB NT Create AndX Request For a Powershell .ps1 File"; flow:established,to_server; content:"SMB|A2|"; depth:9; content:"|2E|ps1|00|"; nocase; distance:0; classtype:bad-unknown; sid:2025704; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Client, created_at 2018_07_16, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2018_07_16;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (officentry .com)"; dns.query; dotprefix; content:".officentry.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037176; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY SMB2 NT Create AndX Request For a Powershell .ps1 File"; flow:established,to_server; content:"SMB"; depth:8; content:"|05 00|"; distance:8; within:2; content:"|00 2E 00|p|00|s|00|1|00|"; nocase; distance:0; classtype:bad-unknown; sid:2025705; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Client, created_at 2018_07_16, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2018_07_16;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (officested .com)"; dns.query; dotprefix; content:".officested.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037177; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY SMB NT Create AndX Request For a .bat File"; flow:established,to_server; content:"SMB|A2|"; depth:9; content:"|2E|bat|00|"; nocase; distance:0; classtype:bad-unknown; sid:2025706; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Client, created_at 2018_07_16, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2018_07_16;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (prizemons .com)"; dns.query; dotprefix; content:".prizemons.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037178; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY SMB2 NT Create AndX Request For a .bat File"; flow:established,to_server; content:"SMB"; depth:8; content:"|05 00|"; distance:8; within:2; content:"|00 2E 00|b|00|a|00|t|00|"; nocase; distance:0; classtype:bad-unknown; sid:2025707; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Client, created_at 2018_07_16, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2018_07_16;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (prizewel .com)"; dns.query; dotprefix; content:".prizewel.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037179; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY SMB NT Create AndX Request For a DLL File"; flow:established,to_server; content:"SMB|A2|"; depth:9; content:"|2E|dll|00|"; nocase; distance:0; classtype:bad-unknown; sid:2025708; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Client, created_at 2018_07_16, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2018_07_16;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (sharestion .com)"; dns.query; dotprefix; content:".sharestion.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037180; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY SMB2 NT Create AndX Request For a DLL File - Possible Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|05 00|"; distance:8; within:2; content:"|00 2E 00|d|00|l|00|l|00|"; nocase; distance:0; classtype:bad-unknown; sid:2025709; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Client, created_at 2018_07_16, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2018_07_16;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (attemplate .com)"; dns.query; dotprefix; content:".attemplate.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037181; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY SMB NT Create AndX Request For a .sys File - Possible Lateral Movement"; flow:established,to_server; content:"SMB|A2|"; depth:9; content:"|2E|sys|00|"; nocase; distance:0; classtype:bad-unknown; sid:2025710; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Client, created_at 2018_07_16, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2018_07_16;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Microsoft Attack Simulation Training Domain in DNS Lookup (windocyte .com)"; dns.query; dotprefix; content:".windocyte.com"; nocase; endswith; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037182; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY SMB2 NT Create AndX Request For a .sys File - Possible Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|05 00|"; distance:8; within:2; content:"|00 2E 00|s|00|y|00|s|00|"; nocase; distance:0; classtype:bad-unknown; sid:2025711; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Client, created_at 2018_07_16, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2018_07_16;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (sharepointin .com)"; flow:established,to_client; tls.cert_subject; content:"sharepointin.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?sharepointin\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037183; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY SMB Remote AT Scheduled Job Create Request - Possible Lateral Movement"; flow:established,to_server; content:"SMB|A2|"; depth:9; content:"atsvc|00|"; distance:0; classtype:bad-unknown; sid:2025712; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Client, created_at 2018_07_16, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2018_07_16;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (templatern .com)"; flow:established,to_client; tls.cert_subject; content:"templatern.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?templatern\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037184; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 Inbound Web Servers Likely Command Execution 1"; flow:established,to_server; content:"base64"; fast_pattern; content:"f0VM"; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})/R"; classtype:attempted-user; sid:2025716; rev:2; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_16, deployment Datacenter, former_category WEB_SPECIFIC_APPS, updated_at 2018_07_16;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (prizegives .com)"; flow:established,to_client; tls.cert_subject; content:"prizegives.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?prizegives\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037185; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 Inbound Web Servers Likely Command Execution 2"; flow:established,to_server; content:"base64"; fast_pattern; content:"9FT"; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})/R"; classtype:attempted-user; sid:2025717; rev:2; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_16, deployment Datacenter, former_category WEB_SPECIFIC_APPS, updated_at 2018_07_16;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (shareholds .com)"; flow:established,to_client; tls.cert_subject; content:"shareholds.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?shareholds\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037186; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 Inbound Web Servers Likely Command Execution 3"; flow:established,to_server; content:"base64"; fast_pattern; content:"/RU"; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})/R"; classtype:attempted-user; sid:2025718; rev:2; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_16, deployment Datacenter, former_category WEB_SPECIFIC_APPS, updated_at 2018_07_16;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (mesharepoint .com)"; flow:established,to_client; tls.cert_subject; content:"mesharepoint.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?mesharepoint\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037187; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET 3333 (msg:"ET EXPLOIT Nanopool Claymore Dual Miner Remote Code Execution Linux"; flow:established,to_server; content:"jsonrpc"; content:"method"; content:"miner_file"; content:".bash"; content:"5c5c7837665c5c7834355c5c7834635c5c783436"; fast_pattern; reference:url,exploit-db.com/exploits/45044/; reference:cve,2018-1000049; classtype:attempted-user; sid:2025861; rev:1; metadata:attack_target Server, created_at 2018_07_17, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (prizewings .com)"; flow:established,to_client; tls.cert_subject; content:"prizewings.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?prizewings\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037188; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET 3333 (msg:"ET EXPLOIT Nanopool Claymore Dual Miner Remote Code Execution Windows"; flow:established,to_server; content:"jsonrpc"; content:"method"; content:"miner_file"; content:".bat"; content:"706f7765727368656c6c2e657865"; fast_pattern; reference:url,exploit-db.com/exploits/45044/; reference:cve,2018-1000049; classtype:attempted-user; sid:2025862; rev:2; metadata:attack_target Server, created_at 2018_07_17, deployment Datacenter, former_category EXPLOIT, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (doctricant .com)"; flow:established,to_client; tls.cert_subject; content:"doctricant.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?doctricant\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037189; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded ASCII Inbound Web Servers Likely Command Execution 4"; flow:established,to_server; content:"5c5c7837665c5c7834355c5c7834635c5c783436"; classtype:attempted-user; sid:2025732; rev:2; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_17, deployment Datacenter, former_category WEB_SPECIFIC_APPS, performance_impact Low, signature_severity Major, updated_at 2018_07_17;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (sharession .com)"; flow:established,to_client; tls.cert_subject; content:"sharession.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?sharession\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037190; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $EXTERNAL_NET !$HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE QRat.Java.RAT Checkin Response"; flow:established,to_client; content:"|7b 22 6d 61 73 6d 61 67 22 3a 22|"; within:48; fast_pattern; content:"|22 2c 22 6d 61 73 76 65 72 22 3a|"; distance:0; content:"|2c 22 6d 61 73 69 64 22 3a 22|"; distance:0; content:"|22 2c 22 6e 65 65 64 2d 6d 6f 72 65 22 3a|"; distance:0; content:"|7b 22 6d 61 67 69 63 22 3a 22|"; distance:0; content:"|22 2c 22 69 6e 64 65 78 22 3a 22|"; distance:0; content:"|22 68 61 73 2d 72 65 71 75 65 73 74 65 72 22 3a|"; distance:0; content:"|22 68 61 73 2d 61 63 63 65 70 74 65 72 22 3a|"; distance:0; reference:md5,3ffbde179d54377d55fcac76ebf314cb; reference:url,labsblog.f-secure.com/2016/06/07/qarallax-rat-spying-on-us-visa-applicants/; reference:url,www.trustwave.com/Resources/SpiderLabs-Blog/Quaverse-RAT--Remote-Access-as-a-Service/; classtype:command-and-control; sid:2025392; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_02_26, deployment Perimeter, former_category MALWARE, malware_family QRat, signature_severity Major, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (sharepointle .com)"; flow:established,to_client; tls.cert_subject; content:"sharepointle.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?sharepointle\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037191; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert smb any any -> $HOME_NET 445 (msg:"ET POLICY Powershell Command With Hidden Window Argument Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|p|00|o|00|w|00|e|00|r|00|s|00|h|00|e|00|l|00|l|00|"; nocase; distance:0; fast_pattern; content:"|00|-|00|w|00|"; nocase; distance:0; content:"|00|h|00|i|00|d|00|d|00|e|00|n|00|"; nocase; distance:0; classtype:trojan-activity; sid:2025720; rev:3; metadata:attack_target SMB_Client, created_at 2018_07_17, deployment Perimeter, deployment Internal, former_category POLICY, performance_impact Low, signature_severity Major, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (mcsharepoint .com)"; flow:established,to_client; tls.cert_subject; content:"mcsharepoint.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?mcsharepoint\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037192; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert smb any any -> $HOME_NET 445 (msg:"ET POLICY Powershell Command With No Profile Argument Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|p|00|o|00|w|00|e|00|r|00|s|00|h|00|e|00|l|00|l|00|"; nocase; distance:0; fast_pattern; content:"|00|n|00|o|00|p|00|"; nocase; distance:0; classtype:trojan-activity; sid:2025722; rev:2; metadata:attack_target SMB_Client, created_at 2018_07_17, deployment Perimeter, deployment Internal, former_category POLICY, performance_impact Low, signature_severity Major, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (officenced .com)"; flow:established,to_client; tls.cert_subject; content:"officenced.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?officenced\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037193; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert smb any any -> $HOME_NET 445 (msg:"ET POLICY Powershell Command With Execution Bypass Argument Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|p|00|o|00|w|00|e|00|r|00|s|00|h|00|e|00|l|00|l|00|"; nocase; distance:0; fast_pattern; content:"|00|e|00|x|00|e|00|c|00|"; nocase; distance:0; content:"|00|b|00|y|00|p|00|a|00|s|00|s|00|"; nocase; distance:0; classtype:trojan-activity; sid:2025723; rev:2; metadata:attack_target SMB_Client, created_at 2018_07_17, deployment Perimeter, deployment Internal, former_category POLICY, performance_impact Low, signature_severity Major, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (templatent .com)"; flow:established,to_client; tls.cert_subject; content:"templatent.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?templatent\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037194; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert smb any any -> $HOME_NET 445 (msg:"ET POLICY Powershell Command With NonInteractive Argument Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|p|00|o|00|w|00|e|00|r|00|s|00|h|00|e|00|l|00|l|00|"; nocase; distance:0; fast_pattern; content:"|00|n|00|o|00|n|00|i|00|"; nocase; distance:0; classtype:trojan-activity; sid:2025724; rev:2; metadata:attack_target SMB_Client, created_at 2018_07_17, deployment Perimeter, deployment Internal, former_category POLICY, performance_impact Low, signature_severity Major, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (sharepointen .com)"; flow:established,to_client; tls.cert_subject; content:"sharepointen.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?sharepointen\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037195; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert smb any any -> $HOME_NET 445 (msg:"ET POLICY RunDll Request Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|r|00|u|00|n|00|d|00|l|00|l|00|"; nocase; distance:0; fast_pattern; classtype:trojan-activity; sid:2025725; rev:3; metadata:attack_target SMB_Client, created_at 2018_07_17, deployment Perimeter, deployment Internal, former_category POLICY, performance_impact Low, signature_severity Major, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (officence .com)"; flow:established,to_client; tls.cert_subject; content:"officence.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?officence\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037196; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 UTF-8 Inbound Web Servers Likely Command Execution 5"; flow:established,to_server; content:"XDE3N1wxMDVcMTE0XDEwN"; classtype:attempted-user; sid:2025832; rev:1; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_18, deployment Datacenter, former_category WEB_SPECIFIC_APPS, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (templateau .com)"; flow:established,to_client; tls.cert_subject; content:"templateau.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?templateau\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037197; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 UTF-8 Inbound Web Servers Likely Command Execution 6"; flow:established,to_server; content:"wxNzdcMTA1XDExNFwxMD"; classtype:attempted-user; sid:2025833; rev:1; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_18, deployment Datacenter, former_category WEB_SPECIFIC_APPS, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (sharesbyte .com)"; flow:established,to_client; tls.cert_subject; content:"sharesbyte.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?sharesbyte\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037198; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 UTF-8 Inbound Web Servers Likely Command Execution 7"; flow:established,to_server; content:"cMTc3XDEwNVwxMTRcMTA2"; classtype:attempted-user; sid:2025834; rev:1; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_18, deployment Datacenter, former_category WEB_SPECIFIC_APPS, updated_at 2018_07_18;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (officences .com)"; flow:established,to_client; tls.cert_subject; content:"officences.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?officences\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037199; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Github Phishing Landing 2018-07-19"; flow:established,from_server; file_data; content:"form action=|22|login.php|22|"; content:"<h1>Sign in to GitHub</h1>"; distance:0; fast_pattern; content:"<input type=|22|text|22 20|name=|22|username|22|"; distance:0; classtype:social-engineering; sid:2025873; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_07_19, deployment Perimeter, former_category CURRENT_EVENTS, performance_impact Low, signature_severity Major, tag Phish, updated_at 2018_07_19;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (officentry .com)"; flow:established,to_client; tls.cert_subject; content:"officentry.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?officentry\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037200; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Twitter Phishing Landing 2018-07-19"; flow:established,from_server; file_data; content:"<title>Login to Twitter"; content:"form action=|22|login.php|22|"; distance:0; content:"|20 20 20 20 20 20|name=|22|usernameOrEmail|22 0a|"; distance:0; fast_pattern; classtype:social-engineering; sid:2025874; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_07_19, deployment Perimeter, former_category CURRENT_EVENTS, performance_impact Low, signature_severity Minor, tag Phish, updated_at 2018_07_19;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (officested .com)"; flow:established,to_client; tls.cert_subject; content:"officested.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?officested\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037201; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 Hex Escape Inbound Web Servers Likely Command Execution 8"; flow:established,to_server; content:"XFx4N2ZcXHg0NVxceDRjXFx4ND"; classtype:attempted-user; sid:2025865; rev:1; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_19, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_07_19;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (prizemons .com)"; flow:established,to_client; tls.cert_subject; content:"prizemons.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?prizemons\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037202; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $EXTERNAL_NET any -> any any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 Hex Escape Inbound Web Servers Likely Command Execution 9"; flow:established,to_server; content:"xceDdmXFx4NDVcXHg0Y1xceDQ2"; classtype:attempted-user; sid:2025866; rev:1; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_19, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_07_19;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (prizewel .com)"; flow:established,to_client; tls.cert_subject; content:"prizewel.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?prizewel\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037203; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 Hex Escape Inbound Web Servers Likely Command Execution 10"; flow:established,to_server; content:"cXHg3ZlxceDQ1XFx4NGNcXHg0N"; classtype:attempted-user; sid:2025867; rev:1; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_19, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_07_19;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (sharestion .com)"; flow:established,to_client; tls.cert_subject; content:"sharestion.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?sharestion\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037204; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic plain Inbound Web Servers Likely Command Execution 11"; flow:established,to_server; content:"|5c|177|5c|105|5c|114|5c|106|5c|"; fast_pattern; classtype:attempted-user; sid:2025868; rev:2; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_19, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_07_19;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (attemplate .com)"; flow:established,to_client; tls.cert_subject; content:"attemplate.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?attemplate\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037205; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic plain Inbound Web Servers Likely Command Execution 12"; flow:established,to_server; content:"|5c 5c|x7f|5c 5c|x45|5c 5c|x4c|5c 5c|x46|5c 5c|"; classtype:attempted-user; sid:2025869; rev:2; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_19, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_07_19;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Microsoft Attack Simulation Training SSL Cert (windocyte .com)"; flow:established,to_client; tls.cert_subject; content:"windocyte.com"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?windocyte\.com(?!\.)/"; reference:url,docs.microsoft.com/en-us/microsoft-365/security/office-365-security/attack-simulation-training-get-started; classtype:misc-activity; sid:2037206; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_06_29, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_06_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Netflix Phishing Landing 2017-07-20"; flow:established,from_server; file_data; content:"Netflix"; content:"meta content=|22|watch movies"; distance:0; content:"meta content=|22|Watch Netflix movies"; distance:0; fast_pattern; content:"action=|22|login.php|22|"; distance:0; classtype:social-engineering; sid:2025875; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_07_20, deployment Perimeter, former_category CURRENT_EVENTS, performance_impact Low, signature_severity Minor, tag Phish, updated_at 2018_07_20;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Delphi JEDI Visual Component Library User-Agent (JEDI-VCL)"; flow:established,to_server; http.host; content:!"apexwin.com"; http.user_agent; content:"JEDI-VCL"; startswith; classtype:misc-activity; sid:2013559; rev:9; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_09_12, deployment Perimeter, former_category INFO, signature_severity Major, updated_at 2022_06_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING LinkedIn Phishing Landing 2017-07-20"; flow:established,from_server; file_data; content:"class=|22|ie ie6 lte9 lte8 lte7 os-linux|22|>"; content:"LinkedIn|26 23|58|3b 20|Log In or Sign Up"; distance:0; fast_pattern; content:"action=|22|login.php|22|"; distance:0; classtype:social-engineering; sid:2025876; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_07_20, deployment Perimeter, former_category CURRENT_EVENTS, performance_impact Low, signature_severity Minor, tag Phish, updated_at 2018_07_20;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Custom Logo Domain Domain in DNS Lookup (logodownload .org)"; dns.query; dotprefix; content:".logodownload.org"; nocase; endswith; classtype:misc-activity; sid:2037269; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_07_05, deployment Perimeter, former_category INFO, signature_severity Major, updated_at 2022_07_05;)
 
-alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE passwd file Outbound from WEB SERVER Linux"; flow:established,from_server; file_data; content:"root:x:0:0:root:/root:/bin/"; within:27; classtype:successful-recon-limited; sid:2025879; rev:1; metadata:created_at 2018_07_20, updated_at 2018_07_20;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed SSL Cert (logodownload .org)"; flow:established,to_client; tls.cert_subject; content:"logodownload.org"; fast_pattern; pcre:"/CN=(?:[^\r\n]+?\.)?logodownload\.org(?!\.)/"; classtype:misc-activity; sid:2037270; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_07_05, deployment Perimeter, former_category INFO, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_07_05;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING [eSentire] DHL Phish Landing July 24 2018"; flow:established,to_client; file_data; content:"Tracking made easy"; nocase; content:"Login to Continue Tracking your Package"; nocase; distance:0; content:"Sign In With Your Correct Email and Password To Review Package Information"; nocase; distance:0; classtype:social-engineering; sid:2025886; rev:2; metadata:attack_target Client_Endpoint, created_at 2018_07_24, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, updated_at 2018_07_24;)
+#alert dns $HOME_NET any -> any any (msg:"ET INFO Outbound RRSIG DNS Query Observed"; content:"|00 00 2e 00 01|"; fast_pattern; classtype:bad-unknown; sid:2030555; rev:2; metadata:created_at 2020_07_17, former_category INFO, updated_at 2020_07_17;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET 5555 (msg:"ET EXPLOIT Remote Command Execution via Android Debug Bridge"; flow:from_server,established; content:"CNXN|00 00 00 01 00 10 00 00 07 00 00 00 32 02 00 00 BC B1 A7 B1|host|3a 3a|"; distance:40; fast_pattern; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/open-adb-ports-being-exploited-to-spread-possible-satori-variant-in-android-devices/; classtype:trojan-activity; sid:2025887; rev:1; metadata:created_at 2018_07_24, updated_at 2018_07_24;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO Observed DNS Query to Dynamic DNS Service (giize .com)"; dns.query; dotprefix; content:".giize.com"; nocase; endswith; classtype:bad-unknown; sid:2037725; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_07_08, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_07_08;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET 5555 (msg:"ET EXPLOIT Remote Command Execution via Android Debug Bridge 2"; flow:from_server,established; content:"OPENX|02 00 00 00 00 00 00 F2 17 4A 00 00 B0 AF BA B1|shell|3a|>/sdcard/Download/f|20|&&|20|cd|20|/sdcard/Download/|3b 20|>/dev/f|20|&&|20|cd|20|/dev/|3b 20|>/data/local/tmp/f|20|&&|20|cd|20|/data/local/tmp/|3b 20|busybox|20|wget|20|http|3a|//"; fast_pattern; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/open-adb-ports-being-exploited-to-spread-possible-satori-variant-in-android-devices/; classtype:trojan-activity; sid:2025888; rev:1; metadata:affected_product Android, attack_target Mobile_Client, created_at 2018_07_24, deployment Perimeter, former_category EXPLOIT, signature_severity Critical, updated_at 2018_07_24;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed File Sharing Domain (roamresearch .com in TLS SNI)"; flow:established,to_server; tls.sni; content:"roamresearch.com"; bsize:16; fast_pattern; classtype:bad-unknown; sid:2037763; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_07_14, deployment Perimeter, signature_severity Major, updated_at 2022_07_14;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android Golden Rat Checkin"; flow:to_server,established; content:"<HmzaPacket>|3e 0a 20 20|<Command>"; depth:25; fast_pattern; content:"<MSG>"; within:40; content:"</MSG>|3e 0a 20 20|"; distance:0; content:"</HmzaPacket></HAMZA_DELIMITER_STOP>"; distance:0; reference:url,csecybsec.com/download/zlab/20180723_CSE_APT27_Syria_v1.pdf; reference:md5,6296586cf9a59b25d1b8ab3eeb0c2a33; classtype:trojan-activity; sid:2025895; rev:1; metadata:affected_product Android, attack_target Mobile_Client, created_at 2018_07_25, deployment Perimeter, former_category MOBILE_MALWARE, malware_family Android_GoldenRat, tag Android, updated_at 2018_07_25, mitre_tactic_id TA0037, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO File Sharing Domain in DNS Lookup (roamresearch .com)"; dns.query; content:"roamresearch.com"; nocase; bsize:16; classtype:bad-unknown; sid:2037764; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_07_14, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_07_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Underminer EK IE Exploit"; flow:established,to_client; file_data; content:"IE=EmulateIE9"; nocase; content:"</head"; nocase; within:200; content:"<body"; nocase; within:200; content:"<script"; nocase; within:200; content:"!!window.ActiveXObject"; nocase; within:200; content:"try"; within:200; content:"parent.parent.setLocalStoreUserData"; nocase; distance:0; pcre:"/^\s*\([\x22\x27][A-F0-9a-f]{32}[\x22\x27]\s*\)\s*\x3b\s*}\s*catch\s*\(e\)\s*\{\s*\}\s*\}\s*<\/script>\s*<\/body>/Rsi"; classtype:exploit-kit; sid:2025911; rev:1; metadata:affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2018_07_26, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag Underminer_EK, updated_at 2018_07_26;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Shared File Retrieved (roamresearch .com)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/|23|/app/cig/page/"; startswith; fast_pattern; http.host; content:"roamresearch.com"; classtype:bad-unknown; sid:2037765; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_07_14, deployment Perimeter, deployment SSLDecrypt, former_category INFO, signature_severity Informational, updated_at 2022_07_14;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Underminer EK Flash Exploit"; flow:established,to_client; file_data; content:"D27CDB6E-AE6D-11cf-96B8-444553540000"; nocase; fast_pattern; content:"<param"; nocase; pcre:"/^(?=[^>]*? name\s*=\s*[\x22\x27]flashvars)[^>]*? value\s*=\s*[\x22\x27]url=https?\x3a[^\x22\x27]*?\.wasm/Rsi"; classtype:exploit-kit; sid:2025914; rev:2; metadata:affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2018_07_26, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag Underminer_EK, updated_at 2018_07_27;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO InformationCardSigninHelper ClassID (Vulnerable ActiveX Control in CVE-2013-3918)"; flow:established,to_client; file_data; content:"19916E01-B44E-4E31-94A4-4696DF46157B"; nocase; classtype:misc-activity; sid:2017980; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_01_17, deployment Perimeter, former_category INFO, signature_severity Major, tag ActiveX, updated_at 2016_07_01;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Underminer EK Plugin Check"; flow:established,to_client; file_data; content:"D27CDB6E-AE6D-11cf-96B8-444553540000"; nocase; fast_pattern; content:"setcallbackfunction"; nocase; content:"<param"; pcre:"/^(?=[^>]*? name\s*=\s*[\x22\x27]movie)[^>]*? value\s*=\s*[\x22\x27]+\+(?P<var>[\w_-]+)\+[^>]+\/>\s*[\x22\x27]+\+(?P<var2>[\w_-]+)\+(?=.+?\b(?P=var)\s*\>\=\s*23\s*&&\s*(?P=var)<\=\s*28\b)(?=.+?\b(?P=var)\s*\>\=\s*17\s*&&\s*(?P=var)<\=\s*18\b)(?=.+?\b(?P=var)\s*\>\=\s*11\s*&&\s*(?P=var)<\=\s*16\b).+?,\s*?(?P=var2)\s*\(\s*\)\s*\)\s*\:(?P=var)\s*\>\=\s*\d/Rsi"; classtype:exploit-kit; sid:2025915; rev:2; metadata:affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2018_07_26, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag Underminer_EK, updated_at 2018_09_28;)
+#alert dns $HOME_NET any -> any any (msg:"ET INFO DNS Query for Suspicious .com.ru Domain"; dns.query; dotprefix; content:".com.ru"; fast_pattern; nocase; endswith; reference:url,sign.kaffenews.com/?p=104; classtype:bad-unknown; sid:2011407; rev:4; metadata:created_at 2010_09_28, former_category INFO, updated_at 2022_07_15;)
 
-alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Oracle WebLogic Deserialization  (CVE-2018-2893)"; flow:established,to_server; content:"t3|20|12"; depth:5; fast_pattern; content:"AS|3a|255"; distance:0; content:"HL|3a|19"; distance:0; content:"MS|3a|10000000"; distance:0; content:"PU|3a|t3|3a|//"; distance:0; reference:cve,2018-2893; reference:url,github.com/pyn3rd/CVE-2018-2893; classtype:attempted-admin; sid:2025929; rev:2; metadata:affected_product Web_Server_Applications, attack_target Server, created_at 2018_08_01, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_08_01;)
+#alert dns $HOME_NET any -> any any (msg:"ET INFO DNS Query for Suspicious .com.cn Domain"; dns.query; dotprefix; content:".com.cn"; fast_pattern; nocase; endswith; reference:url,sign.kaffenews.com/?p=104; classtype:bad-unknown; sid:2011408; rev:4; metadata:created_at 2010_09_28, former_category INFO, updated_at 2022_07_15;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Christian Mingle Phishing Landing 2018-08-07"; flow:established,to_client; file_data; content:"<title>christian mingle - login"; nocase; fast_pattern; content:"
"; nocase; distance:0; classtype:social-engineering; sid:2025973; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_07, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_07;)
+#alert dns $HOME_NET any -> any any (msg:"ET INFO DNS Query for Suspicious .co.kr Domain"; dns.query; dotprefix; content:".co.kr"; fast_pattern; nocase; endswith; reference:url,sign.kaffenews.com/?p=104; classtype:bad-unknown; sid:2011411; rev:4; metadata:created_at 2010_09_28, former_category INFO, updated_at 2022_07_15;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Microsoft Account Phishing Landing 2018-08-07"; flow:established,to_client; file_data; content:"sign in to your microsoft account"; nocase; fast_pattern; content:"method=|22|post|22|"; nocase; distance:0; classtype:social-engineering; sid:2025974; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_07, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_07;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Pastebin-style Service (textbin .net in TLS SNI)"; flow:established,to_server; tls.sni; content:"textbin.net"; bsize:11; fast_pattern; classtype:bad-unknown; sid:2037786; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_07_19, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_07_19;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Paypal Phishing Landing 2018-08-07"; flow:established,to_client; file_data; content:"log in to your paypal account"; nocase; fast_pattern; content:"|7a 31 31 38 2e 63 73 73|"; nocase; distance:0; classtype:social-engineering; sid:2025975; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_07, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_07;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)"; dns.query; dotprefix; content:".con-ip.com"; nocase; endswith; classtype:bad-unknown; sid:2037787; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_07_19, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_07_19;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Free Mobile Phishing Landing 2018-08-07"; flow:established,to_client; file_data; content:"free mobile - bienvenue dans votre espace"; nocase; fast_pattern; content:"<img id=|22|fins|22 20|src=|22|fins.png|22|>"; nocase; distance:0; content:"<input type=|22|password|22 20|name=|22|ps|22 20|id=|22|ps|22|"; nocase; distance:0; classtype:social-engineering; sid:2025976; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_07, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_07;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO DYNAMIC_DNS HTTP Request to a *.misecure .com Domain"; flow:established,to_server; http.host; content:".misecure.com"; endswith; reference:url,changeip.com; classtype:bad-unknown; sid:2036077; rev:2; metadata:attack_target Client_and_Server, created_at 2022_04_14, deployment Perimeter, deprecation_reason Duplicate, former_category INFO, performance_impact Low, signature_severity Informational, updated_at 2022_04_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Adobe Phishing Landing 2018-08-07"; flow:established,to_client; file_data; content:"<title>adobe pdf"; nocase; fast_pattern; content:"title=|22|you are not signed in yet|22|"; nocase; distance:0; content:"title=|22|login to continue|22|"; nocase; distance:0; content:"adobe pdf online"; nocase; distance:0; content:"email password"; nocase; distance:0; classtype:social-engineering; sid:2025977; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_07, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_07;)
+alert dns $HOME_NET any -> any any (msg:"ET INFO DYNAMIC_DNS Query to *.myddns.me Domain"; flow:established,to_server; threshold: type limit, count 1, track by_src, seconds 120; dns.query; content:".myddns.me"; fast_pattern; nocase; endswith; classtype:policy-violation; sid:2027287; rev:5; metadata:attack_target Client_Endpoint, created_at 2019_04_25, deployment Perimeter, former_category INFO, performance_impact Low, signature_severity Informational, tag DynamicDNS, updated_at 2022_07_27;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Microsoft Ajax Phishing Landing 2018-08-07"; flow:established,to_client; file_data; content:"sign in to your account"; nocase; content:"action: posturl|20|}|22 20|action=|22|connectidx.php|22|"; nocase; distance:0; fast_pattern; content:"privacy.microsoft.com"; nocase; distance:0; classtype:social-engineering; sid:2025978; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_07, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_07;)
+# Emerging Threats 
+#
+# This distribution may contain rules under two different licenses. 
+#
+#  Rules with sids 1 through 3464, and 100000000 through 100000908 are under the GPLv2.
+#  A copy of that license is available at http://www.gnu.org/licenses/gpl-2.0.html
+#
+#  Rules with sids 2000000 through 2799999 are from Emerging Threats and are covered under the BSD License 
+#  as follows:
+#
+#*************************************************************
+#  Copyright (c) 2003-2022, Emerging Threats
+#  All rights reserved.
+#  
+#  Redistribution and use in source and binary forms, with or without modification, are permitted provided that the 
+#  following conditions are met:
+#  
+#  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following 
+#    disclaimer.
+#  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the 
+#    following disclaimer in the documentation and/or other materials provided with the distribution.
+#  * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived 
+#    from this software without specific prior written permission.
+#  
+#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES, 
+#  INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
+#  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 
+#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
+#  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 
+#  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE 
+#  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+#
+#*************************************************************
+#
+#
+#
+#
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Alibaba Phishing Landing 2018-08-07"; flow:established,to_client; file_data; content:"content=|22|alibaba manufacturer directory"; nocase; content:"class=|22|xman"; nocase; distance:0; fast_pattern; content:"id=|22|xman"; nocase; distance:0; content:"<iframe"; nocase; distance:0; classtype:social-engineering; sid:2025979; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_07, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_07;)
+# This Ruleset is EmergingThreats Open optimized for suricata-5.0-enhanced.
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Microsoft Phishing Landing 2018-08-07"; flow:established,to_client; file_data; content:"<title>sign in to your account"; nocase; content:"onerror=|22|$loader.on(this,true)|22 20|onload=|22|$loader.on(this)"; nocase; distance:0; fast_pattern; content:"method=|22|post|22|"; nocase; distance:0; content:"secure.aadcdn.microsoftonline-p.com"; nocase; distance:0; classtype:social-engineering; sid:2025981; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_07, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_07;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Suspected Cobalt Strike Malleable C2 M1 (set)"; flow:established,to_server; ja3.hash; content:"eb88d0b3e1961a0562f006e5ce2a0b87"; ja3.string; content:"771,49192-49191-49172-49171"; flowbits:set,ET.cobaltstrike.ja3; flowbits:noalert; classtype:command-and-control; sid:2028831; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_10_15, deployment Perimeter, former_category JA3, malware_family Cobalt_Strike, signature_severity Major, updated_at 2019_10_15, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1001, mitre_technique_name Data_Obfuscation;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE MSIL/Crimson Receiving Command (getavs)"; flow:established,to_client; content:"|00 00 00 00|getavs="; offset:1; depth:11; fast_pattern; reference:md5,0f0f6f48c3ee5f8e7cd3697c40002bc7; classtype:trojan-activity; sid:2036286; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_08_08, deployment Perimeter, former_category MALWARE, malware_family MSIL_Crimson, performance_impact Moderate, signature_severity Major, updated_at 2018_08_08;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Suspected Meterpreter Reverse Shell M1 (set)"; flow:established,to_server; ja3.hash; content:"8916410db85077a5460817142dcbc8de"; flowbits:set,ET.meterpreter.ja3; flowbits:noalert; classtype:command-and-control; sid:2028828; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_10_15, deployment Perimeter, former_category JA3, malware_family Meterpreter, signature_severity Major, updated_at 2019_10_15;)
 
-alert tcp-pkt any 445 -> $HOME_NET any (msg:"ET EXPLOIT SMB Null Pointer Dereference PoC Inbound (CVE-2018-0833)"; flow:from_server,established; content:"|FD 53 4D 42 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41|"; offset:4; reference:url,krbtgt.pw/smbv3-null-pointer-dereference-vulnerability/; reference:cve,2018-0833; classtype:attempted-admin; sid:2025983; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_08_08, deployment Internal, former_category EXPLOIT, signature_severity Minor, updated_at 2018_08_08;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Suspected Meterpreter Reverse Shell M2 (set)"; flow:established,to_server; ja3.hash; content:"72a589da586844d7f0818ce684948eea"; flowbits:set,ET.meterpreter.ja3; flowbits:noalert; classtype:command-and-control; sid:2028830; rev:2; metadata:attack_target Client_Endpoint, created_at 2019_10_15, deployment Perimeter, former_category JA3, malware_family Meterpreter, signature_severity Major, updated_at 2019_10_15;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Adobe PDX in HTTP Flowbit Set"; flow:from_server,established; file_data; content:"%PDX-"; within:5; flowbits:set,ET.pdx.in.http; flowbits:noalert; classtype:not-suspicious; sid:2025985; rev:2; metadata:affected_product Adobe_Reader, created_at 2018_08_10, deployment Perimeter, former_category INFO, performance_impact Low, signature_severity Informational, updated_at 2018_08_10;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Metaploit http scanner (tested: 4.11.5 Kali)"; ja3_hash; content:"16f17c896273d1d098314a02e87dd4cb"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028301; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Adobe Flash Uncompressed in HTTP Flowbit Set"; flow:from_server,established; file_data; content:"FWS"; within:3; flowbits:set,HTTP.UncompressedFlash; flowbits:noalert; classtype:not-suspicious; sid:2016394; rev:7; metadata:created_at 2013_02_09, deployment Perimeter, former_category INFO, performance_impact Low, signature_severity Informational, updated_at 2018_08_10;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Metasploit CCS Scanner"; ja3_hash; content:"950ccdd64d360a7b24c70678ac116a44"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028302; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Unknown Exploit Kit Payload Request"; flow:established,to_server; content:"/download.php?e="; http_uri; fast_pattern:only; pcre:"/\.php\?e=[^&]+?$/U"; classtype:exploit-kit; sid:2016522; rev:3; metadata:created_at 2013_03_05, former_category EXPLOIT_KIT, updated_at 2021_06_23;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Metasploit HeartBleed Scanner"; ja3_hash; content:"ee031b874122d97ab269e0d8740be31a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028303; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Win32/Rallovs.A CnC Beacon"; flow:established,to_server; dsize:>1000; content:"|00 00 00 00|2|00|0|00|"; fast_pattern; pcre:"/^[1-9]\x00\d/R"; content:"|00|-|00|"; within:3; pcre:"/^\d\x00\d/R"; content:"|00|-|00|"; within:3; pcre:"/^\d\x00\d/R"; content:"|00 20 00|"; within:3; pcre:"/^\d\x00\d/R"; content:"|00 3a 00|"; within:3; pcre:"/^\d\x00\d/R"; content:"|00 3a 00|"; pcre:"/^\d\x00\d/R"; content:"|00 00|2|00|0|00|"; distance:0; content:"|00|-|00|"; distance:3; within:3; reference:md5,67a039a3139c6ef1bf42424acf658d01; reference:url,blog.cylance.com/spear-a-threat-actor-resurfaces; classtype:command-and-control; sid:2021117; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_19, deployment Perimeter, former_category TROJAN, signature_severity Major, tag c2, updated_at 2018_08_22, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Metasploit SSL Scanner"; ja3_hash; content:"6825b330bf9de50ccc8745553cb61b2f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028304; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp any any -> $HOME_NET 12397 (msg:"ET SCADA SEIG SYSTEM 9 - Remote Code Execution"; flow:established,to_server; content:"|14 60 00 00 66 66 07 00 10 00 00 00 19 00 00 00 00 00 04 00 00 00 60 00|"; depth:24; content:!"|0d|"; distance:0; content:!"|0a|"; distance:0; content:!"|ff|"; content:!"|00|"; distance:0; reference:url,exploit-db.com/exploits/45218/; reference:cve,2013-0657; classtype:attempted-user; sid:2026003; rev:1; metadata:created_at 2018_08_21, former_category SCADA, updated_at 2018_08_21;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - mitmproxy"; ja3_hash; content:"4d01f8b1afc22e138127611b62f1e6ec"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028308; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [PTsecurity] Remcos RAT Checkin 26"; flow:established,to_server; stream_size:server,=,1; content:"|5a 95 2a 22 4d 37 9e 51 83 55 8f|"; depth: 11; reference:md5,8f8d778bea33bc542b58c0631cf9d7e0; classtype:command-and-control; sid:2026004; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_08_21, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Remcos, updated_at 2018_08_21;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - mitmproxy"; ja3_hash; content:"8ef6a005eae3d51b652ffe41984f8869"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028309; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp any any -> $HOME_NET 27700 (msg:"ET SCADA SEIG Modbus 3.4 - Remote Code Execution"; flow:established,to_server; content:"|42 42 ff ff 07 03 44 00 64|"; fast_pattern; content:"|90 90 90 90 90 90 90 90 90 90|"; distance:0; reference:url,exploit-db.com/exploits/45220/; reference:cve,2013-0662; classtype:attempted-user; sid:2026005; rev:1; metadata:created_at 2018_08_21, former_category SCADA, updated_at 2018_08_21;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Nikto (tested 2.1.6 - Kali)"; ja3_hash; content:"5eeeafdbc41e5ca7b81c92dbefa03ab7"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028327; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Successful Generic Phish (set) 2018-08-27"; flow:established,to_server; content:"POST"; http_method; content:"id1="; depth:4; nocase; http_client_body; content:"|25|40"; distance:0; http_client_body; content:"&id2="; nocase; distance:0; http_client_body; fast_pattern; flowbits:set,ET.genericphish; flowbits:noalert; classtype:credential-theft; sid:2026038; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_27, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2018_11_27, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Nikto (tested 2.1.6 - Kali)"; ja3_hash; content:"f4262963691a8f123d4434c7308ad7fe"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028328; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET !139 (msg:"ET MALWARE Backdoor.Win32.PcClient.bal CnC (OUTBOUND) 2"; flow:to_server,established; content:"|12 12|"; offset:2; depth:2; content:!"|12 12|"; within:2; content:"|12 12|"; distance:2; within:2; content:!"|12 12|"; within:2; content:"|12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12|"; pcre:"/[^\x12][^\x4e\x38\x39\x2f\x6e\x28\x29\x30\x2d\x2e\x2c\x3e\x31\x18][\x40-\x48\x4a-\x4d\x31-\x34\x3a-\x3c\x3f\x50-\x5f\x60-\x6c\x6f\x73-\x7f\x70\x71\x20-\x27\x2a\x2b]{1,14}\x12/R"; reference:md5,00ccc1f7741bb31b6022c6f319c921ee; classtype:command-and-control; sid:2019202; rev:4; metadata:created_at 2014_09_22, former_category MALWARE, updated_at 2014_09_22;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Nikto (tested v2.1.6)"; ja3_hash; content:"a563bb123396e545f5704a9a2d16bcb0"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028329; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic Chalbhai Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:"function unhideBody()"; nocase; content:"onload=|22|unhideBody()|22|"; nocase; distance:0; content:".php|22 20|name=|22|chalbhai|22 20|id=|22|chalbhai|22 20|method=|22|post|22|"; nocase; fast_pattern; distance:0; classtype:social-engineering; sid:2026041; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - AnglerEK"; ja3_hash; content:"96eba628dcb2b47607192ba74a3b55ba"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028360; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic AES Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:"var hea2p ="; nocase; content:"0123456789ABCDEFGHIJKLMNOPQRSTUVXYZabcdefghijklmnopqrstuvxyz"; nocase; distance:0; content:"var hea2t ="; nocase; distance:0; content:"Aes.Ctr.decrypt(hea2t, hea2p"; nocase; fast_pattern; distance:0; classtype:social-engineering; sid:2026043; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - AnglerEK"; ja3_hash; content:"d55e755245ac118f2b1847c1c57b5e03"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028361; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic Chalbhai Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:"function unhideBody()"; nocase; content:"onload=|22|unhideBody()|22|"; nocase; distance:0; content:"name=chalbhai id=chalbhai method=post"; nocase; fast_pattern; distance:0; classtype:social-engineering; sid:2026042; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Boleto Malspam"; ja3_hash; content:"4f635262ad3fb6e634daee798082c788"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028363; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Hellion Postmaster Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:" $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Boleto Malspam"; ja3_hash; content:"e9273590c7875d6367325f8714890790"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028364; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Microsoft Document Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:"
DOCUMENT MANAGEMENT SYSTEM
"; fast_pattern; nocase; content:"javascript:void(0)|3b 22|>Document -> Important Files -> Current File
"; nocase; distance:0; content:"
File to Download
"; content:"USER AUTHENTICATION"; nocase; distance:0; classtype:social-engineering; sid:2026045; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Dridex"; ja3_hash; content:"67f762b0ffe3aad00dfdb0e4b1acd8b5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028365; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic Multi-Email Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:"function popupwnd(url,"; nocase; fast_pattern; content:"var popupwindow = this.open(url,"; nocase; distance:0; content:"onclick=|22|popupwnd("; nocase; distance:0; content:"onclick=|22|popupwnd("; nocase; distance:0; content:"onclick=|22|popupwnd("; nocase; distance:0; classtype:social-engineering; sid:2026046; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Dridex"; ja3_hash; content:"85bedfc1914da556aab4518390798003"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028366; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Apple AES Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:"jQuery(function($)"; nocase; content:"$('.cc-number').payment('formatCardNumber"; nocase; distance:0; content:"$(|22|#ssn|22|).mask(|22|999-99-9999"; nocase; distance:0; content:"Aes.Ctr.decrypt(hea2t, hea2p"; nocase; distance:0; fast_pattern; classtype:social-engineering; sid:2026049; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Eitest Chrome Popup"; ja3_hash; content:"098f55e27d8c4b0a590102cbdb3a5f3a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028367; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Stripe Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:"Stripe: Login"; nocase; fast_pattern; content:"<form name=|22|appleConnectForm"; nocase; distance:0; content:"onsubmit=|22|if(do_submit(3)) return true|3b 20|"; nocase; distance:0; content:"id=|22|pass0|22|"; nocase; distance:0; classtype:social-engineering; sid:2026050; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Eitest/AnglerEK"; ja3_hash; content:"ff94b48f555edc2f0a4c8256eb0d81de"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028368; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Adobe PDF Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:"function MM_validateForm() { //v"; nocase; content:"email address to view or download"; nocase; distance:0; content:"PDF is protected"; nocase; distance:0; content:"onclick=|22|MM_validateForm('password"; nocase; distance:0; fast_pattern; classtype:social-engineering; sid:2026051; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Fake Firefox Font Update"; ja3_hash; content:"2efb07037a97b06201ab4fe7ec0c326e"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028369; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Google Docs Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:"url(Google_docs_files/"; nocase; fast_pattern; content:"href=|22|Google_docs_files/"; nocase; distance:0; content:"your email provider"; nocase; distance:0; content:"data-description=|22|Sign in with"; nocase; distance:0; classtype:social-engineering; sid:2026052; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Fake Firefox Font Update"; ja3_hash; content:"df5c30e670dba99f9270ed36060cf054"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028370; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING WeTransfer Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:"<title>Encrypted Message"; nocase; fast_pattern; content:"<div id=|22|gmail|22|"; nocase; distance:0; content:"<div id=|22|yahoo|22|"; nocase; distance:0; content:"your email provider"; nocase; distance:0; classtype:social-engineering; sid:2026053; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_30;)
+#alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Fake Firefox Font Update"; ja3_hash; content:"a0e9f5d64349fb13191bc781f81f42e1"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028371; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Bank of America Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:"<title>|ce 92 d0 b0 6e 6b 20 d0 be 66 20 ce 91 6d d0 b5 72 d1 96 d1 81 d0 b0 20 7c 20 ce 9f 6e 6c d1 96 6e d0 b5 20 ce 92 d0 b0 6e 6b d1 96 6e 67 20 7c 20 d0 85 d1 96 67 6e 20 ce 99 6e 20 7c 20 ce 9f 6e 6c d1 96 6e d0 b5 20 ce 99 44|"; classtype:social-engineering; sid:2026054; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - FiestaEK"; ja3_hash; content:"c1fbfd09bd0bab610be60dd6819688f4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:exploit-kit; sid:2028372; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Bank of America Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:"Bank of America"; nocase; content:"name=|22|generator|22 20|content=|22|WYSIWYG"; nocase; distance:0; content:"href=|22|css/Untitled"; nocase; distance:0; fast_pattern; classtype:social-engineering; sid:2026055; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Gootkit"; ja3_hash; content:"a34e8a810b5f390fc7aa5ed711fa6993"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028373; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic Mailbox Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:"<title>Mail Verification"; nocase; fast_pattern; content:"<form method=|22|post|22 20|action=|22|x3d.php|22|>"; nocase; distance:0; classtype:social-engineering; sid:2026056; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Gootkit"; ja3_hash; content:"c6e36d272db78ba559429e3d845606d1"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028374; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic Mailbox Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:"<title>Mail Settings|20 7c 20|Email Upgrade"; nocase; fast_pattern; content:"<form method=|22|post|22 20|action=|22|post.php|22|>"; nocase; distance:0; classtype:social-engineering; sid:2026057; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_30;)
+#alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Java Based RAT"; ja3_hash; content:"187dfde7edc8ceddccd3deeccc21daeb"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028375; rev:2; metadata:created_at 2019_09_10, deprecation_reason False_Positive, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Dropbox Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:"<title>Dropbox|20 7c 20|Sign in"; nocase; fast_pattern; content:"name=|22|generator|22 20|content=|22|Web Page Maker"; nocase; distance:0; content:"<div id=|22|image1|22 20|style=|22|position:absolute|3b 20|overflow:hidden|3b 20|left:"; nocase; distance:0; classtype:social-engineering; sid:2026058; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Malspam"; ja3_hash; content:"243a279e5aaae8841edf46d00c05195e"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028376; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Linkedin Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:"<title>Sign In|20 7c 20|LinkedIn"; nocase; content:"<form id=|22|form1|22 20|name=|22|form1|22 20|method=|22|post|22 20|action=|22|login.php|22|>"; nocase; distance:0; fast_pattern; classtype:social-engineering; sid:2026059; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Malspam"; ja3_hash; content:"e7d705a3286e19ea42f587b344ee6865"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028377; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic PhishKit Author Comment M1 2018-08-30"; flow:established,to_client; file_data; content:"|3c 21 2d 2d 20 22 32 6b 31 37 20 70 72 69 76 38 20 62 79 20 6b 40 6d 65 6c 32 70 20 24 22 20 2d 2d 3e|"; classtype:social-engineering; sid:2026061; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2018_08_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Neutrino"; ja3_hash; content:"51b5c918558a4bfb50ce1ab1d5fddff7"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028378; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic PhishKit Author Comment M2 2018-08-30"; flow:established,to_client; file_data; content:"|3c 21 2d 2d 20 22 61 6d 61 7a 6f 6e 20 62 79 20 6b 40 6d 65 6c 32 70 20 24 22 20 2d 2d 3e|"; classtype:social-engineering; sid:2026062; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2018_08_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Neutrino"; ja3_hash; content:"852e7534b3f722d893a7750afb5ecdcc"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028379; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic PhishKit Author Comment M3 2018-08-30"; flow:established,to_client; file_data; content:"|3c 21 2d 2d 20 22 69 74 75 6e 65 73 20 62 79 20 68 61 69 74 68 65 6d 20 62 61 74 20 24 22 20 2d 2d 3e|"; classtype:social-engineering; sid:2026063; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2018_08_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Neutrino"; ja3_hash; content:"a7dfa1673bb090cab6b6658861f43473"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028380; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic PhishKit Author Comment M4 2018-08-30"; flow:established,to_client; file_data; content:"|3c 21 2d 2d 20 73 63 61 6d 20 70 72 6f 20 62 79 20 74 68 75 67 2d 6e 65 74 2d 65 76 65 72 20 26 20 70 75 6e 69 73 68 65 72 2d 6f 75 6a 64 69|"; classtype:social-engineering; sid:2026064; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2018_08_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Neutrino"; ja3_hash; content:"aeae3901ecde8396b2f5648c02aeb37f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028381; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic PhishKit Author Comment M5 2018-08-30"; flow:established,to_client; file_data; content:"|3c 21 2d 2d 20 75 70 64 61 74 65 20 62 79 20 74 61 6b 72 69 7a 20 26 20 32 30 31 35 20 2d 2d 3e|"; classtype:social-engineering; sid:2026065; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2018_08_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Neutrino"; ja3_hash; content:"e107ef8ec0296e17c3f82de949b4066c"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028382; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic PhishKit Author Comment M6 2018-08-30"; flow:established,to_client; file_data; content:"|3c 21 2d 2d 20 75 70 64 61 74 65 20 62 79 20 78 62 6f 6f 6d 62 65 72 20 26 20 78 68 61 74 20 2d 2d 3e|"; classtype:social-engineering; sid:2026066; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2018_08_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Neutrino"; ja3_hash; content:"fd6bbdf835788b3c7d33372127470a06"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028383; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic PhishKit Author Comment M7 2018-08-30"; flow:established,to_client; file_data; content:"|3c 21 2d 2d 2d 20 63 72 65 61 74 65 64 20 62 79 20 6c 65 67 7a 79 20 2d 2d 2d 20 69 63 71 20 3a 20 36 39 32 35 36 31 38 32 34 20 2d 2d 2d 2d 3e|"; classtype:social-engineering; sid:2026067; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2018_08_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - NuclearEK"; ja3_hash; content:"fd2273056f386e0ba8004e897c337037"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028385; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic PhishKit Author Comment M8 2018-08-30"; flow:established,to_client; file_data; content:"|3c 21 2d 2d 6d 6f 64 65 64 20 62 79 20 61 6e 74 68 72 61 78 2d 2d 3e|"; classtype:social-engineering; sid:2026068; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2018_08_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - RigEK"; ja3_hash; content:"1848357994c2851c809cb01bae7d631c"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028386; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic PhishKit Author Comment M9 2018-08-30"; flow:established,to_client; file_data; content:"|3c 21 2d 2d 74 68 65 20 73 63 72 69 70 74 20 77 61 73 20 6f 72 69 67 69 6e 61 6c 79 20 63 6f 64 65 64 20 62 79 20 61 6c 69 62 6f 62 6f 20 33 36 30 2d 2d 3e|"; classtype:social-engineering; sid:2026069; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2018_08_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - RigEK"; ja3_hash; content:"2d44457ca7a1e0e754664c8469ce62a8"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028387; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic PhishKit Author Comment M10 2018-08-30"; flow:established,to_client; file_data; content:"|3c 21 2d 2d 74 68 65 20 73 63 72 69 70 74 20 77 61 73 20 6f 72 69 67 69 6e 61 6c 79 20 63 6f 64 65 64 20 62 79 20 6f 6c 64 6c 65 67 65 6e 64 20 33 36 30 2d 2d 3e|"; classtype:social-engineering; sid:2026070; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2018_08_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Various Malfams"; ja3_hash; content:"bafc6b01eae6f4350f5db6805ace208e"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028388; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING AT&T Phishing Landing 2018-08-30"; flow:established,to_client; file_data; content:"<title>AT&"; nocase; content:"href=|22|https://home.secureapp.att.net/"; nocase; distance:0; content:".php|22 20|method=|22|post|22 20|id=|22|LoginForm|22|"; nocase; distance:0; content:"|22|type=|22|com.sbc.idm.igate_edam.forms.LoginFormBean|22|"; nocase; distance:0; classtype:social-engineering; sid:2026060; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_08_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_08_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - TBot / Skynet Tor Botnet"; ja3_hash; content:"b50f81ae37fb467713e167137cf14540"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028389; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert smtp $EXTERNAL_NET any -> $SMTP_SERVERS any (msg:"ET EXPLOIT Ghostscript invalidcheck escape attempt (SMTP)"; flow:to_server,established; file_data; content:"legal"; content:"restore"; distance:0; content:"currentdevice"; content:"putdeviceprops"; pcre:"/legal[^x7B]*\x7B[^\x7D]*restore/smi"; reference:url,seclists.org/oss-sec/2018/q3/142; classtype:attempted-user; sid:2026084; rev:2; metadata:attack_target SMTP_Server, created_at 2018_09_05, deployment Datacenter, former_category EXPLOIT, signature_severity Major, updated_at 2018_09_05;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Trickbot"; ja3_hash; content:"294b2f1dc22c6e6c3231d2fe311d504b"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028390; rev:2; metadata:created_at 2019_09_10, former_category JA3, malware_family TrickBot, updated_at 2019_10_29;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Ghostscript invalidcheck escape attempt"; flow:to_client,established; file_data; content:"legal"; content:"restore"; distance:0; content:"currentdevice"; content:"putdeviceprops"; pcre:"/legal[^x7B]*\x7B[^\x7D]*restore/smi"; reference:url,seclists.org/oss-sec/2018/q3/142; classtype:attempted-user; sid:2026085; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_09_05, deployment Datacenter, former_category EXPLOIT, signature_severity Informational, updated_at 2018_09_05;)
+#alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Unknown traffic associated with Dridex"; ja3_hash; content:"b9103d9d134e0c59cafbe4ae0a8299a8"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028391; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert smtp $EXTERNAL_NET any -> $SMTP_SERVERS any (msg:"ET EXPLOIT Ghostscript illegal read undefinedfilename attempt (SMTP)"; flow:to_server,established; file_data; content:"undefinedfilename"; fast_pattern; content:"errordict"; content:"invalidfileaccess"; content:"typecheck"; pcre:"/errordict\s+\x2Finvalidfileaccess/smi"; reference:url,seclists.org/oss-sec/2018/q3/142; classtype:attempted-user; sid:2026086; rev:2; metadata:attack_target SMTP_Server, created_at 2018_09_05, deployment Datacenter, former_category EXPLOIT, signature_severity Informational, updated_at 2018_09_05;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - USPS Malspam"; ja3_hash; content:"3fab5d0fe3b2408c8b2251b46d3895de"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028392; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Ghostscript illegal read undefinedfilename attempt"; flow:to_client,established; file_data; content:"undefinedfilename"; fast_pattern; content:"errordict"; content:"invalidfileaccess"; content:"typecheck"; pcre:"/errordict\s+\x2Finvalidfileaccess/smi"; reference:url,seclists.org/oss-sec/2018/q3/142; classtype:attempted-user; sid:2026087; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_09_05, deployment Perimeter, former_category EXPLOIT, signature_severity Informational, updated_at 2018_09_05;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - USPS Malspam"; ja3_hash; content:"6f702efe6480d2a1c9f85b73b8a4794a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028393; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert smtp $EXTERNAL_NET any -> $SMTP_SERVERS any (msg:"ET EXPLOIT Ghostscript illegal delete bindnow attempt (SMTP)"; flow:to_server,established; file_data; content:"unlink("; fast_pattern; content:"|2E|bindnow"; content:"stopped"; distance:0; pcre:"/\x2Ebindnow[^\x7D]*\x7D\s*stopped/smi"; reference:url,seclists.org/oss-sec/2018/q3/142; classtype:attempted-user; sid:2026088; rev:2; metadata:attack_target SMTP_Server, created_at 2018_09_05, deployment Datacenter, former_category EXPLOIT, signature_severity Informational, updated_at 2018_09_05;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - USPS Malspam"; ja3_hash; content:"92579701f145605e9edc0b01a901c6d5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028394; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Ghostscript illegal delete bindnow attempt"; flow:to_client,established; file_data; content:"unlink("; fast_pattern; content:"|2E|bindnow"; content:"stopped"; distance:0; pcre:"/\x2Ebindnow[^\x7D]+\x7D\s*stopped/smi"; reference:url,seclists.org/oss-sec/2018/q3/142; classtype:attempted-user; sid:2026089; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_09_05, deployment Perimeter, former_category EXPLOIT, signature_severity Informational, updated_at 2018_09_05;)
+#alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Various Eitest"; ja3_hash; content:"1074895078955b2db60423ed2bf8ac23"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028395; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert smtp $EXTERNAL_NET any -> $SMTP_SERVERS any (msg:"ET EXPLOIT Ghostscript setpattern type confusion attempt (SMTP)"; flow:to_server,established; file_data; content:"16#"; content:"setpattern"; distance:0; pcre:"/16#[^s]\d+\s*\x3E\x3E\s*setpattern/smi"; reference:url,seclists.org/oss-sec/2018/q3/142; classtype:attempted-user; sid:2026090; rev:2; metadata:attack_target SMTP_Server, created_at 2018_09_05, deployment Datacenter, former_category EXPLOIT, signature_severity Informational, updated_at 2018_09_05;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Various EK"; ja3_hash; content:"51a7ad14509fd614c7bb3a50c4982b8c"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028396; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Ghostscript setpattern type confusion attempt"; flow:to_client,established; file_data; content:"16#"; content:"setpattern"; distance:0; pcre:"/16#[^s]\d+\s*\x3E\x3E\s*setpattern/smi"; reference:url,seclists.org/oss-sec/2018/q3/142; classtype:attempted-user; sid:2026091; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_09_05, deployment Perimeter, former_category EXPLOIT, signature_severity Informational, updated_at 2018_09_05;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Various Malspam/RigEK"; ja3_hash; content:"3b483d0b34894548b602e8d18cdc24c5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028397; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert smtp $EXTERNAL_NET any -> $SMTP_SERVERS any (msg:"ET EXPLOIT Ghostscript LockDistillerParams type confusion attempt (SMTP)"; flow:to_server,established; file_data; content:"LockDistillerParams"; content:"16#"; distance:0; pcre:"/16#[^s]\d+\s*\x3E\x3E\s*setpattern/smi"; reference:url,seclists.org/oss-sec/2018/q3/142; classtype:attempted-user; sid:2026092; rev:2; metadata:attack_target SMTP_Server, created_at 2018_09_05, deployment Datacenter, former_category EXPLOIT, signature_severity Informational, updated_at 2018_09_05;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Various Malspam/RigEK/Dreambot"; ja3_hash; content:"c201b92f8b483fa388be174d6689f534"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028398; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Ghostscript LockDistillerParams type confusion attempt"; flow:to_client,established; file_data; content:"LockDistillerParams"; content:"16#"; distance:0; pcre:"/16#[^s]\d+\s*\x3E\x3E\s*setpattern/smi"; reference:url,seclists.org/oss-sec/2018/q3/142; classtype:attempted-user; sid:2026093; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_09_05, deployment Perimeter, former_category EXPLOIT, signature_severity Informational, updated_at 2018_09_05;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Various RigEK/Cryptowall/Dridex"; ja3_hash; content:"2d8794cb7b52b777bee2695e79c15760"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028399; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp any any -> $HOME_NET any (msg:"ET EXPLOIT Mikrotik Winbox RCE Attempt (CVE-2018-14847)"; flow:established,to_server; content:"|680100664d320500ff010600ff09050700ff090701000021352f2f2f2f2f2e2f2e2e2f2f2f2f2f2f2e2f2e2e2f2f2f2f2f2f2e2f2e2e2f666c6173682f72772f73746f72652f757365722e6461740200ff88020000000000080000000100ff8802000200000002000000|"; offset:0; reference:url,github.com/mrmtwoj/0day-mikrotik; reference:url,www.helpnetsecurity.com/2018/08/03/mikrotik-cryptojacking-campaign; reference:cve,2018-14847; classtype:attempted-admin; sid:2025972; rev:3; metadata:affected_product Linux, attack_target Networking_Equipment, created_at 2018_08_06, deployment Perimeter, former_category EXPLOIT, signature_severity Major, updated_at 2018_09_11;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Various RigEK/Dridex/Kovter"; ja3_hash; content:"df8bfc363eeba63ab938cb2190ccd7b7"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028400; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET MALWARE Possible Ursnif/Gamaredon Related VNC Module CnC Beacon"; flow:established,to_server; dsize:12; content:"RFB 003.008|0a|"; depth:12; reference:md5,27741793672d8b69803f3d2434743731; reference:md5,076fd584d2fcdf5110f41bcbbd9f2c62; reference:md5,49749ee8fb2a2dab83494ab0e6cf5e7b; classtype:command-and-control; sid:2035893; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_10_05, deployment Perimeter, former_category MALWARE, malware_family ursnif, malware_family PowerSniff, malware_family Punchbuggy_VNC_Module, malware_family Gamaredon, signature_severity Major, tag c2, updated_at 2018_09_21, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Malware - Various Trickbot/Kovter/Dridex"; ja3_hash; content:"6734f37431670b3ab4292b8f60f29984"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,www.malware-traffic-analysis.net; classtype:unknown; sid:2028401; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET !$HTTP_PORTS (msg:"ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)"; flow:established,to_server; dsize:<500; content:"|00 6c 6c|"; depth:6; fast_pattern; pcre:"/^[0-9]{2,3}\x00\x6c\x6c(?P<var>[\x20-\x2f\x30-\x39\x3a-\x40\x41-\x5a\x5b-\x60\x7b-\x7e][\x20-\x7e]+?[\x20-\x2f\x30-\x39\x3a-\x40\x41-\x5a\x5b-\x60\x7b-\x7e])(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(?P=var)[^\r\n]+(?P=var)$/i"; flowbits:set,ETPRO.njratgeneric; reference:md5,d68eaf3b43ba1d26b9067489bbf7ee44; classtype:command-and-control; sid:2033132; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_03_22, deployment Perimeter, former_category MALWARE, malware_family Bladabindi, malware_family njrat, performance_impact Moderate, signature_severity Major, updated_at 2017_03_22;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Superfish"; ja3_hash; content:"1b5a75e6d0f679aa312edb060ea8d932"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028402; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER JSP.SJavaWebManage WebShell Pass 20-09-2018 1"; flow:established,from_server; file_data; content:"|3c 25 40|page"; depth:7; content:"String|20|PASS|20|=|20 22|09a0aa1091460d23e5a68550826b359b|22|"; distance:0; fast_pattern; reference:md5,91eaca79943c972cb2ca7ee0e462922c; classtype:trojan-activity; sid:2026337; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_09_20, deployment Datacenter, former_category WEB_SERVER, malware_family SJavaWebManage, performance_impact Low, signature_severity Major, tag WebShell, updated_at 2018_09_25;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Possible Superfish"; ja3_hash; content:"cfaa6f79904b33fdca83dbb5d4b537d4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028403; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER JSP.SJavaWebManage WebShell Pass 20-09-2018 2"; flow:established,from_server; file_data; content:"|3c 25 40|page"; depth:7; content:"String|20|PASS|20|=|20 22|098f6bcd4621d373cade4e832627b4f6|22|"; distance:0; fast_pattern; reference:md5,91eaca79943c972cb2ca7ee0e462922c; classtype:trojan-activity; sid:2026338; rev:2; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_09_20, deployment Datacenter, former_category WEB_SERVER, malware_family SJavaWebManage, performance_impact Low, signature_severity Major, tag WebShell, updated_at 2018_09_25;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Rapid7 Nexpose"; ja3_hash; content:"c22dea495cef869edbeb3458adaf497f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028413; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER JSP.SJavaWebManage WebShell Access"; flow:established,from_server; file_data; content:"|3c 25 40|page"; depth:7; content:"|22|os.name|22|"; distance:0; content:"|22|/bin/sh|22|"; distance:0; content:"getRuntime|28 29|.exec|28|"; fast_pattern; reference:md5,91eaca79943c972cb2ca7ee0e462922c; classtype:trojan-activity; sid:2026336; rev:3; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_09_20, deployment Datacenter, former_category WEB_SERVER, malware_family SJavaWebManage, performance_impact Low, signature_severity Major, tag WebShell, updated_at 2018_09_25;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - sqlmap (tested: v1.0-dev kali)"; ja3_hash; content:"615788655a0e65b71e47c3ebe2302564"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028467; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic MRxJoker Phishing Landing 2018-09-27"; flow:established,to_client; file_data; content:"content=|22|@importmrxjokercss|22|"; nocase; fast_pattern; content:"name=|22|mrxjokercard|22|"; nocase; distance:0; classtype:social-engineering; sid:2026419; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_09_27, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, updated_at 2018_09_27;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - sqlmap (tested: v1.0.7.0 OS X)"; ja3_hash; content:"1ab5d0f756e0692a975fda9a6474969f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028468; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE VBScript Redirect Style Exe File Download"; flow:to_client,established; flowbits:isset,ET.Locky; file_data; content:"MZ"; depth:2; fast_pattern; content:"This program"; within:100; classtype:trojan-activity; sid:2026434; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_04_13, deployment Perimeter, former_category MALWARE, malware_family Locky, malware_family Emotet, signature_severity Major, updated_at 2018_10_04;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - WPScan (tested: 2.9 Kali)"; ja3_hash; content:"4c8ff2ddb1890482e5989b80e48b54d4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028556; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NCSC XAgent Beacon"; flow:established,to_server; content:"HTTP/1.1|0d 0a|Accept|3a|text/html,application/xhtml+xml,application/xml|3b|q=0.9,*"; content:!"Host|3a| yandex.ru"; pcre:"/^(?:GET|POST)\/(?:watch|search|find|results|open|search|close)\/\?(?:text=|from=|aq=|ai=|ags=|oe=|btnG=|oprnd=|utm=|channel=|itwm=)/"; reference:url,www.ncsc.gov.uk/content/files/protected_files/article_files/IOC-APT28-malware-advisory.pdf; classtype:targeted-activity; sid:2026437; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_10_04, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2018_10_04, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Trickbot"; ja3_hash; content:"1aa7bf8b97e540ca5edd75f7b8384bfa"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028757; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NCSC XAgent itwm beacon v1"; flow:established,to_server; content:"/?itwm"; fast_pattern; pcre:"/itwm=[A-Za-z0-9\-\_]{29,35}/"; reference:url,www.ncsc.gov.uk/content/files/protected_files/article_files/IOC-APT28-malware-advisory.pdf; classtype:targeted-activity; sid:2026438; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_10_04, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2018_10_04, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Quakbot"; ja3_hash; content:"3cda52da4ade09f1f781ad2e82dcfa20"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028758; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NCSC XAgent itwm beacon v2"; flow:established,to_server; content:"&itwm"; fast_pattern; pcre:"/&itwm=[A-Za-z0-9\-\_]{29,35}/"; reference:url,www.ncsc.gov.uk/content/files/protected_files/article_files/IOC-APT28-malware-advisory.pdf; classtype:targeted-activity; sid:2026439; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_10_04, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2018_10_04, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Quakbot"; ja3_hash; content:"7dd50e112cd23734a310b90f6f44a7cd"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028759; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-#alert tcp any any <> any any (msg:"ET MALWARE NCSC APT28 - CompuTrace_Beacon_UserAgent"; flow:established; content:"|0d0a|TagId|3a|"; fast_pattern; content: "POST / "; content:!"namequery.com"; content:!"Host: 209.53.113."; content:!"dnssearch.org"; content:!"Cookie:"; content:!"fnbcorporate.co.za"; content:!"207.6.98."; pcre:"/Mozilla\/[0-9]{1,2}.[0-9]{1,2}\(compatible\; MSIE [0-9]{1,2}.[0-9]{1,2}\;\)\x0d\x0a/"; reference:url,www.ncsc.gov.uk/content/files/protected_files/article_files/IOC-APT28-malware-advisory.pdf; classtype:targeted-activity; sid:2026440; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_10_04, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2018_10_17, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Troldesh Ransomware"; ja3_hash; content:"1be3ecebe5aa9d3654e6e703d81f6928"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028760; rev:2; metadata:attack_target Client_Endpoint, created_at 2019_10_14, deployment Perimeter, former_category JA3, signature_severity Major, tag Ransomware, updated_at 2019_10_29, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NCSC APT28 - Web/request -FILE- contenttype"; flow:established,from_client; content:"-FILE-"; pcre:"/[A-Z0-9\-]{16}-FILE-[^\r\n]+.tmp/"; reference:url,www.ncsc.gov.uk/content/files/protected_files/article_files/IOC-APT28-malware-advisory.pdf; classtype:targeted-activity; sid:2026441; rev:2; metadata:created_at 2018_10_04, former_category MALWARE, updated_at 2018_10_04;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Gootkit"; ja3_hash; content:"c5235d3a8b9934b7fbbd204d50bc058d"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028761; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO JAR Containing Executable Downloaded"; flow:established,to_client; flowbits:isset,ET.http.javaclient; file_data; content:"PK"; within:2; content:".exe"; fast_pattern; nocase; classtype:trojan-activity; sid:2016379; rev:6; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2013_02_08, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag DriveBy, updated_at 2018_10_09;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Trickbot"; ja3_hash; content:"e62a5f4d538cbf169c2af71bec2399b4"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028762; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Successful Generic Phish (set) 2018-10-10"; flow:established,to_server; content:"POST"; http_method; content:"id1="; depth:4; nocase; http_client_body; content:"|25|40"; distance:0; http_client_body; content:"&id2="; nocase; distance:0; http_client_body; fast_pattern; flowbits:set,ET.genericphish; flowbits:noalert; classtype:credential-theft; sid:2026465; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_10_10, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2018_11_27, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adwind"; ja3_hash; content:"d2935c58fe676744fecc8614ee5356c7"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028763; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert smtp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN StarDotStar HELO, suspected AUTH LOGIN botnet"; flow:established,to_server; content:"HELO|20 2a 2e 2a 0d 0a|"; depth:11; classtype:bad-unknown; sid:2026463; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_10_09, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, updated_at 2018_10_12;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adwind"; ja3_hash; content:"decfb48a53789ebe081b88aabb58ee34"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028764; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Microsoft Edge Remote Command Execution PoC (CVE-2018-8495)"; flow:established,to_client; file_data; content:"wshfile:"; content:"../../"; within:100; content:"SyncAppvPublishingServer.vbs"; within:200; nocase; fast_pattern; content:"window.onkeydown=e=>"; nocase; distance:0; content:"window.onkeydown=z="; nocase; distance:0; content:"click()"; nocase; distance:0; reference:url,leucosite.com/Microsoft-Edge-RCE/; reference:cve,2018-8495; classtype:attempted-user; sid:2026488; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_10_15, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, updated_at 2018_10_15;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Dridex"; ja3_hash; content:"51c64c77e60f3980eea90869b68c58a8"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028765; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [PTsecurity] Remcos RAT Checkin 69"; flow:established,to_server; content:"|e3 34 a1 ef b4 32 58 d0 f0 3d 66|"; depth:11; reference:md5,f9dbf2c028d3ad58328c190a6adb3301; classtype:command-and-control; sid:2026509; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_10_16, deployment Perimeter, former_category MALWARE, malware_family Remcos, performance_impact Low, signature_severity Major, tag RAT, updated_at 2018_10_16;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Dridex"; ja3_hash; content:"cb98a24ee4b9134448ffb5714fd870ac"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028766; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [PTsecurity] Remcos RAT Checkin 70"; flow:established,to_server; content:"|35 cd 13 07 49 3a 45 81 02 35 bb|"; depth:11; reference:md5,8e99866b89e9349c21b34e6575f2412f; classtype:command-and-control; sid:2026510; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_10_16, deployment Perimeter, former_category MALWARE, malware_family Remcos, performance_impact Low, signature_severity Major, tag RAT, updated_at 2018_10_16;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"f22bdd57e3a52de86cda40da2d84e83b"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028767; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [PTsecurity] Remcos RAT Checkin 71"; flow:established,to_server; content:"|38 b6 1d 2b 3b 5c 11 b4 d8 75 2c|"; depth:11; reference:md5,24bf188785e18db8fcb7dfa50363b3f5; classtype:command-and-control; sid:2026511; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_10_16, deployment Perimeter, former_category MALWARE, malware_family Remcos, performance_impact Low, signature_severity Major, tag RAT, updated_at 2018_10_16;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"fb58831f892190644fe44e25bc830b45"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028768; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [PTsecurity] Remcos RAT Checkin 72"; flow:established,to_server; content:"|eb e7 a2 ec 6e 3e cc a8 34 b5 91|"; depth:11; reference:md5,98a010ad867f4c36730cc6a87c94528c; classtype:command-and-control; sid:2026512; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_10_16, deployment Perimeter, former_category MALWARE, malware_family Remcos, performance_impact Low, signature_severity Major, tag RAT, updated_at 2018_10_16;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"0cc1e84568e471aa1d62ad4158ade6b5"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028769; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [PTsecurity] Remcos RAT Checkin 73"; flow:established,to_server; content:"|2e 11 6e fe 1c 00 92 21 3c ce 31|"; depth:11; reference:md5,9e31ee4bb378d3cf6f80f9f30e9f810f; classtype:command-and-control; sid:2026513; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_10_16, deployment Perimeter, former_category MALWARE, malware_family Remcos, performance_impact Low, signature_severity Major, tag RAT, updated_at 2018_10_16;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"2092e1fffb45d7e4a19a57f9bc5e203a"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028770; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/BlackCarat Response from CnC"; flow:established,from_server; dsize:13; content:"|72 50 bf 9e|"; offset:9; depth:4; fast_pattern; reference:md5,514AB639CD556CEBD78107B4A68A202A; reference:url,www.virusbulletin.com/uploads/pdf/conference_slides/2018/AncelKuprins-VB2018-WolfSheep.pdf; classtype:command-and-control; sid:2026524; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_10_18, deployment Perimeter, former_category MALWARE, malware_family CaratRAT, performance_impact Low, signature_severity Major, tag RAT, updated_at 2018_10_18;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"d18a4da84af59e1108862a39bae7c9d4"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028771; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $EXTERNAL_NET $SSH_PORTS -> any any (msg:"ET POLICY Potentially Vulnerable LibSSH Server Observed - Possible Authentication Bypass (CVE-2018-10933)"; flow:from_server,established; content:"SSH-2.0-libssh-0."; depth:17; pcre:"/^[67]\.[01235]/R"; reference:url,www.libssh.org/security/advisories/CVE-2018-10933.txt; reference:url,github.com/blacknbunny/libSSH-Authentication-Bypass; reference:cve,2018-10933; classtype:bad-unknown; sid:2026526; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_10_19, deployment Perimeter, former_category POLICY, signature_severity Major, tag CVE_2018_10933, updated_at 2018_10_19;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Dridex"; ja3_hash; content:"b386946a5a44d1ddcc843bc75336dfce"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028772; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT IE Double Free (CVE-2018-8460)"; flow:to_client,established; file_data; content:"<script"; nocase; content:"CreateElement"; nocase; content:"cssText"; nocase; content:"DOMAttrModified"; fast_pattern; nocase; content:"addEventListener"; nocase; pcre:"/(?P<obj>[^\s]{1,25})\s*=\s*document\s*\.\s*createElement.*?(?P<func>[^\s]{1,25})\s*=\s*function\s*\x28\s*e\s*\x29\s*{[^}]*this\s*\.\s*style\s*\.\s*cssText.*?(?P=obj)\s*\.\s*addEventListener\s*\x28\s*[\x22\x27]\s*DOMAttrModified\s*[\x22\x27]\s*\x2c\s*(?P=func)/si"; reference:cve,2018-8460; classtype:attempted-user; sid:2026531; rev:2; metadata:affected_product Internet_Explorer, attack_target Client_Endpoint, created_at 2018_10_23, deployment Perimeter, former_category WEB_CLIENT, updated_at 2018_10_23;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"8498fe4268764dbf926a38283e9d3d8f"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028773; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert icmp $HOME_NET any -> any any (msg:"ET EXPLOIT Possible CVE-2018-4407 - Apple ICMP DoS PoC"; itype:12; icode:0; content:"AAAAAAAA"; fast_pattern; reference:url,lgtm.com/blog/apple_xnu_icmp_error_CVE-2018-4407; reference:url,twitter.com/ihackbanme/status/1057811965945376768; classtype:attempted-user; sid:2026567; rev:1; metadata:affected_product Mac_OSX, attack_target Client_Endpoint, created_at 2018_11_01, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2018_11_01;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"20dd18bdd3209ea718989030a6f93364"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028774; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Perl/Shellbot.SM IRC CnC Checkin"; flow:established,to_server; content:"JOIN"; depth:4; content:"Procesor - model name"; distance:0; content:"Numar Procesoare"; distance:0; fast_pattern; content:"|3a|uid="; distance:0; content:"gid="; distance:0; content:"groups="; distance:0; reference:md5,ca42fda581175fd85ba7dab8243204e4; classtype:command-and-control; sid:2026579; rev:1; metadata:attack_target Client_and_Server, created_at 2018_11_05, deployment Perimeter, former_category MALWARE, malware_family Shellbot_SM, performance_impact Low, signature_severity Major, tag Perl, updated_at 2018_11_05;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"8991a387e4cc841740f25d6f5139f92d"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028775; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE JavaRAT Sending Screenshot"; flow:established,to_server; dsize:>1000; content:"sc.cap_sep_"; depth:11; nocase; fast_pattern; reference:md5,9a33176dd80de6f49099a148a2df3491; classtype:trojan-activity; sid:2026585; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_11_07, deployment Perimeter, former_category TROJAN, malware_family JavaRAT, performance_impact Moderate, signature_severity Major, updated_at 2018_11_07;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"e330bca99c8a5256ae126a55c4c725c5"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028776; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Mylobot Receiving XOR Encrypted Config (0xde)"; flow:established,from_server; content:"|00 00 00 00|"; depth:4; content:"|b6 aa aa ae e4 f1 f1|"; distance:1; within:7; fast_pattern; content:"|de 00 00 00 00|"; distance:0; reference:url,www.netformation.com/our-pov/mylobot-continues-global-infections/; classtype:trojan-activity; sid:2026613; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_11_15, deployment Perimeter, former_category TROJAN, malware_family Mylobot, performance_impact Low, signature_severity Major, updated_at 2018_11_15;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"83e04bc58d402f9633983cbf22724b02"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028777; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Observed Malicious SSL Cert (BrushaLoader Domain)"; flow:from_server,established; tls_cert_subject; content:"CN=driversearch.site"; nocase; isdataat:!1,relative; tls_cert_issuer; content:"C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"; classtype:domain-c2; sid:2026644; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2018_11_21, deployment Perimeter, former_category MALWARE, malware_family BrushaLoader, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2018_11_21, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"b8f81673c0e1d29908346f3bab892b9b"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028778; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic Xbalti Phishing Landing 2018-11-26"; flow:established,from_server; file_data; content:"|2d 2d 7e 28 20 20 5c 20 7e 29 29 29 29 29 29 29 29 29 29 29 29 0d 0a 20 20 20 20 2f 20 20 20 20 20 5c 20 20 60 5c 2d 28 28 28 28 28 28 28 28 28|"; within:400; content:"|5c 20 20 5c 20 42 59 20 58 42 41 4c 54 49 20 2f|"; fast_pattern; classtype:social-engineering; sid:2026650; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_11_26, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2018_11_26;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"d551fafc4f40f1dec2bb45980bfa9492"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028779; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Observed Malicious SSL Cert (BrushaLoader Domain)"; flow:from_server,established; tls_cert_subject; content:"CN=kortusops.icu"; nocase; isdataat:!1,relative; tls_cert_issuer; content:"C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"; classtype:domain-c2; sid:2026659; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2018_11_27, deployment Perimeter, former_category MALWARE, malware_family BrushaLoader, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, tag Loader, updated_at 2018_11_27, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"29085f03f8e8a03f0b399c5c7cf0b0b8"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028780; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-#alert udp $EXTERNAL_NET 137 -> $HOME_NET 137 (msg:"ET POLICY NetBIOS nbtstat Type Query Inbound"; content:"|20 43 4b 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00 00 21 00 01|"; threshold:type limit, track by_src, count 1, seconds 10; classtype:unknown; sid:2013491; rev:3; metadata:created_at 2011_08_30, former_category POLICY, updated_at 2018_11_27;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"bc6c386f480ee97b9d9e52d472b772d8"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028781; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-#alert udp $HOME_NET 137 -> $EXTERNAL_NET 137 (msg:"ET POLICY NetBIOS nbtstat Type Query Outbound"; content:"|20 43 4b 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00 00 21 00 01|"; threshold:type limit, track by_src, count 1, seconds 10; classtype:unknown; sid:2013490; rev:3; metadata:created_at 2011_08_30, former_category POLICY, updated_at 2018_11_27;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"b13d01846ad7a14a70bf030a16775c78"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028782; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Delphi APT28 Zebrocy/Zekapab Reporting to CnC"; flow:established,to_server; content:"POST"; http_method; content:".php?res="; http_uri; content:"data="; http_client_body; depth:5; content:"%0D%0AHost%20Name|3a|%20%20%20"; http_client_body; distance:0; content:"%0D%0AOS%20Name|3a|%20%20%20"; http_client_body; distance:0; content:"%0D%0ARegistered%20Owner|3a|%20%20%20"; http_client_body; distance:0; fast_pattern; content:"%0D%0AOriginal%20Install%20Date|3a|%20%20%20"; http_client_body; distance:0; http_protocol; content:"HTTP/1.0"; http_header_names; content:!"Referer"; reference:url,www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf; classtype:targeted-activity; sid:2026682; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_11_30, deployment Perimeter, former_category TROJAN, malware_family Zebrocy, malware_family Zekapab, performance_impact Low, signature_severity Major, tag APT28, updated_at 2018_11_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"698e36219f3979420fa2581b21dac7ec"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028783; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Certificate with Unknown Content M2"; flow:established,to_client; file_data; content:"-----BEGIN CERTIFICATE-----|0A|"; depth:28; fast_pattern; byte_test:1,!=,0x4D,0,relative; reference:url,blog.nviso.be/2018/07/31/powershell-inside-a-certificate-part-1/; classtype:misc-activity; sid:2026684; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_12_04, deployment Perimeter, former_category INFO, performance_impact Moderate, signature_severity Informational, updated_at 2018_12_04;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Torrentlocker"; ja3_hash; content:"1712287800ac91b34cadd5884ce85568"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028784; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Certificate with Unknown Content M1"; flow:established,to_client; file_data; content:"-----BEGIN CERTIFICATE-----|0D 0A|"; depth:29; fast_pattern; byte_test:1,!=,0x4D,0,relative; reference:url,blog.nviso.be/2018/07/31/powershell-inside-a-certificate-part-1/; classtype:misc-activity; sid:2026649; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_11_26, deployment Perimeter, former_category INFO, performance_impact Moderate, signature_severity Major, updated_at 2018_11_26;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"550dce18de1bb143e69d6dd9413b8355"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028785; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE [PTsecurity] WeChat (Ransomware/Stealer) Config"; flow:established,to_client; content:"200"; http_stat_code; file_data; content:"md5"; depth:3; fast_pattern; content:"nnnn"; distance:12; within:4; content:"z"; distance:28; within:1; content:"z"; distance:32; within:1; content:"z"; distance:35; within:1; reference:url,thehackernews.com/2018/12/china-ransomware-wechat.html; classtype:trojan-activity; sid:2026687; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_12_05, deployment Perimeter, former_category MALWARE, malware_family Ransomware, malware_family Stealer, signature_severity Major, tag Ransomware, updated_at 2018_12_05, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"d7150af4514b868defb854db0f62a441"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028786; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET 27 (msg:"ET MALWARE ELF/Samba CnC Checkin"; flow:established,to_server; dsize:8; content:"|11 10 10 01 22 32 21 52|"; fast_pattern; reference:url,www.guardicore.com/2018/11/butter-brute-force-ssh-attack-tool-evolution; classtype:command-and-control; sid:2026717; rev:1; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2018_12_10, deployment Perimeter, former_category MALWARE, malware_family Samba, performance_impact Low, signature_severity Major, updated_at 2018_12_10;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"df5c30e670dba99f9270ed36060cf054"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028787; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE RedControle Probing Infected System"; flow:established,to_server; dsize:14; content:"SE_ND_CO_NN_EC"; fast_pattern; reference:url,threatvector.cylance.com/en_us/home/poking-the-bear-three-year-campaign-targets-russian-critical-infrastructure.html; reference:md5,855b937f668ecd90b8be004fd3c24717; classtype:trojan-activity; sid:2026723; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_12_13, deployment Perimeter, former_category TROJAN, malware_family RedControle, performance_impact Low, signature_severity Major, updated_at 2018_12_13;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"7dcce5b76c8b17472d024758970a406b"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028788; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert smb $HOME_NET any -> $HOME_NET any (msg:"ET MALWARE Shamoon v3 64bit Propagating Internally via SMB"; flow:to_server,established; content:"|00 00 00 00 00 00|"; content:"MZ"; distance:2; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; content:"|48 FF C5 42 0F B6|"; distance:0; fast_pattern; content:"|32 45|"; distance:2; within:2; content:"|41 88 41 FF|"; distance:1; within:4; reference:url,www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/new-version-of-disk-wiping-shamoon-disttrack-spotted-what-you-need-to-know; classtype:trojan-activity; sid:2026733; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Server, created_at 2018_12_14, deployment Perimeter, former_category TROJAN, malware_family Shamoon, performance_impact Low, signature_severity Major, tag SMB, tag Worm, tag Wiper, updated_at 2018_12_14;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"911479ac8a0813ed1241b3686ccdade9"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028789; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE AveMaria Initial CnC Checkin"; flow:established,to_server; dsize:12; content:"|29 bb 66 e4 00 00 00 00 00 00 00 00|"; fast_pattern; reference:url,app.any.run/tasks/67362469-76df-4b19-bfda-5d95a2b4d179; classtype:command-and-control; sid:2026736; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_12_15, deployment Perimeter, former_category MALWARE, malware_family AveMaria, performance_impact Low, signature_severity Major, tag Stealer, updated_at 2018_12_15;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"03e186a7f83285e93341de478334006e"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028790; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Visa Phishing Landing Jan 30 2014"; flow:established,to_server; content:"/Verified by Visa"; http_uri; nocase; http_referer; content:!"http|3a 2f 2f|www.crdbbank.com"; nocase; isdataat:!1,relative; classtype:social-engineering; sid:2018045; rev:6; metadata:created_at 2014_01_30, former_category PHISHING, updated_at 2021_06_23;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"17fd49722f8d11f3d76dce84f8e099a7"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028791; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MSIL.Orion Stealer Exfil via FTP"; flow:established,to_server; content:"STOR PC|3a 20|"; depth:9; content:"/Orion Logger - System Details|3a 20|"; distance:0; fast_pattern; reference:md5,007c4edc6e1ca963a9b2e05e136142f2; classtype:trojan-activity; sid:2026741; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_12_21, former_category TROJAN, updated_at 2018_12_21;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Trickbot"; ja3_hash; content:"fb00055a1196aeea8d1bc609885ba953"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028792; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Apple Phishing Redirect 2019-01-02"; flow:from_server,established; file_data; content:"<!--"; depth:4; content:"window.top.location='account/?view=login&appIdKey="; nocase; within:150; isdataat:!50,relative; classtype:social-engineering; sid:2026748; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2019_01_02, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2019_01_02;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"098f55e27d8c4b0a590102cbdb3a5f3a"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028793; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET COINMINER Random Hash Pascalcoin Miner Checkin"; flow:established,to_server; content:"{|22|params|22|:[|22|rhminer/"; depth:20; classtype:coin-mining; sid:2026750; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_01_02, deployment Perimeter, former_category COINMINER, signature_severity Major, tag Coinminer, updated_at 2019_01_02;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"e3b2ab1f9a56f2fb4c9248f2f41631fa"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028794; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TitanFox Loader CnC Checkin"; flow:established,to_server; dsize:<100; content:"|00 01 00 01 02 02 2b 6e 65 74 2e 74 63 70 3a 2f 2f|"; depth:30; fast_pattern; reference:url,app.any.run/tasks/421691f8-bb33-4be3-abcb-6ee36e772856; classtype:command-and-control; sid:2026759; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_01_04, deployment Perimeter, former_category MALWARE, malware_family TitanFox, performance_impact Low, signature_severity Major, tag Loader, updated_at 2019_01_04;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"46efd49abcca8ea9baa932da68fdb529"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028795; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-#alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Possible Call with No Offset UDP Shellcode"; content:"|E8 00 00 00 00 58|"; reference:url,community.rsa.com/community/products/netwitness/blog/2012/08/22/network-detection-of-x86-buffer-overflow-shellcode; classtype:shellcode-detect; sid:2012087; rev:3; metadata:created_at 2010_12_23, former_category SHELLCODE, updated_at 2010_12_23;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"b2b61db7b9490a60d270ccb20b462826"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028796; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Possible Call with No Offset UDP Shellcode"; content:"|E8 00 00 00 00 0F 1A|"; reference:url,community.rsa.com/community/products/netwitness/blog/2012/08/22/network-detection-of-x86-buffer-overflow-shellcode; classtype:shellcode-detect; sid:2012091; rev:4; metadata:created_at 2010_12_23, former_category SHELLCODE, updated_at 2010_12_23;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"92579701f145605e9edc0b01a901c6d5"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028797; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Possible Call with No Offset UDP Shellcode"; content:"|E8 00 00 00 00 0F A9|"; reference:url,community.rsa.com/community/products/netwitness/blog/2012/08/22/network-detection-of-x86-buffer-overflow-shellcode; classtype:shellcode-detect; sid:2012093; rev:4; metadata:created_at 2010_12_23, former_category SHELLCODE, updated_at 2010_12_23;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"7691297bcb20a41233fd0a0baa0a3628"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028798; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Possible Call with No Offset TCP Shellcode"; flow:established; content:"|E8 00 00 00 00 0F A9|"; reference:url,community.rsa.com/community/products/netwitness/blog/2012/08/22/network-detection-of-x86-buffer-overflow-shellcode; classtype:shellcode-detect; sid:2012092; rev:3; metadata:created_at 2010_12_23, former_category SHELLCODE, updated_at 2010_12_23;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"1543a7c46633acf71e8401baccbd0568"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028799; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Possible Call with No Offset TCP Shellcode"; flow:established; content:"|E8 00 00 00 00 0F 1A|"; reference:url,community.rsa.com/community/products/netwitness/blog/2012/08/22/network-detection-of-x86-buffer-overflow-shellcode; classtype:shellcode-detect; sid:2012090; rev:3; metadata:created_at 2010_12_23, former_category SHELLCODE, updated_at 2010_12_23;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Dridex"; ja3_hash; content:"d6f04b5a910115f4b50ecec09d40a1df"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028800; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET ![23,25,80,137,139,445] -> $EXTERNAL_NET 20000: (msg:"ET MALWARE Sourtoff Download Simda Request"; flow:established,to_server; dsize:18; content:"|0a 10|"; depth:2; flowbits:set,ET.TROJAN.Sourtoff; flowbits:noalert; reference:md5,5469af0daa10f8acbe552cd2f1f6a6bb; classtype:trojan-activity; sid:2019312; rev:3; metadata:created_at 2014_09_29, updated_at 2019_01_10;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"93d056782d649deb51cda44ecb714bb0"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028801; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-#alert tls $HOME_NET any -> $EXTERNAL_NET 853 (msg:"ET INFO DNS Over TLS Request Outbound"; flow:established,to_server; content:"|16 03 01 01|"; depth:4; reference:url,www.linuxbabe.com/ubuntu/ubuntu-stubby-dns-over-tls; classtype:trojan-activity; sid:2026774; rev:2; metadata:created_at 2019_01_10, former_category INFO, updated_at 2019_01_10;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"5e573c9c9f8ba720ef9b18e9fce2e2f7"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028802; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE AtomLogger Exfil via FTP"; flow:established,to_server; content:"Username|3a 20|"; content:"|0d 0a|Machine Name|3a 20|"; distance:0; content:"|0d 0a|Operating System|3a 20|"; distance:0; content:"|0d 0a|IP Address|3a 20|"; distance:0; content:"|0d 0a|Country|3a 20|"; distance:0; content:"|0d 0a|RAM|3a 20|"; distance:0; content:"|0d 0a|Online since|3a 20|"; distance:0; content:"|0d 0a 0d 0a 0d 0a 0d 0a|================================|0d 0a|Keystrokes and Window Log|0d 0a|"; distance:0; fast_pattern; reference:md5,78bd897a638e7c0d3c00c31c8c68f18b; classtype:trojan-activity; sid:2026824; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_01_17, deployment Perimeter, former_category TROJAN, malware_family AtomLogger, performance_impact Moderate, signature_severity Major, updated_at 2019_01_17;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"590a232d04d56409fab72e752a8a2634"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028803; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert udp $HOME_NET [!3389,1024:65535] -> $EXTERNAL_NET [!3389,1024:65535] (msg:"ET P2P Edonkey Search Request (search by name)"; dsize:>5; content:"|e3 98|"; depth:2; content:"|01|"; within:3; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003319; classtype:policy-violation; sid:2003319; rev:4; metadata:created_at 2010_07_30, updated_at 2019_01_18;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"849b04bdbd1d2b983f6e8a457e0632a8"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028804; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE [PTsecurity] Bitter RAT C2 Response"; flow:established,to_client; stream_size:client,=,1; stream_size:server,=,12; dsize:11; content:"|0b 00 d2 0b 00 00|"; offset:5; depth:6; reference:md5,fc516905e3237f1aa03a38a0dde84b52; classtype:command-and-control; sid:2026826; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_01_21, deployment Perimeter, former_category MALWARE, malware_family BitterRAT, performance_impact Low, signature_severity Major, tag RAT, updated_at 2019_01_22;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"9c2589e1c0e9f533a022c6205f9719e1"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028805; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [PTsecurity] Remcos RAT Checkin 85"; flow:established,to_server; content:"|c4 e2 a1 27 66 76 0b 6d bf 25 73|"; depth:11; reference:md5,c00606ac4ed2e1e8a5f503051c555e72; classtype:command-and-control; sid:2026852; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_01_24, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Remcos, updated_at 2019_01_24;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"96eba628dcb2b47607192ba74a3b55ba"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028806; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [PTsecurity] Remcos RAT Checkin 86"; flow:established,to_server; content:"|ce 4a a7 2f c0 8c 6d 5f 38 20 e9|"; depth:11; reference:md5,f78b75d64e5119f48c0644dfbcffba9d; classtype:command-and-control; sid:2026853; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_01_24, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Remcos, updated_at 2019_01_24;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"7c410ce832e848a3321432c9a82e972b"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028807; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert udp $HOME_NET 1024:65535 -> [$EXTERNAL_NET,!224.0.0.0/4] 1024:65535 (msg:"ET P2P ThunderNetwork UDP Traffic"; dsize:<38; content:"|32 00 00 00|"; depth:4; content:"|00 00 00 00|"; distance:1; threshold:type limit, track by_src, count 1, seconds 300; reference:url,xunlei.com; reference:url,en.wikipedia.org/wiki/Xunlei; reference:url,doc.emergingthreats.net/2009099; classtype:policy-violation; sid:2009099; rev:4; metadata:created_at 2010_07_30, updated_at 2019_01_28;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Adware"; ja3_hash; content:"f6fd83a21f9f3c5f9ff7b5c63bbc179d"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028808; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [PTsecurity] Remcos RAT Checkin 87"; flow:established,to_server; stream_size:server,=, 1; content:"|e9 9d ca 64 2d 84 6e 6b cc 48 16|"; depth:11; reference:md5,872fc6cc16b7ba7e2a74b03927d50e85; classtype:command-and-control; sid:2026862; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_01_30, deployment Perimeter, former_category MALWARE, malware_family Remcos, signature_severity Major, updated_at 2019_01_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Ransomware"; ja3_hash; content:"2d8794cb7b52b777bee2695e79c15760"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028809; rev:2; metadata:attack_target Client_Endpoint, created_at 2019_10_14, deployment Perimeter, former_category JA3, signature_severity Major, tag Ransomware, updated_at 2019_10_29, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Possible RTF File With Obfuscated Version Header"; flow:established,to_client; file_data; content:"{|5C|rt"; within:4; content:!"f"; within:1; classtype:bad-unknown; sid:2026863; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_01_30, deployment Perimeter, former_category INFO, signature_severity Major, updated_at 2019_01_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"fd80fa9c6120cdeea8520510f3c644ac"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028810; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $HOME_NET !80 -> $EXTERNAL_NET [!25,!445,!1500] (msg:"ET MALWARE Win32/BlackCarat XORed (0x77) CnC Checkin"; flow:established,to_server; dsize:>800; content:"|77 77|"; offset:2; depth:2; content:"|77|"; distance:1; within:1; content:"|77 77 77 77 77 77 77 77 77 77 77 77 77|"; distance:1; within:13; content:"|20 77 1e 77 19 77 13 77 18 77 00 77 04|"; distance:0; fast_pattern; content:!"|00 00 00 00 00 00|"; reference:md5,514AB639CD556CEBD78107B4A68A202A; reference:url,www.virusbulletin.com/uploads/pdf/conference_slides/2018/AncelKuprins-VB2018-WolfSheep.pdf; classtype:command-and-control; sid:2026525; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_10_18, deployment Perimeter, former_category MALWARE, malware_family BlackCarat, performance_impact Low, signature_severity Major, tag RAT, updated_at 2019_01_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Gozi"; ja3_hash; content:"57f3642b4e37e28f5cbe3020c9331b4c"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028811; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-#alert http $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE Possible ASPXSpy Request"; flow:established,from_server; content:"Thanks Snailsor,FuYu,BloodSword"; reference:url,doc.emergingthreats.net/2009146; classtype:web-application-activity; sid:2009146; rev:5; metadata:created_at 2010_07_30, former_category ATTACK_RESPONSE, updated_at 2010_07_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"906004246f3ba5e755b043c057254a29"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028812; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-#alert http $HTTP_SERVERS $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE Possible ASPXSpy Related Activity"; flow:established,from_server; content:"public string Password|3D 22|21232f297a57a5a743894a0e4a801fc3|22 3B|"; nocase; reference:url,doc.emergingthreats.net/2009147; classtype:web-application-activity; sid:2009147; rev:5; metadata:created_at 2010_07_30, former_category ATTACK_RESPONSE, updated_at 2010_07_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Trickbot"; ja3_hash; content:"c50f6a8b9173676b47ba6085bd0c6cee"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028813; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET ATTACK_RESPONSE Possible ASPXSpy Upload Attempt"; flow:established,to_server; content:"public string Password|3D 22|21232f297a57a5a743894a0e4a801fc3|22 3B|"; nocase; reference:url,doc.emergingthreats.net/2009149; classtype:web-application-activity; sid:2009149; rev:5; metadata:created_at 2010_07_30, former_category ATTACK_RESPONSE, updated_at 2010_07_30;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Gozi"; ja3_hash; content:"c201b92f8b483fa388be174d6689f534"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028814; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Observed Malicious SSL Cert (BrushaLoader CnC)"; flow:established,from_server; content:"traderserviceinfo.info"; fast_pattern; tls_cert_issuer; content:"C=AU, ST=Some-State, L=City, O=Some|20|Company"; classtype:domain-c2; sid:2026899; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2019_02_12, deployment Perimeter, former_category MALWARE, malware_family BrushaLoader, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2019_02_12, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"b90bdbe961a648f0427db21aaa6ccb59"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028815; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET 44818 (msg:"ET EXPLOIT Possible MicroLogix 1100 PCCC DoS Condition (CVE-2017-7924)"; flow:to_server,established; content:"|4b 02 20 67 24 01|"; content:"|a2|"; distance:0; content:"|05 47|"; distance:1; within:2; reference:cve,2017-7924; reference:url,rapid7.com/db/modules/auxiliary/dos/scada/allen_bradley_pccc; classtype:attempted-dos; sid:2026917; rev:1; metadata:created_at 2019_02_18, deployment Perimeter, former_category EXPLOIT, performance_impact Moderate, signature_severity Major, updated_at 2019_02_18;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - [Abuse.ch] Possible Tofsee"; ja3_hash; content:"9f62c4f26b90d3d757bea609e82f2eaf"; reference:url,sslbl.abuse.ch/ja3-fingerprints/; classtype:unknown; sid:2028816; rev:2; metadata:created_at 2019_10_14, former_category JA3, updated_at 2019_10_29;)
 
-alert smb any any -> $HOME_NET 445 (msg:"ET POLICY Powershell Command With Encoded Argument Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|p|00|o|00|w|00|e|00|r|00|s|00|h|00|e|00|l|00|l|00|"; nocase; distance:0; fast_pattern; content:"|00|-|00|e|00|n|00|c|00|"; nocase; distance:0; classtype:trojan-activity; sid:2025721; rev:3; metadata:attack_target SMB_Client, created_at 2018_07_17, deployment Perimeter, deployment Internal, former_category POLICY, performance_impact Low, signature_severity Major, updated_at 2019_02_18;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Trojan.AndroidOS.Jocker.snt 1"; ja3_hash; content:"2f514a024266e9e8d11f10e779168579"; reference:md5,68841dcaf26d83fc1c2f955e9e363a65; classtype:trojan-activity; sid:2029150; rev:2; metadata:affected_product Android, attack_target Mobile_Client, created_at 2019_12_16, deployment Perimeter, former_category JA3, signature_severity Critical, tag Android, updated_at 2019_12_16;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE DirectsX Checkin Response"; flow:established,from_server; dsize:25; content:"|19 00 00 00|"; offset:17; depth:4; content:!"|00 00|"; within:2; content:!"|ff ff|"; within:2; content:!"_loc"; reference:url,public.gdatasoftware.com/Presse/Publikationen/Whitepaper/EN/GDATA_TooHash_CaseStudy_102014_EN_v1.pdf; classtype:command-and-control; sid:2019633; rev:2; metadata:created_at 2014_11_04, former_category MALWARE, updated_at 2019_02_18;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 HASH - Possible BAZAR Backdoor CnC"; ja3.hash; content:"f5e62b5a2ed9467df09fae7a8a54dda6"; reference:url,www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html; classtype:unknown; sid:2030040; rev:1; metadata:created_at 2020_04_28, former_category JA3, updated_at 2020_04_28;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible SharpShooter Framework Generated Script"; flow:established,to_client; file_data; content:"rc4=function|28|key,str|29|"; nocase; content:"key.charCodeAt|28|i%key.length|29|"; fast_pattern; nocase; distance:0; content:"String.fromCharCode|28|str.charCodeAt|28|"; content:"decodeBase64=function"; nocase; distance:0; content:"b64block="; nocase; distance:0; reference:url,www.mdsec.co.uk/2018/03/payload-generation-using-sharpshooter/; reference:url,blog.morphisec.com/sharpshooter-pen-testing-framework-used-in-attacks; classtype:trojan-activity; sid:2026918; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2019_02_18, deployment Perimeter, former_category TROJAN, signature_severity Major, updated_at 2019_02_18;)
+#alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 HASH - Possible POSHC2 Client CnC"; flowbits:set,ET.poshc2.powershellclient; flowbits: noalert; ja3.hash; content:"c12f54a3f91dc7bafd92cb59fe009a35"; reference:url,labs.nettitude.com/blog/detecting-poshc2-indicators-of-compromise/; classtype:unknown; sid:2030366; rev:1; metadata:attack_target Client_Endpoint, created_at 2020_06_19, deployment Perimeter, former_category JA3, malware_family PoshC2, performance_impact Low, signature_severity Major, updated_at 2020_06_19;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible SharpShooter Framework Generated VBS Script"; flow:established,to_client; file_data; content:"RC4|28|byteMessage, strKey|29|"; nocase; content:"function decodeBase64|28|base64|29|"; nocase; distance:0; content:".createElement|28 22|tmp|22 29|"; nocase; distance:0; content:"decoded = decodeBase64|28|"; nocase; distance:0; reference:url,www.mdsec.co.uk/2018/03/payload-generation-using-sharpshooter/; reference:url,blog.morphisec.com/sharpshooter-pen-testing-framework-used-in-attacks; classtype:trojan-activity; sid:2026919; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2019_02_18, deployment Perimeter, former_category TROJAN, performance_impact Low, signature_severity Major, updated_at 2019_02_18;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET JA3 HASH - Possible POSHC2 Server Response"; flowbits:isset,ET.poshc2.powershellclient; ja3s.hash; content:"ec74a5c51106f0419184d0dd08fb05bc"; reference:url,labs.nettitude.com/blog/detecting-poshc2-indicators-of-compromise/; classtype:unknown; sid:2030367; rev:1; metadata:attack_target Client_Endpoint, created_at 2020_06_19, deployment Perimeter, former_category JA3, malware_family PoshC2, performance_impact Low, signature_severity Major, updated_at 2020_06_19;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO PowerShell NoProfile Command Received In Powershell Stagers"; flow:established,from_server; file_data; content:"powershell"; fast_pattern; nocase; content:"-nop"; nocase; distance:0; classtype:trojan-activity; sid:2026988; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_02_28, former_category INFO, performance_impact Low, signature_severity Minor, tag PowerShell, updated_at 2019_02_28;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 HASH - Possible InnocenceBot CnC"; ja3.hash; content:"9551e38f83daab8bcbc283ec0806cf65"; reference:md5,6a2749a5ab44dda4ed6459c8ca36ca64; classtype:unknown; sid:2030645; rev:1; metadata:attack_target Client_Endpoint, created_at 2020_08_04, deployment Perimeter, former_category JA3, performance_impact Low, signature_severity Major, updated_at 2020_08_04;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO PowerShell Hidden Window Command Common In Powershell Stagers M1"; flow:established,from_server; file_data; content:"powershell"; fast_pattern; nocase; content:"-w"; nocase; distance:0; content:"hidden"; within:17; classtype:trojan-activity; sid:2026989; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_02_28, former_category INFO, performance_impact Low, signature_severity Major, tag PowerShell, updated_at 2019_02_28;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 Hash - Remcos 3.x TLS Connection"; flow:established,to_server; ja3.hash; content:"a85be79f7b569f1df5e6087b69deb493"; classtype:command-and-control; sid:2036594; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2021_04_19, deployment Perimeter, former_category JA3, malware_family Remcos, signature_severity Major, updated_at 2021_04_19;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO PowerShell Hidden Window Command Common In Powershell Stagers M2"; flow:established,from_server; file_data; content:"powershell"; fast_pattern; nocase; content:"-w 1"; nocase; distance:0; classtype:trojan-activity; sid:2026990; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_02_28, former_category INFO, performance_impact Low, signature_severity Major, tag PowerShell, updated_at 2019_02_28;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 HASH - Possible RustyBuer Client Activity"; flowbits:set,ET.rustybuer; flowbits: noalert; ja3.hash; content:"6cc312d5b10bcbc97c4619603a24131b"; reference:md5,ea98a9d6ca6f5b2a0820303a1d327593; classtype:bad-unknown; sid:2032959; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_05_13, deployment Perimeter, former_category JA3, malware_family RustyBuer, performance_impact Low, signature_severity Major, updated_at 2021_05_13;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO PowerShell NonInteractive Command Common In Powershell Stagers"; flow:established,from_server; file_data; content:"powershell"; fast_pattern; nocase; content:"-noni"; nocase; distance:0; classtype:trojan-activity; sid:2026991; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_02_28, former_category INFO, performance_impact Low, signature_severity Major, tag PowerShell, updated_at 2019_02_28;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET JA3 HASH - Possible RustyBuer Server Response"; flowbits:isset,ET.rustybuer; ja3s.hash; content:"f6dfdd25d1522e4e1c7cd09bd37ce619"; reference:md5,ea98a9d6ca6f5b2a0820303a1d327593; classtype:bad-unknown; sid:2032960; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_05_13, deployment Perimeter, former_category JA3, malware_family RustyBuer, performance_impact Low, signature_severity Major, updated_at 2021_05_13;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO PowerShell Base64 Encoded Content Command Common In Powershell Stagers M2"; flow:established,from_server; file_data; content:"powershell"; fast_pattern; nocase; content:"FromBase64String|28|"; nocase; distance:0; classtype:trojan-activity; sid:2026993; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_02_28, former_category INFO, performance_impact Low, signature_severity Major, tag PowerShell, updated_at 2019_02_28;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET JA3 HASH - Possible Rclone Client Response (Mega Storage)"; flowbits:isset,ET.rclone; ja3s.hash; content:"eb1d94daa7e0344597e756a1fb6e7054"; reference:url,twitter.com/NCCGroupInfosec/status/1398137873954652163; classtype:bad-unknown; sid:2033055; rev:1; metadata:created_at 2021_05_28, former_category JA3, updated_at 2021_05_28;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO PowerShell DownloadFile Command Common In Powershell Stagers"; flow:established,from_server; file_data; content:"powershell"; fast_pattern; nocase; content:"DownloadFile|28|"; nocase; distance:0; classtype:trojan-activity; sid:2026994; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_02_28, former_category INFO, performance_impact Low, signature_severity Major, tag PowerShell, updated_at 2019_02_28;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET JA3 HASH - Possible Rclone Client Response (Mega Storage)"; flowbits:isset,ET.rclone; ja3s.hash; content:"b607b6456e5d8a98efa7eb7f15029431"; reference:url,twitter.com/NCCGroupInfosec/status/1398137873954652163; classtype:bad-unknown; sid:2033056; rev:1; metadata:created_at 2021_05_28, former_category JA3, updated_at 2021_05_28;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO PowerShell DownloadString Command Common In Powershell Stagers"; flow:established,from_server; file_data; content:"powershell"; fast_pattern; nocase; content:"DownloadString|28|"; nocase; distance:0; classtype:trojan-activity; sid:2026995; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_02_28, former_category INFO, performance_impact Low, signature_severity Major, tag PowerShell, updated_at 2019_02_28;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 HASH - Possible Rclone Client Activity"; flowbits:set,ET.rclone; flowbits:noalert; ja3.hash; content:"d0ee3237a14bbd89ca4d2b5356ab20ba"; tls.sni; content:!"grafana.com"; content:!"grafana.org"; content:!"grafana.net"; reference:url,twitter.com/NCCGroupInfosec/status/1398137873954652163; classtype:bad-unknown; sid:2033047; rev:2; metadata:created_at 2021_05_28, former_category JA3, updated_at 2021_05_28;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO PowerShell DownloadData Command Common In Powershell Stagers"; flow:established,from_server; file_data; content:"powershell"; fast_pattern; nocase; content:"DownloadData|28|"; nocase; distance:0; classtype:trojan-activity; sid:2026996; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_02_28, former_category INFO, performance_impact Low, signature_severity Major, tag PowerShell, updated_at 2019_02_28;)
+alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET JA3 HASH - Possible Nessus Client"; ja3.hash; content:"9598288c48f0a784d8e153b0df2b3bd1"; classtype:bad-unknown; sid:2033150; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_06_17, deployment Perimeter, former_category JA3, performance_impact Low, signature_severity Informational, updated_at 2021_06_17;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded New-Object (V3LU9) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"V3LU9"; fast_pattern; distance:0; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026920; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET JA3 HASH - Possible Cobalt Strike Server"; flowbits:isset,ET.cobaltstrike.ja3; ja3s.hash; content:"eb1d94daa7e0344597e756a1fb6e7054"; reference:url,thedfirreport.com/2021/06/20/from-word-to-lateral-movement-in-1-hour/; classtype:bad-unknown; sid:2033157; rev:1; metadata:created_at 2021_06_22, former_category JA3, updated_at 2021_06_22;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded New-Object (ctT2J) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"ctT2J"; fast_pattern; distance:0; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026921; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET JA3 HASH - Possible Cobalt Strike Server"; flowbits:isset,ET.cobaltstrike.ja3; ja3s.hash; content:"aa29d305dff6e6ac9cd244a62c6ad0c2"; reference:url,thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/; classtype:bad-unknown; sid:2033395; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_07_23, deployment Perimeter, former_category JA3, malware_family Cobalt_Strike, signature_severity Major, updated_at 2021_07_23, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1001, mitre_technique_name Data_Obfuscation;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded New-Object (dy1PYmp) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"dy1PYmp"; fast_pattern; distance:0; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026922; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET JA3 HASH - Possible Cobalt Strike Server"; flowbits:isset,ET.cobaltstrike.ja3; ja3s.hash; content:"ae4edc6faf64d08308082ad26be60767"; reference:url,thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/; classtype:bad-unknown; sid:2033396; rev:1; metadata:attack_target Client_Endpoint, created_at 2021_07_23, deployment Perimeter, former_category JA3, malware_family Cobalt_Strike, signature_severity Major, updated_at 2021_07_23, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1001, mitre_technique_name Data_Obfuscation;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded New-Object (V3LU9iam) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"V3LU9iam"; fast_pattern; distance:0; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026923; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+alert tls $EXTERNAL_NET [!25,!587] -> $HOME_NET any (msg:"ET JA3 Hash - Suspected Cobalt Strike Malleable C2 (ja3s) M1"; flow:established,from_server; ja3s.hash; content:"649d6810e8392f63dc311eecb6b7098b"; tls.cert_subject; content:!"servicebus.windows.net"; flowbits:isset,ET.cobaltstrike.ja3; classtype:command-and-control; sid:2028832; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_10_15, deployment Perimeter, former_category JA3, malware_family Cobalt_Strike, malware_family Cobalt_Strike, signature_severity Major, updated_at 2021_08_25, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1001, mitre_technique_name Data_Obfuscation;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded New-Object (XctT2JqZW) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"XctT2JqZW"; fast_pattern; distance:0; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026924; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+alert tls $HOME_NET any -> $EXTERNAL_NET [465,993] (msg:"ET JA3 HASH - Possible AnchorMail CnC Traffic"; flow:established,to_server; ja3.hash; content:"c216e752cae6f8755fd27f561d031636"; reference:url,securityintelligence.com/posts/new-malware-trickbot-anchordns-backdoor-upgrades-anchormail/; reference:md5,139e70aa7f26f998c1058c270a51783d; classtype:command-and-control; sid:2035359; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_01, deployment Perimeter, former_category JA3, signature_severity Major, updated_at 2022_03_01;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded New-Object (dy1PYmplY3) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"dy1PYmplY3"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026925; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+# Emerging Threats 
+#
+# This distribution may contain rules under two different licenses. 
+#
+#  Rules with sids 1 through 3464, and 100000000 through 100000908 are under the GPLv2.
+#  A copy of that license is available at http://www.gnu.org/licenses/gpl-2.0.html
+#
+#  Rules with sids 2000000 through 2799999 are from Emerging Threats and are covered under the BSD License 
+#  as follows:
+#
+#*************************************************************
+#  Copyright (c) 2003-2022, Emerging Threats
+#  All rights reserved.
+#  
+#  Redistribution and use in source and binary forms, with or without modification, are permitted provided that the 
+#  following conditions are met:
+#  
+#  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following 
+#    disclaimer.
+#  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the 
+#    following disclaimer in the documentation and/or other materials provided with the distribution.
+#  * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived 
+#    from this software without specific prior written permission.
+#  
+#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES, 
+#  INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
+#  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 
+#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
+#  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 
+#  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE 
+#  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+#
+#*************************************************************
+#
+#
+#
+#
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Start-Process (FydC1Qcm9) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"FydC1Qcm9"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026926; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+# This Ruleset is EmergingThreats Open optimized for suricata-5.0-enhanced.
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Start-Process (RhcnQtUHJ) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"RhcnQtUHJ"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026927; rev:2; metadata:attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Psyb0t joining an IRC Channel"; flow:established,to_server; flowbits:isset,is_proto_irc; content:"JOIN #mipsel"; reference:url,www.adam.com.au/bogaurd/PSYB0T.pdf; reference:url,doc.emergingthreats.net/2009172; classtype:trojan-activity; sid:2009172; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Start-Process (YXJ0LVByb2N) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"YXJ0LVByb2N"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026928; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE SC-KeyLog Keylogger Installed - Sending Initial Email Report"; flow:established,to_server; content:"Installation of SC-KeyLog on host "; nocase; content:"<p>You will receive a log report every "; nocase; reference:url,www.soft-central.net/keylog.php; reference:url,doc.emergingthreats.net/2002979; classtype:trojan-activity; sid:2002979; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Start-Process (RhcnQtUHJvY2) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"RhcnQtUHJvY2"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026929; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE SC-KeyLog Keylogger Installed - Sending Log Email Report"; flow:established,to_server; content:"SC-KeyLog log report"; nocase; content:"See attached file"; nocase; content:".log"; nocase; reference:url,www.soft-central.net/keylog.php; reference:url,doc.emergingthreats.net/2008348; classtype:trojan-activity; sid:2008348; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Start-Process (GFydC1Qcm9jZX) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"GFydC1Qcm9jZX"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026930; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Bugbear@MM virus via SMTP"; flow: established; content:"uv+LRCQID7dIDFEECggDSLm9df8C/zSNKDBBAAoGA0AEUQ+FEN23f7doqAT/dCQk/xWcEQmDxCTD"; reference:url,www.symantec.com/avcenter/venc/data/w32.bugbear@mm.html; reference:url,doc.emergingthreats.net/2001764; classtype:misc-activity; sid:2001764; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Start-Process (YXJ0LVByb2Nlc3) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"YXJ0LVByb2Nlc3"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026931; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1433 (msg:"ET MALWARE Outbound AVISOSVB MSSQL Request"; flow:established,to_server; content:"|54 00 42 00 4c 00 5f 00 41 00 56 00 49 00 53 00 4f 00 53 00 56 00 42 00|"; reference:url,doc.emergingthreats.net/2011199; reference:md5,1f5b6d6d94cc6272c937045e22e6d192; classtype:trojan-activity; sid:2011199; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-WmiMethod (Zva2UtV21pTWV) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"Zva2UtV21pTWV"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026932; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer Command Execution"; flow:established; content:"|C2 E5 E5 E5 9E DD A4 A3 D4 A6 D4 D3 D1 C8 A0 A7 A1 D3 C8 D1 87 D7 87 C8 A7 A6 D4 A3 C8 D3 D1 D3 D2 D1 A0 DC DD A4 D2 D4 D5 98 E5|"; reference:url,doc.emergingthreats.net/2010909; classtype:trojan-activity; sid:2010909; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-WmiMethod (52b2tlLVdtaU1) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"52b2tlLVdtaU1"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026933; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer DIR Listing"; flow:established; content:"|C2 E5 E5 E5 9E D5 D4 D2 D1 A1 D7 A3 A6 C8 D2 A6 A7 D3 C8 D1 84 D7 D7 C8 DD D2 A6 D2 C8 D2 A7 A7 D2 D7 A4 D6 D7 A3 D4 DC A3 98 E5|"; reference:url,doc.emergingthreats.net/2010910; classtype:trojan-activity; sid:2010910; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-WmiMethod (dm9rZS1XbWlNZXR) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"dm9rZS1XbWlNZXR"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026934; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer WRITE FILE command"; flow: established; content:"|C2 E5 E5 E5 9E DC DD A1 DC D0 DD A3 A6 C8 A1 D5 A4 D7 C8 D1 83 D4 86 C8 A7 DD D1 D4 C8 D7 D6 D7 A4 A7 D6 D0 D2 A0 D2 A6 DD 98 E5|"; reference:url,doc.emergingthreats.net/2010911; classtype:trojan-activity; sid:2010911; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-WmiMethod (52b2tlLVdtaU1ldG) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"52b2tlLVdtaU1ldG"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026935; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer READ FILE Command"; flow:established; content:"|C2 E5 E5 E5 9E A3 D3 A6 D1 D6 A0 D4 A4 C8 D4 D0 D0 D4 C8 D1 D5 D5 D5 C8 A4 D1 DD D6 C8 A6 D6 D3 D4 DC D3 DC A4 A0 A6 D1 D4 98 E5|"; reference:url,doc.emergingthreats.net/2010912; classtype:trojan-activity; sid:2010912; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-WmiMethod (nZva2UtV21pTWV0aG) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"nZva2UtV21pTWV0aG"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026936; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer NOP Command"; flow:established; content:"|C2 E5 E5 E5 9E D2 DD D6 A0 A4 A6 A7 A3 C8 A0 A3 DD A7 C8 D1 DC DD 80 C8 A4 D5 D0 DC C8 A3 D5 A7 D0 A7 A1 D4 D7 D3 D1 D4 A0 98 E5|"; reference:url,doc.emergingthreats.net/2010913; classtype:trojan-activity; sid:2010913; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-WmiMethod (dm9rZS1XbWlNZXRob2) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"dm9rZS1XbWlNZXRob2"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026937; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer FIND FILE Command"; flow:established; content:"|C2 E5 E5 E5 9E A0 A4 D2 A4 D7 A0 A7 D2 C8 D4 A0 D1 DC C8 D1 81 D0 83 C8 A7 D1 A1 DD C8 A1 D3 D3 D1 D0 A7 D2 D1 D1 D5 A0 D6 98 E5|"; reference:url,doc.emergingthreats.net/2010914; classtype:trojan-activity; sid:2010914; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-Command (Zva2UtQ29) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"Zva2UtQ29"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026938; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer YES Command"; flow:established; content:"|C2 E5 E5 E5 9E A0 D7 A4 A6 D0 D5 DD DC C8 D6 DD D7 D5 C8 D1 D6 83 80 C8 DD A4 D1 A1 C8 A4 D2 D5 D7 DD A3 A4 A1 DD A6 D7 DD 98 E5|"; reference:url,doc.emergingthreats.net/2010915; classtype:trojan-activity; sid:2010915; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-Command (dm9rZS1Db21) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"dm9rZS1Db21"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026939; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer ADD RUN ONCE Command"; flow:established; content:"|C2 E5 E5 E5 9E D6 DD D1 A0 A7 A0 D7 A6 C8 A3 DC A0 A4 C8 D1 83 D3 87 C8 DC D1 A0 A3 C8 A6 DC A1 D7 A1 A4 D0 DD A3 A1 D4 D6 98 E5|"; reference:url,doc.emergingthreats.net/2010916; classtype:trojan-activity; sid:2010916; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-Command (nZva2UtQ29tbW) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"nZva2UtQ29tbW"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026940; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET MALWARE Arucer DEL FILE Command"; flow:established; content:"|C2 E5 E5 E5 9E D1 A3 D1 A3 D5 A1 DD DD C8 A0 D2 D4 D0 C8 D1 87 D4 83 C8 A7 D6 D4 D4 C8 D3 D4 A0 D0 D6 D5 A6 D7 A6 DD A3 A6 98 E5|"; reference:url,doc.emergingthreats.net/2010917; classtype:trojan-activity; sid:2010917; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-Command (52b2tlLUNvbW1) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"52b2tlLUNvbW1"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026941; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET MALWARE Aurora Backdoor (C&C) client connection to CnC"; flow:established,to_server; content:"|ff ff ff ff ff ff 00 00 fe ff ff ff ff ff ff ff ff ff 88 ff|"; depth:20; flowbits:set,ET.aurora.init; reference:url,www.trustedsource.org/blog/373/An-Insight-into-the-Aurora-Communication-Protocol; reference:url,doc.emergingthreats.net/2010695; classtype:command-and-control; sid:2010695; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-Command (dm9rZS1Db21tYW) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"dm9rZS1Db21tYW"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026942; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Aurora Backdoor (C&C) connection CnC response"; flowbits:isset,ET.aurora.init; flow:established,from_server; content:"|cc cc cc cc cd cc cc cc cd cc cc cc cc cc cc cc|"; depth:16; reference:url,www.trustedsource.org/blog/373/An-Insight-into-the-Aurora-Communication-Protocol; reference:url,doc.emergingthreats.net/2010696; classtype:command-and-control; sid:2010696; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE PowerShell Execution String Base64 Encoded Invoke-Command (52b2tlLUNvbW1hbm) in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"52b2tlLUNvbW1hbm"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2026943; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_19, deployment Perimeter, former_category CURRENT_EVENTS, malware_family DNSlivery, signature_severity Major, updated_at 2019_02_19;)
+#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor Possible Backdoor.Cow Varient (Backdoor.Win32.Agent.lam) C&C traffic"; content:"|6C 3C|"; depth:2; content:"|3E 20|"; within:3; content:"bid="; nocase; within:20; content:"bver="; nocase; within:20; content:"bip="; nocase; within:20; content:"bn="; nocase; within:20; reference:url,doc.emergingthreats.net/2008465; classtype:command-and-control; sid:2008465; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF8 base64 string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"hpcyBwcm9"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027027; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_05, deployment Perimeter, former_category ATTACK_RESPONSE, malware_family DNSlivery, signature_severity Major, updated_at 2019_03_05;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 8000 (msg:"ET MALWARE Backdoor.Hupigon Possible Control Connection Being Established"; flow:established,to_server; dsize:4; content:"|00 00 00 00|"; flowbits:set,BSHupigonControlStart; reference:url,www.avira.com/en/threats/section/fulldetails/id_vir/1051/bds_hupigon.bo.html; reference:url,doc.emergingthreats.net/2002974; classtype:trojan-activity; sid:2002974; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF8 base64 string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"lzIHByb2d"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027028; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_05, deployment Perimeter, former_category ATTACK_RESPONSE, malware_family DNSlivery, signature_severity Major, updated_at 2019_03_05;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 8000 (msg:"ET MALWARE Backdoor.Hupigon INFECTION - Reporting Host Type"; flow:established,to_server; flowbits:isset,BSHupigonControlStart; content:"Windows "; flowbits:isset,BSHupigonControlStart; reference:url,www.avira.com/en/threats/section/fulldetails/id_vir/1051/bds_hupigon.bo.html; reference:url,doc.emergingthreats.net/2002975; classtype:trojan-activity; sid:2002975; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF8 base64 string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"aXMgcHJvZ3J"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027029; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_05, deployment Perimeter, former_category ATTACK_RESPONSE, malware_family DNSlivery, signature_severity Major, updated_at 2019_03_05;)
+#alert tcp $HOME_NET !$HTTP_PORTS -> $EXTERNAL_NET 1337 (msg:"ET MALWARE Win32.SkSocket C&C Connection"; flow:established,to_server; flags:PA,12; dsize:1; content:"|04|"; reference:url,doc.emergingthreats.net/2007585; classtype:command-and-control; sid:2007585; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF16-LE base64 string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"hpcyBwcm9ncm"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027030; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_05, deployment Perimeter, former_category ATTACK_RESPONSE, malware_family DNSlivery, signature_severity Major, updated_at 2019_03_05;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor.Win32.VB.brg C&C Checkin"; flow:established,to_server; content:"Status|2a 28|Idle|2e 2e 2e 29 2a|"; depth:17; offset:0; reference:url,doc.emergingthreats.net/2007922; classtype:command-and-control; sid:2007922; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF16-LE base64 string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"GlzIHByb2dyYW"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027031; rev:2; metadata:attack_target DNS_Server, created_at 2019_03_05, deployment Perimeter, former_category ATTACK_RESPONSE, malware_family DNSlivery, signature_severity Major, updated_at 2019_03_05;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor.Win32.VB.brg C&C Reporting Version"; flow:established,to_server; content:"Version|28 2a|"; depth:9; offset:0; content:"|29 2a|"; within:8; reference:url,doc.emergingthreats.net/2007979; classtype:command-and-control; sid:2007979; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF16-LE base64 string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"aXMgcHJvZ3JhbS"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027032; rev:2; metadata:created_at 2019_03_05, former_category ATTACK_RESPONSE, updated_at 2019_03_05;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor.Win32.VB.brg C&C Kill Command Acknowledge"; flow:established,to_server; dsize:29; content:"Status|28 2a|UDP Attack Running!|2a 28|"; offset:0; reference:url,doc.emergingthreats.net/2007981; classtype:command-and-control; sid:2007981; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF8 base64 wide string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"gAaQBzACAAcAByAG8AZwByAGE"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027033; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_05, deployment Perimeter, former_category ATTACK_RESPONSE, malware_family DNSlivery, signature_severity Major, updated_at 2019_03_05;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor.Win32.VB.brg C&C DDoS Outbound"; flow:established,from_server; dsize:>100; content:"|ff ff ff ff|"; depth:4; content:" own you bitch!"; within:20; content:"|01 01 01 01 01 01 01 01 01 01 01 01 01|"; reference:url,doc.emergingthreats.net/2007982; classtype:command-and-control; sid:2007982; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF8 base64 wide string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"BoAGkAcwAgAHAAcgBvAGcAcgB"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027034; rev:2; metadata:created_at 2019_03_05, updated_at 2019_03_05;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Bandook v1.2 Initial Connection and Report"; flowbits:isnotset,BE.Bandook1.2; flow:established,to_server; content:"&first& # "; pcre:"/# \d+d \d+dh \d+m # /iR"; flowbits:set,BE.Bandook1.2; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003549; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF8 base64 wide string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"aABpAHMAIABwAHIAbwBnAHIAYQB"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027035; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_05, deployment Perimeter, former_category ATTACK_RESPONSE, malware_family DNSlivery, signature_severity Major, updated_at 2019_03_05;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Bandook v1.2 Get Processes"; flowbits:isset,BE.Bandook1.2; flow:established,to_server; dsize:8; content:"|99 9b 86 8a 85 80 9a 9d|"; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003550; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF16-LE base64 wide string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"BoAGkAcwAgAHAAcgBvAGcAcgBhAG"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027036; rev:2; metadata:created_at 2019_03_05, updated_at 2019_03_05;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Bandook v1.2 Kill Process Command"; flowbits:isset,BE.Bandook1.2; flow:established,to_server; dsize:>8; content:"kill3d"; offset:0; depth:6; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003551; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF16-LE base64 wide string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"GgAaQBzACAAcAByAG8AZwByAGEAbQ"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027037; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_05, deployment Perimeter, former_category ATTACK_RESPONSE, malware_family DNSlivery, signature_severity Major, updated_at 2019_03_05;)
+#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.2 Reporting Socks Proxy Active"; flowbits:isset,BE.Bandook1.2; flow:established,from_server; dsize:7; content:"sockson"; offset:0; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003552; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF16-LE base64 wide string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"aABpAHMAIABwAHIAbwBnAHIAYQBtAC"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027038; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_05, deployment Perimeter, former_category ATTACK_RESPONSE, malware_family CoinMiner, signature_severity Major, updated_at 2019_03_05;)
+#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.2 Reporting Socks Proxy Off"; flowbits:isset,BE.Bandook1.2; flow:established,from_server; dsize:8; content:"socksoff"; offset:0; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003553; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF8 base64 reversed string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"FyZ29ycCB"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027039; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_05, deployment Perimeter, former_category ATTACK_RESPONSE, malware_family DNSlivery, signature_severity Major, updated_at 2019_03_05;)
+#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.2 Client Ping Reply"; flowbits:isset,BE.Bandook1.2; flow:established,from_server; dsize:10; content:"&SEXREPLY&"; offset:0; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003554; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF8 base64 reversed string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"1hcmdvcnA"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027040; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_05, deployment Perimeter, former_category ATTACK_RESPONSE, malware_family DNSlivery, signature_severity Major, updated_at 2019_03_05;)
+#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.35 Keepalive Send"; flowbits:isset,BE.Bandook1.35; flow:established,from_server; dsize:6; content:"|cf ab a8 a7 ae cf|"; offset:0; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003556; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF8 base64 reversed string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"YXJnb3JwIHN"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027041; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_05, deployment Perimeter, former_category ATTACK_RESPONSE, malware_family DNSlivery, signature_severity Major, updated_at 2019_03_05;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Bandook v1.35 Keepalive Reply"; flowbits:isset,BE.Bandook1.35; flow:established,to_server; dsize:9; content:"|cf ab a8 a4 ae cf 26 26 26|"; offset:0; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003557; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF16 base64 reversed string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"1hcmdvcnAgc2"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027042; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_05, deployment Perimeter, former_category ATTACK_RESPONSE, malware_family DNSlivery, signature_severity Major, updated_at 2019_03_05;)
+#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.35 Create Registry Key Command Send"; flowbits:isset,BE.Bandook1.35; flow:established,from_server; dsize:>10; content:"|cf 9b 8c 8e 8a 9b cf|"; offset:0; depth:7; content:"|95|"; distance:5; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003558; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF16 base64 reversed string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"WFyZ29ycCBzaW"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027043; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_05, deployment Perimeter, former_category ATTACK_RESPONSE, malware_family DNSlivery, signature_severity Major, updated_at 2019_03_05;)
+#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.35 Create Directory Command Send"; flowbits:isset,BE.Bandook1.35; flow:established,from_server; dsize:>7; content:"|cf 84 82 8d 80 9b cf 95|"; offset:0; depth:8; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003559; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE UTF16 base64 reversed string /This Program/ in DNS TXT Reponse"; content:"|00 00 10 00 01 c0 0c 00 10 00 01|"; content:"YXJnb3JwIHNpaF"; distance:0; fast_pattern; reference:url,github.com/no0be/DNSlivery; classtype:bad-unknown; sid:2027044; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_05, deployment Perimeter, former_category ATTACK_RESPONSE, malware_family DNSlivery, signature_severity Major, updated_at 2019_03_05;)
+#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.35 Window List Command Send"; flowbits:isset,BE.Bandook1.35; flow:established,from_server; dsize:10; content:"|cf 8e 80 84 84 8c 9e 80 87 cf|"; offset:0; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003560; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO PowerShell Base64 Encoded Content Command Common In Powershell Stagers M1"; flow:established,from_server; file_data; content:"powershell"; fast_pattern; nocase; content:"|20|-e"; nocase; distance:0; pcre:"/^(?:nc)?\s*(?:[A-Z0-9+\/]{4})*(?:[A-Z0-9+\/]{2}==|[A-Z0-9+\/]{3}=)/Ri"; classtype:trojan-activity; sid:2026992; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_02_28, former_category INFO, performance_impact Low, signature_severity Major, tag PowerShell, updated_at 2019_03_05;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Bandook v1.35 Window List Reply"; flowbits:isset,BE.Bandook1.35; flow:established,to_server; dsize:>10; content:"|cf 9e 80 87 85 80 9a 9d cf|"; offset:0; depth:9; content:"|26 26 26|"; distance:10; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003561; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Py/MechaFlounder CnC Activity - Reporting Download Command Success"; flow:established,to_server; content:!"HTTP|2f|"; content:"2A2A646F776E6C6F61642073756363657373"; fast_pattern; reference:url,unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/; classtype:command-and-control; sid:2027049; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2019_03_06, deployment Perimeter, former_category MALWARE, malware_family MechaFlounder, performance_impact Low, signature_severity Major, tag APT, tag Chafer, tag Python, updated_at 2019_03_06;)
+#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.35 Get Processes Command Send"; flowbits:isset,BE.Bandook1.35; flow:established,from_server; dsize:8; content:"|99 9b 86 8a 85 80 9a 9d|"; offset:0; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003562; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Py/MechaFlounder CnC Activity - Reporting Download Command Error"; flow:established,to_server; content:!"HTTP|2f|"; content:"2A2A646F776E6C6F6164206661696C65642C"; fast_pattern; reference:url,unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/; classtype:command-and-control; sid:2027050; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2019_03_06, deployment Perimeter, former_category MALWARE, malware_family MechaFlounder, performance_impact Low, signature_severity Major, tag APT, tag Chafer, tag Python, updated_at 2019_03_06;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Bandook v1.35 Get Processes Command Reply"; flowbits:isset,BE.Bandook1.35; flow:established,to_server; dsize:>10; content:"|cf 9d 82 99 9b 86 8a cf|"; offset:0; depth:8; content:"|26 26 26|"; distance:10; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003565; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Py/MechaFlounder CnC Activity - Reporting Upload Command Success"; flow:established,to_server; content:!"HTTP|2f|"; content:"2A2A75706C6F61642073756363657373"; fast_pattern; reference:url,unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/; classtype:command-and-control; sid:2027051; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2019_03_06, deployment Perimeter, former_category MALWARE, malware_family MechaFlounder, performance_impact Low, signature_severity Major, tag APT, tag Chafer, tag Python, updated_at 2019_03_06;)
+#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Bandook v1.35 Start Socks5 Proxy Command Send"; flowbits:isset,BE.Bandook1.35; flow:established,from_server; dsize:>6; content:"|a7 a0 a7 ae 95|"; offset:0; depth:5; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003563; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Py/MechaFlounder CnC Activity - Reporting Upload Command Error"; flow:established,to_server; content:!"HTTP|2f|"; content:"2A2A75706C6F6164206661696C65642C"; fast_pattern; reference:url,unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/; classtype:command-and-control; sid:2027052; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2019_03_06, deployment Perimeter, former_category MALWARE, malware_family MechaFlounder, performance_impact Low, signature_severity Major, tag APT, tag Chafer, tag Python, updated_at 2019_03_06;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Bandook v1.35 Socks5 Proxy Start Command Reply"; flowbits:isset,BE.Bandook1.35; flow:established,to_server; dsize:10; content:"|9a 86 8a 82 9a 86 87 26 26 26|"; offset:0; reference:url,www.nuclearwintercrew.com; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=Bandook&threatid=40408; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanBandook; classtype:trojan-activity; sid:2003564; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Py/MechaFlounder CnC Activity - Reporting Directory Change Command Success"; flow:established,to_server; content:!"HTTP|2f|"; content:"2A2A6469726563746F7279206368616E6765642073756363657373"; fast_pattern; reference:url,unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/; classtype:command-and-control; sid:2027053; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2019_03_06, deployment Perimeter, former_category MALWARE, malware_family MechaFlounder, performance_impact Low, signature_severity Major, tag APT, tag Chafer, tag Python, updated_at 2019_03_06;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Bandok phoning home (xor by 0xe9 to decode)"; flow:established,to_server; content:"|CF 8F 80 9B 9A 9D CF 95|"; depth:8; dsize:<80; reference:url,www.dshield.org/diary.html?date=2007-03-28; reference:url,www.secureworks.com/research/threats/bbbphish/?threat=bbbphish; reference:url,doc.emergingthreats.net/2003936; classtype:trojan-activity; sid:2003936; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Py/MechaFlounder CnC Activity - Reporting Sleep Command Success"; flow:established,to_server; content:!"HTTP|2f|"; content:"2A2A72756E74696D65206368616E67656420746F2072756E74696D65"; fast_pattern; reference:url,unit42.paloaltonetworks.com/new-python-based-payload-mechaflounder-used-by-chafer/; classtype:command-and-control; sid:2027048; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2019_03_06, deployment Perimeter, former_category MALWARE, malware_family MechaFlounder, performance_impact Low, signature_severity Major, tag APT, tag Chafer, tag Python, updated_at 2019_03_07;)
+#alert udp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Banker.ike UDP C&C"; content:"|86 71 3b 72 50 61 7d 95 5f 61 46|"; nocase; reference:url,doc.emergingthreats.net/2007957; classtype:command-and-control; sid:2007957; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [AV] EarthWorm/Termite IoT Agent Reporting Infection"; dsize:<500; flow:established,to_server; content:"|00 00 00 01|"; offset:1; depth:4; content:"|00 00 00 01 6b 00 00 00 01|"; distance:7; within:9; fast_pattern; content:"agent"; distance:4; within:5; pcre:"/^\x00+?[\x20-\x7f]+?\x00+?$/R"; reference:url,github.com/anhilo/xiaogongju/tree/422136c014ba6b95ad3a746662be88372eb11b09; reference:url,www.alienvault.com/blogs/labs-research/internet-of-termites; classtype:trojan-activity; sid:2027064; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_07, deployment Perimeter, former_category TROJAN, malware_family Termite, malware_family EarthWorm, performance_impact Moderate, signature_severity Major, updated_at 2019_03_07;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Banker Trojan CnC AddNew Command"; flow:established,to_server; dsize:<120; content:"[S]ADDNEW|7c|"; depth:10; reference:url,doc.emergingthreats.net/2009862; classtype:command-and-control; sid:2009862; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE EarthWorm/Termite IoT Agent CnC Response"; dsize:<500; flow:established,from_server; content:"|00 00 00 01|"; offset:1; depth:4; content:"|00 00 00 01 6b 00 00 00 01|"; distance:7; within:9; fast_pattern; content:"agent"; distance:4; within:5; pcre:"/^\x00+?[\x20-\x7f]+?\x00+?$/R"; reference:url,github.com/anhilo/xiaogongju/tree/422136c014ba6b95ad3a746662be88372eb11b09; reference:url,www.alienvault.com/blogs/labs-research/internet-of-termites; classtype:command-and-control; sid:2027065; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Linux, attack_target Client_Endpoint, created_at 2019_03_07, deployment Perimeter, former_category MALWARE, malware_family Termite, malware_family EarthWorm, performance_impact Moderate, signature_severity Major, updated_at 2019_03_07;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Banker Trojan CnC Hello Command"; flow:established,to_server; dsize:12; content:"[S]hello["; depth:9; reference:url,doc.emergingthreats.net/2009863; classtype:command-and-control; sid:2009863; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE OSX/EvilOSX Client Receiving Commands"; flow:established,to_client; content:"404"; http_stat_code; file_data; content:"DEBUG"; depth:9; fast_pattern; reference:url,github.com/Marten4n6/EvilOSX/; classtype:trojan-activity; sid:2027066; rev:2; metadata:affected_product Mac_OSX, attack_target Client_Endpoint, created_at 2019_03_07, deployment Perimeter, former_category TROJAN, malware_family EvilOSX, performance_impact Moderate, signature_severity Major, updated_at 2019_03_07;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 8074 (msg:"ET MALWARE Banload Gadu-Gadu CnC Message Detected"; flowbits:isset,ET.gadu.loggedin; flow:established,to_server; content:"Uruchomiono trojana, wpisz help aby uzyskac pomoc"; nocase; reference:url,doc.emergingthreats.net/2008320; classtype:command-and-control; sid:2008320; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET ![22,23,25,80,139,443,445] -> $HOME_NET any (msg:"ET MALWARE Netwire RAT Check-in"; flow:established,to_client; dsize:>68; content:"|41 00 00 00 05|"; depth:5; flowbits:isset,ET.NetwireRAT.Client; reference:url,www.circl.lu/pub/tr-23/; classtype:trojan-activity; sid:2018427; rev:4; metadata:created_at 2014_04_28, former_category TROJAN, updated_at 2019_03_08;)
+#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 447 (msg:"ET MALWARE Bobax/Kraken/Oderoor UDP 447 CnC Channel Initial Packet Outbound"; dsize:24; threshold:type threshold, track by_src, count 2, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/OdeRoor; classtype:command-and-control; sid:2008104; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT CVE-2018-8174 Common Construct B64 M2"; flow:from_server,established; file_data; content:"|68546147567362474e765a4756425a475279554746795957|"; classtype:attempted-user; sid:2027070; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_11, deployment Perimeter, former_category EXPLOIT, performance_impact Moderate, signature_severity Major, updated_at 2019_03_11;)
+#alert udp $EXTERNAL_NET 447 -> $HOME_NET 1024: (msg:"ET MALWARE Bobax/Kraken/Oderoor UDP 447 CnC Channel Initial Packet Inbound"; dsize:24; threshold:type threshold, track by_src, count 2, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/OdeRoor; classtype:command-and-control; sid:2008105; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT CVE-2018-8174 Common Construct B64 M1"; flow:from_server,established; file_data; content:"|4b464e6f5a5778735932396b5a55466b5a484a5159584a6862|"; classtype:attempted-user; sid:2027069; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_11, deployment Perimeter, former_category EXPLOIT, performance_impact Moderate, signature_severity Major, updated_at 2019_03_11;)
+#alert tcp $EXTERNAL_NET 447 -> $HOME_NET 1024: (msg:"ET MALWARE Bobax/Kraken/Oderoor TCP 447 CnC Channel Initial Packet Inbound"; flow:established; dsize:24; threshold:type threshold, track by_src, count 2, seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/OdeRoor; classtype:command-and-control; sid:2008106; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT CVE-2018-8174 Common Construct B64 M3"; flow:from_server,established; file_data; content:"|6f5532686c6247786a6232526c5157526b636c4268636d4674|"; classtype:attempted-user; sid:2027071; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_11, deployment Perimeter, former_category EXPLOIT, performance_impact Moderate, signature_severity Major, updated_at 2019_03_11;)
+#alert udp $HOME_NET 1024: -> $EXTERNAL_NET 447 (msg:"ET MALWARE Possible Bobax/Kraken/Oderoor UDP 447 CnC Channel Outbound"; threshold:type threshold, track by_src, count 5, seconds 60; reference:url,doc.emergingthreats.net/bin/view/Main/OdeRoor; classtype:command-and-control; sid:2008109; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Spelevo EK Landing M1"; flow:from_server,established; file_data; content:"|554778315a326c75524756305a574e30|"; content:"-=8))%256)|3b|}"; content:"+=72){"; content:"[0] < 21) return false|3b|"; content:",[0] > 31) return false|3b|"; distance:0; content:"[0] == 31 &&"; content:"[3] > 153) return false|3b|"; distance:0; content:"flash"; nocase; classtype:exploit-kit; sid:2027072; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_11, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Spleevo_EK, performance_impact Moderate, signature_severity Major, updated_at 2019_03_11;)
+#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Ceckno Keepalive from Controller"; flow:established,from_server; dsize:1; content:"1"; flowbits:isset,ET.cekno.initial; reference:url,doc.emergingthreats.net/2008178; classtype:trojan-activity; sid:2008178; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Spelevo EK Landing M2"; flow:from_server,established; file_data; content:"|516248566e615735455a58526c5933|"; content:"-=8))%256)|3b|}"; content:"+=72){"; content:"[0] < 21) return false|3b|"; content:",[0] > 31) return false|3b|"; distance:0; content:"[0] == 31 &&"; content:"[3] > 153) return false|3b|"; distance:0; content:"flash"; nocase; classtype:exploit-kit; sid:2027073; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_11, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Spleevo_EK, performance_impact Moderate, signature_severity Major, updated_at 2019_03_11;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Codesoft PW Stealer Email Report Outbound"; flow:established,to_server; content:"|0d 0a|Subject|3a| Codesoft PW Stealer"; content:"******STEAM PASS STEALER*******"; distance:0; reference:url,doc.emergingthreats.net/2008310; classtype:trojan-activity; sid:2008310; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Spelevo EK Landing M3"; flow:from_server,established; file_data; content:"|427364576470626b526c6447566a64|"; content:"-=8))%256)|3b|}"; content:"+=72){"; content:"[0] < 21) return false|3b|"; content:",[0] > 31) return false|3b|"; distance:0; content:"[0] == 31 &&"; content:"[3] > 153) return false|3b|"; distance:0; content:"flash"; nocase; classtype:exploit-kit; sid:2027074; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_03_11, former_category CURRENT_EVENTS, malware_family Spleevo_EK, performance_impact Moderate, signature_severity Major, updated_at 2019_03_11;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET MALWARE Conficker.a Shellcode"; flow:established,to_server; content:"|e8 ff ff ff ff c1|^|8d|N|10 80|1|c4|Af|81|9EPu|f5 ae c6 9d a0|O|85 ea|O|84 c8|O|84 d8|O|c4|O|9c cc|IrX|c4 c4 c4|,|ed c4 c4 c4 94|&<O8|92|\;|d3|WG|02 c3|,|dc c4 c4 c4 f7 16 96 96|O|08 a2 03 c5 bc ea 95|\;|b3 c0 96 96 95 92 96|\;|f3|\;|24|i| 95 92|QO|8f f8|O|88 cf bc c7 0f f7|2I|d0|w|c7 95 e4|O|d6 c7 17 f7 04 05 04 c3 f6 c6 86|D|fe c4 b1|1|ff 01 b0 c2 82 ff b5 dc b6 1b|O|95 e0 c7 17 cb|s|d0 b6|O|85 d8 c7 07|O|c0|T|c7 07 9a 9d 07 a4|fN|b2 e2|Dh|0c b1 b6 a8 a9 ab aa c4|]|e7 99 1d ac b0 b0 b4 fe eb eb|"; reference:url,www.honeynet.org/node/388; reference:url,doc.emergingthreats.net/2009200; classtype:trojan-activity; sid:2009200; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> any any (msg:"ET MALWARE Win32/Termite Agent Implant Keep-Alive"; flow:established,to_server; dsize:<600; content:"|00 00 00|"; offset:1; depth:3; content:"|00 00 00|"; distance:1; within:3; content:"|00 00 00|"; distance:1; within:3; content:"|00 00 00|This|20|Client|20|Node|00 00 00|"; distance:1; within:22; fast_pattern; content:"|ff ff ff ff ff ff ff ff|"; distance:0; reference:md5,2820653437d5935d94fcb0c997d6f13c; classtype:trojan-activity; sid:2027084; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2019_03_14, deployment Perimeter, deployment Internal, former_category TROJAN, malware_family Termite, performance_impact Low, signature_severity Major, updated_at 2019_03_14;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"ET MALWARE Conficker.b Shellcode"; flow:established,to_server; content:"|e8 ff ff ff ff c2|_|8d|O|10 80|1|c4|Af|81|9MSu|f5|8|ae c6 9d a0|O|85 ea|O|84 c8|O|84 d8|O|c4|O|9c cc|Ise|c4 c4 c4|,|ed c4 c4 c4 94|&<O8|92|\;|d3|WG|02 c3|,|dc c4 c4 c4 f7 16 96 96|O|08 a2 03 c5 bc ea 95|\;|b3 c0 96 96 95 92 96|\;|f3|\;|24 |i|95 92|QO|8f f8|O|88 cf bc c7 0f f7|2I|d0|w|c7 95 e4|O|d6 c7 17 cb c4 04 cb|{|04 05 04 c3 f6 c6 86|D|fe c4 b1|1|ff 01 b0 c2 82 ff b5 dc b6 1f|O|95 e0 c7 17 cb|s|d0 b6|O|85 d8 c7 07|O|c0|T|c7 07 9a 9d 07 a4|fN|b2 e2|Dh|0c b1 b6 a8 a9 ab aa c4|]|e7 99 1d ac b0 b0 b4 fe eb eb|"; reference:url,www.honeynet.org/node/388; reference:url,doc.emergingthreats.net/2009201; classtype:trojan-activity; sid:2009201; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> any any (msg:"ET MALWARE Win32/Termite Agent Implant CnC Checkin"; flow:established,to_server; dsize:<600; content:"|00 00 00|"; offset:1; depth:3; content:"|00 00 00 00 00 00 00 ff 01|"; distance:1; within:9; content:"|ff ff ff ff ff ff ff ff|"; distance:0; content:"|00 00 00|This|20|Client|20|Node|00 00 00|"; distance:0; fast_pattern; reference:md5,2820653437d5935d94fcb0c997d6f13c; classtype:command-and-control; sid:2027083; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2019_03_14, deployment Perimeter, deployment Internal, former_category MALWARE, malware_family Termite, performance_impact Low, signature_severity Major, updated_at 2019_03_14;)
+#alert udp $HOME_NET [!1720,!1722,!2427,!5060,1024:] -> $EXTERNAL_NET [!1720,!1722,!2427,!5060,1024:] (msg:"ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 4)"; dsize:>19; byte_test:1, &, 4, 19; threshold: type both, track by_src, count 95, seconds 40; reference:url,mtc.sri.com/Conficker/addendumC/; reference:url,doc.emergingthreats.net/2009206; reference:url,www.mandiant.com/resources/apt41-us-state-governments; reference:md5,b82456963d04f44e83442b6393face47; classtype:trojan-activity; sid:2009206; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET [19400:19500] -> $HOME_NET any (msg:"ET MALWARE Win32/Spy.Agent.POX Variant CnC"; flow:established,to_client; dsize:4; content:"|6c 69 73 74|"; reference:md5,bb15e442a527a83939d9ff1b835f99dd; classtype:command-and-control; sid:2035057; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_22, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2019_03_22;)
+#alert udp $HOME_NET [!1720,!1722,!2427,!5060,1024:] -> $EXTERNAL_NET [!1720,!1722,!2427,!5060,1024:] (msg:"ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)"; dsize:>19; byte_test:1, &, 5, 19; threshold: type both, track by_src, count 95, seconds 40; reference:url,mtc.sri.com/Conficker/addendumC/; reference:url,doc.emergingthreats.net/2009207; reference:url,www.mandiant.com/resources/apt41-us-state-governments; reference:md5,b82456963d04f44e83442b6393face47; classtype:trojan-activity; sid:2009207; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert smtp any any -> $SMTP_SERVERS any (msg:"ET HUNTING SUSPICIOUS SMTP EXE - EXE SMTP Attachment"; flow:established; content:"|0D 0A 0D 0A|TV"; content:"AAAAAAAAAAAAAAAA"; within:200; classtype:bad-unknown; sid:2017886; rev:3; metadata:created_at 2013_12_20, former_category INFO, updated_at 2019_03_27;)
+#alert udp $HOME_NET [!1720,!1722,!2427,!5060,1024:] -> $EXTERNAL_NET [!1720,!1722,!2427,!5060,1024:] (msg:"ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16)"; dsize:>19; byte_test:1, &, 16, 19; threshold: type both, track by_src, count 95, seconds 40; reference:url,mtc.sri.com/Conficker/addendumC/; reference:url,doc.emergingthreats.net/2009208; classtype:trojan-activity; sid:2009208; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ELF.Initdz.Coinminer C2 Systeminfo (D2)"; flow:established,to_server; content:"D2|7c|System|20|Information&"; fast_pattern; depth:22; content:"Manufacturer|3a|"; distance:0; content:"Product|20|Name|3a|"; distance:0; content:"Version|3a 20|"; distance:0; content:"|0a|D3|7c|MemTotal|3a 20|"; distance:0; reference:md5,8438f4abf3bc5844af493d60ea8eb8f6; classtype:coin-mining; sid:2027150; rev:1; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2019_04_03, deployment Perimeter, former_category MALWARE, malware_family CoinMiner, signature_severity Major, tag Coinminer, updated_at 2019_04_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE DNS Changer.bnm/Downloader.bnm CnC Channel Start"; flow:established,to_server; dsize:8; content:"|0b 01 00 00 00 00 00 00|"; flowbits:noalert; flowbits:set,ET.dlbnm1; reference:url,doc.emergingthreats.net/2008805; classtype:command-and-control; sid:2008805; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert smtp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Outbound SMTP NTLM Authentication Observed"; flow:established,to_server; content:"AUTH|20|ntlm|20|"; depth:10; nocase; fast_pattern; pcre:"/^(?:[A-Z0-9+/]{4})*(?:[A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$/Ri"; classtype:policy-violation; sid:2027152; rev:1; metadata:attack_target Client_and_Server, created_at 2019_04_04, deployment Perimeter, former_category POLICY, performance_impact Low, signature_severity Minor, updated_at 2019_04_04;)
+#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE DNS Changer.bnm/Downloader.bnm CnC Channel Start Response"; flow:established,from_server; dsize:4; content:"|0b 01|"; depth:2; content:"|00|"; distance:1; within:1; flowbits:isset,ET.dlbnm1; reference:url,doc.emergingthreats.net/2008806; classtype:command-and-control; sid:2008806; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET [1024:] (msg:"ET ATTACK_RESPONSE LaZagne Artifact Outbound in FTP"; flow:established,to_server; content:"The LaZagne Project"; fast_pattern; reference:url,github.com/AlessandroZ/LaZagne; classtype:trojan-activity; sid:2027151; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_04, deployment Perimeter, former_category ATTACK_RESPONSE, malware_family Stealer, malware_family LaZange, signature_severity Major, updated_at 2019_04_04;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE DNS Changer.bnm/Downloader.bnm Second CnC Channel Start"; flow:established,to_server; dsize:32; content:"|00 00 00 00 c0 a8 01 1e 67 00 00 00 00|"; depth:13; reference:url,doc.emergingthreats.net/2008807; classtype:command-and-control; sid:2008807; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp any any -> $HOME_NET any (msg:"ET NETBIOS DCERPC WMI Remote Process Execution"; flow:to_server,established; dce_iface:00000143-0000-0000-c000-000000000046; classtype:bad-unknown; sid:2027167; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_09, deployment Internal, former_category NETBIOS, signature_severity Informational, updated_at 2019_04_09;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE DNS Changer.bnm/Downloader.bnm Second CnC Channel Traffic"; flow:established,to_server; dsize:32; content:"|55 d8 09 00 c0 a8 01 1e 67 00 00 00 00|"; depth:13; reference:url,doc.emergingthreats.net/2008808; classtype:command-and-control; sid:2008808; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Powershell Activity Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"powershell"; nocase; distance:0; classtype:bad-unknown; sid:2027168; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_10, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2019_04_10;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET MALWARE Delf Keylog FTP Upload"; flow:established,to_server; content:"STOR "; depth:5; content:" Keylogger ["; nocase; distance:5; within:50; content:"].txt|0d 0a|"; nocase; distance:5; within:40; reference:url,doc.emergingthreats.net/2007858; classtype:trojan-activity; sid:2007858; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Powershell Command With No Profile Argument Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"powershell"; nocase; distance:0; content:"-nop"; distance:0; classtype:bad-unknown; sid:2027169; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_10, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2019_04_10;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Delf CnC Channel Keepalive Pong"; flow:established,to_server; dsize:<40; content:"|20 00 00 00 f8 4d b2 77|"; depth:8; reference:url,doc.emergingthreats.net/2008009; classtype:command-and-control; sid:2008009; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Powershell Command With Hidden Window Argument Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"powershell"; nocase; distance:0; content:"-w"; distance:0; content:"hidden"; nocase; within:17; classtype:bad-unknown; sid:2027170; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_10, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2019_04_10;)
+#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Delf CnC Channel Keepalive Ping"; flow:established,from_server; dsize:22; content:"|12 00 00 00 1c 5e|"; depth:6; reference:url,doc.emergingthreats.net/2008010; classtype:command-and-control; sid:2008010; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Powershell Command With Execution Bypass Argument Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"powershell"; nocase; distance:0; content:"exec"; nocase; distance:0; content:"bypass"; nocase; within:18; classtype:bad-unknown; sid:2027171; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_10, deployment Perimeter, former_category POLICY, signature_severity Minor, updated_at 2019_04_10;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Trojan.Delf-5496 Checkin Error"; flow:established,to_server; dsize:350<>450; content:"Erorr File active\;sorry file erorr plaes down file agen"; reference:url,doc.emergingthreats.net/2008905; classtype:command-and-control; sid:2008905; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Powershell Command With Encoded Argument Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"powershell"; nocase; distance:0; content:"-enc"; nocase; distance:0; classtype:bad-unknown; sid:2027172; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_10, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2019_04_10;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Trojan.Delf-5496 Egg Request"; flow:established,to_server; dsize:<35; content:"|7c|CreateForm|7c|FileTransfer|7c|"; depth:29; reference:url,doc.emergingthreats.net/2008906; classtype:trojan-activity; sid:2008906; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Powershell Command With NonInteractive Argument Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"powershell"; nocase; distance:0; content:"-noni"; nocase; distance:0; classtype:bad-unknown; sid:2027173; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_10, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2019_04_10;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Trojan.Delf-5496 File Manager Access Report"; flow:established,to_server; dsize:<35; content:"|7c|CreateForm|7c|FileManager|7c|"; depth:30; reference:url,doc.emergingthreats.net/2008907; classtype:trojan-activity; sid:2008907; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Command Shell Activity Over SMB - Possible Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"cmd.exe"; nocase; distance:0; classtype:bad-unknown; sid:2027174; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_10, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2019_04_10;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Donbot Report to CnC"; flow:established,to_server; content:"HASH|3a 20|"; depth:6; content:"|0d 0a|ID|3a 20|"; distance:0; content:"|0d 0a|Session|31 20|"; distance:0; content:"|0d 0a|RBL|3a 20|"; reference:url,blog.fireeye.com/research/2009/10/a-little_more_on_donbot.html; reference:url,www.avertlabs.com/research/blog/index.php/2009/04/05/donbot-joining-the-club-of-million-dollar-botnets/; reference:url,doc.emergingthreats.net/2008451; classtype:command-and-control; sid:2008451; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Command Shell Activity Over SMB - Possible Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"cmd "; nocase; distance:0; classtype:bad-unknown; sid:2027176; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_10, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2019_04_10;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Dorf/Win32.Inject.adt C&C Communication Outbound"; flow:established,to_server; dsize:16; content:"1SCD|00 00|"; depth:6; offset:0; reference:url,doc.emergingthreats.net/2008031; classtype:command-and-control; sid:2008031; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Command Shell Activity Using Comspec Environmental Variable Over SMB - Very Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"%comspec"; nocase; distance:0; classtype:bad-unknown; sid:2027178; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_10, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2019_04_10;)
+#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Dorf/Win32.Inject.adt C&C Communication Inbound"; flow:established,from_server; dsize:16; content:"1SCD|00 00|"; depth:6; offset:0; reference:url,doc.emergingthreats.net/2008032; classtype:command-and-control; sid:2008032; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Command Shell Activity Using Comspec Environmental Variable Over SMB - Very Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|%|00|c|00|o|00|m|00|s|00|p|00|e|00|c|00|"; nocase; distance:0; classtype:bad-unknown; sid:2027179; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_10, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2019_04_10;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Dropper-497 (Yumato) System Stats Report"; flow:established,to_server; content:"|00 00 00 83|"; depth:4; content:"<CPU>"; content:"</CPU><"; distance:0; content:"<MEM>"; content:"</MEM><"; distance:0; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanDropper497; classtype:trojan-activity; sid:2007918; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Command Shell Activity Over SMB - Possible Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|c|00|m|00|d|00|.|00|e|00|x|00|e|00|"; nocase; distance:0; classtype:bad-unknown; sid:2027175; rev:2; metadata:attack_target Client_Endpoint, created_at 2019_04_10, deployment Internal, former_category POLICY, updated_at 2019_04_10;)
+#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Dropper-497 Yumato Reply from server"; flow:established,from_server; content:"YUMATO|0d 0a|1234"; depth:12; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanDropper497; classtype:trojan-activity; sid:2007919; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Nslookup Command in SMB Traffic - Possible Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"nslookup"; nocase; distance:0; classtype:bad-unknown; sid:2027183; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_11, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2019_04_11;)
+#alert tcp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity TCP (1)"; flow:established,to_server; content:"|08616c2d6a696e616e036e65740000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007673; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Nslookup Command in SMB Traffic - Possible Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|n|00|s|00|l|00|o|00|o|00|k|00|u|00|p|00|"; nocase; distance:0; classtype:bad-unknown; sid:2027184; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_11, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2019_04_11;)
+#alert tcp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity TCP (2)"; flow:established,to_server; content:"|0861312d6a696e616e036e65740000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007674; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Ipconfig Command in SMB Traffic - Possible Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"ipconfig"; nocase; distance:0; classtype:bad-unknown; sid:2027185; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_11, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2019_04_11;)
+#alert tcp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity TCP (3)"; flow:established,to_server; content:"|0661726464726104686f737402736b0000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007675; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Ipconfig Command in SMB Traffic - Possible Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|i|00|p|00|c|00|o|00|n|00|f|00|i|00|g|00|"; nocase; distance:0; classtype:bad-unknown; sid:2027186; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_11, deployment Internal, former_category POLICY, malware_family CoinMiner, signature_severity Minor, updated_at 2019_04_11;)
+#alert tcp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity TCP (4)"; flow:established,to_server; content:"|03777777056a6f2d7566036e65740000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007676; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Net View Command in SMB Traffic - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"net"; nocase; distance:0; content:"view"; nocase; within:9; classtype:bad-unknown; sid:2027187; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_11, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2019_04_11;)
+#alert tcp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity TCP (5)"; flow:established,to_server; content:"|037777770c6a6f66706d7579747276636603636f6d0000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007677; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Net View Command in SMB Traffic - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|n|00|e|00|t|00|"; nocase; distance:0; fast_pattern; content:"|00|v|00|i|00|e|00|w|00|"; nocase; within:19; classtype:bad-unknown; sid:2027188; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_11, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2019_04_11;)
+#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity UDP (1)"; content:"|08616c2d6a696e616e036e65740000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007678; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp any any -> $HOME_NET any (msg:"ET NETBIOS DCERPC DCOM ShellExecute - Likely Lateral Movement"; flow:established,to_server; content:"|00|S|00|h|00|e|00|l|00|l|00|E|00|x|00|e|00|c|00|u|00|t|00|e|00|"; reference:url,enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/; reference:url,enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/; reference:url,attack.mitre.org/techniques/T1175/; classtype:bad-unknown; sid:2027190; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_11, deployment Internal, former_category NETBIOS, signature_severity Minor, updated_at 2019_04_11;)
+#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity UDP (2)"; content:"|0861312d6a696e616e036e65740000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007679; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Executable Transfer in SMB"; flow:established,to_server; content:"SMB"; depth:8; content:"MZ"; distance:0; content:"This program "; distance:0; content:"PE|00 00|"; distance:0; classtype:bad-unknown; sid:2027191; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_11, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2019_04_11;)
+#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity UDP (3)"; content:"|0661726464726104686f737402736b0000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007680; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp any [21,22,23,25,53,80,443,8080] -> any !3389 (msg:"ET POLICY Tunneled RDP msts Handshake"; dsize:<65; content:"|03 00 00|"; depth:3; content:"|e0|"; distance:2; within:1; content:"Cookie|3a 20|mstshash="; distance:5; within:17; reference:url,www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html; classtype:bad-unknown; sid:2027192; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_11, deployment Perimeter, former_category POLICY, signature_severity Minor, updated_at 2019_04_11;)
+#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity UDP (4)"; content:"|03777777056a6f2d7566036e65740000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007681; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp any [21,22,23,25,53,80,443,8080] -> any !3389 (msg:"ET POLICY Tunneled RDP Handshake"; flow:established; content:"|c0 00|Duca"; depth:250; content:"rdpdr"; content:"cliprdr"; reference:url,www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html; classtype:bad-unknown; sid:2027193; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_11, deployment Perimeter, former_category POLICY, signature_severity Minor, updated_at 2019_04_11;)
+#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE E-Jihad 3.0 DNS Activity UDP (5)"; content:"|037777770c6a6f66706d7579747276636603636f6d0000010001|"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007682; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert smb any any -> $HOME_NET any (msg:"ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|w|00|m|00|i|00|c|00|"; nocase; distance:0; fast_pattern; classtype:trojan-activity; sid:2025726; rev:3; metadata:attack_target SMB_Client, created_at 2018_07_17, deployment Perimeter, deployment Internal, former_category POLICY, performance_impact Low, signature_severity Major, updated_at 2019_04_16;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET MALWARE elitekeylogger v1.0 reporting - Inbound"; flow:established,to_server; content:"MAIL FROM|3a|<logs@logs.com>"; reference:url,doc.emergingthreats.net/2002938; classtype:trojan-activity; sid:2002938; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert smb any any -> $HOME_NET any (msg:"ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|w|00|m|00|i|00|c|00|.|00|e|00|x|00|e|00|"; nocase; distance:0; classtype:trojan-activity; sid:2027180; rev:2; metadata:attack_target SMB_Client, created_at 2019_04_10, deployment Perimeter, deployment Internal, former_category POLICY, signature_severity Major, updated_at 2019_04_16;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE elitekeylogger v1.0 reporting - Outbound"; flow:established,to_server; content:"MAIL FROM|3a|<logs@logs.com>"; reference:url,doc.emergingthreats.net/2002941; classtype:trojan-activity; sid:2002941; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert smb any any -> $HOME_NET any (msg:"ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"wmic.exe"; nocase; distance:0; classtype:trojan-activity; sid:2027181; rev:2; metadata:attack_target SMB_Client, created_at 2019_04_10, deployment Perimeter, deployment Internal, former_category POLICY, signature_severity Major, updated_at 2019_04_16;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE GENERAL Possible Trojan Sending Initial Email to Owner - SUCCESSO"; flow:established,to_server; content:"PC INFECTADO COM SUCCESSO"; nocase; reference:url,doc.emergingthreats.net/2002983; classtype:trojan-activity; sid:2002983; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert smb any any -> $HOME_NET any (msg:"ET POLICY WMIC WMI Request Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"wmic "; nocase; distance:0; classtype:trojan-activity; sid:2027182; rev:2; metadata:attack_target SMB_Client, created_at 2019_04_10, deployment Perimeter, former_category POLICY, signature_severity Major, updated_at 2019_04_16;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Pass Stealer FTP Upload"; flow:established,to_server; content:"INFECTADO|0d 0a|=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|0d 0a|Computador"; depth:64; reference:url,doc.emergingthreats.net/2008237; classtype:trojan-activity; sid:2008237; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert smb any any -> $HOME_NET 445 (msg:"ET POLICY Powershell Activity Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|p|00|o|00|w|00|e|00|r|00|s|00|h|00|e|00|l|00|l|00|.|00|e|00|x|00|e|00|"; nocase; distance:0; classtype:trojan-activity; sid:2027202; rev:1; metadata:created_at 2019_04_16, former_category POLICY, updated_at 2019_04_16;)
+alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gimmiv Infection Ping Outbound"; icode:0; itype:8; dsize:20; content:"abcde12345fghij6789"; reference:url,doc.emergingthreats.net/2008726; classtype:trojan-activity; sid:2008726; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert smb any any -> $HOME_NET 445 (msg:"ET POLICY Powershell Activity Over SMB - Likely Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|p|00|o|00|w|00|e|00|r|00|s|00|h|00|e|00|l|00|l|00 20 00|"; nocase; distance:0; fast_pattern; classtype:trojan-activity; sid:2025719; rev:3; metadata:attack_target SMB_Client, created_at 2018_07_17, deployment Perimeter, deployment Internal, former_category POLICY, performance_impact Low, signature_severity Major, updated_at 2019_04_16;)
+#alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Gimmiv Infection Ping Inbound"; icode:0; itype:8; dsize:20; content:"abcde12345fghij6789"; reference:url,doc.emergingthreats.net/2008727; classtype:trojan-activity; sid:2008727; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert smb any any -> $HOME_NET 445 (msg:"ET POLICY Possible Powershell .ps1 Script Use Over SMB"; flow:established,to_server; content:"SMB"; depth:8; content:".ps1"; nocase; distance:0; classtype:bad-unknown; sid:2027203; rev:2; metadata:created_at 2019_04_16, updated_at 2019_04_16;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE HackerDefender Root Kit Remote Connection Attempt Detected"; flow: established,to_server; content:"|01 9a 8c 66 af c0 4a 11 9e 3f 40 88 12 2c 3a 4a 84 65 38 b0 b4 08 0b af db ce 02 94 34 5f 22|"; rawbytes; tag: session, 20, packets; reference:url,securityresponse.symantec.com/avcenter/venc/data/backdoor.hackdefender.html; reference:url,doc.emergingthreats.net/2001743; classtype:trojan-activity; sid:2001743; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert smb any any -> $HOME_NET 445 (msg:"ET HUNTING Possible Powershell .ps1 Script Use Over SMB"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|.|00|p|00|s|00|1|00|"; nocase; distance:0; classtype:bad-unknown; sid:2027204; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_16, deployment Internal, former_category POLICY, signature_severity Informational, updated_at 2019_04_16;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE HackerDefender.HE Root Kit Control Connection"; flow: established,to_server; content:"|d0 84 ec 77 cf ec 60 e9|"; depth:8; reference:url,securityresponse.symantec.com/avcenter/venc/data/backdoor.hackdefender.html; reference:url,doc.emergingthreats.net/2003244; classtype:trojan-activity; sid:2003244; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert smb any any -> $HOME_NET 445 (msg:"ET POLICY Possible WMI .mof Managed Object File Use Over SMB"; flow:established,to_server; content:"SMB"; depth:8; content:".mof"; nocase; distance:0; reference:url,www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf; classtype:bad-unknown; sid:2027205; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_16, deployment Internal, former_category POLICY, signature_severity Informational, updated_at 2019_04_16;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE HackerDefender.HE Root Kit Control Connection Reply"; flow: established,from_server; content:"|d0 84 ec 77 cf ec 60 e9|"; depth:8; reference:url,securityresponse.symantec.com/avcenter/venc/data/backdoor.hackdefender.html; reference:url,doc.emergingthreats.net/2003245; classtype:trojan-activity; sid:2003245; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert smb any any -> $HOME_NET 445 (msg:"ET POLICY Possible WMI .mof Managed Object File Use Over SMB"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|.|00|m|00|o|00|f|00|"; nocase; distance:0; reference:url,www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf; classtype:bad-unknown; sid:2027206; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_16, deployment Internal, former_category POLICY, signature_severity Informational, updated_at 2019_04_16;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE HotLan.C Spambot C&C download command"; flow:established,from_server; content:"|3B|URL|3A|http|3A 2F 2F|"; pcre:"/\x0D\x0A\x0D\x0ASLP\x3A\d+\x3BMOD\x3A[\S\x3B]+\x3BURL\x3Ahttp\x3A\x2F{2}[^\x3B]+\x3BSRV\x3Aupd\x3B/"; reference:url,doc.emergingthreats.net/2008471; classtype:command-and-control; sid:2008471; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert smb any any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Possible Lateral Movement - File Creation Request in Remote System32 Directory (T1105)"; flow:established,to_server; content:"|05 00|"; offset:16; depth:2; content:"|00|W|00|i|00|n|00|d|00|o|00|w|00|s|00 5c 00|S|00|y|00|s|00|t|00|e|00|m|00|3|00|2|00|"; fast_pattern; classtype:attempted-user; sid:2027267; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_04_23, deployment Internal, former_category ATTACK_RESPONSE, performance_impact Low, signature_severity Major, tag T1105, tag lateral_movement, tag remote_file_copy, updated_at 2019_04_23;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Hupigon CnC Communication (variant bysj)"; flow:established,to_server; dsize:5; content:"HTTP|00|"; reference:url,doc.emergingthreats.net/2008258; classtype:command-and-control; sid:2008258; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Possible Remote System32 DLL Hijack Command Inbound via HTTP (T1038, T1105)"; flow:established,from_server; content:"200"; http_stat_code; file_data; content:"copy|20|"; content:".dll"; distance:0; content:"|5c|Windows|5c|System32|5c|"; distance:0; fast_pattern; content:".dll"; distance:0; content:"copy|20|"; pcre:"/^(?P<dll_name>[a-z0-9\-_]{1,20})\.dll\s*\\\\(([0-9]{1,3}\.){3}[0-9]{1,3}|([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})\\\w{1,10}\$\\Windows\\System32\\(?P=dll_name)\.dll/Ri"; reference:url,posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992; classtype:attempted-user; sid:2027268; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_04_23, deployment Internal, former_category ATTACK_RESPONSE, performance_impact Low, signature_severity Major, tag T1038, tag T1105, updated_at 2019_04_23;)
+#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Win32.Hupigon Control Server Response"; flow:from_server,established; dsize:16; content:"|03 00 00 00 00 00 00 00 c4 ec 48 f5 5e 00 85 80|"; depth:16; threshold: type both, count 2, seconds 120, track by_src; reference:url,doc.emergingthreats.net/2009350; classtype:trojan-activity; sid:2009350; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY PE EXE or DLL Windows file download HTTP"; flow:established,to_client; flowbits:isnotset,ET.http.binary; flowbits:isnotset,ET.INFO.WindowsUpdate; file_data; content:"MZ"; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; flowbits:set,ET.http.binary; reference:url,doc.emergingthreats.net/bin/view/Main/2018959; classtype:policy-violation; sid:2018959; rev:4; metadata:created_at 2014_08_19, former_category POLICY, updated_at 2017_02_01;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE TROJ_INJECT.NI Update Request"; flow:established,to_server; dsize:7; content:"F222222"; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_INJECT.NI&VSect=T; reference:url,doc.emergingthreats.net/2009077; classtype:trojan-activity; sid:2009077; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET POLICY Command Shell Activity Over SMB - Possible Lateral Movement"; flow:established,to_server; content:"SMB"; depth:8; content:"|00|c|00|m|00|d|00 20 00|"; nocase; distance:0; classtype:bad-unknown; sid:2027177; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_04_10, deployment Internal, former_category POLICY, signature_severity Minor, updated_at 2019_04_10;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Keylogger PRO GOLD Post"; flow:established,to_server; content:"to="; content:"&from="; within:200; content:"&subject="; within:200; content:"&message="; within:200; content:"Discribtion"; within:14; content:"KEYLOGG+PRO+GOLD+VERSION"; content:"IPHostName"; content:"IPAddress"; content:"YahooMessenger+Passwords"; reference:url,doc.emergingthreats.net/2008642; classtype:trojan-activity; sid:2008642; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp-pkt $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Cryptocurrency Miner Checkin M2"; flow:established,to_server; content:"|7b 22|id|22 3a|"; nocase; depth:6; content:"|22|jsonrpc|22 3a|"; nocase; distance:0; content:"|22 2c 22|method|22 3a 22|login|22 2c 22|params|22 3a|"; fast_pattern; nocase; content:"|22|agent|22 3a 22|"; nocase; content:!"<title"; nocase; content:!"<script"; nocase; content:!"<html"; nocase; content:!"|22|pass|22 3a 22|"; nocase; classtype:policy-violation; sid:2027316; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_05_06, deployment Perimeter, former_category POLICY, performance_impact Low, signature_severity Major, updated_at 2019_05_06;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Keylogger.ane Checkin"; flow:established,to_server; content:"Secret Client|00 00 00|"; depth:18; reference:url,doc.emergingthreats.net/2008449; classtype:command-and-control; sid:2008449; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Anyplace Remote Access Initial Connection Attempt (005)"; flow:established,to_server; content:"HTTP|2f|1.1|20|005|0d 0a|VERSION|3a 20|"; depth:23; content:"PLATFORM|3a 20|"; distance:0; content:"IPADDRESS|3a 20|"; distance:0; fast_pattern; reference:md5,30e4f96590d530ba5dc1762f8b87c16b; classtype:trojan-activity; sid:2027323; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_05_07, deployment Perimeter, deployment Internal, former_category INFO, malware_family Anyplace, performance_impact Low, signature_severity Major, tag RAT, updated_at 2019_05_07;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Koobface BLACKLABEL"; flow:established,from_server; content: "#BLACKLABEL|0d 0a|EXIT"; reference:url,blog.threatexpert.com/2008/12/koobface-leaves-victims-black-spot.html; reference:url,doc.emergingthreats.net/2009407; classtype:trojan-activity; sid:2009407; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert smb any any -> $HOME_NET any (msg:"ET MALWARE Covenant .NET Framework P2P C&C Protocol Gruntsvc Named Pipe Interaction"; flow:established,to_server; content:"SMB"; depth:8; content:"g|00|r|00|u|00|n|00|t|00|s|00|v|00|c|00|"; nocase; distance:0; fast_pattern; reference:url,posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462; reference:url,posts.specterops.io/designing-peer-to-peer-command-and-control-ad2c61740456; classtype:command-and-control; sid:2027326; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_05_07, deployment Perimeter, deployment Internal, former_category MALWARE, malware_family Covenant, performance_impact Low, signature_severity Major, updated_at 2019_05_07;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Koobface C&C availability check successful"; flowbits:isset,ET.koobfacecheck; flow:established,from_server; content:"|0d 0a 0d 0a|ACH_OK"; nocase; reference:url,us.trendmicro.com/imperia/md/content/us/trendwatch/researchandanalysis/the_20heart_20of_20koobface_final_1_.pdf; reference:url,doc.emergingthreats.net/2010152; classtype:command-and-control; sid:2010152; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Anyplace Remote Access Checkin (051)"; flow:established,to_server; content:"HTTP|2f|1.1|20|051"; depth:12; content:"VER|3a 20|"; distance:0; content:"OBJ|3a 20|"; distance:0; content:"FUNC|3a 20|"; distance:0; content:"NAME|3a 20|"; distance:0; content:"ACC|3a 20|"; distance:0; content:"SRV|3a 20|"; distance:0; content:"PRODUCT|3a 20|"; distance:0; fast_pattern; reference:md5,30e4f96590d530ba5dc1762f8b87c16b; classtype:trojan-activity; sid:2027324; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_05_07, deployment Perimeter, deployment Internal, former_category INFO, malware_family Anyplace, performance_impact Low, signature_severity Major, tag RAT, updated_at 2019_05_07;)
+alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Lethic Spambot CnC Initial Connect"; flow:established,from_server; flowbits:isnotset,ET.lethic.init; flowbits:set,ET.lethic.init; flowbits:noalert; dsize:5; content:"|00 00 00 00 06|"; reference:url,www.m86security.com/trace/spambotitem.asp?article=1205; reference:url,doc.emergingthreats.net/2010646; classtype:command-and-control; sid:2010646; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> any any (msg:"ET MALWARE Win32/ElectricFish Authentication Packet Observed"; flow:established,to_server; content:"aaaabbbbccccdddd|00 00 00 00 00 00 00 00|"; depth:24; fast_pattern; content:"|00 00 04 00 00 00|"; distance:2; within:6; reference:url,www.us-cert.gov/ncas/analysis-reports/AR19-129A; classtype:trojan-activity; sid:2027340; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_05_09, deployment Perimeter, deployment Internal, former_category TROJAN, malware_family ElectricFish, performance_impact Low, signature_severity Major, tag APT, tag T1090, tag connection_proxy, updated_at 2019_05_09;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Lethic Spambot CnC Initial Connect Bot Response"; flow:established,to_server; flowbits:isset,ET.lethic.init; dsize:5; content:"|00 00 00 00 06|"; flowbits:set,ET.lethic.established; reference:url,www.m86security.com/trace/spambotitem.asp?article=1205; reference:url,doc.emergingthreats.net/2010647; classtype:command-and-control; sid:2010647; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp any any -> any 3389 (msg:"ET EXPLOIT [NCC GROUP] Possible Bluekeep Inbound RDP Exploitation Attempt (CVE-2019-0708)"; flow:to_server,established; content:"|03 00|"; depth:2; content:"|02 f0|"; distance:2; within:2; content:"|00 05 00 14 7c 00 01|"; within:512; content:"|03 c0|"; distance:3; within:384; content:"MS_T120|00|"; distance:6; within:372; nocase; fast_pattern; threshold: type limit, track by_src, count 2, seconds 600; reference:cve,CVE-2019-0708; reference:url,portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708; reference:url,github.com/nccgroup/Cyber-Defence/blob/master/Signatures/suricata/2019_05_rdp_cve_2019_0708.txt; classtype:attempted-admin; sid:2027369; rev:3; metadata:attack_target Client_and_Server, created_at 2019_05_21, deployment Perimeter, deployment Internet, deployment Internal, former_category EXPLOIT, malware_family Bluekeep, signature_severity Major, updated_at 2019_05_21;)
+#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Lethic Spambot CnC Connect Command"; flowbits:isset,ET.lethic.established; flow:established,from_server; dsize:11; content:"|02|"; offset:4; depth:5; reference:url,www.m86security.com/trace/spambotitem.asp?article=1205; reference:url,doc.emergingthreats.net/2010648; classtype:command-and-control; sid:2010648; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET [139,445] (msg:"ET MALWARE Suspected ExtraPulsar Backdoor"; flow:established,to_server; content:"ExPu"; depth:11; offset:4; content:"|90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90|"; distance:0; reference:url,github.com/zerosum0x0/smbdoor; classtype:trojan-activity; sid:2027370; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_05_21, deployment Internal, former_category TROJAN, malware_family ExtraPulsar, signature_severity Major, updated_at 2019_05_22;)
+#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Lethic Spambot CnC Connect Command (port 25 specifically)"; flowbits:isset,ET.lethic.established; flow:established,from_server; dsize:11; content:"|02|"; offset:4; depth:5; content:"|00 19|"; offset:9; reference:url,www.m86security.com/trace/spambotitem.asp?article=1205; reference:url,doc.emergingthreats.net/2010649; classtype:command-and-control; sid:2010649; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Nuclear EK Landing Apr 08 2015"; flow:established,from_server; content:"Server|3a 20|nginx"; http_header; file_data; content:"Q|22|"; fast_pattern; content:"length"; pcre:"/^\s*?\<\s*?10/Rs"; content:"replace"; within:500; pcre:"/^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22(?:\!(?:\x22\s*?\+\s*?\x22)?)?Q(?:\x22\s*?\+\s*?\x22)?Q\x22/Rs"; classtype:exploit-kit; sid:2020865; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_04_09, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Nuclear, signature_severity Critical, tag Exploit_Kit, tag Nuclear, updated_at 2020_08_20;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Lethic Spambot CnC Bot Command Confirmation"; flow:established,to_server; flowbits:isset,ET.lethic.established; dsize:6; content:"|21 01|"; offset:4; reference:url,www.m86security.com/trace/spambotitem.asp?article=1205; reference:url,doc.emergingthreats.net/2010650; classtype:command-and-control; sid:2010650; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible Locky Payload DL Sept 26 2017 M3"; flow:established,to_server; urilen:>6; content:"MSIE"; http_user_agent; fast_pattern; pcre:"/^(?:\/(?:(?:af|p66)\/(?=(?:[a-zA-Z]{0,12}[0-9]|(?=[a-z0-9]{0,12}[A-Z])(?=[A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(?=(?:[a-zA-Z]{0,12}[0-9]|(?=[a-z0-9]{0,12}[A-Z])(?=[A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*(?:(?P<var1>[^=&]+)=(?P=var1))?))$/U"; http_header_names; content:!"Referer"; content:!"Cookie"; http_start; content:"HTTP/1.1|0d 0a|Accept|3a 20|*/*|0d 0a|"; flowbits:set,ET.Locky; flowbits:noalert; classtype:trojan-activity; sid:2026461; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_10_03, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Locky, performance_impact Moderate, signature_severity Major, updated_at 2019_05_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Lethic Spambot CnC Bot Transaction Relay"; flow:established,to_server; flowbits:isset,ET.lethic.established; content:"|03|"; offset:4; depth:5; reference:url,www.m86security.com/trace/spambotitem.asp?article=1205; reference:url,doc.emergingthreats.net/2010651; classtype:command-and-control; sid:2010651; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux/Moose NAT Traversal CnC Beacon - Sleep"; flow:established,from_server; dsize:8; content:"|16 00|"; depth:2; content:!"|04 00|"; within:2; content:!"|00 00|"; within:2; content:!"|00|"; distance:2; within:1; content:!"|00|"; distance:5; within:1; flowbits:isset,ET.Linux.Moose; reference:url,welivesecurity.com/wp-content/uploads/2015/05/Dissecting-LinuxMoose.pdf; classtype:command-and-control; sid:2021151; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_26, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2019_05_29, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+#alert tcp $EXTERNAL_NET 81:90 -> $HOME_NET any (msg:"ET MALWARE Looked.P/Gamania/Delf #109/! Style CnC Checkin Response from Server"; flow:established,from_server; dsize:6; content:"#1"; depth:2; content:"/!"; offset:4; pcre:"/^\x23\d\d\d\x2f\x21/"; reference:url,doc.emergingthreats.net/bin/view/Main/Win32Looked; classtype:command-and-control; sid:2008220; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux/Moose NAT Traversal CnC Beacon - Multiple Tunnel"; flow:established,from_server; dsize:8; content:"|17 00|"; depth:2; content:!"|04 00|"; within:2; content:!"|00 00|"; within:2; content:!"|00|"; distance:2; within:1; content:!"|00|"; distance:5; within:1; flowbits:isset,ET.Linux.Moose; reference:url,welivesecurity.com/wp-content/uploads/2015/05/Dissecting-LinuxMoose.pdf; classtype:command-and-control; sid:2021152; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_26, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2019_05_29, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+#alert udp $HOME_NET any -> $EXTERNAL_NET 6990:6999 (msg:"ET MALWARE Medbod UDP Phone Home Packet"; dsize:<50; content:"ebex"; nocase; pcre:"/\x06\x00?$/"; reference:url,doc.emergingthreats.net/2007949; classtype:trojan-activity; sid:2007949; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert udp $HOME_NET any -> any 57621 (msg:"ET POLICY Spotify P2P Client"; flow:to_server; dsize:44; content:"|53 70 6f 74 55 64 70 30|"; depth:8; threshold:type limit, count 1, track by_src, seconds 300; classtype:not-suspicious; sid:2027397; rev:1; metadata:affected_product Windows_Client_Apps, attack_target Client_Endpoint, created_at 2019_05_30, deployment Internal, performance_impact Low, signature_severity Minor, updated_at 2019_05_30;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 2227 (msg:"ET MALWARE Trojan-PSW.Win32.Nilage.crg Checkin"; flow:established,to_server; dsize:32; content:"|00 c0 a8 01 f4 6f 00 00 00|"; depth:12; content:"|00 00 00 05 01 28 0a|"; reference:url,doc.emergingthreats.net/2008481; classtype:command-and-control; sid:2008481; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Observed Malicious SSL Cert (BrushaLoader CnC) 2019-05-30"; flow:established,to_client; tls_cert_subject; content:"CN=halatest.info"; tls_cert_issuer; content:"C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"; reference:url,twitter.com/Racco42/status/1134214372996390913; classtype:domain-c2; sid:2027414; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2019_05_31, deployment Perimeter, former_category MALWARE, malware_family BrushaLoader, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2019_05_31, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Overtoolbar.net Backdoor ICMP Checkin Request"; dsize:9; icode:0; itype:8; content:"Echo This"; reference:url,doc.emergingthreats.net/2009130; classtype:command-and-control; sid:2009130; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET CURRENT_EVENTS Brushaloader Domain in DNS Lookup 2019-05-30"; dns_query; content:"canasikos.info"; nocase; isdataat:!1,relative; reference:url,twitter.com/Racco42/status/1134214372996390913; classtype:trojan-activity; sid:2027415; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_05_31, deployment Perimeter, former_category CURRENT_EVENTS, malware_family BrushaLoader, performance_impact Low, signature_severity Major, updated_at 2019_05_31;)
+alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Overtoolbar.net Backdoor ICMP Checkin Response"; dsize:9; icode:0; itype:0; content:"Echo This"; reference:url,doc.emergingthreats.net/2009131; classtype:command-and-control; sid:2009131; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux/HiddenWasp CnC Request (set)"; flow:established,to_server; flowbits:set,ET.Linux.HiddenWasp; flowbits:noalert; content:"|75 63 65 73 00 01|"; depth:6; fast_pattern; reference:url,www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/; reference:md5,5b134e0a1a89a6c85f13e08e82ea35c3; classtype:command-and-control; sid:2027395; rev:3; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2019_05_29, deployment Perimeter, former_category MALWARE, performance_impact Significant, signature_severity Major, updated_at 2019_05_31;)
+#alert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"ET MALWARE Prg Trojan Server Reply"; flow:to_client,established; content:"HTTP"; depth:4; content:"|0d0a|Hall|3a|"; depth:512; reference:url,www.securescience.net/FILES/securescience/10378/pubMalwareCaseStudy.pdf; reference:url,doc.emergingthreats.net/2003183; classtype:trojan-activity; sid:2003183; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux/HiddenWasp CnC Response"; flow:established,from_server; flowbits:isset,ET.Linux.HiddenWasp; content:"|75 63 65 73 00 01|"; depth:6; fast_pattern; reference:url,www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/; reference:md5,5b134e0a1a89a6c85f13e08e82ea35c3; classtype:command-and-control; sid:2027396; rev:3; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2019_05_29, deployment Perimeter, former_category MALWARE, performance_impact Significant, signature_severity Major, updated_at 2019_05_31;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1900 (msg:"ET MALWARE Backdoor.Win32/PcClient.ZL Checkin"; flow:established,to_server; content:"|00 00 00 10 c8 00 00 00 b0 ff|"; depth:10; reference:url,doc.emergingthreats.net/2008920; classtype:command-and-control; sid:2008920; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET MALWARE Executable contained in DICOM Medical Image SMB File Transfer"; flow:established,to_server; flowbits:isset,ET.smb.binary; content:"SMB"; depth:8; content:"MZ"; distance:0; content:"DICM"; fast_pattern; distance:126; within:4; reference:url,github.com/d00rt/pedicom/; reference:url,labs.cylera.com/2019/04/16/pe-dicom-medical-malware/; classtype:trojan-activity; sid:2027402; rev:1; metadata:affected_product Windows_Client_Apps, attack_target Client_Endpoint, created_at 2019_05_31, deployment Internal, former_category MALWARE, signature_severity Major, updated_at 2019_05_31;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE PcClient Backdoor Checkin Packet 1"; flow:established,to_server; dsize:4; content:"|82 87 99 45|"; flowbits:set,ET.PcClient; flowbits:noalert; reference:url,doc.emergingthreats.net/2009238; classtype:command-and-control; sid:2009238; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET [104,2104,22104] (msg:"ET MALWARE Executable contained in DICOM Medical Image PACS DICOM Protocol Transfer"; flow:established,to_client; content:"MZ"; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; content:"DICM"; offset:128; depth:4; fast_pattern; reference:url,github.com/d00rt/pedicom/; reference:url,labs.cylera.com/2019/04/16/pe-dicom-medical-malware/; classtype:trojan-activity; sid:2027403; rev:1; metadata:affected_product Windows_Client_Apps, attack_target Client_Endpoint, created_at 2019_05_31, deployment Internal, former_category MALWARE, signature_severity Major, updated_at 2019_05_31;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE PcClient Backdoor Checkin"; flowbits:isset,ET.PcClient; flow:established,to_server; dsize:248; content:"|52 0d 12 12|"; depth:4; flowbits:noalert; reference:url,doc.emergingthreats.net/2009239; classtype:command-and-control; sid:2009239; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp any [104,2104,22104] -> $HOME_NET any (msg:"ET MALWARE Executable contained in DICOM Medical Image Received from PACS DICOM Device"; flow:established,to_client; content:"MZ"; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; content:"DICM"; offset:128; depth:4; fast_pattern; reference:url,github.com/d00rt/pedicom/; reference:url,labs.cylera.com/2019/04/16/pe-dicom-medical-malware/; classtype:trojan-activity; sid:2027404; rev:1; metadata:affected_product Windows_Client_Apps, attack_target Client_Endpoint, created_at 2019_05_31, deployment Internal, former_category MALWARE, signature_severity Major, updated_at 2019_05_31;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE PECompact2 Packed Binary - Sometimes Hostile"; flow:from_server,established; content:"|74 65 78 74|"; content:"|50 45 43 32|"; within:40; reference:url,www.bitsum.com/pecompact.shtml; reference:url,bits.packetninjas.org/eblog/?p=306; reference:url,doc.emergingthreats.net/2008547; classtype:trojan-activity; sid:2008547; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE Windows 64bit procdump Dump File Exfiltration"; flow:established,to_server; content:"|00 2a 00 2a 00 2a 00 20 00|p|00|r|00|o|00|c|00|d|00|u|00|m|00|p|00|6|00|4|00 2e 00|e|00|x|00|e"; fast_pattern; reference:url,attack.mitre.org/techniques/T1003/; classtype:attempted-admin; sid:2027435; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_06_05, deployment Perimeter, former_category ATTACK_RESPONSE, performance_impact Low, signature_severity Major, tag T1003, tag credential_dumping, updated_at 2019_06_05;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Perfect Keylogger FTP Initial Install Log Upload"; flow:established,to_server; content:"Congratulations! Perfect Kelogger was successfully installed"; depth:63; reference:url,doc.emergingthreats.net/2007973; classtype:trojan-activity; sid:2007973; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE Windows 32bit procdump Dump File Exfiltration"; flow:established,to_server; content:"|00 2a 00 2a 00 2a 00 20 00|p|00|r|00|o|00|c|00|d|00|u|00|m|00|p|00 2e 00|e|00|x|00|e"; fast_pattern; reference:url,attack.mitre.org/techniques/T1003/; classtype:attempted-admin; sid:2027436; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_06_05, deployment Perimeter, former_category ATTACK_RESPONSE, performance_impact Low, signature_severity Major, tag T1003, tag credential_dumping, updated_at 2019_06_05;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Perfect Keylogger FTP Initial Install Log Upload (Null obfuscated)"; flow:established,to_server; content:"C|00|o|00|n|00|g|00|r|00|a|00|t|00|u|00|l|00|a|00|t|00|i|00|o|00|n|00|s|00|!|00| |00|P|00|e|00|r|00|f|00|e|00|c|00|t|00| |00|K|00|e|00|l|00|o|00|g|00|g|00|e|00|r|00| |00|w|00|a|00|s|00| |00|s|00|u|00|c|00|c|00|e|00|s|00|s|00|f|00|u|00|l|00|l|00|y|00| |00|i|00|n|00|s|00|t|00|a|00|l|00|l|00|e|00|d|00|"; reference:url,doc.emergingthreats.net/2008327; classtype:trojan-activity; sid:2008327; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert smtp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Phorpiex Template 3 Active - Outbound Malicious Email Spam"; flow:established,to_server; content:"Your|20|computer|20|was|20|infected|20|with|20|my|20|private|20|malware"; fast_pattern; content:"malware|20|gave|20|me|20|full"; distance:0; content:"accounts|20 28|see|20|password|20|above|29|"; distance:0; content:"MANY|20|EMBARASSING|20|VIDEOS"; distance:0; threshold: type limit, count 1, seconds 60, track by_src; classtype:trojan-activity; sid:2027437; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_06_06, deployment Perimeter, former_category TROJAN, malware_family Phorpiex, performance_impact Low, signature_severity Major, tag SpamBot, updated_at 2019_06_06;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE RLPacked Binary - Likely Hostile"; flow:from_server,established; content:"|2E 70 61 63 6B 65 64|"; content:"|2E 52 4C 50 61 63 6B|"; within:50; reference:url,rlpack.jezgra.net; reference:url,www.teamfurry.com/wordpress/2007/04/01/unpacking-rlpack/; reference:url,doc.emergingthreats.net/2008285; classtype:trojan-activity; sid:2008285; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert smtp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Phorpiex Template 4 Active - Outbound Malicious Email Spam"; flow:established,to_server; content:"infected|20|you|20|with|20|a|20|malware"; content:"malware|20|gave|20|me|20|full"; distance:0; content:"collected|20|everything|20|private|20|from|20|you"; distance:0; content:"FEW|20|EMBARASSING|20|VIDEOS"; distance:0; threshold: type limit, count 1, seconds 60, track by_src; classtype:trojan-activity; sid:2027438; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_06_06, deployment Perimeter, former_category TROJAN, malware_family Phorpiex, performance_impact Low, signature_severity Major, tag SpamBot, updated_at 2019_06_06;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET MALWARE Trojan.Win32.Regrun.ro FTP connection detected"; flow:established,to_server; content:"RETR k3ylogger.txt|0d 0a|"; depth:21; reference:url,doc.emergingthreats.net/2008733; classtype:trojan-activity; sid:2008733; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $HOME_NET any -> $EXTERNAL_NET [1024:65535,![3389]] (msg:"ET POLICY TLS/SSL Client Key Exchange on Unusual Port"; flowbits:isset,BS.SSL.Client.Hello; flow:established; content:"|16 03 01|"; content:"|10|"; within:6; reference:url,doc.emergingthreats.net/2003006; classtype:unusual-client-port-connection; sid:2003006; rev:9; metadata:created_at 2010_07_30, updated_at 2019_06_06;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 8080 (msg:"ET MALWARE Saturn Proxy Initial Outbound Checkin (404.txt)"; flow:established,to_server; dsize:<50; content:"GET /404.txt HTTP/1.0"; depth:21; flowbits:set,ET.saturn.checkin; reference:url,doc.emergingthreats.net/2007751; classtype:command-and-control; sid:2007751; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET [443,7080,8080,80] (msg:"ET MALWARE W32/Emotet.v4 Checkin 2"; flow:established,to_server; urilen:1; content:"POST"; http_method; content:"|20|MSIE|20|"; http_user_agent; fast_pattern; pcre:"/^(?:\d{1,3}\.){3}\d{1,3}(?:\x3a[03478]+)?/W"; pcre:"/^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/Ps"; http_protocol; content:"HTTP/1."; http_content_len; byte_test:0,>,150,0,string,dec; http_header_names; content:"|0d 0a|User-Agent|0d 0a|"; depth:14; content:!"Accept"; content:!"Referer"; content:!"Content-Type"; content:!"Cookie"; content:!"TagId"; classtype:command-and-control; sid:2035048; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_08_17, deployment Perimeter, deprecation_reason False_Positive, former_category MALWARE, malware_family Emotet, performance_impact Moderate, signature_severity Major, updated_at 2019_06_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Saturn Proxy C&C Activity"; flow:established,from_server; dsize:12; content:"|2d 00 00 00|"; offset:0; depth:4; content:"|00 00 55 00 00 00|"; distance:2; reference:url,doc.emergingthreats.net/2007753; classtype:command-and-control; sid:2007753; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert dns any any -> $HOME_NET any (msg:"ET HUNTING Suspicious Registrar Nameservers in DNS Response (carbon2u)"; content:"|00 02 00 01|"; content:"|03|ns1|08|carbon2u|03|com|00|"; distance:14; within:18; fast_pattern; classtype:bad-unknown; sid:2027471; rev:1; metadata:created_at 2019_06_14, deployment Perimeter, former_category INFO, performance_impact Low, signature_severity Major, updated_at 2019_06_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Socks666 Connection Initial Packet"; flow:established,to_server; dsize:24; content:"|9a 02 06 00|"; offset:0; depth:4; flowbits:set,BS.BPcheckin; flowbits:noalert; reference:url,doc.emergingthreats.net/2006396; classtype:trojan-activity; sid:2006395; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux.Ngioweb Stage 1 CnC Activity Server Response (WAIT)"; flow:established,to_client; flowbits:isset,ET.Linux.Ngioweb; content:" 200 OK|0d 0a|"; content:"|0d 0a 0d 0a|WAIT "; distance:0; fast_pattern; reference:url,blog.netlab.360.com/an-analysis-of-linux-ngioweb-botnet-en/; classtype:command-and-control; sid:2027508; rev:2; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2019_06_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2019_06_21;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Socks666 Connect Command Packet"; flowbits:isset,BS.BPcheckin; flow:established,from_server; dsize:10; content:"|9a 02 07 00|"; offset:0; depth:4; flowbits:set,BS.BPset; reference:url,doc.emergingthreats.net/2006396; classtype:trojan-activity; sid:2006396; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux.Ngioweb Stage 1 CnC Activity Server Response (CONNECT)"; flow:established,to_client; flowbits:isset,ET.Linux.Ngioweb; content:" 200 OK|0d 0a|"; content:"|0d 0a 0d 0a|CONNECT "; distance:0; fast_pattern; reference:url,blog.netlab.360.com/an-analysis-of-linux-ngioweb-botnet-en/; classtype:command-and-control; sid:2027509; rev:2; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2019_06_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2019_06_21;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Socks666 Successful Connect Packet Packet"; flowbits:isset,BS.BPset; flow:established,to_server; dsize:16; content:"|9a 02 08 00|"; offset:0; depth:4; flowbits:set,BS.BPcheckin; tag:session,300,seconds; reference:url,doc.emergingthreats.net/2006396; classtype:trojan-activity; sid:2006397; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux.Ngioweb Stage 1 CnC Activity Server Response (DISCONNECT)"; flow:established,to_client; flowbits:isset,ET.Linux.Ngioweb; content:" 200 OK|0d 0a|"; content:"|0d 0a 0d 0a|DISCONNECT "; distance:0; fast_pattern; reference:url,blog.netlab.360.com/an-analysis-of-linux-ngioweb-botnet-en/; classtype:command-and-control; sid:2027510; rev:2; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2019_06_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2019_06_21;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Socks666 Checkin Packet"; flow:established,to_server; dsize:30; content:"|9a 02 01 00|"; offset:0; depth:4; flowbits:set,BS.BPcheckin1; flowbits:noalert; reference:url,doc.emergingthreats.net/2006396; classtype:command-and-control; sid:2006398; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux.Ngioweb Stage 1 CnC Activity Server Response (CERT)"; flow:established,to_client; flowbits:isset,ET.Linux.Ngioweb; content:" 200 OK|0d 0a|"; content:"|0d 0a 0d 0a|CERT "; distance:0; fast_pattern; reference:url,blog.netlab.360.com/an-analysis-of-linux-ngioweb-botnet-en/; classtype:command-and-control; sid:2027511; rev:2; metadata:affected_product Linux, attack_target Client_Endpoint, created_at 2019_06_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2019_06_21;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Socks666 Checkin Success Packet"; flowbits:isset,BS.BPcheckin1; flow:established,from_server; dsize:4; content:"|9a 02 05 00|"; offset:0; depth:4; reference:url,doc.emergingthreats.net/2006396; classtype:command-and-control; sid:2006399; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Cloned Cox Page - Possible Phishing Landing M2"; flow:established,to_client; content:"200"; http_stat_code; file_data; content:"<!-- saved from url=("; within:500; content:")https://idm.east.cox.net/"; distance:4; within:26; fast_pattern; classtype:social-engineering; sid:2027535; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2019_06_26, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2019_06_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert icmp any any -> any any (msg:"ET MALWARE Storm Worm ICMP DDOS Traffic"; itype:8; icode:0; dsize:32; content:"abcdefghijklmnopqr|00 00|"; depth:22; threshold:type both, track by_src, count 1, seconds 60; reference:url,doc.emergingthreats.net/2007618; classtype:trojan-activity; sid:2007618; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic Miarroba Phishing Landing"; flow:established,to_client; content:"200"; http_stat_code; file_data; content:"|3c 21 2d 2d 20 49 6e 73 65 72 74 65 64 20 62 79 20 6d 69 61 72 72 6f 62 61 20 2d 2d 3e|"; classtype:social-engineering; sid:2027561; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2019_06_26, deployment Perimeter, former_category PHISHING, signature_severity Minor, tag Phishing, updated_at 2019_06_26;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Themida Packed Binary - Likely Hostile"; flow:established,from_server; content:"|2E 69 64 61 74 61 20 20|"; content:"|54 68 65 6D 64 61 20 00|"; within:49; reference:url,www.oreans.com/themida.php; reference:url,cwsandbox.org/?page=samdet&id=164533&password=wnnpi; reference:url,doc.emergingthreats.net/2008341; classtype:trojan-activity; sid:2008341; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp any ![445,138,80] -> any any (msg:"ET HUNTING SUSPICIOUS IRC - PRIVMSG *.(exe|tar|tgz|zip)  download command"; flow:established,to_client; content:"PRIVMSG|20|"; pcre:"/^[^\r\n]+\.(?:t(?:ar|gz)|exe|zip)/Ri"; classtype:bad-unknown; sid:2017318; rev:5; metadata:created_at 2013_08_13, former_category CURRENT_EVENTS, updated_at 2019_07_01;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Turkojan C&C Initial Checkin (ams)"; flow:established,to_server; dsize:3; content:"ams"; reference:url,doc.emergingthreats.net/2008021; classtype:command-and-control; sid:2008021; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Godlua Backdoor Stage-3 Client Heartbeat (Jun 2019- Dec 2019) (set)"; flow:established,to_server; flowbits:set,ET.Godlua.heartbeat; flowbits:noalert; dsize:7; content:"|02 00 04 5d|"; depth:4; fast_pattern; reference:url,blog.netlab.360.com/an-analysis-of-godlua-backdoor-en/; classtype:trojan-activity; sid:2027672; rev:2; metadata:attack_target Client_Endpoint, created_at 2019_07_03, deployment Perimeter, former_category TROJAN, malware_family Godlua, performance_impact Moderate, signature_severity Major, tag Backdoor, updated_at 2019_07_03;)
+alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Turkojan C&C Logs Parse Command (LOGS1)"; flow:established,from_server; dsize:5; content:"LOGS1"; depth:5; reference:url,doc.emergingthreats.net/2008024; classtype:command-and-control; sid:2008024; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Godlua Backdoor Stage-3 Client Heartbeat (Dec 2019- Jul 2020) (set)"; flow:established,to_server; flowbits:set,ET.Godlua.heartbeat; flowbits:noalert; dsize:7; content:"|02 00 04 5e|"; depth:4; fast_pattern; reference:url,blog.netlab.360.com/an-analysis-of-godlua-backdoor-en/; classtype:trojan-activity; sid:2027673; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Linux, attack_target Client_Endpoint, created_at 2019_07_03, deployment Perimeter, former_category TROJAN, performance_impact Moderate, signature_severity Major, updated_at 2019_07_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Turkojan C&C Logs Parse Response Response (LOGS1)"; flow:established,to_server; content:"|08 00 00 00|LOGS1|5b|"; offset:0; depth:10; reference:url,doc.emergingthreats.net/2008025; classtype:command-and-control; sid:2008025; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Godlua Backdoor Stage-3 Client Heartbeat (Jul 2020- Jan 2021) (set)"; flow:established,to_server; flowbits:set,ET.Godlua.heartbeat; flowbits:noalert; dsize:7; content:"|02 00 04 5f|"; depth:4; fast_pattern; reference:url,blog.netlab.360.com/an-analysis-of-godlua-backdoor-en/; classtype:trojan-activity; sid:2027674; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Linux, attack_target Client_Endpoint, created_at 2019_07_03, deployment Perimeter, former_category TROJAN, malware_family Godlua, performance_impact Moderate, signature_severity Major, tag Backdoor, updated_at 2019_07_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Turkojan C&C Keepalive (BAGLANTI)"; flow:established,to_server; dsize:9; content:"BAGLANTI?"; reference:url,doc.emergingthreats.net/2008026; classtype:command-and-control; sid:2008026; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Godlua Backdoor Stage-3 Server Heartbeat Reply (Jun 2019 - Sep 2020)"; flow:established,to_client; flowbits:isset,ET.Godlua.heartbeat; dsize:13; content:"|02 00 0a 31 35|"; depth:5; fast_pattern; reference:url,blog.netlab.360.com/an-analysis-of-godlua-backdoor-en/; classtype:trojan-activity; sid:2027675; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Linux, attack_target Client_Endpoint, created_at 2019_07_03, deployment Perimeter, former_category TROJAN, malware_family Godlua, performance_impact Moderate, signature_severity Major, tag Backdoor, updated_at 2019_07_03;)
+alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Turkojan C&C Browse Drive Command (BROWSC)"; flow:established,from_server; dsize:<100; content:"BROWS"; depth:5; content:"|3a|"; distance:1; within:2; reference:url,doc.emergingthreats.net/2008027; classtype:command-and-control; sid:2008027; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Godlua Backdoor Stage-3 Server Heartbeat Reply (Sep 2020 - Nov 2023)"; flow:established,to_client; flowbits:isset,ET.Godlua.heartbeat; dsize:13; content:"|02 00 0a 31 36|"; depth:5; fast_pattern; reference:url,blog.netlab.360.com/an-analysis-of-godlua-backdoor-en/; classtype:trojan-activity; sid:2027676; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Linux, attack_target Client_Endpoint, created_at 2019_07_03, deployment Perimeter, former_category TROJAN, malware_family Godlua, performance_impact Moderate, signature_severity Major, tag Backdoor, updated_at 2019_07_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Turkojan C&C Browse Drive Command Response (metin)"; flow:established,to_server; content:"|00 00|metin|0d 3a|"; offset:2; depth:11; reference:url,doc.emergingthreats.net/2008028; classtype:command-and-control; sid:2008028; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Zoom Client Auto-Join (CVE-2019-13450)"; flow:established,to_client; file_data; content:"localhost|3a|19421/launch?action=join&confno="; reference:url,medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5; reference:cve,2019-13450; classtype:attempted-user; sid:2027696; rev:1; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2019_07_10, deployment Perimeter, former_category EXPLOIT, performance_impact Moderate, signature_severity Informational, updated_at 2019_07_10;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Turkojan C&C nxt Command Response (nxt)"; flow:established,from_server; dsize:16; content:"nxt|09 00 00 00|"; depth:7; offset:0; reference:url,doc.emergingthreats.net/2008030; classtype:command-and-control; sid:2008030; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Socks5 Proxy to Onion (set)"; flow:established,to_server; flowbits:set,ET.Socks5.OnionReq; content:"|05 01 00 03|"; depth:4; content:".onion|00 50|"; distance:0; fast_pattern; reference:url,www.intezer.com/blog-seizing-15-active-ransomware-campaigns-targeting-linux-file-storage-servers; classtype:policy-violation; sid:2027703; rev:1; metadata:attack_target Client_Endpoint, created_at 2019_07_11, deployment Perimeter, former_category POLICY, performance_impact Moderate, signature_severity Major, updated_at 2019_07_11;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 5190 (msg:"ET MALWARE Win32.Agent.bea C&C connection"; flow:to_server,established; dsize:24; content:"|9a 02 06 00|"; depth:4; reference:url,doc.emergingthreats.net/2007608; classtype:command-and-control; sid:2007608; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE eCh0raix/QNAPCrypt Requesting Key/Wallet/Note"; flow:established,to_server; flowbits:isset,ET.Socks5.OnionReq; flowbits:set,ET.QNAPCrypt.DetailReq; content:"GET /api/GetAvailKeysByCampId/"; depth:30; fast_pattern; content:".onion|0d 0a|User-Agent|3a 20|Go-http-client/1.1"; distance:0; reference:url,www.intezer.com/blog-seizing-15-active-ransomware-campaigns-targeting-linux-file-storage-servers; classtype:trojan-activity; sid:2027704; rev:1; metadata:attack_target IoT, created_at 2019_07_11, deployment Perimeter, former_category TROJAN, performance_impact Low, signature_severity Major, tag Ransomware, updated_at 2019_07_11;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Win32.Inject.zy Checkin Post"; flow:established,to_server; dsize:8; content:"|16 00 00 00 00 00 00 00|"; reference:url,doc.emergingthreats.net/2007966; classtype:command-and-control; sid:2007966; rev:2; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE eCh0raix/QNAPCrypt Successful Server Response"; flow:established,from_server; flowbits:isset,ET.QNAPCrypt.DetailReq; content:"HTTP/1.1 200 OK|0d 0a|"; depth:17; content:"Content-Type|3a 20|application/json"; distance:0; content:"|7b 22|RsaPublicKey|22 3a 22|-----BEGIN RSA PUBLIC KEY"; content:"|22 7d 2c 7b 22|BtcPublicKey|22 3a 22|"; fast_pattern; content:"|22 7d 2c 7b 22|Readme|22 3a 22|"; reference:url,www.intezer.com/blog-seizing-15-active-ransomware-campaigns-targeting-linux-file-storage-servers; classtype:trojan-activity; sid:2027705; rev:1; metadata:attack_target IoT, created_at 2019_07_11, deployment Perimeter, former_category TROJAN, performance_impact Low, signature_severity Major, updated_at 2019_07_11;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Proxy.Win32.Wopla.ag Server Reply"; dsize:12; flow:established,from_server; content:"|0d 00 00 00|"; depth:4; content:"|00 00 00 00 00 00|"; distance:2; within:6; reference:url,doc.emergingthreats.net/2007604; classtype:trojan-activity; sid:2007604; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Successful Generic Miarroba Phish 2019-07-11"; flow:from_server,established; flowbits:isset,ET.genericphish; file_data; content:"<!-- Inserted by miarroba -->"; fast_pattern; nocase; classtype:credential-theft; sid:2027699; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2019_07_11, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2019_07_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET MALWARE XP keylogger v2.1 mail report - Inbound"; flow:established,to_server; content:"X-Mailer|3a| JMail 4.3.0 Free Version by Dimac"; content:"<H2=3EAbout the use of the PC</H2=3E"; reference:url,doc.emergingthreats.net/2002940; classtype:trojan-activity; sid:2002940; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Netwire RAT Check-in (set)"; flow:established,to_server; dsize:>65; content:"|41 00 00 00 99|"; depth:5; flowbits:set,ET.NetwireRAT.Client; flowbits:noalert; reference:url,www.circl.lu/pub/tr-23/; reference:md5,3c4a93154378e17e71830ff164bb54c4; classtype:trojan-activity; sid:2029477; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_07_16, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Netwire, updated_at 2019_07_16;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE XP keylogger v2.1 mail report - Outbound"; flow:established,to_server; content:"X-Mailer|3a| JMail 4.3.0 Free Version by Dimac"; content:"<H2=3EAbout the use of the PC</H2=3E"; reference:url,doc.emergingthreats.net/2002942; classtype:trojan-activity; sid:2002942; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Blacknix CnC Checkin"; flow:to_server,established; dsize:200<>300; content:"|32|"; depth:1; content:"|7c 78 01|"; distance:2; within:3; pcre:"/^[0-9]{3}\x7cx/"; reference:md5,b4e95d3ec39cf8c7347ca1c64cfed631; classtype:command-and-control; sid:2027731; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_07_19, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Blacknix, updated_at 2019_07_19;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Yoda's Protector Packed Binary - VERY Likely Hostile"; flow:established,from_server; content:"|E8 03 00 00 00 EB 01|"; content:"|BB 55 00 00 00 E8 03 00 00 00 EB 01|"; within:14; reference:url,doc.emergingthreats.net/2009557; classtype:trojan-activity; sid:2009557; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Blacknix CnC Heartbeat"; flow:to_server,established; dsize:15; content:"|7c 78 01|"; offset:2; depth:3; pcre:"/^[0-9]{2}\x7cx/"; threshold: type both, track by_src, count 5, seconds 60; reference:md5,b4e95d3ec39cf8c7347ca1c64cfed631; classtype:command-and-control; sid:2027732; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_07_19, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Blacknix, updated_at 2019_07_19;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Torpig Related Fake User-Agent (Apache (compatible...))"; flow:established,to_server; content:"User-Agent|3a| Apache (compatible|3b| MSIE 6.0|3b| Windows NT 5.1|3b| SV1)"; http_header; reference:url,doc.emergingthreats.net/2010823; classtype:trojan-activity; sid:2010823; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert ssh [94.140.120.163,49.50.70.223,80.82.67.21,125.160.17.32] any -> any any (msg:"ET MALWARE Windigo SSH Connection Received (Ebury < 1.7.0)"; ssh_proto; content:"2.0"; ssh_software; pcre:"/^[a-f0-9]{40,}$/"; reference:url,security.web.cern.ch/security/advisories/windigo/windigo.shtml; classtype:trojan-activity; sid:2027729; rev:2; metadata:attack_target Client_Endpoint, created_at 2019_07_19, deployment Perimeter, former_category TROJAN, signature_severity Major, tag Windigo, updated_at 2019_07_19;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Trojan.Win32.Small.yml client registration"; flow:established,to_client; content:"|0d 0a|Content-Length|3a| "; depth:500; content:"|0d 0a 0d 0a|xxyysign|0d 0a|xxyyMyIP="; within:27; reference:url,doc.emergingthreats.net/2008950; classtype:trojan-activity; sid:2008950; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert ssh [94.140.120.163,49.50.70.223,80.82.67.21,125.160.17.32] any -> any any (msg:"ET MALWARE Windigo SSH Connection Received (Ebury > 1.7.0)"; ssh_proto; content:"2.0"; ssh_software; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$$/"; reference:url,security.web.cern.ch/security/advisories/windigo/windigo.shtml; classtype:trojan-activity; sid:2027730; rev:2; metadata:attack_target Client_Endpoint, created_at 2019_07_19, deployment Perimeter, former_category TROJAN, signature_severity Major, tag Windigo, updated_at 2019_07_19;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Trojan.Win32.Small.yml client command"; flow:established,to_client; content:"|0d 0a|Content-Length|3a| "; depth:500; content:"|0d 0a 0d 0a|xxyysign|0d 0a|xxyyUserNamePassWord="; within:40; reference:url,doc.emergingthreats.net/2008951; classtype:trojan-activity; sid:2008951; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET [443,7080,8080,80] (msg:"ET MALWARE W32/Emotet.v4 Checkin 3"; flow:established,to_server; content:"|20|MSIE|20|"; http_user_agent; pcre:"/^(?:\d{1,3}\.){3}\d{1,3}/W"; pcre:"/^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/Ps"; http_request_line; content:"POST / HTTP/1."; depth:14; fast_pattern; http_header_names; content:"|0d 0a|User-Agent|0d 0a|"; depth:14; content:!"Accept"; content:!"Referer"; content:!"Content-Type"; content:!"Cookie"; content:!"TagId"; http_content_len; byte_test:0,<=,999,0,string,dec; byte_test:0,>,99,0,string,dec; classtype:command-and-control; sid:2035050; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_09_19, deployment Perimeter, deprecation_reason False_Positive, former_category MALWARE, malware_family Emotet, signature_severity Major, updated_at 2022_04_18;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Win32/Winwebsec User-Agent Detected"; flow:established,to_server; content:"User-Agent|3a| InstallNotify/1.0"; http_header; reference:url,www.f-secure.com/sw-desc/rogue_w32_winwebsec.shtml; reference:url,blogs.technet.com/mmpc/archive/2009/05/13/msrt-tackles-another-rogue.aspx; reference:url,doc.emergingthreats.net/2009896; classtype:trojan-activity; sid:2009896; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 443 (msg:"ET MALWARE [GIGAMON_ATR] FIN8 BADHATCH Remote Shell Banner"; flow:established,to_server; dsize:>100; content:"|2a 20|SUPER|20|REMOTE|20|SHELL|20|v2|2e|2|20|SSL"; reference:url,atr-blog.gigamon.com/2019/07/23/abadbabe-8badf00d:-discovering-badhatch-and-a-detailed-look-at-fin8's-tooling/; classtype:targeted-activity; sid:2027751; rev:1; metadata:created_at 2019_07_23, deployment Perimeter, former_category TROJAN, malware_family ShellTea, performance_impact Low, signature_severity Major, tag Backdoor, updated_at 2019_07_23;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor.Win32.VB.fdi Bot Reporting to Controller"; flow:established,to_server; content:"state|3a| 0 - zombie is ready for control"; depth:38; reference:url,doc.emergingthreats.net/2008507; classtype:trojan-activity; sid:2008507; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 443 (msg:"ET MALWARE [GIGAMON_ATR] FIN8 BADHATCH CnC Checkin"; flow:established,to_server; dsize:64; content:"-SH"; offset:44; depth:3; pcre:"/(?:[0-9A-F]{8}\-){5}\-SH/"; content:"|02 09 01|"; offset:52; depth:3; reference:url,atr-blog.gigamon.com/2019/07/23/abadbabe-8badf00d:-discovering-badhatch-and-a-detailed-look-at-fin8's-tooling/; classtype:command-and-control; sid:2027752; rev:1; metadata:created_at 2019_07_23, deployment Perimeter, former_category MALWARE, malware_family ShellTea, performance_impact Low, signature_severity Major, tag Backdoor, updated_at 2019_07_23;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Banload Downloader Infection - Sending initial email to owner"; flow:established,to_server; content:"X-Library|3a| Indy 9"; nocase; content:"Dispositivo instalado."; nocase; content:"Maquina pronta para uso."; nocase; content:"Data|3a| "; nocase; content:"Hora|3a| "; nocase; content:"Development by "; nocase; reference:url,www.viruslist.com/en/viruses/encyclopedia?virusid=95586; reference:url,doc.emergingthreats.net/2002977; classtype:trojan-activity; sid:2002977; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert udp $HOME_NET any -> any 53 (msg:"ET DNS Query for .co TLD"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"|02|co|00|"; distance:0; fast_pattern; classtype:bad-unknown; sid:2027759; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2019_07_26, deployment Perimeter, former_category DNS, signature_severity Minor, updated_at 2019_07_26;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Banker.Delf Infection - Sending Initial Email to Owner"; flow:established,to_server; content:"X-Library|3a| Indy 9"; nocase; content:"Maquina.."; nocase; content:"Vers|e3|o do Windows"; nocase; content:"Microsoft Windows"; nocase; content:"Mac Address.."; nocase; reference:url,www.avira.com/en/threats/section/details/id_vir/1836/tr_banker.delf.df735649.html; reference:url,doc.emergingthreats.net/2002976; classtype:trojan-activity; sid:2002976; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Successful Generic Adobe Phish 2019-07-29"; flow:from_server,established; flowbits:isset,ET.genericphish; file_data; content:"<title>Adobe Document Cloud"; fast_pattern; nocase; classtype:credential-theft; sid:2027764; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2019_07_29, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2019_07_29, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Banker.Delf Infection variant 3 - Sending Initial Email to Owner"; flow:established,to_server; content:"X-Library|3a| Indy 9"; nocase; content:"Subject|3a| INFECT - "; nocase; content:"Data|3a| "; nocase; content:"Windows|3a| Microsoft Windows "; nocase; reference:url,www.avira.com/en/threats/section/details/id_vir/1836/tr_banker.delf.df735649.html; reference:url,doc.emergingthreats.net/2002980; classtype:trojan-activity; sid:2002980; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert icmp any any -> any any (msg:"ET MALWARE Possible ICMP Backdoor Tunnel Command - whoami"; itype:8; icode:0; content:"whoami"; depth:6; nocase; reference:url,www.hackingarticles.in/command-and-control-tunnelling-via-icmp; classtype:trojan-activity; sid:2027763; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_07_29, deployment Perimeter, former_category TROJAN, performance_impact Moderate, signature_severity Major, updated_at 2019_07_29;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Banker.Delf Infection variant 4 - Sending Initial Email to Owner"; flow:established,to_server; content:"X-Library|3a| Indy 9"; nocase; content:"Maquina"; nocase; content:"IP"; nocase; content:"Hora"; nocase; content:"Data"; nocase; content:"Microsoft Windows "; nocase; reference:url,www.avira.com/en/threats/section/details/id_vir/1836/tr_banker.delf.df735649.html; reference:url,doc.emergingthreats.net/2002981; classtype:trojan-activity; sid:2002981; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> any [!$HTTP_PORTS,1024:] (msg:"ET POLICY Windows Update P2P Activity"; flow:established,to_server; dsize:<100; content:"Swarm|20|protocol"; depth:20; classtype:not-suspicious; sid:2027766; rev:2; metadata:created_at 2019_07_31, updated_at 2019_07_31;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Delf/Hupigon C&C Channel Version Report"; flow:established,to_server; dsize:<25; content:"VERSON|3a|"; depth:7; reference:url,doc.emergingthreats.net/2007930; classtype:command-and-control; sid:2007930; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp any any -> any any (msg:"ET EXPLOIT Possible VXWORKS Urgent11 RCE Attempt - Urgent Flag"; flags:U+; reference:url,armis.com/urgent11; reference:cve,2019-12255; reference:cve,2019-12260; reference:cve,2019-12261; reference:cve,2019-12263; classtype:attempted-admin; sid:2027768; rev:1; metadata:attack_target Client_Endpoint, created_at 2019_07_31, deployment Perimeter, former_category EXPLOIT, signature_severity Major, updated_at 2019_07_31;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Donbot Connect to CnC"; flow:established,to_server; dsize:7; content:"HALLO|0d 0a|"; depth:7; reference:url,doc.emergingthreats.net/2008450; reference:url,blog.fireeye.com/research/2009/10/a-little_more_on_donbot.html; reference:url,www.avertlabs.com/research/blog/index.php/2009/04/05/donbot-joining-the-club-of-million-dollar-botnets/; classtype:command-and-control; sid:2008450; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert smtp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Phorpiex Template 5 Active - Outbound Malicious Email Spam"; flow:established,to_server; content:"one|20|of|20|your|20|passwords|20|is|3a|"; content:"infected|20|with|20|my|20|private|20|malware"; distance:0; content:"I|20|RECORDED|20|YOU|20 28|through|20|your|20|webcam"; distance:0; fast_pattern; content:"bitcoin|20|wallet|20|is|3a|"; threshold: type limit, count 1, seconds 60, track by_src; classtype:trojan-activity; sid:2027769; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_07_31, deployment Perimeter, former_category TROJAN, malware_family Phorpiex, performance_impact Low, signature_severity Major, tag SpamBot, updated_at 2019_07_31;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor.Win32.VB.cfi (related) System Info Upload via FTP"; flow:established,to_server; content:"*************CD-Key Pack**************"; content:"|0d 0a|Microsoft Windows Product ID CD Key|3a|"; distance:0; reference:url,doc.emergingthreats.net/2008005; classtype:trojan-activity; sid:2008005; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp any any -> any any (msg:"ET EXPLOIT Possible VXWORKS Urgent11 RCE Attempt - Illegal Urgent Flag"; flags:SUF+; reference:url,armis.com/urgent11; reference:cve,2019-12255; reference:cve,2019-12260; reference:cve,2019-12261; reference:cve,2019-12263; classtype:attempted-admin; sid:2027770; rev:2; metadata:attack_target Client_Endpoint, created_at 2019_08_01, deployment Perimeter, former_category EXPLOIT, signature_severity Major, updated_at 2019_08_01;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET MALWARE Likely eCard Malware Laden Email Inbound"; flow:established,to_server; content:"|0d 0a|Subject|3a| You have received an eCard"; nocase; content:"e-card.zip"; nocase; reference:url,www.sophos.com/blogs/gc/g/2008/10/15/you-have-not-received-an-ecard/; reference:url,doc.emergingthreats.net/2008674; classtype:trojan-activity; sid:2008674; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Covenant Framework HTTP Hello World Server Response"; flow:established,to_client; file_data; content:"Hello World! eyJHVUlEIjoi"; fast_pattern; threshold: type limit, count 1, seconds 60, track by_dst; reference:url,posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462; classtype:trojan-activity; sid:2027794; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_08_04, deployment Perimeter, signature_severity Major, updated_at 2019_08_04;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Egspy Infection Report Email"; flow:established,to_server; content:"FROM\: EgySpy Victim"; content:"TO|3a| EgySpy User"; distance:0; content:"SUBJECT|3a| E g y S p y KeyLogger"; distance:0; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=EgySpy&threatid=48410; reference:url,doc.emergingthreats.net/2008039; classtype:trojan-activity; sid:2008039; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Covenant Framework Grunt Stager HTTP Download (Grunt.GruntStager)"; flow:established,to_client; file_data; content:".CreateInstance(|27|Grunt.GruntStager|27|)"; fast_pattern; reference:url,github.com/cobbr/Covenant; reference:url,posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462; classtype:trojan-activity; sid:2027795; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_08_04, deployment Perimeter, signature_severity Major, updated_at 2019_08_04;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE GENERAL Possible Trojan Sending Initial Email to Owner - INFECTADO"; flow:established,to_server; content:"Subject|3a| Microsoft Windows"; nocase; content:"INFECTADO"; nocase; within:20; reference:url,doc.emergingthreats.net/2002982; classtype:trojan-activity; sid:2002982; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Covenant Framework Grunt Stager HTTP Download (DynamicInvoke)"; flow:established,to_client; file_data; content:"toStream(assembly_str)"; content:"delegate.DynamicInvoke(array.ToArray()).CreateInstance("; distance:0; fast_pattern; reference:url,github.com/cobbr/Covenant; reference:url,posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462; classtype:trojan-activity; sid:2027796; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_08_04, deployment Perimeter, signature_severity Major, updated_at 2019_08_04;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE IE Ilookup Trojan"; flow: from_server,established; content:"#@~^/gAAAA==@#@&@#@&7lMP|3a|HVK^P{P[W1Ehn"; content:"#@~^GAIAAA==@#@&\\CMPsX/DD,xPvEU+kmC2"; reference:url,62.131.86.111/analysis.htm; reference:url,doc.emergingthreats.net/2001066; classtype:misc-activity; sid:2001066; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Covenant Framework Grunt PowerShell Stager HTTP Download"; flow:established,to_client; file_data; content:"IO.Compression.CompressionMode]|3a 3a|Decompress"; content:".Value.Write("; distance:0; content:"Reflection.Assembly]|3a 3a|Load("; fast_pattern; distance:0; content:".EntryPoint.Invoke("; distance:0; content:"Out-Null"; distance:0; reference:url,github.com/cobbr/Covenant; reference:url,posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462; classtype:trojan-activity; sid:2027797; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_08_04, deployment Perimeter, signature_severity Major, updated_at 2019_08_04;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Possible Infection Report Mail - Indy Mail lib and No Message Body - Priority 1"; flow:established,to_server; content:"|0d 0a|X-Priority|3a| 1|0d 0a|X-Library|3a| Indy "; content:"|0d 0a 0d 0a 2e 0d 0a|"; within:30; reference:url,doc.emergingthreats.net/2007611; classtype:trojan-activity; sid:2007611; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Covenant Framework Grunt MSBuild Stager HTTP Download"; flow:established,to_client; file_data; content:"System.IO.Compression.CompressionMode.Decompress"; content:"System.Reflection.Assembly.Load("; distance:0; content:".EntryPoint.Invoke("; distance:0; fast_pattern; content:"|3c 2f|UsingTask|3e|"; distance:0; reference:url,github.com/cobbr/Covenant; reference:url,posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462; classtype:trojan-activity; sid:2027798; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_08_04, deployment Perimeter, signature_severity Major, updated_at 2019_08_04;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Possible Infection Report Mail - Indy Mail lib and No Message Body - Priority 3"; flow:established,to_server; content:"|0d 0a|X-Priority|3a| 3|0d 0a|X-Library|3a| Indy "; content:"|0d 0a 0d 0a 2e 0d 0a|"; within:30; reference:url,doc.emergingthreats.net/2007612; classtype:trojan-activity; sid:2007612; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Nyanw0rm CnC Keep-Alive (Outbound) M2"; flow:established,to_server; dsize:16; content:"|49 42 d4 b5 38 70 fe 86 2a 4e d2 73 0d 95 79 e5|"; reference:md5,5c12015ebeb755c0b6029468a13e59a9; classtype:command-and-control; sid:2027813; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_08_07, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Nyanw0rm, updated_at 2019_08_07;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Possible Infection Report Mail - Indy Mail lib and MAC Message Body - Priority 1"; flow:established,to_server; content:"|0d 0a|X-Priority|3a| 1|0d 0a|X-Library|3a| Indy "; content:"|0d 0a|MAC......."; nocase; within:20; reference:url,doc.emergingthreats.net/2007613; classtype:trojan-activity; sid:2007613; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Nyanw0rm CnC Keep-Alive (Outbound) M1"; flow:established,to_server; dsize:16; content:"|73 08 e2 bc 6d 8c 9d b5 85 52 b1 e1 5d 5a 9a 8e|"; reference:md5,d6db3ac5a8022184f03a34fbfdcb926d; classtype:command-and-control; sid:2027812; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_08_07, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Nyanw0rm, updated_at 2019_08_07;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Possible Infection Report Mail - Indy Mail lib and MAC Message Body - Priority 3"; flow:established,to_server; content:"|0d 0a|X-Priority|3a| 3|0d 0a|X-Library|3a| Indy "; content:"|0d 0a|MAC......."; nocase; within:20; reference:url,doc.emergingthreats.net/2007614; classtype:trojan-activity; sid:2007614; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ELF/Emptiness v1 UDP Flood Command Inbound"; flow:established,from_server; content:".udp|20|"; depth:5; fast_pattern; pcre:"/^((?:\d{1,3}\.){3}\d{1,3}|((?:https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})/Ri"; reference:url,blog.netlab.360.com/emptiness-a-new-evolving-botnet/; classtype:trojan-activity; sid:2027837; rev:2; metadata:affected_product Linux, created_at 2019_08_09, deployment Perimeter, former_category TROJAN, malware_family Emptiness, performance_impact Low, signature_severity Major, tag DDoS, updated_at 2019_08_09;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET [587,25] (msg:"ET MALWARE LDPinch Reporting infection via Email"; flow:established,to_server; content:"X-Mailer|3a| Blat v2.6.2 w/GSS encryption, a Win32 SMTP/NNTP mailer http|3a|//www.blat.net|0d 0a|"; content:"|0d 0a|Subject|3a| Contents of file|3a| WINDOWS/system32/"; distance:0; reference:url,doc.emergingthreats.net/2009242; classtype:trojan-activity; sid:2009242; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ELF/Emptiness v1 DNS Flood Command Inbound"; flow:established,from_server; content:".dns|20|"; depth:5; fast_pattern; pcre:"/^((\d{1,3}\.){3}\d{1,3}|((?:https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})/Ri"; reference:url,blog.netlab.360.com/emptiness-a-new-evolving-botnet/; classtype:trojan-activity; sid:2027838; rev:1; metadata:affected_product Linux, created_at 2019_08_09, former_category TROJAN, malware_family Emptiness, tag DDoS, updated_at 2019_08_09;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Trojan-PWS.Win32.Small.gs Passwords leak over FTP"; flow:established,to_server; content:"IE7 Passwords|3a|"; depth:14; content:"FF Passwords"; within:500; reference:url,doc.emergingthreats.net/2008841; classtype:trojan-activity; sid:2008841; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ELF/Emptiness v1 HTTP Flood Command Inbound"; flow:established,from_server; content:".http|20|"; depth:6; fast_pattern; pcre:"/^((\d{1,3}\.){3}\d{1,3}|((?:https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})/Ri"; reference:url,blog.netlab.360.com/emptiness-a-new-evolving-botnet/; classtype:trojan-activity; sid:2027839; rev:1; metadata:affected_product Linux, created_at 2019_08_09, former_category TROJAN, malware_family Emptiness, tag DDoS, updated_at 2019_08_09;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Perfect Keylogger FTP Log Upload"; flow:established,to_server; content:"Log upload date|3a| "; depth:17; content:"|0d 0a|Time|3a| "; within:40; content:"To view DAT files, please do the following steps|3a|"; distance:0; reference:url,doc.emergingthreats.net/2007974; classtype:trojan-activity; sid:2007974; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ELF/Emptiness v1.1 UDP Flood Command Inbound"; flow:established,from_server; content:"LnVkcC"; depth:6; fast_pattern; pcre:"/^(?:[A-Z0-9+/]{4})*(?:[A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$/i"; reference:url,blog.netlab.360.com/emptiness-a-new-evolving-botnet/; classtype:trojan-activity; sid:2027840; rev:1; metadata:affected_product Linux, created_at 2019_08_09, former_category TROJAN, malware_family Emptiness, tag DDoS, updated_at 2019_08_09;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Silon Encrypted Data POST to C&C"; flow:established,to_server; content:".php?i="; nocase; http_uri; content:"&k="; nocase; http_uri; pcre:"/\.php\?i=\w+_[0-9A-F]{8}&k=\d+$/Ui"; reference:url,www.trusteer.com/webform/w32silon-malware-analysis; reference:url,doc.emergingthreats.net/2010201; classtype:command-and-control; sid:2010201; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ELF/Emptiness v1.1 DNS Flood Command Inbound"; flow:established,from_server; content:"LmRucy"; depth:6; fast_pattern; pcre:"/^(?:[A-Z0-9+/]{4})*(?:[A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$/i"; reference:url,blog.netlab.360.com/emptiness-a-new-evolving-botnet/; classtype:trojan-activity; sid:2027841; rev:1; metadata:affected_product Linux, created_at 2019_08_09, former_category TROJAN, malware_family Emptiness, tag DDoS, updated_at 2019_08_09;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Snatch Reporting User Activity"; flow:established,to_server; content:"/snatch/module"; http_uri; content:"User-Agent|3a 20|Snatch-System"; http_header; reference:url,doc.emergingthreats.net/2003515; classtype:trojan-activity; sid:2003515; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ELF/Emptiness v2 XOR UDP Flood Command Inbound"; flow:established,from_server; content:"|fe d5 57 68 f0 44 fb|"; depth:7; fast_pattern; pcre:"/^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]/"; reference:url,blog.netlab.360.com/emptiness-a-new-evolving-botnet/; classtype:trojan-activity; sid:2027843; rev:1; metadata:affected_product Linux, created_at 2019_08_09, former_category TROJAN, malware_family Emptiness, tag DDoS, updated_at 2019_08_09;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE 3alupKo/Win32.Socks.n Related Checkin URL"; flow:established,to_server; content:".php?"; http_uri; content:"&v="; http_uri; content:"&s="; http_uri; content:"&cip="; http_uri; content:"&lid="; http_uri; reference:url,doc.emergingthreats.net/2008280; classtype:command-and-control; sid:2008280; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ELF/Emptiness v2 XOR DNS Flood Command Inbound"; flow:established,from_server; content:"|fe d6 53 76 f0 7e fb|"; depth:7; fast_pattern; pcre:"/^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]/"; reference:url,blog.netlab.360.com/emptiness-a-new-evolving-botnet/; classtype:trojan-activity; sid:2027844; rev:1; metadata:affected_product Linux, created_at 2019_08_09, former_category TROJAN, malware_family Emptiness, tag DDoS, updated_at 2019_08_09;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE 3alupKo/Win32.Socks.n Related Checkin URL (2)"; flow:established,to_server; content:"/?&v="; http_uri; content:"&s="; http_uri; content:"&cip="; http_uri; content:"&lid="; http_uri; reference:url,doc.emergingthreats.net/2008393; classtype:command-and-control; sid:2008393; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ELF/Emptiness v2 XOR HTTP Flood Command Inbound"; flow:established,from_server; content:"|fe d6 69 33 f7 4f fb c5|"; depth:8; fast_pattern; pcre:"/^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]/"; reference:url,blog.netlab.360.com/emptiness-a-new-evolving-botnet/; classtype:trojan-activity; sid:2027845; rev:1; metadata:affected_product Linux, created_at 2019_08_09, former_category TROJAN, malware_family Emptiness, tag DDoS, updated_at 2019_08_09;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE 3alupKo/Win32.Socks.n Related Checkin URL (3)"; flow:established,to_server; content:"&ns="; http_uri; content:"&id="; http_uri; content:"User-Agent|3a| Mozilla|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2008395; classtype:command-and-control; sid:2008395; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ELF/Emptiness v2 XOR Exec Command Inbound"; flow:established,from_server; content:"|fe d6 57 37 c9 50 f7|"; depth:7; fast_pattern; pcre:"/^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]/"; reference:url,blog.netlab.360.com/emptiness-a-new-evolving-botnet/; classtype:trojan-activity; sid:2027846; rev:1; metadata:affected_product Linux, created_at 2019_08_09, former_category TROJAN, malware_family Emptiness, tag DDoS, updated_at 2019_08_09;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Zalupko/Koceg/Mandaph manda.php Checkin"; flow:established,to_server; content:"/manda.php?"; nocase; http_uri; content:"ns="; nocase; http_uri; content:"&id="; nocase; http_uri; reference:url,doc.emergingthreats.net/2008324; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Backdoor%3aWin32%2fKoceg.gen!B; reference:md5,b2aad8e259cbfdd2ba1fcbf22bcee2e9; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2008-042816-0445-99&tabid=2; classtype:command-and-control; sid:2008324; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ELF/Emptiness v2 XOR Update Command Inbound"; flow:established,from_server; content:"|fe d5 57 74 c9 40 fc 92 e8|"; depth:9; fast_pattern; pcre:"/^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]/"; reference:url,blog.netlab.360.com/emptiness-a-new-evolving-botnet/; classtype:trojan-activity; sid:2027847; rev:1; metadata:affected_product Linux, created_at 2019_08_09, former_category TROJAN, malware_family Emptiness, tag DDoS, updated_at 2019_08_09;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Fake.Googlebar or Softcash.org Related Post-Infection Checkin"; flow:established,to_server; content:"bl="; http_uri; content:"&cuid="; http_uri; content:"&cnid="; http_uri; content:"&luid="; http_uri; content:"&rnd="; http_uri; reference:url,doc.emergingthreats.net/2008236; classtype:command-and-control; sid:2008236; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp any any -> $EXTERNAL_NET any (msg:"ET MALWARE ELF/Mirai.shiina v3 CnC Checkin"; flow:established,to_server; content:"|01 03 03 07 04 02 00 06|"; depth:8; fast_pattern; reference:url,blog.netlab.360.com/emptiness-a-new-evolving-botnet/; classtype:command-and-control; sid:2027848; rev:1; metadata:affected_product Linux, created_at 2019_08_09, former_category MALWARE, malware_family Mirai, tag DDoS, updated_at 2019_08_09;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Spyguarder.com Fake AV Install Report"; flow:established,to_server; content:"/statscnt.js?scrW="; http_uri; content:"&scrH="; http_uri; content:"&ua="; http_uri; content:"&referer="; http_uri; content:"&ref_id="; http_uri; content:"&cn_id="; http_uri; reference:url,doc.emergingthreats.net/2008911; classtype:trojan-activity; sid:2008911; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO HTTP Request to Suspicious *.biz Domain"; flow:established,to_server; content:".biz"; fast_pattern; http_host; isdataat:!1,relative; reference:url,www.spamhaus.org/statistics/tlds/; classtype:bad-unknown; sid:2027872; rev:2; metadata:created_at 2019_08_13, deployment Perimeter, former_category HUNTING, performance_impact Low, signature_severity Minor, updated_at 2019_08_13;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Ssppyy.com Surveillance Agent Reporting via Email"; flow:established,to_server; content:"|0d 0a|Subject|3a| SSPPYY notification|0d 0a|X=Mailer|3a| Mail|0d 0a|"; content:"The computer you are monitoring has connected online - The module name of"; distance:5; reference:url,doc.emergingthreats.net/2007780; classtype:trojan-activity; sid:2007780; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET MALWARE Possible Variant.Kazy.53640 Malformed Client Hello SSL 3.0 (Session_Id length greater than Client_Hello Length)"; flow:to_server,established; content:"|16 03 00|"; depth:3; content:"|01|"; distance:2; within:1; byte_extract:3,0,SSL.Client_Hello.length,relative; byte_test:1,>,SSL.Client_Hello.length,34,relative; threshold: type both, track by_src, count 5, seconds 60; reference:md5,a01d75158cf4618677f494f9626b1c4c; classtype:trojan-activity; sid:2014634; rev:2; metadata:created_at 2012_04_24, updated_at 2019_08_13;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Possible Storm Variant HTTP Post (U)"; flow:established,to_server; content:"POST /u/ HTTP"; depth:13; nocase; content:"User-Agent|3a| Internet Explorer|0d 0a|"; http_header; content:"a="; http_client_body; depth:2; content:!"Referer|3a|"; nocase; http_header; reference:url,cyber.secdev.ca/2009/11/russian-malware-bundle; reference:url,www.blackhat.com/presentations/bh-usa-08/Stewart/BH_US_08_Stewart_Protocols_of_the_Storm.pdf; reference:url,doc.emergingthreats.net/2010442; classtype:trojan-activity; sid:2010442; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SpywareLabs VirtualBouncer Seeking Instructions"; flow: to_server,established; content:"instructions"; nocase; pcre:"/instructions\/\d{2}\.xml/mi"; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.virtualbouncer.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000587; classtype:pup-activity; sid:2000587; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Possible Storm Variant HTTP Post (S)"; flow:established,to_server; content:"POST /s/ HTTP"; depth:13; nocase; content:"User-Agent|3a| Internet Explorer|0d 0a|"; http_header; content:"a="; http_client_body; depth:2; content:!"Referer|3a|"; nocase; http_header; reference:url,cyber.secdev.ca/2009/11/russian-malware-bundle; reference:url,www.blackhat.com/presentations/bh-usa-08/Stewart/BH_US_08_Stewart_Protocols_of_the_Storm.pdf; reference:url,doc.emergingthreats.net/2010441; classtype:trojan-activity; sid:2010441; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP TopMoxie Retrieving Data (downloads)"; flow: to_server,established; content:"/external/builds/downloads2/"; http_uri; nocase; reference:url,www.topmoxie.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000589; classtype:pup-activity; sid:2000589; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Stormy Variant HTTP Request"; flow:established,to_server; content:"/zzu/zc.php?l="; nocase; http_uri; content:"&d="; nocase; http_uri; content:"&v="; nocase; http_uri; content:"&k="; nocase; http_uri; reference:url,doc.emergingthreats.net/2003435; classtype:trojan-activity; sid:2003435; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP TopMoxie Retrieving Data (common)"; flow: to_server,established; content:"/external/builds/common/"; http_uri; nocase; reference:url,www.topmoxie.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000590; classtype:pup-activity; sid:2000590; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Stpage Checkin (nomodem)"; flow:established,to_server; content:"/nomodem.php"; http_uri; content:"if="; http_uri; content:"&am="; http_uri; content:"&cl={"; http_uri; content:"&id="; http_uri; reference:url,doc.emergingthreats.net/2008522; classtype:command-and-control; sid:2008522; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Keenvalue Update Engine"; flow: to_server,established; content:"Host|3a|secure.keenvalue.com"; http_header; content:"|0d0a|Extension|3a|Remote-Passphrase"; reference:url,www.safer-networking.org/index.php?page=updatehistory&detail=2003-11-24; reference:url,doc.emergingthreats.net/bin/view/Main/2000932; classtype:pup-activity; sid:2000932; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE W32.Downloader Tibs.jy Reporting to C&C"; flow:established,to_server; content:"/post.php"; nocase; http_uri; content:"User-Agent|3a| Mozilla/3.0b5a (Win95|3b| I)"; http_header; nocase; content:"data="; nocase; reference:url,doc.emergingthreats.net/2003238; classtype:command-and-control; sid:2003238; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP Webhancer Data Upload"; flow: from_server,established; content:"WebHancer Authority Server"; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/spyware.webhancer.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001317; classtype:pup-activity; sid:2001317; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Tibs Checkin 2"; flow:established,to_server; content:"/cntr.php?e="; nocase; http_uri; content:"&x="; nocase; http_uri; reference:url,doc.emergingthreats.net/2002961; classtype:command-and-control; sid:2002961; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP E2give Related Receiving Config"; flow:established,to_server; http.uri; content:"/config/?"; nocase; content:"v=5"; nocase; content:"n=mm2"; nocase; content:"i="; nocase; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=E2Give&threatid=4728; reference:url,doc.emergingthreats.net/bin/view/Main/2001417; classtype:pup-activity; sid:2001417; rev:11; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2022_04_18;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Generic Spyware Update Download"; flow:established,to_server; content:"/synctl/task.fcgi?"; nocase; http_uri; content:"id="; nocase; http_uri; content:"&v="; nocase; http_uri; reference:url,doc.emergingthreats.net/2002964; classtype:trojan-activity; sid:2002964; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Overpro Spyware Bundle Install"; flow: to_server,established; content:"Host|3a| download.overpro.com"; nocase; http_header; pcre:"/(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/WildApp\.cab/i"; reference:url,www.wildarcade.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001444; classtype:pup-activity; sid:2001444; rev:14; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Trats.a Post-Infection Checkin"; flow:established,to_server; content:"AID="; http_uri; content:"GUID="; nocase; http_uri; content:"POST"; depth:4; http_method; content:"|0d 0a|SPK|3a| "; fast_pattern; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 6.0) WinNT 5.1|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2008155; classtype:command-and-control; sid:2008155; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Overpro Spyware Games"; flow: to_server,established; content:"/blocks/blasterblocks"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.overpro.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001459; classtype:pup-activity; sid:2001459; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE BackDoor-EGB Check-in"; flow:established,to_server; content:"GET"; depth:3; http_method; content:".asp"; http_uri; content:"?username="; http_uri; content:"&serverMac="; http_uri; content:"&edition="; pcre:"/.asp\?username=.+&serverMac=([0-9A-F]{2}-){5}[0-9A-F]{2}&edition=/Ui"; reference:url,doc.emergingthreats.net/2009532; reference:url,home.mcafee.com/virusinfo/virusprofile.aspx?key=239060; classtype:trojan-activity; sid:2009532; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP Searchmiracle.com Spyware Installer silent.exe Download"; flow: from_server,established; content:"|20 28 43 29 20 32 30 30 31 2c 20 32 30 30 33 20 52 61 64 69 6d 20 50 69 63 68 61|"; reference:url,www.searchmiracle.com/silent.exe; reference:url,doc.emergingthreats.net/bin/view/Main/2001533; classtype:pup-activity; sid:2001533; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE smain?scout=acxc Generic Download landing"; flow:established,to_server; content:"GET"; depth:3; http_method; nocase; content:"/smain?scout=acxc"; nocase; http_uri; pcre:"/\/smain\?scout=acxc[a-z]{3}$/Ui"; reference:url,www.bluetack.co.uk/forums/lofiversion/index.php/t18462.html; reference:md5,513077916da4e86827a6000b40db95d5; reference:url,doc.emergingthreats.net/2010822; classtype:trojan-activity; sid:2010822; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP A-d-w-a-r-e.com Activity (popup)"; flow: established,to_server; content:"/cgi-bin/PopupV"; http_uri; nocase; content:"?ID={"; http_uri; nocase; reference:url,www.a-d-w-a-r-e.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001730; classtype:pup-activity; sid:2001730; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Vanquish Trojan HTTP Checkin"; flow:established,to_server; content:"ip="; http_uri; content:"&v=1&s="; http_uri; content:"&h="; http_uri; content:"&kb="; http_uri; content:"&o="; http_uri; content:"&c="; http_uri; content:"&un="; http_uri; content:"&m="; http_uri; content:"&w="; http_uri; content:"&ss="; http_uri; reference:url,doc.emergingthreats.net/2007698; classtype:command-and-control; sid:2007698; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Likely Trojan/Spyware Installer Requested (1)"; flow: established,to_server; content:".scr"; nocase; http_uri; pcre:"/(cartao|mensagem|voxcards|humortadela|ouca|cartaovirtual|uol3171|embratel|yahoo|viewforhumor|humormenssagem|terra)\.scr/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2001850; classtype:pup-activity; sid:2001850; rev:12; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Virtumonde Variant Reporting to Controller via HTTP"; flow:established,to_server; content:"?sid="; http_uri; pcre:"/\?sid=[0-9A-F]{180}/U"; reference:url,doc.emergingthreats.net/2007142; classtype:trojan-activity; sid:2007142; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP 180solutions Spyware Install"; flow: to_server,established; content:"/downloads/installers/"; http_uri; nocase; content:"simpleinternet/180sainstaller.exe"; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002003; classtype:pup-activity; sid:2002003; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Virtumonde Variant Reporting to Controller via HTTP (2)"; flow:established,to_server; content:"php?"; nocase; http_uri; content:"cmp="; nocase; http_uri; content:"&guid="; nocase; http_uri; content:"&affid="; nocase; http_uri; content:"&run="; nocase; http_uri; content:"&dn_uid="; nocase; http_uri; content:"&dn_affid="; nocase; http_uri; content:"&vm_guid="; nocase; http_uri; content:"&ip="; nocase; http_uri; content:"&altid="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007285; classtype:trojan-activity; sid:2007285; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Overpro Spyware Install Report"; flow: to_server,established; content:"/processInstall.aspx"; nocase; http_uri; reference:url,securityresponse.symantec.com/avcenter/venc/data/adware.overpro.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002017; classtype:pup-activity; sid:2002017; rev:10; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Virut Counter/Check-in"; flow:established,to_server; content:"POST"; depth:4; http_method; content:".asp?mac="; http_uri; content:"&rw="; http_uri; content:"&ver="; http_uri; pcre:"/.asp\?mac=([0-9A-F]{2}-){5}([0-9A-F]{2})/Ui"; reference:url,www.threatexpert.com/reports.aspx?find=ipk8888.cn&x=0&y=0; reference:url,doc.emergingthreats.net/2009457; classtype:trojan-activity; sid:2009457; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP 180solutions Spyware Defs Download"; flow: to_server,established; content:"/geodefs/gdf"; http_uri; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002048; classtype:pup-activity; sid:2002048; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Virut/Virutas/Virtob/QQHelper Dropper Family - HTTP GET"; flow:established,to_server; content:"GET"; depth:3; http_method; content:"?SoftName="; nocase; http_uri; content:"&SoftVersion="; nocase; http_uri; content:"&UserIP"; nocase; http_uri; content:"&Mac"; nocase; http_uri; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AWin32%2FQQHelper.gen!E&ThreatID=-2147371486; reference:url,www.sophos.com/security/analyses/viruses-and-spyware/w32viruti.html; reference:url,www.threatexpert.com/threats/w32-virut-i.html; reference:url,doc.emergingthreats.net/2009829; classtype:trojan-activity; sid:2009829; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Likely Trojan/Spyware Installer Requested (2)"; flow: established,to_server; content:".exe"; nocase; http_uri; pcre:"/(discador|ocartao|msgav|extrato|correcao|extrato_tim|visualizar|cartas&cartoes|embratel|cartao|MSN_INSTALL|VirtualCards|atualizacaonorton|serasar|CobrancaEmbratel|ExtratoTim|FlashFotos|Vacina-Norton|CartaoIloves|Cobranca|fotos_ineditas|boletocobranca|saudades|wwwuolcartoescombr|cartaoanimado)\.exe/Ui"; reference:url,doc.emergingthreats.net/bin/view/Main/2002093; classtype:pup-activity; sid:2002093; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Vundo.dam http Update"; flow:established,to_server; content:"/cgi-bin/heartbeat.php"; nocase; http_uri; content:"uid="; nocase; http_uri; content:"&affiliate_id="; nocase; http_uri; content:"&db=1"; nocase; http_uri; content:"&version="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007573; classtype:trojan-activity; sid:2007573; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP 180solutions Spyware config Download"; flow: to_server,established; content:"/config.aspx?did="; http_uri; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002099; classtype:pup-activity; sid:2002099; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Vundo HTTP Pre-Install Checkin"; flow:established,to_server; content:"/app/preinstall.php?"; nocase; http_uri; content:"t_uid="; nocase; http_uri; content:"&t_pid="; nocase; http_uri; content:"&t_mac="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007989; classtype:command-and-control; sid:2007989; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP 180solutions Spyware versionconfig POST"; flow:to_server,established; content:"/versionconfig.aspx?"; http_uri; content:"&ver="; http_uri; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2002354; classtype:pup-activity; sid:2002354; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Vundo HTTP Post-Install Checkin"; flow:established,to_server; content:"/app/install_done.php?"; nocase; http_uri; content:"t_uid="; nocase; http_uri; content:"&t_pid="; nocase; http_uri; content:"&t_mac="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007990; classtype:command-and-control; sid:2007990; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP 180solutions Spyware Actionlibs Download"; flow:to_server,established; content:"/actionurls/ActionUrlb"; http_uri; nocase; content:"partnerid="; http_uri; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003057; classtype:pup-activity; sid:2003057; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Vundo HTTP Post-Install Checkin (2)"; flow:established,to_server; content:"?w="; nocase; http_uri; content:"&ucid="; nocase; http_uri; content:"&e=00"; nocase; http_uri; content:"&err="; nocase; http_uri; reference:url,doc.emergingthreats.net/2008082; classtype:command-and-control; sid:2008082; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP 180solutions (Zango) Spyware TB Installer Download"; flow:to_server,established; content:"/ZangoTBInstaller.exe"; http_uri; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003059; classtype:pup-activity; sid:2003059; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Vundo Variant reporting to Controller via HTTP (1)"; flow:established,to_server; content:"POST"; depth:4; http_method; content:"/req.html?suid=&cuid="; http_uri; content:"&tid="; http_uri; content:"&cver="; http_uri; content:"&affid="; http_uri; reference:url,doc.emergingthreats.net/2008976; classtype:trojan-activity; sid:2008976; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP 180solutions (Zango) Spyware Event Activity Post"; flow:to_server,established; content:"/php/uci.php"; http_uri; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003061; classtype:pup-activity; sid:2003061; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Vundo Variant reporting to Controller via HTTP (2)"; flow:established,to_server; content:"GET"; depth:3; http_method; content:"?cuid="; http_uri; content:"&suid="; http_uri; content:"&affid="; http_uri; reference:url,doc.emergingthreats.net/2008977; classtype:trojan-activity; sid:2008977; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Bestcount.net Spyware Data Upload"; flow:established,to_server; content:"/objects/ocget.dll"; nocase; http_uri; content:"mybest"; nocase; reference:url,reports.internic.net/cgi/whois?whois_nic=bestcount.net&type=domain; reference:url,doc.emergingthreats.net/bin/view/Main/2003154; classtype:pup-activity; sid:2003154; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Possible Vundo EXE Download Attempt"; flow:established,to_server; content:"GET"; depth:3; http_method; content:"/dwn/d.html?sid="; http_uri; urilen: > 80; reference:url,doc.emergingthreats.net/2009174; classtype:trojan-activity; sid:2009174; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP AntiVermins.com Fake Antispyware Package User-Agent (AntiVerminser)"; flow:to_server,established; content:"User-Agent|3a|"; nocase; http_header; content:"AntiVerminser"; http_header; fast_pattern:only; reference:url,doc.emergingthreats.net/2003336; classtype:pup-activity; sid:2003336; rev:15; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2020_08_20;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE w32agent.dsi Domain Update"; flow:established,to_server; content:"/getgewinnspiel.php?uid="; http_uri; reference:url,doc.emergingthreats.net/2002782; classtype:trojan-activity; sid:2002782; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP AskSearch Toolbar Spyware User-Agent (AskBar)"; flow:to_server,established; content:"|3b| AskBar"; pcre:"/User-Agent\x3a[^\n]+AskBar/iH"; reference:url,doc.emergingthreats.net/2003496; classtype:pup-activity; sid:2003496; rev:13; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, signature_severity Minor, tag Spyware_User_Agent, updated_at 2016_07_01;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE w32agent.dsi Posting Info"; flow:established,to_server; content:"/postgewinnspiel.php"; http_uri; content:"uid="; http_uri; reference:url,doc.emergingthreats.net/2002781; classtype:trojan-activity; sid:2002781; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Alexa Spyware Reporting URL Visited"; flow:established,to_server; content:"/data/"; nocase; http_uri; content:"cli="; nocase; http_uri; content:"&ver=alxi"; nocase; http_uri; fast_pattern:only; content:"&url="; nocase; http_uri; content:"alexa.com|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2003606; classtype:pup-activity; sid:2003606; rev:7; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2020_08_20;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Warezov/Stration Communicating with Controller 2"; flow:established,to_server; content:"/chr/"; nocase; http_uri; content:"/e/"; http_uri; content:"?lid="; nocase; http_uri; pcre:"/\/chr\/\d+\/e\/t\d+\?lid=/Ui"; reference:url,www.sophos.com/security/analyses/w32strationbo.html; reference:url,www.avira.com/en/threats/section/fulldetails/id_vir/3242/tr_dldr.warezov.df.html; reference:url,doc.emergingthreats.net/2003436; classtype:trojan-activity; sid:2003436; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP Zango Spyware (tbrequest data post)"; flow: to_server,established; content:"/tbrequest"; http_uri; nocase; content:"&q="; http_uri; nocase; pcre:"/\/tbrequest\d+\.php/Ui"; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003610; classtype:pup-activity; sid:2003610; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Win32.Agent.ajx Trojan Reporting to Server"; flow:established,to_server; content:"/count.php?fid="; nocase; http_uri; content:"&cid="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&tid="; nocase; http_uri; content:"&sn="; nocase; http_uri; content:"&wc="; nocase; http_uri; reference:url,doc.emergingthreats.net/2006448; classtype:trojan-activity; sid:2006448; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET ADWARE_PUP 51yes.com Spyware Reporting User Activity"; flow:established,to_server; content:"/sa.aspx?id="; http_uri; nocase; content:"&refe=http"; http_uri; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2003620; classtype:pup-activity; sid:2003620; rev:5; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Win32.Agent.cyt (Or variant) HTTP POST Checkin (2)"; flow:established,to_server; content:"POST"; depth:4; http_method; content:".cgi"; http_uri; content:"o=c&s="; http_client_body; reference:url,doc.emergingthreats.net/2008004; classtype:command-and-control; sid:2008004; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP AVSystemcare.com.com Fake Anti-Virus Product"; flow:established,to_server; http.uri; content:"?proto="; nocase; content:"&rc="; nocase; content:"&v="; nocase; content:"&abbr="; nocase; content:"&platform="; nocase; content:"&os_version="; nocase; content:"&ac="; nocase; content:"&appid="; nocase; content:"&em="; nocase; content:"&pcid="; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2007664; classtype:pup-activity; sid:2007664; rev:6; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2022_04_18;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Win32.Small.yml or Related HTTP Checkin"; flow:established,to_server; content:"/ClientReg.aspx?mac="; http_uri; content:"&Type="; http_uri; content:"&Sn="; http_uri; pcre:"/mac=([0-9A-F]{2}:){5}([0-9A-F]{2})/Ui"; reference:url,doc.emergingthreats.net/2008949; classtype:command-and-control; sid:2008949; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Shopcenter.co .kr Spyware Install Report"; flow:established,to_server; http.uri; content:"/RewardInstall.php?mac=0"; content:"&hdd="; content:"&ver="; content:"&ie="; content:"&win="; reference:url,doc.emergingthreats.net/bin/view/Main/2008370; classtype:pup-activity; sid:2008370; rev:5; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category ADWARE_PUP, updated_at 2022_04_18, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Win32.Small.yml or Related HTTP Command"; flow:established,to_server; content:"/ClientTask.aspx?mac="; http_uri; content:"&Type="; http_uri; content:"&Sn="; http_uri; pcre:"/mac=([0-9A-F]{2}:){5}([0-9A-F]{2})/Ui"; reference:url,doc.emergingthreats.net/2008952; classtype:trojan-activity; sid:2008952; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET 20000 (msg:"ET ADWARE_PUP Realtimegaming.com Online Casino Spyware Gaming Checkin"; flow:established,to_server; dsize:<30; content:"|43 01 00|"; depth:4; content:"Casino"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2008402; classtype:pup-activity; sid:2008402; rev:4; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2010_07_30;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE WindowsEnterpriseSuite FakeAV check-in HEAD"; flow:established,to_server; content:"HEAD"; depth:4; http_method; content:"?controller="; http_uri; content:"&abbr="; http_uri; content:"&setupType="; http_uri; content:"&ttl="; http_uri; content:"&pid="; http_uri; reference:url,doc.emergingthreats.net/2010240; reference:md5,d9bcb4e4d650a6ed4402fab8f9ef1387; classtype:trojan-activity; sid:2010240; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP User-Agent (Mozilla/4.8 ru)"; flow:established,to_server; content:"User-Agent|3a| Mozilla/4.8 [ru] (Windows NT 6.0|3b| U)|0d 0a|"; fast_pattern; http_header; reference:url,doc.emergingthreats.net/2009438; classtype:pup-activity; sid:2009438; rev:9; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2022_03_17;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Winspywareprotect.com Fake AV/Anti-Spyware Install Checkin"; flow:established,to_server; content:"/stat.php?func=install&pid="; http_uri; content:"&ip="; http_uri; content:"&landing="; http_uri; reference:url,doc.emergingthreats.net/2008250; classtype:command-and-control; sid:2008250; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP Fake Mozilla User-Agent (Mozilla/0.xx) Inbound"; flow:established,to_server; content:"User-Agent|3a| Mozilla/0."; fast_pattern; http_header; reference:url,doc.emergingthreats.net/2010904; classtype:pup-activity; sid:2010904; rev:8; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2022_03_17;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Zhelatin Update Detected"; flow:established,to_server; content:".php?l="; nocase; http_uri; content:"&v="; nocase; http_uri; content:"&rvz1="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007769; classtype:trojan-activity; sid:2007769; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP Inbound AlphaServer User-Agent (Powered By 64-Bit Alpha Processor)"; flow:to_server,established; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 4.01|3b| Digital AlphaServer 1000A 4/233|3b| Windows NT|3b| Powered By 64-Bit Alpha Processor)|0d 0a|"; nocase; http_header; fast_pattern; classtype:pup-activity; sid:2011517; rev:4; metadata:created_at 2010_09_27, former_category ADWARE_PUP, updated_at 2022_03_17;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Zlob HTTP Checkin"; flow:established,to_server; content:"/confirm.php?aid="; nocase; http_uri; content:"&said="; nocase; http_uri; content:"&mn="; nocase; http_uri; reference:url,doc.emergingthreats.net/2008386; classtype:command-and-control; sid:2008386; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Outbound AlphaServer User-Agent (Powered By 64-Bit Alpha Processor)"; flow:to_server,established; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 4.01|3b| Digital AlphaServer 1000A 4/233|3b| Windows NT|3b| Powered By 64-Bit Alpha Processor)|0d 0a|"; nocase; http_header; fast_pattern; classtype:pup-activity; sid:2011518; rev:4; metadata:created_at 2010_09_27, former_category ADWARE_PUP, updated_at 2022_03_17;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Zlob Initial Check-in Version 2 (confirm.php?sid=)"; flow:to_server,established; content:"GET"; nocase; http_method; content:"confirm.php?sid="; nocase; http_uri; content:"&said="; nocase; http_uri; content:"&mn="; nocase; http_uri; reference:url,doc.emergingthreats.net/2008396; classtype:trojan-activity; sid:2008396; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET 5217 (msg:"ET ADWARE_PUP W32/SmartPops Adware Outbound Off-Port MSSQL Communication"; flow:established,to_server; content:"S|00|M|00|A|00|R|00|T|00|P|00|O|00|P"; content:"D|00|B|00|_|00|S|00|M|00|A|00|R|00|T|00|P|00|O|00|P"; distance:0; classtype:pup-activity; sid:2013956; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_11_23, deployment Perimeter, former_category ADWARE_PUP, signature_severity Minor, updated_at 2017_09_21;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE s4t4n1c Trojan Check-in"; flow:established,to_server; content:"POST"; depth:4; http_method; content:".php"; http_uri; content:"continencia="; http_client_body; content:"&versao_kl="; http_client_body; content:"&data="; http_client_body; content:"&hora="; http_client_body; content:"&nome_maquina="; http_client_body; reference:url,doc.emergingthreats.net/2009518; classtype:trojan-activity; sid:2009518; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET ADWARE_PUP Carder Card Checking Tool try2check.me SSL Certificate on Off Port"; flow:established,from_server; content:"|16 03|"; content:"|0b|"; within:7; content:"try2check.me"; within:400; classtype:pup-activity; sid:2014287; rev:3; metadata:attack_target Client_Endpoint, created_at 2012_02_28, deployment Perimeter, former_category ADWARE_PUP, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE thespybot.com installation download detected"; flow:established,to_server; content:"GET"; depth:3; http_method; content:".php"; http_uri; content:"m="; http_uri; content:"&ydf="; http_uri; content:"&e="; http_uri; content:"&w="; http_uri; content:"&t="; http_uri; content:"&apz="; http_uri; reference:url,doc.emergingthreats.net/2008482; classtype:trojan-activity; sid:2008482; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP BitCoinPlus Embedded site forcing visitors to mine BitCoins"; flow:established,from_server; content:"BitcoinPlusMiner("; reference:url,www.bitcoinplus.com/miner/embeddable; reference:url,www.bitcoinplus.com/miner/whatsthis; classtype:coin-mining; sid:2014535; rev:4; metadata:created_at 2012_04_10, former_category ADWARE_PUP, updated_at 2012_04_10;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Hupigon.dkxh Checkin to CnC"; flow:established,to_server; content:"OK|2e 01|200"; fast_pattern; depth:20; offset:13; content:"Windows "; distance:4; within:30; reference:url,doc.emergingthreats.net/2008540; classtype:command-and-control; sid:2008540; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> 54.218.7.114 any (msg:"ET ADWARE_PUP DomainIQ Check-in"; flow:established,to_server; content:"User-Agent|3a 20|NSISDL/1.2|20 28|Mozilla|29 0d 0a|"; http_header; fast_pattern; reference:md5,00699af9bb10af100563adbb767bcee0; classtype:pup-activity; sid:2018458; rev:4; metadata:created_at 2014_05_09, former_category ADWARE_PUP, updated_at 2022_03_17;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Small.wpx or Related Downloader Posting Data"; flow:to_server,established; content:"POST"; http_method; content:"=|22|boturl|22|"; nocase; fast_pattern; content:"=|22|filename|22|"; nocase; content:"=|22|compips|22|"; nocase; content:"=|22|loadername|22|"; nocase; content:"=|22|loaderid|22|"; nocase; content:"=|22|uptime|22|"; nocase; content:"=|22|comptime|22|"; nocase; content:"=|22|winver|22|"; nocase; reference:url,doc.emergingthreats.net/2008319; classtype:trojan-activity; sid:2008319; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Downloader.NSIS.OutBrowse.b Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/Installer/Flow?pubid="; nocase; depth:22; http_uri; fast_pattern; content:"&distid="; distance:0; http_uri; content:"&productid="; distance:0; http_uri; content:"&subpubid="; distance:0; http_uri; content:"&campaignid="; distance:0; http_uri; content:"&networkid="; distance:0; http_uri; content:"&dfb="; distance:0; http_uri; content:"&os="; distance:0; http_uri; content:"&version="; distance:0; http_uri; content:"Chrome/18.0.1025.142 Safari/535.19|0d 0a|Host|3a|"; http_header; reference:md5,38eeed96ade6037dc299812eeadee164; reference:url,sophos.com/en-us/threat-center/threat-analyses/adware-and-puas/OutBrowse%20Revenyou/detailed-analysis.aspx; classtype:pup-activity; sid:2018617; rev:7; metadata:created_at 2014_01_14, former_category ADWARE_PUP, updated_at 2016_06_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 3306 (msg:"ET MALWARE Viruscatch.co.kr/Win32.Small.hvd Mysql Command and Control Connection (user viruscatch)"; flow:established,to_server; dsize:<40; content:"viruscatch|00|"; reference:url,doc.emergingthreats.net/2008573; classtype:trojan-activity; sid:2008573; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ADWARE_PUP AdWare.Win32.BetterSurf.b SSL Cert"; flow:established,from_server; content:"CN=*.tr553.com"; threshold: type limit, track by_src, count 2, seconds 60; reference:md5,54c9288cbbf29062d6d873cba844645a; classtype:pup-activity; sid:2020712; rev:5; metadata:attack_target Client_Endpoint, created_at 2015_03_19, deployment Perimeter, former_category ADWARE_PUP, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
+#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET 1024: (msg:"ET MALWARE Beizhu/Womble/Vipdataend Controller Keepalive"; flow:established,from_server; dsize:1; content:"d"; reference:url,doc.emergingthreats.net/2008335; classtype:trojan-activity; sid:2008335; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access takeCameraPicture"; flow:from_server,established; file_data; content:"utilityController"; nocase; content:".takeCameraPicture"; nocase; reference:url,www.fireeye.com/blog/technical/vulnerabilities/2013/11/inmobi-another-vulnaggressive-adware-opens-billions-of-javascript-sidedoors-on-android-devices.html; classtype:trojan-activity; sid:2017777; rev:3; metadata:created_at 2013_11_27, former_category CURRENT_EVENTS, updated_at 2013_11_27;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET MALWARE Yoyo-DDoS Bot Execute SYN Flood Command Message From CnC Server"; flow:established,from_server; dsize:124; content:"|80 04 00 00|"; nocase; depth:4; reference:url,asert.arbornetworks.com/2010/08/yoyoddos-a-new-family-of-ddos-bots/; classtype:command-and-control; sid:2011400; rev:3; metadata:created_at 2010_09_28, former_category MALWARE, updated_at 2010_09_28;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access sendSMS"; flow:from_server,established; file_data; content:"utilityController"; nocase; content:"sendSMS"; nocase; reference:url,fireeye.com/blog/threat-research/2014/01/js-binding-over-http-vulnerability-and-javascript-sidedoor.html; classtype:trojan-activity; sid:2017782; rev:3; metadata:created_at 2013_11_27, former_category CURRENT_EVENTS, updated_at 2013_11_27;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET MALWARE Yoyo-DDoS Bot Download and Launch Executable Message From CnC Server"; flow:established,from_server; dsize:124; content:"|00 00 00 04|http|3a|//"; depth:11; reference:url,asert.arbornetworks.com/2010/08/yoyoddos-a-new-family-of-ddos-bots/; classtype:command-and-control; sid:2011399; rev:4; metadata:created_at 2010_09_28, former_category MALWARE, updated_at 2010_09_28;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access registerMicListener"; flow:from_server,established; file_data; content:"utilityController"; nocase; content:"registerMicListener"; nocase; reference:url,fireeye.com/blog/threat-research/2014/01/js-binding-over-http-vulnerability-and-javascript-sidedoor.html; classtype:trojan-activity; sid:2017783; rev:3; metadata:created_at 2013_11_27, former_category CURRENT_EVENTS, updated_at 2013_11_27;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET MALWARE Yoyo-DDoS Bot Execute DDoS Command From CnC Server"; flow:established,from_server; dsize:124; content:"|00 10 00 00|http|3a|//"; depth:11; reference:url,asert.arbornetworks.com/2010/08/yoyoddos-a-new-family-of-ddos-bots/; classtype:command-and-control; sid:2011398; rev:3; metadata:created_at 2010_09_28, former_category MALWARE, updated_at 2010_09_28;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access sendMail"; flow:from_server,established; file_data; content:"utilityController"; nocase; content:"sendMail"; nocase; reference:url,fireeye.com/blog/threat-research/2014/01/js-binding-over-http-vulnerability-and-javascript-sidedoor.html; classtype:trojan-activity; sid:2017781; rev:3; metadata:created_at 2013_11_27, former_category CURRENT_EVENTS, updated_at 2013_11_27;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET MALWARE Yoyo-DDoS Bot Download and Launch Executable Message From CnC Server"; flow:established,from_server; dsize:124; content:"|00 00 00 04|ftp|3a|//"; depth:10; reference:url,asert.arbornetworks.com/2010/08/yoyoddos-a-new-family-of-ddos-bots/; classtype:command-and-control; sid:2011592; rev:1; metadata:created_at 2010_10_07, former_category MALWARE, updated_at 2010_10_07;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access postToSocial"; flow:from_server,established; file_data; content:"utilityController"; nocase; content:"postToSocial"; nocase; reference:url,fireeye.com/blog/threat-research/2014/01/js-binding-over-http-vulnerability-and-javascript-sidedoor.html; classtype:trojan-activity; sid:2017780; rev:3; metadata:created_at 2013_11_27, former_category CURRENT_EVENTS, updated_at 2013_11_27;)
+#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE FakeAV SetupSecure Download Attempt SetupSecure"; flow:established,to_server; content:"/download/SetupSecure_"; nocase; http_uri; content:".exe"; nocase; http_uri; reference:url,www.malwareurl.com/listing.php?domain=virus-scanner-6.com; classtype:trojan-activity; sid:2011357; rev:3; metadata:created_at 2010_09_28, updated_at 2010_09_28;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MOBILE_MALWARE Possible Android InMobi SDK SideDoor Access getGalleryImage"; flow:from_server,established; file_data; content:"utilityController"; nocase; content:"getGalleryImage"; nocase; reference:url,www.fireeye.com/blog/technical/vulnerabilities/2013/11/inmobi-another-vulnaggressive-adware-opens-billions-of-javascript-sidedoors-on-android-devices.html; classtype:trojan-activity; sid:2017778; rev:4; metadata:created_at 2013_11_27, former_category CURRENT_EVENTS, updated_at 2013_11_27;)
+#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Trojan.Win32.FraudPack.aweo"; flow:established,to_server; content:"GET"; http_method; content:"update.php?do="; http_uri; content:"&coid="; http_uri; content:"&IP="; http_uri; content:"&fff="; http_uri; content:"&lct="; http_uri; content:"&ttt="; http_uri; content:"&v="; reference:md5,4bc4c32a8d93c29b026bbfb24ccecd14; classtype:trojan-activity; sid:2011294; rev:3; metadata:created_at 2010_09_28, updated_at 2010_09_28;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MOBILE_MALWARE Possible Android CVE-2014-6041"; flow:from_server,established; file_data; content:"|5c|u001"; fast_pattern; pcre:"/^[a-f0-9]/Ri"; content:"javascript|3a|"; nocase; within:11; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/same-origin-policy-bypass-vulnerability-has-wider-reach-than-thought/; classtype:attempted-user; sid:2020397; rev:4; metadata:created_at 2015_02_12, former_category CURRENT_EVENTS, updated_at 2015_02_12;)
+#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Stupid Stealer C&C Communication (1)"; flow:established,to_server; content:"cmd=give&pcname="; nocase; http_uri; content:"&status="; http_uri; nocase; pcre:"/cmd=give&pcname=.+&status=\d+$/U"; reference:url,amada.abuse.ch/?search=f4bf4fb71d0846b0d43f22f0a77253fb; classtype:command-and-control; sid:2011370; rev:3; metadata:created_at 2010_09_28, former_category MALWARE, updated_at 2010_09_28;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MOBILE_MALWARE Possible Android CVE-2014-6041"; flow:from_server,established; file_data; content:"|5c|u000"; fast_pattern; pcre:"/^[a-f0-9]/Ri"; content:"javascript|3a|"; nocase; within:11; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/same-origin-policy-bypass-vulnerability-has-wider-reach-than-thought/; classtype:trojan-activity; sid:2019181; rev:9; metadata:created_at 2014_09_16, former_category CURRENT_EVENTS, updated_at 2014_09_16;)
+#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Stupid Stealer C&C Communication (2)"; flow:established,to_server; content:"action=add"; nocase; http_uri; content:"&status="; nocase; http_uri; content:"&wmid="; nocase; http_uri; content:"&os="; nocase; http_uri; content:"&pcname="; http_uri; nocase; reference:url,amada.abuse.ch/?search=f4bf4fb71d0846b0d43f22f0a77253fb; classtype:command-and-control; sid:2011371; rev:3; metadata:created_at 2010_09_28, former_category MALWARE, updated_at 2010_09_28;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Locky AlphaNum Downloader Oct 3 2016"; flow:to_server,established; urilen:5<>10; content:"GET"; http_method; pcre:"/^\/(?=[a-z]*[0-9][a-z-0-9]*$)(?=[0-9]*[a-z][a-z-0-9]*$)[a-z0-9]{5,8}$/U"; content:!"Cookie|3a 20|"; content:!"Referer|3a|"; http_header; content:"User-Agent|3a 20|Mozilla/4.0 (compatible|3b| MSIE 7.0|3b| Windows NT"; http_header; fast_pattern; content:"Accept|3a|"; http_header; content:"Accept-Encoding"; http_header; flowbits:set,ET.LockyDL; flowbits:noalert; classtype:trojan-activity; sid:2023315; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_10_03, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Locky, signature_severity Major, updated_at 2022_03_17;)
+#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE FakeYak or Related Infection Checkin 2"; flow:established,to_server; content:"&fff="; http_uri; content:"&coid="; http_uri; content:"saf="; http_uri; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Rogue%3aWin32%2fFakeYak; classtype:command-and-control; sid:2011397; rev:3; metadata:created_at 2010_09_28, former_category MALWARE, updated_at 2010_09_28;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE VBA Office Document Dridex Binary Download User-Agent 2"; flow:established,to_server; content:"User-Agent|3A| MisterZALALU"; http_header; fast_pattern; reference:md5,2f53b7669482c2d9216a74050630fbb7; classtype:trojan-activity; sid:2020806; rev:3; metadata:created_at 2015_03_31, former_category CURRENT_EVENTS, updated_at 2022_03_17;)
+#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE wisp backdoor detected reporting"; flow:established,to_server; content:"getkys.kys"; nocase; http_uri; content:"hostname="; nocase; http_uri; classtype:trojan-activity; sid:2011395; rev:3; metadata:created_at 2010_09_28, updated_at 2010_09_28;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Gamut Spambot Checkin Response"; flow:established,from_server; file_data; content:"count_threads|09 09 09 3d 09|"; depth:18; fast_pattern; content:"|0a|efficiency_limit|09 09 3d 09|"; distance:1; within:22; flowbits:isset,ETGamut; reference:url,blog.spiderlabs.com/2014/03/gamut-spambot-analysis-.html; reference:md5,f00f3f47062646f900aa327b1d5ca3a1; classtype:command-and-control; sid:2018246; rev:3; metadata:created_at 2014_03_11, former_category MALWARE, updated_at 2014_03_11;)
+#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Downloader.Win32.Zlob.bgs Checkin(1)"; flow:established,to_server; content:"GET"; http_header; content:"/gatech.php?pn="; nocase; http_uri; reference:md5,ffdcea0ed88d47bc21d71040f9289ef4; classtype:command-and-control; sid:2011490; rev:3; metadata:created_at 2010_09_29, former_category MALWARE, updated_at 2010_09_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible MHTML CVE-2012-0158 Vulnerable CLSID+b64 Office Doc Magic 1"; flow:established; file_data; content:"bdd1f04b-858b-11d1-b16a-00c0f0283628"; nocase; content:"0M8R4KGxGu"; reference:url,www.antiy.net/wp-content/uploads/The-Latest-APT-Attack-by-Exploiting-CVE2012-0158-Vulnerability.pdf; reference:url,contagiodump.blogspot.com/2013/09/sandbox-miming-cve-2012-0158-in-mhtml.html; classtype:trojan-activity; sid:2017409; rev:3; metadata:created_at 2013_09_03, former_category CURRENT_EVENTS, updated_at 2013_09_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Downloader.Win32.Zlob.bgs Checkin(2)"; flow:established,to_server; content:"GET"; http_method; content:"/gatech.php?id="; nocase; http_uri; reference:md5,ffdcea0ed88d47bc21d71040f9289ef4; classtype:command-and-control; sid:2011491; rev:3; metadata:created_at 2010_09_29, former_category MALWARE, updated_at 2010_09_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible MHTML CVE-2012-0158 Vulnerable CLSID+b64 Office Doc Magic 2"; flow:established; file_data; content:"996BF5E0-8044-4650-ADEB-0B013914E99C"; nocase; content:"0M8R4KGxGu"; reference:url,www.antiy.net/wp-content/uploads/The-Latest-APT-Attack-by-Exploiting-CVE2012-0158-Vulnerability.pdf; reference:url,contagiodump.blogspot.com/2013/09/sandbox-miming-cve-2012-0158-in-mhtml.html; classtype:trojan-activity; sid:2017410; rev:3; metadata:created_at 2013_09_03, former_category CURRENT_EVENTS, updated_at 2013_09_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Daurso FTP Credential Theft Reported"; flow:to_server,established; content:"/receiver/ftp"; http_uri; nocase; content:"|0d 0a 0d 0a|ftp_uri_0="; nocase; content:"&ftp_source_0="; nocase; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fDaurso; reference:url,xanalysis.blogspot.com/2009/07/9121219837-badness.html; reference:md5,348ba619aab3a92b99701335f95fe2a7; reference:md5,8be56dbd057c3bde42ae804bfd647bb6; classtype:trojan-activity; sid:2011470; rev:3; metadata:created_at 2010_09_29, updated_at 2010_09_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible MHTML CVE-2012-0158 Vulnerable CLSID+b64 Office Doc Magic 3"; flow:established; file_data; content:"C74190B6-8589-11d1-B16A-00C0F0283628"; nocase; content:"0M8R4KGxGu"; reference:url,www.antiy.net/wp-content/uploads/The-Latest-APT-Attack-by-Exploiting-CVE2012-0158-Vulnerability.pdf; reference:url,contagiodump.blogspot.com/2013/09/sandbox-miming-cve-2012-0158-in-mhtml.html; classtype:trojan-activity; sid:2017411; rev:3; metadata:created_at 2013_09_03, former_category CURRENT_EVENTS, updated_at 2013_09_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Daurso Checkin"; flow:established,to_server; content:"POST"; http_method; content:"receiver/online"; http_uri; content:"|0d 0a 0d 0a|guid="; nocase; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fDaurso; reference:url,xanalysis.blogspot.com/2009/07/9121219837-badness.html; reference:md5,348ba619aab3a92b99701335f95fe2a7; reference:md5,8be56dbd057c3bde42ae804bfd647bb6; classtype:command-and-control; sid:2011471; rev:3; metadata:created_at 2010_09_29, former_category MALWARE, updated_at 2010_09_29;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Internet Explorer CVE-2014-6332 Common Construct (Reversed)"; flow:established,from_server; file_data; content:"(wrhc&)6712(wrhc&)10"; reference:cve,2014-6332; classtype:attempted-user; sid:2019806; rev:3; metadata:created_at 2014_11_26, former_category CURRENT_EVENTS, updated_at 2014_11_26;)
+#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Win32/Small.gen!AQ Communication with Controller"; flow:established,to_server; content:"?uid="; nocase; http_uri; fast_pattern; content:"&action="; nocase; http_uri; content:"&v="; nocase; http_uri; content:"&b="; nocase; http_uri; pcre:"/\?uid=[0-9a-f]{40}&action=\w+&v=[\w.]+&b=\d+$/U"; reference:md5,eb3140416c06fa8cb7851076dd100dfb; reference:url,perpetualhorizon.blogspot.com/2010/08/shot-in-dark-analysis-of-failed-malware.html; reference:md5,8033dffa899dcd16769f389073f9f053; classtype:trojan-activity; sid:2011414; rev:4; metadata:created_at 2010_09_28, updated_at 2010_09_28;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Internet Explorer CVE-2014-6332 Common Construct DECC"; flow:established,from_server; file_data; content:"99,104,114,119,40,48,49,41,38,99,104,114,119,40,50,49,55,54,41,38,99,104,114,119,40,48,49,41,38,99,104,114,119,40,48,48,41"; reference:cve,2014-6332; classtype:attempted-user; sid:2019796; rev:3; metadata:created_at 2014_11_25, former_category CURRENT_EVENTS, updated_at 2014_11_25;)
+#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Vipdataend C&C Traffic Checkin variant 2"; flowbits:set,ET.vipdataend; flow:established,to_server; dsize:<22; content:"|3a|"; depth:5; offset:2; content:"|7c|win "; within:12; reference:url,doc.emergingthreats.net/2009025; classtype:command-and-control; sid:2009025; rev:3; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Internet Explorer CVE-2014-6332 Common Construct DECCS"; flow:established,from_server; file_data; content:"99, 104, 114, 119, 40, 48, 49, 41, 38, 99, 104, 114, 119, 40, 50, 49, 55, 54, 41, 38, 99, 104, 114, 119, 40, 48, 49, 41, 38, 99, 104, 114, 119, 40, 48, 48, 41"; reference:cve,2014-6332; classtype:attempted-user; sid:2019797; rev:3; metadata:created_at 2014_11_25, former_category CURRENT_EVENTS, updated_at 2014_11_25;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE x0Proto Init"; flow:established,from_server; dsize:2; content:"x0"; depth:2; flowbits:noalert; flowbits:set,et.x0proto; classtype:trojan-activity; sid:2012236; rev:2; metadata:created_at 2011_01_27, updated_at 2011_01_27;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Internet Explorer CVE-2014-6332 Common Construct HEX"; flow:established,from_server; file_data; content:"63687277283031292663687277283231373629266368727728303129266368727728303029"; reference:cve,2014-6332; classtype:attempted-user; sid:2019793; rev:3; metadata:created_at 2014_11_25, former_category CURRENT_EVENTS, updated_at 2014_11_25;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE x0Proto Client Info"; flow:established,to_server; flowbits:isset,et.x0proto; dsize:<128; content:"x0|0c|"; depth:3; classtype:trojan-activity; sid:2012237; rev:2; metadata:created_at 2011_01_27, updated_at 2011_01_27;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Internet Explorer CVE-2014-6332 Common Construct HEXC"; flow:established,from_server; file_data; content:"63,68,72,77,28,30,31,29,26,63,68,72,77,28,32,31,37,36,29,26,63,68,72,77,28,30,31,29,26,63,68,72,77,28,30,30,29"; reference:cve,2014-6332; classtype:attempted-user; sid:2019794; rev:3; metadata:created_at 2014_11_25, former_category CURRENT_EVENTS, updated_at 2014_11_25;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE x0Proto Pong"; flow:established,to_server; flowbits:isset,et.x0proto; dsize:9; content:"x53|0c|"; depth:4; content:"|0c|0|0c|1"; distance:1; within:4; classtype:trojan-activity; sid:2012238; rev:2; metadata:created_at 2011_01_27, updated_at 2011_01_27;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Internet Explorer CVE-2014-6332 Common Construct HEXCS"; flow:established,from_server; file_data; content:"63, 68, 72, 77, 28, 30, 31, 29, 26, 63, 68, 72, 77, 28, 32, 31, 37, 36, 29, 26, 63, 68, 72, 77, 28, 30, 31, 29, 26, 63, 68, 72, 77, 28, 30, 30, 29"; reference:cve,2014-6332; classtype:attempted-user; sid:2019795; rev:3; metadata:created_at 2014_11_25, former_category CURRENT_EVENTS, updated_at 2014_11_25;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE x0Proto Ping"; flow:established,from_server; flowbits:isset,et.x0proto; dsize:7; content:"x53|0c|1|0c|0"; depth:7; classtype:trojan-activity; sid:2012239; rev:2; metadata:created_at 2011_01_27, updated_at 2011_01_27;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Internet Explorer CVE-2014-6332 Common Construct URLENCODE"; flow:established,from_server; file_data; content:"%63%68%72%77%28%30%31%29%26%63%68%72%77%28%32%31%37%36%29%26%63%68%72%77%28%30%31%29%26%63%68%72%77%28%30%30%29"; reference:cve,2014-6332; classtype:attempted-user; sid:2019792; rev:3; metadata:created_at 2014_11_25, former_category CURRENT_EVENTS, updated_at 2014_11_25;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE x0Proto Download Cmd"; flow:established,from_server; flowbits:isset,et.x0proto; content:"x74|0c|1|0c|1x"; depth:8; classtype:trojan-activity; sid:2012240; rev:2; metadata:created_at 2011_01_27, updated_at 2011_01_27;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Java Request With Uncompressed JAR/Class Importing Classe used in CVE-2013-2465/2463"; flow:established,from_server; flowbits:isset,et.JavaArchiveOrClass; file_data; content:"java/awt/image/MultiPixelPacked"; classtype:bad-unknown; sid:2017773; rev:3; metadata:created_at 2013_11_26, former_category CURRENT_EVENTS, updated_at 2013_11_26;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Storm Worm HTTP Request"; flow:established,to_server; content:"GET"; http_method; content:"/?"; http_uri; pcre:"/GET \/\?[0-9a-f]{16}/Ui"; pcre:"/Host\x3a [0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/i"; reference:url,doc.emergingthreats.net/2006411; classtype:trojan-activity; sid:2006411; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Java Request With Uncompressed JAR/Class Importing Classe used in CVE-2013-2471/2472/2473"; flow:established,from_server; flowbits:isset,et.JavaArchiveOrClass; file_data; content:"java/awt/image/SinglePixelPacked"; classtype:bad-unknown; sid:2017772; rev:3; metadata:created_at 2013_11_26, former_category CURRENT_EVENTS, updated_at 2013_11_26;)
+#alert http $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Likely Spambot Web-based Control Traffic"; flow: to_server,established; content:"User-Agent|3a| Godzilla"; nocase; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/2001711; classtype:trojan-activity; sid:2001711; rev:9; metadata:created_at 2010_07_30, former_category USER_AGENTS, updated_at 2010_07_30;)
 
-#alert udp $EXTERNAL_NET any -> $HOME_NET 162 (msg:"ET DELETED Cisco Non-Trap PDU request on SNMPv1 trap port"; content:"|02 01 00|"; depth:3; byte_test:1,>,159,8,relative; byte_test:1,<,164,8,relative; classtype:attempted-dos; sid:2027890; rev:2; metadata:created_at 2019_08_15, former_category SNMP, updated_at 2020_08_20;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Night Dragon CMD Shell"; flow:established,to_server; content:"|68 57 24 13 00 33|Microsoft"; offset:12; depth:15; reference:url,www.mcafee.com/us/resources/white-papers/wp-global-energy-cyberattacks-Night-dragon.pdf; classtype:trojan-activity; sid:2012307; rev:1; metadata:created_at 2011_02_11, updated_at 2011_02_11;)
 
-alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [TGI] Py.Machete FTP Exfil 1"; flow:established,to_server; content:"STOR|20|FIREPERF.zip"; depth:17; reference:url,travisgreen.net/2019/08/14/machete-malware.html; classtype:trojan-activity; sid:2027888; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_08_15, deployment Perimeter, former_category TROJAN, malware_family Machete, performance_impact Moderate, signature_severity Major, updated_at 2019_08_15;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Night Dragon Server Auth to Bot"; flow:established,from_server; dsize:29; content:"|00 00|password|00 00 00|"; offset:3; depth:13; reference:url,www.mcafee.com/us/resources/white-papers/wp-global-energy-cyberattacks-Night-dragon.pdf; classtype:trojan-activity; sid:2012309; rev:1; metadata:created_at 2011_02_11, updated_at 2011_02_11;)
 
-alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [TGI] Py.Machete FTP Exfil 2"; flow:established,to_server; content:"STOR|20|CRHOMEPER.zip"; depth:18; reference:url,travisgreen.net/2019/08/14/machete-malware.html; classtype:trojan-activity; sid:2027889; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_08_15, deployment Perimeter, former_category TROJAN, malware_family Machete, performance_impact Moderate, signature_severity Major, updated_at 2019_08_15;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Night Dragon CnC Traffic Inbound 2"; flow:established,from_server; dsize:16; content:"|68 57 24 13|"; offset:12; depth:4; threshold: type limit, count 1, seconds 60, track by_src; reference:url,www.mcafee.com/us/resources/white-papers/wp-global-energy-cyberattacks-Night-dragon.pdf; classtype:command-and-control; sid:2012305; rev:5; metadata:created_at 2011_02_10, former_category MALWARE, updated_at 2011_02_10;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET [25,587] (msg:"ET EXPLOIT Possible CVE-2014-1761 Inbound SMTP 1"; flow:from_client,established; content:"XGxpc3RvdmVycmlkZWNvdW50"; isdataat:2,relative; pcre:"/^\s*/Rs"; content:!"MQ"; within:2; content:!"MV"; within:2; content:!"MT"; within:2; content:!"MH"; within:2; content:!"MF"; within:2; content:!"ME"; within:2; content:!"OQ"; within:2; content:!"OX"; within:2; content:!"MA"; within:2; content:!"MS"; within:2; content:!"MX"; within:2; reference:cve,2014-1761; reference:url,blogs.technet.com/b/srd/archive/2014/03/24/security-advisory-2953095-recommendation-to-stay-protected-and-for-detections.aspx; classtype:attempted-user; sid:2018314; rev:9; metadata:created_at 2014_03_25, former_category CURRENT_EVENTS, updated_at 2014_03_25;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Night Dragon CnC Traffic Outbound 2"; flow:established,to_server; dsize:16; content:"|68 57 24 13|"; offset:12; depth:4; threshold: type limit, count 1, seconds 60, track by_dst; reference:url,www.mcafee.com/us/resources/white-papers/wp-global-energy-cyberattacks-Night-dragon.pdf; classtype:command-and-control; sid:2012306; rev:6; metadata:created_at 2011_02_10, former_category MALWARE, updated_at 2011_02_10;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET [25,587] (msg:"ET EXPLOIT Possible CVE-2014-1761 Inbound SMTP 2"; flow:from_client,established; content:"xsaXN0b3ZlcnJpZGVjb3Vud"; isdataat:2,relative; pcre:"/^\s*/Rs"; content:!"DE"; within:2; content:!"DF"; within:2; content:!"Dk"; within:2; content:!"Dl"; within:2; content:!"DA"; within:2; content:!"DB"; within:2; content:!"DV"; within:2; reference:cve,2014-1761; reference:url,blogs.technet.com/b/srd/archive/2014/03/24/security-advisory-2953095-recommendation-to-stay-protected-and-for-detections.aspx; classtype:attempted-user; sid:2018308; rev:8; metadata:created_at 2014_03_25, former_category CURRENT_EVENTS, updated_at 2014_03_25;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Night Dragon CnC Beacon Outbound"; flow:established,to_server; dsize:16; content:"|01 50 00 00 00 00 00 00 00 00 00 01 68 57 24 13|"; threshold: type limit, count 1, seconds 60, track by_src; reference:url,www.mcafee.com/us/resources/white-papers/wp-global-energy-cyberattacks-night-dragon.pdf; classtype:command-and-control; sid:2012303; rev:4; metadata:attack_target Client_Endpoint, created_at 2011_02_10, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2011_02_10, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET [25,587] (msg:"ET EXPLOIT Possible CVE-2014-1761 Inbound SMTP 3"; flow:from_client,established; content:"cbGlzdG92ZXJyaWRlY291bn"; isdataat:2,relative; pcre:"/^\s*/Rs"; content:!"Qx"; within:2; content:!"Q5"; within:2; content:!"Qw"; within:2; reference:cve,2014-1761; reference:url,blogs.technet.com/b/srd/archive/2014/03/24/security-advisory-2953095-recommendation-to-stay-protected-and-for-detections.aspx; classtype:attempted-user; sid:2018309; rev:6; metadata:created_at 2014_03_25, former_category CURRENT_EVENTS, updated_at 2014_03_25;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Night Dragon CnC Beacon Inbound"; flow:established,from_server; dsize:16; content:"|01 50 00 00 00 00 00 00 00 00 00 01 68 57 24 13|"; threshold: type limit, count 1, seconds 60, track by_src; reference:url,www.mcafee.com/us/resources/white-papers/wp-global-energy-cyberattacks-Night-dragon.pdf; classtype:command-and-control; sid:2012304; rev:6; metadata:attack_target Client_Endpoint, created_at 2011_02_10, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2011_02_10, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET [25,587] (msg:"ET EXPLOIT Possible CVE-2014-1761 Inbound SMTP 4"; flow:from_client,established; content:"x1LTU1N"; fast_pattern; pcre:"/^(?:.*?(?:XHUtNTU0|cdS01NT|x1LTU1N)){5}/Rs"; reference:cve,2014-1761; reference:url,blogs.technet.com/b/srd/archive/2014/03/24/security-advisory-2953095-recommendation-to-stay-protected-and-for-detections.aspx; classtype:attempted-user; sid:2018310; rev:6; metadata:created_at 2014_03_25, former_category CURRENT_EVENTS, updated_at 2014_03_25;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Night Dragon Dropper Download Command"; flow:established,from_server; dsize:5; content:"|01 08 00 00 00|"; reference:url,www.mcafee.com/us/resources/white-papers/wp-global-energy-cyberattacks-Night-dragon.pdf; classtype:trojan-activity; sid:2012308; rev:2; metadata:created_at 2011_02_11, former_category MALWARE, updated_at 2011_02_11;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET [25,587] (msg:"ET EXPLOIT Possible CVE-2014-1761 Inbound SMTP 5"; flow:from_client,established; content:"XHUtNTU0"; fast_pattern; pcre:"/^(?:.*?(?:XHUtNTU0|cdS01NT|x1LTU1N)){7}/Rs"; reference:cve,2014-1761; reference:url,blogs.technet.com/b/srd/archive/2014/03/24/security-advisory-2953095-recommendation-to-stay-protected-and-for-detections.aspx; classtype:attempted-user; sid:2018311; rev:5; metadata:created_at 2014_03_25, former_category CURRENT_EVENTS, updated_at 2014_03_25;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE PWS Banker Trojan Sending Report of Infection"; flow: established,to_server; content:"From|3a 20 22|PC ID|3a|"; nocase; content:"Subject|3a| INFECTED"; nocase; content:"esta infectado"; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pwsteal.banker.b.html; reference:url,doc.emergingthreats.net/2001933; classtype:trojan-activity; sid:2001933; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET [25,587] (msg:"ET EXPLOIT Possible CVE-2014-1761 Inbound SMTP 6"; flow:from_client,established; content:"cdS01NT"; fast_pattern; pcre:"/^(?:.*?(?:XHUtNTU0|cdS01NT|x1LTU1N)){7}/Rs"; reference:cve,2014-1761; reference:url,blogs.technet.com/b/srd/archive/2014/03/24/security-advisory-2953095-recommendation-to-stay-protected-and-for-detections.aspx; classtype:attempted-user; sid:2018312; rev:5; metadata:created_at 2014_03_25, former_category CURRENT_EVENTS, updated_at 2014_03_25;)
+#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Possible Neosploit Toolkit download"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/GNH11.exe"; http_uri; nocase; reference:url,www.malwareurl.com/listing.php?domain=piadraspgdw.com; reference:url,labs.m86security.com/2011/01/shedding-light-on-the-neosploit-exploit-kit; classtype:trojan-activity; sid:2012333; rev:3; metadata:created_at 2011_02_22, former_category CURRENT_EVENTS, updated_at 2011_02_22;)
 
-alert tcp any any -> $HOME_NET !$HTTP_PORTS (msg:"ET EXPLOIT Malformed HeartBeat Request"; flow:established,to_server; content:"|18 03|"; depth:2; byte_test:1,<,4,2; content:"|01|"; offset:5; depth:1; byte_extract:2,3,record_len; byte_test:2,>,2,3; byte_test:2,>,record_len,6; threshold:type limit,track by_src,count 1,seconds 120; flowbits:set,ET.MalformedTLSHB; reference:cve,2014-0160; reference:url,blog.inliniac.net/2014/04/08/detecting-openssl-heartbleed-with-suricata/; reference:url,heartbleed.com/; reference:url,blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/; classtype:bad-unknown; sid:2018372; rev:3; metadata:created_at 2014_04_08, former_category CURRENT_EVENTS, updated_at 2014_04_08;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Eleonore Exploit pack download"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/load/load.exe"; nocase; http_uri; reference:url,www.malwareurl.com/listing.php?domain=ultranichehost.com; classtype:trojan-activity; sid:2012446; rev:2; metadata:created_at 2011_03_10, updated_at 2011_03_10;)
 
-alert tcp any any -> $HOME_NET !$HTTP_PORTS (msg:"ET EXPLOIT Malformed HeartBeat Request method 2"; flow:established,to_server; content:"|18 03|"; depth:2; byte_test:1,<,4,2; content:"|01|"; offset:5; depth:1; byte_test:2,>,2,3; byte_test:2,>,200,6; threshold:type limit,track by_src,count 1,seconds 120; flowbits:set,ET.MalformedTLSHB; flowbits:noalert; reference:cve,2014-0160; reference:url,blog.inliniac.net/2014/04/08/detecting-openssl-heartbleed-with-suricata/; reference:url,heartbleed.com/; reference:url,blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/; classtype:bad-unknown; sid:2018374; rev:3; metadata:created_at 2014_04_08, former_category CURRENT_EVENTS, updated_at 2014_04_08;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader Win32.Agent.FakeAV.AVG 1"; flow:to_server,established; content:"GET"; nocase; http_method; content:"?mod=lr&id="; http_uri; content:"&ver="; http_uri; content:"&bit="; http_uri; content:"&uni="; http_uri; reference:url,support.clean-mx.de/clean-mx/view_joebox.php?md5=96742442435325983fefb385174a57be&id=765408; classtype:trojan-activity; sid:2012448; rev:2; metadata:created_at 2011_03_10, updated_at 2011_03_10;)
 
-alert tcp any any -> $HOME_NET any (msg:"ET EXPLOIT TLS HeartBeat Request (Server Initiated) fb set"; flow:established,from_server; content:"|18 03|"; depth:2; byte_test:1,<,4,2; flowbits:isnotset,ET.HB.Response.SI; flowbits:set,ET.HB.Request.SI; flowbits:noalert; reference:cve,2014-0160; reference:url,blog.inliniac.net/2014/04/08/detecting-openssl-heartbleed-with-suricata/; reference:url,heartbleed.com/; reference:url,blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/; classtype:bad-unknown; sid:2018375; rev:4; metadata:created_at 2014_04_09, former_category CURRENT_EVENTS, updated_at 2014_04_09;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader Win32.Agent.FakeAV.AVG 2"; flow:to_server,established; content:"GET"; nocase; http_method; content:"?mod=vv&i="; http_uri; content:"&id="; http_uri; content:"&uni="; http_uri; reference:url,support.clean-mx.de/clean-mx/view_joebox.php?md5=96742442435325983fefb385174a57be&id=765408; classtype:trojan-activity; sid:2012449; rev:2; metadata:created_at 2011_03_10, updated_at 2011_03_10;)
 
-alert tcp any any -> $HOME_NET any (msg:"ET EXPLOIT TLS HeartBeat Request (Client Initiated) fb set"; flow:established,to_server; content:"|18 03|"; depth:2; byte_test:1,<,4,2; flowbits:isnotset,ET.HB.Response.CI; flowbits:set,ET.HB.Request.CI; flowbits:noalert; reference:cve,2014-0160; reference:url,blog.inliniac.net/2014/04/08/detecting-openssl-heartbleed-with-suricata/; reference:url,heartbleed.com/; reference:url,blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/; classtype:bad-unknown; sid:2018376; rev:5; metadata:created_at 2014_04_09, former_category CURRENT_EVENTS, updated_at 2014_04_09;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Vundo Trojan Variant reporting to Controller"; flow:established,to_server; content:"POST"; http_method; content:"/frame.html?"; http_uri; urilen: > 80; reference:url,doc.emergingthreats.net/2009173; classtype:trojan-activity; sid:2009173; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> any any (msg:"ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response (Client Init Vuln Server)"; flow:established,to_client; content:"|18 03|"; depth:2; byte_test:1,<,4,2; flowbits:isset,ET.HB.Request.CI; flowbits:isnotset,ET.HB.Response.CI; flowbits:set,ET.HB.Response.CI; flowbits:unset,ET.HB.Request.CI; byte_test:2,>,150,3; threshold:type limit,track by_src,count 1,seconds 120; reference:cve,2014-0160; reference:url,blog.inliniac.net/2014/04/08/detecting-openssl-heartbleed-with-suricata/; reference:url,heartbleed.com/; reference:url,blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/; classtype:bad-unknown; sid:2018377; rev:4; metadata:created_at 2014_04_09, former_category CURRENT_EVENTS, updated_at 2014_04_09;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Hiloti loader installed successfully response"; flow:established,from_server; content:"|0d 0a 0d 0a|a|0d 0a|install OK"; classtype:trojan-activity; sid:2012512; rev:2; metadata:created_at 2011_03_16, updated_at 2011_03_16;)
 
-alert tcp $HOME_NET any -> any any (msg:"ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response (Server Init Vuln Client)"; flow:established,to_server; content:"|18 03|"; depth:2; byte_test:1,<,4,2; flowbits:isset,ET.HB.Request.SI; flowbits:isnotset,ET.HB.Response.SI; flowbits:set,ET.HB.Response.SI; flowbits:unset,ET.HB.Request.SI; byte_test:2,>,150,3; threshold:type limit,track by_src,count 1,seconds 120; reference:cve,2014-0160; reference:url,blog.inliniac.net/2014/04/08/detecting-openssl-heartbleed-with-suricata/; reference:url,heartbleed.com/; reference:url,blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/; classtype:bad-unknown; sid:2018378; rev:6; metadata:created_at 2014_04_09, former_category CURRENT_EVENTS, updated_at 2014_04_09;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Zbot/Zeus HTTP POST"; flow:to_server,established; content:"POST"; depth:4; http_method; content:".php?"; http_uri; content:"zip="; http_uri; content:"type="; http_uri; content:"name="; http_uri; content:"q="; http_uri; content:"item="; http_uri; content:"id="; http_uri; content:"rdp="; http_uri; reference:url,doc.emergingthreats.net/2008661; classtype:trojan-activity; sid:2008661; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET [21,25,110,143,443,465,587,636,989:995,5061,5222] (msg:"ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response from Common SSL Port (Outbound from Client)"; flow:established,from_client; content:"|18 03|"; depth:2; byte_test:1,<,4,2; byte_test:2,>,150,3; byte_test:2,<,17000,3; threshold:type limit,track by_src,count 1,seconds 120; reference:cve,2014-0160; reference:url,blog.inliniac.net/2014/04/08/detecting-openssl-heartbleed-with-suricata/; reference:url,heartbleed.com/; reference:url,blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/; classtype:bad-unknown; sid:2018383; rev:9; metadata:created_at 2014_04_11, former_category CURRENT_EVENTS, updated_at 2014_04_11;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE - Possible Zeus/Perkesh (.bin) configuration download"; flow:established,to_server; content:"GET"; http_method; content:!"Referer|3a|"; nocase; http_header; content:!"Host|3a| toolbar.live.com|0d 0a|"; nocase; http_header; content:!"Host|3a| downloadfree.avg.com|0d 0a|"; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE"; content:"Accept|3a| */*|0d 0a|"; content:".bin"; http_uri; pcre:"/\/[0-9A-Z]+\/[0-9A-Z]+\.bin$/Ui"; reference:url,zeustracker.abuse.ch; reference:url,doc.emergingthreats.net/2010348; classtype:trojan-activity; sid:2010348; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert tcp any any -> $HOME_NET [443,636,989,990,992,993,994,995,5061,25] (msg:"ET EXPLOIT Possible TLS HeartBleed Unencrypted Request Method 4 (Inbound to Common SSL Port)"; flow:established,to_server; content:"|18 03|"; byte_test:1,<,4,0,relative; content:"|00 03 01|"; distance:1; within:3; byte_test:2,>,150,0,relative; isdataat:!18,relative; threshold:type limit,track by_src,count 1,seconds 120; reference:cve,2014-0160; reference:url,blog.inliniac.net/2014/04/08/detecting-openssl-heartbleed-with-suricata/; reference:url,heartbleed.com/; reference:url,blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/; classtype:bad-unknown; sid:2018388; rev:3; metadata:created_at 2014_04_15, former_category CURRENT_EVENTS, updated_at 2014_04_15;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE X-Tag Zeus Mitmo user agent"; flow:established,to_server; content:"|29 20|X-Tag/"; nocase; reference:url,eternal-todo.com/blog/thoughts-facts-zeus-mitmo; classtype:trojan-activity; sid:2011926; rev:5; metadata:created_at 2010_11_16, updated_at 2010_11_16;)
 
-alert tcp any any -> $HOME_NET [443,636,989,990,992,993,994,995,5061,25] (msg:"ET EXPLOIT Possible TLS HeartBleed Unencrypted Request Method 3 (Inbound to Common SSL Port)"; flow:established,to_server; content:"|18 03|"; depth:2; byte_test:1,<,4,0,relative; content:!"|00 03|"; distance:1; within:2; byte_extract:2,1,rec_len,relative; content:"|01|"; within:1; byte_test:2,>,150,0,relative; byte_test:2,>,rec_len,0,relative; threshold:type limit,track by_src,count 1,seconds 120; reference:cve,2014-0160; reference:url,blog.inliniac.net/2014/04/08/detecting-openssl-heartbleed-with-suricata/; reference:url,heartbleed.com/; reference:url,blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/; classtype:bad-unknown; sid:2018389; rev:4; metadata:created_at 2014_04_15, former_category CURRENT_EVENTS, updated_at 2014_04_15;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Inject.ql Checkin Post"; flow:established,to_server; content:"POST"; depth:4; http_method; content:"MAC="; nocase; http_client_body; content:"&IP="; nocase; http_client_body; content:"&NAME="; nocase; http_client_body; content:"&OS="; nocase; http_client_body; reference:url,doc.emergingthreats.net/2007803; classtype:command-and-control; sid:2007803; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert tcp $HOME_NET [443,465,993,995,25] -> $EXTERNAL_NET any (msg:"ET EXPLOIT SSL excessive fatal alerts (possible POODLE attack against server)"; flow:from_server,established; ssl_version:sslv3; content:"|15 03 00 00|"; depth:4; byte_jump:2,3,post_offset -1; isdataat:!2,relative; threshold:type both, track by_src, count 50, seconds 300; reference:url,blog.fox-it.com/2014/10/15/poodle/; reference:url,www.openssl.org/~bodo/ssl-poodle.pdf; reference:cve,2014-3566; reference:url,askubuntu.com/questions/537196/how-do-i-patch-workaround-sslv3-poodle-vulnerability-cve-2014-3566; reference:url,www.imperialviolet.org/2014/10/14/poodle.html; classtype:attempted-recon; sid:2019418; rev:6; metadata:created_at 2014_10_15, former_category CURRENT_EVENTS, updated_at 2014_10_15;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Coreflood/AFcore Trojan Infection"; flow:to_server; content:"POST|20|/c/a"; byte_test:1,<,64,0,relative; content:"HTTP/1.0|0d 0a|Host|3a20|"; reference:url,www.secureworks.com/research/threats/coreflood; reference:url,doc.emergingthreats.net/2008434; classtype:trojan-activity; sid:2008434; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Metasploit Java CVE-2013-2465 Class Name Sub Algo"; flow:established,from_server; flowbits:isset,ET.http.javaclient; file_data; content:".classPK"; content:"$"; distance:-21; within:1; content:".classPK"; distance:0; content:"$"; distance:-21; within:1; pcre:"/\b(?P<xps>[a-zA-Z]{7})\.classPK.+?\b(?P=xps)\$[a-zA-Z]{12}\.classPK.+?\b(?P=xps)\$[a-zA-Z]{12}\.classPK/s"; reference:cve,2013-2465; reference:url,seclists.org/fulldisclosure/2013/Aug/134; reference:url,github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/java_storeimagearray.rb; classtype:attempted-user; sid:2017568; rev:4; metadata:affected_product Any, attack_target Client_and_Server, created_at 2013_10_08, deployment Perimeter, deployment Internet, deployment Internal, deployment Datacenter, former_category CURRENT_EVENTS, signature_severity Critical, tag Metasploit, updated_at 2016_07_01;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.small Generic Checkin"; flow:established,to_server; content:"/install.asp?mac="; http_uri; content:"User-Agent|3a| MyAgent"; http_header; classtype:command-and-control; sid:2012541; rev:2; metadata:created_at 2011_03_22, former_category MALWARE, updated_at 2011_03_22;)
 
-alert tcp $HOME_NET [21,25,110,143,443,465,587,636,989:995,5061,5222] -> $EXTERNAL_NET any (msg:"ET EXPLOIT Possible OpenSSL HeartBleed Large HeartBeat Response from Common SSL Port (Outbound from Server)"; flow:established,to_client; content:"|18 03|"; depth:2; byte_test:1,<,4,2; byte_test:2,>,150,3; byte_test:2,<,17000,3; threshold:type limit,track by_dst,count 1,seconds 120; reference:cve,2014-0160; reference:url,blog.inliniac.net/2014/04/08/detecting-openssl-heartbleed-with-suricata/; reference:url,heartbleed.com/; reference:url,blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/; classtype:bad-unknown; sid:2018382; rev:9; metadata:created_at 2014_04_11, former_category CURRENT_EVENTS, updated_at 2014_04_11;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Monkif/DlKroha Trojan Activity HTTP Outbound"; flow:to_server,established; content:".php?"; http_uri; content:"4x4x4x4x4x6x"; http_uri; fast_pattern; reference:url,doc.emergingthreats.net/2009752; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3aWin32%2fMonkif.C; classtype:trojan-activity; sid:2009752; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT FakeAV Landing Page - Viruses were found"; flow:established,from_server; file_data; content:">Viruses were found on your computer!</"; fast_pattern; content:"images/alert.png"; classtype:bad-unknown; sid:2014729; rev:5; metadata:created_at 2012_05_10, former_category CURRENT_EVENTS, updated_at 2012_05_10;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Malicious JAR olig"; flow:established,from_server; content:"|00 00|META-INF/PK|0a|"; fast_pattern; content:"|00|olig/"; classtype:trojan-activity; sid:2012646; rev:3; metadata:created_at 2011_04_07, former_category CURRENT_EVENTS, updated_at 2011_04_07;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Adobe Flash Player update warning enticing clicks to malware payload"; flow:established,from_server; file_data; content:"WARNING|21| You should update your Flash Player Immediately"; classtype:trojan-activity; sid:2017122; rev:4; metadata:created_at 2013_07_09, former_category CURRENT_EVENTS, updated_at 2013_07_09;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Rimecud download"; flow:established,to_server; content:"/peca"; nocase; http_uri; content:".exe"; nocase; http_uri; content:"User-Agent|3a 20|SKOLOVANI"; nocase; http_header; pcre:"/\x2fpeca\d+\x2eexe/Ui"; reference:url,www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Trojan%3aWin32/Rimecud.A; classtype:trojan-activity; sid:2012828; rev:2; metadata:created_at 2011_05_20, updated_at 2011_05_20;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT DRIVEBY FakeUpdate - URI - Payload Requested"; flow:established,to_server; content:"DDL Java Installer.php?dv1="; http_uri; classtype:trojan-activity; sid:2017846; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2013_12_13, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag DriveBy, updated_at 2016_07_01;)
+#alert udp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET MALWARE Palevo/BFBot/Mariposa server join acknowledgement"; dsize:8; content:"|40|"; depth:1; flowbits:isset,ET.MariposaJoin; reference:url,defintel.com/docs/Mariposa_Analysis.pdf; reference:url,defintel.blogspot.com/2009/09/half-of-fortune-100-companies.html; reference:url,doc.emergingthreats.net/2010101; reference:url,blogs.pcmag.com/securitywatch/2009/09/botnet_reported_loose_in_fortu.php; reference:url,www.symantec.com/business/security_response/writeup.jsp?docid=2009-093006-0442-99&tabid=2; reference:url,www.symantec.com/connect/blogs/mariposa-butterfly; classtype:trojan-activity; sid:2010101; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT DRIVEBY FakeSupport - Landing Page - Windows Firewall Warning"; flow:established,to_client; file_data; content:"<title>Windows Firewall warning!"; nocase; classtype:trojan-activity; sid:2019597; rev:3; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2014_10_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag DriveBy, updated_at 2016_07_01;)
+#alert udp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET MALWARE Butterfly/Mariposa Bot Join Acknowledgment"; dsize:21; content:"|38|"; depth:1; flowbits:isset,ET.ButterflyJoin; classtype:trojan-activity; sid:2011296; rev:2; metadata:created_at 2010_09_28, updated_at 2010_09_28;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT DRIVEBY FakeSupport - Landing Page - Operating System Check"; flow:established,to_client; file_data; content:"Operating System Check"; classtype:trojan-activity; sid:2019599; rev:4; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2014_10_30, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag DriveBy, updated_at 2016_07_01;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Clicker.Win32.AutoIt.ai Checkin"; flow:to_server,established; content:"/getpmnum"; http_uri; content:".asp?"; http_uri; content:"id="; http_uri; reference:md5,39d0dbe4f6923ed36864ae339f558963; classtype:command-and-control; sid:2012867; rev:3; metadata:created_at 2011_05_26, former_category MALWARE, updated_at 2011_05_26;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Scam - FakeAV Alert Landing March 2 2015"; flow:established,from_server; file_data; content:"WARNING! Your PC may not be protected!"; content:"remove malicious malware and adware"; distance:0; classtype:social-engineering; sid:2020588; rev:3; metadata:created_at 2015_03_03, former_category WEB_CLIENT, updated_at 2015_03_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor Win32/Begman.A Checkin"; flow:established,to_server; content:".php?v="; http_uri; content:"&id="; http_uri; content:"&wv="; http_uri; pcre:"/\.php\?v=[A-Za-z0-9.]+&id=-?\d+&wv=[0-9.]{1,14}$/U"; reference:url,support.clean-mx.de/clean-mx/view_joebox.php?md5=2eb07de0ccaed89cd099fe61e6ae689e&id=766255/; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FBegman.A; reference:url,www.virustotal.com/file-scan/report.html?id=0bb86bf59dd554f98194b23a16b96f873ddab8cbe11de627415ff81facd84f48-1299508248; classtype:bad-unknown; sid:2012908; rev:3; metadata:created_at 2011_05_31, former_category MALWARE, updated_at 2011_05_31;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Scam - FakeAV Alert Landing March 2 2015"; flow:established,from_server; file_data; content:"WARNING|3a| Your PC may have a serious virus!"; content:"assistance removing malicious viruses"; classtype:social-engineering; sid:2020589; rev:3; metadata:created_at 2015_03_03, former_category WEB_CLIENT, updated_at 2015_03_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 288 (msg:"ET MALWARE Dropper.Win32.Agent.ahju Checkin"; flow:established,to_server; content:"|44 78 47 54 33 43 6D 42 66 39 73 39 6C 74 62 6A 35 61 4A 7C 0A|"; depth:21; reference:md5,48ad09c574a4bd3bb24d007005382e63; reference:md5,a264690a775a4e1b3d91c2dbcd850ce9; classtype:command-and-control; sid:2012895; rev:2; metadata:created_at 2011_05_31, former_category MALWARE, updated_at 2011_05_31;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Windows Security Warning - Alert"; flow:established,to_client; file_data; content:"WARNING - SECURITY ALERT"; classtype:trojan-activity; sid:2020710; rev:3; metadata:created_at 2015_03_19, former_category CURRENT_EVENTS, updated_at 2015_03_19;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Bifrose Response from Controller"; flow:established,from_server; dsize:9; content:"|05 00 00 00 BC|"; depth:5; content:"|CC|"; distance:3; within:4; reference:url,doc.emergingthreats.net/2008274; classtype:trojan-activity; sid:2008274; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing June 2 2015"; flow:established,from_server; file_data; content:"WARNING|3a| INTERNET SECURITY ALERT"; nocase; fast_pattern; content:"function myFunction|28 29|"; nocase; distance:0; content:"Due to Suspicious Activity"; nocase; distance:0; classtype:social-engineering; sid:2021177; rev:3; metadata:created_at 2015_06_03, former_category WEB_CLIENT, updated_at 2015_06_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Bifrose Connect to Controller"; flow:established,to_server; dsize:<20; content:"|09 00 00 9a|"; depth:4; content:"|cc|"; distance:3; within:4; content:"|74|"; distance:3; within:4; reference:url,doc.emergingthreats.net/2008273; classtype:trojan-activity; sid:2008273; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing June 4 2015 M1"; flow:established,to_client; file_data; content:"MICROSOFT WINDOWS SECURITY ALERT"; nocase; fast_pattern; content:"WARNING: VIRUS CHECK"; nocase; distance:0; classtype:social-engineering; sid:2021181; rev:3; metadata:created_at 2015_06_04, former_category WEB_CLIENT, updated_at 2015_06_04;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.Win32.ZZSlash/Redosdru.E checkin"; flow:established,to_server; content:"|14 00 00 00 04 00 00 00 78 9C 63 60 60 60 00 00 00 04 00 01|"; depth:20; reference:md5,3b0299d72c853f56a1595c855776f89f; reference:md5,adc3a35d1244c9129be6edd6ccfaec5b; classtype:command-and-control; sid:2012957; rev:2; metadata:created_at 2011_06_08, former_category MALWARE, updated_at 2011_06_08;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing June 4 2015 M2"; flow:established,to_client; file_data; content:"WARNING: VIRUS CHECK"; fast_pattern; nocase; content:"function myFunction|28 29|"; nocase; distance:0; content:"There is a .net frame work file missing due to some harmfull virus"; nocase; distance:0; classtype:social-engineering; sid:2021182; rev:3; metadata:created_at 2015_06_04, former_category WEB_CLIENT, updated_at 2015_06_04;)
+#alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32.Qakbot .cb File Extention FTP Upload"; flow:established,to_server; content:"si_"; content:".cb"; distance:10; within:3; pcre:"/si\x5F[a-z]{5}[0-9]{5}\x2Ecb/smi"; reference:url,www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_qakbot_in_detail.pdf; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2009-050707-0639-99; classtype:trojan-activity; sid:2012974; rev:2; metadata:created_at 2011_06_09, updated_at 2011_06_09;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing June 4 2015 M3"; flow:established,to_client; file_data; content:"Advised System Support!"; fast_pattern; nocase; content:"Your Computer May Not Be Protected"; nocase; distance:0; content:"Possible network damages if virus not removed immediately"; nocase; distance:0; classtype:social-engineering; sid:2021183; rev:3; metadata:created_at 2015_06_04, former_category WEB_CLIENT, updated_at 2015_06_04;)
+#alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32.Qakbot Seclog FTP Upload"; flow:established,to_server; content:"seclog_"; content:".kcb"; within:30; pcre:"/seclog\x5F[a-z]{5}[0-9]{5}\x5F.+\x2Ekcb/smi"; reference:url,www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_qakbot_in_detail.pdf; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2009-050707-0639-99; classtype:trojan-activity; sid:2012975; rev:2; metadata:created_at 2011_06_09, updated_at 2011_06_09;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing June 16 2015 M2"; flow:established,to_client; file_data; content:"Security Error"; nocase; content:"myFunction|28 29|"; content:"setInterval"; content:"WARNING"; nocase; classtype:social-engineering; sid:2021286; rev:4; metadata:created_at 2015_06_17, former_category WEB_CLIENT, updated_at 2015_06_17;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Carberp CnC Reply no tasks"; flow:established,from_server; content:"|0d 0a 0d 0a|no tasks"; classtype:command-and-control; sid:2011851; rev:7; metadata:created_at 2010_10_26, former_category MALWARE, updated_at 2010_10_26;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing June 16 2015 M4"; flow:established,to_client; file_data; content:"onload=|22|myFunction|28 29 3b 22|"; fast_pattern; content:"onmouseover=|22|myFunction|28 29 3b 22|"; distance:1; content:"onclick=|22|myFunction|28 29 3b 22|"; distance:1; content:"onkeydown=|22|myFunction|28 29 3b 22|"; distance:1; content:"onunload=|22|myFunction|28 29 3b 22|"; distance:1; classtype:social-engineering; sid:2021288; rev:3; metadata:created_at 2015_06_17, former_category WEB_CLIENT, updated_at 2015_06_17;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DLoader PWS Module Data Upload Activity"; flow:established,to_server; content:"/grabbers.php"; http_uri; content:"logs="; content:"&module=grabbers"; distance:0; reference:md5,12554e7f2e78daf26e73a2f92d01e7a7; reference:url,about-threats.trendmicro.com/malware.aspx?language=us&name=TROJ_VBKRYPT.CB; reference:md5,3310259795b787210dd6825e7b6d6d28; reference:url,www.f-secure.com/v-descs/trojan-downloader_w32_kdv176347.shtml; reference:md5,7af2097d75869aa5aa656cd6e523c8b3; classtype:trojan-activity; sid:2013046; rev:3; metadata:created_at 2011_06_16, updated_at 2011_06_16;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing June 17 2015 M1"; flow:established,to_client; file_data; content:"/Alert_files/"; nocase; fast_pattern; content:"Due to a third party application"; nocase; distance:0; content:"iOS is crashed"; nocase; distance:0; classtype:social-engineering; sid:2021294; rev:3; metadata:created_at 2015_06_18, former_category WEB_CLIENT, updated_at 2015_06_18;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MacShield FakeAV CnC Communication"; flow:established,to_server; content:"/mac/soft.php?affid="; nocase; http_uri; fast_pattern:only; reference:url,blog.trendmicro.com/obfuscated-ip-addresses-and-affiliate-ids-in-mac-fakeav/; classtype:command-and-control; sid:2013062; rev:2; metadata:created_at 2011_06_17, former_category MALWARE, updated_at 2011_06_17;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing June 17 2015 M2"; flow:established,to_server; content:"GET"; http_method; content:"a=HT&u="; http_uri; fast_pattern; content:"&clickid="; http_uri; distance:0; content:"&browser="; http_uri; distance:0; content:"&country="; http_uri; distance:0; content:"&device="; http_uri; distance:0; content:"&model="; http_uri; distance:0; content:"&isp="; http_uri; distance:0; classtype:social-engineering; sid:2021295; rev:3; metadata:created_at 2015_06_18, former_category WEB_CLIENT, updated_at 2015_06_18;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Vilsel.ayjv Checkin (aid)"; flow:to_server,established; content:"?aid="; http_uri; content:"&si="; http_uri; content:"&rd="; http_uri; pcre:"/&si=\d+&si=\d+&rd=20\d{11}/U"; classtype:command-and-control; sid:2013122; rev:5; metadata:created_at 2011_06_29, former_category MALWARE, updated_at 2011_06_29;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing June 26 2015 M1"; flow:established,to_server; content:"GET"; http_method; content:".php?cid="; http_uri; fast_pattern; content:"-w"; distance:0; http_uri; pcre:"/\.php\?cid=[0-9]+?-w[A-Z0-9]{23}$/U"; classtype:social-engineering; sid:2021357; rev:5; metadata:created_at 2015_06_26, former_category WEB_CLIENT, updated_at 2015_06_26;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FakeAV FakeAlert.Rena.n Checkin Flowbit set"; flow:established,to_server; content:"/1020000"; http_uri; depth:8; content:" HTTP/1.0|0d 0a|"; http_header; flowbits:set,ET.fakealert.rena.n; flowbits:noalert; classtype:command-and-control; sid:2013135; rev:1; metadata:created_at 2011_06_29, former_category MALWARE, updated_at 2011_06_29;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing June 26 2015 M2"; flow:established,to_client; file_data; content:"SCANNING.."; fast_pattern; content:"myFunction|28 29|"; distance:0; content:"virus"; nocase; distance:0; classtype:social-engineering; sid:2021358; rev:3; metadata:created_at 2015_06_26, former_category WEB_CLIENT, updated_at 2015_06_26;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Swizzor Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"c="; http_uri; content:"&wv="; http_uri; content:"&wd="; http_uri; content:"&ie="; http_uri; content:"User-Agent|3a| NSISDL/1.2 (Mozilla)"; http_header; reference:url,doc.emergingthreats.net/2008347; classtype:successful-recon-limited; sid:2008347; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing June 26 2015 M3"; flow:established,to_client; file_data; content:"e.ctrlKey &&"; distance:0; content:"e.keyCode ==="; distance:0; content:"e.keyCode ==="; distance:0; content:"e.keyCode ==="; distance:0; content:"IP has been Registed"; nocase; fast_pattern; distance:0; classtype:social-engineering; sid:2021359; rev:3; metadata:created_at 2015_06_26, former_category WEB_CLIENT, updated_at 2015_06_26;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SafeFighter Fake Scanner Installation in Progress"; flow:established,to_server; content:"/safefighter.php"; nocase; http_uri; content:"User-Agent|3a| NSIS"; nocase; http_header; reference:url,doc.emergingthreats.net/2010065; classtype:trojan-activity; sid:2010065; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Stylesheet June 26 2015"; flow:established,to_client; content:"Content-Type|3a 20|text/css"; http_header; file_data; content:".header-warning"; content:".what-to-do"; distance:0; content:"more-about-the-virus"; distance:0; fast_pattern; classtype:social-engineering; sid:2021366; rev:3; metadata:created_at 2015_06_29, former_category WEB_CLIENT, updated_at 2015_06_29;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan/Hacktool.Sniffer Initial Checkin"; flow:established,to_server; content:"/username.asp?Uid="; http_uri; fast_pattern:only; classtype:command-and-control; sid:2013198; rev:2; metadata:created_at 2011_07_05, former_category MALWARE, updated_at 2011_07_05;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing June 26 2015 M6"; flow:established,to_client; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"<title>WARNING|3a|"; nocase; fast_pattern; content:"onbeforeunload"; nocase; distance:0; content:"function|28 29|"; nocase; distance:0; content:"virus"; nocase; distance:0; classtype:social-engineering; sid:2021368; rev:4; metadata:created_at 2015_06_29, former_category WEB_CLIENT, updated_at 2015_06_29;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/IRCBrute Checkin 2"; flow:established,to_server; content:"/Dialer_Min/telcom.asp"; nocase; http_uri; reference:url,www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~DwnLdr-IRB/detailed-analysis.aspx; classtype:command-and-control; sid:2013225; rev:3; metadata:created_at 2011_07_07, former_category MALWARE, updated_at 2011_07_07;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing July 20 2015 M4"; flow:to_client,established; file_data; content:"myFunction|28 29|"; content:"setInterval"; distance:0; content:"alert"; distance:0; content:"gp-msg.mp3"; nocase; distance:0; fast_pattern; classtype:social-engineering; sid:2021449; rev:3; metadata:created_at 2015_07_20, former_category WEB_CLIENT, updated_at 2015_07_20;)
+alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Ruskill/Palevo Download Command"; flow:established,to_server; content:"PRIVMSG #"; depth:9; content:"|3a 5b|d=|22|http|3a|//"; distance:0; reference:md5,2d69d8d243499ab53b840c64f68cc830; reference:url,sebdraven.tumblr.com/post/6769853139/palevo-analysises; classtype:trojan-activity; sid:2013245; rev:3; metadata:created_at 2011_07_11, updated_at 2011_07_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing July 20 2015 M1"; flow:to_client,established; file_data; content:"us_win.mp3"; fast_pattern; content:"yourOS|28 29|"; distance:0; content:"myFunction|28 29|"; distance:0; content:"onload_fun|28 29|"; distance:0; classtype:social-engineering; sid:2021500; rev:3; metadata:created_at 2015_07_20, former_category WEB_CLIENT, updated_at 2015_07_20;)
+alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Ruskill/Palevo CnC PONG"; flow:established,to_server; content:"PONG |3a|hub.us.com"; depth:16; reference:url,ore.carnivore.it/malware/hash/d4dc8459a34ea14d856e529d3a9e0362; reference:url,sebdraven.tumblr.com/post/6769853139/palevo-analysises; classtype:command-and-control; sid:2013246; rev:2; metadata:created_at 2011_07_11, former_category MALWARE, updated_at 2011_07_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing Sept 21 2015"; flow:established,to_client; file_data; content:"malware error 895-system 32.exe"; nocase; fast_pattern; content:"RESOLVE THE ISSUE ON TOLL FREE - 1-855-"; nocase; content:"DO NOT SHUT DOWN OR RESTART"; nocase; classtype:social-engineering; sid:2021811; rev:3; metadata:created_at 2015_09_22, former_category WEB_CLIENT, updated_at 2015_09_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Guagua Trojan Update Checkin"; flow:established,to_server; content:"/update_check?version="; http_uri; content:"User-Agent|3A| Update"; http_header; classtype:command-and-control; sid:2013259; rev:3; metadata:created_at 2011_07_13, former_category MALWARE, updated_at 2011_07_13;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Fake Virus Phone Scam Landing Oct 19 M1"; flow:established,to_server; content:"GET"; http_method; content:".html?a="; http_uri; fast_pattern; content:"&clickid=w"; distance:0; http_uri; pcre:"/&clickid=w[A-Z0-9]{23}$/U"; classtype:social-engineering; sid:2021963; rev:3; metadata:created_at 2015_10_19, former_category WEB_CLIENT, updated_at 2015_10_19;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Nekill Checkin"; flow:established,to_server; content:"?v="; http_uri; content:"&mid="; http_uri; content:"&r1="; http_uri; content:"&tm="; http_uri; content:"&av="; http_uri; content:"&os="; http_uri; content:"&uid="; http_uri; content:"&cht="; http_uri; content:"&sn="; http_uri; reference:url,blog.emergingthreatspro.com/2011/07/bot-of-day-nekilla.html; classtype:command-and-control; sid:2013260; rev:3; metadata:created_at 2011_07_13, former_category MALWARE, updated_at 2011_07_13;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Fake Virus Phone Scam Redirector Oct 19 M1"; flow:established,to_server; content:"GET"; http_method; content:"/scan"; depth:5; fast_pattern; http_uri; content:!"Referer|3a|"; http_header; pcre:"/^\/scan[A-Z][a-z]?\/?$/U"; classtype:social-engineering; sid:2021967; rev:3; metadata:created_at 2015_10_19, former_category WEB_CLIENT, updated_at 2015_10_19;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Banker.Delf Infection variant 2 - Sending Initial Email to Owner"; flow:established,to_server; content:"X-Library|3a| Indy 9"; nocase; content:"Nome Computador|3a| "; nocase; content:"Data|3a| "; nocase; reference:url,www.avira.com/en/threats/section/details/id_vir/1836/tr_banker.delf.df735649.html; reference:url,doc.emergingthreats.net/2002978; classtype:trojan-activity; sid:2002978; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Fake Virus Phone Scam Redirector Oct 19 M3"; flow:established,to_server; content:"GET"; http_method; content:"/eyJscCI6InRlc3Q"; depth:16; fast_pattern; http_uri; pcre:"/^\/(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\/$/U"; classtype:social-engineering; sid:2021974; rev:3; metadata:created_at 2015_10_20, former_category WEB_CLIENT, updated_at 2015_10_20;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Sohanad Checkin via HTTP"; flow:established,to_server; content:"GET"; http_method; content:"/cs/bux/check.php"; http_uri; content:!"User-Agent|3a| "; http_header; reference:url,doc.emergingthreats.net/2007898; classtype:command-and-control; sid:2007898; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Virus Phone Scam Landing Oct 19 M5"; flow:established,from_server; file_data; content:"<title>SECURITY WARNING"; nocase; content:"dontdisplaycheckbox()"; distance:0; nocase; content:"gp-msg.mp3"; distance:0; nocase; fast_pattern; content:"Infection ID"; distance:0; nocase; classtype:social-engineering; sid:2021975; rev:3; metadata:created_at 2015_10_20, former_category WEB_CLIENT, updated_at 2015_10_20;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Cycbot Pay-Per-Install Executable Download"; flow:established,to_server; content:"/adv.php?login="; http_uri; content:"&key="; http_uri; content:"&subacc="; http_uri; reference:url,www.eset.com/about/blog/blog/article/cycbot-ready-to-ride/; classtype:trojan-activity; sid:2013291; rev:2; metadata:created_at 2011_07_19, updated_at 2011_07_19;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing Oct 29"; flow:established,to_client; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"WARNING! Windows Update Required"; nocase; fast_pattern; content:"Call US Toll Free|20 3a 20|1-877"; nocase; distance:0; content:"System connected with OVERSEAS IP Address"; nocase; distance:0; content:"YOUR COMPUTER HAS BEEN LOCKED!!"; nocase; distance:0; reference:url,threatglass.com/malicious_urls/funu-info; classtype:social-engineering; sid:2022010; rev:3; metadata:created_at 2015_10_29, former_category WEB_CLIENT, updated_at 2015_10_29;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Cycbot Initial Checkin to CnC"; flow:established,to_server; content:"id="; http_uri; content:"&hwid="; http_uri; content:"&step="; http_uri; content:"&wd="; http_uri; content:"&av="; fast_pattern; http_uri; reference:url,www.eset.com/about/blog/blog/article/cycbot-ready-to-ride/; classtype:command-and-control; sid:2013292; rev:2; metadata:created_at 2011_07_19, former_category MALWARE, updated_at 2011_07_19;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Virus Phone Scam Audio Oct 30"; flow:established,from_server; file_data; content:"<audio"; content:"gp-msg.mp3"; distance:0; nocase; fast_pattern; content:"audio/mpeg"; distance:0; nocase; content:"</audio>"; distance:0; nocase; classtype:social-engineering; sid:2022012; rev:3; metadata:created_at 2015_10_31, former_category WEB_CLIENT, updated_at 2015_10_31;)
+#alert udp $HOME_NET [!1720,!1722,!2222,!2427,!5060,1024:] -> $EXTERNAL_NET [!1720,!1722,!2427,!5060,1024:] (msg:"ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 1)"; dsize:>19; byte_test:1, &, 1, 19; threshold: type both, track by_src, count 95, seconds 50; reference:url,mtc.sri.com/Conficker/addendumC/; reference:url,doc.emergingthreats.net/2009205; reference:url,www.mandiant.com/resources/apt41-us-state-governments; reference:md5,b82456963d04f44e83442b6393face47; classtype:trojan-activity; sid:2009205; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Video Player Update Scam Oct 30"; flow:established,from_server; file_data; content:"<title>Please Update"; nocase; fast_pattern; content:"downloadUrl"; nocase; distance:0; content:"update your video player"; nocase; distance:0; content:"please send a message <a href=|22|#|22|>here</a>"; nocase; distance:0; classtype:social-engineering; sid:2022013; rev:3; metadata:created_at 2015_10_31, former_category WEB_CLIENT, updated_at 2015_10_31;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Google Warning Infected Local User"; flow:established,from_server; content:"<span>It appears that your computer is infected with software that intercepts your connection to Google and other sites.</span>"; classtype:trojan-activity; sid:2013318; rev:1; metadata:created_at 2011_07_26, updated_at 2011_07_26;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Virus Phone Scam JS Landing Nov 4"; flow:established,from_server; content:"200"; http_stat_code; content:"Content-Type|3a 20|application/x-javascript"; http_header; content:"Content-Encoding|3a 20|gzip"; http_header; file_data; content:"tfnnumber"; content:"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="; distance:0; content:"msgencoded"; content:"returnmsgencoded"; distance:0; content:"Base64"; pcre:"/^\s*?\.\s*?decode\s*?\(\s*?msgencoded\s*?\)\s*?\.\s*?replace/Rsi"; classtype:social-engineering; sid:2022031; rev:5; metadata:created_at 2015_11_04, former_category WEB_CLIENT, updated_at 2015_11_04;)
+#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Ruskill CnC Download Command 1"; flow:established,to_client; content:"|3a|["; depth:2; content:".r.getfile http|3a|//"; distance:0; classtype:command-and-control; sid:2013329; rev:3; metadata:created_at 2011_07_27, former_category MALWARE, updated_at 2011_07_27;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Fake Virus Phone Scam GET Nov 4"; flow:to_server,established; content:"GET"; http_method; content:".html?cid="; nocase; http_uri; fast_pattern; content:"&caid="; http_uri; nocase; distance:0; content:"&oid="; http_uri; nocase; distance:0; content:"&zid="; http_uri; nocase; distance:0; content:"&os="; http_uri; nocase; distance:0; content:"&browser="; http_uri; nocase; distance:0; content:"&isp="; http_uri; nocase; distance:0; content:!"www.google-analytics.com|0d 0a|"; http_header; classtype:social-engineering; sid:2022032; rev:4; metadata:created_at 2015_11_04, former_category WEB_CLIENT, updated_at 2015_11_04;)
+#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Ruskill CnC Download Command 2"; flow:established,to_client; content:"|3a|n"; depth:2; content:"on .dl http|3a|//"; distance:0; classtype:command-and-control; sid:2013330; rev:1; metadata:created_at 2011_07_27, former_category MALWARE, updated_at 2011_07_27;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing Nov 11"; flow:established,to_client; file_data; content:"onload=|22|myFunction|28 29 22|"; fast_pattern; content:"onclick=|22|myFunction|28 29 22|"; distance:0; content:"onkeydown=|22|myFunction|28 29 22|"; distance:0; content:"onunload=|22|myFunction|28 29 22|"; distance:0; classtype:social-engineering; sid:2022079; rev:3; metadata:created_at 2015_11_12, former_category WEB_CLIENT, updated_at 2015_11_12;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Ruskill Reporting on Local Scans"; flow:established,to_server; content:"PRRVMSG"; depth:7; content:"Port Scan started on"; distance:0; content:"with a delay of"; distance:0; classtype:trojan-activity; sid:2013331; rev:1; metadata:created_at 2011_07_27, updated_at 2011_07_27;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Virus Phone Scam Landing Nov 16"; flow:established,from_server; file_data; content:"Windows Browser"; fast_pattern; content:"getElementById"; nocase; distance:0; pcre:"/^\s*?\(\s*?[\x22\x27]country[\x22\x27]/Rsi"; content:"getElementById"; nocase; distance:0; pcre:"/^\s*?\(\s*?[\x22\x27]isp[\x22\x27]/Rsi"; content:"getElementById"; nocase; distance:0; pcre:"/^\s*?\(\s*?[\x22\x27]ip[\x22\x27]/Rsi"; content:"Hello China"; nocase; distance:0; classtype:social-engineering; sid:2022092; rev:3; metadata:created_at 2015_11_16, former_category WEB_CLIENT, updated_at 2015_11_16;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Dropper.Win32.Agent.bpxo Checkin"; flow:established,to_server; content:"|71 4E 6C 39 34 65 66 59 41 7A 32 32 37 4F 71 45 44 4D 50 0A|"; depth:20; reference:md5,02e447b347a90680e03c8b7d843a8e46; reference:url,www.antivirus365.org/PCAntivirus/37128.html; classtype:command-and-control; sid:2012894; rev:4; metadata:created_at 2011_05_31, former_category MALWARE, updated_at 2011_05_31;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Fake Virus Phone Scam Landing Nov 16"; flow:established,to_server; content:"GET"; http_method; content:".html?os="; http_uri; fast_pattern; content:"&clickid=w"; distance:0; http_uri; pcre:"/&clickid=w[A-Z0-9]{23}$/U"; classtype:social-engineering; sid:2022103; rev:3; metadata:created_at 2015_11_17, former_category WEB_CLIENT, updated_at 2015_11_17;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Bifrose Client Checkin"; flow:established,to_server; content:"|00 00 99 4F B9 74 E2 75 94 0A 5A|"; offset:2; depth:11; classtype:command-and-control; sid:2013338; rev:2; metadata:created_at 2011_08_02, former_category MALWARE, updated_at 2011_08_02;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing Nov 20"; flow:established,from_server; file_data; content:"<title>VIRUS WARNING"; fast_pattern; nocase; content:"onload=|22|myFunction()|22|"; nocase; content:"YOUR COMPUTER HAS BEEN BLOCKED"; nocase; content:"CALL IMMEDIATLY"; nocase; content:"|5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e 5c 6e|"; nocase; classtype:social-engineering; sid:2022125; rev:3; metadata:created_at 2015_11_21, former_category WEB_CLIENT, updated_at 2015_11_21;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FakeAV/Application JPDesk/Delf checkin"; flow:established,to_server; content:"|2f 3f|data="; http_uri; nocase; content:"jpdesk.com|0d 0a|"; nocase; http_header; pcre:"/\x2f\x3fdata\x3d[a-fA-F0-9]{60}/U"; reference:md5,08f116cf4feff245dca581244e4f509c; classtype:command-and-control; sid:2013340; rev:2; metadata:created_at 2011_08_02, former_category MALWARE, updated_at 2011_08_02;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Tech Support Phone Scam Landing Dec 30 M1"; flow:to_client,established; file_data; content:"/windowslogo.jpg"; fast_pattern; nocase; content:"/winborder.html"; nocase; distance:0; content:"bug1.html"; nocase; distance:0; content:"infected your system"; nocase; distance:0; content:"TCP connection already exists"; nocase; distance:0; content:"TOLL FREE"; nocase; distance:0; classtype:social-engineering; sid:2022319; rev:3; metadata:created_at 2015_12_30, former_category WEB_CLIENT, updated_at 2015_12_30;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FakeAV Checkin"; flow:established,to_server; content:"/ping.php?v="; http_uri; content:"&cid="; http_uri; content:"&s="; http_uri; content:"&wid="; http_uri; content:"&fid="; http_uri; content:"&step="; http_uri; classtype:command-and-control; sid:2013366; rev:2; metadata:created_at 2011_08_05, former_category MALWARE, updated_at 2011_08_05;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Tech Support Phone Scam Landing Dec 30 M2"; flow:to_client,established; file_data; content:"/sound.mp3"; fast_pattern; nocase; content:"function goodbye"; nocase; distance:0; content:"DetectMobile()"; nocase; distance:0; content:"stopPropagation"; nocase; distance:0; content:"preventDefault"; nocase; distance:0; classtype:social-engineering; sid:2022320; rev:3; metadata:created_at 2015_12_30, former_category WEB_CLIENT, updated_at 2015_12_30;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Alunik User Agent Detected"; flow:established,to_server; content:"User-Agent|3A| Alun4ik"; http_header; classtype:trojan-activity; sid:2013377; rev:2; metadata:created_at 2011_08_05, updated_at 2011_08_05;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Chrome Tech Support Scam Landing Jan 26 2016"; flow:to_client,established; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"function pop"; fast_pattern; nocase; content:"function progressUpdate"; nocase; content:"Operating System"; nocase; content:"Browser"; nocase; content:"Internet Provider"; nocase; content:"Location"; nocase; content:"Scan progress"; nocase; classtype:social-engineering; sid:2022410; rev:3; metadata:created_at 2016_01_27, former_category WEB_CLIENT, updated_at 2016_01_27;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Fakealert.Rena CnC Checkin 1"; flow:established,to_server; content:"/images/thanks_25.php?id="; fast_pattern:only; content:"HTTP/1.1|0d 0a|User-Agent"; content:"|20|HTTP/1.1|0d 0a|User-Agent|3a 20|Mozilla/4.0|20|(compatible|3b 20|MSIE|20|"; content:"|3b 20|Windows|20|NT|20|"; distance:0; content:")|0d 0a|Host|3a 20|"; distance:0; content:"Cache-Control|3a 20|no-cache|0d 0a 0d 0a|"; distance:0; content:!"|0d 0a|Accept"; classtype:command-and-control; sid:2013383; rev:3; metadata:created_at 2011_08_09, former_category MALWARE, updated_at 2011_08_09;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Hard Drive Delete Scam Landing Feb 16 M4"; flow:to_client,established; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"function main_alert"; nocase; fast_pattern; content:"WARNING"; nocase; distance:0; content:"Your hard drive will be DELETED"; nocase; distance:0; content:"To Stop This Process"; nocase; distance:0; classtype:social-engineering; sid:2022528; rev:3; metadata:created_at 2016_02_16, former_category WEB_CLIENT, updated_at 2016_02_16;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Accept-encode HTTP header with UA indicating infected host"; flow:established,to_server; content:"Accept-encode|3a| "; fast_pattern; http_header; content:"Accept-Encoding|3a| "; http_header; threshold:type limit, count 1, seconds 360, track by_src; classtype:trojan-activity; sid:2013385; rev:3; metadata:created_at 2011_08_09, updated_at 2011_08_09;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Virus Phone Scam Landing Feb 17"; flow:to_client,established; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"keyframes poplzatvci"; fast_pattern; content:"#lzatvciovlwmiiqxbwxywuerkhtunrlvherk"; nocase; distance:0; classtype:social-engineering; sid:2022530; rev:3; metadata:created_at 2016_02_17, former_category WEB_CLIENT, updated_at 2016_02_17;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User Agent 3653Client"; flow:established,to_server; content:"User-Agent|3A 20|3653Client"; http_header; classtype:trojan-activity; sid:2013390; rev:2; metadata:created_at 2011_08_10, updated_at 2011_08_10;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Microsoft Fake Support Phone Scam Mar 7"; flow:from_server,established; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"<title>Microsoft"; nocase; content:"function myFunction()"; pcre:"/^\s*?\{\s*?setInterval\s*?\(\s*?function/Rsi"; content:"alert2.mp3"; fast_pattern; nocase; distance:0; classtype:social-engineering; sid:2022602; rev:3; metadata:created_at 2016_03_07, former_category WEB_CLIENT, updated_at 2016_03_07;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User Agent ksdl_1_0"; flow:established,to_server; content:"User-Agent|3A 20|ksdl_"; http_header; classtype:trojan-activity; sid:2013404; rev:2; metadata:created_at 2011_08_11, updated_at 2011_08_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Generic Fake Support Phone Scam Mar 8"; flow:established,from_server; file_data; content:"onload=|22|myFunction|28 29 3b 22|"; fast_pattern; nocase; content:"onclick=|22|myFunction|28 29 3b 22|"; nocase; content:"onkeydown=|22|myFunction|28 29 3b 22|"; nocase; content:"onunload=|22|myFunction|28 29 3b 22|"; nocase; content:"<audio"; nocase; pcre:"/^[^\r\n]+autoplay=[\x22\x27]autoplay/Rsi"; content:"TOLL FREE"; nocase; classtype:social-engineering; sid:2022603; rev:3; metadata:created_at 2016_03_09, former_category WEB_CLIENT, updated_at 2016_03_09;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET !1433 (msg:"ET MALWARE Bancos.DV MSSQL CnC Connection Outbound"; flow:to_server,established; flowbits:isset,ET.MSSQL; content:"|49 00 B4 00 4D 00 20 00 54 00 48 00 45 00 20 00 4D 00 41 00 53 00 54 00 45 00 52 00|"; classtype:command-and-control; sid:2013411; rev:1; metadata:created_at 2011_08_16, former_category MALWARE, malware_family Bancos, tag Banking_Trojan, updated_at 2018_04_23;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Generic Fake Support Phone Scam Mar 9 M1"; flow:established,from_server; file_data; content:"Callpixels"; fast_pattern; nocase; pcre:"/^\s*?\.\s*?Campaign\s*?\(\s*?\{\s*?campaign_key/Rsi"; content:"<audio"; nocase; pcre:"/^[^\r\n]+autoplay=[\x22\x27]autoplay/Rsi"; content:"TOLL FREE"; nocase; classtype:social-engineering; sid:2022605; rev:3; metadata:created_at 2016_03_09, former_category WEB_CLIENT, updated_at 2016_03_09;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Trojan.Vaklik.kku Checkin Response"; flow:from_server,established; flowbits:isset,et.trojan.valkik.kku; content:"Content-Length|3a 20|88|0d 0a|"; nocase; content:"|0d 0a 0d 0a|"; distance:0; content:"|48 00 00 00|"; distance:4; within:4; flowbits:unset,et.trojan.valkik.kku; reference:md5,9688d1d37a7ced200c53ec2b9332a0ad; reference:md5,81d8a235cb5f7345b5796483abe8145f; classtype:command-and-control; sid:2012961; rev:3; metadata:created_at 2011_06_09, former_category MALWARE, updated_at 2011_06_09;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Generic Fake Support Phone Scam Mar 9 M2"; flow:established,from_server; file_data; content:"//Flag we have not"; fast_pattern; nocase; content:"//The location of the page that we will load on a second pop"; nocase; distance:0; content:"//figure out what to use for default number"; nocase; distance:0; content:"//allow for the traffic source to send in their own default number"; nocase; distance:0; content:"//if no unformatted number just use it"; nocase; distance:0; classtype:social-engineering; sid:2022606; rev:3; metadata:created_at 2016_03_09, former_category WEB_CLIENT, updated_at 2016_03_09;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/TrojanDownloader.Chekafe.D Initial Checkin"; flow:established,to_server; content:"/count.php?id="; http_uri; content:"&isInst="; http_uri; content:"&lockcode="; http_uri; content:"&pc="; http_uri; content:"&PcType="; http_uri; content:"&AvName="; http_uri; content:"&ProCount="; http_uri; classtype:command-and-control; sid:2013447; rev:3; metadata:created_at 2011_08_22, former_category MALWARE, updated_at 2011_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Generic Fake Support Phone Scam Mar 9 M3"; flow:established,from_server; file_data; content:"<title>ALERT"; fast_pattern; content:"makeNewPosition"; nocase; distance:0; content:"animateDiv"; nocase; distance:0; content:"div.fakeCursor"; nocase; distance:0; content:"<audio autoplay"; nocase; distance:0; classtype:social-engineering; sid:2022607; rev:3; metadata:created_at 2016_03_09, former_category WEB_CLIENT, updated_at 2016_03_09;)
+#alert tcp $EXTERNAL_NET 6000:10000 -> $HOME_NET any (msg:"ET MALWARE Vobfus/Changeup/Chinky Download Command"; flow:to_client,established; content:"|3a 2e|dl http|3a|"; depth:11; reference:url,www.symantec.com/connect/blogs/w32changeup-threat-profile; reference:url,doc.emergingthreats.net/2010973; reference:url,www.sunbeltsecurity.com/partnerresources/cwsandbox/md5.aspx?id=beb8bc1ba5dbd8de0761ef362bc8b0a4; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fVobfus; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2009-081806-2906-99&tabid=2; reference:md5,f8880b851ea5ed92dd97657574fb4f70; classtype:trojan-activity; sid:2010973; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing Mar 15"; flow:established,to_client; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"<title>Security"; fast_pattern; nocase; content:"function DetectMobile"; nocase; distance:0; content:"function myFunction"; nocase; distance:0; content:"Please call"; nocase; distance:0; classtype:social-engineering; sid:2022619; rev:3; metadata:created_at 2016_03_16, former_category WEB_CLIENT, updated_at 2016_03_16;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Phoenix Landing Page Obfuscated Javascript 2"; flow:established,to_client; content:"<html><body><input|20|type|3d 27|hidden|27 20|value|3d 27|"; pcre:"/\S{20,40}\'\>/R"; classtype:trojan-activity; sid:2013314; rev:5; metadata:created_at 2011_07_26, updated_at 2011_07_26;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Mar 23"; flow:established,to_client; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"<title>Microsoft"; fast_pattern; nocase; content:"function myFunction"; nocase; distance:0; content:"setInterval"; nocase; distance:0; pcre:"/^\s*?\(\s*?function\s*?\(\s*?\)\s*?\{\s*?alert\s*?\(/Rsi"; content:"<audio"; nocase; distance:0; classtype:social-engineering; sid:2022649; rev:3; metadata:created_at 2016_03_23, former_category WEB_CLIENT, updated_at 2016_03_23;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Best Pack Exploit Pack Binary Load Request"; flow:established,to_server; content:".php?e="; http_uri; content:"&o="; http_uri; content:"&b="; http_uri; content:"&id="; http_uri; pcre:"/\.php\?e=\d+&o=\w+&b=\w+&id=[0-9a-f]{32}$/U"; reference:url,www.kahusecurity.com/2011/best-pack/; classtype:bad-unknown; sid:2013489; rev:3; metadata:created_at 2011_08_30, updated_at 2011_08_30;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Flash Update Mar 23"; flow:established,to_client; file_data; content:"<title>Flash"; nocase; fast_pattern; content:"#prozor"; nocase; distance:0; content:"#dugme"; nocase; distance:0; content:"Latest version of Adobe"; nocase; distance:0; classtype:trojan-activity; sid:2022651; rev:3; metadata:created_at 2016_03_24, former_category CURRENT_EVENTS, updated_at 2016_03_24;)
+alert tcp $HOME_NET any -> 11.11.11.11 55611 (msg:"ET MALWARE W32/Badlib Connectivity Check To Department of Defense Intelligence Information Systems"; flow:to_server; flags:S; reference:url,blog.eset.com/2011/08/03/win32delf-qcztrust-me-i%E2%80%99m-your-anti-virus; reference:url,www.eset.com/about/blog/blog/article/win32delf-qcz-additional-details; classtype:trojan-activity; sid:2013506; rev:1; metadata:created_at 2011_08_31, updated_at 2011_08_31;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing Apr 1"; flow:established,to_client; file_data; content:"<title>SYSTEM ERROR WARNING"; fast_pattern; nocase; content:"function loadNumber"; nocase; distance:0; content:"campaign_key:"; nocase; distance:0; classtype:social-engineering; sid:2022695; rev:3; metadata:created_at 2016_04_01, former_category WEB_CLIENT, updated_at 2016_04_01;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Bancos Reporting"; flow:established,to_server; content:".php?codigo="; http_uri; content:"&g_id="; http_uri; content:"&g_windows="; http_uri; content:"&func_versao_ie="; http_uri; content:"&firefox="; http_uri; content:"&primeira_versao_update="; http_uri; content:"&ultimo_acesso="; http_uri; classtype:trojan-activity; sid:2013513; rev:2; metadata:created_at 2011_08_31, former_category TROJAN, malware_family Bancos, tag Banking_Trojan, updated_at 2018_04_23;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Microsoft Fake Support Phone Scam May 10"; flow:from_server,established; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"<title>Error Hard Drive Safety"; nocase; content:"myFunction()"; content:"Warning|3a| Internet Security Damaged"; content:"err.mp3"; fast_pattern; nocase; distance:0; classtype:social-engineering; sid:2022802; rev:3; metadata:created_at 2016_05_11, former_category WEB_CLIENT, updated_at 2016_05_11;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Driveby Loader Request sn.php"; flow:established,to_server; content:"/sn.php?c="; http_uri; depth:10; content:"&t="; http_uri; pcre:"/c\x3d[0-9a-f]{100}/Ui"; classtype:trojan-activity; sid:2013519; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_09_02, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Tech Support Phone Scam Landing M3 Jun 3"; flow:from_server,established; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"<title>Chrome Error"; fast_pattern; nocase; content:"function myFunction"; nocase; distance:0; content:"setInterval"; nocase; distance:0; pcre:"/^\s*\(\s*function\s*\(\s*\)\s*\{\s*alert\s*\([\x22\x27]\s*Warning/Rsi"; classtype:social-engineering; sid:2022855; rev:3; metadata:created_at 2016_06_03, former_category WEB_CLIENT, updated_at 2016_06_03;)
+#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET 1024: (msg:"ET MALWARE Backdoor.Win32.Fynloski.A Command Request"; flow:to_server,established; content:"#BOT#"; depth:5; pcre:"/^\x23BOT\x23(VisitUrl|OpenUrl|Ping|RunPrompt|CloseServer|SvrUninstall|URLUpate|URLDownload)/i"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3aWin32%2fFynloski.A&ThreatID=-2147327112; reference:url,home.mcafee.com/virusinfo/virusprofile.aspx?key=570863; classtype:trojan-activity; sid:2013532; rev:2; metadata:created_at 2011_09_03, updated_at 2011_09_03;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Tech Support Phone Scam Landing M1 Jun 3"; flow:from_server,established; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"script to pull the number yet"; nocase; content:"// alert the visitor"; fast_pattern; nocase; distance:0; content:"// repeat alert, whatever you want them to see"; nocase; distance:0; content:"// end function goodbye"; nocase; distance:0; classtype:social-engineering; sid:2022856; rev:3; metadata:created_at 2016_06_03, former_category WEB_CLIENT, updated_at 2016_06_03;)
+#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor.Win32.Fynloski.A Command Response"; flow:to_server,established; content:"#botCommand%"; depth:12; pcre:"/^\x23botCommand\x25(close\x20command|Error|Finish|Http\x20Flood|Mass\x20Download|Respond\x20\x5bOK|Syn\x20Flood|UDP\x20Flood|uninstall|Update|)/i"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3aWin32%2fFynloski.A&ThreatID=-2147327112; reference:url,home.mcafee.com/virusinfo/virusprofile.aspx?key=570863; classtype:trojan-activity; sid:2013533; rev:2; metadata:created_at 2011_09_03, updated_at 2011_09_03;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Tech Support Phone Scam Landing M2 Jun 3"; flow:from_server,established; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"function countdown"; nocase; content:"function loadNumber"; nocase; distance:0; content:"function main_alert"; nocase; distance:0; fast_pattern; content:"function repeat_alert"; nocase; distance:0; content:"function goodbye"; nocase; distance:0; classtype:social-engineering; sid:2022857; rev:3; metadata:created_at 2016_06_03, former_category WEB_CLIENT, updated_at 2016_06_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TROJ_VB.FJP Generic Dowbnloader Connectivity Check to Google"; flow:established,to_server; content:"/whatever.exe"; fast_pattern; http_uri; content:"Host|3A 20|google.com|0d 0a|"; http_header; classtype:trojan-activity; sid:2013544; rev:2; metadata:created_at 2011_09_06, updated_at 2011_09_06;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Tech Support Phone Scam Landing Jun 29 M2"; flow:from_server,established; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"<title>errorx508"; fast_pattern; nocase; content:"Warning_0001"; nocase; distance:0; classtype:social-engineering; sid:2022926; rev:3; metadata:created_at 2016_06_29, former_category WEB_CLIENT, updated_at 2016_06_29;)
+#alert udp $HOME_NET any -> $EXTERNAL_NET 54 (msg:"ET MALWARE Win32.Unknown.UDP.edsm CnC traffic"; content:"|65 f2 9c 64 cf 0a 5e d3 f6 5b 2a 9f 73 3c 91 4d|"; offset:16; depth:16; threshold:type limit, track by_src, count 1, seconds 600; reference:url,xml.ssdsandbox.net/view/11c0df38d31121885a76500140780cef; classtype:command-and-control; sid:2013547; rev:2; metadata:created_at 2011_09_07, former_category MALWARE, updated_at 2011_09_07;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Tech Support Phone Scam Landing Jun 29 M4"; flow:from_server,established; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"<title>Mozila Error"; fast_pattern; nocase; content:"Warning|3a 20|Internet Security"; nocase; distance:0; classtype:social-engineering; sid:2022928; rev:3; metadata:created_at 2016_06_29, former_category WEB_CLIENT, updated_at 2016_06_29;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Fivfrom Downloader (Unitrix)"; flow:established,to_server; content:".php?seller="; http_uri; content:"&hash={"; http_uri; pcre:"/hash=\{[a-f0-9]+-/Ui"; classtype:trojan-activity; sid:2013555; rev:5; metadata:created_at 2011_09_10, updated_at 2011_09_10;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing Feb 2"; flow:from_server,established; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"<title> Microsoft Official Support <"; fast_pattern; nocase; content:"var stroka"; nocase; distance:0; content:"wM/8AAEQgADQCgAwEiAAIRAQMRAf/dAAQACv/EAT8AAAEFAQEBAQEBAAAAAAAAAAMAAQIE"; distance:0; classtype:social-engineering; sid:2023869; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_02_03, deployment Perimeter, former_category WEB_CLIENT, performance_impact Low, signature_severity Major, updated_at 2017_02_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potentially Unwanted Program Storm3-607.exe Download Reporting"; flow:established,to_server; content:"GET"; http_method; content:"/Storm3-607.exe"; nocase; http_uri; content:"User-Agent|3a| InnoTools_Downloader"; http_header; classtype:trojan-activity; sid:2013560; rev:3; metadata:created_at 2011_09_12, updated_at 2011_09_12;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Lets Encrypt Free SSL Cert Observed in Tech Support Scams M1"; flow:established,from_server; content:"|55 04 0a|"; content:"|0d|Let|27|s Encrypt"; distance:1; within:14; content:"|55 04 03|"; distance:0; content:"|12|wide.singldays.top"; distance:1; within:19; fast_pattern; reference:url,blog.sucuri.net/2017/02/javascript-injections-leads-to-tech-support-scam.html; reference:url,letsencrypt.org/about/; classtype:social-engineering; sid:2024124; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_03_31, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, updated_at 2017_03_31;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Downbot/Shady Rat Remote Shell Connection"; flow:established,from_server; dsize:<90; content:"|2F 2A 0A 40 2A 2A 2A 40 2A 40 40 40 40 40 40 40 40 40 40 40|"; depth:20; flowbits:set,et.shadyratinit; reference:url,www.symantec.com/connect/blogs/truth-behind-shady-rat; classtype:trojan-activity; sid:2013379; rev:3; metadata:created_at 2011_08_09, updated_at 2011_08_09;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Lets Encrypt Free SSL Cert Observed in Tech Support Scams M4"; flow:established,from_server; content:"|55 04 0a|"; content:"|0d|Let|27|s Encrypt"; distance:1; within:14; content:"|55 04 03|"; distance:0; content:"|13|web.machinerysc.top"; distance:1; within:20; fast_pattern; reference:url,blog.sucuri.net/2017/02/javascript-injections-leads-to-tech-support-scam.html; reference:url,letsencrypt.org/about/; classtype:social-engineering; sid:2024127; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_03_31, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, updated_at 2017_03_31;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Unknown Exploit Pack Binary Load Request (server_privileges.php)"; flow:established,to_server; content:"/server_privileges.php?"; http_uri; pcre:"/\/server_privileges\.php\?[0-9a-f]{32}=\d+(&\w+)?$/U"; classtype:trojan-activity; sid:2013663; rev:2; metadata:created_at 2011_09_19, updated_at 2011_09_19;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Lets Encrypt Free SSL Cert Observed in Tech Support Scams M5"; flow:established,from_server; content:"|55 04 0a|"; content:"|0d|Let|27|s Encrypt"; distance:1; within:14; content:"|55 04 03|"; distance:0; content:"|12|sub.contentedy.top"; distance:1; within:19; fast_pattern; reference:url,blog.sucuri.net/2017/02/javascript-injections-leads-to-tech-support-scam.html; reference:url,letsencrypt.org/about/; classtype:social-engineering; sid:2024128; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_03_31, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, updated_at 2017_03_31;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Riberow.A (touch)"; flow:to_server,established; content:"/touch.php?dir="; http_uri; content:" HTTP/1.1|0d 0a|Host|3a| "; content:"|0d 0a|Pragma|3a| no-cache|0d 0a|Accept|3a| */*|0d 0a 0d 0a|"; within:70; content:!"User-Agent|3a|"; http_header; reference:md5,c55fe941b80b3e5e77be8728642d138e; classtype:trojan-activity; sid:2013671; rev:2; metadata:created_at 2011_09_19, former_category MALWARE, updated_at 2011_09_19;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Multibrowser Resource Exhaustion observed in Tech Support Scam"; flow:from_server,established; file_data; content:"var|20|total|20|=|20 22 22 3b|"; nocase; content:"total|20|=|20|total"; nocase; distance:0; content:"history.pushState"; nocase; fast_pattern; distance:0; pcre:"/^\s*\(\s*0\s*,\s*0\s*,\s*total\s*\)/Ri"; reference:url,bugzilla.mozilla.org/show_bug.cgi?id=1246773; classtype:social-engineering; sid:2024305; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_05_16, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, updated_at 2017_05_16;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ZeroAccess/Max++ Rootkit C&C Activity 2"; flow:established,to_server; content:".php?w="; http_uri; content:"&fail="; http_uri; content:"&i="; http_uri; pcre:"/\.php\?w=\d+&fail=\d+&i=[0-9a-f]{32}$/U"; reference:url,resources.infosecinstitute.com/step-by-step-tutorial-on-reverse-engineering-malware-the-zeroaccessmaxsmiscer-crimeware-rootkit/; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2011-071314-0410-99&tabid=2; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDropper%3aWin32%2fSirefef.B; classtype:command-and-control; sid:2013686; rev:2; metadata:created_at 2011_09_22, former_category MALWARE, updated_at 2011_09_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Adobe Flash Update Landing - Title over non SSL"; flow:established,to_client; file_data; content:"<title>Adobe - Update Adobe Flash Player"; nocase; classtype:bad-unknown; sid:2024643; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_08_31, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, updated_at 2017_08_31;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Shylock Module Server Response"; flow:established,from_server; content:"|0d 0a 0d 0a 23 23 23|ERROR_SRC|23 23 23|"; content:"|23 23 23|ERROR_SRC_END|23 23 23|"; distance:0; reference:md5,4fda5e7e8e682870e993f97ad26ba6b2; classtype:trojan-activity; sid:2013688; rev:2; metadata:created_at 2011_09_22, former_category MALWARE, updated_at 2011_09_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Adobe Flash Update Landing - Title over non SSL"; flow:established,to_client; file_data; content:"Flash Player Update"; nocase; classtype:bad-unknown; sid:2024644; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_08_31, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, updated_at 2017_08_31;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 3306 (msg:"ET MALWARE Win32.Parite Checkin SQL Database"; flow:established,to_server; content:"SHOW COLUMNS FROM webronaldogyn01"; reference:md5,19441bc629e6c1dcb54cb5febdf9a22d; classtype:command-and-control; sid:2013683; rev:2; metadata:attack_target Client_Endpoint, created_at 2011_09_22, deployment Perimeter, former_category MALWARE, malware_family Parite, signature_severity Major, updated_at 2017_07_17;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Adobe Flash Update Landing - Title over non SSL"; flow:established,to_client; file_data; content:"Adobe Flash Player"; nocase; classtype:bad-unknown; sid:2024645; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_08_31, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, updated_at 2017_08_31;)
+#alert http $HOME_NET any ->  $EXTERNAL_NET any (msg:"ET MALWARE Win32.Swisyn Reporting"; flow:to_server,established; content:"/Qvodav.exe"; nocase; http_uri; content:"User-Agent|3a| Av_DVD"; nocase; http_header; reference:url,precisesecurity.com/worms/trojan-win32-swisyn-algm; classtype:trojan-activity; sid:2013766; rev:5; metadata:created_at 2011_10_11, updated_at 2011_10_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Adobe Flash Update Landing - Title over non SSL"; flow:established,to_client; file_data; content:"Flash Player|20 7c 20|Free Download"; nocase; classtype:bad-unknown; sid:2024646; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_08_31, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, updated_at 2017_08_31;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET MALWARE Possible German Governmental Backdoor/R2D2.A 2"; flow:from_client,established; content:"C3PO-r2d2-POE"; depth:13; reference:url,ccc.de/en/updates/2011/staatstrojaner; classtype:trojan-activity; sid:2013752; rev:3; metadata:created_at 2011_10_11, updated_at 2011_10_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Adobe Flash Update Landing - Title over non SSL"; flow:established,to_client; file_data; content:"Adobe Flash Player Update"; nocase; classtype:bad-unknown; sid:2024647; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_08_31, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, updated_at 2017_08_31;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET MALWARE Possible German Governmental Backdoor/R2D2.A 1"; flow:from_client,established; content:"|11 26 80 7c ff ff ff ff 00 26 80 7c 42 25 80 7c|"; fast_pattern; reference:url,ccc.de/en/updates/2011/staatstrojaner; classtype:trojan-activity; sid:2013751; rev:3; metadata:created_at 2011_10_11, updated_at 2011_10_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Adobe Flash Update Landing - Title over non SSL"; flow:established,to_client; file_data; content:"Flash Player is outdated"; nocase; classtype:bad-unknown; sid:2024648; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_08_31, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, updated_at 2017_08_31;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.Win32.Prosti Checkin"; flow:from_client,established; content:"&first& # 0d 0h "; depth:16; reference:md5,5113c6dbd644874482f3a26650970600; classtype:command-and-control; sid:2013769; rev:1; metadata:created_at 2011_10_12, former_category MALWARE, updated_at 2011_10_12;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Adobe Flash Update Landing - Title over non SSL"; flow:established,to_client; file_data; content:"flash player might be outdated"; nocase; classtype:bad-unknown; sid:2024649; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_08_31, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, updated_at 2017_08_31;)
+#alert ip 207.158.22.134 any -> $HOME_NET any (msg:"ET MALWARE Bundestrojaner (W32/R2D2 BTrojan) Inbound SRV-1"; threshold:type limit, track by_src,count 1, seconds 60; reference:url,www.ccc.de/de/updates/2011/staatstrojaner; reference:url,www.ccc.de/system/uploads/76/original/staatstrojaner-report23.pdf; reference:url,www.f-secure.com/weblog/archives/00002249.html; reference:url,www.heise.de/newsticker/meldung/CCC-knackt-Staatstrojaner-1357670.html; reference:url,www.virustotal.com/gui/file/be36ce1e79ba6f97038a6f9198057abecf84b38f0ebb7aaa897fd5cf385d702f; reference:url,www.ccc.de/en/updates/2011/staatstrojaner; classtype:trojan-activity; sid:2013755; rev:4; metadata:created_at 2011_10_11, former_category MALWARE, updated_at 2011_10_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Microsoft Tech Support Scam Landing M1 Oct 13 2017"; flow:established,to_client; file_data; content:"Windows Defender"; nocase; fast_pattern; content:"background-color|3a 20|#659e1d"; nocase; distance:0; classtype:social-engineering; sid:2024841; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_10_13, deployment Perimeter, former_category WEB_CLIENT, signature_severity Minor, tag Tech_Support_Scam, updated_at 2017_10_13;)
+#alert ip $HOME_NET any -> 207.158.22.134 any (msg:"ET MALWARE Bundestrojaner (W32/R2D2 BTrojan) Outbound SRV-1"; threshold:type limit, track by_dst, count 1, seconds 60; reference:url,www.ccc.de/de/updates/2011/staatstrojaner; reference:url,www.ccc.de/system/uploads/76/original/staatstrojaner-report23.pdf; reference:url,www.f-secure.com/weblog/archives/00002249.html; reference:url,www.heise.de/newsticker/meldung/CCC-knackt-Staatstrojaner-1357670.html; reference:url,www.virustotal.com/file-scan/report.html?id=be36ce1e79ba6f97038a6f9198057abecf84b38f0ebb7aaa897fd5cf385d702f-1318152545; reference:url,www.ccc.de/en/updates/2011/staatstrojaner; classtype:trojan-activity; sid:2013756; rev:4; metadata:created_at 2011_10_11, updated_at 2011_10_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Tech Support Phone Scam Landing 2018-01-10"; flow:from_server,established; file_data; content:"Security Warning"; nocase; fast_pattern; content:"background-color:#d70000"; nocase; distance:0; classtype:social-engineering; sid:2025197; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_01_10, deployment Perimeter, former_category WEB_CLIENT, signature_severity Minor, tag Tech_Support_Scam, updated_at 2018_01_10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32.Cerberus RAT Server ping"; flow:from_server,established; content:"wBmpf3Pb7RJe|0d0a|"; depth:14; dsize:14; reference:md5,76e084e9420bfaa31c0f0bf000f1c301; classtype:trojan-activity; sid:2013774; rev:2; metadata:created_at 2011_10_14, updated_at 2011_10_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing Feb 12"; flow:from_server,established; file_data; content:"|57 69 6e 64 6f 77 73 20 44 65 66 65 6e 64 65 72 20 41 6c 65 72 74 20 3a 20 5a 65 75 73 20 56 69 72 75 73 20 44 65 74 65 63 74 65 64 20 49 6e 20 59 6f 75 72 20 43 6f 6d 70 75 74 65 72 20 21 21 3c 2f 68 31 3e|"; fast_pattern; nocase; content:"|3e 50 6c 65 61 73 65 20 44 6f 20 4e 6f 74 20 53 68 75 74 20 44 6f 77 6e 20 6f 72 20 52 65 73 65 74 20 59 6f 75 72 20 43 6f 6d 70 75 74 65 72 2e 3c 2f 68 33 3e|"; nocase; distance:0; classtype:social-engineering; sid:2025345; rev:3; metadata:created_at 2018_02_12, former_category WEB_CLIENT, updated_at 2018_02_12;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Cerberus RAT Checkin Outbound"; flow:established,to_server; content:"Ypmw1Syv023QZD"; depth:30; reference:md5,76e084e9420bfaa31c0f0bf000f1c301; classtype:command-and-control; sid:2013771; rev:4; metadata:created_at 2011_10_14, former_category MALWARE, updated_at 2011_10_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Tech Support Phone Scam Landing 2017-07-26"; flow:from_server,established; file_data; content:"Microsoft Windows Notification"; nocase; fast_pattern; content:"<audio autoplay=autoplay loop id=audio>"; nocase; distance:0; content:".mp3 type=audio/mpeg"; nocase; distance:0; classtype:social-engineering; sid:2025908; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_07_26, deployment Perimeter, former_category WEB_CLIENT, signature_severity Minor, tag Tech_Support_Scam, updated_at 2018_07_26;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32.Cerberus RAT Checkin Response"; flow:established,to_client; content:"Ypmw1Syv023QZD"; depth:30; reference:md5,76e084e9420bfaa31c0f0bf000f1c301; classtype:command-and-control; sid:2013772; rev:2; metadata:created_at 2011_10_14, former_category MALWARE, updated_at 2011_10_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Tech Support Phone Scam Landing 2017-07-26"; flow:from_server,established; file_data; content:"href=|22|./files/alert.css"; nocase; content:"<audio autoplay=|22|autoplay|22 20|loop=|22|"; nocase; fast_pattern; distance:0; content:".mp3|22 20|type=|22|audio/mpeg"; nocase; distance:0; content:"Internet Security Alert"; nocase; distance:0; classtype:social-engineering; sid:2025909; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_07_26, deployment Perimeter, former_category WEB_CLIENT, signature_severity Minor, tag Tech_Support_Scam, updated_at 2018_07_26;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Cerberus RAT Client pong"; flow:from_client,established; content:"wZ2pla"; depth:6; reference:md5,76e084e9420bfaa31c0f0bf000f1c301; classtype:trojan-activity; sid:2013773; rev:2; metadata:created_at 2011_10_14, updated_at 2011_10_14;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Tech Support Phone Scam Landing 2017-07-26"; flow:from_server,established; file_data; content:"<title>Windows Defender"; nocase; fast_pattern; content:"<audio id=|22|play|22 20|loop="; nocase; distance:0; content:".mp3|22 20|type=|22|audio/mpeg"; nocase; distance:0; content:"Windows Defender Alert"; nocase; distance:0; classtype:social-engineering; sid:2025910; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_07_26, deployment Perimeter, former_category WEB_CLIENT, signature_severity Minor, tag Tech_Support_Scam, updated_at 2018_07_26;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE nte Binary Download Attempt (multiple malware variants served)"; flow:established,to_server; content:"GET"; http_method; content:"/nte/"; http_uri; content:!"Referer|3a| "; http_header; content:"User-Agent|3a| Java"; http_header; pcre:"/(\.php|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$/Ui"; reference:url,www.malwaredomainlist.com; reference:url,www.malwareurl.com/search.php?domain=&s=trest1&match=0&rp=200&urls=on&redirs=on&ip=on&reverse=on&as=on; classtype:trojan-activity; sid:2011576; rev:4; metadata:created_at 2010_09_27, updated_at 2010_09_27;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Microsoft Tech Support Phone Scam Landing 2018-09-12"; flow:established,to_client; file_data; content:"<title>Microsoft Official Support"; nocase; fast_pattern; content:"<strong>VIRUS ALERT FROM MICROSOFT"; nocase; distance:0; content:"<audio autoplay=|22|autoplay|22|"; nocase; distance:0; classtype:social-engineering; sid:2026111; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_09_12, deployment Perimeter, former_category WEB_CLIENT, signature_severity Minor, tag Tech_Support_Scam, updated_at 2018_09_12;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE BOT - potential DDoS command (2)"; flowbits:isset,is_proto_irc; flow:established,from_server; content:"ddos"; nocase; pcre:"/ddos\.(phat(icmp|syn|wonk)|stop|(syn|udp|http)flood|targa3|(syn|ack|random) ([0-9]{1,3}\.){3}[0-9]{1,3})/i"; reference:url,doc.emergingthreats.net/2003132; classtype:trojan-activity; sid:2003132; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert udp $HOME_NET any -> $EXTERNAL_NET 8000 (msg:"ET MALWARE Win32/Dostre CnC Activity"; content:"|af 7d a7 38 eb f9 f7 47|"; depth:8; fast_pattern; content:"|00|"; distance:4; within:1; content:"|10 00|"; distance:1; within:2; threshold: type limit, track by_src, count 1, seconds 60; reference:url,www.fortinet.com/blog/threat-research/chinese-targeted-trojan-analysis.html; classtype:command-and-control; sid:2027892; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_08_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2019_08_19;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE IRC Potential DDoS command 1"; flowbits:isset,is_proto_irc; flow:established,to_client; content:"floodnet "; pcre:"/floodnet ([0-9]{1,3}\.){3}[0-9]{1,3}|(tcp|syn|udp|ack|ping|icmp)(flood)? ([0-9]{1,3}\.){3}[0-9]{1,3}/i"; reference:url,doc.emergingthreats.net/2002032; classtype:trojan-activity; sid:2002032; rev:22; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $HOME_NET any -> 76.74.9.18 $HTTP_PORTS (msg:"ET DELETED Milw0rm Exploit Launch Attempt"; flow:to_server,established; content:"GET "; depth:4; content:"/exploit.php?id="; http_uri; nocase; reference:url,www.milw0rm.com; reference:url,doc.emergingthreats.net/2009586; classtype:misc-activity; sid:2009586; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE IRC Potential bot update/download via http command"; flowbits:isset,is_proto_irc; flow:established,to_client; content:" http|3a|//"; fast_pattern:only; pcre:"/\.(upda|getfile|dl\dx|dl|download|execute)\w*\s+http\x3a\x2f\x2f/i"; reference:url,doc.emergingthreats.net/2002031; classtype:trojan-activity; sid:2002031; rev:19; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET EXPLOIT TAC Attack Directory Traversal"; flow:established,to_server; content:"/ISALogin.dll?"; http_uri; nocase; pcre:"/Template=.*\.\./UGi"; reference:cve,2005-3040; reference:url,secunia.com/advisories/16854; reference:url,cirt.dk/advisories/cirt-37-advisory.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2002406; classtype:attempted-recon; sid:2002406; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE IRC Channel topic scan/exploit command"; flowbits:isset,is_proto_irc; flow:to_client,established; content:"|3a|"; content:"|20|332|20|"; within: 50; content:"|2023|"; within: 20; content:"|203a|"; nocase; within:40; pcre:"/(ntscan [0-9]{1,4} [0-9]{1,4}|dcom\.self|scan\.(start|stop)|scan ([0-9]{1,3}\.[0-9]{1,3})|(advscan|asc|xscan|xploit|adv\.start) (webdav|netbios|ntpass|dcom(2|135|445|1025)|mssql|lsass|optix|upnp|dcass|beagle[12]|mydoom|netdevil|DameWare|kuang2|sub7|iis5ssl|wkssvc|wks1|mysql|wkssvcOth|wkssvcENG|arkeia|arcserve|wins|veritas|netbackup|asn))/i"; reference:url,doc.emergingthreats.net/2002029; classtype:trojan-activity; sid:2002029; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET EXPLOIT M3U File Request Flowbit Set"; flow:to_server,established; content:"GET "; depth:4; content:".m3u"; http_uri; flowbits:set,ET.m3u.download; flowbits:noalert; reference:url,doc.emergingthreats.net/2011241; classtype:not-suspicious; sid:2011241; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE perlb0t/w0rmb0t Response 2"; flow:established,to_server; flowbits:isset,is_proto_irc; content:"|3A 02 03|4|5B|"; content:"|03 02|"; within: 32; pcre:"/\x3A\x02\x034\x5B(BackConnect|help|HTTP.*|SCAN|TCP.*|UDP.*|VERSION)\x5D\x03\x02/i"; reference:url,doc.emergingthreats.net/2006911; classtype:trojan-activity; sid:2006911; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET GAMES TrackMania Ad Report"; flow:to_server,established; content:"GET"; offset:0; depth:3; content:"/online_game/ad_report.php"; http_uri; content:"|0d 0a|User-Agent|3a| GameBox"; content:"protocol="; http_uri; content:"author="; http_uri; content:"login="; http_uri; content:"zone="; http_uri; reference:url,www.trackmania.com; reference:url,doc.emergingthreats.net/2011758; classtype:policy-violation; sid:2011758; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET !6661:6668 (msg:"ET MALWARE IRC DCC chat request on non-standard port"; flow:to_server,established; content:"PRIVMSG "; nocase; depth:8; content:" |3a|.DCC CHAT chat"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2000350; classtype:policy-violation; sid:2000350; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED KitCo Kcast Ticker (agtray)"; flow: to_server,established; content:"/pr/agtray.txt"; http_uri; nocase; reference:url,doc.emergingthreats.net/2000569; classtype:policy-violation; sid:2000569; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET !6661:6668 (msg:"ET MALWARE IRC DNS request on non-standard port"; flow:to_server,established; content:"USERHOST "; nocase; depth:9; reference:url,doc.emergingthreats.net/bin/view/Main/2000352; classtype:policy-violation; sid:2000352; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED KitCo Kcast Ticker (autray)"; flow: to_server,established; content:"/pr/autray.txt"; http_uri; nocase; reference:url,doc.emergingthreats.net/2000570; classtype:policy-violation; sid:2000570; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE psyBNC IRC Server Connection"; flow:from_server,established; content:"psyBNC@lam3rz"; depth:33; nocase; flowbits:isset,is_proto_irc; reference:url,en.wikipedia.org/wiki/PsyBNC; reference:url,doc.emergingthreats.net/2003302; classtype:misc-activity; sid:2003302; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $HOME_NET any -> 76.74.9.19 $HTTP_PORTS (msg:"ET DELETED Packetstormsecurity Exploits Of The Month Download"; content:"GET /"; content:"-exploits.tgz"; http_uri; depth:70; flow:to_server,established; reference:url,www.packetstormsecurity.org; reference:url,doc.emergingthreats.net/2008525; classtype:misc-activity; sid:2008525; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE IRC Potential bot scan/exploit command"; flowbits:isset,is_proto_irc; flow:established,from_server; content:"PRIVMSG|20|"; depth:8; content:"|3a|"; within:30; pcre:"/(ntscan [0-9]{1,4} [0-9]{1,4}|dcom\.self|scan\.(start|stop)|scan ([0-9]{1,3}\.[0-9]{1,3})|(advscan|exploited|asc|xscan|xploit|adv\.start) (webdav|netbios|ntpass|dcom(2|135|445|1025)|mssql|lsass|optix|upnp|dcass|beagle[12]|mydoom|netdevil|DameWare|kuang2|sub7|iis5ssl|wkssvc|wks1|mysql|wkssvcOth|wkssvcENG|arkeia|arcserve|wins|veritas|netbackup|asn))/i"; reference:url,doc.emergingthreats.net/2002030; classtype:trojan-activity; sid:2002030; rev:16; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS DGNews XSS Attempt -- news.php catid"; flow:established,to_server; content:"/news.php?"; http_uri; nocase; content:"catid="; http_uri; nocase; pcre:"/.*<?(java|vb)?script>?.*<.+\/script>?/iU"; reference:cve,CVE-2007-0693; reference:url,www.securityfocus.com/bid/24201; reference:url,doc.emergingthreats.net/2004585; classtype:web-application-attack; sid:2004585; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE IRC potential bot commands"; flow:established,from_server; content:"PRIVMSG "; depth:8; content:"|3a|"; within:30; pcre:"/((\.aim\w*|ascanall|\x3agetshit200)\s+\w+)|((@kill|@get_os_version|@get_computer_name|@get_bot_version|@update|@restart|@reboot|@shutdown)\s)/i"; reference:url,doc.emergingthreats.net/2002384; classtype:trojan-activity; sid:2002384; rev:17; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS FSphp pathwirte.php FSPHP_LIB Parameter Remote File Inclusion Attempt"; flow:to_server,established; content:"/lib/pathwirte.php?"; http_uri; nocase; content:"FSPHP_LIB="; http_uri; nocase; pcre:"/FSPHP_LIB\s*=\s*(https?|ftps?|php)\:\//Ui"; reference:url,osvdb.org/show/osvdb/58317; reference:url,www.milw0rm.com/exploits/9720; reference:url,doc.emergingthreats.net/2010361; classtype:web-application-attack; sid:2010361; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE IRC potential reptile commands"; flow:established,from_server; content:"PRIVMSG|20|"; depth:8; content:"|3a|"; within:30; pcre:"/\.((testdlls|threads|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|currentip)\s*[\r\n]|(iestart|ies|login|l|mirccmd|system|file\s+(cat|exists|e|del|rm|rmdir|move|copy|attrib)|down|dl\dx|update|reg\s+(query|delete|write))\s+\w+|(banner|ban|advscan|asc|scanall|sa|ntscan|nts)\s*[\n\r])/i"; reference:url,doc.emergingthreats.net/2002363; classtype:trojan-activity; sid:2002363; rev:15; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS News Manager ch_readalso.php read_xml_include Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/ch_readalso.php?"; http_uri; nocase; content:"read_xml_include="; http_uri; nocase; pcre:"/read_xml_include=\s*(https?|ftps?|php)\:\//Ui"; reference:bugtraq,29251; reference:url,xforce.iss.net/xforce/xfdb/42459; reference:url,milw0rm.com/exploits/5624; reference:url,doc.emergingthreats.net/2010099; classtype:web-application-attack; sid:2010099; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely Bot Username in IRC (XP-..)"; flow:established,to_server; content:"USER XP-"; depth:8; reference:url,doc.emergingthreats.net/2008123; classtype:trojan-activity; sid:2008123; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Nitrotech common.php root Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/includes/common.php?"; http_uri; nocase; content:"root="; http_uri; nocase; pcre:"/root=\s*(ftps?|https?|php)\:\//Ui"; reference:url,xforce.iss.net/xforce/xfdb/29904; reference:url,milw0rm.com/exploits/7218; reference:url,doc.emergingthreats.net/2008922; classtype:web-application-attack; sid:2008922; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely Bot Nick in IRC (USA +..)"; flow:established,to_server; content:"NICK "; depth:5; content:"USA"; within:10; reference:url,doc.emergingthreats.net/2008124; classtype:trojan-activity; sid:2008124; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS NoAH Remote Inclusion Attempt -- mfa_theme.php tpls"; flow:established,to_server; content:"/modules/noevents/templates/mfa_theme.php?"; http_uri; nocase; content:"tpls["; http_uri; nocase; reference:cve,CVE-2007-2572; reference:url,www.milw0rm.com/exploits/3861; reference:url,doc.emergingthreats.net/2003694; classtype:web-application-attack; sid:2003694; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Ruskill/Palevo KCIK IRC Command"; flow:established,to_server; content:"KCIK |7b|"; depth:6; reference:url,ore.carnivore.it/malware/hash/d4dc8459a34ea14d856e529d3a9e0362; reference:url,sebdraven.tumblr.com/post/6769853139/palevo-analysises; classtype:trojan-activity; sid:2013247; rev:5; metadata:created_at 2011_07_11, updated_at 2011_07_11;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Nokia Intellisync Mobile Suite XSS Attempt -- dev_logon.asp username"; flow:established,to_server; content:"/de/pda/dev_logon.asp?"; http_uri; nocase; content:"username="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2592; reference:url,www.securityfocus.com/archive/1/archive/1/468048/100/0/threaded; reference:url,doc.emergingthreats.net/2003894; classtype:web-application-attack; sid:2003894; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Agobot-SDBot Commands"; flow:established,from_server; content:"PRIVMSG|20|"; depth:8; pcre:"/((cvar\.set)|(http\.(execute|update))|((aol)spam\.(setlist|settemplate|start|stop|setuser|setpass))|sniffer\.(addstring|delstring)|pingstop|udpstop|scan(all|stats|del|stop)|clone(stop|start)|c_(raw|mode|nick|join|part|privmsg|action))/i"; reference:url,doc.emergingthreats.net/2003157; classtype:trojan-activity; sid:2003157; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Nokia Intellisync Mobile Suite XSS Attempt -- registerAccount.asp"; flow:established,to_server; content:"/usrmgr/registerAccount.asp?"; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2592; reference:url,www.securityfocus.com/archive/1/archive/1/468048/100/0/threaded; reference:url,doc.emergingthreats.net/2003895; classtype:web-application-attack; sid:2003895; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE IRC Potential bot command response"; flow:established,to_server; content:"PRIVMSG "; depth:8; content:"|3a|"; within:30; pcre:"/((T?FTP)\x3a File transfer|(random|sequential) Port Scan|Random (Spreading|Scanner)|Exploiting IP|Exploiting\.\.|flooding\x3a|flood stopped|sending packets)|Random Method started|FINDFILE|Scan stopped|No scan thread found|thread\(s\) stopped|\x3aExec /i"; reference:url,doc.emergingthreats.net/2002033; classtype:trojan-activity; sid:2002033; rev:17; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Nokia Intellisync Mobile Suite XSS Attempt -- create_account.asp"; flow:established,to_server; content:"/de/create_account.asp?"; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2592; reference:url,www.securityfocus.com/archive/1/archive/1/468048/100/0/threaded; reference:url,doc.emergingthreats.net/2003896; classtype:web-application-attack; sid:2003896; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dropper.Win32.Npkon Client Checkin"; flow:established,to_server; content:"|40 1f|"; offset:1; depth:2; content:"|03|"; distance:1; within:1; content:"|20 00 00 00|"; distance:1; within:4; dsize:10; reference:md5,a7f4a7d08fa650a5f09a00519b944b0b; classtype:command-and-control; sid:2013793; rev:1; metadata:created_at 2011_10_24, former_category MALWARE, updated_at 2011_10_24;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ODARS resource_categories_view.php CLASSES_ROOT parameter Remote file inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/resource_categories_view.php?"; http_uri; nocase; content:"CLASSES_ROOT="; http_uri; nocase; pcre:"/CLASSES_ROOT=\s*(https?|ftps?|php)\:\//Ui"; reference:url,secunia.com/advisories/30784/; reference:url,milw0rm.com/exploits/5906; reference:url,doc.emergingthreats.net/2009333; classtype:web-application-attack; sid:2009333; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Dropper.Win32.Npkon Server Responce"; flow:from_server,established; content:"|40 1f|"; offset:1; depth:2; content:"|01|"; distance:1; within:1; content:"|10 00 00 00|"; distance:1; within:4; dsize:26; reference:md5,a7f4a7d08fa650a5f09a00519b944b0b; classtype:trojan-activity; sid:2013794; rev:1; metadata:created_at 2011_10_24, updated_at 2011_10_24;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS OSTicket Remote Code Execution Attempt"; flow: established,from_client; content:"/osticket/include"; http_uri; nocase; pcre:"/.*\[.*\].*\;/U"; reference:url,secunia.com/advisories/15216; reference:url,www.gulftech.org/?node=research&article_id=00071-05022005; reference:cve,CAN-2005-1438; reference:cve,CAN-2005-1439; reference:url,doc.emergingthreats.net/bin/view/Main/2002702; classtype:web-application-attack; sid:2002702; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Trojan.SuspectCRC FakeAV Checkin"; flow:established,to_server; content:"value.php?"; http_uri; content:"md="; http_uri; content:"&pc="; http_uri; content:"User-Agent|3a| sample"; http_header; reference:md5,54c9d51661a05151e5143f4e80cbed86; classtype:command-and-control; sid:2013799; rev:3; metadata:created_at 2011_10_24, former_category MALWARE, updated_at 2011_10_24;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Open Translation Engine Remote Inclusion Attempt -- header.php ote_home"; flow:established,to_server; content:"/skins/header.php?"; http_uri; nocase; content:"ote_home="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2676; reference:url,www.milw0rm.com/exploits/3838; reference:url,doc.emergingthreats.net/2003741; classtype:web-application-attack; sid:2003741; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE IRC pBot PHP Bot Commands"; flow:established,from_server; content:"PRIVMSG|20|"; depth:8; pcre:"/PRIVMSG\s+\S+\s+\x3a\s*(\.user |\.logout|\.die|\.restart|\.mail |\.dns |\.download |\.exec |\.find |\.cmd |\.php |\.tcpflood |\.udpflood |\.raw |\.rndnick|\.pscan |\.ud\.server )/i"; reference:url,doc.emergingthreats.net/2003208; classtype:trojan-activity; sid:2003208; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Open Translation Engine (OTE) XSS Attempt -- header.php ote_home"; flow:established,to_server; content:"/skins/header.php?"; http_uri; nocase; content:"ote_home="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2676; reference:url,www.milw0rm.com/exploits/3838; reference:url,doc.emergingthreats.net/2003878; classtype:web-application-attack; sid:2003878; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Warezov/Stration Data Post to Controller"; flow:established,to_server; content:"/cgi-bin/pr.cgi"; http_uri; content:"POST"; http_method; reference:url,www.sophos.com/security/analyses/w32strationbo.html; reference:url,doc.emergingthreats.net/2003180; classtype:trojan-activity; sid:2003180; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS openEngine filepool.php oe_classpath parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/filepool.php?"; http_uri; nocase; content:"oe_classpath="; http_uri; nocase; pcre:"/oe_classpath=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,31423; reference:url,milw0rm.com/exploits/6585; reference:url,doc.emergingthreats.net/2009164; classtype:web-application-attack; sid:2009164; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Basine Trojan Checkin"; flow:established,to_server; content:"a="; http_client_body; content:"&b=reported"; http_client_body; content:"&d=report"; http_client_body; reference:url,doc.emergingthreats.net/2007692; classtype:command-and-control; sid:2007692; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Orlando CMS classes init.php GLOBALS Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/modules/core/logger/init.php?"; http_uri; nocase; content:"GLOBALS[preloc]="; http_uri; nocase; pcre:"/GLOBALS\[preloc\]=\s*(https?|ftps?|php)\:\//Ui"; reference:bugtraq,29820; reference:url,milw0rm.com/exploits/5864; reference:url,doc.emergingthreats.net/2009459; classtype:web-application-attack; sid:2009459; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Bifrose Connect to Controller (PING PONG)"; flow:stateless; dsize:10; content:"PING |3a|i.|0d 0a|"; flowbits:set,ET.bifrose1; reference:url,doc.emergingthreats.net/2009128; classtype:trojan-activity; sid:2009128; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Orlando CMS newscat.php GLOBALS Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/newscat.php?"; http_uri; nocase; content:"GLOBALS[preloc]="; http_uri; nocase; pcre:"/GLOBALS\[preloc\]=\s*(https?|ftps?|php)\:\//Ui"; reference:bugtraq,29820; reference:url,milw0rm.com/exploits/5864; reference:url,doc.emergingthreats.net/2009460; classtype:web-application-attack; sid:2009460; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Bifrose Response from Controller (PING PONG)"; flow:stateless; flowbits:isset,ET.bifrose1; dsize:9; content:"PONG |3a|i.|0d|"; reference:url,doc.emergingthreats.net/2009129; classtype:trojan-activity; sid:2009129; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Client_ID SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Client_ID="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006528; classtype:web-application-attack; sid:2006528; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE FakeAV FakeAlertRena.n Checkin NO Response from Server"; flow:established,from_server; flowbits:isset,ET.fakealert.rena.n; content:"Content-Length|3a| 2|0d 0a 0d 0a|NO"; classtype:command-and-control; sid:2013420; rev:4; metadata:created_at 2011_08_18, former_category MALWARE, updated_at 2011_08_18;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Client_ID UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Client_ID="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006529; classtype:web-application-attack; sid:2006529; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.Kryptik/proscan.co.kr Checkin"; flow:established,to_server; content:"User-Agent|3a| proscan-down"; http_header; reference:md5,bf156b649cb5da6603a5f665a7d8f13b; classtype:command-and-control; sid:2013821; rev:2; metadata:created_at 2011_11_04, former_category MALWARE, updated_at 2011_11_04;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Client_ID INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Client_ID="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006530; classtype:web-application-attack; sid:2006530; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Koobface Variant Initial Checkin"; flow:established,to_server; content:".php?datos=c|3A|"; http_uri; content:"&user="; http_uri; classtype:command-and-control; sid:2013890; rev:2; metadata:created_at 2011_11_08, former_category MALWARE, updated_at 2011_11_08;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Client_ID DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Client_ID="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006531; classtype:web-application-attack; sid:2006531; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.Win32.Svlk Client Checkin"; flow:from_client,established; dsize:12; content:"|38 0d ff 0a d7 ee 9d d7 ec 59 13 56|"; depth:12; reference:md5,c929e8c75901c7e50685df0445a38bd0; classtype:command-and-control; sid:2013891; rev:1; metadata:created_at 2011_11_09, former_category MALWARE, updated_at 2011_11_09;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Client_ID ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Client_ID="; http_uri; nocase; content:"ASCII"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006532; classtype:web-application-attack; sid:2006532; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Backdoor.Win32.Svlk Server Reply"; flow:from_server,established; dsize:44; content:"|33 39 0d ff 0a c4 e5 9f d5 ec 58 4a 69|"; depth:13; reference:md5,c929e8c75901c7e50685df0445a38bd0; classtype:trojan-activity; sid:2013892; rev:1; metadata:created_at 2011_11_09, updated_at 2011_11_09;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Client_ID UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Client_ID="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006533; classtype:web-application-attack; sid:2006533; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.Win32.Svlk Client Ping"; flow:from_client,established; dsize:7; content:"|33 0D FF 0A C5 F8 C1|"; depth:7; reference:md5,c929e8c75901c7e50685df0445a38bd0; classtype:trojan-activity; sid:2013893; rev:2; metadata:created_at 2011_11_09, updated_at 2011_11_09;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Invoice_ID SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Invoice_ID="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006534; classtype:web-application-attack; sid:2006534; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Yaq Checkin"; flow:established,to_server; content:"/Submit.php?id="; http_uri; content:"&action="; http_uri; within:10; content:"&mac="; http_uri; within:10; content:"&lockcode="; http_uri; within:30; content:"&homepc="; http_uri; within:15; content:"User-Agent|3A 20|getinfo|0D 0A|"; http_header; classtype:command-and-control; sid:2013900; rev:2; metadata:created_at 2011_11_11, former_category MALWARE, updated_at 2011_11_11;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Invoice_ID UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Invoice_ID="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006535; classtype:web-application-attack; sid:2006535; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.BlackControl Retrieving IP Information"; flow:established,to_server; content:"/v2/ip_query_country.php?key="; http_uri; content:"&timezone="; http_uri; content:"User-Agent|3A 20|1|0D 0A|"; http_header; fast_pattern; classtype:trojan-activity; sid:2013902; rev:3; metadata:created_at 2011_11_11, updated_at 2011_11_11;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Invoice_ID INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Invoice_ID="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006536; classtype:web-application-attack; sid:2006536; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User Agent GetFile"; flow:established,to_server; content:"User-Agent|3A 20|GetFile|0D 0A|"; http_header; classtype:trojan-activity; sid:2013903; rev:2; metadata:created_at 2011_11_11, updated_at 2011_11_11;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Invoice_ID DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Invoice_ID="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006537; classtype:web-application-attack; sid:2006537; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Rimecud User Agent beat"; flow:established,to_server; content:"User-Agent|3A 20|beat|0D 0A|"; http_header; classtype:trojan-activity; sid:2013904; rev:2; metadata:created_at 2011_11_11, updated_at 2011_11_11;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Invoice_ID ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Invoice_ID="; http_uri; nocase; content:"ASCII"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006538; classtype:web-application-attack; sid:2006538; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious User Agent banderas"; flow:established,to_server; content:"User-Agent|3A 20|banderas"; http_header; classtype:trojan-activity; sid:2013905; rev:2; metadata:created_at 2011_11_11, updated_at 2011_11_11;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Invoice_ID UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Invoice_ID="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006539; classtype:web-application-attack; sid:2006539; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spy-Net Trojan Connection"; flow:established; content:"maininfo|7c|"; depth:9; nocase; content:"|7c|"; distance:3; reference:url,doc.emergingthreats.net/2008644; classtype:trojan-activity; sid:2008644; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Vendor_ID SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Vendor_ID="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006540; classtype:web-application-attack; sid:2006540; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.Emp Keepalive to CnC"; flow:established,to_server; content:"|7a 05 61 17 27 f5 09 f9 05 a2 ff 71 e0 49 96 47|"; offset:16; depth:16; dsize:48; reference:url,www.mcafee.com/threat-intelligence/malware/default.aspx?id=541210; classtype:command-and-control; sid:2013922; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_11_18, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Vendor_ID UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Vendor_ID="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006541; classtype:web-application-attack; sid:2006541; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.Eu2 Keepalive to CnC"; flow:established,to_server; content:"|1c e9 a1 06 39 95 48 0d 64 1f 39 23 21 7f dc 43|"; offset:16; depth:16; dsize:48; classtype:command-and-control; sid:2013923; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_11_18, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Vendor_ID INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Vendor_ID="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006542; classtype:web-application-attack; sid:2006542; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.Eu3 Keepalive to CnC"; flow:established,to_server; content:"|77 1b 13 19 a2 d1 8d a1 b5 05 8f fa 3f aa c0 8a|"; offset:16; depth:16; dsize:48; classtype:command-and-control; sid:2013924; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_11_18, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Vendor_ID DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Vendor_ID="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006543; classtype:web-application-attack; sid:2006543; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.Eu4 Keepalive to CnC"; flow:established,to_server; content:"|ea a2 0d a1 b4 a9 a2 18 12 34 67 eb aa 6f ab 3f|"; offset:16; depth:16; dsize:48; classtype:command-and-control; sid:2013925; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_11_18, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Vendor_ID ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Vendor_ID="; http_uri; nocase; content:"ASCII"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006544; classtype:web-application-attack; sid:2006544; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Rimecud.A User-Agent (needit)"; flow:to_server,established; content:"User-Agent|3a| needit|0d 0a|"; http_header; reference:md5,1b1fff82c72277aff808291d53df7fd8; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FRimecud.A; classtype:trojan-activity; sid:2013951; rev:3; metadata:created_at 2011_11_23, updated_at 2011_11_23;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Vendor_ID UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Vendor_ID="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006545; classtype:web-application-attack; sid:2006545; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TR/Rimecud.aksa User-Agent (indy)"; flow:to_server,established; content:"User-Agent|3a| indy|0d 0a|"; http_header; reference:md5,1536a7072981ce5140efe6b9c193bb7e; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FRimecud.A; classtype:trojan-activity; sid:2013952; rev:3; metadata:created_at 2011_11_23, updated_at 2011_11_23;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPauction GPL converter.inc.php include_path Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/includes/converter.inc.php?"; http_uri; nocase; content:"include_path="; http_uri; nocase; pcre:"/include_path=\s*(ftps?|https?|php)\://Ui"; reference:url,vupen.com/english/advisories/2008/0908; reference:bugtraq,28284; reference:url,milw0rm.com/exploits/5266; reference:url,doc.emergingthreats.net/2009871; classtype:web-application-attack; sid:2009871; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Rimecud.A User-Agent (counters)"; flow:to_server,established; content:"User-Agent|3a| counters|0d 0a|"; http_header; reference:md5,60ce66bd10fcac3c97151612c8a4d343; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FRimecud.A; classtype:trojan-activity; sid:2013953; rev:3; metadata:created_at 2011_11_22, updated_at 2011_11_22;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPauction GPL messages.inc.php include_path Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/includes/messages.inc.php?"; http_uri; nocase; content:"include_path="; http_uri; nocase; pcre:"/include_path=\s*(ftps?|https?|php)\://Ui"; reference:url,vupen.com/english/advisories/2008/0908; reference:bugtraq,28284; reference:url,milw0rm.com/exploits/5266; reference:url,doc.emergingthreats.net/2009872; classtype:web-application-attack; sid:2009872; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Rimecud.A User-Agent (giftz)"; flow:to_server,established; content:"User-Agent|3a| giftz|0d 0a|"; http_header; reference:md5,0f726e84bae5a8d1f166bbf6d09d821b; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FRimecud.A; classtype:trojan-activity; sid:2013954; rev:2; metadata:created_at 2011_11_23, updated_at 2011_11_23;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPauction GPL settings.inc.php include_path Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/includes/settings.inc.php?"; http_uri; nocase; content:"include_path="; http_uri; nocase; pcre:"/include_path=\s*(ftps?|https?|php)\://Ui"; reference:url,vupen.com/english/advisories/2008/0908; reference:bugtraq,28284; reference:url,milw0rm.com/exploits/5266; reference:url,doc.emergingthreats.net/2009873; classtype:web-application-attack; sid:2009873; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Sality User-Agent (Internet Explorer 5.01)"; flow:established,to_server; content:"User-Agent|3A 20|Internet Explorer 5.01|0D 0A|"; http_header; classtype:trojan-activity; sid:2013963; rev:3; metadata:created_at 2011_11_23, updated_at 2011_11_23;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB Remote Code Execution Attempt"; flow:established,to_server; content:"/viewtopic.php?"; http_uri; pcre:"/highlight=.*?(\'|\%[a-f0-9]{4})(\.|\/|\\|\%[a-f0-9]{4}).+?(\'|\%[a-f0-9]{4})/Ui"; reference:url,secunia.com/advisories/15845/; reference:bugtraq,14086; reference:url,www.securiteam.com/unixfocus/6Z00R2ABPY.html; reference:url,doc.emergingthreats.net/2002070; classtype:web-application-attack; sid:2002070; rev:9; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert udp $HOME_NET any -> 8.8.8.8 53 (msg:"ET MALWARE TDSS DNS Based Internet Connectivity Check"; dsize:34; content:"|33 33 01 00 00 01 00 00 00 00 00 00 07|counter|05|yadro|02|ru|00 00 01 00 01|"; classtype:trojan-activity; sid:2013977; rev:1; metadata:created_at 2011_12_02, updated_at 2011_12_02;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Generic phpbb arbitrary command attempt"; flow:established,to_server; content:".php?"; http_uri; nocase; content:"phpbb_root_path="; http_uri; nocase; pcre:"/phpbb_root_path=(ftps?|https?|php)/Ui"; reference:url,cve.mitre.org/cgi-bin/cvekey.cgi?keyword=phpbb_root_path; reference:url,doc.emergingthreats.net/2002731; classtype:web-application-attack; sid:2002731; rev:9; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE W32/Jorik DDOS Instructions From CnC Server"; flow:established,to_client; content:"|7C|ddos|7C|"; pcre:"/\x7Cddos\x7C(syn|http)\x7C/"; classtype:command-and-control; sid:2013998; rev:3; metadata:created_at 2011_12_08, former_category MALWARE, updated_at 2011_12_08;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 registration (Step1 GET)"; flow:to_server,established; content:"GET "; depth:4; nocase; content:"/ucp.php"; http_uri; nocase; content:"mode=register"; http_uri; flowbits:set,ET.phpBB3_test; flowbits:set,ET.phpBB3_register_stage1; flowbits:noalert; reference:url,doc.emergingthreats.net/2010890; classtype:attempted-user; sid:2010890; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE VBKrypt.dytr Checkin"; flow:to_server,established; content:"/gate.php?id="; http_uri; content:"&pc="; http_uri; content:"&os="; http_uri; content:"&version="; http_uri; content:!"User-Agent|3a|"; http_header; reference:md5,090986b0e303779bde1ddad3c65a9d78; classtype:command-and-control; sid:2014003; rev:3; metadata:created_at 2011_08_16, former_category MALWARE, updated_at 2011_08_16;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 registration (Step2 POST)"; flow:to_server,established; content:"POST "; depth:5; nocase; content:"/ucp.php"; http_uri; nocase; content:"mode=register"; http_uri; content:"agreed=I+agree+to+these+terms"; content:"change_lang="; content:"creation_time"; content:"form_token"; flowbits:set,ET.phpBB3_test; flowbits:isset,ET.phpBB3_register_stage1; flowbits:set,ET.phpBB3_register_stage2; flowbits:noalert; reference:url,doc.emergingthreats.net/2010891; classtype:attempted-user; sid:2010891; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE P2P Zeus Response From CnC"; flow:established,from_server; content:"|E5 AA C0 31|"; depth:4; content:"|5B 74|"; distance:5; within:2; content:"|C1|"; distance:4; within:2; reference:url,www.abuse.ch/?p=3499; classtype:command-and-control; sid:2013912; rev:4; metadata:created_at 2011_11_11, former_category MALWARE, updated_at 2011_11_11;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 registration (Step3 GET)"; flow:to_server,established; content:"GET "; depth:4; nocase; content:"/ucp.php"; http_uri; nocase; content:"mode=confirm"; http_uri; content:"confirm_id="; http_uri; content:"type="; http_uri; flowbits:set,ET.phpBB3_test; flowbits:set,ET.phpBB3_register_stage3; flowbits:noalert; reference:url,doc.emergingthreats.net/2010892; classtype:attempted-user; sid:2010892; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gootkit Checkin User-Agent (Gootkit HTTP Client)"; flow:to_server,established; content:"Gootkit HTTP Client"; http_header; nocase; reference:url,doc.emergingthreats.net/2010718; classtype:command-and-control; sid:2010718; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 registration (Step4 POST)"; flow:to_server,established; content:"POST "; depth:5; nocase; content:"/ucp.php"; http_uri; nocase; content:"mode=register"; http_uri; content:"username="; content:"email="; content:"email_confirm="; content:"new_password"; content:"password_confirm"; content:"lang="; content:"tz="; content:"confirm_code="; content:"refresh_vc="; content:"confirm_id="; content:"agreed="; content:"change_lang="; content:"confirm_id="; content:"creation_time="; content:"form_token="; flowbits:set,ET.phpBB3_test; flowbits:isset,ET.phpBB3_register_stage3; flowbits:set,ET.phpBB3_register_stage4; flowbits:noalert; reference:url,doc.emergingthreats.net/2010893; classtype:attempted-user; sid:2010893; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Egspy Infection Report via HTTP"; flow:established,to_server; content:"/keylogkontrol/"; fast_pattern; http_uri; content:"User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)"; http_header; reference:url,research.sunbelt-software.com/threatdisplay.aspx?name=EgySpy&threatid=48410; reference:url,doc.emergingthreats.net/2008047; classtype:trojan-activity; sid:2008047; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 Brute-Force reg attempt (Bad pf_XXXXX)"; flowbits:isset,ET.phpBB3_test; flow:to_server,established; content:"POST "; depth:5; nocase; content:"/ucp.php"; http_uri; nocase; content:"mode=register"; http_uri; content:"username="; content:"email="; content:"pf_XXXXX="; pcre:!"/^Y$/R"; flowbits:unset,ET.phpBB3_test; reference:url,doc.emergingthreats.net/2010894; classtype:web-application-attack; sid:2010894; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET MALWARE Double HTTP/1.1 Header Inbound - Likely Hostile Traffic"; flow:established,to_server; content:" HTTP/1.1|20|HTTP/1.1|0d 0a|"; depth:300; classtype:bad-unknown; sid:2014047; rev:3; metadata:created_at 2011_12_30, updated_at 2011_12_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 Brute-Force reg attempt (Bad pf_XXXXX)"; flowbits:isset,ET.phpBB3_test; flow:to_server,established; content:"POST "; depth:5; nocase; content:"/ucp.php"; http_uri; nocase; content:"mode=register"; http_uri; content:"username="; content:"email="; content:"pf_XXXXX="; pcre:!"/^YYY$/R"; flowbits:unset,ET.phpBB3_test; reference:url,doc.emergingthreats.net/2010895; classtype:web-application-attack; sid:2010895; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Double HTTP/1.1 Header Outbound - Likely Infected or Hostile Traffic"; flow:established,to_server; content:" HTTP/1.1|20|HTTP/1.1|0d 0a|"; depth:300; classtype:bad-unknown; sid:2013745; rev:5; metadata:created_at 2011_10_05, updated_at 2011_10_05;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 registration (Bogus Stage3 GET)"; flow:to_server,established; content:"GET "; depth:4; nocase; content:"/ucp.php"; http_uri; nocase; content:"mode=confirm"; http_uri; content:"id="; http_uri; pcre:"/(\?|&)id=/Ui"; content:"type="; http_uri; reference:url,doc.emergingthreats.net/2010898; classtype:web-application-attack; sid:2010898; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Win32/Hilgild!gen.A CnC Communication"; flow:established,to_server; content:"Y|00|M|00|S|00|G|00 2e 00 2e 00 2e 00 2e 00|"; depth:16; content:"|f6 f6 f6 f6 f6 f6 f6 f6 f6|"; dsize:1024; reference:md5,d8edad03f5524369e60c69a7483f8365; classtype:command-and-control; sid:2014055; rev:1; metadata:created_at 2011_12_31, former_category MALWARE, updated_at 2011_12_31;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 multiple login attempts"; flow:to_server,established; content:"POST "; depth:5; nocase; content:"/ucp.php"; http_uri; nocase; content:"mode=login"; http_uri; threshold: type threshold, track by_src, count 2, seconds 60; reference:url,doc.emergingthreats.net/2010899; classtype:attempted-user; sid:2010899; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE PoisonIvy.Eu5 Keepalive from CnC"; flow:established,from_server; content:"|3a 62 26 fd 44 34 01 ed a1 ed 88 48 7e f4 6e ca 0d 81 aa 70 c7 da e0 1c fc f2 f1 d2 94 f6 d9 44 f6 c1 92 c4 4f d4 2d 53 a7 5f 59 fd f6 1e 9b 6f|"; depth:48; dsize:48; reference:md5,d8edad03f5524369e60c69a7483f8365; classtype:command-and-control; sid:2014057; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_12_31, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 possible spammer posting attempts"; flow:to_server,established; content:"POST "; depth:5; nocase; content:"/posting.php"; http_uri; nocase; content:"mode=post"; http_uri; threshold: type threshold, track by_src, count 2, seconds 30; reference:url,doc.emergingthreats.net/2010900; classtype:web-application-attack; sid:2010900; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.Eu5 Keepalive to CnC"; flow:established,to_server; content:"|13 cb df 56 6f f3 20 08 c2 f1 ab d3 6f 75 56 a9|"; offset:16; depth:16; dsize:48; reference:md5,d8edad03f5524369e60c69a7483f8365; classtype:command-and-control; sid:2014056; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_12_31, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED Possible PHP-Calendar configfile Remote .PHP File Inclusion Arbitrary Code Execution Attempt"; flow:established,to_server; content:"/php-calendar-1.1/update"; http_uri; nocase; content:"configfile="; http_uri; nocase; content:".php"; nocase; pcre:"/\x2Fphp-calendar-1.1\x2Fupdate(08|10)\x2Ephp(\x3F|.*(\x26|\x3B))configfile=[^\x26\x3B]*[^a-zA-Z0-9_]/Ui"; reference:url,securitytracker.com/alerts/2009/Dec/1023375.html; reference:cve,2009-3702; reference:url,doc.emergingthreats.net/2010531; classtype:web-application-attack; sid:2010531; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE FakeAV InstallInternetProtection Download"; flow:established,from_server; content:"|3b 20|filename=|22|InstallInternetProtection_"; nocase; classtype:trojan-activity; sid:2012696; rev:3; metadata:created_at 2011_04_21, updated_at 2011_04_21;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPChain XSS Attempt -- settings.php catid"; flow:established,to_server; content:"/settings.php?"; http_uri; nocase; content:"catid="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2670; reference:url,www.securityfocus.com/bid/23761; reference:url,doc.emergingthreats.net/2003879; classtype:web-application-attack; sid:2003879; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE FakeAV FakeAlertRena.n Checkin Response from Server"; flow:established,from_server; flowbits:isset,ET.fakealert.rena.n; content:"Content-Length|3a| 2|0d 0a|"; content:"|0d 0a 0d 0a|OK"; distance:0; classtype:command-and-control; sid:2013136; rev:6; metadata:created_at 2011_06_29, former_category MALWARE, updated_at 2011_06_29;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPChain XSS Attempt -- cat.php catid"; flow:established,to_server; content:"/cat.php?"; http_uri; nocase; content:"catid="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2670; reference:url,www.securityfocus.com/bid/23761; reference:url,doc.emergingthreats.net/2003880; classtype:web-application-attack; sid:2003880; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE SecurityDefender exe Download Likely FakeAV Install"; flow:established,from_server; content:"|0D 0A|Content-Disposition|3a| attachment|3B| filename=|22|"; content:"SecurityDefender"; nocase; within:24; content:".exe"; within:24; classtype:trojan-activity; sid:2013826; rev:3; metadata:created_at 2011_11_05, updated_at 2011_11_05;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPChess Remote Inclusion Attempt -- language.php config"; flow:established,to_server; content:"/includes/language.php?"; http_uri; nocase; content:"config="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2677; reference:url,www.milw0rm.com/exploits/3837; reference:url,doc.emergingthreats.net/2003742; classtype:web-application-attack; sid:2003742; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.Win32.Nurech Checkin UA"; flow:from_client,established; content:"User-Agent|3a| ipwf|0d 0a|"; http_header; classtype:command-and-control; sid:2014093; rev:3; metadata:created_at 2012_01_03, former_category MALWARE, updated_at 2012_01_03;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPChess Remote Inclusion Attempt -- layout_admin_cfg.php Root_Path"; flow:established,to_server; content:"/layout_admin_cfg.php?"; http_uri; nocase; content:"Root_Path="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2677; reference:url,www.milw0rm.com/exploits/3837; reference:url,doc.emergingthreats.net/2003743; classtype:web-application-attack; sid:2003743; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Blackshades Payload Download Command"; flow:established,to_client; content:"x74|0C|64|0C|"; depth:7; content:"x49|0C|"; distance:64; classtype:trojan-activity; sid:2014101; rev:2; metadata:created_at 2012_01_05, updated_at 2012_01_05;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPChess Remote Inclusion Attempt -- layout_cfg.php Root_Path"; flow:established,to_server; content:"/layout_cfg.php?"; http_uri; nocase; content:"Root_Path="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2677; reference:url,www.milw0rm.com/exploits/3837; reference:url,doc.emergingthreats.net/2003744; classtype:web-application-attack; sid:2003744; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.Eu6 Keepalive to CnC"; flow:established,to_server; content:"|29 a7 7b 28 9b c5 b8 b6 10 d7 d7 6b e1 3e 62 f1|"; offset:16; depth:16; dsize:48; classtype:command-and-control; sid:2014108; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_01_10, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPChess Remote Inclusion Attempt -- layout_t_top.php Root_Path"; flow:established,to_server; content:"/skins/phpchess/layout_t_top.php?"; http_uri; nocase; content:"Root_Path="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2677; reference:url,www.milw0rm.com/exploits/3837; reference:url,doc.emergingthreats.net/2003745; classtype:web-application-attack; sid:2003745; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.UFRStealer.A issuing MKD command FTP"; flow:to_server,established; content:"MKD UFR_Stealer"; nocase; depth:15; reference:md5,a251ef38f048d695eae52626e57d617d; classtype:trojan-activity; sid:2014111; rev:6; metadata:created_at 2011_04_20, updated_at 2011_04_20;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPEventMan remote file include"; flow:established,to_server; content:"/controller/"; http_uri; nocase; pcre:"/(text\.ctrl\.php|common\.function\.php)\?level=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,22358; reference:url,doc.emergingthreats.net/2003372; classtype:web-application-attack; sid:2003372; rev:6; metadata:affected_product Any, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Remote_File_Include, updated_at 2019_08_22;)
+#alert tcp $HOME_NET $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ET MALWARE Cythosia V2 DDoS WebPanel Hosted Locally"; flow:established,from_server; content:"|3C|title|3E|Cythosia|20|V2|20|Bot|20|Webpanel|20 2D 20|Login|3C 2F|title|3E|"; nocase; reference:url,blog.webroot.com/2012/01/09/a-peek-inside-the-cythosia-v2-ddos-bot/; classtype:successful-admin; sid:2014118; rev:2; metadata:created_at 2012_01_12, updated_at 2012_01_12;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPFirstPost Remote Inclusion Attempt block.php Include"; flow:established,to_server; content:"/block.php?"; http_uri; nocase; content:"Include="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2665; reference:url,www.milw0rm.com/exploits/3906; reference:url,doc.emergingthreats.net/2003740; classtype:web-application-attack; sid:2003740; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spyeye Data Exfiltration 5"; flow:established,to_server; content:"|7A 7A 7A 7A 72 71 71 71 71 73 73 73 73 7D 7D 7D 7D|"; offset:5; depth:17; classtype:trojan-activity; sid:2013526; rev:3; metadata:created_at 2011_09_02, updated_at 2011_09_02;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPGenealogy CoupleDB.php DataDirectory Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/CoupleDB.php?"; http_uri; nocase; content:"DataDirectory="; http_uri; nocase; pcre:"/DataDirectory=\s*(ftps?|https?|php)\:\//Ui"; reference:url,milw0rm.com/exploits/9155; reference:url,packetstormsecurity.org/0907-exploits/phpgenealogy-rfi.txt; reference:url,doc.emergingthreats.net/2010095; classtype:web-application-attack; sid:2010095; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spyeye Data Exfiltration 6"; flow:established,to_server; content:"|B5 B5 B5 B5 BD BE BE BE BE BC BC BC BC B2 B2 B2 B2|"; offset:5; depth:17; classtype:trojan-activity; sid:2013527; rev:3; metadata:created_at 2011_09_02, updated_at 2011_09_02;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_USER SELECT"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_USER="; http_uri; nocase; content:"SELECT"; http_uri; nocase; content:"FROM"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003805; classtype:web-application-attack; sid:2003805; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spyeye Data Exfiltration 7"; flow:established,to_server; content:"|6F 6F 6F 6F 67 64 64 64 64 66 66 66 66 68 68 68 68|"; offset:5; depth:17; classtype:trojan-activity; sid:2013528; rev:3; metadata:created_at 2011_09_02, updated_at 2011_09_02;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_USER UNION SELECT"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_USER="; http_uri; nocase; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003806; classtype:web-application-attack; sid:2003806; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spyeye Data Exfiltration 8"; flow:established,to_server; content:"|B4 B4 B4 B4 BC BF BF BF BF BD BD BD BD B3 B3 B3 B3|"; offset:5; depth:17; classtype:trojan-activity; sid:2013529; rev:3; metadata:created_at 2011_09_02, updated_at 2011_09_02;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_USER INSERT"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_USER="; http_uri; nocase; content:"INSERT"; http_uri; nocase; content:"INTO"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003807; classtype:web-application-attack; sid:2003807; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spyeye Data Exfiltration 9"; flow:established,to_server; content:"|0F 0F 0F 0F 07 04 04 04 04 06 06 06 06 08 08 08 08|"; offset:5; depth:17; classtype:trojan-activity; sid:2013530; rev:3; metadata:created_at 2011_09_02, updated_at 2011_09_02;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_USER DELETE"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_USER="; http_uri; nocase; content:"DELETE"; http_uri; nocase; content:"FROM"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003808; classtype:web-application-attack; sid:2003808; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spyeye Data Exfiltration 0"; flow:established,to_server; content:"|B4 B4 B4 B4 BC BF BF BF BF BD BD BD BD B3 B3 B3 B3|"; offset:5; depth:17; classtype:trojan-activity; sid:2013521; rev:4; metadata:created_at 2011_09_02, updated_at 2011_09_02;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_USER ASCII"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_USER="; http_uri; nocase; content:"ASCII("; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003809; classtype:web-application-attack; sid:2003809; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spyeye Data Exfiltration 1"; flow:established,to_server; content:"|40 40 40 40 48 4B 4B 4B 4B 49 49 49 49 47 47 47 47|"; offset:5; depth:17; classtype:trojan-activity; sid:2013522; rev:4; metadata:created_at 2011_09_02, updated_at 2011_09_02;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_USER UPDATE"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_USER="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; content:"SET"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003810; classtype:web-application-attack; sid:2003810; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spyeye Data Exfiltration 2"; flow:established,to_server; content:"|0B 0B 0B 0B 03 00 00 00 00 02 02 02 02 0C 0C 0C 0C|"; offset:5; depth:17; classtype:trojan-activity; sid:2013523; rev:4; metadata:created_at 2011_09_02, updated_at 2011_09_02;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_PASS SELECT"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_PASS="; http_uri; nocase; content:"SELECT"; http_uri; nocase; content:"FROM"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003811; classtype:web-application-attack; sid:2003811; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spyeye Data Exfiltration 3"; flow:established,to_server; content:"|AC AC AC AC A4 A7 A7 A7 A7 A5 A5 A5 A5 AB AB AB AB|"; offset:5; depth:17; classtype:trojan-activity; sid:2013524; rev:3; metadata:created_at 2011_09_02, updated_at 2011_09_02;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_PASS UNION SELECT"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_PASS="; http_uri; nocase; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003812; classtype:web-application-attack; sid:2003812; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spyeye Data Exfiltration 4"; flow:established,to_server; content:"|DD DD DD DD D5 D6 D6 D6 D6 D4 D4 D4 D4 DA DA DA DA|"; offset:5; depth:17; classtype:trojan-activity; sid:2013525; rev:3; metadata:created_at 2011_09_02, updated_at 2011_09_02;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_PASS INSERT"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_PASS="; http_uri; nocase; content:"INSERT"; http_uri; nocase; content:"INTO"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003813; classtype:web-application-attack; sid:2003813; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.Ehy Keepalive to CnC"; flow:established,to_server; content:"|19 07 1b 24 3b 7a 9d e7 77 1e 84 f6 0f 60 3e 27|"; offset:16; depth:16; dsize:48; reference:md5,d2311b7208d563ac59c9114f5d422441; classtype:command-and-control; sid:2014145; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_01_24, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_PASS DELETE"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_PASS="; http_uri; nocase; content:"DELETE"; http_uri; nocase; content:"FROM"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003814; classtype:web-application-attack; sid:2003814; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Win32/Spy.Banker Reporting Via SMTP"; flow:established,to_server; content:"|3A 3A 3A 3A 3A 28 20|Cliente"; content:"Sistem S/"; distance:0; content:"Versao S/"; distance:0; classtype:trojan-activity; sid:2014146; rev:1; metadata:created_at 2012_01_24, updated_at 2012_01_24;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_PASS ASCII"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_PASS="; http_uri; nocase; content:"ASCII("; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003815; classtype:web-application-attack; sid:2003815; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Agent.UGP!tr/Cryptor/Graftor Dropper Requesting exe"; flow:established,to_server; content:"/yahoo.com"; http_uri; content:"User-Agent|3a| Mozilla/4.0|0d 0a|"; http_header; classtype:trojan-activity; sid:2014029; rev:3; metadata:created_at 2011_12_15, updated_at 2011_12_15;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_PASS UPDATE"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_PASS="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; content:"SET"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003816; classtype:web-application-attack; sid:2003816; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Wombot.A checkin Possible Bruteforcer for Web Forms and Accounts - HTTP POST"; flow:established,to_server; content:"POST"; http_method; content:"&ver="; http_client_body; content:"&MAX_EXECUTE_TIME="; http_client_body; fast_pattern; content:"&RELOAD_JOBS="; http_client_body; content:"&BROWSER_DELAY="; http_client_body; content:"&CONTROL_PAGE"; http_client_body; content:"&lastlogcount"; http_client_body; content:"&min_captchasize"; http_client_body; content:"&botid"; http_client_body; content:"®_NAME"; http_client_body; content:"&botlogin="; http_client_body; reference:url,doc.emergingthreats.net/2009830; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FWombot.A; classtype:command-and-control; sid:2009830; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPHtmlLib Remote Inclusion Attempt -- widget8.php phphtmllib"; flow:established,to_server; content:"/examples/widget8.php?"; http_uri; nocase; content:"phphtmllib="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2614; reference:url,www.securityfocus.com/archive/1/archive/1/467837/100/0/threaded; reference:url,doc.emergingthreats.net/2003730; classtype:web-application-attack; sid:2003730; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Goldun Reporting User Activity"; flow:established,to_server; content:".php?param="; http_uri; content:"&socks="; http_uri; content:"User-Agent|3a| Windows Updater"; http_header; reference:url,www.avira.com/en/threats/TR_Spy_Goldun_de_1_details.html; reference:url,doc.emergingthreats.net/2002775; classtype:trojan-activity; sid:2002775; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPLojaFacil Remote Inclusion Attempt -- ftp.php path_local"; flow:established,to_server; content:"/ftp.php?"; http_uri; nocase; content:"path_local="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2615; reference:url,www.milw0rm.com/exploits/3875; reference:url,doc.emergingthreats.net/2003731; classtype:web-application-attack; sid:2003731; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.VB.aie Reporting User Activity"; flow:established,to_server; content:"php?iso="; nocase; http_uri; content:"&country="; nocase; http_uri; content:"&proxy="; nocase; http_uri; content:"&tel="; nocase; http_uri; content:"&ftp="; nocase; http_uri; content:"&socks="; nocase; http_uri; content:"&remote="; nocase; http_uri; content:"&smtp="; nocase; http_uri; reference:url,doc.emergingthreats.net/2002857; classtype:trojan-activity; sid:2002857; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPLojaFacil Remote Inclusion Attempt -- db.php path_local"; flow:established,to_server; content:"/libs/db.php?"; http_uri; nocase; content:"path_local="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2615; reference:url,www.milw0rm.com/exploits/3875; reference:url,doc.emergingthreats.net/2003732; classtype:web-application-attack; sid:2003732; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gozi Checkin to CnC"; flow:to_server,established; content:"user_id="; depth:8; http_client_body; content:"&version_id="; http_client_body; content:"&socks="; fast_pattern; http_client_body; content:"&build="; http_client_body; classtype:command-and-control; sid:2014152; rev:3; metadata:created_at 2012_01_27, former_category MALWARE, updated_at 2012_01_27;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPLojaFacil Remote Inclusion Attempt -- libs_ftp.php path_local"; flow:established,to_server; content:"/libs/ftp.php?"; http_uri; nocase; content:"path_local="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2615; reference:url,www.milw0rm.com/exploits/3875; reference:url,doc.emergingthreats.net/2003733; classtype:web-application-attack; sid:2003733; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE W32/Mentory CnC Server Providing Update Details"; flow:established,to_client; content:"[UPDATE]|0D 0A|VER ="; content:"URL ="; distance:0; content:"[PATTERN]|0D 0A|VER ="; distance:0; content:"URL ="; distance:0; reference:md5,6724bb601611dcc0140960c59c7b3393; classtype:command-and-control; sid:2014166; rev:2; metadata:created_at 2012_01_28, former_category MALWARE, updated_at 2012_01_28;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPmyGallery confdir parameter Remote File Inclusion"; flow:established,to_server; content:"GET "; depth:4; content:"/_conf/core/common-tpl-vars.php?"; http_uri; nocase; content:"confdir="; http_uri; nocase; pcre:"/confdir=\s*(ftps?|https?|php)\:\//Ui"; reference:url,milw0rm.com/exploits/7392; reference:bugtraq,32705; reference:url,doc.emergingthreats.net/2008962; classtype:web-application-attack; sid:2008962; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE W32/Mentory CnC Server Providing File Info Details"; flow:established,to_client; content:"[DBINFO]|0D 0A|Info ="; content:"Version ="; distance:0; content:"[TotalCount]|0D 0A|Count ="; distance:0; content:"[GaruYac"; distance:0; reference:md5,6724bb601611dcc0140960c59c7b3393; classtype:command-and-control; sid:2014167; rev:2; metadata:created_at 2012_01_28, former_category MALWARE, updated_at 2012_01_28;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPOutsourcing Zorum prod.php Remote Command Execution Attempt"; flow:to_server,established; content:"/prod.php?"; http_uri; nocase; pcre:"/(argv[1]=\|.+)/"; reference:bugtraq,14601; reference:url,doc.emergingthreats.net/2002314; classtype:web-application-attack; sid:2002314; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.Win32.Poison.AU checkin"; flow:established,to_server; content:"|4D 53 47 20 35 20 4E 20 31 33 30 0D 0A 4D 49 4d 45 2d 56 65 72 73 69 6f 6e 3a 20 31 2e 30 0d 0a|"; depth:32; fast_pattern; content:"|f6 f6 f6 f6 f6 f6 f6 f6 f6 f6 f6 f6 f6 f6 f6 f6|"; reference:md5,4b8adc7612e984d12b77f197c59827a2; classtype:command-and-control; sid:2012882; rev:4; metadata:created_at 2011_05_27, former_category MALWARE, updated_at 2011_05_27;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPSecurityAdmin Remote Inclusion Attempt -- logout.php PSA_PATH"; flow:established,to_server; content:"/include/logout.php?"; http_uri; nocase; content:"PSA_PATH="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2628; reference:url,www.securityfocus.com/bid/23801; reference:url,doc.emergingthreats.net/2003735; classtype:web-application-attack; sid:2003735; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dapato/Cleaman Checkin"; flow:established,to_server; content:".php?rnd="; http_uri; fast_pattern; content:"GET"; http_method; pcre:"/\?rnd=\d{5,7}\x20HTTP1\/1\.[01]\x0d\x0aHost\x3a\x20/"; content:!"User-Agent|3a|"; http_header; content:!"Accept|3a|"; http_header; reference:md5,45b3b6fcb666c93e305dba35832e1d42; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FCleaman.G; classtype:command-and-control; sid:2014200; rev:4; metadata:created_at 2012_02_07, former_category MALWARE, updated_at 2012_02_07;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPStore Yahoo Answers id parameter SQL Injection"; flow:to_server,established; content:"GET "; depth:4; content:"/index.php?"; http_uri; nocase; content:"cmd=4"; http_uri; nocase; content:"id="; http_uri; nocase; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/UNION.+SELECT/Ui"; reference:url,secunia.com/advisories/32717/; reference:url,milw0rm.com/exploits/7131; reference:url,doc.emergingthreats.net/2008874; classtype:web-application-attack; sid:2008874; rev:4; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TLD4 Purple Haze Variant Initial CnC Request for Ad Servers"; flow:established,to_server; content:"trf?q="; http_uri; content:"&edv="; http_uri; content:"&o="; http_uri; content:"&kp="; http_uri; content:"&tk="; http_uri; content:"&fk="; http_uri; content:"&ks="; http_uri; reference:url,contagiodump.blogspot.com/2012/02/purple-haze-bootkit.html; classtype:command-and-control; sid:2014208; rev:2; metadata:created_at 2012_02_07, former_category MALWARE, updated_at 2012_02_07;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPNuke general XSS attempt"; flow: to_server,established; content:"/modules.php?"; http_uri; content:"name="; http_uri; content:"SCRIPT"; http_uri; nocase; pcre:"/<\s*SCRIPT\s*>/iU"; reference:url,www.waraxe.us/?modname=sa&id=030; reference:url,doc.emergingthreats.net/2001218; classtype:web-application-attack; sid:2001218; rev:12; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Sykipot SSL Certificate subject emailAddress detected"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"marry.smith@ltu.edu"; within:400; reference:url,labs.alienvault.com/labs/index.php/2011/are-the-sykipots-authors-obsessed-with-next-generation-us-drones/; classtype:trojan-activity; sid:2014210; rev:1; metadata:attack_target Client_Endpoint, created_at 2012_02_07, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHP PHPNuke Remote File Inclusion Attempt"; flow:established,to_server; content:"/iframe.php"; http_uri; nocase; content:"file="; http_uri; nocase; pcre:"/file=\s*(ftps?|https?|php)\:\//Ui"; reference:url,www.zone-h.org/en/advisories/read/id=8694/; reference:url,doc.emergingthreats.net/2002800; classtype:web-application-attack; sid:2002800; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Sykipot SSL Certificate serial number detected"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|00 ec 32 09 67 c9 34 3f 50|"; within:30; reference:url,labs.alienvault.com/labs/index.php/2011/are-the-sykipots-authors-obsessed-with-next-generation-us-drones/; classtype:trojan-activity; sid:2014209; rev:3; metadata:attack_target Client_Endpoint, created_at 2012_02_07, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHP Web Calendar Remote File Inclusion Attempt"; flow:established,to_server; content:"/send_reminders.php"; http_uri; nocase; pcre:"/includedir=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,14651; reference:cve,2005-2717; reference:url,doc.emergingthreats.net/2002898; classtype:web-application-attack; sid:2002898; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Delf/Troxen/Zema controller responding to client"; flow:established,to_client; content:"|0d 0a 0d 0a|wait.<os>"; classtype:trojan-activity; sid:2014216; rev:2; metadata:created_at 2012_02_07, updated_at 2012_02_07;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPtree Remote Inclusion Attempt -- cms2.php s_dir"; flow:established,to_server; content:"/plugin/HP_DEV/cms2.php?"; http_uri; nocase; content:"s_dir="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2573; reference:url,www.milw0rm.com/exploits/3860; reference:url,doc.emergingthreats.net/2003693; classtype:web-application-attack; sid:2003693; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Delf/Troxen/Zema controller delivering clickfraud instructions"; flow:established,to_client; content:"|0d 0a 0d 0a|<md5>"; content:"</md5><url>"; distance:16; within:11; classtype:trojan-activity; sid:2014217; rev:3; metadata:created_at 2012_02_07, updated_at 2012_02_07;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PmWiki Globals Variables Overwrite Attempt"; flow:to_server,established; content:"/pmwiki.php"; http_uri; nocase; content:"GLOBALS[FarmD]="; nocase; pcre:"/GLOBALS\x5bFarmD\x5d\x3d/i"; reference:cve,CVE-2006-0479; reference:bugtraq,16421; reference:nessus,20891; reference:url,doc.emergingthreats.net/2002837; classtype:web-application-attack; sid:2002837; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE BB Trojan Communication Protocol detected"; flow:established,to_server; content:"|01 00 00 00|"; offset:4; depth:4; content:"|01 04 01 00 00|"; distance:8; within:5; reference:url,www.commandfive.com/papers/C5_APT_C2InTheFifthDomain.pdf; classtype:trojan-activity; sid:2014227; rev:2; metadata:created_at 2012_02_14, updated_at 2012_02_14;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PNphpBB2 SQL Injection Attempt -- index.php c SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"c="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/SELECT.+FROM/Ui"; reference:cve,CVE-2007-3052; reference:url,www.milw0rm.com/exploits/4026; reference:url,doc.emergingthreats.net/2004606; classtype:web-application-attack; sid:2004606; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"ET MALWARE QDIGIT Trojan Protocol detected"; flow:to_server,established; content:"|51 31 39 21 00|"; depth:5; dsize:5; reference:url,www.commandfive.com/papers/C5_APT_C2InTheFifthDomain.pdf; classtype:trojan-activity; sid:2014222; rev:2; metadata:created_at 2012_02_14, updated_at 2012_02_14;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PNphpBB2 SQL Injection Attempt -- index.php c UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"c="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/UNION\s+SELECT/Ui"; reference:cve,CVE-2007-3052; reference:url,www.milw0rm.com/exploits/4026; reference:url,doc.emergingthreats.net/2004607; classtype:web-application-attack; sid:2004607; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Sefnit Checkin 4"; flow:established,to_server; content:"?aid="; http_uri; content:"&url="; http_uri; pcre:"/\?aid=\d{9}&url=[\w\.\-]{23}$/Ui"; classtype:command-and-control; sid:2014247; rev:2; metadata:created_at 2012_02_21, former_category MALWARE, updated_at 2012_02_21;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PNphpBB2 SQL Injection Attempt -- index.php c INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"c="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/INSERT.+INTO/Ui"; reference:cve,CVE-2007-3052; reference:url,www.milw0rm.com/exploits/4026; reference:url,doc.emergingthreats.net/2004608; classtype:web-application-attack; sid:2004608; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Sefnit Checkin 5"; flow:established,to_server; content:"?subid="; http_uri; content:"&u="; distance:0; http_uri; pcre:"/\?subid=\d{9}&u=[\w\.\-]{23}$/Ui"; classtype:command-and-control; sid:2014248; rev:2; metadata:created_at 2012_02_21, former_category MALWARE, updated_at 2012_02_21;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PNphpBB2 SQL Injection Attempt -- index.php c DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"c="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/DELETE.+FROM/Ui"; reference:cve,CVE-2007-3052; reference:url,www.milw0rm.com/exploits/4026; reference:url,doc.emergingthreats.net/2004609; classtype:web-application-attack; sid:2004609; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Pasta.IK Checkin"; flow:established,to_server; content:"/data/index.asp?act="; http_uri; content:"&ver=Ver"; http_uri; content:"&a="; http_uri; reference:md5,1a13d56365e864aba54967d4745ab660; classtype:command-and-control; sid:2014263; rev:2; metadata:created_at 2012_02_21, former_category MALWARE, updated_at 2012_02_21;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PNphpBB2 SQL Injection Attempt -- index.php c ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"c="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-3052; reference:url,www.milw0rm.com/exploits/4026; reference:url,doc.emergingthreats.net/2004610; classtype:web-application-attack; sid:2004610; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE IP2B Trojan Communication Protocol detected"; flow:established,to_server; content:"|78 56 34 12 00 10 00 10|"; depth:8; content:"|00 18 09 07 20|"; distance:4; within:5; reference:url,www.commandfive.com/papers/C5_APT_C2InTheFifthDomain.pdf; classtype:trojan-activity; sid:2014226; rev:2; metadata:created_at 2012_02_14, updated_at 2012_02_14;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PNphpBB2 SQL Injection Attempt -- index.php c UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"c="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/UPDATE.+SET/Ui"; reference:cve,CVE-2007-3052; reference:url,www.milw0rm.com/exploits/4026; reference:url,doc.emergingthreats.net/2004611; classtype:web-application-attack; sid:2004611; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE Query for Known Hostile *test.3322.org.cn Domain"; content:"|01 00 00 01 00 00 00 00 00|"; depth:9; offset:2; content:"test|04|3322|03|org|02|cn"; fast_pattern; nocase; distance:0; reference:url,www.sans.org/reading_room/whitepapers/malicious/detailed-analysis-advanced-persistent-threat-malware_33814; reference:md5,e4afcee06ddaf093982f80dafbf9c447; classtype:trojan-activity; sid:2014267; rev:1; metadata:created_at 2012_02_21, updated_at 2012_02_21;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Particle Gallery XSS Attempt -- search.php order"; flow:established,to_server; content:"/search.php?"; http_uri; nocase; content:"order="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/.*<?(java|vb)?script>?.*<.+\/script>?/iU"; reference:cve,CVE-2007-2962; reference:url,www.securityfocus.com/archive/1/archive/1/469985/100/0/threaded; reference:url,doc.emergingthreats.net/2004582; classtype:web-application-attack; sid:2004582; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.Win32.RShot Checkin"; flow:established,to_server; content:"connected#"; depth:10; content:"#Windows "; content:"##"; distance:0; dsize:<120; reference:md5,c0aadd5594d340d8a4909d172017e5d0; classtype:command-and-control; sid:2014268; rev:1; metadata:created_at 2012_02_21, former_category MALWARE, updated_at 2012_02_21;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt - Headerfile.php System"; flow:established,to_server; content:"/blocks/headerfile.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003660; classtype:web-application-attack; sid:2003660; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Kryptik.ABUD Checkin"; flow:established,to_server; content:"/imagedump/image.php?size="; http_uri; content:"&thumbnail="; http_uri; reference:md5,00b714468f1bc2254559dd8fd84186f1; classtype:command-and-control; sid:2014300; rev:1; metadata:created_at 2012_03_02, former_category MALWARE, updated_at 2012_03_02;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- latest_files.php System"; flow:established,to_server; content:"/files/blocks/latest_files.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003661; classtype:web-application-attack; sid:2003661; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE W32/NSIS.TrojanDownloader Second Stage Download Instructions from Server"; flow:established,to_client; content:"|3B 20|Ini download file modue"; nocase; content:"DownUrl="; nocase; distance:0; content:"FileName="; nocase; distance:0; content:"SaveType="; nocase; distance:0; pcre:"/FileName\x3D[^\r\n]*\x2E(dll|exe)/i"; reference:md5,3ce5da32903b52394cff2517df51f599; classtype:trojan-activity; sid:2014312; rev:2; metadata:created_at 2012_03_06, updated_at 2012_03_06;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- latest_posts.php System"; flow:established,to_server; content:"/forums/blocks/latest_posts.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003662; classtype:web-application-attack; sid:2003662; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE ZeuS Clickfraud List Delivered To Client"; flow:established,from_server; content:"|0d 0a 0d 0a|<xml>"; content:"<time>"; distance:0; content:"<doc>"; distance:0; content:"<url>http|3a|//"; distance:0; content:"<ref>"; distance:0; content:"<n>"; distance:0; classtype:trojan-activity; sid:2014317; rev:2; metadata:created_at 2012_03_06, updated_at 2012_03_06;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- groups_headerfile.php System"; flow:established,to_server; content:"/groups/headerfile.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003663; classtype:web-application-attack; sid:2003663; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE SMTP Subject Line Contains C Path and EXE Possible Trojan Reporting Execution Path/Binary Name"; flow:established,to_server; content:"Subject|3A 20|"; content:"C|3A 5C|"; nocase; fast_pattern; within:100; content:".exe"; within:40; pcre:"/Subject\x3A\x20[^\r\n]*C\x3A\x5C[^\r\n]*\x2Eexe/i"; reference:md5,24e937b9f3fd6a04dde46a2bc75d4b18; classtype:bad-unknown; sid:2014343; rev:2; metadata:created_at 2012_03_09, updated_at 2012_03_09;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- filters_headerfile.php System"; flow:established,to_server; content:"/filters/headerfile.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003664; classtype:web-application-attack; sid:2003664; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor.Win32.Riern.K Checkin Off Port"; flow:established,from_client; content:"|01|new_host_"; depth:10; fast_pattern; content:"|ff ff ff ff ff 00 00 00 00 00 00 00 00|"; distance:0; classtype:command-and-control; sid:2014358; rev:2; metadata:created_at 2012_03_09, former_category MALWARE, updated_at 2012_03_09;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- links.php System"; flow:established,to_server; content:"/links/blocks/links.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003665; classtype:web-application-attack; sid:2003665; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Kazy Checkin"; flow:established,to_server; content:"/guidcheck.php?q="; http_uri; content:"&g="; http_uri; content:"&n="; http_uri; content:"&h="; http_uri; content:!"User-Agent|3A|"; nocase; http_header; reference:md5,bb129d433271951abb0e5262060a4583; classtype:command-and-control; sid:2014357; rev:4; metadata:created_at 2012_03_09, former_category MALWARE, updated_at 2012_03_09;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- menu_headerfile.php System"; flow:established,to_server; content:"/menu/headerfile.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003666; classtype:web-application-attack; sid:2003666; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Generic Spambot-Spyware Access"; flow:established,to_server; content:"/synctl/"; nocase; http_uri; content:!"User-Agent|3a|"; http_header; reference:url,doc.emergingthreats.net/2002963; classtype:trojan-activity; sid:2002963; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- latest_news.php System"; flow:established,to_server; content:"/news/blocks/latest_news.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003667; classtype:web-application-attack; sid:2003667; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SpyEye Post_Express_Label ftpgrabber check-in"; flow:established,to_server; content:"grabbers.php"; http_uri; content:"&module=ftpgrabber"; http_client_body; content:!"Referer|3a| "; http_header; reference:url,nakedsecurity.sophos.com/2011/02/01/outbreak-post-express-service-malware-attack-spammed-out; classtype:trojan-activity; sid:2012284; rev:3; metadata:created_at 2011_02_03, updated_at 2011_02_03;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- settings_headerfile.php System"; flow:established,to_server; content:"/settings/headerfile.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003668; classtype:web-application-attack; sid:2003668; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely Fake Antivirus Download ws.exe"; flow:established,to_server; content:"GET"; http_method; content:"/install/ws.exe"; http_uri; nocase; reference:url,doc.emergingthreats.net/2010051; classtype:trojan-activity; sid:2010051; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- users_headerfile.php System"; flow:established,to_server; content:"/modules/users/headerfile.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003681; classtype:web-application-attack; sid:2003681; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32.Blocker Checkin"; flow:established,to_server; content:"/gate.php?cmd="; http_uri; content:"&botnet="; http_uri; content:"&userid="; http_uri; content:"&os="; http_uri; reference:md5,1d8841128e63ed7e26200d4ed3bc8e05; classtype:command-and-control; sid:2014364; rev:2; metadata:created_at 2012_03_13, former_category MALWARE, updated_at 2012_03_13;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Phil-a-Form SQL Injection Attempt -- index.php form_id SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"form_id="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-2933; reference:url,www.milw0rm.com/exploits/4003; reference:url,doc.emergingthreats.net/2004089; classtype:web-application-attack; sid:2004089; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DownLoader.30525 Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/ctrl/ctrv.php"; nocase; http_uri; reference:url,doc.emergingthreats.net/bin/view/Main/2006404; classtype:command-and-control; sid:2006404; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Phil-a-Form SQL Injection Attempt -- index.php form_id UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"form_id="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-2933; reference:url,www.milw0rm.com/exploits/4003; reference:url,doc.emergingthreats.net/2004090; classtype:web-application-attack; sid:2004090; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely Fake Antivirus Download Antivirus_21.exe"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/download/Antivirus_"; http_uri; content:".exe"; http_uri; pcre:"/download\x2FAntivirus_\d+\x2Eexe/Ui"; reference:url,doc.emergingthreats.net/2010050; classtype:trojan-activity; sid:2010050; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Phil-a-Form SQL Injection Attempt -- index.php form_id INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"form_id="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-2933; reference:url,www.milw0rm.com/exploits/4003; reference:url,doc.emergingthreats.net/2004091; classtype:web-application-attack; sid:2004091; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely TDSS Download (codec.exe)"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/codec.exe"; http_uri; nocase; reference:url,doc.emergingthreats.net/2010054; classtype:trojan-activity; sid:2010054; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Phil-a-Form SQL Injection Attempt -- index.php form_id DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"form_id="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-2933; reference:url,www.milw0rm.com/exploits/4003; reference:url,doc.emergingthreats.net/2004092; classtype:web-application-attack; sid:2004092; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely Fake Antivirus Download AntivirusPlus.exe"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/AntivirusPlus"; http_uri; content:".exe"; http_uri; reference:url,doc.emergingthreats.net/2010062; classtype:trojan-activity; sid:2010062; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Phil-a-Form SQL Injection Attempt -- index.php form_id ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"form_id="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-2933; reference:url,www.milw0rm.com/exploits/4003; reference:url,doc.emergingthreats.net/2004093; classtype:web-application-attack; sid:2004093; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potential Fake AV GET installer.1.exe"; flow:established,to_server; content:"GET"; http_method; nocase; content:"/installer."; http_uri; nocase; content:".exe"; http_uri; nocase; pcre:"/\/installer\.\d+\.exe/Ui"; reference:url,www.malwareurl.com; reference:url,doc.emergingthreats.net/2010452; classtype:trojan-activity; sid:2010452; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Phil-a-Form SQL Injection Attempt -- index.php form_id UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"form_id="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-2933; reference:url,www.milw0rm.com/exploits/4003; reference:url,doc.emergingthreats.net/2004094; classtype:web-application-attack; sid:2004094; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potential Fake AV GET installer_1.exe"; flow:established,to_server; content:"GET"; http_method; nocase; content:"/installer_"; nocase; http_uri; content:".exe"; nocase; http_uri; pcre:"/\/installer_\d+\.exe/Ui"; reference:url,www.malwareurl.com; reference:url,doc.emergingthreats.net/2010453; classtype:trojan-activity; sid:2010453; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PhpBlock basicfogfactory.class.php PATH_TO_CODE Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/basicfogfactory.class.php?"; http_uri; nocase; content:"PATH_TO_CODE="; http_uri; nocase; pcre:"/PATH_TO_CODE=\s*(https?|ftps?|php)\:\//Ui"; reference:bugtraq,28588; reference:url,milw0rm.com/exploits/5348; reference:url,doc.emergingthreats.net/2009415; classtype:web-application-attack; sid:2009415; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potential Fake AV Download (download/install.php)"; flow:established,to_server; content:"GET"; nocase; http_method; content:"download/install.php"; http_uri; pcre:"/\x0d\x0aHost\: [a-z\x2e]+(security|virus|pro|anti|scan|mypc|total|protect|check|guard|defend)/i"; reference:url,lists.emergingthreats.net/pipermail/emerging-sigs/2009-December/004891.html; reference:url,malwareurl.com; reference:url,www.malwaredomainlist.com; reference:url,doc.emergingthreats.net/2010465; classtype:trojan-activity; sid:2010465; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpFan init.php Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/includes/init.php?"; http_uri; nocase; content:"includepath="; http_uri; nocase; pcre:"/includepath=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,32335; reference:url,milw0rm.com/exploits/7143; reference:url,doc.emergingthreats.net/2008871; classtype:web-application-attack; sid:2008871; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely Fake Antivirus Download Setup_2012.exe"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/Setup_"; nocase; http_uri; content:".exe"; nocase; pcre:"/Setup_20\d+\x2Eexe/Ui"; reference:url,doc.emergingthreats.net/xxxxxxx; classtype:trojan-activity; sid:2010684; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Pie RSS module lib parameter remote file inclusion"; flow:established,to_server; content:"GET "; depth:4; content:"/lib/action/rss.php?"; http_uri; nocase; content:"lib="; http_uri; nocase; pcre:"/lib=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,32465; reference:url,milw0rm.com/exploits/7225; reference:url,doc.emergingthreats.net/2008899; classtype:web-application-attack; sid:2008899; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Unknown Malware Download Request"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/images/GR_OLD_CR.EXE"; nocase; http_uri; reference:url,www.prevx.com/filenames/X22210989379038527-X1/GR_OLD_CR.EXE.html; reference:url,doc.emergingthreats.net/2011148; classtype:trojan-activity; sid:2011148; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Piranha default passwd attempt"; flow:to_server,established; content:"/piranha/secure/control.php3"; http_uri; content:"Authorization\: Basic cGlyYW5oYTp"; reference:bugtraq,1148; reference:cve,2000-0248; reference:nessus,10381; reference:url,doc.emergingthreats.net/2002331; classtype:attempted-recon; sid:2002331; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Downloader Possible AV KILLER"; flow:established,to_server; content:"GET"; nocase; http_method; content:"SoftName="; http_uri; nocase; content:"SoftVersion="; http_uri; nocase; content:"UserIP="; http_uri; nocase; content:"Mac="; http_uri; nocase; reference:url,doc.emergingthreats.net/2009487; classtype:trojan-activity; sid:2009487; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Plume CMS prepend.php Remote File Inclusion attempt"; flow:to_server,established; content:"/prepend.php"; http_uri; nocase; content:"_px_config[manager_path]="; nocase; pcre:"/_px_config\x5bmanager_path\x5d=(https?|ftps?|php)\:/i"; reference:cve,CVE-2006-0725; reference:bugtraq,16662; reference:nessus,20972; reference:url,doc.emergingthreats.net/2002815; classtype:web-application-attack; sid:2002815; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE AVKiller with Backdoor checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"id="; http_client_body; nocase; content:"&ip_int="; http_client_body; nocase; content:"&os="; http_client_body; nocase; content:"&av="; http_client_body; nocase; reference:url,doc.emergingthreats.net/2009812; classtype:command-and-control; sid:2009812; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Podium CMS XSS Attempt -- Default.aspx id"; flow:established,to_server; content:"/Default.aspx?"; http_uri; nocase; content:"id="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2555; reference:url,www.securityfocus.com/archive/1/archive/1/467823/100/0/threaded; reference:url,doc.emergingthreats.net/2003914; classtype:web-application-attack; sid:2003914; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Antispywareexpert.com Fake AS Install Checkin"; flow:established,to_server; content:"/?action="; http_uri; content:"&pc_id="; http_uri; content:"&abbr="; http_uri; content:"&a="; http_uri; content:"&l="; http_uri; content:"&addt"; reference:url,doc.emergingthreats.net/2008502; classtype:command-and-control; sid:2008502; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Pragyan CMS form.lib.php sourceFolder Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/cms/modules/form.lib.php?"; http_uri; nocase; content:"sourceFolder="; http_uri; nocase; pcre:"/sourceFolder=\s*(ftps?|https?|php)\://Ui"; reference:bugtraq,30235; reference:url,juniper.net/security/auto/vulnerabilities/vuln30235.html; reference:url,milw0rm.com/exploits/6078; reference:url,doc.emergingthreats.net/2009898; classtype:web-application-attack; sid:2009898; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Antivirus2008 Fake AV Install Report"; flow:established,to_server; content:"?type=scanner&pin="; http_uri; content:"&lnd="; http_uri; reference:url,doc.emergingthreats.net/2008511; classtype:trojan-activity; sid:2008511; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ProjectCMS select_image.php dir Parameter Directory Traversal"; flow:to_server,established; content:"GET "; depth:4; content:"/imagelibrary/select_image.php?"; http_uri; nocase; content:"dir="; http_uri; nocase; content:"../"; reference:url,milw0rm.com/exploits/8608; reference:bugtraq,34816; reference:url,doc.emergingthreats.net/2009736; classtype:web-application-attack; sid:2009736; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Autorun.qvi Related HTTP Get on Off Port"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/get_r.php?fid="; http_uri; content:"&mac="; http_uri; within:15; content:"&version="; http_uri; distance:0; content:"&uuid="; http_uri; distance:0; reference:url,doc.emergingthreats.net/2008755; classtype:trojan-activity; sid:2008755; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ProjectCMS admin_theme_remove.php file Parameter Remote Directory Delete"; flow:to_server,established; content:"GET "; depth:4; content:"/admin_includes/admin_theme_remove.php?"; http_uri; nocase; content:"file="; http_uri; nocase; content:"../"; reference:url,milw0rm.com/exploits/8608; reference:bugtraq,34816; reference:url,doc.emergingthreats.net/2009737; classtype:web-application-attack; sid:2009737; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Bandook iwebho/BBB-phish trojan leaking user data"; flow:established,to_server; content:"POST"; nocase; http_method; content:"Content-Type|3a20|application/x-www-form-urlencoded|0d0a|Host|3a20|"; depth:55; http_header; content:"Content-Length|3a20|"; http_header; content:"VISITED_URL"; depth:100; http_client_body; reference:url,www.secureworks.com/research/threats/bbbphish; reference:url,doc.emergingthreats.net/2003937; classtype:trojan-activity; sid:2003937; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PsychoStats XSS Attempt -- awards.php"; flow:established,to_server; content:"/awards.php?"; http_uri; nocase; content:"| 3C |"; http_uri; content:"SCRIPT"; http_uri; nocase; content:"| 3E |"; http_uri; reference:cve,CVE-2007-2914; reference:url,www.securityfocus.com/archive/1/archive/1/469260/100/0/threaded; reference:url,doc.emergingthreats.net/2004587; classtype:web-application-attack; sid:2004587; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banker.OPX HTTP Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"TIPO=CLIENTE&NOME="; nocase; http_client_body; reference:url,doc.emergingthreats.net/2007901; classtype:command-and-control; sid:2007901; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PsychoStats XSS Attempt -- login.php"; flow:established,to_server; content:"/login.php?"; http_uri; nocase; content:"| 3C |"; http_uri; content:"SCRIPT"; http_uri; nocase; content:"| 3E |"; http_uri; reference:cve,CVE-2007-2914; reference:url,www.securityfocus.com/archive/1/archive/1/469260/100/0/threaded; reference:url,doc.emergingthreats.net/2004588; classtype:web-application-attack; sid:2004588; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banker.ili HTTP Checkin"; flow:established,to_server; content:"/ctrl/cnt_boot.php?pgv="; http_uri; nocase; reference:url,doc.emergingthreats.net/2007940; classtype:command-and-control; sid:2007940; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PsychoStats XSS Attempt -- register.php"; flow:established,to_server; content:"/register.php?"; http_uri; nocase; content:"| 3C |"; http_uri; content:"SCRIPT"; http_uri; nocase; content:"| 3E |"; http_uri; reference:cve,CVE-2007-2914; reference:url,www.securityfocus.com/archive/1/archive/1/469260/100/0/threaded; reference:url,doc.emergingthreats.net/2004589; classtype:web-application-attack; sid:2004589; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banker Trojan (General) HTTP Checkin"; flow:established,to_server; content:".php?PC="; http_uri; content:"&Data="; http_uri; content:"&Mac="; http_uri; reference:url,doc.emergingthreats.net/2007984; classtype:command-and-control; sid:2007984; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PsychoStats XSS Attempt -- weapons.php"; flow:established,to_server; content:"/weapons.php?"; http_uri; nocase; content:"| 3C |"; http_uri; content:"SCRIPT"; http_uri; nocase; content:"| 3E |"; http_uri; reference:cve,CVE-2007-2914; reference:url,www.securityfocus.com/archive/1/archive/1/469260/100/0/threaded; reference:url,doc.emergingthreats.net/2004590; classtype:web-application-attack; sid:2004590; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banker.JU Related HTTP Post-infection Checkin"; flow:established,to_server; content:"/envio.php?"; http_uri; fast_pattern; content:"User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)"; http_header; content:"tipo="; http_client_body; reference:url,doc.emergingthreats.net/2008267; classtype:command-and-control; sid:2008267; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Quantum Game Library server_request.php CONFIG Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/server_request.php?"; http_uri; nocase; content:"CONFIG[gameroot]="; http_uri; nocase; pcre:"/CONFIG\[gameroot\]=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,27945; reference:url,secunia.com/advisories/29077; reference:url,milw0rm.com/exploits/5174; reference:url,doc.emergingthreats.net/2009502; classtype:web-application-attack; sid:2009502; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Agent.zrm/Infostealer.Bancos Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"appdata="; http_uri; nocase; content:"hd="; nocase; http_uri; content:"mac="; nocase; http_uri; content:"computador="; http_uri; nocase; reference:url,doc.emergingthreats.net/2008519; classtype:command-and-control; sid:2008519; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, malware_family Bancos, tag Banking_Trojan, updated_at 2018_04_23;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Quantum Game Library smarty.inc.php CONFIG Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/qlib/smarty.inc.php?"; http_uri; nocase; content:"CONFIG[gameroot]="; http_uri; nocase; pcre:"/CONFIG\[gameroot\]=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,27945; reference:url,secunia.com/advisories/29077; reference:url,milw0rm.com/exploits/5174; reference:url,doc.emergingthreats.net/2009504; classtype:web-application-attack; sid:2009504; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Generic Banker Trojan Downloader Config to client"; flow:established,to_client; content:"|0d 0a 0d 0a|[Controlinfo]"; nocase; content:"CntInfo="; within:9; nocase; content:"UseSepControl="; within:30; nocase; content:"Names="; within:20; reference:url,doc.emergingthreats.net/2009090; classtype:trojan-activity; sid:2009090; rev:5; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Trojan_Downloader, updated_at 2016_07_01;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS QuickTeam qte_web.php qte_web_path Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/qte_web.php?"; http_uri; nocase; content:"qte_web_path="; http_uri; nocase; pcre:"/qte_web_path=\s*(ftps?|https?|php)\:\//Ui"; reference:url,secunia.com/advisories/34997/; reference:url,milw0rm.com/exploits/8602; reference:url,doc.emergingthreats.net/2009723; classtype:web-application-attack; sid:2009723; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banker/Bancos/Infostealer Possible Rootkit - HTTP HEAD Request"; flow:established,to_server; content:"HEAD"; http_method; nocase; content:".php?action="; http_uri; nocase; content:"&uid="; nocase; http_uri; content:"&locale="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&build="; nocase; http_uri; reference:url,www.pctools.com/mrc/infections/id/Trojan.Banker/; reference:url,www.anti-spyware-101.com/remove-trojanbanker; reference:url,doc.emergingthreats.net/2009750; classtype:trojan-activity; sid:2009750; rev:6; metadata:created_at 2010_07_30, former_category TROJAN, malware_family Bancos, tag Banking_Trojan, updated_at 2018_04_23;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS RM EasyMail Plus XSS Attempt -- Login d"; flow:established,to_server; content:"cp/ps/Main/login/Login"; http_uri; nocase; content:"d="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/.*<?(java|vb)?script>?.*<.+\/script>?/iU"; reference:cve,CVE-2007-2802; reference:url,www.secunia.com/advisories/25326; reference:url,doc.emergingthreats.net/2004571; classtype:web-application-attack; sid:2004571; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Patcher/Bankpatch Module Download Request"; flow:established,to_server; content:"/dl/AcroIEHelpe"; nocase; http_uri; content:".dll"; http_uri; nocase; pcre:"/\/dl\/AcroIEHelpe(r)?(\d)?\.dll/U"; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2008-081817-1808-99&tabid=2; reference:url,doc.emergingthreats.net/2009409; classtype:trojan-activity; sid:2009409; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS RSS-aggregator display.php path Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/display.php?"; http_uri; nocase; content:"path="; http_uri; nocase; pcre:"/path=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,29873; reference:url,milw0rm.com/exploits/5900; reference:url,doc.emergingthreats.net/2009788; classtype:web-application-attack; sid:2009788; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banload HTTP Checkin Detected"; flow:established,to_server; content:"php?mac="; nocase; http_uri; content:"&hdd="; nocase; http_uri; content:"++++++++"; nocase; content:"&ver="; nocase; http_uri; content:"&ie="; http_uri; nocase; reference:url,doc.emergingthreats.net/2007864; classtype:command-and-control; sid:2007864; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS REALTOR define.php Remote File Inclusion"; flow:established,to_server; content:"GET "; depth:4; content:"/define.php?"; http_uri; nocase; content:"INC_DIR="; http_uri; nocase; pcre:"/INC_DIR=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,33227; reference:url,milw0rm.com/exploits/7743; reference:url,doc.emergingthreats.net/2009101; classtype:web-application-attack; sid:2009101; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banload HTTP Checkin Detected (quem=)"; flow:established,to_server; content:".php"; nocase; http_uri; content:"User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)"; http_header; content:"quem="; depth:5; http_client_body; content:"praquem="; http_client_body; fast_pattern; offset:5; nocase; reference:url,doc.emergingthreats.net/2008283; classtype:command-and-control; sid:2008283; rev:9; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Recly Feederator add_tmsp.php mosConfig_absolute_path parameter remote file inclusion"; flow:established,to_server; content:"GET "; depth:4; content:"/tmsp/add_tmsp.php?"; http_uri; nocase; content:"mosConfig_absolute_path="; http_uri; nocase; pcre:"/mosConfig_absolute_path=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,32194; reference:url,milw0rm.com/exploits/7040; reference:url,doc.emergingthreats.net/2009059; classtype:web-application-attack; sid:2009059; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE BANLOAD Downloader GET Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"mac="; http_uri; content:"sys="; http_uri; content:"yp="; http_uri; content:"rand="; http_uri; nocase; pcre:"/mac=[0-9A-Fa-f]{12}&/Ui"; reference:url,www.sophos.com/security/analyses/viruses-and-spyware/trojbanloe.html; reference:url,doc.emergingthreats.net/2009453; classtype:command-and-control; sid:2009453; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Recly Feederator edit_tmsp.php mosConfig_absolute_path parameter remote file inclusion"; flow:established,to_server; content:"GET "; depth:4; content:"/tmsp/edit_tmsp.php?"; http_uri; nocase; content:"mosConfig_absolute_path="; http_uri; nocase; pcre:"/mosConfig_absolute_path=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,32194; reference:url,milw0rm.com/exploits/7040; reference:url,doc.emergingthreats.net/2009060; classtype:web-application-attack; sid:2009060; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Banload Checkin"; flow:to_server,established; content:"GET"; nocase; http_method; content:"c=voip&ord="; nocase; http_uri; content:"=&SCRNSZ"; http_uri; content:"&BRSRSZ="; http_uri; content:"&TIMEZONE="; http_uri; reference:url,doc.emergingthreats.net/2010266; classtype:command-and-control; sid:2010266; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Recly Feederator tmsp.php mosConfig_absolute_path parameter remote file inclusion"; flow:established,to_server; content:"GET "; depth:4; content:"/tmsp/tmsp.php?"; http_uri; nocase; content:"mosConfig_absolute_path="; http_uri; nocase; pcre:"/mosConfig_absolute_path=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,32194; reference:url,milw0rm.com/exploits/7040; reference:url,doc.emergingthreats.net/2009062; classtype:web-application-attack; sid:2009062; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Urlzone/Bebloh Communication with Controller"; flow:established,to_server; content:"GET"; nocase; http_method; content:"?type=slg&id="; http_uri; nocase; pcre:"/\?type=slg&id=[0-9A-Z]{18}/U"; reference:url,threatinfo.trendmicro.com/vinfo/grayware/ve_graywareDetails.asp?GNAME=TSPY_BEBLOH.KO&VSect=Td; reference:url,doc.emergingthreats.net/2009351; classtype:trojan-activity; sid:2009351; rev:8; metadata:created_at 2010_07_30, former_category TROJAN, malware_family URLZone, tag Banking_Trojan, updated_at 2018_04_23;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Recly Competitions Component add.php GLOBALS Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/includes/competitions/add.php?"; http_uri; nocase; content:"GLOBALS[mosConfig_absolute_path]="; http_uri; nocase; pcre:"/GLOBALS\[mosConfig_absolute_path\]=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,32192; reference:url,milw0rm.com/exploits/7039; reference:url,doc.emergingthreats.net/2009466; classtype:web-application-attack; sid:2009466; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Bredavi Configuration Update Response"; flow:established,from_server; content:"|0d 0a 0d 0a 21|new_config|0a|"; nocase; reference:url,doc.emergingthreats.net/2010790; classtype:trojan-activity; sid:2010790; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Recly Competitions Component competitions.php GLOBALS Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/includes/competitions/competitions.php?"; http_uri; nocase; content:"GLOBALS[mosConfig_absolute_path]="; http_uri; nocase; pcre:"/GLOBALS\[mosConfig_absolute_path\]=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,32192; reference:url,milw0rm.com/exploits/7039; reference:url,doc.emergingthreats.net/2009467; classtype:web-application-attack; sid:2009467; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Bredolab Downloader Communicating With Controller (2)"; flow:established,to_server; content:"action="; nocase; http_uri; content:"&guid="; nocase; http_uri; content:"&rnd="; nocase; http_uri; content:"&uid="; nocase; http_uri; content:"&entity="; http_uri; nocase; reference:url,www.microsoft.com/security/portal/Entry.aspx?Name=TrojanDownloader%3aWin32/Bredolab.B; reference:url,doc.emergingthreats.net/2009354; classtype:trojan-activity; sid:2009354; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Recly Competitions Component settings.php mosConfig_absolute_path Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/includes/settings/settings.php?"; http_uri; nocase; content:"mosConfig_absolute_path="; http_uri; nocase; pcre:"/mosConfig_absolute_path=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,32192; reference:url,milw0rm.com/exploits/7039; reference:url,doc.emergingthreats.net/2009468; classtype:web-application-attack; sid:2009468; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Bredolab Check In"; flow:established,to_server; content:"GET"; nocase; http_method; content:"v="; http_uri; content:"&s="; http_uri; content:"&uid="; http_uri; content:"&p="; http_uri; content:"&q="; content:"User-Agent|3a 0d 0a|"; http_header; reference:url,www.martinsecurity.net/2009/05/20/inside-the-massive-gumblar-attacka-dentro-del-enorme-ataque-gumblar/; reference:url,doc.emergingthreats.net/2009360; classtype:trojan-activity; sid:2009360; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Redoable XSS Attempt -- searchloop.php s"; flow:established,to_server; content:"/wp-content/themes/redoable/searchloop.php?"; http_uri; nocase; content:"s="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2757; reference:url,www.securityfocus.com/archive/1/archive/1/468892/100/0/threaded; reference:url,doc.emergingthreats.net/2003872; classtype:web-application-attack; sid:2003872; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Metafisher/Bzub/Cimuz/Tanspy Reporting User Activity"; flow:established,to_server; content:"ver="; nocase; http_uri; content:"&lg="; nocase; http_uri; content:"&phid="; nocase; http_uri; content:"&r="; http_uri; pcre:"/phid=[A-F0-9]{64}/Ui"; reference:url,doc.emergingthreats.net/2009349; classtype:trojan-activity; sid:2009349; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Redoable XSS Attempt -- header.php s"; flow:established,to_server; content:"/wp-content/themes/redoable/header.php?"; http_uri; nocase; content:"s="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2757; reference:url,www.securityfocus.com/archive/1/archive/1/468892/100/0/threaded; reference:url,doc.emergingthreats.net/2003873; classtype:web-application-attack; sid:2003873; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Cinmus.Checkin 1"; flow:to_server,established; content:"GET"; nocase; http_method; content:"?version="; nocase; http_uri; content:"lversion="; nocase; http_uri; content:"&mac="; nocase; http_uri; content:"&fid="; nocase; http_uri; content:"&vpc="; nocase; http_uri; content:"&run="; nocase; http_uri; content:"&from="; http_uri; reference:url,doc.emergingthreats.net/2008623; classtype:command-and-control; sid:2008623; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ResManager SQL Injection Attempt -- edit_day.php id_reserv SELECT"; flow:established,to_server; content:"/edit_day.php?"; http_uri; nocase; content:"id_reserv="; http_uri; nocase; content:"SELECT"; http_uri; nocase; content:"FROM"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-2735; reference:url,www.milw0rm.com/exploits/3931; reference:url,doc.emergingthreats.net/2003829; classtype:web-application-attack; sid:2003829; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Cinmus.Checkin 2"; flow:to_server,established; content:"GET"; http_method; nocase; content:"?fid="; nocase; http_uri; content:"&kid="; nocase; http_uri; content:"&cnt="; nocase; http_uri; content:"&mac="; nocase; http_uri; content:"&kw="; nocase; http_uri; content:"&from="; http_uri; reference:url,doc.emergingthreats.net/2008624; classtype:command-and-control; sid:2008624; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ResManager SQL Injection Attempt -- edit_day.php id_reserv UNION SELECT"; flow:established,to_server; content:"/edit_day.php?"; http_uri; nocase; content:"id_reserv="; http_uri; nocase; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-2735; reference:url,www.milw0rm.com/exploits/3931; reference:url,doc.emergingthreats.net/2003830; classtype:web-application-attack; sid:2003830; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Citi-bank.ru Related Trojan Checkin"; flow:established,to_server; content:".php?hid=NT"; nocase; http_uri; content:"&wp="; nocase; http_uri; content:"&sp="; nocase; http_uri; content:"&eep="; nocase; http_uri; content:"&edp="; nocase; http_uri; reference:url,doc.emergingthreats.net/2008153; classtype:command-and-control; sid:2008153; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ResManager SQL Injection Attempt -- edit_day.php id_reserv INSERT"; flow:established,to_server; content:"/edit_day.php?"; http_uri; nocase; content:"id_reserv="; http_uri; nocase; content:"INSERT"; http_uri; nocase; content:"INTO"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-2735; reference:url,www.milw0rm.com/exploits/3931; reference:url,doc.emergingthreats.net/2003831; classtype:web-application-attack; sid:2003831; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Conficker/MS08-067 Worm Traffic Outbound"; flowbits:isset,ET.ms08067_header; flow:established,to_server; content:"If-None-Match|3A| |22|60794|2D|12b3|2D|e4169440|22|"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2008739; classtype:trojan-activity; sid:2008739; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ResManager SQL Injection Attempt -- edit_day.php id_reserv DELETE"; flow:established,to_server; content:"/edit_day.php?"; http_uri; nocase; content:"id_reserv="; http_uri; nocase; content:"DELETE"; http_uri; nocase; content:"FROM"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-2735; reference:url,www.milw0rm.com/exploits/3931; reference:url,doc.emergingthreats.net/2003832; classtype:web-application-attack; sid:2003832; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE CoreFlooder.Q C&C Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/a?"; nocase; http_uri; content:"wg="; http_client_body; nocase; content:"&cn="; http_client_body; nocase; content:"&i="; http_client_body; nocase; content:"&panic="; http_client_body; nocase; threshold: type limit, track by_src, seconds 3600, count 1; reference:url,www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ%5FCOREFLOOD%2EQ; reference:url,doc.emergingthreats.net/2008353; classtype:command-and-control; sid:2008353; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ResManager SQL Injection Attempt -- edit_day.php id_reserv ASCII"; flow:established,to_server; content:"/edit_day.php?"; http_uri; nocase; content:"id_reserv="; http_uri; nocase; content:"ASCII("; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-2735; reference:url,www.milw0rm.com/exploits/3931; reference:url,doc.emergingthreats.net/2003833; classtype:web-application-attack; sid:2003833; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Proxy.Corpes.j Infection Report"; flow:established,to_server; content:".php?tma="; http_uri; content:"&mode="; http_uri; pcre:"/mode=\d+D[0-9A-F]{150}/U"; reference:url,doc.emergingthreats.net/2008144; classtype:trojan-activity; sid:2008144; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ResManager SQL Injection Attempt -- edit_day.php id_reserv UPDATE"; flow:established,to_server; content:"/edit_day.php?"; http_uri; nocase; content:"id_reserv="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; content:"SET"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-2735; reference:url,www.milw0rm.com/exploits/3931; reference:url,doc.emergingthreats.net/2003834; classtype:web-application-attack; sid:2003834; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Cosmu Process Dump Report"; flow:established,to_server; content:"] Dumping processes {|0d 0a|"; reference:url,doc.emergingthreats.net/2011234; classtype:trojan-activity; sid:2011234; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Text Lines Rearrange Script filename parameter File Disclosure"; flow:established,to_server; content:"GET "; depth:4; content:"/download.php?"; http_uri; nocase; content:"filename="; http_uri; nocase; pcre:"/(\.\.\/){1,}/U"; reference:url,securityfocus.com/bid/32968; reference:url,milw0rm.com/exploits/7542; reference:url,doc.emergingthreats.net/2009018; classtype:web-application-attack; sid:2009018; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Crypt.CFI.Gen Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"User-Agent|3a| BIE|0d 0a|"; http_header; content:"cname="; http_client_body; reference:url,doc.emergingthreats.net/2009204; classtype:command-and-control; sid:2009204; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Rigter Portal System (RPS) SQL Injection Attempt -- index.php categoria SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"categoria="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/SELECT.+FROM/Ui"; reference:cve,CVE-2007-1293; reference:url,www.milw0rm.com/exploits/3403; reference:url,doc.emergingthreats.net/2004660; classtype:web-application-attack; sid:2004660; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DNS Changer HTTP Post Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"x="; http_client_body; content:!"User-Agent|3a| "; http_header; pcre:"/^x=[0-9a-zA-Z]{50}/P"; reference:url,doc.emergingthreats.net/2008263; classtype:command-and-control; sid:2008263; rev:13; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Rigter Portal System (RPS) SQL Injection Attempt -- index.php categoria UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"categoria="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/UNION\s+SELECT/Ui"; reference:cve,CVE-2007-1293; reference:url,www.milw0rm.com/exploits/3403; reference:url,doc.emergingthreats.net/2004661; classtype:web-application-attack; sid:2004661; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DNSChanger.AT or related Infection Checkin Post"; flow:established,to_server; content:"POST /cgi-bin/generator HTTP/1.0|0d 0a|Content-Length|3a| "; depth:50; content:"|0d 0a 0d 0a|"; within:10; reference:url,doc.emergingthreats.net/2008940; classtype:command-and-control; sid:2008940; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Rigter Portal System (RPS) SQL Injection Attempt -- index.php categoria INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"categoria="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/INSERT.+INTO/Ui"; reference:cve,CVE-2007-1293; reference:url,www.milw0rm.com/exploits/3403; reference:url,doc.emergingthreats.net/2004662; classtype:web-application-attack; sid:2004662; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Daonol C&C Communication"; flow:established,to_server; content:"/x/?0"; http_uri; nocase; content:"|0d 0a|SS|3a|"; nocase; content:"|0d 0a|Xost|3a|"; nocase; pcre:"/\/x\/\?0\w{35}$/U"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32%2fDaonol; reference:url,blog.fireeye.com/research/2009/10/gumblar-not-gumby.html; reference:url,www.iss.net/threats/gumblar.html; reference:url,blog.scansafe.com/journal/2009/10/15/gumblar-website-botnet-awakes.html; reference:url,doc.emergingthreats.net/2010164; classtype:command-and-control; sid:2010164; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Rigter Portal System (RPS) SQL Injection Attempt -- index.php categoria DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"categoria="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/DELETE.+FROM/Ui"; reference:cve,CVE-2007-1293; reference:url,www.milw0rm.com/exploits/3403; reference:url,doc.emergingthreats.net/2004663; classtype:web-application-attack; sid:2004663; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Delf HTTP Checkin (1)"; flow:established,to_server; content:"/mydown.asp?"; nocase; http_uri; content:"reg="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&tgid="; nocase; http_uri; content:"&address="; nocase; http_uri; content:"&mydo="; nocase; http_uri; content:"&flag="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007838; classtype:command-and-control; sid:2007838; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Rigter Portal System (RPS) SQL Injection Attempt -- index.php categoria ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"categoria="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-1293; reference:url,www.milw0rm.com/exploits/3403; reference:url,doc.emergingthreats.net/2004664; classtype:web-application-attack; sid:2004664; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Delf Download via HTTP"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/mdfexcute/"; http_uri; content:"Windows 98)"; http_header; reference:url,doc.emergingthreats.net/2007911; classtype:trojan-activity; sid:2007911; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Rigter Portal System (RPS) SQL Injection Attempt -- index.php categoria UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"categoria="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/UPDATE.+SET/Ui"; reference:cve,CVE-2007-1293; reference:url,www.milw0rm.com/exploits/3403; reference:url,doc.emergingthreats.net/2004665; classtype:web-application-attack; sid:2004665; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Delf Checkin via HTTP (up)"; flow:established,to_server; content:"/up.html?"; nocase; http_uri; content:"set="; nocase; http_uri; content:"&pid="; nocase; http_uri; content:"&MAC="; http_uri; nocase; reference:url,doc.emergingthreats.net/2007939; classtype:command-and-control; sid:2007939; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Ripe Website Manager XSS Attempt -- index.php ripeformpost"; flow:established,to_server; content:"/contact/index.php?"; http_uri; nocase; content:"ripeformpost="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/.*<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2206; reference:url,www.securityfocus.com/bid/23597; reference:url,doc.emergingthreats.net/2003871; classtype:web-application-attack; sid:2003871; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Delf Checkin via HTTP (6)"; flow:established,to_server; content:"GET"; nocase; http_method; content:".php?v="; nocase; http_uri; content:"&u="; nocase; http_uri; content:"&t="; nocase; http_uri; content:"&p="; nocase; http_uri; content:"&=w"; http_uri; nocase; reference:url,doc.emergingthreats.net/2008071; classtype:command-and-control; sid:2008071; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS RunCms SQL Injection Attempt -- debug_show.php executed_queries SELECT"; flow:established,to_server; content:"/class/debug/debug_show.php?"; http_uri; nocase; content:"executed_queries="; http_uri; nocase; content:"SELECT"; http_uri; nocase; content:"FROM"; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-2538; reference:url,www.milw0rm.com/exploits/3850; reference:url,doc.emergingthreats.net/2003817; classtype:web-application-attack; sid:2003817; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Delf Checkin via HTTP (7)"; flow:established,to_server; content:"POST"; nocase; http_method; content:".php?macros="; nocase; http_uri; content:"&botstatus="; http_uri; nocase; reference:url,doc.emergingthreats.net/2008090; classtype:command-and-control; sid:2008090; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS RunCms SQL Injection Attempt -- debug_show.php executed_queries UNION SELECT"; flow:established,to_server; content:"/class/debug/debug_show.php?"; http_uri; nocase; content:"executed_queries="; http_uri; nocase; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-2538; reference:url,www.milw0rm.com/exploits/3850; reference:url,doc.emergingthreats.net/2003818; classtype:web-application-attack; sid:2003818; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.Win32.Delf followon POST Data PUSH Packet"; flow:established,to_server; content:"tip="; depth:4; nocase; content:"&cli="; nocase; content:"&tipo="; nocase; reference:url,www.threatexpert.com/threats/trojan-downloader-win32-delf.html; reference:url,doc.emergingthreats.net/2009824; classtype:trojan-activity; sid:2009824; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS RunCms SQL Injection Attempt -- debug_show.php executed_queries INSERT"; flow:established,to_server; content:"/class/debug/debug_show.php?"; http_uri; nocase; content:"executed_queries="; http_uri; nocase; content:"INSERT"; http_uri; nocase; content:"INTO"; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-2538; reference:url,www.milw0rm.com/exploits/3850; reference:url,doc.emergingthreats.net/2003819; classtype:web-application-attack; sid:2003819; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dialer"; flow: established,to_server; content:"/getnumtemp.asp?nip=0"; http_uri; nocase; reference:url,isc.sans.org/diary.php?storyid=1388; reference:url,doc.emergingthreats.net/2003083; classtype:trojan-activity; sid:2003083; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS RunCms SQL Injection Attempt -- debug_show.php executed_queries DELETE"; flow:established,to_server; content:"/class/debug/debug_show.php?"; http_uri; nocase; content:"executed_queries="; http_uri; nocase; content:"DELETE"; http_uri; nocase; content:"FROM"; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-2538; reference:url,www.milw0rm.com/exploits/3850; reference:url,doc.emergingthreats.net/2003820; classtype:web-application-attack; sid:2003820; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Dialer.buv Sending Information Home"; flow:established,to_server; content:"/exit.php?if="; http_uri; nocase; content:"&cl="; content:"&id="; content:"&ov="; content:"&site="; content:"&tk="; reference:url,doc.emergingthreats.net/2008430; classtype:trojan-activity; sid:2008430; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS RunCms SQL Injection Attempt -- debug_show.php executed_queries ASCII"; flow:established,to_server; content:"/class/debug/debug_show.php?"; http_uri; nocase; content:"executed_queries="; http_uri; nocase; content:"ASCII("; http_uri; nocase; content:"SELECT"; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-2538; reference:url,www.milw0rm.com/exploits/3850; reference:url,doc.emergingthreats.net/2003821; classtype:web-application-attack; sid:2003821; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dialer.Win32.E-Group.n Checkin"; flow:to_server,established; content:"login="; nocase; http_uri; content:"&brokerid="; nocase; http_uri; content:"&extlogin="; nocase; http_uri; content:"&autosize="; nocase; http_uri; content:"&icp="; nocase; http_uri; content:"&id_site="; nocase; http_uri; content:"&dl_tracker="; nocase; http_uri; content:"&connection_type="; nocase; http_uri; reference:url,doc.emergingthreats.net/2008490; classtype:command-and-control; sid:2008490; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS RunCms SQL Injection Attempt -- debug_show.php executed_queries UPDATE"; flow:established,to_server; content:"/class/debug/debug_show.php?"; http_uri; nocase; content:"executed_queries="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; content:"SET"; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-2538; reference:url,www.milw0rm.com/exploits/3850; reference:url,doc.emergingthreats.net/2003822; classtype:web-application-attack; sid:2003822; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert http $HOME_NET any -> $HOME_NET any (msg:"ET MALWARE dlink router access attempt"; flow:established,to_server; content:"GET /dlink/hwiz.html HTTP/1.0|0d 0a 0d 0a|"; content:!"|0d 0a|Host|3a| "; reference:url,doc.emergingthreats.net/2008945; classtype:trojan-activity; sid:2008945; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS RunawaySoft Haber portal 1.0 SQL Injection Attempt -- devami.asp id SELECT"; flow:established,to_server; content:"/devami.asp?"; http_uri; nocase; content:"id="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-2752; reference:url,www.milw0rm.com/exploits/3936; reference:url,doc.emergingthreats.net/2003858; classtype:web-application-attack; sid:2003858; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.Dluca HTTP Checkin"; flow:established,to_server; content:"?id={"; nocase; http_uri; content:"&srv="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&docid="; nocase; http_uri; content:"&time="; nocase; http_uri; content:"&cstate="; nocase; http_uri; content:"&state="; nocase; http_uri; content:"&flash="; nocase; http_uri; content:"&pin="; nocase; http_uri; content:"&OSInfo2="; nocase; content:"&cinfo="; nocase; http_uri; content:"&smd="; nocase; http_uri; content:"&rts="; nocase; http_uri; content:"&retryattempt="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007595; classtype:command-and-control; sid:2007595; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS RunawaySoft Haber portal 1.0 SQL Injection Attempt -- devami.asp id UNION SELECT"; flow:established,to_server; content:"/devami.asp?"; http_uri; nocase; content:"id="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-2752; reference:url,www.milw0rm.com/exploits/3936; reference:url,doc.emergingthreats.net/2003859; classtype:web-application-attack; sid:2003859; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Clicker.BC User Agent Detected (linkrunner)"; flow:established,to_server; content:"User-Agent|3a| linkrunner"; nocase; http_header; reference:url,doc.emergingthreats.net/2003648; classtype:trojan-activity; sid:2003648; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS RunawaySoft Haber portal 1.0 SQL Injection Attempt -- devami.asp id INSERT"; flow:established,to_server; content:"/devami.asp?"; http_uri; nocase; content:"id="; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-2752; reference:url,www.milw0rm.com/exploits/3936; reference:url,doc.emergingthreats.net/2003860; classtype:web-application-attack; sid:2003860; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.Win32.Agent.bwr CnC Beacon"; flow:established,to_server; content:"?m="; nocase; http_uri; content:"&a="; nocase; http_uri; content:"&hdd="; nocase; http_uri; content:"&os="; nocase; http_uri; reference:url,doc.emergingthreats.net/2006377; classtype:command-and-control; sid:2006377; rev:6; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2010_07_30, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS RunawaySoft Haber portal 1.0 SQL Injection Attempt -- devami.asp id DELETE"; flow:established,to_server; content:"/devami.asp?"; http_uri; nocase; content:"id="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-2752; reference:url,www.milw0rm.com/exploits/3936; reference:url,doc.emergingthreats.net/2003861; classtype:web-application-attack; sid:2003861; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.26001 Url Pattern Detected"; flow:established,to_server; content:"install.php?"; nocase; http_uri; content:"wall_id="; nocase; http_uri; content:"&maddr=0"; nocase; http_uri; content:"&action="; nocase; http_uri; reference:url,doc.emergingthreats.net/2006400; classtype:trojan-activity; sid:2006400; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS RunawaySoft Haber portal 1.0 SQL Injection Attempt -- devami.asp id ASCII"; flow:established,to_server; content:"/devami.asp?"; http_uri; nocase; content:"id="; http_uri; nocase; content:"ASCII("; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-2752; reference:url,www.milw0rm.com/exploits/3936; reference:url,doc.emergingthreats.net/2003862; classtype:web-application-attack; sid:2003862; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.26001 Url Pattern Detected (lunch_id)"; flow:established,to_server; content:".php?"; nocase; http_uri; content:"aff_id="; nocase; http_uri; content:"lunch_id="; nocase; http_uri; content:"&maddr=0"; nocase; http_uri; reference:url,doc.emergingthreats.net/2006401; classtype:trojan-activity; sid:2006401; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS RunawaySoft Haber portal 1.0 SQL Injection Attempt -- devami.asp id UPDATE"; flow:established,to_server; content:"/devami.asp?"; http_uri; nocase; content:"id="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; content:"SET"; http_uri; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-2752; reference:url,www.milw0rm.com/exploits/3936; reference:url,doc.emergingthreats.net/2003863; classtype:web-application-attack; sid:2003863; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE General Downloader or Virut C&C Ack"; flow:established,to_server; content:"uid="; nocase; http_uri; content:"&version="; nocase; http_uri; content:"&actionname="; nocase; http_uri; content:"&action="; nocase; http_uri; content:"&success="; nocase; http_uri; content:"&debug="; nocase; http_uri; content:"&nocache="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007587; classtype:command-and-control; sid:2007587; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SMA-DB format.php _page_css Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/theme/format.php?"; http_uri; nocase; content:"_page_css="; http_uri; nocase; pcre:"/_page_css=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,34569; reference:url,milw0rm.com/exploits/8460; reference:url,doc.emergingthreats.net/2009653; classtype:web-application-attack; sid:2009653; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.49651 Checkin"; flow:established,to_server; content:"/boot.php/boot.php?"; nocase; http_uri; content:"partner="; nocase; http_uri; content:"&mac="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007952; classtype:command-and-control; sid:2007952; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SMA-DB format.php _page_javascript Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/theme/format.php?"; http_uri; nocase; content:"_page_javascript="; http_uri; nocase; pcre:"/_page_javascript=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,34569; reference:url,milw0rm.com/exploits/8460; reference:url,doc.emergingthreats.net/2009654; classtype:web-application-attack; sid:2009654; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.49651 Install Report"; flow:established,to_server; content:"/install.php?"; nocase; http_uri; content:"partner="; nocase; http_uri; content:"&mac="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007953; classtype:trojan-activity; sid:2007953; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SMA-DB format.php _page_content Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/theme/format.php?"; http_uri; nocase; content:"_page_content="; http_uri; nocase; pcre:"/_page_content=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,34569; reference:url,milw0rm.com/exploits/8460; reference:url,doc.emergingthreats.net/2009656; classtype:web-application-attack; sid:2009656; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.49651 Online Report"; flow:established,to_server; content:"/up.html?"; nocase; http_uri; content:"set="; nocase; http_uri; content:"pid="; nocase; http_uri; content:"&mac="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007954; classtype:trojan-activity; sid:2007954; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ScriptMagix Jokes SQL Injection Attempt -- index.php catid SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"catid="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/SELECT.+FROM/Ui"; reference:cve,CVE-2007-1615; reference:url,www.milw0rm.com/exploits/3509; reference:url,doc.emergingthreats.net/2004116; classtype:web-application-attack; sid:2004116; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Cygo Checkin"; flow:established,to_server; content:"/count.php?"; nocase; http_uri; content:"type="; nocase; http_uri; content:"partner="; nocase; http_uri; content:"&mac="; nocase; http_uri; content:"ver="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007955; classtype:command-and-control; sid:2007955; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ScriptMagix Jokes SQL Injection Attempt -- index.php catid UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"catid="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/UNION\s+SELECT/Ui"; reference:cve,CVE-2007-1615; reference:url,www.milw0rm.com/exploits/3509; reference:url,doc.emergingthreats.net/2004117; classtype:web-application-attack; sid:2004117; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.VB.CEJ HTTP Checkin"; flow:established,to_server; content:"/down"; http_uri; content:"/down/?"; http_uri; content:"s="; http_uri; content:"&t="; http_uri; content:"&v="; http_uri; pcre:"/\/down\d+\/down\/\?s=[A-F0-9]+\&t=\d+\/\d+\/20/U"; reference:url,doc.emergingthreats.net/2008087; classtype:command-and-control; sid:2008087; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ScriptMagix Jokes SQL Injection Attempt -- index.php catid INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"catid="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/INSERT.+INTO/Ui"; reference:cve,CVE-2007-1615; reference:url,www.milw0rm.com/exploits/3509; reference:url,doc.emergingthreats.net/2004118; classtype:web-application-attack; sid:2004118; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Generic Dropper User-Agent (XXXwww)"; flow:established,to_server; content:"User-Agent|3a| XXXwww"; http_header; classtype:trojan-activity; sid:2014387; rev:1; metadata:created_at 2012_03_16, updated_at 2012_03_16;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ScriptMagix Jokes SQL Injection Attempt -- index.php catid DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"catid="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/DELETE.+FROM/Ui"; reference:cve,CVE-2007-1615; reference:url,www.milw0rm.com/exploits/3509; reference:url,doc.emergingthreats.net/2004119; classtype:web-application-attack; sid:2004119; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Agent.cah Checkin Request"; flow:established,to_server; content:"?v="; nocase; http_uri; content:"&mid="; nocase; http_uri; content:"&r1="; nocase; http_uri; content:"&tm=201"; nocase; http_uri; content:"&av="; nocase; http_uri; content:"&os=Windows"; nocase; http_uri; content:"&uid="; nocase; http_uri; content:"cht="; http_uri; reference:url,doc.emergingthreats.net/2007644; classtype:command-and-control; sid:2007644; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ScriptMagix Jokes SQL Injection Attempt -- index.php catid ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"catid="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-1615; reference:url,www.milw0rm.com/exploits/3509; reference:url,doc.emergingthreats.net/2004120; classtype:web-application-attack; sid:2004120; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dropper.Win32.VB.on Keylog/System Info Report via HTTP"; flow:established,to_server; content:"post================================"; content:"=====|0d 0a|Resource Name "; distance:0; content:"|0d 0a|User Name/Value "; distance:0; content:"*************STEAM PASSWORDS**********"; distance:0; content:"Number of procesor|3a|"; distance:0; reference:url,doc.emergingthreats.net; classtype:trojan-activity; sid:2007987; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ScriptMagix Jokes SQL Injection Attempt -- index.php catid UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"catid="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/UPDATE.+SET/Ui"; reference:cve,CVE-2007-1615; reference:url,www.milw0rm.com/exploits/3509; reference:url,doc.emergingthreats.net/2004121; classtype:web-application-attack; sid:2004121; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dropper mdodo.com Related Trojan"; flow:established,to_server; content:"GET"; nocase; http_method; content:"User-Agent|3a| Mdodo"; http_header; reference:url,doc.emergingthreats.net/2008195; classtype:trojan-activity; sid:2008195; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Sendcard XSS Attempt -- sendcard.php form"; flow:established,to_server; content:"/sendcard.php?"; http_uri; nocase; content:"form="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2472; reference:url,www.secunia.com/advisories/25085; reference:url,doc.emergingthreats.net/2003922; classtype:web-application-attack; sid:2003922; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dropper 6dzone.com Related Trojan"; flow:established,to_server; content:"GET"; nocase; http_method; content:"User-Agent|3a| 6dzone|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/2008196; classtype:trojan-activity; sid:2008196; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SezHoo SezHooTabsAndActions.php IP Parameter Remote File Inclusion"; flow:established,to_server; content:"GET "; depth:4; content:"/SezHooTabsAndActions.php?"; http_uri; nocase; content:"IP="; http_uri; nocase; pcre:"/IP=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,31756; reference:url,www.milw0rm.com/exploits/6751; reference:url,doc.emergingthreats.net/2009123; classtype:web-application-attack; sid:2009123; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.Duntek establishing remote connection"; flow:established,to_server; content:"rfe.php?"; nocase; http_uri; content:"cmp=dun_tekfirst"; nocase; http_uri; content:"guid="; nocase; http_uri; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2006-102514-0554-99; reference:url,doc.emergingthreats.net/2003537; classtype:trojan-activity; sid:2003537; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SimpNews SQL Injection Attempt -- print.php newsnr SELECT"; flow:established,to_server; content:"/print.php?"; http_uri; nocase; content:"newsnr="; http_uri; nocase; content:"SELECT"; http_uri; nocase; content:"FROM"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-2750; reference:url,www.milw0rm.com/exploits/3942; reference:url,doc.emergingthreats.net/2003852; classtype:web-application-attack; sid:2003852; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE E-Jihad 3.0 DDoS HTTP Activity OUTBOUND"; flow:established,to_server; content:"GET"; nocase; http_method; content:"User-Agent|3a| Attacker|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:denial-of-service; sid:2007686; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SimpNews SQL Injection Attempt -- print.php newsnr UNION SELECT"; flow:established,to_server; content:"/print.php?"; http_uri; nocase; content:"newsnr="; http_uri; nocase; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-2750; reference:url,www.milw0rm.com/exploits/3942; reference:url,doc.emergingthreats.net/2003853; classtype:web-application-attack; sid:2003853; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET MALWARE E-Jihad 3.0 DDoS HTTP Activity INBOUND"; flow:established,to_server; content:"GET"; nocase; http_method; content:"User-Agent|3a| Attacker|0d 0a|"; http_header; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:denial-of-service; sid:2007687; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SimpNews SQL Injection Attempt -- print.php newsnr INSERT"; flow:established,to_server; content:"/print.php?"; http_uri; nocase; content:"newsnr="; http_uri; nocase; content:"INSERT"; http_uri; nocase; content:"INTO"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-2750; reference:url,www.milw0rm.com/exploits/3942; reference:url,doc.emergingthreats.net/2003854; classtype:web-application-attack; sid:2003854; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Egspy Install Report via HTTP"; flow:established,to_server; content:"/control.php?pcad="; nocase; http_uri; content:"&tarih="; nocase; http_uri; content:"&saat="; nocase; http_uri; content:"&veri="; http_uri; reference:url,doc.emergingthreats.net/2008136; classtype:trojan-activity; sid:2008136; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SimpNews SQL Injection Attempt -- print.php newsnr DELETE"; flow:established,to_server; content:"/print.php?"; http_uri; nocase; content:"newsnr="; http_uri; nocase; content:"DELETE"; http_uri; nocase; content:"FROM"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-2750; reference:url,www.milw0rm.com/exploits/3942; reference:url,doc.emergingthreats.net/2003855; classtype:web-application-attack; sid:2003855; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Eleonore Exploit Pack activity"; flow:established,to_server; content:"?spl="; http_uri; content:"&br="; http_uri; content:"&vers="; http_uri; content:"&s="; http_uri; pcre:"/\?spl=\d+&br=[A-Za-z]+&vers=\d\.\d&s=[a-z0-9]+[^&]$/U"; reference:url,www.offensivecomputing.net/?q=node/1419; reference:url,doc.emergingthreats.net/2010248; classtype:trojan-activity; sid:2010248; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SimpNews SQL Injection Attempt -- print.php newsnr ASCII"; flow:established,to_server; content:"/print.php?"; http_uri; nocase; content:"newsnr="; http_uri; nocase; content:"ASCII("; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-2750; reference:url,www.milw0rm.com/exploits/3942; reference:url,doc.emergingthreats.net/2003856; classtype:web-application-attack; sid:2003856; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Eleonore Exploit Pack activity variant May 2010"; flow:established,to_server; content:".php?spl="; http_uri; pcre:"/\?spl=MS[0-9]{2}-[0-9]{3}$/U"; reference:url,www.offensivecomputing.net/?q=node/1419; reference:url,doc.emergingthreats.net/2010248; classtype:trojan-activity; sid:2011128; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SimpNews SQL Injection Attempt -- print.php newsnr UPDATE"; flow:established,to_server; content:"/print.php?"; http_uri; nocase; content:"newsnr="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; content:"SET"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-2750; reference:url,www.milw0rm.com/exploits/3942; reference:url,doc.emergingthreats.net/2003857; classtype:web-application-attack; sid:2003857; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE FSG Packed Binary via HTTP Inbound"; flow:from_server,established; content:"|4D 5A|"; content:"|50 45 00 00 4C 01 02 00 46 53 47 21|"; distance:10; reference:url,www.securityfocus.com/infocus/1745; reference:url,doc.emergingthreats.net/2002773; classtype:trojan-activity; sid:2002773; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Simple PHP Script Gallery Remote Inclusion index.php gallery"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"gallery="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2679; reference:url,www.securityfocus.com/bid/23534; reference:url,doc.emergingthreats.net/2003746; classtype:web-application-attack; sid:2003746; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Rogue A/V Win32/FakeXPA GET Request"; flow:to_server,established; content:"?campaign="; http_uri; content:"&country="; http_uri; content:"&counter="; http_uri; content:"&campaign="; http_uri; content:"&landid="; http_uri; reference:url,doc.emergingthreats.net/2009209; classtype:trojan-activity; sid:2009209; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Simple Text-File Login script slogin_path parameter remote file inclusion"; flow:established,to_server; content:"GET "; depth:4; content:"/slogin_lib.inc.php?"; http_uri; nocase; content:"slogin_path="; http_uri; nocase; pcre:"/slogin_path=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,32811; reference:url,milw0rm.com/exploits/7444; reference:url,doc.emergingthreats.net/2008996; classtype:web-application-attack; sid:2008996; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FAKE/ROGUE AV HTTP Post"; flow:established,to_server; content:"POST"; nocase; http_method; content:"mid="; content:"&wv="; content:"&r="; content:"&tp="; content:"&exe="; fast_pattern; content:"&ls="; content:"&uid="; reference:url,doc.emergingthreats.net/2009514; classtype:trojan-activity; sid:2009514; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php ps SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"ps="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/SELECT.+FROM/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005518; classtype:web-application-attack; sid:2005518; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FAKE/ROGUE AV Encoded data= HTTP POST"; flow:established,to_server; content:"POST"; nocase; http_method; content:"Cache-Control|3a 20|no-cache|0d 0a|"; http_header; content:"data=/CjEfcLas0KCj/"; http_client_body; nocase; reference:url,doc.emergingthreats.net/2009553; classtype:trojan-activity; sid:2009553; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php ps UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"ps="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/UNION\s+SELECT/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005519; classtype:web-application-attack; sid:2005519; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Fake/Rogue AV Landing Page Encountered"; flow:established,to_server; content:".php?"; nocase; http_uri; content:"land="; nocase; http_uri; content:"affid="; nocase; http_uri; pcre:"/\.php\?(land=\d+|affid=\d{5})&(land=\d+|affid=\d{5})$/Ui"; reference:url,en.wikipedia.org/wiki/Scareware; reference:url,doc.emergingthreats.net/2010347; classtype:trojan-activity; sid:2010347; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php ps INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"ps="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/INSERT.+INTO/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005520; classtype:web-application-attack; sid:2005520; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Fake-Rean Installer Activity (Malwareurl.com Top 30)"; flow:to_server; content:"|2F|installer|2F|Installer|2E|exe"; nocase; http_uri; pcre:"/[1-3]\x2Finstaller\x2FInstaller\x2Eexe/Ui"; reference:url,www.sophos.com/security/analyses/viruses-and-spyware/trojfakereane.html?_log_from=rss; reference:url,doc.emergingthreats.net/2010221; classtype:trojan-activity; sid:2010221; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php ps DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"ps="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/DELETE.+FROM/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005521; classtype:web-application-attack; sid:2005521; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan-Dropper.Win32.Flystud"; flow:to_server,established; content:"loading.html?fn="; nocase; http_uri; content:"&pid="; nocase; http_uri; content:"&mid="; nocase; http_uri; content:"&cid="; nocase; http_uri; content:"&pn="; nocase; http_uri; content:"&clientid="; nocase; http_uri; content:"channel="; nocase; http_uri; content:"&stn="; nocase; http_uri; reference:url,doc.emergingthreats.net/2011086; classtype:trojan-activity; sid:2011086; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php ps ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"ps="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005522; classtype:web-application-attack; sid:2005522; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Fullspace.cc or Related Checkin (1)"; flow:established,to_server; content:"/config.php?ver="; nocase; http_uri; content:"&uid="; nocase; http_uri; content:"&action="; nocase; http_uri; content:"&ras="; nocase; http_uri; content:"&verfull="; nocase; http_uri; reference:url,doc.emergingthreats.net/2008397; classtype:command-and-control; sid:2008397; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php ps UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"ps="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/UPDATE.+SET/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005523; classtype:web-application-attack; sid:2005523; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PWS.Gamania Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"un="; http_client_body; content:"&pw="; http_client_body; content:"&sn="; http_client_body; content:"&l="; http_client_body; content:"&gd1="; http_client_body; content:"&pn="; http_client_body; reference:url,doc.emergingthreats.net/2008431; classtype:command-and-control; sid:2008431; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php us SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"us="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/SELECT.+FROM/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005524; classtype:web-application-attack; sid:2005524; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potential Gemini/Fake AV Download URL Detected"; flow:established,to_server; content:"/Layouts/Landings/CentralLandings/"; nocase; http_uri; content:"/images/"; nocase; http_uri; pcre:"/\x2FLayouts\x2FLandings\x2FCentralLandings\x2F\d+\x2Fimages\x2F/Ui"; reference:url,www.virustotal.com/analisis/c36e206c6dfe88345815da41c1b14b4f33a9636ad94dd46ce48f5b367f1c736c-1254242791; reference:url,doc.emergingthreats.net/2010450; classtype:trojan-activity; sid:2010450; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php us UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"us="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/UNION\s+SELECT/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005525; classtype:web-application-attack; sid:2005525; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader Infostealer - GET Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"User-Agent|3a| wget 3.0|0d 0a|"; nocase; http_header; content:"aid="; nocase; http_uri; content:"os="; nocase; http_uri; content:"uid="; nocase; http_uri; reference:url,doc.emergingthreats.net/2009539; classtype:command-and-control; sid:2009539; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php us DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"us="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/DELETE.+FROM/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005527; classtype:web-application-attack; sid:2005527; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Win32/Agent.QBY CnC Post"; flow:established,to_server; content:"cike.php?fid="; nocase; http_uri; content: "&cid="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&tid="; nocase; http_uri; content:"&sn="; nocase; http_uri; reference:url,www.threatexpert.com/report.aspx?uid=4f05faef-6a70-4957-8990-b316d8487f63; reference:url,doc.emergingthreats.net/2010138; classtype:command-and-control; sid:2010138; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php us ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"us="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005528; classtype:web-application-attack; sid:2005528; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Keylogger Infection Report via POST"; flow:established,to_server; content:"texto=|25 30 44 25 30 41 25 30 44 25 30 41|Computer"; content:"|25 30 44 25 30 41|IP|25 32 45 25 32 45 25 32 45 25 32 45 25 32 45|"; distance:0; reference:url,doc.emergingthreats.net/2008521; classtype:trojan-activity; sid:2008521; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php us UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"us="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/UPDATE.+SET/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005529; classtype:web-application-attack; sid:2005529; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Common Spambot HTTP Checkin"; flow:established,to_server; content:"os="; http_uri; content:"&user="; http_uri; content:"&status="; http_uri; content:"&uptime="; http_uri; content:"&cmd="; http_uri; reference:url,doc.emergingthreats.net/2008261; classtype:command-and-control; sid:2008261; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php f SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"f="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/SELECT.+FROM/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005530; classtype:web-application-attack; sid:2005530; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Unnamed Generic.Malware http get"; flow:established,to_server; content:"/ww20/script.php?id="; nocase; http_uri; content:"&config="; nocase; content:!"User-Agent|3a|"; http_header; reference:url,doc.emergingthreats.net/2003431; classtype:trojan-activity; sid:2003431; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php f UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"f="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/UNION\s+SELECT/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005531; classtype:web-application-attack; sid:2005531; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Generic Trojan Checkin (double Content-Type headers)"; flow:to_server,established; content:"POST"; nocase; http_method; content:".php"; http_uri; content:"Content-Type|3a| text/html"; http_header; content:"Content-type|3a| image/gif"; http_header; reference:url,doc.emergingthreats.net/2010282; classtype:command-and-control; sid:2010282; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php f INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"f="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/INSERT.+INTO/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005532; classtype:web-application-attack; sid:2005532; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gimmiv.A.dll Infection"; flow: to_server,established; content:"/test"; http_uri; content:".php"; http_uri; content:"?abc="; http_uri; content:"?def="; http_uri; reference:url,www.microsoft.com/security/portal/Entry.aspx?name=TrojanSpy%3aWin32%2fGimmiv.A; reference:url,doc.emergingthreats.net/2008689; classtype:trojan-activity; sid:2008689; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php f DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"f="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/DELETE.+FROM/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005533; classtype:web-application-attack; sid:2005533; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Glacial Dracon C&C Communication"; flow:established,to_server; content:"?id="; nocase; http_uri; content:"&ve="; nocase; http_uri; content:"&h="; nocase; http_uri; content:"&c[]="; nocase; depth:5; http_client_body; content:"&t[]="; nocase; http_client_body; content:"&u[]="; nocase; http_client_body; content:"&d[]="; nocase; http_client_body; content:"&p[]="; nocase; http_client_body; reference:md5,fd3d061ee86987e8f3f245c2dc0ceb46; reference:md5,912692cb4e3f960c9cb4bbc96fa17c9d; reference:url,doc.emergingthreats.net/2010163; classtype:command-and-control; sid:2010163; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php f ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"f="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005534; classtype:web-application-attack; sid:2005534; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http any any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Possible Bobax trojan infection"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/reg|3f|u="; http_uri; content:"|26|v="; http_uri; reference:url,www.lurhq.com/bobax.html; reference:url,doc.emergingthreats.net/2001901; classtype:trojan-activity; sid:2001901; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php f UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"f="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/UPDATE.+SET/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005535; classtype:web-application-attack; sid:2005535; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Hitpop Checkin"; flow:established,to_server; content:"/stat.htm?id="; nocase; http_uri; content:"&agt="; nocase; http_uri; content:"&r=http"; http_uri; nocase; content:"&OS="; nocase; http_uri; content:"&ntime="; nocase; http_uri; content:"&rtime="; nocase; http_uri; reference:url,atlas-public.ec2.arbor.net/docs/Hitpop_DDoS_Malware_Analysis_PUBLIC.pdf; reference:url,doc.emergingthreats.net/2008275; classtype:command-and-control; sid:2008275; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php code SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"code="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/SELECT.+FROM/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005536; classtype:web-application-attack; sid:2005536; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Hupigon User Agent Detected (SykO)"; flow:established,to_server; content:"User-Agent|3a| SykO"; http_header; nocase; reference:url,doc.emergingthreats.net/2003649; classtype:trojan-activity; sid:2003649; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php code UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"code="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/UNION\s+SELECT/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005537; classtype:web-application-attack; sid:2005537; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Hupigon User Agent Detected (IE_7.0)"; flow:established,to_server; content:"User-Agent|3a| IE_7.0"; http_header; nocase; reference:url,doc.emergingthreats.net/2003932; classtype:trojan-activity; sid:2003932; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php code INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"code="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/INSERT.+INTO/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005538; classtype:web-application-attack; sid:2005538; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE KillAV/Dropper/Mdrop/Hupigon - HTTP GET"; flow:established,to_server; content:"GET"; nocase; http_method; content:".asp?mac="; nocase; http_uri; content:"&xxx="; nocase; http_uri; content:"User-Agent|3a| baidu|0d 0a|"; http_header; nocase; reference:url,doc.emergingthreats.net/2009811; classtype:trojan-activity; sid:2009811; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php code DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"code="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/DELETE.+FROM/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005539; classtype:web-application-attack; sid:2005539; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Insidebar.co.kr Related Infection Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"e=inside&s="; http_client_body; content:"&ver="; http_client_body; content:"&p="; http_client_body; reference:url,doc.emergingthreats.net/2008760; classtype:command-and-control; sid:2008760; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php code ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"code="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005540; classtype:web-application-attack; sid:2005540; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Klom.A Connecting to Controller"; flow:established,to_server; content:"/s_13_0?m="; nocase; http_uri; content:"r="; nocase; http_uri; content:"&a="; nocase; http_uri; content:"&os="; nocase; http_uri; reference:url,www.bitdefender.com/VIRUS-1000126-en--Trojan.Klom.A.html; reference:url,doc.emergingthreats.net/2003538; classtype:trojan-activity; sid:2003538; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php code UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"code="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/UPDATE.+SET/Ui"; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005541; classtype:web-application-attack; sid:2005541; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Knockbot Proxy Response From Controller"; flow:established,from_server; content:"|0d 0a 0d 0a|command|7c|file|7c|http"; depth:250; nocase; content:"|7c|"; within:150; reference:url,www.malwaredomainlist.com/mdl.php?search=knock.php; reference:url,doc.emergingthreats.net/2010787; classtype:trojan-activity; sid:2010787; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SnippetMaster pcltar.lib.php g_pcltar_lib_dir Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/pcltar.lib.php?"; http_uri; nocase; content:"g_pcltar_lib_dir="; http_uri; pcre:"/g_pcltar_lib_dir=\s*(https?|ftps?|php)\:\//Ui"; reference:url,secunia.com/advisories/33865/; reference:url,milw0rm.com/exploits/8017; reference:url,doc.emergingthreats.net/2009180; classtype:web-application-attack; sid:2009180; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32.Koblu"; flow:established,to_server; content:"GET"; nocase; http_method; content:"sid="; nocase; http_uri; content:"&sa="; nocase; http_uri; content: "&p="; http_uri; content:"&q=cards&rf="; http_uri; content:"&enc="; http_uri; content:"&enk=&xsc=&xsp=&xsm="; http_uri; reference:url,doc.emergingthreats.net/2010230; classtype:trojan-activity; sid:2010230; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SonicBB XSS Attempt -- search.php part"; flow:established,to_server; content:"/search.php?"; http_uri; nocase; content:"part="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-1903; reference:url,www.netvigilance.com/advisory0020; reference:url,doc.emergingthreats.net/2003881; classtype:web-application-attack; sid:2003881; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Koobface fetch C&C command detected"; flow:established, to_server; content:".php"; nocase; http_uri; content:"f=0&a="; fast_pattern; content:"&v="; content:"&c="; content:"&s="; content:"&l="; content:"&ck="; content:"&c_fb="; content:"&c_ms="; content:"&c_hi="; content:"&c_be="; content:"&c_fr="; content:"&c_yb="; content:"&c_tg="; content:"&c_nl="; content:"&c_fu="; reference:url,us.trendmicro.com/imperia/md/content/us/trendwatch/researchandanalysis/the_20heart_20of_20koobface_final_1_.pdf; reference:url,doc.emergingthreats.net/2010153; classtype:command-and-control; sid:2010153; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Triexa SonicMailer Pro SQL Injection Attempt -- index.php list SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"list="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/SELECT.+FROM/Ui"; reference:cve,CVE-2007-1425; reference:url,www.milw0rm.com/exploits/3457; reference:url,doc.emergingthreats.net/2004379; classtype:web-application-attack; sid:2004379; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Korklic.A"; flow:to_server,established; content:"GET"; nocase; http_method; content:"mode=boot&MyValue="; http_uri; content:"&code="; http_uri; pcre:"/MyValue=[a-f0-9]{2}\:[a-f0-9]{2}\:[a-f0-9]{2}\:[a-f0-9]{2}\:/Ui"; reference:url,doc.emergingthreats.net/2009003; classtype:trojan-activity; sid:2009003; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Triexa SonicMailer Pro SQL Injection Attempt -- index.php list UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"list="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/UNION\s+SELECT/Ui"; reference:cve,CVE-2007-1425; reference:url,www.milw0rm.com/exploits/3457; reference:url,doc.emergingthreats.net/2004380; classtype:web-application-attack; sid:2004380; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Lager Trojan Reporting Spam"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/sp/post.php"; nocase; http_uri; content:"data="; depth:400; reference:url,www.viruslist.com/en/viruses/encyclopedia?virusid=87732; reference:url,doc.emergingthreats.net/2003190; classtype:trojan-activity; sid:2003190; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Triexa SonicMailer Pro SQL Injection Attempt -- index.php list INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"list="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/INSERT.+INTO/Ui"; reference:cve,CVE-2007-1425; reference:url,www.milw0rm.com/exploits/3457; reference:url,doc.emergingthreats.net/2004381; classtype:web-application-attack; sid:2004381; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET 1025:5000 (msg:"ET MALWARE Possible Web-based DDoS-command being issued"; flow: established,from_server; content: "Server|3a| nginx/0."; offset: 17; depth: 19; content: "Content-Type|3a| text/html"; content:"|3a|80|3b|255.255.255.255"; fast_pattern; reference:url,doc.emergingthreats.net/2003296; classtype:trojan-activity; sid:2003296; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Triexa SonicMailer Pro SQL Injection Attempt -- index.php list DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"list="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/DELETE.+FROM/Ui"; reference:cve,CVE-2007-1425; reference:url,www.milw0rm.com/exploits/3457; reference:url,doc.emergingthreats.net/2004382; classtype:web-application-attack; sid:2004382; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Mcboo.com/Bundlext.com related Trojan Checkin URL"; flow:established,to_server; content:"/ack.php?version="; http_uri; content:"&uid="; http_uri; content:"&status="; http_uri; reference:url,doc.emergingthreats.net/2008758; classtype:command-and-control; sid:2008758; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Triexa SonicMailer Pro SQL Injection Attempt -- index.php list ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"list="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-1425; reference:url,www.milw0rm.com/exploits/3457; reference:url,doc.emergingthreats.net/2004383; classtype:web-application-attack; sid:2004383; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MEREDROP/micr0s0fts.cn Related Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/update.asp"; http_uri; content:"ver="; http_client_body; depth:4; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; http_client_body; reference:url,doc.emergingthreats.net/2008891; classtype:command-and-control; sid:2008891; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Triexa SonicMailer Pro SQL Injection Attempt -- index.php list UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"list="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/UPDATE.+SET/Ui"; reference:cve,CVE-2007-1425; reference:url,www.milw0rm.com/exploits/3457; reference:url,doc.emergingthreats.net/2004384; classtype:web-application-attack; sid:2004384; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Metajuan trojan checkin"; flow:established,to_server; content:"trafc-2/rfe"; nocase; http_uri; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2007-030112-0714-99; reference:url,doc.emergingthreats.net/2007811; classtype:command-and-control; sid:2007811; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TellTarget CMS Remote Inclusion site_conf.php ordnertiefe"; flow:established,to_server; content:"/site_conf.php?"; http_uri; nocase; content:"ordnertiefe="; http_uri; nocase; reference:cve,CVE-2007-2597; reference:url,www.milw0rm.com/exploits/3885; reference:url,doc.emergingthreats.net/2003705; classtype:web-application-attack; sid:2003705; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.MisleadApp Fake Security Product Install"; flow:established,to_server; content:"GET"; nocase; http_method; content:"hash?http"; nocase; http_uri; pcre:"/\/(ucleaner|udefender|ufixer)\.com\/demo\.php\?/Ui"; reference:url,doc.emergingthreats.net/2007566; classtype:trojan-activity; sid:2007566; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TellTarget CMS Remote Inclusion class.csv.php tt_docroot"; flow:established,to_server; content:"/class.csv.php?"; http_uri; nocase; content:"tt_docroot="; http_uri; nocase; reference:cve,CVE-2007-2597; reference:url,www.milw0rm.com/exploits/3885; reference:url,doc.emergingthreats.net/2003706; classtype:web-application-attack; sid:2003706; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Monkif Downloader Checkin"; flow:to_server,established; content:"/cgi/"; http_uri; content:".php?"; nocase; http_uri; content:"x640<x"; http_uri; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3aWin32%2fMonkif.C; reference:url,doc.emergingthreats.net/2009126; classtype:command-and-control; sid:2009126; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TellTarget CMS Remote Inclusion produkte_nach_serie.php tt_docroot"; flow:established,to_server; content:"/produkte_nach_serie.php?"; http_uri; nocase; content:"tt_docroot="; http_uri; nocase; reference:cve,CVE-2007-2597; reference:url,www.milw0rm.com/exploits/3885; reference:url,doc.emergingthreats.net/2003707; classtype:web-application-attack; sid:2003707; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Nanspy Bot Checkin"; flow:established,to_server; content:"HEAD"; nocase; http_method; content:"/bbcount.php?action="; http_uri; content:"&uid="; http_uri; content:"&locale="; http_uri; content:"&build="; http_uri; reference:url,doc.emergingthreats.net/2010158; classtype:command-and-control; sid:2010158; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TellTarget CMS Remote Inclusion ref_kd_rubrik.php tt_docroot"; flow:established,to_server; content:"/functionen/ref_kd_rubrik.php?"; http_uri; nocase; content:"tt_docroot="; http_uri; nocase; reference:cve,CVE-2007-2597; reference:url,www.milw0rm.com/exploits/3885; reference:url,doc.emergingthreats.net/2003708; classtype:web-application-attack; sid:2003708; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Navipromo related update"; flow:established,to_client; content:"|0d 0a|Server|3a| lighttpd|0d 0a 0d 0a|<HTML><CFG>_SYSTEM_DIR_"; reference:url,doc.emergingthreats.net/2009694; classtype:trojan-activity; sid:2009694; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TellTarget CMS Remote Inclusion hg_referenz_jobgalerie.php tt_docroot"; flow:established,to_server; content:"/hg_referenz_jobgalerie.php?"; http_uri; nocase; content:"tt_docroot="; http_uri; nocase; reference:cve,CVE-2007-2597; reference:url,www.milw0rm.com/exploits/3885; reference:url,doc.emergingthreats.net/2003709; classtype:web-application-attack; sid:2003709; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Nine Ball Infection ya.ru Post"; flow:established,to_server; content:"POST"; http_method; nocase; content:"/gate/"; http_uri; content:".php"; http_uri; content:"|0d 0a 0d 0a|"; content:"ya.ru/"; distance:67; within:6; reference:url,www.martinsecurity.net/page/3; reference:url,doc.emergingthreats.net/2011186; classtype:trojan-activity; sid:2011186; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TellTarget CMS Remote Inclusion surfer_anmeldung_NWL.php tt_docroot"; flow:established,to_server; content:"/surfer_anmeldung_NWL.php?"; http_uri; nocase; content:"tt_docroot="; http_uri; nocase; reference:cve,CVE-2007-2597; reference:url,www.milw0rm.com/exploits/3885; reference:url,doc.emergingthreats.net/2003710; classtype:web-application-attack; sid:2003710; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NoBo Downloader Dropper GET"; flow:established,to_server; content:"GET"; nocase; http_method; content:"User-Agent|3a| NoBo"; http_header; reference:url,www.spynomore.com/trojan-nobo-v1-3.htm; reference:url,doc.emergingthreats.net/2009443; classtype:trojan-activity; sid:2009443; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TellTarget CMS Remote Inclusion produkte_nach_serie_alle.php tt_docroot"; flow:established,to_server; content:"/produkte_nach_serie_alle.php?"; http_uri; nocase; content:"tt_docroot="; http_uri; nocase; reference:cve,CVE-2007-2597; reference:url,www.milw0rm.com/exploits/3885; reference:url,doc.emergingthreats.net/2003711; classtype:web-application-attack; sid:2003711; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Obitel trojan calling home"; flow:established,to_server; content:"/gate.php?hash="; http_uri; content:"/gate.php?hash="; content:" HTTP/1."; distance:8; within:16; reference:url,www.abuse.ch/?p=143; reference:url,doc.emergingthreats.net/2008405; classtype:trojan-activity; sid:2008405; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TellTarget CMS Remote Inclusion surfer_aendern.php tt_docroot"; flow:established,to_server; content:"/surfer_aendern.php?"; http_uri; nocase; content:"tt_docroot="; http_uri; nocase; reference:cve,CVE-2007-2597; reference:url,www.milw0rm.com/exploits/3885; reference:url,doc.emergingthreats.net/2003712; classtype:web-application-attack; sid:2003712; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Oficla Russian Malware Bundle C&C instruction response with runurl"; flow:established,to_client; content:"|0d 0a 0d 0a|[info]runurl|3a|"; content:"|7c|taskid|3a|"; within:100; content:"|7c|delay|3a|"; within:30; content:"|7c|upd|3a|"; within:20; content:"[/info]"; distance:0; reference:url,malwarelab.org/2009/11/russian-malware-bundle/; reference:url,doc.emergingthreats.net/2010723; classtype:command-and-control; sid:2010723; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TellTarget CMS Remote Inclusion ref_kd_rubrik.php tt_docroot"; flow:established,to_server; content:"/ref_kd_rubrik.php?"; http_uri; nocase; content:"tt_docroot="; http_uri; nocase; reference:cve,CVE-2007-2597; reference:url,www.milw0rm.com/exploits/3885; reference:url,doc.emergingthreats.net/2003715; classtype:web-application-attack; sid:2003715; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Oficla Russian Malware Bundle C&C instruction response"; flow:established,to_client; content:"|0d 0a 0d 0a|[info]kill|3a|"; content:"|7c|delay|3a|"; within:50; content:"|7c|upd|3a|"; within:20; content:"[/info]"; distance:0; reference:url,malwarelab.org/2009/11/russian-malware-bundle/; reference:url,doc.emergingthreats.net/2010724; classtype:command-and-control; sid:2010724; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TellTarget CMS Remote Inclusion referenz.php tt_docroot"; flow:established,to_server; content:"/module/referenz.php?"; http_uri; nocase; content:"tt_docroot="; http_uri; nocase; reference:cve,CVE-2007-2597; reference:url,www.milw0rm.com/exploits/3885; reference:url,doc.emergingthreats.net/2003713; classtype:web-application-attack; sid:2003713; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Oficla Russian Malware Bundle C&C instruction response (2)"; flow:established,to_client; content:"|0d 0a 0d 0a|[info]delay|3a|"; content:"|7c|upd|3a|"; within:20; content:"[/info]"; distance:0; reference:url,malwarelab.org/2009/11/russian-malware-bundle/; reference:url,doc.emergingthreats.net/2010744; classtype:command-and-control; sid:2010744; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TellTarget CMS Remote Inclusion lay.php tt_docroot"; flow:established,to_server; content:"/standard/1/lay.php?"; http_uri; nocase; content:"tt_docroot="; http_uri; nocase; reference:cve,CVE-2007-2597; reference:url,www.milw0rm.com/exploits/3885; reference:url,doc.emergingthreats.net/2003714; classtype:web-application-attack; sid:2003714; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE onmuz.com Infection Activity"; flow:established,to_server; content:"pid=patchup_notpid_update^on"; http_uri; content:"/logonmuz"; http_uri; reference:url,doc.emergingthreats.net/2008973; classtype:trojan-activity; sid:2008973; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TellTarget CMS Remote Inclusion 3_lay.php tt_docroot"; flow:established,to_server; content:"/standard/3/lay.php?"; http_uri; nocase; content:"tt_docroot="; http_uri; nocase; reference:cve,CVE-2007-2597; reference:url,www.milw0rm.com/exploits/3885; reference:url,doc.emergingthreats.net/2003867; classtype:web-application-attack; sid:2003867; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Opachki Link Hijacker Traffic Redirection"; flow:established,to_server; content:"/?do=rphp"; nocase; http_uri; content:"&sub="; nocase; http_uri; content:"&b="; nocase; http_uri; content:"&q="; nocase; http_uri; content:"&orig="; nocase; http_uri; reference:url,www.secureworks.com/research/threats/opachki/?threat=opachki; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3aWin32%2fOpachki.A; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2009-092213-3317-99&tabid=2; reference:url,doc.emergingthreats.net/2010224; classtype:trojan-activity; sid:2010224; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ThWboard SQL Injection Attempt -- index.php board SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"board["; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/SELECT.+FROM/Ui"; reference:cve,CVE-2007-0340; reference:url,www.milw0rm.com/exploits/3124; reference:url,doc.emergingthreats.net/2005567; classtype:web-application-attack; sid:2005567; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Prg Trojan HTTP POST v1"; flow:established,to_server; content:"POST"; nocase; http_method; content:".php?2="; http_uri; content:"&n="; http_uri; content:"&v="; http_uri; content:"&i="; http_uri; content:"&sp="; http_uri; content:"&lcp="; http_uri; reference:url,www.securescience.net/FILES/securescience/10378/pubMalwareCaseStudy.pdf; reference:url,doc.emergingthreats.net/2007688; classtype:trojan-activity; sid:2007688; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ThWboard SQL Injection Attempt -- index.php board UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"board["; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/UNION\s+SELECT/Ui"; reference:cve,CVE-2007-0340; reference:url,www.milw0rm.com/exploits/3124; reference:url,doc.emergingthreats.net/2005568; classtype:web-application-attack; sid:2005568; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Prg Trojan HTTP POST version 2"; flow:established,to_server; content:"POST"; nocase; http_method; content:".php?1="; http_uri; content:"&i="; http_uri; pcre:"/\.php\?1=[a-z0-9]+_[a-z0-9_]+&i=/Ui"; reference:url,www.securescience.net/FILES/securescience/10378/pubMalwareCaseStudy.pdf; reference:url,doc.emergingthreats.net/2007724; classtype:trojan-activity; sid:2007724; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ThWboard SQL Injection Attempt -- index.php board INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"board["; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/INSERT.+INTO/Ui"; reference:cve,CVE-2007-0340; reference:url,www.milw0rm.com/exploits/3124; reference:url,doc.emergingthreats.net/2005569; classtype:web-application-attack; sid:2005569; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET 82 (msg:"ET MALWARE LD Pinch Checkin (HTTP POST on port 82)"; flow:established,to_server; content:"POST"; nocase; http_method; content:".php"; content:"a="; content:"&b="; content:"&d="; content:"&c="; nocase; reference:url,doc.emergingthreats.net/2008366; classtype:command-and-control; sid:2008366; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ThWboard SQL Injection Attempt -- index.php board ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"board["; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-0340; reference:url,www.milw0rm.com/exploits/3124; reference:url,doc.emergingthreats.net/2005571; classtype:web-application-attack; sid:2005571; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan-PWS.Win32.VB.tr Checkin Detected"; flow:established,to_server; content:"POST"; nocase; http_method; content:".asp"; http_uri; content:"id="; content:"&tit="; content:"&comm"; content:"Run|2B|Successfully"; fast_pattern; reference:url,doc.emergingthreats.net/2008506; classtype:command-and-control; sid:2008506; rev:9; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ThWboard SQL Injection Attempt -- index.php board UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"board["; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/UPDATE.+SET/Ui"; reference:cve,CVE-2007-0340; reference:url,www.milw0rm.com/exploits/3124; reference:url,doc.emergingthreats.net/2005572; classtype:web-application-attack; sid:2005572; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Generic PSW Agent server reply"; flow:from_server,established; content:"200"; http_stat_code; content:"OK"; http_stat_msg; content:"|0d 0a|[Uptade]|0d 0a|Web="; content:"|0d 0a|[Guncellestirme]|0d 0a|Version="; within:100; reference:url,doc.emergingthreats.net/2008662; classtype:trojan-activity; sid:2008662; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Apache Tomcat XSS Attempt -- implicit-objects.jsp"; flow:established,to_server; content:"/implicit-objects.jsp?"; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2006-7195; reference:url,www.frsirt.com/english/advisories/2007/1729; reference:url,doc.emergingthreats.net/2003902; classtype:web-application-attack; sid:2003902; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PassSickle Reporting User Activity"; flow:established,to_server; content:".php?id="; nocase; http_uri; content:"&data="; nocase; http_uri; content:"PassSickle"; http_header; nocase; pcre:"/^User-Agent\:[^\n]+PassSickle/Hmi"; reference:url,doc.emergingthreats.net/2002859; classtype:trojan-activity; sid:2002859; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Tomcat XSS Attempt -- hello.jsp test"; flow:established,to_server; content:"/appdev/sample/web/hello.jsp?"; http_uri; nocase; content:"test="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/.*<?(java|vb)?script>?.*<.+\/script>?/iU"; reference:cve,CVE-2007-1355; reference:url,www.securityfocus.com/bid/24058; reference:url,doc.emergingthreats.net/2004575; classtype:web-application-attack; sid:2004575; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Pasta Downloader - GET Checkin to Fake GIF"; flow:established,to_server; content:"GET"; nocase; http_method; content:".gif?"; content:!"c.gif?"; nocase; http_uri; content:!"__utm.gif?"; http_uri; nocase; http_uri; content:"t="; nocase; http_uri; content:"q="; nocase; http_uri; content:"p="; nocase; http_uri; content:"pn="; nocase; http_uri; reference:url,malwarebytes.org/malwarenet.php?name=Trojan.Pasta; reference:url,doc.emergingthreats.net/2009522; classtype:command-and-control; sid:2009522; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TopTree Remote Inclusion Attempt -- tpl_message.php right_file"; flow:established,to_server; content:"/templates/default/tpl_message.php?"; http_uri; nocase; content:"right_file="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2544; reference:url,www.milw0rm.com/exploits/3854; reference:url,doc.emergingthreats.net/2003669; classtype:web-application-attack; sid:2003669; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Personal Defender 2009 - prinimalka.py"; flow:established,to_server; content:"/prinimalka.py"; http_uri; reference:url,malwarebytes.besttechie.net/2008/11/03/removal-instructions-for-personal-defender-2009/; reference:url,doc.emergingthreats.net/2009405; classtype:trojan-activity; sid:2009405; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TotalCalendar config.php inc_dir Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/config.php?"; http_uri; nocase; content:"inc_dir="; http_uri; nocase; pcre:"/inc_dir=\s*(https?|ftps?|php)\:\//Ui"; reference:bugtraq,34617; reference:url,milw0rm.com/exploits/8494; reference:url,doc.emergingthreats.net/2009663; classtype:web-application-attack; sid:2009663; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Personal Defender 2009 - trash.py"; flow:established,to_server; content:"/trash.py"; http_uri; reference:url,malwarebytes.besttechie.net/2008/11/03/removal-instructions-for-personal-defender-2009/; reference:url,doc.emergingthreats.net/2009406; classtype:trojan-activity; sid:2009406; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Track+ XSS Attempt -- reportItem.do projId"; flow:established,to_server; content:"/reportItem.do?"; http_uri; nocase; content:"projId="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/.*<?(java|vb)?script>?.*<.+\/script>?/iU"; reference:cve,CVE-2007-2819; reference:url,www.securityfocus.com/bid/24060; reference:url,doc.emergingthreats.net/2004558; classtype:web-application-attack; sid:2004558; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Piptea.a Related Trojan Checkin (3)"; flow:established,to_server; content:"/cd/un.php?id="; http_uri; content:"&ver="; http_uri; pcre:"/\/cd\/un\.php.id=[A-F0-9\-]+&ver=/U"; reference:url,doc.emergingthreats.net/2008384; classtype:command-and-control; sid:2008384; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Tropicalm Remote Inclusion Attempt -- dosearch.php RESPATH"; flow:established,to_server; content:"/dosearch.php?"; http_uri; nocase; content:"RESPATH="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2530; reference:url,www.milw0rm.com/exploits/3865; reference:url,doc.emergingthreats.net/2003678; classtype:web-application-attack; sid:2003678; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Pointfree.co.kr Trojan/Spyware Infection Checkin"; flow:established,to_server; content:"log.php?mac="; http_uri; content:"&hdd="; content:"&ver="; http_uri; content:"&ie="; http_uri; content:"&win="; http_uri; reference:url,doc.emergingthreats.net/2008972; classtype:command-and-control; sid:2008972; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Turnkey Arcade Script id parameter SQL injection"; flow:to_server,established; content:"GET "; depth:4; content:"/index.php?"; http_uri; nocase; content:"action=play"; http_uri; nocase; content:"id="; http_uri; nocase; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/UNION.+SELECT/Ui"; reference:url,secunia.com/advisories/32890/; reference:url,milw0rm.com/exploits/7256; reference:url,doc.emergingthreats.net/2008934; classtype:web-application-attack; sid:2008934; rev:4; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Proxy.Win32.Agent.mx CnC Beacon"; flow:established,to_server; content:"q.php"; nocase; http_uri; content:"&m="; nocase; http_uri; content:"&a="; nocase; http_uri; content:"&x="; nocase; http_uri; content:"&i="; nocase; http_uri; reference:url,doc.emergingthreats.net/2006405; classtype:command-and-control; sid:2006405; rev:4; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2010_07_30, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TurnKeyWebTools Remote Inclusion Attempt -- payflow_pro.php abs_path"; flow:established,to_server; content:"/include/payment/payflow_pro.php?"; http_uri; nocase; content:"abs_path="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2474; reference:url,www.securityfocus.com/bid/23662; reference:url,doc.emergingthreats.net/2003687; classtype:web-application-attack; sid:2003687; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Pushdo Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"m="; http_uri; content:"&a="; http_uri; content:"&os="; http_uri; pcre:"/&os=[a-f0-9]{50}/U"; reference:url,doc.emergingthreats.net/2008493; classtype:command-and-control; sid:2008493; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TurnKeyWebTools Remote Inclusion Attempt -- global.php abs_path"; flow:established,to_server; content:"/global.php?"; http_uri; nocase; content:"abs_path="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2474; reference:url,www.securityfocus.com/bid/23662; reference:url,doc.emergingthreats.net/2003688; classtype:web-application-attack; sid:2003688; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Qhosts Trojan Check-in"; flow:established,to_server; content:"POST"; nocase; http_method; content:".php"; http_uri; content:"UserID="; http_client_body; content:"&wv="; http_client_body; content:"&res="; http_client_body; content:"&lng="; http_client_body; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2003-100116-5901-99; reference:url,doc.emergingthreats.net/2009517; classtype:trojan-activity; sid:2009517; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TurnKeyWebTools Remote Inclusion Attempt -- libsecure.php abs_path"; flow:established,to_server; content:"/libsecure.php?"; http_uri; nocase; content:"abs_path="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2474; reference:url,www.securityfocus.com/bid/23662; reference:url,doc.emergingthreats.net/2003689; classtype:web-application-attack; sid:2003689; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Rcash.co.kr Bootup Checkin via HTTP"; flow:established,to_server; content:"/install/Boot.asp?macaddr="; nocase; http_uri; content:"&partner="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007807; classtype:command-and-control; sid:2007807; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TurnkeyWebTools SunShop Shopping Cart XSS Attempt -- index.php l"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"l="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2547; reference:url,www.securityfocus.com/bid/23856; reference:url,doc.emergingthreats.net/2003917; classtype:web-application-attack; sid:2003917; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Renos/ssd.com HTTP Checkin"; flow:established,to_server; content:"/dlp.php?"; nocase; http_uri; content:"&m="; nocase; http_uri; content:"&ydf="; nocase; http_uri; content:"&e="; nocase; http_uri; content:"&w=___"; nocase; http_uri; content:"&t="; nocase; http_uri; content:"&apzx="; nocase; http_uri; content:"&apz="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007834; classtype:command-and-control; sid:2007834; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TutorialCMS (Photoshop Tutorials) XSS Attempt -- browseCat.php catFile"; flow:established,to_server; content:"/browseCat.php?"; http_uri; nocase; content:"catFile="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2600; reference:url,www.milw0rm.com/exploits/3887; reference:url,doc.emergingthreats.net/2003888; classtype:web-application-attack; sid:2003888; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE RhiFrem Trojan Activity - cmd"; flow:to_server,established; content:"GET"; nocase; http_method; content:"?mod=cmd&user="; http_uri; content:"User-Agent|3A|  Mozilla/5.0 Gecko/20050212 Firefox/1.5.0.2"; http_header; pcre:"/^GET\x20[^\x0D\x0A]+\x3Fmod\x3Dcmd\x26user\x3D\w+[^\x0D\x0A]*\x20HTTP\x2F1\x2E0\x0D\x0A.*\x0D\x0AHost\x3A\x20\w+/"; reference:url,www.castlecops.com/U_S_Courts_phish792683.html; reference:url,doc.emergingthreats.net/2008139; classtype:trojan-activity; sid:2008139; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TutorialCMS (Photoshop Tutorials) XSS Attempt -- browseSubCat.php catFile"; flow:established,to_server; content:"/browseSubCat.php?"; http_uri; nocase; content:"catFile="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2600; reference:url,www.milw0rm.com/exploits/3887; reference:url,doc.emergingthreats.net/2003889; classtype:web-application-attack; sid:2003889; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE RhiFrem Trojan Activity - log"; flow:to_server,established; content:"POST"; nocase; http_method; content:"?mod=log&user="; fast_pattern; http_uri; content:"User-Agent|3A| Mozilla/5.0 Gecko/20050212 Firefox/1.5.0.2"; http_header; pcre:"/^POST\x20[^\x0D\x0A]+\x3Fmod\x3Dlog\x26user\x3D\w+[^\x0D\x0A]*\x20HTTP\x2F1\x2E0\x0D\x0A.*\x0D\x0AHost\x3A\x20\w+.*\x0D\x0A\x0D\x0Acurr\x3D.*\x26next\x3D/"; reference:url,www.castlecops.com/U_S_Courts_phish792683.html; reference:url,doc.emergingthreats.net/2008140; classtype:trojan-activity; sid:2008140; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TutorialCMS (Photoshop Tutorials) XSS Attempt -- openTutorial.php id"; flow:established,to_server; content:"/openTutorial.php?"; http_uri; nocase; content:"id="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2600; reference:url,www.milw0rm.com/exploits/3887; reference:url,doc.emergingthreats.net/2003890; classtype:web-application-attack; sid:2003890; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Fake AV CnC Checkin cycle_report"; flow:established,to_server; content:"POST"; http_method; content:"/cgi-bin/cycle_report.cgi?type=g"; nocase; http_uri; reference:md5,fa078834dd3b4c6604d12823a6f9f17e; classtype:command-and-control; sid:2011820; rev:3; metadata:created_at 2010_10_15, former_category MALWARE, updated_at 2010_10_15;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TutorialCMS (Photoshop Tutorials) XSS Attempt -- topFrame.php id"; flow:established,to_server; content:"/topFrame.php?"; http_uri; nocase; content:"id="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2600; reference:url,www.milw0rm.com/exploits/3887; reference:url,doc.emergingthreats.net/2003891; classtype:web-application-attack; sid:2003891; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Comotor.A!dll Reporting 2"; flow:to_server,established; content:"GET"; nocase; http_method; content:"/cy/dl.php"; nocase; http_uri; content:"id="; http_uri; nocase; reference:md5,5e1c680e70e423dd02e31ab9d689e40b; reference:url,microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FComotor.A!dll&ThreatID=-2147346593; classtype:trojan-activity; sid:2011849; rev:4; metadata:created_at 2010_10_25, updated_at 2010_10_25;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TutorialCMS (Photoshop Tutorials) XSS Attempt -- editListing.php id"; flow:established,to_server; content:"/admin/editListing.php?"; http_uri; nocase; content:"id="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2600; reference:url,www.milw0rm.com/exploits/3887; reference:url,doc.emergingthreats.net/2003892; classtype:web-application-attack; sid:2003892; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely Hostile HTTP Header GET structure"; flow:established,to_server; content:"GET"; nocase; http_method; content:"|20|HTTP/1.0|0d 0a|User-Agent|3a 20|"; fast_pattern; content:".php"; nocase; http_uri; content:"|0d 0a|Host|3a 20|"; content:"|0d 0a|Pragma|3a| no-cache|0d 0a|"; distance:0; content:!"|0d 0a|Host|3a| update.nai.com"; distance:0; content:!"|0d 0a|Host|3a 20|toolbarqueries.google."; http_header; content:!".ceipmsn.com|0d 0a|Pragma|3a 20|"; http_header; content:!"Host|3a| stats.mbamupdates.com|0d 0a|"; http_header; classtype:trojan-activity; sid:2011858; rev:12; metadata:created_at 2010_10_27, updated_at 2010_10_27;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TutorialCMS (Photoshop Tutorials) XSS Attempt -- search.php search"; flow:established,to_server; content:"/search.php?"; http_uri; nocase; content:"search="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2600; reference:url,www.milw0rm.com/exploits/3887; reference:url,doc.emergingthreats.net/2003893; classtype:web-application-attack; sid:2003893; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Feodo Banking Trojan Account Details Post"; flow:established,to_server; content:"POST"; nocase; http_method; content:"AccountSummary"; nocase; fast_pattern; content:"userid|3A|"; nocase; distance:0; content:"password|3A|"; nocase; distance:0; content:"screenid|3A|"; nocase; distance:0; content:"origination|3A|"; nocase; distance:0; reference:url,blog.fireeye.com/research/2010/10/feodosoff-a-new-botnet-on-the-rise.html#more; classtype:trojan-activity; sid:2011862; rev:4; metadata:created_at 2010_10_28, updated_at 2010_10_28;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS TWiki INCLUDE remote command execution attempt"; flow:to_server,established; content:"INCLUDE"; http_uri; nocase; pcre:"/%INCLUDE\s*{.*rev=\"\d+\|.+\".*}\s*%/i"; reference:bugtraq,14960; reference:url,doc.emergingthreats.net/2002662; classtype:web-application-attack; sid:2002662; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Krap.ar Infection URL Request"; flow:established,to_server; content:"type="; http_uri; nocase; content:"email="; http_uri; nocase; content:"hwinfo="; http_uri; nocase; reference:md5,df29b9866397fd311a5259c5d4bc00dd; classtype:trojan-activity; sid:2012076; rev:2; metadata:created_at 2010_12_18, updated_at 2010_12_18;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED TxtBlog index.php m Parameter Local File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/index.php?m="; http_uri; nocase; pcre:"/(\.\.\/){1,}/U"; reference:bugtraq,32498; reference:url,milw0rm.com/exploits/7241; reference:url,doc.emergingthreats.net/2008923; classtype:web-application-attack; sid:2008923; rev:4; metadata:affected_product Web_Server_Applications, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Local_File_Inclusion, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.BackDoor-DRV.gen.c Reporting-2"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/zok.php?"; nocase; http_uri; content:"username="; nocase; http_uri; content:"url="; nocase; http_uri; content:"sid="; nocase; http_uri; content:"tm="; nocase; http_uri; content:"hlto="; http_uri; nocase; reference:md5,d5ff6df296c068fcc0ddd303984fa6b9; classtype:trojan-activity; sid:2012114; rev:3; metadata:created_at 2010_12_30, former_category MALWARE, updated_at 2010_12_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Ultrastats serverid parameter SQL Injection"; flow:to_server,established; content:"GET "; depth:4; content:"/index.php?"; http_uri; nocase; content:"serverid="; http_uri; nocase; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/UNION.+SELECT/Ui"; reference:bugtraq,32340; reference:url,milw0rm.com/exploits/7148; reference:url,doc.emergingthreats.net/2008872; classtype:web-application-attack; sid:2008872; rev:4; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Storm/Waledac 3.0 Checkin 1"; flow:established,to_server; content:"GET"; nocase; http_method; content:".htm"; http_uri; content:"Host|3a| "; http_header; content:"Content-Length|3a| "; http_header; content:".htm HTTP/1.1"; pcre:"/Host\x3a [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/"; pcre:"/Content-Length\x3a [1-9]/"; classtype:command-and-control; sid:2012137; rev:5; metadata:created_at 2011_01_05, former_category MALWARE, updated_at 2011_01_05;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Ultrize TimeSheet timesheet.php include_dir Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/include/timesheet.php?"; http_uri; nocase; content:"config[include_dir]="; http_uri; pcre:"/config\[include_dir\]=\s*(https?|ftps?|php)\:\//Ui"; reference:url,milw0rm.com/exploits/9297; reference:url,secunia.com/advisories/36033/; reference:url,doc.emergingthreats.net/2010126; classtype:web-application-attack; sid:2010126; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spy Banker Outbound Communication Attempt"; flow:established,to_server; content:"praquem="; nocase; content:"titulo="; distance:0; nocase; content:"Dir+System32"; nocase; distance:0; reference:md5,58b3c37b61d27cdc0a55321f4c12ef04; classtype:trojan-activity; sid:2012225; rev:4; metadata:created_at 2011_01_24, updated_at 2011_01_24;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS VM Watermark Remote Inclusion Attempt -- watermark.php GALLERY_BASEDIR"; flow:established,to_server; content:"/watermark.php?"; http_uri; nocase; content:"GALLERY_BASEDIR="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2575; reference:url,www.milw0rm.com/exploits/3857; reference:url,doc.emergingthreats.net/2003692; classtype:web-application-attack; sid:2003692; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Banbra Banking Trojan Communication"; flow:established,to_server; content:"para="; nocase; content:"titulo="; nocase; distance:0; content:"mensagem="; nocase; distance:0; reference:md5,7ce03717d6879444d8e45b7cf6470c67; classtype:trojan-activity; sid:2012226; rev:4; metadata:created_at 2011_01_24, updated_at 2011_01_24;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS VP-ASP Shopping Cart XSS Attempt -- shopcontent.asp type"; flow:established,to_server; content:"/shopcontent.asp?"; http_uri; nocase; content:"type="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/.*<?(java|vb)?script>?.*<.+\/script>?/iU"; reference:cve,CVE-2007-2790; reference:url,www.securityfocus.com/archive/1/archive/1/468834/100/0/threaded; reference:url,doc.emergingthreats.net/2004573; classtype:web-application-attack; sid:2004573; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Hupigon.AZG Checkin"; flow:established,to_server; content:"GET"; http_method; nocase; content:"User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)|0d 0a|"; http_header; nocase; content:"eve="; nocase; http_uri; content:"username="; nocase; http_uri; content:"anma="; nocase; http_uri; content:"ver="; nocase; http_uri; reference:url,www.pandasecurity.com/homeusers/security-info/about-malware/encyclopedia/overview.aspx?idvirus=143511&sind=0; reference:url,vil.nai.com/vil/content/v_145056.htm; reference:url,doc.emergingthreats.net/2008515; classtype:command-and-control; sid:2008515; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHP VWar Remote File Inclusion get_header.php"; flow:established,to_server; content:"/get_header.php"; http_uri; nocase; pcre:"/vwar_root=\s*(ftps?|https?|php)\:\//Ui"; reference:url,www.milw0rm.com/exploits/1632; reference:cve,2006-1636; reference:bugtraq,17358; reference:url,doc.emergingthreats.net/2002899; classtype:web-application-attack; sid:2002899; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32 Troxen Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/report3.ashx?"; http_uri; nocase; content:"m="; nocase; http_uri; content:"mid="; nocase; http_uri; content:"d="; nocase; http_uri; content:"uid="; http_uri; nocase; reference:url,microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3aWin32/Troxen!rts; reference:md5,664a5147e6258f10893c3fd375f16ce4; classtype:trojan-activity; sid:2012289; rev:4; metadata:created_at 2011_02_04, updated_at 2011_02_04;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHP VWar Remote File Inclusion functions_install.php"; flow:established,to_server; content:"/functions_install.php"; http_uri; nocase; pcre:"/vwar_root=\s*(ftps?|https?|php)\:\//Ui"; reference:cve,2006-1503; reference:bugtraq,17290; reference:url,doc.emergingthreats.net/2002902; classtype:web-application-attack; sid:2002902; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spy.Win32.Agent.bijs Reporting 1"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/app/count/inst.php?"; http_uri; nocase; content:"ucode="; nocase; http_uri; content:"pcode="; http_uri; nocase; reference:md5,846ac24b003c6d468a833bff58db5f5c; classtype:trojan-activity; sid:2012290; rev:4; metadata:created_at 2011_02_04, updated_at 2011_02_04;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Versado CMS Remote Inclusion Attempt -- ajax_listado.php urlModulo"; flow:established,to_server; content:"/includes/ajax_listado.php?"; http_uri; nocase; content:"urlModulo="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2541; reference:url,www.milw0rm.com/exploits/3847; reference:url,doc.emergingthreats.net/2003671; classtype:web-application-attack; sid:2003671; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spy.Win32.Agent.bijs Reporting 2"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/app/count/boot.php?"; nocase; http_uri; content:"ucode="; nocase; http_uri; content:"pcode="; nocase; http_uri; reference:md5,846ac24b003c6d468a833bff58db5f5c; classtype:trojan-activity; sid:2012288; rev:4; metadata:created_at 2011_02_04, updated_at 2011_02_04;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS VirtueMart Google Base Component admin.googlebase.php Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/admin.googlebase.php?"; http_uri; nocase; content:"mosConfig_absolute_path="; http_uri; nocase; pcre:"/mosConfig_absolute_path=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,32098; reference:url,milw0rm.com/exploits/6975; reference:url,doc.emergingthreats.net/2009877; classtype:web-application-attack; sid:2009877; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Tatanga Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:".php?build="; http_uri; content:"&id="; http_uri; content:"&SA=1-0"; http_uri; content:"&SP=1-"; http_uri; reference:url,securityblog.s21sec.com/2011/02/tatanga-new-banking-trojan-with-mitb.html; reference:url,www.sophos.com/security/analyses/viruses-and-spyware/trojtatangac.html; reference:url,support.clean-mx.de/clean-mx/view_joebox.php?md5=4b5eb54de32f86819c638878ac2c7985&id=740958; reference:url,www.malware-control.com/statics-pages/06198e9b72e1bb0c256769c5754ed821.php; classtype:command-and-control; sid:2012391; rev:3; metadata:created_at 2011_02_28, former_category MALWARE, updated_at 2011_02_28;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Vizayn Urun Tanitim Sitesi SQL Injection Attempt -- default.asp id SELECT"; flow:established,to_server; content:"/default.asp?"; http_uri; nocase; content:"id="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-2803; reference:url,www.secunia.com/advisories/25348; reference:url,doc.emergingthreats.net/2003993; classtype:web-application-attack; sid:2003993; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Vilsel.akd Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/app_count/ag4_del_count.php?"; nocase; http_uri; content:"mac="; nocase; http_uri; content:"pid="; nocase; http_uri; reference:md5,2d6cede13913b17bc2ea7c7f70ce5fa8; classtype:trojan-activity; sid:2012439; rev:4; metadata:created_at 2011_03_08, updated_at 2011_03_08;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Vizayn Urun Tanitim Sitesi SQL Injection Attempt -- default.asp id UNION SELECT"; flow:established,to_server; content:"/default.asp?"; http_uri; nocase; content:"id="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-2803; reference:url,www.secunia.com/advisories/25348; reference:url,doc.emergingthreats.net/2003994; classtype:web-application-attack; sid:2003994; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.Win32.Agent.bqkb Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/updata/"; nocase; http_uri; content:"lg1="; nocase; http_uri; content:"lg2="; nocase; http_uri; content:"lg3="; nocase; http_uri; content:"lg5="; nocase; http_uri; content:"lg6="; nocase; http_uri; content:"lg7="; nocase; http_uri; reference:md5,de85ae919d48325189bead995e8052e7; classtype:trojan-activity; sid:2012440; rev:4; metadata:created_at 2011_03_08, former_category MALWARE, updated_at 2011_03_08;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Vizayn Urun Tanitim Sitesi SQL Injection Attempt -- default.asp id INSERT"; flow:established,to_server; content:"/default.asp?"; http_uri; nocase; content:"id="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-2803; reference:url,www.secunia.com/advisories/25348; reference:url,doc.emergingthreats.net/2003995; classtype:web-application-attack; sid:2003995; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Monkif Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/photo/"; http_uri; content:"6x5x5772=712x5772=716x"; http_uri; classtype:command-and-control; sid:2012505; rev:4; metadata:created_at 2011_03_15, former_category MALWARE, updated_at 2011_03_15;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Vizayn Urun Tanitim Sitesi SQL Injection Attempt -- default.asp id DELETE"; flow:established,to_server; content:"/default.asp?"; http_uri; nocase; content:"id="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-2803; reference:url,www.secunia.com/advisories/25348; reference:url,doc.emergingthreats.net/2003996; classtype:web-application-attack; sid:2003996; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Rimecud.B Activity"; flow:to_server,established; content:"POST"; nocase; http_method; content:"&acc=ups"; http_uri; content:"&nick="; http_uri; content:"&botver=Beta&code="; http_uri; content:"User-Agent|3a 20|"; nocase; http_header; content:"|3b 20|es-ES|3b|"; distance:39; http_header; content:"plist|3d 2d 2d 2d|"; depth:9; http_client_body; content:"Passwords"; distance:0; http_client_body; reference:md5,01dd7102b9d36ec8556eed2909b74f52; classtype:trojan-activity; sid:2012517; rev:2; metadata:created_at 2011_03_17, updated_at 2011_03_17;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Vizayn Urun Tanitim Sitesi SQL Injection Attempt -- default.asp id ASCII"; flow:established,to_server; content:"/default.asp?"; http_uri; nocase; content:"id="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-2803; reference:url,www.secunia.com/advisories/25348; reference:url,doc.emergingthreats.net/2003997; classtype:web-application-attack; sid:2003997; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan-Spy.Win32.Zbot.djrm Checkin"; flow:to_server,established; content:"/index.html?mac="; http_uri; content:"&ver="; http_uri; content:"&os="; http_uri; content:"&dtime="; fast_pattern; http_uri; content:"User-Agent|3a| baidu|0d 0a|"; http_header; reference:md5,b895249cce7d2c27cb9c480feb36560c; reference:md5,f70a5f52d4c0071963602c25b62865cb; classtype:command-and-control; sid:2014399; rev:3; metadata:created_at 2012_03_15, former_category MALWARE, updated_at 2012_03_15;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED Way Of The Warrior crea.php plancia Parameter Local File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"crea.php?"; http_uri; nocase; content:"plancia="; http_uri; nocase; pcre:"/(\.\.\/){1,}/U"; reference:url,secunia.com/advisories/32515/; reference:url,milw0rm.com/exploits/6992; reference:url,doc.emergingthreats.net/2008825; classtype:web-application-attack; sid:2008825; rev:4; metadata:affected_product Web_Server_Applications, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Local_File_Inclusion, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PWS-Banker.gen.b Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/curubacom.php?"; http_uri; nocase; content:"op="; http_uri; nocase; reference:md5,e3fdf31ce57b3807352971a62f85c55b; classtype:trojan-activity; sid:2012592; rev:5; metadata:created_at 2011_03_28, updated_at 2011_03_28;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Way Of The Warrior crea.php plancia Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"crea.php?"; http_uri; nocase; content:"plancia="; http_uri; nocase; pcre:"/plancia=\s*(ftps?|https?|php)\:\//Ui"; reference:url,secunia.com/advisories/32515/; reference:url,milw0rm.com/exploits/6992; reference:url,doc.emergingthreats.net/2008826; classtype:web-application-attack; sid:2008826; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Best Spyware Scanner FaveAV Download"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/BestSpywareScanner_Setup.exe"; nocase; http_uri; classtype:trojan-activity; sid:2012590; rev:5; metadata:created_at 2011_03_28, updated_at 2011_03_28;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS WeBid cron.php include_path Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/cron.php?"; http_uri; nocase; content:"include_path="; http_uri; nocase; pcre:"/include_path=\s*(https?|ftps?|php)\:\//Ui"; reference:url,milw0rm.com/exploits/8195; reference:bugtraq,34074; reference:url,doc.emergingthreats.net/2009307; classtype:web-application-attack; sid:2009307; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan-Downloader.Win32.Small Checkin"; flow:to_server,established; content:"GET"; http_method; nocase; content:"|2e|ashx|3f|m|3d|"; http_uri; content:"|2d|"; distance:2; within:1; http_uri; content:"|26|mid|3d|"; http_uri; distance:0; content:"|26|tid|3d|"; http_uri; distance:0; content:"|26|d|3d|"; http_uri; distance:0; content:"|26|uid|3d|"; http_uri; distance:0; content:"|26|t|3d|"; http_uri; distance:0; reference:md5,48432bdd116dccb684c8cef84579b963; classtype:command-and-control; sid:2012839; rev:4; metadata:created_at 2011_05_23, former_category MALWARE, updated_at 2011_05_23;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS WeBid ST_browsers.php include_path Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/ST_browsers.php?"; http_uri; nocase; content:"include_path="; http_uri; nocase; pcre:"/include_path=\s*(https?|ftps?|php)\:\//Ui"; reference:url,milw0rm.com/exploits/8195; reference:bugtraq,34074; reference:url,doc.emergingthreats.net/2009309; classtype:web-application-attack; sid:2009309; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gozi posting form data"; flow:established,to_server; content:"POST"; nocase; http_method; content:"name=\"upload_file\""; http_client_body; content:"URL|3a|"; http_client_body; classtype:trojan-activity; sid:2012871; rev:4; metadata:created_at 2011_05_27, updated_at 2011_05_27;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS WeBid ST_countries.php include_path Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/ST_countries.php?"; http_uri; nocase; content:"include_path="; http_uri; nocase; pcre:"/include_path=\s*(https?|ftps?|php)\:\//Ui"; reference:url,milw0rm.com/exploits/8195; reference:bugtraq,34074; reference:url,doc.emergingthreats.net/2009311; classtype:web-application-attack; sid:2009311; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Generic adClicker Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"web"; http_uri; content:"getinfo"; http_uri; content:".aspx?"; http_uri; content:"ver="; http_uri; content:"User-Agent|3a| Microsoft Internet Explorer"; http_header; classtype:command-and-control; sid:2012934; rev:4; metadata:created_at 2011_06_06, former_category MALWARE, updated_at 2011_06_06;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS WeBid ST_platforms.php include_path Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/ST_platforms.php?"; http_uri; nocase; content:"include_path="; http_uri; nocase; pcre:"/include_path=\s*(https?|ftps?|php)\:\//Ui"; reference:url,milw0rm.com/exploits/8195; reference:bugtraq,34074; reference:url,doc.emergingthreats.net/2009313; classtype:web-application-attack; sid:2009313; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE WebToolbar.Win32.WhenU.r Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/prod/MEADInst.exe"; http_uri; nocase; reference:md5,27867435a1b6b3f35daf13faac6f77b7; classtype:trojan-activity; sid:2013034; rev:4; metadata:created_at 2011_06_16, updated_at 2011_06_16;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS webCalendar Remote File include"; flow: to_server,established; content:"includedir="; http_uri; pcre:"/\/ws\/(login|get_reminders|get_events)\.php/"; reference:url,www.securityfocus.com/archive/1/462957; reference:url,doc.emergingthreats.net/2003520; classtype:web-application-attack; sid:2003520; rev:9; metadata:affected_product Any, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Remote_File_Include, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dropper.MSIL.Agent.ate Checkin"; flow:established,to_server; content:"GET"; http_method; nocase; content:"/bot.php?"; http_uri; content:"hwid="; http_uri; content:"pcname="; http_uri; reference:md5,4860e53b7e71cd57956e10ef48342b5f; classtype:command-and-control; sid:2013071; rev:4; metadata:created_at 2011_06_21, former_category MALWARE, updated_at 2011_06_21;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS WebMplayer SQL Injection Attempt -- index.php strid SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"strid="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/SELECT.+FROM/Ui"; reference:cve,CVE-2007-1135; reference:url,www.securityfocus.com/bid/22726; reference:url,doc.emergingthreats.net/2004754; classtype:web-application-attack; sid:2004754; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Cridex.B/Feodo Checkin"; flow:to_server,established; content:"POST"; nocase; http_method; content:"/in"; offset:11; depth:3; http_uri; content:".ru"; http_header; pcre:"/\/\w{3}\/\w\d_\w\w\w\/in\/?$/Ui"; pcre:"/Host\x3a\s[a-z]{15,19}\.ru(\x3a8080)?/Hm"; reference:md5,7ed139b53e24e4385c4c59cd2aa0e5f7; reference:url,labs.m86security.com/2012/03/the-cridex-trojan-targets-137-financial-organizations-in-one-go/; reference:url,blog.fireeye.com/research/2010/10/feodosoff-a-new-botnet-on-the-rise.html; reference:url,about-threats.trendmicro.com/Malware.aspx?language=us&name=WORM_CRIDEX.IC; classtype:command-and-control; sid:2014405; rev:10; metadata:created_at 2012_02_29, former_category MALWARE, updated_at 2012_02_29;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS WebMplayer SQL Injection Attempt -- index.php strid UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"strid="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/UNION\s+SELECT/Ui"; reference:cve,CVE-2007-1135; reference:url,www.securityfocus.com/bid/22726; reference:url,doc.emergingthreats.net/2004755; classtype:web-application-attack; sid:2004755; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/VB.HV Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/popcode.php?aid="; http_uri; content:"&lc="; http_uri; content:"&domain="; http_uri; reference:url,microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDropper%3AWin32%2FVB.HV; classtype:command-and-control; sid:2013456; rev:5; metadata:created_at 2011_08_24, former_category MALWARE, updated_at 2011_08_24;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS WebMplayer SQL Injection Attempt -- index.php strid INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"strid="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/INSERT.+INTO/Ui"; reference:cve,CVE-2007-1135; reference:url,www.securityfocus.com/bid/22726; reference:url,doc.emergingthreats.net/2004756; classtype:web-application-attack; sid:2004756; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NgrBot IRC CnC Channel Join"; flow:established,to_server; content:"PASS ngrBot"; content:"NICK"; distance:0; reference:url,stopmalvertising.com/rootkits/analysis-of-ngrbot.html; classtype:command-and-control; sid:2013451; rev:3; metadata:created_at 2011_08_24, former_category MALWARE, updated_at 2011_08_24;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS WebMplayer SQL Injection Attempt -- index.php strid DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"strid="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/DELETE.+FROM/Ui"; reference:cve,CVE-2007-1135; reference:url,www.securityfocus.com/bid/22726; reference:url,doc.emergingthreats.net/2004757; classtype:web-application-attack; sid:2004757; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/iGrabber Info Stealer FTP Upload"; flow:established,to_server; content:"iGrabber Logs"; classtype:trojan-activity; sid:2013543; rev:3; metadata:created_at 2011_09_06, updated_at 2011_09_06;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS WebMplayer SQL Injection Attempt -- index.php strid ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"strid="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-1135; reference:url,www.securityfocus.com/bid/22726; reference:url,doc.emergingthreats.net/2004758; classtype:web-application-attack; sid:2004758; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Zeus/Aeausuc P2P Variant Retrieving Peers List"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/gameover"; http_uri; pcre:"/gameover(\d+)?\.php/U"; content:" HTTP/1.1|0d 0a|Accept|3a| */*|0d 0a|X-ID|3a|"; reference:url,www.abuse.ch/?p=3499; classtype:trojan-activity; sid:2013740; rev:9; metadata:created_at 2011_10_05, updated_at 2011_10_05;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS WebMplayer SQL Injection Attempt -- index.php strid UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"strid="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/UPDATE.+SET/Ui"; reference:cve,CVE-2007-1135; reference:url,www.securityfocus.com/bid/22726; reference:url,doc.emergingthreats.net/2004759; classtype:web-application-attack; sid:2004759; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Einstein CnC Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:".php?id="; http_uri; content:"&ext="; http_uri; pcre:"/\x2F[a-z]{5}\x2Ephp\x3Fid\x3D/U"; reference:url,www.cyberesi.com/2011/10/06/trojan-matryoshka-and-trojan-einstein/; classtype:command-and-control; sid:2013767; rev:3; metadata:created_at 2011_10_12, former_category MALWARE, updated_at 2011_10_12;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Webradev Download Protect EmailTemplates.class.php Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/Framework/EmailTemplates.class.php?"; http_uri; nocase; content:"GLOBALS[RootPath]="; http_uri; nocase; pcre:"/GLOBALS\[RootPath\]=\s*(https?|ftps?|php)\:\//Ui"; reference:url,milw0rm.com/exploits/8792; reference:url,doc.emergingthreats.net/2010092; classtype:web-application-attack; sid:2010092; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Scar.dvov Searchstar.co.kr related Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/juso_return.php?mode="; http_uri; content:"&pluslook_p"; http_uri; reference:md5,07ed70b6e7775a510d725c9f032c70d8; classtype:command-and-control; sid:2013781; rev:4; metadata:created_at 2011_10_19, former_category MALWARE, updated_at 2011_10_19;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Webradev Download Protect PDPEmailReplaceConstants.class.php Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/Customers/PDPEmailReplaceConstants.class.php?"; http_uri; nocase; content:"GLOBALS[RootPath]="; http_uri; nocase; pcre:"/GLOBALS\[RootPath\]=\s*(https?|ftps?|php)\:\//Ui"; reference:url,milw0rm.com/exploits/8792; reference:url,doc.emergingthreats.net/2010093; classtype:web-application-attack; sid:2010093; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Sefbov.E Reporting"; flow:to_server,established; content:"POST"; nocase; http_method; content:"/CallBack/SomeScripts/mgsGetMGList.php"; nocase; http_uri; reference:md5,f50d954f1fd38c6eb10e7e399caab480; classtype:trojan-activity; sid:2013868; rev:4; metadata:created_at 2011_11_08, updated_at 2011_11_08;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Webradev Download Protect ResellersManager.class.php Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/Admin/ResellersManager.class.php?"; http_uri; nocase; content:"GLOBALS[RootPath]="; http_uri; nocase; pcre:"/GLOBALS\[RootPath\]=\s*(https?|ftps?|php)\:\//Ui"; reference:url,milw0rm.com/exploits/8792; reference:url,doc.emergingthreats.net/2010094; classtype:web-application-attack; sid:2010094; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PWS.TIBIA Checkin or Data Post"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/arq.php"; http_uri; fast_pattern; content:"User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)|0d 0a|"; http_header; classtype:command-and-control; sid:2013948; rev:4; metadata:created_at 2011_11_23, former_category MALWARE, updated_at 2011_11_23;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Werner Hilversum FAQ Manager header.php config_path parameter Remote File Inclusion"; flow:established,to_server; content:"GET "; depth:4; content:"/include/header.php?"; http_uri; nocase; content:"config_path="; http_uri; nocase; pcre:"/config_path=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,32472; reference:url,milw0rm.com/exploits/7229; reference:url,doc.emergingthreats.net/2008935; classtype:web-application-attack; sid:2008935; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PWS.TIBIA Checkin or Data Post 2"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/arq.php"; http_uri; fast_pattern; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 6.0|3b| Windows NT 5.1|3b| SV2|0d 0a|"; http_header; classtype:command-and-control; sid:2013949; rev:4; metadata:created_at 2011_11_23, former_category MALWARE, updated_at 2011_11_23;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Wikivi5 Remote Inclusion Attempt -- show.php sous_rep"; flow:established,to_server; content:"/handlers/page/show.php?"; http_uri; nocase; content:"sous_rep="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2570; reference:url,www.milw0rm.com/exploits/3863; reference:url,doc.emergingthreats.net/2003696; classtype:web-application-attack; sid:2003696; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE VMProtect Packed Binary Inbound via HTTP - Likely Hostile"; flow:established,from_server; content:"VirtualProtect|00|"; reference:url,doc.emergingthreats.net/2009080; classtype:trojan-activity; sid:2009080; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS WikkaWiki (Wikka Wiki) XSS Attempt -- usersettings.php name"; flow:established,to_server; content:"/usersettings.php?"; http_uri; nocase; content:"name="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2551; reference:url,www.securityfocus.com/bid/23894; reference:url,doc.emergingthreats.net/2003916; classtype:web-application-attack; sid:2003916; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET MALWARE Win32.PowerPointer checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"<packet>"; http_client_body; content:"</packet>"; http_client_body; classtype:command-and-control; sid:2014040; rev:3; metadata:created_at 2011_12_28, former_category MALWARE, updated_at 2011_12_28;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS WikyBlog XSS Attempt sessionRegister.php"; flow:established,to_server; content:"/include/sessionRegister.php?"; http_uri; nocase; content:"| 3C |"; http_uri; content:"SCRIPT"; http_uri; nocase; content:"| 3E |"; http_uri; reference:cve,CVE-2007-2781; reference:url,www.secunia.com/advisories/25308; reference:url,doc.emergingthreats.net/2004574; classtype:web-application-attack; sid:2004574; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan-Clicker.Win32.VB.gnf Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/channel/onSale.htm?"; nocase; http_uri; content:"pid="; nocase; http_uri; reference:url,microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanClicker%3AWin32%2FVB.GE; classtype:trojan-activity; sid:2014066; rev:4; metadata:created_at 2012_01_02, updated_at 2012_01_02;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Wordpress wp-login.php redirect_to credentials stealing attempt"; flow:to_server,established; content:"/wp-login.php"; http_uri; nocase; content:"redirect_to"; http_uri; pcre:"/redirect_to=(ht|f)tps?\:\//iU"; reference:url,www.inliniac.net/blog/?p=71; reference:url,doc.emergingthreats.net/2003508; classtype:web-application-attack; sid:2003508; rev:7; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Wordpress, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TROJAN Win32.OnlineGames.Bft Reporting"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/urlrcv.php?"; nocase; http_uri; content:"mc="; nocase; http_uri; content:"sc="; nocase; http_uri; content:"uuid="; nocase; http_uri; reference:md5,e488fca95cb923a0ecd329642c076e0d; reference:url,www.thespywaredetector.com/spywareinfo.aspx?ID=1874131; classtype:trojan-activity; sid:2014084; rev:5; metadata:created_at 2012_01_03, updated_at 2012_01_03;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Wordpress Remote Inclusion Attempt -- wptable-button.php wpPATH"; flow:established,to_server; content:"/js/wptable-button.php?"; http_uri; nocase; content:"wpPATH="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2484; reference:url,www.milw0rm.com/exploits/3824; reference:url,doc.emergingthreats.net/2003685; classtype:web-application-attack; sid:2003685; rev:7; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Wordpress, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Zeus POST Request to CnC - cookie variation"; flow:established,to_server; content:"POST"; nocase; http_method; content:"|20|HTTP/1."; content:"|0d 0a|Accept|3a 20|*/*|0d 0a|Accept-Language|3a 20|en-us|0d 0a|Cookie|3a 20|cid="; distance:1; within:51; content:"User-Agent|3a 20|Mozilla"; distance:0; content:"Host|3a 20|"; distance:0; content:"Content-Length|3a 20|"; distance:0; content:!"0"; within:1; content:"Connection|3a| Keep-Alive|0d 0a|"; distance:0; content:"|3a| no-cache|0d 0a 0d 0a|"; distance:0; reference:url,zeustracker.abuse.ch/monitor.php?search=209.59.216.103; classtype:command-and-control; sid:2014107; rev:3; metadata:created_at 2012_01_10, former_category MALWARE, updated_at 2012_01_10;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Wordpress Remote Inclusion Attempt -- wordtube-button.php wpPATH"; flow:established,to_server; content:"/wordtube-button.php?"; http_uri; nocase; content:"wpPATH="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2481; reference:url,www.milw0rm.com/exploits/3825; reference:url,doc.emergingthreats.net/2003686; classtype:web-application-attack; sid:2003686; rev:7; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Wordpress, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Delf/Troxen/Zema Reporting 1"; flow:established,to_server; content:"GET"; nocase; http_method; content:".php?m="; http_uri; content:"&s="; http_uri; content:"&v="; http_uri; content:"User-Agent|3a| build"; http_header; pcre:"/\.php\?m=[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}&[vs]=/Ui"; reference:md5,3d18363a20882bd74ae7e0f68d3ed8ef; classtype:trojan-activity; sid:2014114; rev:4; metadata:created_at 2012_01_12, updated_at 2012_01_12;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS WordPress XSS Attempt -- sidebar.php"; flow:established,to_server; content:"/sidebar.php?"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2627; reference:url,www.securityfocus.com/archive/1/archive/1/467360/100/0/threaded; reference:url,doc.emergingthreats.net/2003885; classtype:web-application-attack; sid:2003885; rev:6; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Wordpress, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Delf/Troxen/Zema Reporting 2"; flow:established,to_server; content:"GET"; nocase; http_method; content:".php?s="; http_uri; content:"&m="; http_uri; content:"User-Agent|3a| build"; http_header; pcre:"/\.php\?s=\d&m=[A-F0-9]{16}$/Ui"; reference:md5,3d18363a20882bd74ae7e0f68d3ed8ef; classtype:trojan-activity; sid:2014115; rev:3; metadata:created_at 2012_01_12, updated_at 2012_01_12;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS x10 Automatic MP3 Script function_core.php web_root Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/includes/function_core.php?"; http_uri; nocase; content:"web_root="; http_uri; nocase; pcre:"/web_root=\s*(https?|ftps?|php)\:\//Ui"; reference:url,secunia.com/advisories/31920; reference:bugtraq,31225; reference:url,milw0rm.com/exploits/6480; reference:url,doc.emergingthreats.net/2009925; classtype:web-application-attack; sid:2009925; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SpyEye Checkin version 1.3.25 or later 2"; flow:established,to_server; content:"POST"; nocase; http_method; content:"data=6Prm67"; depth:11; http_client_body; classtype:command-and-control; sid:2014044; rev:5; metadata:created_at 2011_12_28, former_category MALWARE, updated_at 2011_12_28;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS x10 Automatic MP3 Script layout_lyrics.php web_root Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/templates/layout_lyrics.php?"; http_uri; nocase; content:"web_root="; http_uri; nocase; pcre:"/web_root=\s*(https?|ftps?|php)\:\//Ui"; reference:url,secunia.com/advisories/31920; reference:bugtraq,31225; reference:url,milw0rm.com/exploits/6480; reference:url,doc.emergingthreats.net/2009927; classtype:web-application-attack; sid:2009927; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE UPDATE Protocol Trojan Communication detected on http ports"; flow:to_server,established; content:"POST"; nocase; http_method; content:"/update?product=windows"; http_uri; content:"X-Status|3A|"; http_header; content:"X-Size|3A|"; http_header; content:"X-Sn|3A|"; http_header; fast_pattern; content:"User-Agent|3a| Mozilla/4.0 |28|compatible|3b| MSIE 6.0|3b| Windows NT 5.1|3b|SV1|3b 0d 0a|"; http_header; reference:url,www.commandfive.com/papers/C5_APT_C2InTheFifthDomain.pdf; classtype:trojan-activity; sid:2014223; rev:4; metadata:created_at 2012_02_14, updated_at 2012_02_14;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Xoops Articles modules print.php SQL injection attempt"; flow:to_server,established; content:"/print.php?"; http_uri; nocase; content:"id="; http_uri; nocase; pcre:"/id=-?\d+.+UNION.+SELECT/Ui"; reference:bugtraq,23160; reference:url,doc.emergingthreats.net/2003516; classtype:web-application-attack; sid:2003516; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET !$HTTP_PORTS (msg:"ET MALWARE UPDATE Protocol Trojan Communication detected on non-http ports"; flow:to_server,established; content:"POST"; nocase; http_method; content:"/update?product=windows"; http_uri; content:"X-Status|3A|"; http_header; content:"X-Size|3A|"; http_header; content:"X-Sn|3A|"; http_header; fast_pattern; content:"User-Agent|3a| Mozilla/4.0 |28|compatible|3b| MSIE 6.0|3b| Windows NT 5.1|3b|SV1|3b 0d 0a|"; http_header; reference:url,www.commandfive.com/papers/C5_APT_C2InTheFifthDomain.pdf; classtype:trojan-activity; sid:2014224; rev:4; metadata:created_at 2012_02_14, updated_at 2012_02_14;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS iPhotoAlbum header.php remote file include"; flow:established,to_server; content:"/header.php?"; http_uri; nocase; content:"set_menu="; http_uri; nocase; pcre:"/set_menu=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,23189; reference:url,doc.emergingthreats.net/2003517; classtype:web-application-attack; sid:2003517; rev:7; metadata:affected_product Any, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Remote_File_Include, updated_at 2019_08_22;)
+alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32.Duptwux/Ganelp FTP Username - onthelinux"; flow:established,to_server; content:"USER onthelinux"; classtype:trojan-activity; sid:2014239; rev:3; metadata:created_at 2012_02_18, updated_at 2012_02_18;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS YACS update_trailer.php context Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/update_trailer.php?"; http_uri; nocase; content:"context[path_to_root]="; http_uri; nocase; pcre:"/context\[path_to_root\]=\s*(https?|ftps?|php)\:\//Ui"; reference:url,milw0rm.com/exploits/8066; reference:url,secunia.com/advisories/33959/; reference:url,doc.emergingthreats.net/2009190; classtype:web-application-attack; sid:2009190; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/SelfStarterInternet.InfoStealer Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/login.aspx?ReturnUrl=/card/Pay_query.aspx"; http_uri; content:"VIEWSTATE="; nocase; http_client_body; content:"EVENTVALIDATION="; nocase; distance:0; http_client_body; content:"&txtUser="; nocase; distance:0; http_client_body; content:"&txtPwd="; nocase; distance:0; http_client_body; content:"&btnEnter="; nocase; distance:0; http_client_body; reference:md5,67c748f3ecc0278f1f94596f86edc509; classtype:command-and-control; sid:2014307; rev:4; metadata:created_at 2012_03_05, former_category MALWARE, updated_at 2012_03_05;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Yaap Remote Inclusion Attempt -- common.php root_path"; flow:established,to_server; content:"/includes/common.php?"; http_uri; nocase; content:"root_path="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2664; reference:url,www.milw0rm.com/exploits/3908; reference:url,doc.emergingthreats.net/2003739; classtype:web-application-attack; sid:2003739; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Dropper.Wlock Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"hardware_id="; http_client_body; content:"&user_id="; http_client_body; content:"&os_ver="; http_client_body; content:"&os_sp="; http_client_body; content:"&os_arch="; http_client_body; reference:md5,881e21645e5ffe1ffb959835f8fdf71d; classtype:command-and-control; sid:2013768; rev:4; metadata:created_at 2011_10_12, former_category MALWARE, updated_at 2011_10_12;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Zomplog SQL Injection Attempt -- mp3playlist.php speler SELECT"; flow:established,to_server; content:"/plugins/mp3playlist/mp3playlist.php?"; http_uri; nocase; content:"speler="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-2773; reference:url,www.milw0rm.com/exploits/3955; reference:url,doc.emergingthreats.net/2003981; classtype:web-application-attack; sid:2003981; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Karagany/Kazy Obfuscated Payload Download"; flow:established,to_client; content:"Content-Disposition|3a| "; http_header; content:"windows-update-"; fast_pattern; http_header; distance:0; content:".exe"; distance:0; http_header; content:!"|0d 0a 0d 0a|MZ"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AWin32%2FKaragany.I; reference:url,www.virustotal.com/file/6c7ae03b8b660826f0c58bbec4208bf03e704201131b3b5c5709e5837bfdd218/analysis/1334672726/; classtype:trojan-activity; sid:2014230; rev:5; metadata:created_at 2012_02_16, updated_at 2022_05_03;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Zomplog SQL Injection Attempt -- mp3playlist.php speler UNION SELECT"; flow:established,to_server; content:"/plugins/mp3playlist/mp3playlist.php?"; http_uri; nocase; content:"speler="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-2773; reference:url,www.milw0rm.com/exploits/3955; reference:url,doc.emergingthreats.net/2003982; classtype:web-application-attack; sid:2003982; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Zeus Bot Request to CnC 2"; flow:to_server,established; content:"GET"; nocase; http_method; content:"Accept|3a| */*|0d 0a|If-None-Match|3a| "; fast_pattern; depth:28; http_header; content:"Cache-Control|3a| no-cache|0d 0a|User-Agent|3a| Mozilla"; distance:0; http_header; content:"Connection|3a| Close|0d 0a 0d 0a|"; distance:0; http_header; classtype:command-and-control; sid:2013348; rev:8; metadata:created_at 2011_08_04, former_category MALWARE, updated_at 2011_08_04;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Zomplog SQL Injection Attempt -- mp3playlist.php speler INSERT"; flow:established,to_server; content:"/plugins/mp3playlist/mp3playlist.php?"; http_uri; nocase; content:"speler="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-2773; reference:url,www.milw0rm.com/exploits/3955; reference:url,doc.emergingthreats.net/2003983; classtype:web-application-attack; sid:2003983; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Patcher/Bankpatch V2 Communication with Controller"; flow:established,to_server; content:"id="; nocase; http_uri; content:"&check="; nocase; http_uri; content:"&version2="; http_uri; nocase; pcre:"/\?id=[A-Za-z]+_[A-Za-z0-9]+&/U"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=PWS%3AWin32%2FBanker.O; classtype:trojan-activity; sid:2009408; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Zomplog SQL Injection Attempt -- mp3playlist.php speler DELETE"; flow:established,to_server; content:"/plugins/mp3playlist/mp3playlist.php?"; http_uri; nocase; content:"speler="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-2773; reference:url,www.milw0rm.com/exploits/3955; reference:url,doc.emergingthreats.net/2003984; classtype:web-application-attack; sid:2003984; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE VBKrypt.cmtp Login to Server"; flow:to_server,established; content:"USER|20|lodosxxx"; reference:url,vil.nai.com/vil/content/v_377875.htm; classtype:trojan-activity; sid:2013092; rev:4; metadata:created_at 2011_06_22, updated_at 2011_06_22;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Zomplog SQL Injection Attempt -- mp3playlist.php speler ASCII"; flow:established,to_server; content:"/plugins/mp3playlist/mp3playlist.php?"; http_uri; nocase; content:"speler="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-2773; reference:url,www.milw0rm.com/exploits/3955; reference:url,doc.emergingthreats.net/2003985; classtype:web-application-attack; sid:2003985; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DwnLdr-JMZ Downloading Binary"; flow:established,to_server; content:"/ngt.exe"; fast_pattern; http_uri; content:"User-Agent|3a| Mozilla|0d 0a|"; http_header; reference:url,sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~DwnLdr-JMZ/detailed-analysis.aspx; classtype:trojan-activity; sid:2014464; rev:2; metadata:created_at 2012_04_04, updated_at 2012_04_04;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Zomplog SQL Injection Attempt -- mp3playlist.php speler UPDATE"; flow:established,to_server; content:"/plugins/mp3playlist/mp3playlist.php?"; http_uri; nocase; content:"speler="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-2773; reference:url,www.milw0rm.com/exploits/3955; reference:url,doc.emergingthreats.net/2003986; classtype:web-application-attack; sid:2003986; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DwnLdr-JMZ Downloading Binary 2"; flow:established,to_server; content:"/?path=qx200.exe"; http_uri; reference:url,sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~DwnLdr-JMZ/detailed-analysis.aspx; classtype:trojan-activity; sid:2014465; rev:2; metadata:created_at 2012_04_04, updated_at 2012_04_04;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS @Mail XSS Attempt -- ReadMsg.php"; flow:established,to_server; content:"/ReadMsg.php?"; http_uri; nocase; content:"| 3C |"; http_uri; content:"SCRIPT"; http_uri; nocase; content:"| 3E |"; http_uri; reference:cve,CVE-2007-2825; reference:url,xforce.iss.net/xforce/xfdb/34376; reference:url,doc.emergingthreats.net/2004557; classtype:web-application-attack; sid:2004557; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE HTTP Request to Zaletelly CnC Domain zaletellyxx.be"; flow:established,to_server; content:"Host|3a| zaletelly"; http_header; nocase; content:".be|0d 0a|"; http_header; within:9; nocase; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Worm%3aWin32/Gamarue.F; classtype:command-and-control; sid:2014476; rev:2; metadata:created_at 2012_04_05, former_category MALWARE, updated_at 2012_04_05;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ccTiddly index.php cct_base parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/index.php?"; http_uri; nocase; content:"cct_base="; http_uri; nocase; pcre:"/cct_base=\s*(ftps?|https?|php)\:\//Ui"; reference:url,www.milw0rm.com/exploits/7336; reference:url,secunia.com/Advisories/32995/; reference:url,doc.emergingthreats.net/2008966; classtype:web-application-attack; sid:2008966; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE HTTP Request to Zaletelly CnC Domain atserverxx.info"; flow:established,to_server; content:"Host|3a| atserver"; http_header; nocase; content:".info|0d 0a|"; http_header; within:11; nocase; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Worm%3aWin32/Gamarue.F; classtype:command-and-control; sid:2014477; rev:2; metadata:created_at 2012_04_05, former_category MALWARE, updated_at 2012_04_05;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ccTiddly proxy.php cct_base parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/handle/proxy.php?"; http_uri; nocase; content:"cct_base="; http_uri; nocase; pcre:"/cct_base=\s*(ftps?|https?|php)\:\//Ui"; reference:url,www.milw0rm.com/exploits/7336; reference:url,secunia.com/Advisories/32995/; reference:url,doc.emergingthreats.net/2008967; classtype:web-application-attack; sid:2008967; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Datamaikon Checkin NewAgent"; flow:to_server,established; content:"/index.dat?"; http_uri; content:" NewAgent|0d 0a|Host|3a| "; http_header; pcre:"/\/index.dat\?\d{5,9}$/U"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AWin32%2FDatamaikon.gen!A&ThreatID=-2147312276; reference:md5,77d68770fcdc6052bd8d761d14a14f5a; classtype:command-and-control; sid:2014467; rev:4; metadata:created_at 2012_04_04, former_category MALWARE, updated_at 2012_04_04;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ccTiddly header.php cct_base parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/includes/header.php?"; http_uri; nocase; content:"cct_base="; http_uri; nocase; pcre:"/cct_base=\s*(ftps?|https?|php)\:\//Ui"; reference:url,www.milw0rm.com/exploits/7336; reference:url,secunia.com/Advisories/32995/; reference:url,doc.emergingthreats.net/2008968; classtype:web-application-attack; sid:2008968; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Taidoor.Backdoor Command Request CnC Checkin"; flow:established,to_server; content:".php?id="; http_uri; content:"&ext="; fast_pattern; http_uri; pcre:"/\x2F[a-z]{5}\x2Ephp\x3Fid\x3D.+[a-f0-9]{12}&ext\x3D/Ui"; reference:url,www.symantec.com/connect/blogs/trojantaidoor-takes-aim-policy-think-tanks; classtype:command-and-control; sid:2014528; rev:2; metadata:created_at 2012_04_06, former_category MALWARE, updated_at 2012_04_06;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ccTiddly include.php cct_base parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/includes/include.php?"; http_uri; nocase; content:"cct_base="; http_uri; nocase; pcre:"/cct_base=\s*(ftps?|https?|php)\:\//Ui"; reference:url,www.milw0rm.com/exploits/7336; reference:url,secunia.com/Advisories/32995/; reference:url,doc.emergingthreats.net/2008969; classtype:web-application-attack; sid:2008969; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/LockScreen Scareware Geolocation Request"; flow:established,to_server; content:"/loc/gate.php?getpic=getpic"; http_uri; reference:url,www.abuse.ch/?p=3610; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_police_trojan.pdf; classtype:trojan-activity; sid:2014309; rev:3; metadata:created_at 2012_03_05, updated_at 2012_03_05;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ccTiddly workspace.php cct_base parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/includes/workspace.php?"; http_uri; nocase; content:"cct_base="; http_uri; nocase; pcre:"/cct_base=\s*(ftps?|https?|php)\:\//Ui"; reference:url,www.milw0rm.com/exploits/7336; reference:url,secunia.com/Advisories/32995/; reference:url,doc.emergingthreats.net/2008970; classtype:web-application-attack; sid:2008970; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Farfli User Agent Detected"; flow:established,to_server; content:"/rpt"; http_uri; fast_pattern; content:"User-Agent|3a| "; http_header; content:!"User-Agent|3a| Mozilla"; http_header; pcre:"/^User-Agent\x3a [a-z0-9]{92}/Hmi"; reference:url,doc.emergingthreats.net/2007646; classtype:trojan-activity; sid:2007646; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS cmsWorks lib.module.php mod_root Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/lib.module.php?"; http_uri; nocase; content:"mod_root"; http_uri; nocase; pcre:"/mod_root=\s*(https?|ftps?|php)/Ui"; reference:url,milw0rm.com/exploits/5921; reference:bugtraq,29914; reference:url,doc.emergingthreats.net/2009367; classtype:web-application-attack; sid:2009367; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Winwebsec.B Checkin"; flow:established,to_server; content:"/temp1.jpg"; http_uri; content:"User-Agent|3a 20|HTTP Client|0d 0a|"; http_header; reference:md5,9c9109cea5845272d6abd1b5523c8de7; classtype:command-and-control; sid:2014578; rev:3; metadata:created_at 2012_04_16, former_category MALWARE, updated_at 2012_04_16;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS cpCommerce _functions.php GLOBALS Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/_functions.php?"; http_uri; nocase; content:"GLOBALS[prefix]="; http_uri; nocase; pcre:"/GLOBALS\[prefix\]=\s*(ftps?|https?|php)\://Ui"; reference:bugtraq,35103; reference:url,milw0rm.com/exploits/8790; reference:url,doc.emergingthreats.net/2009874; classtype:web-application-attack; sid:2009874; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.Es11 Keepalive to CnC"; flow:established,to_server; content:"|89 e7 52 d4 68 64 a7 73 bd 7e 3f 5c f7 99 3a 2e|"; offset:16; depth:16; dsize:48; reference:md5,4a17e9bd99f496c518ddfaaef93384b0; classtype:command-and-control; sid:2014630; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_04_20, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php seite_id SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"seite_id="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2006-6218; reference:url,www.securityfocus.com/bid/21170; reference:url,doc.emergingthreats.net/2006951; classtype:web-application-attack; sid:2006951; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.E Keepalive to CnC"; flow:established,to_server; dsize:>30; content:"|90 48 5c d5 ec 70 a3 8b 41 72 28 50 ec f6 d5 2a|"; offset:16; depth:16; reference:md5,fc414168a5b4ca074ea6e03f770659ef; classtype:command-and-control; sid:2013337; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2011_08_01, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php seite_id UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"seite_id="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2006-6218; reference:url,www.securityfocus.com/bid/21170; reference:url,doc.emergingthreats.net/2006952; classtype:web-application-attack; sid:2006952; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET MALWARE Possible Variant.Kazy.53640 Malformed Client Hello SSL 3.0 (Cipher_Suite length greater than Client_Hello Length)"; flow:to_server,established; content:"|16 03 00|"; depth:3; content:"|01|"; distance:2; within:1; byte_extract:3,0,SSL.Client_Hello.length,relative; byte_jump:1,34,relative; byte_test:2,>,SSL.Client_Hello.length,0,relative; reference:md5,a01d75158cf4618677f494f9626b1c4c; classtype:trojan-activity; sid:2014635; rev:1; metadata:created_at 2012_04_24, updated_at 2012_04_24;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php seite_id INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"seite_id="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2006-6218; reference:url,www.securityfocus.com/bid/21170; reference:url,doc.emergingthreats.net/2006953; classtype:web-application-attack; sid:2006953; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Maljava Dropper for OS X"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/install_flash_player.py"; nocase; http_uri; reference:url,www.symantec.com/connect/blogs/both-mac-and-windows-are-targeted-once; classtype:trojan-activity; sid:2014638; rev:4; metadata:created_at 2012_04_25, updated_at 2012_04_25;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php seite_id DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"seite_id="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2006-6218; reference:url,www.securityfocus.com/bid/21170; reference:url,doc.emergingthreats.net/2006954; classtype:web-application-attack; sid:2006954; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Maljava Dropper for Windows"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/install_flash_player.tmp2"; nocase; http_uri; reference:url,www.symantec.com/connect/blogs/both-mac-and-windows-are-targeted-once; classtype:trojan-activity; sid:2014637; rev:3; metadata:created_at 2012_04_25, updated_at 2012_04_25;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php seite_id ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"seite_id="; http_uri; nocase; content:"ASCII"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2006-6218; reference:url,www.securityfocus.com/bid/21170; reference:url,doc.emergingthreats.net/2006955; classtype:web-application-attack; sid:2006955; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor Win32.Idicaf/Atraps"; flow:to_server,established; dsize:780; content:"|00 00 00 00 00 00 00 00|"; depth:8; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 9C 00 00 00|"; distance:31; within:5; fast_pattern; content:"|00 00 00|"; distance:1; within:3; content:"|00 00 00|"; distance:1; within:3; content:"|00 00|"; distance:2; within:2; content:"|00|"; distance:172; within:1; reference:url,www.commandfive.com/papers/C5_APT_C2InTheFifthDomain.pdf; classtype:trojan-activity; sid:2014228; rev:7; metadata:created_at 2012_02_14, updated_at 2012_02_14;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php seite_id UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"seite_id="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2006-6218; reference:url,www.securityfocus.com/bid/21170; reference:url,doc.emergingthreats.net/2006956; classtype:web-application-attack; sid:2006956; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely Infostealer exe Download"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/crack."; http_uri; content:".exe"; http_uri; pcre:"/\/crack\.\d+\.exe$/Ui"; classtype:trojan-activity; sid:2010059; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php gruppe_id SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"gruppe_id="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2006-6218; reference:url,www.securityfocus.com/bid/21170; reference:url,doc.emergingthreats.net/2006957; classtype:web-application-attack; sid:2006957; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE P2P Zeus or ZeroAccess Request To CnC"; flow:established,to_server; dsize:20; content:"|E5 AA C0 31|"; depth:4; content:"|5B 74 08 4D 9B 39 C1|"; distance:5; within:7; reference:url,www.abuse.ch/?p=3499; reference:url,www.kindsight.net/sites/default/files/Kindsight_Malware_Analysis-ZeroAcess-Botnet-final.pdf; classtype:command-and-control; sid:2013911; rev:9; metadata:created_at 2011_11_11, former_category MALWARE, updated_at 2011_11_11;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php gruppe_id UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"gruppe_id="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2006-6218; reference:url,www.securityfocus.com/bid/21170; reference:url,doc.emergingthreats.net/2006958; classtype:web-application-attack; sid:2006958; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Simbot.Backdoor Checkin"; flow:established,to_server; content:"/rclgx.php?id="; depth:14; http_uri; reference:md5,a4edc9d31bc0ad763b3424e9306f4d7c; classtype:command-and-control; sid:2014719; rev:2; metadata:created_at 2012_05_08, former_category MALWARE, updated_at 2012_05_08;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php gruppe_id DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"gruppe_id="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2006-6218; reference:url,www.securityfocus.com/bid/21170; reference:url,doc.emergingthreats.net/2006960; classtype:web-application-attack; sid:2006960; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Downloader/Agent.dxh.1 Reporting to CnC"; flow:established,to_server; dsize:80<>110; content:"!"; depth:1; content:"|5C 7C 3F 2F|"; within:6; content:".exe|5C 7C 3F 2F|"; distance:0; reference:md5,ded49b8c92d7ab6725649f04f30df8ce; classtype:command-and-control; sid:2014720; rev:2; metadata:created_at 2012_05_08, former_category MALWARE, updated_at 2012_05_08;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php gruppe_id ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"gruppe_id="; http_uri; nocase; content:"ASCII"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2006-6218; reference:url,www.securityfocus.com/bid/21170; reference:url,doc.emergingthreats.net/2006961; classtype:web-application-attack; sid:2006961; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Boatz Checkin"; flow:to_server,established; content:"/clients.php?os="; http_uri; content:"&name="; distance:0; http_uri; content:"&id="; distance:0; http_uri; content:"&loc="; distance:0; http_uri; reference:url,blogs.mcafee.com/mcafee-labs/pastebin-shares-botnet-source-code; classtype:command-and-control; sid:2014721; rev:2; metadata:created_at 2012_05_08, former_category MALWARE, updated_at 2012_05_08;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php gruppe_id UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"gruppe_id="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2006-6218; reference:url,www.securityfocus.com/bid/21170; reference:url,doc.emergingthreats.net/2006962; classtype:web-application-attack; sid:2006962; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Suspicious lcon http header in response seen with Medfos/Midhos downloader"; flow:to_client,established; content:"|0d 0a|lcon|3a 20|"; http_header; reference:md5,63491dcc8e897bf442599febe48b824d; classtype:trojan-activity; sid:2014723; rev:2; metadata:created_at 2012_05_08, updated_at 2012_05_08;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php go_target SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"go_target="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2006-6218; reference:url,www.securityfocus.com/bid/21170; reference:url,doc.emergingthreats.net/2006963; classtype:web-application-attack; sid:2006963; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Snap Bot Checkin"; flow:to_server,established; content:"id="; depth:3; http_client_body; content:"&s5_uidx="; distance:0; http_client_body; content:"&os="; distance:0; http_client_body; content:"&s5="; distance:0; http_client_body; reference:md5,a45a1ccf6842b032b7f2ef2f2255c81c; reference:md5,e070ce714e343052d19a7e3213ee2a9a; reference:url,ddanchev.blogspot.com/2011/05/peek-inside-new-ddos-bot-snap.html; classtype:command-and-control; sid:2014731; rev:2; metadata:created_at 2012_05_11, former_category MALWARE, updated_at 2012_05_11;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php go_target UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"go_target="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2006-6218; reference:url,www.securityfocus.com/bid/21170; reference:url,doc.emergingthreats.net/2006964; classtype:web-application-attack; sid:2006964; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Snap Bot Receiving DDoS Command"; flow:to_client,established; content:"|0d 0a 0d 0a|"; content:"|7c|ddos|7c|"; distance:1; within:10; nocase; pcre:"/^\d+\x7cddos\x7c([^\x7c]+\x7c){5}[^\x7c]+$/mi"; reference:md5,a45a1ccf6842b032b7f2ef2f2255c81c; reference:md5,e070ce714e343052d19a7e3213ee2a9a; reference:url,ddanchev.blogspot.com/2011/05/peek-inside-new-ddos-bot-snap.html; classtype:trojan-activity; sid:2014733; rev:5; metadata:created_at 2012_05_11, updated_at 2012_05_11;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php go_target INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"go_target="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2006-6218; reference:url,www.securityfocus.com/bid/21170; reference:url,doc.emergingthreats.net/2006965; classtype:web-application-attack; sid:2006965; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Snap Bot Receiving Download Command"; flow:to_client,established; content:"|0d 0a 0d 0a|"; content:"|7c|dlexec|7c|"; nocase; distance:1; within:12; content:"|7c|"; distance:0; content:"|7c|"; distance:0; content:"|7c|"; distance:0; pcre:"/^\d+\x7cdlexec\x7c([^\x7c]+\x7c){3}[^\x7c]+$/mi"; reference:md5,a45a1ccf6842b032b7f2ef2f2255c81c; reference:md5,e070ce714e343052d19a7e3213ee2a9a; reference:url,ddanchev.blogspot.com/2011/05/peek-inside-new-ddos-bot-snap.html; classtype:trojan-activity; sid:2014732; rev:4; metadata:created_at 2012_05_11, updated_at 2012_05_11;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php go_target DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"go_target="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2006-6218; reference:url,www.securityfocus.com/bid/21170; reference:url,doc.emergingthreats.net/2006966; classtype:web-application-attack; sid:2006966; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Votwup.Backdoor Checkin"; flow:established,to_server; content:"/ddos?uid="; http_uri; content:"&ver="; http_uri; reference:md5,1325e4e44b5bf2f8dfe550dec016da53; classtype:command-and-control; sid:2014760; rev:2; metadata:created_at 2012_05_17, former_category MALWARE, updated_at 2012_05_17;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php go_target ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"go_target="; http_uri; nocase; content:"ASCII"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2006-6218; reference:url,www.securityfocus.com/bid/21170; reference:url,doc.emergingthreats.net/2006967; classtype:web-application-attack; sid:2006967; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert smtp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/SpyBanker Infection Confirmation Email 2"; flow:established,to_server; content:"From|3A 20 22|Infected|22|"; reference:md5,f091e8ed0e8f4953ff10ce3bd06dbe54; classtype:trojan-activity; sid:2014762; rev:2; metadata:created_at 2012_05_17, updated_at 2012_05_17;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS dev4u CMS SQL Injection Attempt -- index.php go_target UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"go_target="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2006-6218; reference:url,www.securityfocus.com/bid/21170; reference:url,doc.emergingthreats.net/2006968; classtype:web-application-attack; sid:2006968; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Win32/MultiPasswordRecovery.A cs-crash PWS"; flow:to_server,established; content:"X-Mailer|3a| Blat "; content:"Subject|3A 20|Contents of file|3A 20|stdin.txt"; content:"name|3D|"; distance:0; content:".mpf"; within:24; classtype:trojan-activity; sid:2014793; rev:3; metadata:created_at 2012_05_19, updated_at 2012_05_19;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS e107 123 FlashChat Module 123flashchat.php e107path Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/123flashchat.php?"; http_uri; nocase; content:"e107path="; http_uri; nocase; pcre:"/e107path=\s*(ftps?|https?|php)\:\//Ui"; reference:url,xforce.iss.net/xforce/xfdb/41867; reference:url,secunia.com/advisories/29870; reference:url,milw0rm.com/exploits/5459; reference:url,doc.emergingthreats.net/2009435; classtype:web-application-attack; sid:2009435; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Unknown java_ara Bin Download"; flow:established,to_server; content:"java_ara&name="; http_uri; content:"/forum/"; http_uri; content:".php?"; http_uri; flowbits:isset,ET.http.javaclient.vulnerable; classtype:trojan-activity; sid:2014805; rev:2; metadata:created_at 2012_05_24, former_category CURRENT_EVENTS, updated_at 2012_05_24;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ea-gBook index_inc.php inc_ordner parameter remote file inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/index_inc.php?"; http_uri; nocase; content:"inc_ordner="; http_uri; nocase; pcre:"/inc_ordner=\s*(https?|ftps?|php)\:\//Ui"; reference:url,secunia.com/advisories/33927/; reference:bugtraq,33774; reference:url,milw0rm.com/exploits/8052; reference:url,doc.emergingthreats.net/2009225; classtype:web-application-attack; sid:2009225; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE VBS/Wimmie.A Checkin"; flow:to_server,established; content:"POST"; nocase; http_method; content:"/count.php?m=w&n="; http_uri; content:"_"; distance:0; http_uri; content:"@."; distance:0; http_uri; content:"|16 00 00 00|down"; http_client_body; depth:8; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_luckycat_redux.pdf; reference:md5,61474931882dce7b1c67e1f22d26187e; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanDownloader%3AVBS%2FWimmie.A; reference:md5,6fd7493e56fdc3b0dd8ecd24aea20da1; classtype:command-and-control; sid:2014804; rev:6; metadata:created_at 2011_11_05, former_category MALWARE, updated_at 2011_11_05;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS fotolog XSS Attempt -- all_photos.html user"; flow:established,to_server; content:"/all_photos.html?"; http_uri; nocase; content:"user="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2724; reference:url,www.securityfocus.com/archive/1/archive/1/468316/100/0/threaded; reference:url,doc.emergingthreats.net/2003875; classtype:web-application-attack; sid:2003875; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET 88 (msg:"ET MALWARE Virus.Win32.Sality.aa Checkin"; flow:established,to_server; content:".txt"; http_uri; pcre:"/\.txt$/U"; content:"User-Agent|3a| Download|0d 0a|"; http_header; reference:md5,1e0e6717f72b66f6fc83f2ef6c00dcb7; classtype:command-and-control; sid:2014826; rev:5; metadata:created_at 2012_04_09, former_category MALWARE, updated_at 2012_04_09;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS gapicms toolbar.php dirDepth Parameter Remote File Inclusion"; flow:established,to_server; content:"GET "; depth:4; content:"/toolbar.php?"; http_uri; nocase; content:"dirDepth="; http_uri; nocase; pcre:"/dirDepth=\s*(https?|ftps?|php)\:\//Ui"; reference:url,vupen.com/english/advisories/2008/2059; reference:url,milw0rm.com/exploits/6036; reference:url,doc.emergingthreats.net/2009188; classtype:web-application-attack; sid:2009188; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Feodo/Cridex Traffic Detected"; flow:established,to_server; content:"POST"; http_method; nocase; content:"/zb/v_01_a/in/"; http_uri; classtype:trojan-activity; sid:2014841; rev:2; metadata:created_at 2012_06_01, updated_at 2012_06_01;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS gnuedu Remote Inclusion Attempt -- lom.php ETCDIR"; flow:established,to_server; content:"/libs/lom.php?"; http_uri; nocase; content:"ETCDIR="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2609; reference:url,www.milw0rm.com/exploits/3876; reference:url,doc.emergingthreats.net/2003718; classtype:web-application-attack; sid:2003718; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> any any (msg:"ET MALWARE Flamer WuSetupV module traffic 2"; flow:established,to_server; content:"?ac=1"; http_uri; content:"&fd="; http_uri; distance:0; content:"&gb="; http_uri; distance:0; content:"&rt="; http_uri; reference:md5,1f61d280067e2564999cac20e386041c; classtype:trojan-activity; sid:2014850; rev:5; metadata:created_at 2012_06_04, updated_at 2012_06_04;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS gnuedu Remote Inclusion Attempt -- lom_update.php ETCDIR"; flow:established,to_server; content:"/lom_update.php?"; http_uri; nocase; content:"ETCDIR="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2609; reference:url,www.milw0rm.com/exploits/3876; reference:url,doc.emergingthreats.net/2003719; classtype:web-application-attack; sid:2003719; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> any any (msg:"ET MALWARE Flamer WuSetupV module traffic 1"; flow:established,to_server; content:"?mp=1"; http_uri; content:"&jz="; http_uri; distance:0; content:"&fd="; http_uri; distance:0; content:"&am="; http_uri; distance:0; content:"&ef="; http_uri; distance:0; content:"&pr="; http_uri; distance:0; content:"&ec="; http_uri; distance:0; content:"&ov="; http_uri; distance:0; content:"&pl="; http_uri; distance:0; reference:md5,1f61d280067e2564999cac20e386041c; classtype:trojan-activity; sid:2014849; rev:3; metadata:created_at 2012_06_04, updated_at 2012_06_04;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS gnuedu Remote Inclusion Attempt -- check-lom.php ETCDIR"; flow:established,to_server; content:"/scripts/check-lom.php?"; http_uri; nocase; content:"ETCDIR="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2609; reference:url,www.milw0rm.com/exploits/3876; reference:url,doc.emergingthreats.net/2003720; classtype:web-application-attack; sid:2003720; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Self Signed SSL Certificate (Reaserch)"; flow:established,from_server; content:"|16 03|"; content:"|0b|"; within:7; content:"Security Reaserch WWEB Group|2c| LLC"; classtype:trojan-activity; sid:2014871; rev:2; metadata:attack_target Client_Endpoint, created_at 2012_06_08, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS gnuedu Remote Inclusion Attempt -- weigh_keywords.php ETCDIR"; flow:established,to_server; content:"/scripts/weigh_keywords.php?"; http_uri; nocase; content:"ETCDIR="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2609; reference:url,www.milw0rm.com/exploits/3876; reference:url,doc.emergingthreats.net/2003721; classtype:web-application-attack; sid:2003721; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Self Signed SSL Certificate (John Doe)"; flow:established,from_server; content:"|16 03|"; content:"|0b|"; within:7; content:"|08|John Doe0"; classtype:trojan-activity; sid:2014872; rev:2; metadata:attack_target Client_Endpoint, created_at 2012_06_08, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS gnuedu Remote Inclusion Attempt -- logout.php ETCDIR"; flow:established,to_server; content:"/logout.php?"; http_uri; nocase; content:"ETCDIR="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2609; reference:url,www.milw0rm.com/exploits/3876; reference:url,doc.emergingthreats.net/2003722; classtype:web-application-attack; sid:2003722; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET MALWARE W32/Bakcorox.A ProxyBot CnC Server Connection"; flow:established,to_server; content:"GET favicon.ico HTTP/1.1"; depth:24; content:"Host|3A 20|bcProxyBot.com"; fast_pattern; distance:0; reference:url,contagioexchange.blogspot.co.uk/2012/06/022-crime-win32bakcoroxa-proxy-bot-web.html; classtype:command-and-control; sid:2014887; rev:2; metadata:created_at 2012_06_12, former_category MALWARE, updated_at 2012_06_12;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS gnuedu Remote Inclusion Attempt -- help.php ETCDIR"; flow:established,to_server; content:"/help.php?"; http_uri; nocase; content:"ETCDIR="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2609; reference:url,www.milw0rm.com/exploits/3876; reference:url,doc.emergingthreats.net/2003723; classtype:web-application-attack; sid:2003723; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Unknown Java Malicious Jar /eeltff.jar"; flow:to_server,established; content:"/eeltff.jar"; nocase; http_uri; classtype:trojan-activity; sid:2014927; rev:1; metadata:created_at 2012_06_20, former_category CURRENT_EVENTS, updated_at 2012_06_20;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS gnuedu Remote Inclusion Attempt -- index.php ETCDIR"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"ETCDIR="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2609; reference:url,www.milw0rm.com/exploits/3876; reference:url,doc.emergingthreats.net/2003724; classtype:web-application-attack; sid:2003724; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Ceckno Reporting to Controller"; flow:established,to_server; dsize:<30; content:"\:2|7c|"; depth:10; content:"|7c|"; distance:0; content:"|7c|"; distance:0; pcre:"/^\d+\x3a\d\x7c\d+\x7c[0-9a-z]+\x7c\d/i"; flowbits:set,ET.cekno.initial; reference:url,doc.emergingthreats.net/2008177; classtype:trojan-activity; sid:2008177; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS gnuedu Remote Inclusion Attempt -- login.php ETCDIR"; flow:established,to_server; content:"/login.php?"; http_uri; nocase; content:"ETCDIR="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2609; reference:url,www.milw0rm.com/exploits/3876; reference:url,doc.emergingthreats.net/2003725; classtype:web-application-attack; sid:2003725; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Potential Gemini Malware Download"; flow:established,to_server; content:"GET"; nocase; http_method; content:".php?cmd=getFile&counter="; http_uri; pcre:"/\.php\?cmd=getFile&counter=\d/U"; reference:url,www.virustotal.com/analisis/c36e206c6dfe88345815da41c1b14b4f33a9636ad94dd46ce48f5b367f1c736c-1254242791; reference:url,doc.emergingthreats.net/2010007; classtype:trojan-activity; sid:2010007; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS gnuedu Remote Inclusion Attempt -- lom.php ETCDIR"; flow:established,to_server; content:"/web/lom.php?"; http_uri; nocase; content:"ETCDIR="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2609; reference:url,www.milw0rm.com/exploits/3876; reference:url,doc.emergingthreats.net/2003747; classtype:web-application-attack; sid:2003747; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Goldun Reporting Install"; flow:established,to_server; content:".php?codec="; http_uri; pcre:"/codec=\d+D\d+D\d/U"; reference:url,doc.emergingthreats.net/2007965; classtype:trojan-activity; sid:2007965; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS justVisual contact.php fs_jVroot Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/test/pages/contact.php?"; http_uri; nocase; content:"fs_jVroot="; http_uri; nocase; pcre:"/fs_jVroot\s*=\s*(https?|ftps?|php)\:\//Ui"; reference:url,secunia.com/advisories/36072/; reference:url,milw0rm.com/exploits/9308; reference:url,doc.emergingthreats.net/2010191; classtype:web-application-attack; sid:2010191; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE IRC channel topic misc bot commands"; flowbits:isset,is_proto_irc; flow:established,from_server; content:"|3a|"; content:"|20|332|20|"; within:50; content:"|2023|"; within:20; content:"|203a|"; pcre:"/(\.aim\w*|ascanall)\s+\w/i"; reference:url,doc.emergingthreats.net/2002386; classtype:trojan-activity; sid:2002386; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS justVisual pageTemplate.php fs_jVroot Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/system/pageTemplate.php?"; http_uri; nocase; content:"fs_jVroot="; http_uri; nocase; pcre:"/fs_jVroot\s*=\s*(https?|ftps?|php)\:\//Ui"; reference:url,secunia.com/advisories/36072/; reference:url,milw0rm.com/exploits/9308; reference:url,doc.emergingthreats.net/2010192; classtype:web-application-attack; sid:2010192; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE WindowsEnterpriseSuite FakeAV Reporting via POST initial check-in"; flow:established,to_server; content:"POST"; http_method; content:"/MicroinstallServiceReport.php"; http_uri; content:"report="; http_client_body; content:"&pid="; http_client_body; content:"&wv="; http_client_body; pcre:"/report=\d+&pid=\d+&wv=[A-Za-z0-9]/P"; reference:url,doc.emergingthreats.net/2010246; reference:md5,d9bcb4e4d650a6ed4402fab8f9ef1387; classtype:trojan-activity; sid:2010246; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS justVisual utilities.php fs_jVroot Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/system/utilities.php?"; http_uri; nocase; content:"fs_jVroot="; http_uri; nocase; pcre:"/fs_jVroot\s*=\s*(https?|ftps?|php)\:\//Ui"; reference:url,secunia.com/advisories/36072/; reference:url,milw0rm.com/exploits/9308; reference:url,doc.emergingthreats.net/2010193; classtype:web-application-attack; sid:2010193; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE CoreFlooder C&C Checkin (2)"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/index.php"; http_uri; nocase; content:"r="; http_client_body; content:"&i="; http_client_body; content:"&v="; http_client_body; content:"&os="; http_client_body; content:"&panic="; fast_pattern; http_client_body; content:"&input="; http_client_body; reference:url,doc.emergingthreats.net/2009287; classtype:command-and-control; sid:2009287; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS MXBB Remote Inclusion Attempt -- faq.php module_root_path"; flow:established,to_server; content:"/faq.php?"; http_uri; nocase; content:"module_root_path="; http_uri; nocase; content:"cmd="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2493; reference:url,www.milw0rm.com/exploits/3833; reference:url,doc.emergingthreats.net/2003684; classtype:web-application-attack; sid:2003684; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Bicololo.Dropper ne_unik CnC Server Response"; flow:established,to_client; content:"|0d 0a 0d 0a|ne_unik"; classtype:command-and-control; sid:2014933; rev:3; metadata:created_at 2012_06_22, former_category MALWARE, updated_at 2012_06_22;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS myBloggie SQL Injection Attempt -- index.php cat_id UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"cat_id="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/UPDATE\s+SELECT/Ui"; reference:cve,CVE-2007-3003; reference:url,www.securityfocus.com/bid/24249; reference:url,doc.emergingthreats.net/2004469; classtype:web-application-attack; sid:2004469; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor Win32/Hupigon.CK Client Checkin"; flow:to_server,established; content:"|00 00 00 18 01 00 00|"; offset:1; depth:7; fast_pattern; content:"|78 9c|"; distance:5; within:2; classtype:command-and-control; sid:2014955; rev:2; metadata:created_at 2012_06_25, former_category MALWARE, updated_at 2012_06_25;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS myBloggie SQL Injection Attempt -- index.php cat_id INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"cat_id="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/INSERT.+INTO/Ui"; reference:cve,CVE-2007-3003; reference:url,www.securityfocus.com/bid/24249; reference:url,doc.emergingthreats.net/2004470; classtype:web-application-attack; sid:2004470; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Backdoor Win32/Hupigon.CK Server Checkin"; flow:to_client,established; content:"|00 00 00 01 00 00 00|"; offset:1; depth:7; fast_pattern; content:"|78 9c|"; distance:5; within:2; content:"|00 00 01 00 01|"; distance:2; within:5; classtype:command-and-control; sid:2014956; rev:1; metadata:created_at 2012_06_26, former_category MALWARE, updated_at 2012_06_26;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS myBloggie SQL Injection Attempt -- index.php cat_id DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"cat_id="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/DELETE.+FROM/Ui"; reference:cve,CVE-2007-3003; reference:url,www.securityfocus.com/bid/24249; reference:url,doc.emergingthreats.net/2004471; classtype:web-application-attack; sid:2004471; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor Win32/Hupigon.CK Client Idle"; flow:to_server,established; content:"|00 00 00 02 00 00 00|"; offset:1; depth:7; fast_pattern; content:"|78 9c|"; distance:5; within:2; content:"|00 00|"; distance:3; within:2; content:"|00|"; distance:1; within:1; classtype:trojan-activity; sid:2014957; rev:1; metadata:created_at 2012_06_26, updated_at 2012_06_26;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS myBloggie SQL Injection Attempt -- index.php cat_id ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"cat_id="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-3003; reference:url,www.securityfocus.com/bid/24249; reference:url,doc.emergingthreats.net/2004472; classtype:web-application-attack; sid:2004472; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Backdoor Win32/Hupigon.CK Server Idle"; flow:to_client,established; content:"|00 00 00 01 00 00 00|"; offset:1; depth:7; fast_pattern; content:"|78 9c|"; distance:5; within:2; content:"|00 00 1f 00 1f|"; distance:2; within:5; classtype:trojan-activity; sid:2014958; rev:1; metadata:created_at 2012_06_26, updated_at 2012_06_26;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS myBloggie SQL Injection Attempt -- index.php cat_id UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"cat_id="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/UPDATE.+SET/Ui"; reference:cve,CVE-2007-3003; reference:url,www.securityfocus.com/bid/24249; reference:url,doc.emergingthreats.net/2004473; classtype:web-application-attack; sid:2004473; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Scar CnC Checkin"; flow:established,to_server; content:"/yeni_urunler.php?hdd="; http_uri; reference:md5,b345634df53511c7195d661ac755b320; classtype:command-and-control; sid:2014961; rev:2; metadata:created_at 2012_06_26, former_category MALWARE, updated_at 2012_06_26;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS myBloggie SQL Injection Attempt -- index.php year SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"year="; http_uri; nocase; pcre:"/SELECT.+FROM/Ui"; reference:cve,CVE-2007-3003; reference:url,www.securityfocus.com/bid/24249; reference:url,doc.emergingthreats.net/2004474; classtype:web-application-attack; sid:2004474; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Zusy Gettime Checkin"; flow:established,to_server; content:"/gettime.html?"; fast_pattern; http_uri; content:"HTTP/1.0"; http_header; content:"If-None-Match|3A 20|"; http_header; reference:md5,a152772516cef409ddd58f90917a3b44; classtype:command-and-control; sid:2015022; rev:2; metadata:created_at 2012_07_04, former_category MALWARE, updated_at 2012_07_04;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS myBloggie SQL Injection Attempt -- index.php year UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"year="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/UNION\s+SELECT/Ui"; reference:cve,CVE-2007-3003; reference:url,www.securityfocus.com/bid/24249; reference:url,doc.emergingthreats.net/2004475; classtype:web-application-attack; sid:2004475; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Pushbot User-Agent"; flow:to_server,established; content:"User-Agent|3A 20|cvc_v105"; fast_pattern:only; http_header; reference:url,www.cert.pl/news/5587/langswitch_lang/en; classtype:trojan-activity; sid:2015002; rev:6; metadata:created_at 2012_07_03, updated_at 2012_07_03;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS myBloggie SQL Injection Attempt -- index.php year INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"year="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/INSERT.+INTO/Ui"; reference:cve,CVE-2007-3003; reference:url,www.securityfocus.com/bid/24249; reference:url,doc.emergingthreats.net/2004476; classtype:web-application-attack; sid:2004476; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Pushbot server response"; flow:to_client,established; content:"|0d 0a 0d 0a|ZG%|20|!GX"; reference:url,www.cert.pl/news/5587/langswitch_lang/en; classtype:trojan-activity; sid:2015003; rev:4; metadata:created_at 2012_07_03, updated_at 2012_07_03;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS myBloggie SQL Injection Attempt -- index.php year DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"year="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/DELETE.+FROM/Ui"; reference:cve,CVE-2007-3003; reference:url,www.securityfocus.com/bid/24249; reference:url,doc.emergingthreats.net/2004477; classtype:web-application-attack; sid:2004477; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Incognito - Malicious PDF Requested - /getfile.php"; flow:established,to_server; content:"/getfile.php?i="; http_uri; content:"&key="; http_uri; content:!" Java/1"; http_header; classtype:trojan-activity; sid:2015024; rev:1; metadata:created_at 2012_07_04, former_category CURRENT_EVENTS, updated_at 2012_07_04;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS myBloggie SQL Injection Attempt -- index.php year ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"year="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-3003; reference:url,www.securityfocus.com/bid/24249; reference:url,doc.emergingthreats.net/2004478; classtype:web-application-attack; sid:2004478; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Monkif CnC response in fake JPEG"; flow:established,from_server; content:"|0d 0a 0d 0a ff d8 ff e0|"; content:"JFIF|00 01 01|"; distance:2; content:"lppt>++"; fast_pattern; within:50; content:"bm|60|95"; distance:0; content:"|7c|0"; distance:0; reference:url,2009.brucon.org/material/Julia_Wolf_Brucon_final.pdf; reference:url,research.zscaler.com/2010/03/trojan-monkif-is-still-active-and.html; reference:url,blogs.mcafee.com/mcafee-labs/monkif-botnet-hides-commands-in-jpegs; classtype:command-and-control; sid:2012507; rev:5; metadata:created_at 2011_03_15, former_category MALWARE, updated_at 2011_03_15;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS myBloggie SQL Injection Attempt -- index.php year UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"year="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/UPDATE.+SET/Ui"; reference:cve,CVE-2007-3003; reference:url,www.securityfocus.com/bid/24249; reference:url,doc.emergingthreats.net/2004479; classtype:web-application-attack; sid:2004479; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET MALWARE ZeroAccess udp traffic detected"; content:"|9e 98|"; offset:6; depth:2; dsize:20; classtype:trojan-activity; sid:2015474; rev:2; metadata:created_at 2012_07_14, updated_at 2012_07_14;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS nweb2fax viewrq.php var_filename Parameter Directory Traversal"; flow:to_server,established; content:"GET "; depth:4; content:"/viewrq.php?"; http_uri; nocase; content:"format=ps"; http_uri; nocase; content:"var_filename="; http_uri; content:"../"; reference:bugtraq,29804; reference:url,milw0rm.com/exploits/5856; reference:url,doc.emergingthreats.net/2009501; classtype:web-application-attack; sid:2009501; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET 1024:65535 -> $HOME_NET any (msg:"ET MALWARE Delfsnif/Buzus.fte Remote Response"; flow:established,from_server; dsize:9; content:"|05 00 00 00|"; depth:4; content:"|cd|"; distance:4; within:1; reference:url,www.threatexpert.com/threats/virtool-win32-delfsnif-gen.html; reference:url,doc.emergingthreats.net/2009079; classtype:trojan-activity; sid:2009079; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS pfa CMS Remote Inclusion index.php abs_path"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"abs_path="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2559; reference:url,www.securityfocus.com/archive/1/archive/1/467840/100/0/threaded; reference:url,doc.emergingthreats.net/2003698; classtype:web-application-attack; sid:2003698; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/OnlineGame.DaGame Variant CnC Checkin"; flow:established,to_server; content:"/logexp.php?aid="; http_uri; content:"&pid="; http_uri; content:"&kind="; http_uri; pcre:"/User\x2DAgent\x3A\x20[a-f0-9]{5,14}\x0D\x0A/H"; classtype:command-and-control; sid:2015489; rev:2; metadata:created_at 2012_07_20, former_category MALWARE, updated_at 2012_07_20;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS pfa CMS Remote Inclusion checkout.php abs_path"; flow:established,to_server; content:"/checkout.php?"; http_uri; nocase; content:"abs_path="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2559; reference:url,www.securityfocus.com/archive/1/archive/1/467840/100/0/threaded; reference:url,doc.emergingthreats.net/2003699; classtype:web-application-attack; sid:2003699; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ProxyBox - ProxyBotCommand - I_AM"; flow:established,to_server; content:"I_AM|0D 0A|"; depth:6; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2012-071005-4515-99&tabid=2; classtype:trojan-activity; sid:2015510; rev:2; metadata:created_at 2012_07_21, updated_at 2012_07_21;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS pfa CMS Remote Inclusion libsecure.php abs_path"; flow:established,to_server; content:"/libsecure.php?"; http_uri; nocase; content:"abs_path="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2559; reference:url,www.securityfocus.com/archive/1/archive/1/467840/100/0/threaded; reference:url,doc.emergingthreats.net/2003700; classtype:web-application-attack; sid:2003700; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ProxyBox - ProxyBotCommand - FORCE_AUTHENTICATION*"; flow:established,to_client; content:"FORCE_AUTHENTICATION_"; depth:21; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2012-071005-4515-99&tabid=2; classtype:trojan-activity; sid:2015511; rev:2; metadata:created_at 2012_07_21, updated_at 2012_07_21;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS pfa CMS Remote Inclusion index.php repinc"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"repinc="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2558; reference:url,www.securityfocus.com/archive/1/archive/1/467827/100/0/threaded; reference:url,doc.emergingthreats.net/2003701; classtype:web-application-attack; sid:2003701; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ProxyBox -ProxyBotCommand - CHECK_ME"; flow:established,to_server; content:"CHECK_ME|0D 0A|Port|3a| "; depth:16; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2012-071005-4515-99&tabid=2; classtype:trojan-activity; sid:2015502; rev:2; metadata:created_at 2012_07_21, updated_at 2012_07_21;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpPgAdmin XSS Attempt -- sqledit.php server"; flow:established,to_server; content:"/sqledit.php?"; http_uri; nocase; content:"server="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/.*<?(java|vb)?script>?.*<.+\/script>?/iU"; reference:cve,CVE-2007-2865; reference:url,www.securityfocus.com/bid/24115; reference:url,doc.emergingthreats.net/2004552; classtype:web-application-attack; sid:2004552; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Pakes2 - Server Hello"; flow:established,to_client; dsize:11; content:"|01 00 01 ae 84 e3 aa 1f 90|"; offset:2; depth:9; classtype:trojan-activity; sid:2015521; rev:2; metadata:created_at 2012_07_25, updated_at 2012_07_25;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpProfiles body_comm.inc.php content parameter remote file inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/body_comm.inc.php?"; http_uri; nocase; content:"content="; http_uri; nocase; pcre:"/content=\s*(https?|ftps?|php)\:\//Ui"; reference:bugtraq,27952; reference:url,milw0rm.com/exploits/5175; reference:url,doc.emergingthreats.net/2009397; classtype:web-application-attack; sid:2009397; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Generic - ProxyJudge Reverse Proxy Scoring Activity"; flow:established,to_client; file_data; content:"ProxyJudge V"; nocase; classtype:trojan-activity; sid:2015532; rev:2; metadata:created_at 2012_07_27, updated_at 2012_07_27;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS pnFlashGames SQL Injection Attempt -- index.php cid SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"cid="; http_uri; nocase; content:"SELECT"; http_uri; nocase; content:"FROM"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-2427; reference:url,www.milw0rm.com/exploits/3813; reference:url,doc.emergingthreats.net/2003782; classtype:web-application-attack; sid:2003782; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 81: (msg:"ET MALWARE Turkojan C&C Info Command Response (MINFO)"; flow:established,to_server; dsize:<100; content:"MINFO|7c|"; depth:6; reference:url,doc.emergingthreats.net/2008023; classtype:command-and-control; sid:2008023; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS pnFlashGames SQL Injection Attempt -- index.php cid UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"cid="; http_uri; nocase; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-2427; reference:url,www.milw0rm.com/exploits/3813; reference:url,doc.emergingthreats.net/2003783; classtype:web-application-attack; sid:2003783; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET 81: -> $HOME_NET any (msg:"ET MALWARE Turkojan C&C Info Command (MINFO)"; flow:established,from_server; dsize:5; content:"MINFO"; reference:url,doc.emergingthreats.net/2008022; classtype:command-and-control; sid:2008022; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS pnFlashGames SQL Injection Attempt -- index.php cid INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"cid="; http_uri; nocase; content:"INSERT"; http_uri; nocase; content:"INTO"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-2427; reference:url,www.milw0rm.com/exploits/3813; reference:url,doc.emergingthreats.net/2003784; classtype:web-application-attack; sid:2003784; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SickleBot Reporting User Activity"; flow:established,to_server; content:"GET"; http_method; content:"id="; nocase; http_uri; content:"User-Agent|3a| SickleBot"; http_header; reference:url,doc.emergingthreats.net/2002776; classtype:trojan-activity; sid:2002776; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS pnFlashGames SQL Injection Attempt -- index.php cid DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"cid="; http_uri; nocase; content:"DELETE"; http_uri; nocase; content:"FROM"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-2427; reference:url,www.milw0rm.com/exploits/3813; reference:url,doc.emergingthreats.net/2003785; classtype:web-application-attack; sid:2003785; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Tigger.a/Syzor Control Checkin"; flow:established,to_server; content:"/track.cgi"; http_uri; content:"POST"; depth:4; http_method; content:"u="; http_client_body; depth:2; content:"&t="; http_client_body; content:"&v="; http_client_body; content:"&f="; http_client_body; content:"&z="; http_client_body; reference:url,voices.washingtonpost.com/securityfix/2009/02/the_t-i-double-guh-r_trojan_ic.html?wprss=securityfix; reference:url,mnin.blogspot.com/2009/02/why-i-enjoyed-tiggersyzor.html; reference:url,doc.emergingthreats.net/2009096; classtype:command-and-control; sid:2009096; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS pnFlashGames SQL Injection Attempt -- index.php cid ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"cid="; http_uri; nocase; content:"ASCII("; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-2427; reference:url,www.milw0rm.com/exploits/3813; reference:url,doc.emergingthreats.net/2003786; classtype:web-application-attack; sid:2003786; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Tigger.a/Syzor Checkin"; flow:established,to_server; content:"POST"; depth:4; http_method; content:"/track.cgi"; http_uri; content:"u="; http_client_body; depth:2; content:"&t="; http_client_body; content:"&b="; http_client_body; content:"&v="; http_client_body; content:"&f="; http_client_body; reference:url,doc.emergingthreats.net/2009347; classtype:command-and-control; sid:2009347; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS pnFlashGames SQL Injection Attempt -- index.php cid UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"cid="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; content:"SET"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-2427; reference:url,www.milw0rm.com/exploits/3813; reference:url,doc.emergingthreats.net/2003787; classtype:web-application-attack; sid:2003787; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TSPY_SPCESEND.A Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/log.php"; fast_pattern; http_uri; content:"id="; depth:3; http_client_body; content:"&link="; http_client_body; content:"&password="; http_client_body; content:"&debug="; http_client_body; content:!"User-Agent|3a 20|"; http_header; reference:url,blog.trendmicro.com/malware-uses-sendspace-to-store-stolen-documents/; classtype:command-and-control; sid:2014219; rev:4; metadata:created_at 2012_02_11, former_category MALWARE, updated_at 2012_02_11;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS rgboard footer.php _path parameter remote file inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/footer.php?"; http_uri; nocase; content:"_path[counter]="; http_uri; nocase; pcre:"/_path\[counter\]=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,33621; reference:url,milw0rm.com/exploits/7978; reference:url,doc.emergingthreats.net/2009321; classtype:web-application-attack; sid:2009321; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Krunchy/BZub HTTP POST Update"; flow:established,to_server; content:"POST"; nocase; http_method; content:"action="; fast_pattern; http_client_body; depth:7; content:"|25 35 46|script"; http_client_body; content:!"User-Agent|3a| "; http_header; reference:url,doc.emergingthreats.net/2007776; classtype:trojan-activity; sid:2007776; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS tikiwiki featured link XSS attempt"; flow:to_server,established; content:"/tiki-featured_link.php?type="; http_uri; nocase; content:"/iframe>"; http_uri; nocase; reference:url,www.securityfocus.com/archive/1/450268/30/0; reference:url,doc.emergingthreats.net/2003167; classtype:web-application-attack; sid:2003167; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Pandex Trojan Dropper Initial Checkin"; flow:established,to_server; content:"?r="; http_uri; content:"&hdd="; fast_pattern; http_uri; content:"&gen="; http_uri; content:!"User-Agent|3A|"; nocase; http_header; classtype:command-and-control; sid:2013397; rev:3; metadata:created_at 2011_08_10, former_category MALWARE, updated_at 2011_08_10;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS txtSQL startup.php CFG Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/startup.php?"; http_uri; nocase; content:"CFG[txtsql][class]="; http_uri; nocase; pcre:"/CFG\[txtsql\]\[class\]=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,30625; reference:url,milw0rm.com/exploits/6224; reference:url,doc.emergingthreats.net/2009416; classtype:web-application-attack; sid:2009416; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Agent-TMF Checkin"; flow:to_server,established; content:!"User-Agent|3a 20|"; http_header; content:!"Referer|3a 20|"; http_header; content:"GET"; http_method; content:".php?gd="; fast_pattern; http_uri; pcre:"/.php\?gd=\d+_\d+_\d+$/U"; classtype:command-and-control; sid:2013701; rev:2; metadata:created_at 2011_09_28, former_category MALWARE, updated_at 2011_09_28;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS vDesk Webmail XSS Attempt -- printcal.pl"; flow:established,to_server; content:"/printcal.pl?"; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2745; reference:url,www.securityfocus.com/bid/24022; reference:url,doc.emergingthreats.net/2003874; classtype:web-application-attack; sid:2003874; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Unknown Keylogger checkin"; flow:established; content:"GET"; nocase; http_method; content:"?mail="; http_uri; content:"subject=Keylogger"; http_uri; fast_pattern; content:"&body="; http_uri; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 6.0|3b| Windows NT 5.1|3b| SV1)"; http_header; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2008368; classtype:command-and-control; sid:2008368; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2022_05_03;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- index.php showonly SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"showonly="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/SELECT.+FROM/Ui"; reference:cve,CVE-2007-1019; reference:url,www.milw0rm.com/exploits/3325; reference:url,doc.emergingthreats.net/2004881; classtype:web-application-attack; sid:2004881; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Emogen Reporting via HTTP"; flow:established,to_server; content:".asp?"; nocase; http_uri; content:"mac="; fast_pattern; nocase; http_uri; content:"&name="; nocase; http_uri; content:"&p="; nocase; http_uri; content:"&id="; nocase; http_uri; reference:url,doc.emergingthreats.net/2007986; classtype:trojan-activity; sid:2007986; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- index.php showonly UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"showonly="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/UNION\s+SELECT/Ui"; reference:cve,CVE-2007-1019; reference:url,www.milw0rm.com/exploits/3325; reference:url,doc.emergingthreats.net/2004882; classtype:web-application-attack; sid:2004882; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE RevProxy ClientHello"; flow:established,to_server; dsize:13; content:"|04 00 00 01 05 00 00 00 00 07 00 01 00|"; reference:md5,7bf026c71d4ca6cdc7b6e543f9a5bb64; classtype:trojan-activity; sid:2014348; rev:2; metadata:created_at 2012_03_09, updated_at 2012_03_09;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- index.php showonly INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"showonly="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/INSERT.+INTO/Ui"; reference:cve,CVE-2007-1019; reference:url,www.milw0rm.com/exploits/3325; reference:url,doc.emergingthreats.net/2004883; classtype:web-application-attack; sid:2004883; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Java EXE Download by Vulnerable Version - Likely Driveby"; flowbits:isset,ET.http.javaclient.vulnerable; flow:established,to_client; content:"|0d 0a 0d 0a|MZ"; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; threshold:type limit,track by_src,count 1,seconds 3; classtype:trojan-activity; sid:2013036; rev:7; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_06_16, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2016_07_01;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- index.php showonly DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"showonly="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/DELETE.+FROM/Ui"; reference:cve,CVE-2007-1019; reference:url,www.milw0rm.com/exploits/3325; reference:url,doc.emergingthreats.net/2004884; classtype:web-application-attack; sid:2004884; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE UPX compressed file download possible malware"; flow:established,from_server; content:"|0d 0a 0d 0a|MZ"; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; content:"UPX0"; content:"UPX1"; content:"UPX!"; reference:url,doc.emergingthreats.net/2001046; classtype:misc-activity; sid:2001046; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- index.php showonly ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"showonly="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-1019; reference:url,www.milw0rm.com/exploits/3325; reference:url,doc.emergingthreats.net/2004885; classtype:web-application-attack; sid:2004885; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MP-FormGrabber Checkin"; flow:established,to_server; content:"/panel/gate.php?host="; nocase; http_uri; content:"&data="; nocase; distance:0; http_uri; reference:url,www.xylibox.com/2012/08/mp-formgrabber.html?spref=tw; classtype:command-and-control; sid:2015587; rev:2; metadata:created_at 2012_08_08, former_category MALWARE, updated_at 2012_08_08;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS webSPELL SQL Injection Attempt -- index.php showonly UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"showonly="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/UPDATE.+SET/Ui"; reference:cve,CVE-2007-1019; reference:url,www.milw0rm.com/exploits/3325; reference:url,doc.emergingthreats.net/2004886; classtype:web-application-attack; sid:2004886; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert udp $HOME_NET 1024: -> $EXTERNAL_NET any (msg:"ET MALWARE Palevo/BFBot/Mariposa client join attempt"; dsize:7; content:"|61|"; depth:1; flowbits:set,ET.MariposaJoin; reference:url,defintel.com/docs/Mariposa_Analysis.pdf; reference:url,defintel.blogspot.com/2009/09/half-of-fortune-100-companies.html; reference:url,doc.emergingthreats.net/2010100; reference:url,blogs.pcmag.com/securitywatch/2009/09/botnet_reported_loose_in_fortu.php; reference:url,www.symantec.com/business/security_response/writeup.jsp?docid=2009-093006-0442-99&tabid=2; reference:url,www.symantec.com/connect/blogs/mariposa-butterfly; classtype:trojan-activity; sid:2010100; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Workbench Survival Guide Remote Inclusion Attempt -- headerfile.php path"; flow:established,to_server; content:"/header.php?"; http_uri; nocase; content:"path="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2542; reference:url,www.milw0rm.com/exploits/3848; reference:url,doc.emergingthreats.net/2003670; classtype:web-application-attack; sid:2003670; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FinFisher Malware Connection Handshake"; flow:to_server,established; content:"|5c 00 00 00 a0 02 72 00 0c 00 00 00 40 04 fe 00|"; depth:16; reference:url,community.rapid7.com/community/infosec/blog/2012/08/08/finfisher; classtype:trojan-activity; sid:2015595; rev:2; metadata:created_at 2012_08_09, updated_at 2012_08_09;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET GAMES TrackMania Game Launch"; flow:to_server,established; content:"GET"; offset:0; depth:3; content:"/online_game/launcher_init.php?"; http_uri; content:"|0d 0a|User-Agent|3a| GameBox"; content:"game="; http_uri; content:"lang="; http_uri; content:"protocol="; http_uri; content:"distro="; http_uri; content:"osdesc="; http_uri; reference:url,www.trackmania.com; reference:url,doc.emergingthreats.net/2011748; classtype:policy-violation; sid:2011748; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FinFisher Malware Connection Initialization"; flow:to_server,established; content:"|0c 00 00 00 40 01 73 00|"; depth:8; reference:url,community.rapid7.com/community/infosec/blog/2012/08/08/finfisher; classtype:trojan-activity; sid:2015594; rev:2; metadata:created_at 2012_08_09, updated_at 2012_08_09;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET GAMES TrackMania Game Check for Patch"; flow:to_server,established; content:"GET"; offset:0; depth:3; content:"/online_game/patch.php?"; http_uri; content:"game="; http_uri; content:"lang="; http_uri; content:"protocol="; http_uri; content:"distro="; http_uri; content:"osdesc="; http_uri; reference:url,www.trackmania.com; reference:url,doc.emergingthreats.net/2011749; classtype:policy-violation; sid:2011749; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Smardf/Boaxxe GET to cc.php3"; flow:established,to_server; content:"/cc.php3"; http_uri; fast_pattern:only; content:"GET"; http_method; content:!"|0d 0a|Accept"; http_header; reference:md5,f856b4c526c3e5cee9d47df59295d2e1; reference:md5,232b4dbed0453e2a952630fb1076248f; classtype:trojan-activity; sid:2015617; rev:2; metadata:created_at 2012_08_11, updated_at 2012_08_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET GAMES TrackMania Request GetConnectionAndGameParams"; flow:to_server,established; content:"POST"; offset:0; depth:4; content:"/online_game/request.php"; http_uri; content:"|0d 0a|User-Agent|3a| GameBox"; content:"<request><name>GetConnectionAndGameParams</name>"; nocase; reference:url,www.trackmania.com; reference:url,doc.emergingthreats.net/2011750; classtype:policy-violation; sid:2011750; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.Briba Checkin"; flow:to_server,established; content:"POST"; nocase; http_method; content:"loginmid="; http_client_body; content:"nickid="; http_client_body; reference:url,labs.alienvault.com/labs/index.php/2012/cve-2012-1535-adobe-flash-being-exploited-in-the-wild/; classtype:command-and-control; sid:2015635; rev:3; metadata:created_at 2012_08_16, former_category MALWARE, updated_at 2012_08_16;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET GAMES TrackMania Request OpenSession"; flow:to_server,established; content:"POST"; offset:0; depth:4; content:"/online_game/request.php"; http_uri; content:"|0d 0a|User-Agent|3a| GameBox"; content:"<request><name>OpenSession</name>"; nocase; reference:url,www.trackmania.com; reference:url,doc.emergingthreats.net/2011751; classtype:policy-violation; sid:2011751; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.Vaklik.kku Checkin Request"; flow:to_server,established; content:".rar HTTP/1."; pcre:"/\x2f\d+?\x2erar$/U"; flowbits:set,et.trojan.valkik.kku; flowbits:noalert; reference:md5,9688d1d37a7ced200c53ec2b9332a0ad; reference:md5,81d8a235cb5f7345b5796483abe8145f; reference:md5,47a6dd02ee197f82b28cee0ab2b9bd35; classtype:command-and-control; sid:2012960; rev:8; metadata:created_at 2011_06_09, former_category MALWARE, updated_at 2022_05_03;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET GAMES TrackMania Request Disconnect"; flow:to_server,established; content:"POST"; offset:0; depth:4; content:"/online_game/request.php"; http_uri; content:"|0d 0a|User-Agent|3a| GameBox"; content:"<request><name>Disconnect</name>"; nocase; reference:url,www.trackmania.com; reference:url,doc.emergingthreats.net/2011753; classtype:policy-violation; sid:2011753; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Rogue.Win32/Winwebsec Install"; flow:to_server,established; content:"/api/stats/install/?affid="; content:"&ver=30"; http_uri; content:"&group="; http_uri; reference:md5,5310a7d855a14c93b12a36869cd252ec; classtype:trojan-activity; sid:2015653; rev:4; metadata:created_at 2012_02_24, updated_at 2012_02_24;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET GAMES TrackMania Request GetOnlineProfile"; flow:to_server,established; content:"POST"; offset:0; depth:4; content:"/online_game/request.php"; http_uri; content:"|0d 0a|User-Agent|3a| GameBox"; content:"<request><name>GetOnlineProfile</name>"; nocase; reference:url,www.trackmania.com; reference:url,doc.emergingthreats.net/2011754; classtype:policy-violation; sid:2011754; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NeoSploit - Version Enumerated - null"; flow:established,to_server; urilen:85; content:"/null/null"; http_uri; pcre:"/^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/null\/null$/U"; classtype:attempted-user; sid:2015667; rev:2; metadata:created_at 2012_08_29, former_category CURRENT_EVENTS, updated_at 2012_08_29;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET GAMES TrackMania Request GetBuddies"; flow:to_server,established; content:"POST"; offset:0; depth:4; content:"/online_game/request.php"; http_uri; content:"|0d 0a|User-Agent|3a| GameBox"; content:"<request><name>GetBuddies</name>"; nocase; reference:url,www.trackmania.com; reference:url,doc.emergingthreats.net/2011755; classtype:policy-violation; sid:2011755; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NeoSploit - Version Enumerated - Java"; flow:established,to_server; urilen:>85; content:"/1."; offset:75; depth:3; http_uri; content:"|2e|"; distance:1; within:1; http_uri; content:"|2e|"; distance:1; within:1; http_uri; pcre:"/^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/1\.[4-7]\.[0-2]\.[0-9]{1,2}\//U"; classtype:attempted-user; sid:2015666; rev:4; metadata:created_at 2012_08_29, former_category CURRENT_EVENTS, updated_at 2012_08_29;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET GAMES TrackMania Request SearchNew"; flow:to_server,established; content:"POST"; offset:0; depth:4; content:"/online_game/request.php"; http_uri; content:"|0d 0a|User-Agent|3a| GameBox"; content:"<request><name>SearchNew</name>"; nocase; reference:url,www.trackmania.com; reference:url,doc.emergingthreats.net/2011756; classtype:policy-violation; sid:2011756; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE DOCHTML C&C http directive in HTML comments"; flow:established,from_server; content:"|3c|!-- DOCHTMLhttp|3a|//"; reference:url,blog.accuvantlabs.com/blog/dgrif/anatomy-targeted-attack; classtype:command-and-control; sid:2015616; rev:3; metadata:created_at 2012_08_11, former_category MALWARE, updated_at 2012_08_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET GAMES TrackMania Request LiveUpdate"; flow:to_server,established; content:"POST"; offset:0; depth:4; content:"/online_game/request.php"; http_uri; content:"|0d 0a|User-Agent|3a| GameBox"; content:"<request><name>LiveUpdate</name>"; nocase; reference:url,www.trackmania.com; reference:url,doc.emergingthreats.net/2011757; classtype:policy-violation; sid:2011757; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PCFlashbang.com Spyware Checkin (PCFlashBangA)"; flow:to_server,established; content:"User-Agent|3a| PCFlashBang"; http_header; reference:url,www.ca.com/us/securityadvisor/pest/pest.aspx?id=453113169; reference:url,doc.emergingthreats.net/2009540; classtype:command-and-control; sid:2009540; rev:9; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET INAPPROPRIATE Google Image Search, Safe Mode Off"; flow:established,to_server; content:"&safe=off"; http_uri; content:"|0d 0a|Host|3a| images.google.com|0d 0a|"; reference:url,doc.emergingthreats.net/bin/view/Main/2002925; classtype:policy-violation; sid:2002925; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Shady RAT Get File Command"; flow:established,from_server; flowbits:isset,et.shadyratinit; content:"gf|3a|{"; content:"}"; within:50; reference:url,www.symantec.com/connect/blogs/truth-behind-shady-rat; classtype:trojan-activity; sid:2013653; rev:2; metadata:created_at 2011_09_15, updated_at 2011_09_15;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Zango Spyware Activity"; flow:to_server,established; content:"/banman/banman.asp?ZoneID="; http_uri; nocase; content:"&Task="; http_uri; nocase; content:"&X="; http_uri; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2003170; classtype:trojan-activity; sid:2003170; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Shady RAT Put File Command"; flow:established,from_server; flowbits:isset,et.shadyratinit; content:"pf|3a|{"; content:"}"; within:50; reference:url,www.symantec.com/connect/blogs/truth-behind-shady-rat; classtype:trojan-activity; sid:2013654; rev:2; metadata:created_at 2011_09_15, updated_at 2011_09_15;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED MSUpdater.net Spyware Checkin"; flow:established,to_server; content:"/popsetarray.php?&country="; http_uri; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2002094; classtype:trojan-activity; sid:2002094; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Shady RAT Retrieve and Execute Command"; flow:established,from_server; flowbits:isset,et.shadyratinit; content:"http|3a|{"; content:"}.exe"; within:50; reference:url,www.symantec.com/connect/blogs/truth-behind-shady-rat; classtype:trojan-activity; sid:2013655; rev:2; metadata:created_at 2011_09_15, updated_at 2011_09_15;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Trojan.Downloader.Time2Pay.AQ"; flow:established,to_server; content:"/progs_traff/"; http_uri; nocase; reference:url,research.sunbelt-software.com; reference:url,doc.emergingthreats.net/bin/view/Main/2003034; classtype:trojan-activity; sid:2003034; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Shady RAT Relay Command"; flow:established,from_server; flowbits:isset,et.shadyratinit; content:"taxi|3a|"; content:"}"; within:50; reference:url,www.symantec.com/connect/blogs/truth-behind-shady-rat; classtype:trojan-activity; sid:2013656; rev:2; metadata:created_at 2011_09_15, updated_at 2011_09_15;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Weatherbug Design60 Upload Activity"; flow:established,to_server; content:"/GetDesign60.aspx?Magic="; http_uri; nocase; content:"?ZipCode="; http_uri; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2003423; classtype:trojan-activity; sid:2003423; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Shady RAT Send Status Result"; flow:established,from_server; flowbits:isset,et.shadyratinit; content:"slp|3a|{"; content:"}"; within:50; reference:url,www.symantec.com/connect/blogs/truth-behind-shady-rat; classtype:trojan-activity; sid:2013657; rev:2; metadata:created_at 2011_09_15, updated_at 2011_09_15;)
 
-#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED Crewbox Proxy Scan"; flow:established,to_server; content:".php?"; http_uri; nocase; content:"crewbox.by.ru/crew/"; http_uri; nocase; reference:url,doc.emergingthreats.net/2003156; classtype:attempted-recon; sid:2003156; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.Win32.Gbod.dv Checkin"; flow:established,to_server; content:"POST"; http_method; nocase; content:"Opera/"; http_header; content:"Presto/"; http_header; fast_pattern; content:!"Accept|3a| "; http_header; content:"a="; http_client_body; content:"&b="; http_client_body; content:"&c="; http_client_body; classtype:command-and-control; sid:2013154; rev:5; metadata:created_at 2011_07_01, former_category MALWARE, updated_at 2011_07_01;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET VOIP Centrality IP Phone (PA-168 Chipset) Session Hijacking"; flow:established,to_server; content:"POST "; nocase; depth:5; content:"/g"; http_uri; nocase; content:"back=++Back++"; nocase; pcre:"/^\/g($|[?#])/Ui"; reference:url,www.milw0rm.com/exploits/3189; reference:url,doc.emergingthreats.net/bin/view/Main/2003329; reference:cve,2007-0528; classtype:attempted-user; sid:2003329; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dapato Checkin 8"; flow:established,to_server; content:"GET"; http_method; nocase; content:"?uid={"; http_uri; content:"}&user="; distance:0; http_uri; content:"&os="; distance:0; http_uri; content:"Mozilla/4.1"; http_user_agent; depth:11; reference:md5,de7c781205d31f58a04d5acd13ff977d; classtype:command-and-control; sid:2015713; rev:3; metadata:created_at 2012_09_18, former_category MALWARE, updated_at 2012_09_18;)
 
-#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER CGI AWstats Migrate Command Attempt"; flow:established,to_server; content:"/awstats.pl?"; http_uri; nocase; content:"/migrate"; http_uri; pcre:"/migrate\s*=\s*\|/Ui"; reference:bugtraq,17844; reference:url,doc.emergingthreats.net/2002900; classtype:web-application-attack; sid:2002900; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE SSL Cert Used In Unknown Exploit Kit"; flow:established,from_server; content:"|16 03|"; content:"|0b|"; distance:3; within:1; byte_extract:3,0,Certs.len,relative; content:"|55 04 0a 0c 0C|The Internet"; distance:3; within:Certs.len; content:"|55 04 03 0c 03|web"; distance:0; classtype:exploit-kit; sid:2015718; rev:2; metadata:attack_target Client_Endpoint, created_at 2012_09_20, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SERVER Barracuda Spam Firewall img.pl Remote Command Execution Attempt"; flow: to_server,established; content:"/cgi-bin/img.pl?"; http_uri; nocase; pcre:"/(f=.+\|)/Ui"; reference:bugtraq,14712; reference:url,doc.emergingthreats.net/2002362; classtype:web-application-attack; sid:2002362; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE UpackbyDwing binary in HTTP (2) Possibly Hostile"; flow:from_server,established; content:"PE|00 00|"; content:"Upack|00 00|"; within:255; reference:url,www.packetninjas.net; reference:url,doc.emergingthreats.net/2008947; classtype:trojan-activity; sid:2008947; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SERVER Barracuda Spam Firewall img.pl Remote Directory Traversal Attempt"; flow: to_server,established; content:"/cgi-bin/img.pl?"; http_uri; nocase; pcre:"/(f=\.\..+)/Ui"; reference:bugtraq,14710; reference:url,doc.emergingthreats.net/2002685; classtype:web-application-attack; sid:2002685; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE UpackbyDwing binary in HTTP Download Possibly Hostile"; flow:from_server,established; content:"UpackByDwing|40|"; content:"PE|00 00|"; within:20; reference:url,www.packetninjas.net; reference:url,doc.emergingthreats.net/2008946; classtype:trojan-activity; sid:2008946; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SERVER Barracuda Spam Firewall preview_email.cgi Remote Command Execution"; flow: to_server,established; content:"/cgi-bin/preview_email.cgi?"; http_uri; nocase; pcre:"/file=.*\|/Ui"; reference:bugtraq,19276; reference:url,doc.emergingthreats.net/2003086; classtype:web-application-attack; sid:2003086; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE General Trojan Checkin by MAC chkmac.php"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/ctrl/chkmac.php?mac="; nocase; http_uri; classtype:command-and-control; sid:2006403; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SERVER Barracuda Spam Firewall preview_email.cgi Remote Directory Traversal Attempt"; flow: to_server,established; content:"/cgi-bin/preview_email.cgi?"; http_uri; nocase; pcre:"/file=.+\.\..+\|/Ui"; reference:bugtraq,19276; reference:url,doc.emergingthreats.net/2003087; classtype:web-application-attack; sid:2003087; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE SSL Cert Used In Unknown Exploit Kit"; flow:established,from_server; content:"|16 03|"; content:"|0b|"; distance:3; within:1; byte_extract:3,0,Certs.len,relative; content:"|55 04 06 13 02|SE"; distance:3; within:Certs.len; content:"|55 04 08 13 01 20|"; distance:0; content:"|55 04 07 13 01 20|"; distance:0; content:"|55 04 0a 13 01 20|"; distance:0; content:"|55 04 0b 13 01 20|"; distance:0; content:"|55 04 03 13 01 20|"; distance:0; fast_pattern; classtype:exploit-kit; sid:2015742; rev:1; metadata:attack_target Client_Endpoint, created_at 2012_09_27, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SERVER Cisco IOS HTTP set enable password attack"; flow:established,to_server; content:"/configure/"; http_uri; content:"/enable/"; http_uri; reference:cve,2005-3921; reference:bugtraq,15602; reference:url,www.infohacking.com/INFOHACKING_RESEARCH/Our_Advisories/cisco/index.html; reference:url,doc.emergingthreats.net/2002721; classtype:web-application-attack; sid:2002721; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.Win32.Fynloski.A/DarkRat Checkin Outbound"; flow:to_server,established; dsize:<16; content:"KEEPALIVE"; depth:9; pcre:"/^KEEPALIVE\x7c?\d/"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3aWin32%2fFynloski.A&ThreatID=-2147327112; reference:url,www.contextis.com/research/blog/darkcometrat/; reference:url,www.eff.org/deeplinks/2012/08/syrian-malware-post; reference:md5,a2f58a4215441276706f18519dae9102; classtype:command-and-control; sid:2013090; rev:10; metadata:created_at 2010_11_22, former_category MALWARE, updated_at 2010_11_22;)
 
-#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Cisco CallManager XSS Attempt serverlist.asp pattern"; flow:established,to_server; content:"/CCMAdmin/serverlist.asp?"; http_uri; nocase; content:"pattern="; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/iU"; reference:cve,CVE-2007-2832; reference:url,www.secunia.com/advisories/25377; reference:url,doc.emergingthreats.net/2004556; classtype:web-application-attack; sid:2004556; rev:9; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Backdoor.Win32.VB.brg C&C Kill Command Send"; flow:established,from_server; dsize:<35; content:"kill-"; offset:0; depth:5; pcre:"/kill\-\d+.\d+.\d+.\d+\:\d+%\d/"; reference:url,doc.emergingthreats.net/2007980; classtype:command-and-control; sid:2007980; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SERVER Cpanel lastvisit.html Arbitary file disclosure"; flow:to_server,established; content:"GET "; depth:4; content:"lastvist.html?"; http_uri; nocase; content:"domain="; http_uri; nocase; content:"../"; depth:200; reference:url,milw0rm.com/exploits/9039; reference:bugtraq,35518; reference:url,doc.emergingthreats.net/2009484; classtype:web-application-attack; sid:2009484; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Bredolab Downloader Response Binaries from Controller"; flow:established,from_server; content:"|0d 0a|Entity-Info|3a|"; nocase; content:"|0d 0a|Magic-Number|3a|"; nocase; pcre:"/\x0d\x0aEntity-Info\x3a\s+\d+\x3a\d/"; pcre:"/\x0d\x0aMagic-Number\x3a\s+\d+\|\d/"; reference:url,www.microsoft.com/security/portal/Entry.aspx?Name=TrojanDownloader%3aWin32/Bredolab.B; reference:url,doc.emergingthreats.net/2009388; classtype:trojan-activity; sid:2009388; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER IBM Lotus Domino BaseTarget XSS attempt"; flow:to_server,established; content:"OpenForm"; http_uri; nocase; pcre:"/BaseTarget=.*?\"/iU"; reference:bugtraq,14845; reference:url,doc.emergingthreats.net/2002376; classtype:web-application-attack; sid:2002376; rev:11; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.Win32.Agent.cav Url Pattern Detected (ping)"; flow:established,to_server; content:"/ping/"; nocase; http_uri; pcre:"/\/ping\/[0-9a-fA-F]{64}\/[0-9a-fA-F]+\/[0-9a-fA-F]/Ui"; reference:url,doc.emergingthreats.net/2007284; classtype:trojan-activity; sid:2007284; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER IBM Lotus Domino Src XSS attempt"; flow:to_server,established; content:"OpenFrameSet"; http_uri; nocase; pcre:"/src=.*\"><\/FRAMESET>.*<script>.*<\/script>/iU"; reference:bugtraq,14846; reference:url,doc.emergingthreats.net/2002377; classtype:web-application-attack; sid:2002377; rev:10; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE HotLan.C Spambot Trojan Activity"; flow:to_server,established; content:"GET"; http_method; content:"|3F|mod|3D|"; fast_pattern:only; http_uri; content:"&id="; http_uri; content:"&up="; http_uri; content:"&mid="; http_uri; pcre:"/\x3Fmod\x3D\w*?\x26id\x3D[^\x26\s]+?\x5F\w+?\x26up\x3D[^\x26]+?\x26mid\x3D[^\x26\s]/Ui"; reference:url,doc.emergingthreats.net/2008473; classtype:trojan-activity; sid:2008473; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER HP OpenView Network Node Manager OvWebHelp.exe Heap Buffer Overflow Attempt"; flow:established,to_server; content:"POST "; depth:5; nocase; content:"/OvCgi/OvWebHelp.exe"; http_uri; nocase; content:"Topic="; nocase; isdataat:1000,relative; content:!"|0A|"; within:1000; reference:cve,2009-4178; reference:url,doc.emergingthreats.net/2010970; classtype:web-application-attack; sid:2010970; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Lydra.hj HTTP Checkin"; flow:established,to_server; content:"/NewsFolder/News00"; http_uri; content:".ASP?id="; http_uri; pcre:"/\/NewsFolder\/News00\d\d\.ASP\?id=/U"; pcre:"/Host\: \d+\.\d+\.\d+\.\d/"; reference:url,doc.emergingthreats.net/2008130; classtype:command-and-control; sid:2008130; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER IIS ASP.net Auth Bypass / Canonicalization % 5 C"; flow: to_server,established; content:".aspx"; http_uri; nocase; content:"GET"; nocase; depth: 3; content:"%5C"; depth: 200; nocase; content:"aspx"; within:100; reference:url,doc.emergingthreats.net/2001343; classtype:web-application-attack; sid:2001343; rev:23; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Small.zon checkin"; flow:established,to_server; content:"GET"; depth:3; http_method; content:"?n="; http_uri; content:"&id="; http_uri; content:"&t="; http_uri; content:"&i="; http_uri; pcre:"/\?n=\d+&id=.+&t=.+&i=\d/Ui"; reference:url,doc.emergingthreats.net/2009300; classtype:command-and-control; sid:2009300; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SERVER osCommerce extras/update.php disclosure"; flow:to_server,established; content:"extras/update.php"; http_uri; nocase; reference:url,retrogod.altervista.org/oscommerce_22_adv.html; reference:url,doc.emergingthreats.net/2002864; classtype:attempted-recon; sid:2002864; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Small.qh/xSock Checkin URL Detected"; flow:established,to_server; content:"port="; nocase; http_uri; content:"&id="; nocase; http_uri; content:"&v="; nocase; http_uri; content:"&sm="; nocase; http_uri; pcre:"/port=\d/Ui"; pcre:"/id=[a-f0-9-]+&/Ui"; reference:url,doc.emergingthreats.net/2007610; classtype:command-and-control; sid:2007610; rev:6; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SERVER Oracle Reports XML Information Disclosure"; flow:established,to_server; content:"GET "; depth:4; nocase; content:"CUSTOMIZE=/"; http_uri; nocase; pcre:"/(showenv|parsequery|rwservlet)\?.*CUSTOMIZE=\//Ui"; reference:url,www.oracle.com/technology/products/reports/index.html; reference:url,www.red-database-security.com/advisory/oracle_reports_read_any_xml_file.html; reference:url,doc.emergingthreats.net/2002131; classtype:web-application-activity; sid:2002131; rev:11; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Zlob Updating via HTTP (v2)"; flow:established,to_server; content:".php?Code="; nocase; http_uri; content:"&V="; nocase; http_uri; content:"&ID="; nocase; http_uri; pcre:"/Code=\d/Ui"; pcre:"/ID=.{40}&.{6}/Ui"; reference:url,doc.emergingthreats.net/2007620; classtype:trojan-activity; sid:2007620; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SERVER Oracle Reports DESFORMAT Information Disclosure"; flow:established,to_server; content:"GET "; depth:4; nocase; content:"destype=file"; http_uri; nocase; content:"desformat="; http_uri; nocase; pcre:"/(showenv|parsequery|rwservlet)\?.*destype=file.*desformat=\//Ui"; reference:url,www.oracle.com/technology/products/reports/index.html; reference:url,www.red-database-security.com/advisory/oracle_reports_read_any_file.html; reference:url,doc.emergingthreats.net/2002132; classtype:web-application-activity; sid:2002132; rev:11; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Mini-Flame v 4.x C2 HTTP request"; flow:established,to_server; content:"/cgi-bin/feed.cgi"; http_uri; fast_pattern:only; pcre:"/(?:web(?:\.(?:velocitycache\.com|autoflash\.info)|update\.(?:dyndns\.info|hopto\.org)|app\.serveftp\.com)|flash(?:center\.info|rider\.org)|cache\.dyndns\.info)\r?$/Hmi"; reference:url,www.securelist.com/en/analysis/204792247/miniFlame_aka_SPE_Elvis_and_his_friends; classtype:command-and-control; sid:2015805; rev:2; metadata:created_at 2012_10_16, former_category MALWARE, updated_at 2012_10_16;)
 
-#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Oracle Reports OS Command Injection Attempt"; flow:established,to_server; content:"GET "; depth:4; nocase; content:"report="; http_uri; nocase; pcre:"/(showenv|parsequery|rwservlet)\?.*report=.*\.(rdf|rep)/Ui"; reference:url,www.oracle.com/technology/products/reports/index.html; reference:url,www.red-database-security.com/advisory/oracle_reports_run_any_os_command.html; reference:url,doc.emergingthreats.net/2002133; classtype:web-application-activity; sid:2002133; rev:11; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Mini-Flame v 5.x C2 HTTP request"; flow:established,to_server; content:"/cgi-bin/counter.cgi"; http_uri; fast_pattern:only; pcre:"/(?:(?:nvidia(?:s(?:tream|oft)|drivers)|(?:rendercode|videosyn)c|flashupdates|syncstream)\.info|194\.192\.14\.125|202\.75\.58\.179)\r?$/Hmi"; reference:url,www.securelist.com/en/analysis/204792247/miniFlame_aka_SPE_Elvis_and_his_friends; classtype:command-and-control; sid:2015806; rev:2; metadata:created_at 2012_10_16, former_category MALWARE, updated_at 2012_10_16;)
 
-#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED PHP remote file include exploit attempt"; flow: to_server,established; content:"GET "; nocase; depth:4; content:".php?"; http_uri; nocase; content:"cmd="; http_uri; nocase; pcre:"/=(https?|ftps?|php)\:\/.{0,100}cmd=/Ui"; reference:url,doc.emergingthreats.net/2001810; classtype:attempted-admin; sid:2001810; rev:29; metadata:affected_product Any, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Remote_File_Include, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Yoyo-DDoS Bot HTTP Flood Attack Outbound"; flow:established,to_server; content:"|0d 0a|Accept-Encoding|3A| g|7b|ip|2C| deflate|0d 0a|"; http_header; content:"|0d 0a|Connection|3A| Keep|2D|Alivf|0d 0a|"; http_header; threshold:type limit, count 5, seconds 60, track by_src; reference:url,asert.arbornetworks.com/2010/08/yoyoddos-a-new-family-of-ddos-bots/; classtype:denial-of-service; sid:2011403; rev:3; metadata:created_at 2010_09_28, updated_at 2010_09_28;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET DELETED PacketShaper DoS attempt"; flow:to_server,established; content:"/rpttop.htm"; http_uri; pcre:"/MEAS\.TYPE=(?!(link|class)&)/U"; reference:url,doc.emergingthreats.net/2004449; classtype:denial-of-service; sid:2004449; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downadup/Conficker A Worm reporting"; flow:to_server,established; content:"/search?q="; http_uri; content:"&aq="; http_uri; pcre:"/\/search\?q\=\d+&aq=\d/mi"; reference:url,www.f-secure.com/weblog/archives/00001584.html; reference:url,doc.emergingthreats.net/bin/view/Main/2009114; classtype:trojan-activity; sid:2009114; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER PHP Generic Remote File Include Attempt (HTTP)"; flow:to_server,established; content:".php"; http_uri; nocase; content:"=http|3a|/"; http_uri; nocase; pcre:"/\x2Ephp\x3F.{0,300}\x3Dhttp\x3A\x2F[^\x3F\x26]+\x3F/Ui"; reference:url,doc.emergingthreats.net/2009151; classtype:web-application-attack; sid:2009151; rev:9; metadata:affected_product Any, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Remote_File_Include, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE GeckaSeka User-Agent"; flow:established,to_server; content:"GeckaSeka"; http_user_agent; classtype:trojan-activity; sid:2015824; rev:6; metadata:created_at 2012_10_19, updated_at 2012_10_19;)
 
-#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED RSA Web Auth Exploit Attempt - Long URL"; flow:to_server,established; content:"/WebID/IISWebAgentIF.dll"; http_uri; content:"?Redirect?"; http_uri; nocase; pcre:"/url=.{8000}/iU"; reference:url,secunia.com/advisories/17281; reference:url,www.metasploit.com/projects/Framework/modules/exploits/rsa_iiswebagent_redirect.pm; reference:url,doc.emergingthreats.net/2002660; reference:url,doc.emergingthreats.net/2002660; classtype:web-application-activity; sid:2002660; rev:11; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Citadel API Access Video Controller (Inbound)"; flow:established,to_server; content:"/api.php/"; fast_pattern:only; http_uri; content:"/video/"; http_uri; nocase; content:"botI"; http_uri; nocase; reference:url,xylithreats.free.fr/public/; reference:url,www.xylibox.com/2012/10/citadel-1351-rain-edition.html; classtype:trojan-activity; sid:2015834; rev:7; metadata:created_at 2012_10_23, updated_at 2012_10_23;)
 
-#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Possible Usage of MYSQL Comments in URI for SQL Injection"; flow:established,to_server; content:"/*"; http_uri; content:"*/"; http_uri; pcre:"/\x2F\x2A.+\x2A\x2F/U"; reference:url,dev.mysql.com/doc/refman/5.0/en/comments.html; reference:url,en.wikipedia.org/wiki/SQL_injection; reference:url,doc.emergingthreats.net/2011040; classtype:web-application-attack; sid:2011040; rev:4; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Citadel API Access Iframer Controller (Outbound)"; flow:established,to_server; content:"/api.php/"; http_uri; fast_pattern:only; content:"/iframer/"; http_uri; nocase; reference:url,xylithreats.free.fr/public/; reference:url,www.xylibox.com/2012/10/citadel-1351-rain-edition.html; classtype:trojan-activity; sid:2015827; rev:6; metadata:created_at 2012_10_23, updated_at 2012_10_23;)
 
-#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Microsoft SharePoint XSS Attempt default.aspx"; flow:established,to_server; content:"/default.aspx?"; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2581; reference:url,www.securityfocus.com/bid/23832; reference:url,doc.emergingthreats.net/2003903; classtype:web-application-attack; sid:2003903; rev:9; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Citadel API Access IFramer Controller (Inbound)"; flow:established,to_server; content:"/api.php/"; http_uri; fast_pattern:only; content:"/iframer/"; http_uri; nocase; reference:url,xylithreats.free.fr/public/; reference:url,www.xylibox.com/2012/10/citadel-1351-rain-edition.html; classtype:trojan-activity; sid:2015828; rev:7; metadata:created_at 2012_10_23, updated_at 2012_10_23;)
 
-#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Microsoft SharePoint XSS Attempt index.php form mail"; flow:established,to_server; content:"/contact/contact/index.php?"; http_uri; nocase; content:"form[mail]="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2579; reference:url,www.securityfocus.com/bid/23834; reference:url,doc.emergingthreats.net/2003904; classtype:web-application-attack; sid:2003904; rev:9; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Citadel API Access VNC Controller (Outbound)"; flow:established,to_server; content:"/api.php/"; http_uri; fast_pattern:only; content:"/vnc/"; http_uri; nocase; content:"botI"; http_uri; nocase; reference:url,xylithreats.free.fr/public/; reference:url,www.xylibox.com/2012/10/citadel-1351-rain-edition.html; classtype:trojan-activity; sid:2015829; rev:6; metadata:created_at 2012_10_23, updated_at 2012_10_23;)
 
-#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Poison Null Byte"; flow:established,to_server; content:"|00|"; http_uri; depth:2400; reference:cve,2006-4542; reference:cve,2006-4458; reference:cve,2006-3602; reference:url,www.security-assessment.com/Whitepapers/0x00_vs_ASP_File_Uploads.pdf; reference:url,doc.emergingthreats.net/2003099; classtype:web-application-activity; sid:2003099; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Citadel API Access VNC Controller (Inbound)"; flow:established,to_server; content:"/api.php/"; http_uri; fast_pattern:only; content:"/vnc/"; http_uri; nocase; content:"botI"; http_uri; nocase; reference:url,xylithreats.free.fr/public/; reference:url,www.xylibox.com/2012/10/citadel-1351-rain-edition.html; classtype:trojan-activity; sid:2015830; rev:6; metadata:created_at 2012_10_23, updated_at 2012_10_23;)
 
-#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SERVER Apache Axis2 xsd Parameter Directory Traversal Attempt"; flow:to_server,established; content:"GET "; depth:4; content:"/axis2/services/Version?"; http_uri; nocase; content:"xsd="; http_uri; nocase; content:"../"; depth:200; reference:bugtraq,40343; reference:url,doc.emergingthreats.net/2011160; classtype:web-application-attack; sid:2011160; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Citadel API Access Bot Controller (Outbound)"; flow:established,to_server; content:"/api.php/"; fast_pattern:only; http_uri; content:"/bots/"; http_uri; nocase; content:"botI"; http_uri; nocase; reference:url,xylithreats.free.fr/public/; reference:url,www.xylibox.com/2012/10/citadel-1351-rain-edition.html; classtype:trojan-activity; sid:2015831; rev:6; metadata:created_at 2012_10_23, updated_at 2012_10_23;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED MALWARE Likely Unknown Trojan Download"; flow:established,to_server; content:"GET "; depth:4; nocase; content:"/softwarefortubeview.40009.exe"; http_uri; nocase; reference:url,doc.emergingthreats.net/2010058; classtype:trojan-activity; sid:2010058; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Citadel API Access Bot Controller (Inbound)"; flow:established,to_server; content:"/api.php/"; fast_pattern:only; http_uri; content:"/bots/"; http_uri; nocase; content:"botI"; http_uri; nocase; reference:url,xylithreats.free.fr/public/; reference:url,www.xylibox.com/2012/10/citadel-1351-rain-edition.html; classtype:trojan-activity; sid:2015832; rev:6; metadata:created_at 2012_10_23, updated_at 2012_10_23;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED MALWARE Potential Malware Download, loadjavad.php exploit"; flow:established,to_server; content:"/ssp/loadjavad.php"; http_uri; nocase; reference:url,malwareurl.com; reference:url,doc.emergingthreats.net/2010446; classtype:bad-unknown; sid:2010446; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Zeus/Citadel Control Panel Access (Outbound)"; flow:established,to_server; content:".php?m=login"; fast_pattern:only; http_uri; nocase; content:"user="; depth:5; http_client_body; nocase; content:"pass="; http_client_body; nocase; reference:url,xylithreats.free.fr/public/; reference:url,www.xylibox.com/2012/10/citadel-1351-rain-edition.html; classtype:trojan-activity; sid:2015825; rev:8; metadata:created_at 2012_10_23, updated_at 2012_10_23;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED NeoSploit Exploit Kit Java exploit drive-by host likely infected (kav)"; flow:established,to_server; content:"/kav"; http_uri; nocase; content:"|0d 0a|accept-encoding|3a| pack200-gzip,gzip|0d 0a|"; nocase; content:"|0d 0a|content-type|3a| application/x-java-archive|0d 0a|"; nocase; content:!"|0d 0a|Referer|3a| "; nocase; content:"|0d 0a|User-Agent|3a| Mozilla"; nocase; content:" Java/"; nocase; within:50; reference:url,www.malwaredomainlist.com/forums/index.php?action=printpage%3btopic=3781.0; reference:url,doc.emergingthreats.net/2010870; classtype:exploit-kit; sid:2010870; rev:7; metadata:created_at 2010_07_30, former_category EXPLOIT_KIT, updated_at 2021_06_23;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Zeus/Citadel Control Panel Access (Inbound)"; flow:established,to_server; content:".php?m=login"; http_uri; fast_pattern:only; nocase; content:"user="; depth:5; http_client_body; nocase; content:"pass="; http_client_body; nocase; reference:url,xylithreats.free.fr/public/; reference:url,www.xylibox.com/2012/10/citadel-1351-rain-edition.html; classtype:trojan-activity; sid:2015826; rev:8; metadata:created_at 2012_10_23, updated_at 2012_10_23;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Likely FAKEAV scanner page encountered - i1000000.gif"; flow:established,to_server; content:"/i1000000.gif"; http_uri; nocase; reference:url,doc.emergingthreats.net/2011760; classtype:bad-unknown; sid:2011760; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE SSL Cert Used In Unknown Exploit Kit"; flow:established,from_server; content:"|00 c8 b9 67 4e 25 75 e9 92|"; content:"|55 04 06 13 02 4e 4c|"; distance:0; content:"|55 04 07 0c 01 20|"; distance:0; content:"|55 04 03 0c 01 20|"; distance:0; classtype:exploit-kit; sid:2015837; rev:2; metadata:attack_target Client_Endpoint, created_at 2012_10_24, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED iPhone Bot iKee.B Contacting C&C"; flow:to_server,established; content:"/xml/p.php?id="; http_uri; nocase; pcre:"/\/xml\/p\.php\?id=\d{2,}/Ui"; reference:url,mtc.sri.com/iPhone/; reference:url,doc.emergingthreats.net/2010551; classtype:trojan-activity; sid:2010551; rev:9; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Zeus POST Request to CnC - URL agnostic"; flow:established,to_server; content:"POST"; nocase; http_method; content:" HTTP/1."; content:"|0D 0A|Accept|3a| */*|0D 0A|User-Agent|3a| Mozilla"; distance:1; within:34; fast_pattern; content:"|0D 0A|"; distance:0; content:"Content-Length|3a| "; distance:0; content:!"0"; within:1; content:"Connection|3a| Keep-Alive|0D 0A|"; distance:0; content:"|3a| no-cache"; distance:0; content:"|0D 0A 0D 0A|"; distance:0; content:!"Content-Type|3a| "; http_header; content:!"NetflixId="; http_header; reference:url,www.secureworks.com/research/threats/zeus/?threat=zeus; reference:url,lists.emergingthreats.net/pipermail/emerging-sigs/2010-October/009807.html; classtype:command-and-control; sid:2013976; rev:10; metadata:created_at 2011_12_01, former_category MALWARE, updated_at 2011_12_01;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED ASPROX Infected Site - ngg.js Request"; flow:established,to_server; content:"/ngg.js"; http_uri; nocase; content:!"nextgen-gallery"; nocase; reference:url,infosec20.blogspot.com/; reference:url,doc.emergingthreats.net/bin/view/Main/2008373; classtype:trojan-activity; sid:2008373; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor.ADDNEW (DarKDdoser) CnC 1"; flow:to_server,established; dsize:<100; content:"ADDNEW|7C|ddoser|7C|"; depth:14; pcre:"/\x7C(NEW|Awaiting commands)/R"; reference:url,blog.fireeye.com/research/2012/11/backdooraddnew-darkddoser-and-gh0st-a-match-made-in-heaven.html; reference:md5,691305b05ae75389526aa7c15b319c3b; classtype:command-and-control; sid:2015868; rev:2; metadata:created_at 2012_11_07, former_category MALWARE, updated_at 2012_11_07;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS SnortReport nmap.php target Parameter Arbitrary Command Execution Attempt"; flow:established,to_server; content:"GET "; depth:4; content:"/nmap.php?"; http_uri; nocase; content:"target="; http_uri; nocase; pcre:"/target=\w*\;/Ui"; reference:url,osvdb.org/show/osvdb/67739; classtype:web-application-attack; sid:2011555; rev:2; metadata:created_at 2010_09_27, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor.ADDNEW (DarKDdoser) CnC 2"; flow:to_server,established; dsize:<100; content:"ADDNEW|7C|Zombie|7C|"; depth:14; pcre:"/\x7C(NEW|Awaiting commands)/R"; reference:url,blog.fireeye.com/research/2012/11/backdooraddnew-darkddoser-and-gh0st-a-match-made-in-heaven.html; reference:md5,691305b05ae75389526aa7c15b319c3b; classtype:command-and-control; sid:2015869; rev:2; metadata:created_at 2012_11_07, former_category MALWARE, updated_at 2012_11_07;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS iWare Professional SQL Injection Attempt -- index.php D SELECT"; flow:established,to_server; uricontent:"/index.php?"; nocase; uricontent:"D="; nocase; uricontent:"SELECT"; nocase; uricontent:"FROM"; nocase; pcre:"/SELECT.+FROM/Ui"; reference:cve,CVE-2006-6446; reference:url,www.securityfocus.com/bid/21467; reference:url,doc.emergingthreats.net/2006609; classtype:web-application-attack; sid:2006609; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_08_20;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor.ADDNEW (DarKDdoser) CnC 3"; flow:to_server,established; dsize:<100; content:"ADDNEW|7C|Stable|7C|"; depth:14; pcre:"/\x7C(NEW|Awaiting commands)/R"; reference:url,blog.fireeye.com/research/2012/11/backdooraddnew-darkddoser-and-gh0st-a-match-made-in-heaven.html; reference:md5,691305b05ae75389526aa7c15b319c3b; classtype:command-and-control; sid:2015870; rev:2; metadata:created_at 2012_11_07, former_category MALWARE, updated_at 2012_11_07;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS iWare Professional SQL Injection Attempt -- index.php D INSERT"; flow:established,to_server; uricontent:"/index.php?"; nocase; uricontent:"D="; nocase; uricontent:"INSERT"; nocase; uricontent:"INTO"; nocase; pcre:"/INSERT.+INTO/Ui"; reference:cve,CVE-2006-6446; reference:url,www.securityfocus.com/bid/21467; reference:url,doc.emergingthreats.net/2006611; classtype:web-application-attack; sid:2006611; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_08_20;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Delf Alms backdoor checkin"; content:"/getnewv.php?keyword=google&id="; http_uri; nocase; fast_pattern; content:"Mozilla/5.0 (Windows|3b| U|3b| Windows NT 5.1|3b| en-US)"; http_user_agent; flow:to_server,established; classtype:command-and-control; sid:2012803; rev:5; metadata:created_at 2011_05_11, former_category MALWARE, updated_at 2011_05_11;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS iWare Professional SQL Injection Attempt -- index.php D DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"D="; http_uri; nocase; content:"DELETE"; http_uri; nocase; content:"FROM"; http_uri; nocase; pcre:"/DELETE.+FROM/Ui"; reference:cve,CVE-2006-6446; reference:url,www.securityfocus.com/bid/21467; reference:url,doc.emergingthreats.net/2006612; classtype:web-application-attack; sid:2006612; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Mac Flashback Checkin 3"; flow:to_server,established; content:"GET"; http_method; content:"/search?q="; http_uri; content:"&ua="; http_uri; distance: 0; content:"==&al="; http_uri; distance: 0; content:"&cv="; http_uri; distance:0; classtype:command-and-control; sid:2014599; rev:5; metadata:created_at 2012_04_17, former_category MALWARE, updated_at 2012_04_17;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS WF-Links (wflinks) SQL Injection Attempt -- viewcat.php cid SELECT"; flow:established,to_server; content:"/viewcat.php?"; http_uri; nocase; content:"cid="; http_uri; nocase; content:"SELECT"; http_uri; nocase; content:"FROM"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-2373; reference:url,www.milw0rm.com/exploits/3670; reference:url,doc.emergingthreats.net/2003764; classtype:web-application-attack; sid:2003764; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Unknown FakeAV - /get/*.crp"; flow:established,to_server; content:"/get/"; http_uri; content:".crp"; http_uri; fast_pattern; classtype:trojan-activity; sid:2015894; rev:2; metadata:created_at 2012_11_20, updated_at 2012_11_20;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED 180solutions Spyware (action url reported)"; flow: to_server,established; content:"/actionurls/ActionUrl"; http_uri; nocase; reference:url,securityresponse.symantec.com/avcenter/venc/data/pf/adware.180search.html; reference:url,doc.emergingthreats.net/bin/view/Main/2001399; classtype:trojan-activity; sid:2001399; rev:11; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Quarian HTTP Proxy Header"; flow:established,to_server; content:"Content_length|3A 20|"; http_header; content:"Proxy-Connetion|3A 20|"; http_header; reference:url,vrt-blog.snort.org/2012/12/quarian.html; classtype:trojan-activity; sid:2015999; rev:2; metadata:created_at 2012_12_08, updated_at 2012_12_08;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpMyAdmin Setup Code Injection (system)"; flow:established,to_server; content:"POST"; http_method; content:"/scripts/setup.php"; http_uri; nocase; content:"token="; http_client_body; depth:6; content:"host"; http_client_body; content:"system|28 24 5F|"; nocase; http_client_body; reference:cve,CVE-2009-1151; reference:url,www.securityfocus.com/bid/34236; reference:url,labs.neohapsis.com/2009/04/06/about-cve-2009-1151/; reference:url,doc.emergingthreats.net/2009710; classtype:web-application-attack; sid:2009710; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Prinimalka Get Task CnC Beacon"; flow:established,to_server; content:"/command?user_id="; fast_pattern; http_uri; content:"&version_id="; http_uri; content:"&crc="; http_uri; reference:url,ddos.arbornetworks.com/2012/10/trojan-prinimalka-bits-and-pieces/; classtype:command-and-control; sid:2016047; rev:2; metadata:attack_target Client_Endpoint, created_at 2012_12_18, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2012_12_18, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpMyAdmin Setup Code Injection (phpinfo)"; flow:established,to_server; content:"POST "; depth:5; content:"/scripts/setup.php"; http_uri; nocase; content:"|0D 0A 0D 0A|token="; content:"host"; content:"phpinfo|25|28|25|29|25|3b"; nocase; within:64; reference:cve,CVE-2009-1151; reference:url,www.securityfocus.com/bid/34236; reference:url,labs.neohapsis.com/2009/04/06/about-cve-2009-1151/; reference:url,doc.emergingthreats.net/2009709; classtype:web-application-attack; sid:2009709; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Prinimalka Configuration Update Request"; flow:established,to_server; content:"/options?user_id="; http_uri; content:"&version_id="; http_uri; content:"&crc="; http_uri; content:"&uptime="; http_uri; content:"&port="; http_uri; content:"&ip="; http_uri; reference:url,ddos.arbornetworks.com/2012/10/trojan-prinimalka-bits-and-pieces/; classtype:trojan-activity; sid:2016048; rev:2; metadata:created_at 2012_12_18, updated_at 2012_12_18;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS MyConference SQL Injection Attempt -- index.php cid DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"cid="; http_uri; nocase; content:"DELETE"; http_uri; nocase; content:"FROM"; http_uri; nocase; pcre:"/DELETE.+FROM/Ui"; reference:cve,CVE-2007-2737; reference:url,www.frsirt.com/english/advisories/2007/1830; reference:url,doc.emergingthreats.net/2003838; classtype:web-application-attack; sid:2003838; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Prinimalka Prinimalka.py Script In CnC Beacon"; flow:established,to_server; content:"/prinimalka.py/"; http_uri; fast_pattern:only; reference:url,ddos.arbornetworks.com/2012/10/trojan-prinimalka-bits-and-pieces/; classtype:command-and-control; sid:2016049; rev:2; metadata:attack_target Client_Endpoint, created_at 2012_12_18, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2012_12_18, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpMyPortal Remote Inclusion Attempt -- articles.inc.php GLOBALS CHEMINMODULES"; flow:established,to_server; content:"/inc/articles.inc.php?"; http_uri; nocase; content:"GLOBALS[CHEMINMODULES]="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2594; reference:url,www.milw0rm.com/exploits/3879; reference:url,doc.emergingthreats.net/2003703; classtype:web-application-attack; sid:2003703; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32.Daws/Sanny CnC POST"; flow:established,to_server; content:"POST"; http_method; content:"/write.php"; http_uri; fast_pattern; content:"Accept-Language|3A| ko-kr"; http_header; content:"db="; http_client_body; depth:3; content:"&ch="; distance:0; http_client_body; content:"&name="; distance:0; http_client_body; content:"&email="; http_client_body; distance:0; content:"&pw="; http_client_body; distance:0; reference:url,blog.fireeye.com/research/2012/12/to-russia-with-apt.html; reference:url,contagiodump.blogspot.co.uk/2012/12/end-of-year-presents-continue.html; classtype:command-and-control; sid:2016051; rev:5; metadata:created_at 2012_12_18, former_category MALWARE, updated_at 2022_05_03;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHP Turbulence Remote Inclusion Attempt -- turbulence.php GLOBALS tcore"; flow:established,to_server; content:"/user/turbulence.php?"; http_uri; nocase; content:"GLOBALS[tcore]="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2504; reference:url,www.securityfocus.com/bid/23580; reference:url,doc.emergingthreats.net/2003683; classtype:web-application-attack; sid:2003683; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux/Chapro.A Malicious Apache Module CnC Beacon"; flow:established,to_server; content:"POST"; http_method; content:"/index.php"; http_uri; content:"c="; http_client_body; depth:2; content:"&version="; http_client_body; distance:0; content:"&uname="; fast_pattern; http_client_body; distance:0; reference:url,blog.eset.com/2012/12/18/malicious-apache-module-used-for-content-injection-linuxchapro-a; classtype:command-and-control; sid:2016062; rev:2; metadata:attack_target Client_Endpoint, created_at 2012_12_19, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2012_12_19, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PMECMS Remote Inclusion Attempt -- mod_image_index.php config pathMod"; flow:established,to_server; content:"/mod/image/index.php?"; http_uri; nocase; content:"config[pathMod]="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2540; reference:url,www.milw0rm.com/exploits/3852; reference:url,doc.emergingthreats.net/2003672; classtype:web-application-attack; sid:2003672; rev:9; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FakeAV Download antivirus-installer.exe"; flow:to_server,established; content:"/antivirus-install.exe"; http_uri; classtype:trojan-activity; sid:2016110; rev:3; metadata:created_at 2012_12_29, updated_at 2012_12_29;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PMECMS Remote Inclusion Attempt -- mod_liens_index.php config pathMod"; flow:established,to_server; content:"/mod/liens/index.php?"; http_uri; nocase; content:"config[pathMod]="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2540; reference:url,www.milw0rm.com/exploits/3852; reference:url,doc.emergingthreats.net/2003673; classtype:web-application-attack; sid:2003673; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Downloader.FakeFlashPlayer Clientregister.php CnC Beacon"; flow:established,to_server; content:"/clientregister.php?type="; http_uri; content:"&uniqid="; http_uri; content:"&winver="; http_uri; content:"&compusername="; http_uri; content:"&compnetname="; http_uri; classtype:command-and-control; sid:2016124; rev:2; metadata:attack_target Client_Endpoint, created_at 2012_12_29, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2012_12_29, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PMECMS Remote Inclusion Attempt -- mod_liste_index.php config pathMod"; flow:established,to_server; content:"/mod/liste/index.php?"; http_uri; nocase; content:"config[pathMod]="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2540; reference:url,www.milw0rm.com/exploits/3852; reference:url,doc.emergingthreats.net/2003674; classtype:web-application-attack; sid:2003674; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Downloader.FakeFlashPlayer Bitensiteler CnC Beacon"; flow:established,to_server; content:".php?type="; http_uri; content:"&uniqid="; http_uri; content:"&langid="; http_uri; content:"&ver="; http_uri; content:"bitensiteler="; http_uri; classtype:command-and-control; sid:2016126; rev:2; metadata:attack_target Client_Endpoint, created_at 2012_12_29, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2012_12_29, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PMECMS Remote Inclusion Attempt -- mod_special_index.php config pathMod"; flow:established,to_server; content:"/mod/special/index.php?"; http_uri; nocase; content:"config[pathMod]="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2540; reference:url,www.milw0rm.com/exploits/3852; reference:url,doc.emergingthreats.net/2003675; classtype:web-application-attack; sid:2003675; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Downloader.FakeFlashPlayer Kelimeid CnC Beacon"; flow:established,to_server; content:".php?type="; http_uri; content:"&kelimeid"; http_uri; content:"&gecenzaman="; http_uri; content:"&gezilensayfa="; http_uri; content:"&delcookies="; http_uri; classtype:command-and-control; sid:2016127; rev:2; metadata:attack_target Client_Endpoint, created_at 2012_12_29, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2012_12_29, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PMECMS Remote Inclusion Attempt -- mod_texte_index.php config pathMod"; flow:established,to_server; content:"/mod/texte/index.php?"; http_uri; nocase; content:"config[pathMod]="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2540; reference:url,www.milw0rm.com/exploits/3852; reference:url,doc.emergingthreats.net/2003676; classtype:web-application-attack; sid:2003676; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE RevProxy - ClickFraud - MIDUIDEND"; flow:established,to_server; dsize:46; content:"MID"; depth:3; content:"UID"; distance:32; within:3; content:"END"; distance:5; within:3; classtype:trojan-activity; sid:2016293; rev:2; metadata:created_at 2013_01_26, updated_at 2013_01_26;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Pixaria Gallery Remote Inclusion Attempt -- psg.smarty.lib.php cfg sys base_path"; flow:established,to_server; content:"/psg.smarty.lib.php?"; http_uri; nocase; content:"cfg[sys][base_path]="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2458; reference:url,www.frsirt.com/english/advisories/2007/1390; reference:url,doc.emergingthreats.net/2003691; classtype:web-application-attack; sid:2003691; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Backdoor.Win32.Likseput.B Checkin 2"; flow:from_server,established; file_data; content:"|3c 21 2d 2d 0d 0a 3c|img border="; nocase; content:"|2f 23|KX8|2E|"; distance:5; within:64; fast_pattern; pcre:"/^\x3c\x21\x2d\x2d\x0d\x0a\x3cimg\x20border=\d+\x20src=\x22\S+\x2f\x23KX8\x2e/mi"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3aWin32%2fLikseput.B; classtype:command-and-control; sid:2016428; rev:7; metadata:created_at 2011_03_08, former_category MALWARE, updated_at 2011_03_08;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Pixaria Gallery Remote Inclusion class.Smarty.php cfg sys base_path"; flow:established,to_server; content:"/resources/includes/class.Smarty.php?"; http_uri; nocase; content:"cfg[sys][base_path]="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2457; reference:url,www.milw0rm.com/exploits/3733; reference:url,doc.emergingthreats.net/2003702; classtype:web-application-attack; sid:2003702; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE WEBC2-TABLE Checkin Response - Embedded CnC APT1 Related"; flow:established,from_server; flowbits:isset,ET.webc2; file_data; content:"<!---<table<b"; reference:url,www.mandiant.com/apt1; reference:md5,7a7a46e8fbc25a624d58e897dee04ffa; reference:md5,110160e9d6e1483192653d4bfdcbb609; classtype:targeted-activity; sid:2016438; rev:2; metadata:created_at 2013_02_20, former_category MALWARE, updated_at 2013_02_20;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Recly Feederator subscription.php GLOBALS mosConfig_absolute_path parameter remote file inclusion"; flow:established,to_server; content:"GET "; depth:4; content:"/tmsp/subscription.php?"; http_uri; nocase; content:"GLOBALS[mosConfig_absolute_path]="; http_uri; nocase; pcre:"/GLOBALS\[mosConfig_absolute_path\]=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,32194; reference:url,milw0rm.com/exploits/7040; reference:url,doc.emergingthreats.net/2009061; classtype:web-application-attack; sid:2009061; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SEASALT Client Checkin"; flow:established,to_server; dsize:7; content:"fxftest"; depth:7; reference:md5,5e0df5b28a349d46ac8cc7d9e5e61a96; reference:url,www.mandiant.com/apt1; classtype:command-and-control; sid:2016441; rev:2; metadata:created_at 2013_02_20, former_category MALWARE, updated_at 2013_02_20;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS playSMS init.php apps_path themes parameter remote file inclusion"; flow:established,to_server; content:"GET "; depth:4; content:"/plugin/themes/default/init.php?"; http_uri; nocase; content:"apps_path[themes]="; http_uri; nocase; pcre:"/apps_path\[themes\]=\s*(ftps?|https?|php)\:\//Ui"; reference:url,secunia.com/advisories/33386/; reference:url,milw0rm.com/exploits/7687; reference:url,doc.emergingthreats.net/2009086; classtype:web-application-attack; sid:2009086; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE SEASALT Server Response"; flow:established,from_server; dsize:7; content:"fxftest"; depth:7; reference:md5,5e0df5b28a349d46ac8cc7d9e5e61a96; reference:url,www.mandiant.com/apt1; classtype:trojan-activity; sid:2016442; rev:2; metadata:created_at 2013_02_20, updated_at 2013_02_20;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS playSMS function.php apps_path libs parameter remote file inclusion"; flow:established,to_server; content:"GET "; depth:4; content:"/lib/function.php?"; http_uri; nocase; content:"apps_path[libs]="; http_uri; nocase; pcre:"/apps_path\[libs\]=\s*(ftps?|https?|php)\:\//Ui"; reference:url,secunia.com/advisories/33386/; reference:url,milw0rm.com/exploits/7687; reference:url,doc.emergingthreats.net/2009088; classtype:web-application-attack; sid:2009088; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET MALWARE STARSYPOUND Client Checkin"; flow:established,to_server; content:"*(SY)# "; depth:7; reference:md5,8442ae37b91f279a9f06de4c60b286a3; reference:url,www.mandiant.com/apt1; classtype:command-and-control; sid:2016443; rev:2; metadata:created_at 2013_02_20, former_category MALWARE, updated_at 2013_02_20;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Vizayn Urun Tanitim Sitesi SQL Injection Attempt -- default.asp id UPDATE"; flow:established,to_server; uricontent:"/default.asp?"; nocase; uricontent:"id="; nocase; uricontent:"UPDATE"; nocase; uricontent:"SET"; nocase; pcre:"/UPDATE.+SET/Ui"; reference:cve,CVE-2007-2803; reference:url,www.secunia.com/advisories/25348; reference:url,doc.emergingthreats.net/2003998; classtype:web-application-attack; sid:2003998; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_08_20;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE WEBC2-ADSPACE Server Response"; flow:established,from_server; file_data; content:"<!---HEADER ADSPACE style=|22|"; content:"|5c|text $-->"; distance:0; reference:url,www.mandiant.com/apt1; classtype:command-and-control; sid:2016448; rev:2; metadata:created_at 2013_02_20, former_category MALWARE, updated_at 2013_02_20;)
 
-#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Zeus Bot Request to CnC"; flow:established,to_server; content:".bin"; http_uri; content:"GET"; depth:3; http_method; content:".bin HTTP/1.1|0d 0a|Accept|3a| */*|0d 0a|Connection|3a| Close|0d 0a|User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 6.0|3b| Windows NT 5.1|3b| SV1)|0d 0a|Host|3a| "; content:!"|0d 0a|Referer|3a|"; nocase; reference:url,doc.emergingthreats.net/2010861; classtype:command-and-control; sid:2010861; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE WEBC2-AUSOV Checkin Response - Embedded CnC APT1 Related"; flow:established,from_server; file_data; content:"|3c|!-- DOCHTMLAuthor"; pcre:"/^\d+\s*-->/R"; reference:url,www.mandiant.com/apt1; reference:md5,0cf9e999c574ec89595263446978dc9f; reference:md5,0cf9e999c574ec89595263446978dc9f; classtype:targeted-activity; sid:2016449; rev:3; metadata:created_at 2013_02_20, former_category MALWARE, updated_at 2013_02_20;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET EXPLOIT HP OpenView NNM snmpviewer.exe CGI Stack Buffer Overflow 2"; flow:to_server,established; content:"POST "; nocase; depth:5; content:"/OvCgi/snmpviewer.exe"; http_uri; nocase; content:"app="; nocase; content:"act="; nocase; isdataat:257,relative; content:!"|0A|"; within:257; pcre:"/act\x3D[^\x26\s\r\n]{257}/i"; reference:cve,CVE-2010-1552; reference:bugtraq,40068; classtype:attempted-admin; sid:2012683; rev:6; metadata:created_at 2010_09_25, updated_at 2019_08_22;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE STARSYPOUND Client Checkin"; flow:established,from_server; content:"*(SY)# "; depth:7; reference:md5,8442ae37b91f279a9f06de4c60b286a3; reference:url,www.mandiant.com/apt1; classtype:command-and-control; sid:2016444; rev:3; metadata:created_at 2013_02_20, former_category MALWARE, updated_at 2013_02_20;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Buzus Posting Data"; flow:established,to_server; content:"POST "; nocase; depth:5; content:"/fdsupdate"; http_uri; nocase; content:"|0d 0a 0d 0a|PUTF"; reference:url,doc.emergingthreats.net/2010064; classtype:trojan-activity; sid:2010064; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible WEBC2-GREENCAT Response - Embedded CnC APT1 Related"; flow:established,from_server; file_data; content:"<!--|0d 0a|<img border="; pcre:"/^[0-4]\s*src=\x22[^\x22]+\x22\swidth=\d+\sheight=\d+>\r\n-->/R"; reference:url,www.mandiant.com/apt1; reference:md5,b5e9ce72771217680efaeecfafe3da3f; classtype:targeted-activity; sid:2016455; rev:3; metadata:created_at 2013_02_22, former_category MALWARE, updated_at 2013_02_22;)
 
-#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED Exploit Suspected PHP Injection Attack (name=)"; flow:to_server,established; content:"GET "; nocase; depth:4; content:".php?"; http_uri; nocase; content:"name="; http_uri; nocase; pcre:"/name=(https?|ftps?|php)/Ui"; reference:cve,2002-0953; reference:url,doc.emergingthreats.net/2001621; classtype:web-application-attack; sid:2001621; rev:36; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE WEBC2-KT3 Intial Connection Beacon APT1 Related"; flow:established,to_server; dsize:<11; content:"*!Kt3+v|7c|"; depth:8; flowbits:set,ET.WEBC2KT3; reference:url,www.mandiant.com/apt1; reference:md5,ec3a2197ca6b63ee1454d99a6ae145ab; classtype:targeted-activity; sid:2016456; rev:2; metadata:attack_target Client_Endpoint, created_at 2013_02_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2013_02_22, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Metarewards Disclaimer Access"; flow: to_server,established; content:"/www.metareward.com/mailimg/disclaimer/"; http_uri; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2002309; classtype:policy-violation; sid:2002309; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE WEBC2-KT3 Intial Connection Beacon Server Response APT1 Related"; flow:established,from_server; dsize:<11; content:"*!Kt3+v|7c|"; depth:8; flowbits:isset,ET.WEBC2KT3; reference:url,www.mandiant.com/apt1; reference:md5,ec3a2197ca6b63ee1454d99a6ae145ab; classtype:targeted-activity; sid:2016457; rev:3; metadata:attack_target Client_Endpoint, created_at 2013_02_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2013_02_22, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Generic Spambot (often Tibs) Post-Infection Checkin"; flow:established,to_server; content:"/access.php?"; http_uri; nocase; content:"w="; http_uri; nocase; content:"&a="; http_uri; nocase; content:"|0d 0a|Host|3a| "; pcre:"/Host\: \d+\.\d+\.\d+\.\d+\x0d\x0a/"; content:"|0d 0a|Cache-Control|3a| no-cache|0d 0a|"; content:!"|0d 0a|User-Agent|3a| "; reference:url,doc.emergingthreats.net/2008174; classtype:trojan-activity; sid:2008174; rev:9; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE WEBC2-UGX Embedded CnC Response APT1"; flow:established,from_server; flowbits:isset,ET.webc2ugx; file_data; content:"<!-- dW"; within:20; reference:md5,ae45648a8fc01b71214482d35cf8da54; reference:url,www.mandiant.com/apt1; classtype:targeted-activity; sid:2016472; rev:2; metadata:created_at 2013_02_22, former_category MALWARE, updated_at 2013_02_22;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"GPL DELETED IISProtect globaladmin.asp access"; flow:to_server,established; content:"/iisprotect/admin/GlobalAdmin.asp"; http_uri; nocase; reference:nessus,11661; classtype:web-application-activity; sid:2102157; rev:4; metadata:created_at 2010_09_23, updated_at 2019_08_22;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Gimemo Ransomware Checkin"; flow:established,to_client; file_data; content:"/gate.php?computername="; nocase; classtype:command-and-control; sid:2016496; rev:4; metadata:attack_target Client_Endpoint, created_at 2013_02_25, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2013_02_25, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHP Portail Includes.php remote file include"; flow:established,to_server; content:"/includes/includes.php"; http_uri; content:"site_path"; http_uri; nocase; pcre:"/site_path=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,22361; reference:url,doc.emergingthreats.net/2003371; classtype:web-application-attack; sid:2003371; rev:8; metadata:affected_product Any, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Remote_File_Include, updated_at 2019_08_22;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE APT_NGO_wuaclt PDF file"; flow:from_server,established; file_data; content:"%PDF-"; within:5; content:"|3C 21 2D 2D 0D 0A 63 57 4B 51 6D 5A 6C 61 56 56 56 56 56 56 56 56 56 56 56 56 56 63 77 53 64 63 6A 4B 7A 38 35 6D 37 4A 56 6D 37 4A 46 78 6B 5A 6D 5A 6D 52 44 63 5A 58 41 73 6D 5A 6D 5A 7A 42 4A 31 79 73 2F 4F 0D 0A|"; within:200; reference:url,labs.alienvault.com/labs/index.php/2013/latest-adobe-pdf-exploit-used-to-target-uyghur-and-tibetan-activists/; classtype:targeted-activity; sid:2016579; rev:2; metadata:created_at 2013_03_15, former_category MALWARE, updated_at 2013_03_15;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET EXPLOIT HP OpenView NNM snmpviewer.exe CGI Stack Buffer Overflow 1"; flow:to_server,established; content:"POST "; nocase; depth:5; content:"/OvCgi/snmpviewer.exe"; http_uri; nocase; content:"act="; nocase; content:"app="; nocase; isdataat:257,relative; content:!"|0A|"; within:257; pcre:"/app\x3D[^\x26\s\r\n]{257}/i"; reference:cve,CVE-2010-1552; reference:bugtraq,40068; classtype:attempted-admin; sid:2012682; rev:7; metadata:created_at 2010_09_25, updated_at 2019_08_22;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE RevProxy Java  Settings"; flow:established,to_client; file_data; content:"USE_USERAGENT="; content:"DELAY_BETWEEN_SYNCS="; content:"CONNECTION_TIMEOUT="; classtype:trojan-activity; sid:2016592; rev:3; metadata:created_at 2013_03_19, updated_at 2013_03_19;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET DELETED Cisco-MARS/JBoss jmx-console POST"; flow:to_server,established; content:"POST "; depth:5; nocase; content:"/jmx-console/HtmlAdaptor"; http_uri; nocase; flowbits:set,cmars.jboss; reference:bugtraq,19071; reference:url,doc.emergingthreats.net/bin/view/Main/2003064; classtype:attempted-admin; sid:2003064; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [CrowdStrike] ANCHOR PANDA - Adobe Gh0st Beacon"; flow:established, to_server; content: "Adobe"; depth:5; content:"|e0 00 00 00 78 9c|"; distance: 4; within:15; reference:url,blog.crowdstrike.com/whois-anchor-panda/index.html; classtype:trojan-activity; sid:2016656; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_03_22, deployment Perimeter, former_category MALWARE, malware_family Gh0st, malware_family PCRAT, signature_severity Major, tag PCRAT, tag Gh0st, tag RAT, tag c2, updated_at 2016_07_01, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Sality Trojan Web Update"; flow:to_server,established; content:"/new_array2.php?speed="; http_uri; nocase; reference:url,www.sophos.com/security/analyses/w32salityu.html; reference:url,doc.emergingthreats.net/2003424; classtype:trojan-activity; sid:2003424; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [CrowdStrike] ANCHOR PANDA Torn RAT Beacon Message Header Local"; flow:established, to_server; dsize:16; content:"|00 00 00 11 c8 00 00 00 00 00 00 00 00 00 00 00|"; depth:16; flowbits:set,ET.Torn.toread_header; flowbits: noalert; reference:url,blog.crowdstrike.com/whois-anchor-panda/index.html; classtype:trojan-activity; sid:2016659; rev:2; metadata:attack_target Client_Endpoint, created_at 2013_03_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2013_03_22, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ScriptsEz Easy Image Downloader id File Disclosure"; flow:established,to_server; content:"GET "; depth:4; content:"main.php?action=download"; http_uri; nocase; content:"&id="; http_uri; nocase; pcre:"/(\.\.\/){1}/"; reference:url,www.milw0rm.com/exploits/6715; reference:url,secunia.com/Advisories/32210/; reference:url,doc.emergingthreats.net/2008652; classtype:web-application-attack; sid:2008652; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [CrowdStrike] ANCHOR PANDA Torn RAT Beacon Message"; dsize: 200; flow: to_server,established; flowbits:isset,ET.Torn.toread_header; content:"|40 7e 7e 7e|"; offset:196; depth:4; reference:url,blog.crowdstrike.com/whois-anchor-panda/index.html; classtype:trojan-activity; sid:2016660; rev:2; metadata:attack_target Client_Endpoint, created_at 2013_03_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2013_03_22, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PassWiki site_id Parameter Local File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/passwiki.php?site_id="; http_uri; nocase; pcre:"/(\.\.\/){1}/U"; reference:bugtraq,29455; reference:url,doc.emergingthreats.net/2008687; classtype:web-application-attack; sid:2008687; rev:7; metadata:affected_product Web_Server_Applications, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Local_File_Inclusion, updated_at 2019_08_22;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Delfinject Check-in"; flow:established,to_server; content: "|44 4d 7f 49 51 48 50 62 7d 74 61 77 4e 55 32 2f|"; depth:16; dsize:<65; reference:md5,90f8b934c541966aede75094cfef27ed; reference:url,www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=VirTool%3AWin32%2FDelfInject; classtype:trojan-activity; sid:2016685; rev:2; metadata:created_at 2013_03_28, updated_at 2013_03_28;)
 
-#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Mindset Interactive Ad Retrieval"; flow: to_server,established; content:"/mindset5"; http_uri; nocase; reference:url,www.mindsetinteractive.com; reference:url,doc.emergingthreats.net/bin/view/Main/2000594; classtype:trojan-activity; sid:2000594; rev:9; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE W32/NSISDL.Downloader CnC Server Response"; flow:established,to_client; file_data; content:"[install 1]"; within:11; content:"Ins="; within:40; classtype:command-and-control; sid:2016746; rev:2; metadata:created_at 2013_04_09, former_category MALWARE, updated_at 2013_04_09;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET DELETED GuppY error.php Arbitrary Remote Code Execution"; flow: to_server,established; content:"/error.php?"; http_uri; nocase; content:"err="; http_uri; nocase; content:"_SERVER[REMOTE_ADDR]="; http_uri; nocase; reference:bugtraq,15609; reference:url,doc.emergingthreats.net/bin/view/Main/2002703; classtype:web-application-attack; sid:2002703; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Siscos CnC Checkin"; flow:established,to_server; content:".php?getcmd="; fast_pattern:only; http_uri; content:"&uid="; http_uri; content:"User-Agent|3a| "; http_header; content:"|3b| MSlE 6.0|3b|"; distance:23; within:11; http_header; classtype:command-and-control; sid:2013384; rev:3; metadata:created_at 2011_08_09, former_category MALWARE, updated_at 2011_08_09;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Korgo.U Reporting"; flow: to_server,established; content:"/index.php?id="; http_uri; nocase; content:"cnt="; http_uri; nocase; content:"&scn="; http_uri; nocase; content:"&inf="; http_uri; nocase; content:"&ver="; http_uri; nocase; reference:url,www.f-secure.com/v-descs/korgo_u.shtml; reference:url,doc.emergingthreats.net/2003070; classtype:trojan-activity; sid:2003070; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Pony Downloader check-in response STATUS-IMPORT-OK"; flow:established,from_server; file_data; content:"STATUS-IMPORT-OK"; within:16; classtype:trojan-activity; sid:2014563; rev:3; metadata:created_at 2012_04_13, updated_at 2012_04_13;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Korgo.P Reporting"; flow: to_server,established; content:"/index.php?id="; http_uri; nocase; content:"?cnt="; http_uri; nocase; content:"?scn="; http_uri; nocase; content:"?inf="; http_uri; nocase; content:"?ver="; http_uri; nocase; reference:url,www.f-secure.com/v-descs/korgo_p.shtml; reference:url,doc.emergingthreats.net/2008192; classtype:trojan-activity; sid:2008192; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Bancos User-Agent Detected vb wininet"; flow:established,to_server; content:"vb wininet"; nocase; http_user_agent; reference:url,doc.emergingthreats.net/2004114; classtype:trojan-activity; sid:2004114; rev:7; metadata:created_at 2010_07_30, former_category USER_AGENTS, malware_family Bancos, tag Banking_Trojan, updated_at 2018_04_23;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Potential FakeAV download Setup_103s1 or Setup_207 variant"; flow:established,to_server; content:"GET "; nocase; depth:4; content:"/Setup_"; http_uri; nocase; content:".exe"; http_uri; nocase; content:!"|0d 0a|Referer|3a| "; nocase; pcre:"/\/Setup_[0-9]{3}([A-Z][0-9])?\.exe$/Ui"; reference:url,www.prevx.com/avgraph/1/AVG.html; reference:url,doc.emergingthreats.net/2010867; classtype:trojan-activity; sid:2010867; rev:9; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Bredolab Infection - Windows Key"; flow:established,to_server; content:"?s=Windows"; nocase; http_uri; content:"&p="; nocase; http_uri; pcre:"/\&p=[0-9A-Za-z]{5}\-[0-9A-Za-z]{5}\-/U"; reference:url,doc.emergingthreats.net/2010072; classtype:trojan-activity; sid:2010072; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED TROJAN Likely TDSS Download (197.exe)"; flow:established,to_server; content:"GET "; depth:4; nocase; content:"/codec/197.exe"; http_uri; nocase; reference:url,doc.emergingthreats.net/2010056; classtype:trojan-activity; sid:2010056; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Opachki Link Hijacker HTTP Header Injection"; flow:established,to_server; content:".php?l="; fast_pattern; nocase; http_uri; content:"&u="; nocase; http_uri; content:"Accept-Encoding|3a|"; http_header; nocase; content:"Referer|3a| "; http_header; nocase; pcre:"/^Accept-Encoding\x3a\s+([a-z])\1{3}/Hmi"; reference:url,www.secureworks.com/research/threats/opachki/?threat=opachki; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3aWin32%2fOpachki.A; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2009-092213-3317-99&tabid=2; reference:url,doc.emergingthreats.net/2010283; classtype:trojan-activity; sid:2010283; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Psyb0t Code Download"; flow:established,to_server; content:"/udhcpc.env"; http_uri; nocase; reference:url,www.adam.com.au/bogaurd/PSYB0T.pdf; reference:url,doc.emergingthreats.net/2009170; classtype:trojan-activity; sid:2009170; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Rovnix Downloading Config File From CnC"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/config.php?"; http_uri; content:"user="; http_uri; content:"version="; http_uri; content:"&server="; http_uri; content:"&crc="; http_uri; pcre:"/user=[a-f0-9]{32}&/Ui"; reference:url,blog.eset.com/2012/02/22/rovnix-reloaded-new-step-of-evolution; classtype:command-and-control; sid:2014276; rev:4; metadata:created_at 2012_02_24, former_category MALWARE, updated_at 2012_02_24;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED FakeAlert/FraudPack/FakeAV/Guzz/Dload/Vobfus/ZPack Encrypted GIF download 2"; flow:established,to_server; content:"GET "; depth:4; content:"/werber/"; http_uri; nocase; content:"/217.gif"; http_uri; nocase; reference:url,threatinfo.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_AGENT.GUZZ&VSect=T; reference:url,vil.nai.com/vil/content/v_157489.htm; reference:url,threatinfo.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_DLOAD.TID&VSect=T; reference:url,blog.threatfire.com/2009/06/streamviewers-gif-images-embedded-with-encrypted-malware.html; reference:url,doc.emergingthreats.net/2010232; classtype:trojan-activity; sid:2010232; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Embedded Android Dalvik Executable File With Fake Windows Executable Header - Possible AV Bypass Attempt"; flow:established,to_client; file_data; content:"MZ"; within:2; content:"This program"; distance:0; content:"dex|0A|"; distance:0; reference:url,research.zscaler.com/2013/03/guess-who-am-i-pe-or-apk.html; classtype:trojan-activity; sid:2016854; rev:3; metadata:created_at 2013_05_16, updated_at 2013_05_16;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED FakeAlert/FraudPack/FakeAV/Guzz/Dload/Vobfus/ZPack Encrypted GIF download 3"; flow:established,to_server; content:"GET "; depth:4; content:"/item/"; http_uri; nocase; content:"/titem.gif"; http_uri; nocase; reference:url,threatinfo.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_AGENT.GUZZ&VSect=T; reference:url,vil.nai.com/vil/content/v_157489.htm; reference:url,blog.threatfire.com/2009/06/streamviewers-gif-images-embedded-with-encrypted-malware.html; reference:url,doc.emergingthreats.net/2010233; classtype:trojan-activity; sid:2010233; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Embedded ZIP/APK File With Fake Windows Executable Header - Possible AV Bypass Attempt"; flow:established,to_client; file_data; content:"MZ"; within:2; content:"This program"; distance:0; content:"PK|03|"; distance:0; content:"classes."; distance:0; reference:url,research.zscaler.com/2013/03/guess-who-am-i-pe-or-apk.html; classtype:trojan-activity; sid:2016855; rev:2; metadata:created_at 2013_05_16, updated_at 2013_05_16;)
 
-#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS OS Commerce 2.2 RC2 Potential Anonymous Remote Code Execution"; flow:established,to_server; content:"POST "; depth:5; content:".php/"; http_uri; pcre:"/\/[a-z_]+\.php\/[a-z_]+\.php/U"; reference:url,seclists.org/fulldisclosure/2009/Nov/169; reference:url,seclists.org/fulldisclosure/2009/Nov/170; reference:url,doc.emergingthreats.net/2010341; classtype:web-application-attack; sid:2010341; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan-Spy.Win32.Agent.byhm User-Agent (EMSCBVDFRT)"; flow:to_server,established; content:"EMSCBVDFRT"; http_user_agent; depth:10; classtype:trojan-activity; sid:2016907; rev:5; metadata:created_at 2012_03_02, updated_at 2022_05_03;)
 
-alert udp $HOME_NET any -> any 53 (msg:"ET DNS Hiloti DNS CnC Channel Successful Install Message"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"|05|empty"; nocase; distance:0; content:"|0C|explorer_exe"; nocase; distance:0; reference:url,sign.kaffenews.com/?p=104; reference:url,blog.fortinet.com/hiloti-the-botmaster-of-disguise/; classtype:command-and-control; sid:2011911; rev:3; metadata:created_at 2010_11_09, former_category DNS, updated_at 2019_08_29;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.Win32.FresctSpy.A User-Agent (MBVDFRESCT)"; flow:to_server,established; content:"MBVDFRESCT"; nocase; depth:10; http_user_agent; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanSpy%3AWin32%2FAgent.CZ; classtype:trojan-activity; sid:2016908; rev:5; metadata:created_at 2011_09_09, updated_at 2011_09_09;)
 
-alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE DNS Request for Zaletelly CnC Domain"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"zaletelly"; fast_pattern; nocase; distance:0; content:"|02|be|00|"; nocase; reference:url,www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~MDrop-EAB/detailed-analysis.aspx; classtype:command-and-control; sid:2014513; rev:2; metadata:created_at 2012_04_05, former_category MALWARE, updated_at 2019_08_29;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE KeyBoy Backdoor Login"; flow:to_server,established; content:"|c4 4c 87 3f 11 1e c4 1a|"; depth:8; reference:url,community.rapid7.com/community/infosec/blog/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india; classtype:trojan-activity; sid:2016986; rev:2; metadata:created_at 2013_06_08, former_category MALWARE, updated_at 2013_06_08;)
 
-alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE Win32/Pift DNS TXT CnC Lookup ppidn.net"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"|05|ppidn|03|net|00 00 10|"; reference:url,kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/23000/PD23873/en_US/McAfee%20Labs%20Threat%20Advisory-W32-Pift.pdf; reference:md5,d3c6af8284276b11c2f693c1195b4735; classtype:command-and-control; sid:2017312; rev:5; metadata:created_at 2013_08_12, former_category MALWARE, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE KeyBoy Backdoor SysInfo Response header"; flow:to_server,established; content:"|ac 09 7b 09 4b 2a 92 bd ac 00|"; depth:10; reference:url,community.rapid7.com/community/infosec/blog/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india; classtype:trojan-activity; sid:2016987; rev:2; metadata:created_at 2013_06_08, former_category MALWARE, updated_at 2013_06_08;)
 
-alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET MALWARE Possible Hiloti DNS Checkin Message explorer_exe"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"explorer_exe"; nocase; distance:0; reference:url,blog.fortinet.com/hiloti-the-botmaster-of-disguise/; classtype:command-and-control; sid:2012781; rev:3; metadata:created_at 2011_05_03, former_category MALWARE, updated_at 2019_08_29;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE KeyBoy Backdoor File Manager Response Header"; flow:to_server,established; content:"|ac 92 4b 04 ff 37 b3 2a b3 25 ff 76 ac 00|"; depth:14; reference:url,community.rapid7.com/community/infosec/blog/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india; classtype:trojan-activity; sid:2016988; rev:3; metadata:created_at 2013_06_08, former_category MALWARE, updated_at 2013_06_08;)
 
-alert udp $HOME_NET any -> any 53 (msg:"ET INFO DNS Query for a Suspicious Malware Related Numerical .in Domain"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"|02|in|00|"; fast_pattern; nocase; distance:0; pcre:"/\x00[0-9]{4,7}\x02in\x00/i"; reference:url,sign.kaffenews.com/?p=104; reference:url,www.isc.sans.org/diary.html?storyid=10165; classtype:bad-unknown; sid:2012115; rev:7; metadata:created_at 2010_12_30, former_category HUNTING, updated_at 2019_08_29;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE KeyBoy Backdoor File Download Response Header"; flow:to_server,established; content:"|ac 92 4b 04 ff 0c bd 55 2a 04 bd b3 6c ac 00|"; depth:15; reference:url,community.rapid7.com/community/infosec/blog/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india; classtype:trojan-activity; sid:2016989; rev:2; metadata:created_at 2013_06_08, former_category MALWARE, updated_at 2013_06_08;)
 
-alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE Large DNS Query possible covert channel"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"|02|in|00|"; fast_pattern; nocase; distance:0; pcre:"/\x00[0-9]{4,7}\x02in\x00/i"; classtype:bad-unknown; sid:2013075; rev:9; metadata:created_at 2011_06_21, updated_at 2019_08_29;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE KeyBoy Backdoor File Upload Response Header"; flow:to_server,established; content:"|ac 92 4b 04 ff cf 50 04 bd b3 6c ac 00|"; depth:13; reference:url,community.rapid7.com/community/infosec/blog/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india; classtype:trojan-activity; sid:2016990; rev:2; metadata:created_at 2013_06_08, former_category MALWARE, updated_at 2013_06_08;)
 
-#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE DNS Query Gauss Domain *.dotnetadvisor.info"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"|0d|dotnetadvisor|04|info|00|"; fast_pattern; nocase; distance:0; reference:url,www.securelist.com/en/analysis/204792238/Gauss_Abnormal_Distribution; classtype:bad-unknown; sid:2015600; rev:5; metadata:created_at 2012_08_10, updated_at 2019_09_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Srv.SSA-KeyLogger Checkin Traffic"; flow:to_server,established; content:"Srv.SSA-KeyLogger"; http_uri; reference:url,doc.emergingthreats.net/2002175; classtype:command-and-control; sid:2002175; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE FrameworkPOS Covert DNS CnC Beacon 1"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"dc"; nocase; distance:7; content:"|06|beacon"; nocase; offset:12; fast_pattern; pcre:"/^[\x0e-\x1e](?:[a-f0-9]{2}){1,3}(?:dc(?:[a-f0-9]{2}){1,3}){3}.[a-f0-9]{2}/Ri"; reference:md5,a5dc57aea5f397c2313e127a6e01aa00; reference:url,blog.gdatasoftware.com/blog/article/new-frameworkpos-variant-exfiltrates-data-via-dns-requests.html; classtype:command-and-control; sid:2019454; rev:2; metadata:attack_target Client_Endpoint, created_at 2014_10_16, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2019_08_29, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+#alert ip $HOME_NET any -> [50.57.148.87,166.78.144.80] any (msg:"ET MALWARE Connection to Georgia Tech Sinkhole IP (Possible Infected Host)"; threshold:type limit,track by_src,seconds 3600,count 1; classtype:trojan-activity; sid:2016994; rev:2; metadata:created_at 2013_06_11, updated_at 2013_06_11;)
 
-alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE FrameworkPOS Covert DNS CnC Beacon 2"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"dc978a97"; nocase; distance:6; content:"|05|alert"; nocase; offset:12; fast_pattern; pcre:"/^[\x08-\xFF](?:[a-f0-9]{2})*?dc978a97/Ri"; reference:md5,a5dc57aea5f397c2313e127a6e01aa00; reference:url,blog.gdatasoftware.com/blog/article/new-frameworkpos-variant-exfiltrates-data-via-dns-requests.html; classtype:command-and-control; sid:2019455; rev:2; metadata:attack_target Client_Endpoint, created_at 2014_10_16, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2019_08_29, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+#alert ip $HOME_NET any -> 176.31.62.76 any (msg:"ET MALWARE Connection to Zinkhole Sinkhole IP (Possible Infected Host)"; threshold:type limit,track by_src,seconds 3600,count 1; classtype:trojan-activity; sid:2016996; rev:2; metadata:created_at 2013_06_11, updated_at 2013_06_11;)
 
-alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE ELF.MrBlack DOS.TF Malformed Lookup (/lib32/libc.so.6)"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"|0b|/lib32/libc|02|so|01|6|00|"; fast_pattern; distance:0; nocase; reference:md5,312fa52a7992e58359cb68bb0f029ea7; reference:url,blog.malwaremustdie.org/2016/01/mmd-0048-2016-ddostf-new-elf-windows.html; classtype:trojan-activity; sid:2022335; rev:3; metadata:created_at 2016_01_07, updated_at 2019_09_03;)
+#alert ip $HOME_NET any -> 212.227.20.19 any (msg:"ET MALWARE Connection to 1&1 Sinkhole IP (Possible Infected Host)"; threshold:type limit,track by_src,seconds 3600,count 1; classtype:trojan-activity; sid:2016995; rev:3; metadata:created_at 2013_06_11, updated_at 2013_06_11;)
 
-#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE Tofsee DGA (2016-12-15 to 2017-05-04)"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"|07|dq"; fast_pattern; distance:0; pcre:"/^(?:gdqg|hdqh|idqi|jdqj|kdqk|ldql|mdqm|ndqn|odqo|pdqp|qdqq|rdqr|sdqs|tdqt|udqu|vdqv|wdqw|xdqx|ydqy|zdqz)[a-j](?:\x02ch|\x03biz)/R"; threshold: type both, track by_src, count 10, seconds 60; classtype:trojan-activity; sid:2023677; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_12_22, deployment Perimeter, malware_family Spambot, malware_family Tofse, signature_severity Major, updated_at 2019_08_29;)
+#alert ip $HOME_NET any -> 91.233.244.106 any (msg:"ET MALWARE Connection to Dr Web Sinkhole IP(Possible Infected Host)"; threshold:type limit,track by_src,seconds 3600,count 1; classtype:trojan-activity; sid:2016997; rev:2; metadata:created_at 2013_06_11, updated_at 2013_06_11;)
 
-#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE Tofsee DGA (2017-05-04 to 2017-11-02)"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"|07|dq"; fast_pattern; distance:0; pcre:"/^(?:adra|bdrb|cdrc|ddrd|edre|fdrf|gdrg|hdrh|idri|jdrj|kdrk|ldrl|mdrm|ndrn|odro|pdrp|qdrq|rdrr|sdrs|tdrt|udru|vdrv|wdrw|xdrx|ydry|zdrz)[a-j](?:\x02ch|\x03biz)/R"; threshold: type both, track by_src, count 10, seconds 60; classtype:trojan-activity; sid:2023678; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_12_22, deployment Perimeter, malware_family Spambot, malware_family Tofse, signature_severity Major, updated_at 2019_08_29;)
+#alert ip $HOME_NET any -> 193.166.255.171 any (msg:"ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host)"; threshold:type limit,track by_src,seconds 3600,count 1; classtype:trojan-activity; sid:2016998; rev:2; metadata:created_at 2013_06_11, updated_at 2013_06_11;)
 
-alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PowerShell/Agent.A DNS Checkin"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"00"; distance:1; within:2; content:"00000"; distance:0; fast_pattern; pcre:"/^(?!0+30)[0-9A-Z]+30[^0-9]/R"; content:"|00|"; distance:0; reference:url,www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html; classtype:command-and-control; sid:2022836; rev:4; metadata:created_at 2016_05_24, former_category MALWARE, updated_at 2019_08_29;)
+#alert ip $HOME_NET any -> 148.81.111.111 any (msg:"ET MALWARE Connection to a cert.pl Sinkhole IP (Possible Infected Host)"; threshold:type limit,track by_src,seconds 3600,count 1; classtype:trojan-activity; sid:2017001; rev:2; metadata:created_at 2013_06_11, updated_at 2013_06_11;)
 
-alert udp $HOME_NET any -> any 53 (msg:"ET ADWARE_PUP All Numerical .cn Domain Likely Malware Related"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"|02|cn|00|"; distance:0; nocase; fast_pattern; content:!"|03|360"; distance:-8; within:4; pcre:"/\x00[\x02-\x1E][0-9]{2,30}\x02cn\x00/i"; classtype:pup-activity; sid:2012327; rev:6; metadata:created_at 2011_02_21, former_category ADWARE_PUP, updated_at 2019_08_29;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Proxy.Win32.Fackemo.g/Katusha/FakeAlert Checkin"; flow:to_server,established; content:"POST"; http_method; content:"magic="; http_uri; content:"&id="; http_uri; content:"&cache="; http_uri; content:"&tm="; http_uri; content:"&ox="; http_uri; content:!"Mozilla"; http_user_agent; reference:md5,29457bd7a95e11bfd0e614a6e237a344; reference:md5,173a060ed791e620c2ec84d7b360ed60; reference:url,www.bugbopper.com/NameLookup.asp?Name=Packed_Win32_TDSS_o; classtype:command-and-control; sid:2008523; rev:8; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-alert udp $HOME_NET any -> any 53 (msg:"ET ADWARE_PUP All Numerical .ru Domain Lookup Likely Malware Related"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"|02|ru|00|"; fast_pattern; distance:0; nocase; pcre:"/\x00[\x02-\x1E][0-9]{2,30}\x02ru\x00/i"; content:!"|03|101|02|ru"; content:!"|07|9366858|02|ru"; classtype:pup-activity; sid:2012328; rev:8; metadata:created_at 2011_02_21, former_category ADWARE_PUP, updated_at 2019_08_29;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Karagany encrypted binary (3)"; flow:established,to_client; file_data; content:"|f2 fd 90 00 bc a7 00 00|"; within:8; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2016970; rev:4; metadata:created_at 2013_06_05, former_category EXPLOIT_KIT, updated_at 2013_06_05;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain peocity.com"; dns_query; content:"peocity.com"; depth:11; nocase; fast_pattern; classtype:trojan-activity; sid:2016600; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Unknown Webserver Backdoor Domain (google-analytcs)"; flow:established,to_server; content:"google-analytcs.com|0d 0a|"; nocase; http_header; reference:url,blog.sucuri.net/2013/06/apache-php-injection-to-javascript-files.html; classtype:trojan-activity; sid:2017027; rev:2; metadata:created_at 2013_06_18, updated_at 2013_06_18;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain skyruss.net"; dns_query; content:"skyruss.net"; depth:11; nocase; fast_pattern; classtype:trojan-activity; sid:2016602; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Drive Receiving UDP DDoS instructions"; flow:established,to_client; flowbits:isset,ET.Drive.DDoS.Checkin; file_data; content:"-udp "; reference:url,ddos.arbornetworks.com/2013/06/dirtjumpers-ddos-engine-gets-a-tune-up-with-new-drive-variant/; classtype:trojan-activity; sid:2017051; rev:3; metadata:created_at 2013_06_22, updated_at 2013_06_22;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain commanal.net"; dns_query; content:"commanal.net"; depth:12; nocase; fast_pattern; classtype:trojan-activity; sid:2016603; rev:3; metadata:created_at 2013_03_20, updated_at 2019_09_03;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Drive Receiving IP2 DDoS instructions"; flow:established,to_client; flowbits:isset,ET.Drive.DDoS.Checkin; file_data; content:"-ip2 "; reference:url,ddos.arbornetworks.com/2013/06/dirtjumpers-ddos-engine-gets-a-tune-up-with-new-drive-variant/; classtype:trojan-activity; sid:2017050; rev:4; metadata:created_at 2013_06_22, updated_at 2013_06_22;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain natareport.com"; dns_query; content:"natareport.com"; depth:14; nocase; fast_pattern; classtype:trojan-activity; sid:2016604; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Drive Receiving IP DDoS instructions"; flow:established,to_client; flowbits:isset,ET.Drive.DDoS.Checkin; file_data; content:"-ip "; reference:url,ddos.arbornetworks.com/2013/06/dirtjumpers-ddos-engine-gets-a-tune-up-with-new-drive-variant/; classtype:trojan-activity; sid:2017049; rev:3; metadata:created_at 2013_06_22, updated_at 2013_06_22;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain photogellrey.com"; dns_query; content:"photogellrey.com"; depth:16; nocase; fast_pattern; classtype:trojan-activity; sid:2016605; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Drive Receiving POST2 DDoS instructions"; flow:established,to_client; flowbits:isset,ET.Drive.DDoS.Checkin; file_data; content:"-post2 http"; reference:url,ddos.arbornetworks.com/2013/06/dirtjumpers-ddos-engine-gets-a-tune-up-with-new-drive-variant/; classtype:trojan-activity; sid:2017048; rev:3; metadata:created_at 2013_06_22, updated_at 2013_06_22;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain creditrept.com"; dns_query; content:"creditrept.com"; depth:14; nocase; fast_pattern; classtype:trojan-activity; sid:2016608; rev:3; metadata:created_at 2013_03_20, updated_at 2019_09_03;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Drive Receiving POST1 DDoS instructions"; flow:established,to_client; flowbits:isset,ET.Drive.DDoS.Checkin; file_data; content:"-post1 http"; reference:url,ddos.arbornetworks.com/2013/06/dirtjumpers-ddos-engine-gets-a-tune-up-with-new-drive-variant/; classtype:trojan-activity; sid:2017047; rev:3; metadata:created_at 2013_06_22, updated_at 2013_06_22;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain pollingvoter.org"; dns_query; content:"pollingvoter.org"; depth:16; nocase; fast_pattern; classtype:trojan-activity; sid:2016609; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Drive Receiving GET DDoS instructions"; flow:established,to_client; flowbits:isset,ET.Drive.DDoS.Checkin; file_data; content:"-get http"; reference:url,ddos.arbornetworks.com/2013/06/dirtjumpers-ddos-engine-gets-a-tune-up-with-new-drive-variant/; classtype:trojan-activity; sid:2017046; rev:3; metadata:created_at 2013_06_22, updated_at 2013_06_22;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain dfasonline.com"; dns_query; content:"dfasonline.com"; depth:14; nocase; fast_pattern; classtype:trojan-activity; sid:2016610; rev:3; metadata:created_at 2013_03_20, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE AryaN IRC bot Download and Execute Scheduled file command"; flow:established,to_server; content:"PRIVMSG "; depth:8; content:"Download and Execute Scheduled [File|3a|"; classtype:trojan-activity; sid:2017057; rev:1; metadata:created_at 2013_06_25, updated_at 2013_06_25;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain hudsoninst.com"; dns_query; content:"hudsoninst.com"; depth:14; nocase; fast_pattern; classtype:trojan-activity; sid:2016611; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE AryaN IRC bot CnC2"; flow:established,to_server; dsize:<256; content:"PRIVMSG "; depth:8; content:" |3a|[AryaN]|3a| "; within:30; content: "download"; nocase; classtype:command-and-control; sid:2017056; rev:1; metadata:created_at 2013_06_25, former_category MALWARE, updated_at 2013_06_25;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain wsurveymaster.com"; dns_query; content:"wsurveymaster.com"; depth:17; nocase; fast_pattern; classtype:trojan-activity; sid:2016612; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE AryaN IRC bot CnC1"; flow:established,to_server; dsize:<256; content:"PRIVMSG "; depth:8; content:"|20 3a 03|10OK|3a 03 20|"; within:30; classtype:command-and-control; sid:2017055; rev:1; metadata:created_at 2013_06_25, former_category MALWARE, updated_at 2013_06_25;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain nhrasurvey.org"; dns_query; content:"nhrasurvey.org"; depth:14; nocase; fast_pattern; classtype:trojan-activity; sid:2016613; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE AryaN IRC bot Flood command"; flow:established,to_server; content:"PRIVMSG "; depth:8; content:"Flood|3a| Started [Type|3a|"; classtype:trojan-activity; sid:2017058; rev:1; metadata:created_at 2013_06_25, updated_at 2013_06_25;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain pdi2012.org"; dns_query; content:"pdi2012.org"; depth:11; nocase; fast_pattern; classtype:trojan-activity; sid:2016614; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE AryaN IRC bot Botkill command"; flow:established,to_server; content:"PRIVMSG "; depth:8; content:"Botkill|3a| Cycled once"; classtype:trojan-activity; sid:2017059; rev:1; metadata:created_at 2013_06_25, updated_at 2013_06_25;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain nceba.org"; dns_query; content:"nceba.org"; depth:9; nocase; fast_pattern; classtype:trojan-activity; sid:2016615; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Keylogger Crack by bahman"; flow:established,to_server; content:"POST"; nocase; http_method; content:"&message=|2b|keylogger|2b|Crack|2b|By|2b 25 32 31 25 32 31 25 32 31|...bahman"; nocase; http_client_body; reference:url,doc.emergingthreats.net/2008369; classtype:trojan-activity; sid:2008369; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain linkedin-blog.com"; dns_query; content:"linkedin-blog.com"; depth:17; nocase; fast_pattern; classtype:trojan-activity; sid:2016616; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Cryptmen FakAV page Title"; flow:established,from_server; file_data; content:"<title>Viruses were found on your computer"; classtype:trojan-activity; sid:2017137; rev:2; metadata:created_at 2013_07_13, updated_at 2013_07_13;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain aafbonus.com"; dns_query; content:"aafbonus.com"; depth:12; nocase; fast_pattern; classtype:trojan-activity; sid:2016617; rev:3; metadata:created_at 2013_03_20, updated_at 2019_09_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE E-Jihad 3.0 HTTP Activity 1"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/tlog.php?logn="; http_uri; pcre:"/\/tlog\.php\?logn=[^\s]+&pss=[^\s]/U"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007683; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain milstars.org"; dns_query; content:"milstars.org"; depth:12; nocase; fast_pattern; classtype:trojan-activity; sid:2016618; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE E-Jihad 3.0 HTTP Activity 2"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/ntarg.php?"; http_uri; pcre:"/ntarg\.php\?[^\s]*(notdoing|howme|uname)=/U"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007684; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain vatdex.com"; dns_query; content:"vatdex.com"; depth:10; nocase; fast_pattern; classtype:trojan-activity; sid:2016619; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE E-Jihad 3.0 HTTP Activity 3"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/tnewu.php?nlogin="; http_uri; pcre:"/\/tnewu\.php\?nlogin=[^\s]+&npss=[^\s]+&invitedby=[^\s]/U"; reference:url,doc.emergingthreats.net/bin/view/Main/EJihadHackTool; classtype:trojan-activity; sid:2007685; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain applesea.net"; dns_query; content:"applesea.net"; depth:12; nocase; fast_pattern; classtype:trojan-activity; sid:2016621; rev:3; metadata:created_at 2013_03_20, updated_at 2019_09_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE - Trojan.Proxy.PPAgent.t (updatea)"; flow:to_server,established; content:"/updatea.php?p="; nocase; http_uri; pcre:"/updatea\.php\?p=\d/Ui"; flowbits:set,BT.ppagent.updatea; flowbits:noalert; reference:url,original.avira.com/en/threats/vdf_history.html?id_vdf=2738; reference:url,doc.emergingthreats.net/2003115; classtype:trojan-activity; sid:2003115; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain appledmg.net"; dns_query; content:"appledmg.net"; depth:12; nocase; fast_pattern; classtype:trojan-activity; sid:2016622; rev:3; metadata:created_at 2013_03_20, updated_at 2019_09_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.Win32/Mutopy.A Checkin"; flow:to_server,established; content:"/protocol.php?p="; fast_pattern:only; http_uri; content:"&d="; http_uri; pcre:"/&d=.{44}$/U"; reference:md5,2a0344bac492c65400eb944ac79ac3c3; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3AWin32%2FMutopy.A&ThreatID=-2147312217; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/header-spoofing-hides-malware-communication/; classtype:command-and-control; sid:2016963; rev:5; metadata:created_at 2012_04_13, former_category MALWARE, updated_at 2012_04_13;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain appleintouch.net"; dns_query; content:"appleintouch.net"; depth:16; nocase; fast_pattern; classtype:trojan-activity; sid:2016623; rev:3; metadata:created_at 2013_03_20, updated_at 2019_09_03;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE W32/StealRat.SpamBot CnC Server Configuration File Response"; flowbits:isset,et.stealrat.config; flow:established,to_client; file_data; content:""; within:50; content:"<|2F|dudp>"; within:100; content:""; within:50; content:"<|2F|pudp>"; within:100; content:""; within:50; content:""; within:50; content:"<|2F|dom>"; within:100; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-stealrat.pdf; classtype:command-and-control; sid:2017275; rev:2; metadata:created_at 2013_08_05, former_category MALWARE, updated_at 2013_08_05;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain appledns.net"; dns_query; content:"appledns.net"; depth:12; nocase; fast_pattern; classtype:trojan-activity; sid:2016625; rev:3; metadata:created_at 2013_03_20, updated_at 2019_09_03;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible CritX/SafePack/FlashPack Jar Download"; flow:established,from_server; content:"filename=j"; http_header; content:".jar"; distance:23; within:4; http_header; pcre:"/filename=j[a-f0-9]{23}\.jar/H"; classtype:exploit-kit; sid:2017296; rev:5; metadata:created_at 2013_08_08, former_category CURRENT_EVENTS, updated_at 2013_08_08;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain emailserverctr.com"; dns_query; content:"emailserverctr.com"; depth:18; nocase; fast_pattern; classtype:trojan-activity; sid:2016626; rev:3; metadata:created_at 2013_03_20, updated_at 2019_09_03;)
+alert ip $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DDoS.Win32.Agent.bay Covert Channel (VERSONEX and Mr.Black)"; content:"VERSONEX|3a|"; depth:64; fast_pattern; content:"Mr.Black"; within:50; classtype:trojan-activity; sid:2017315; rev:2; metadata:created_at 2013_08_12, updated_at 2013_08_12;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain slashdoc.org"; dns_query; content:"slashdoc.org"; depth:12; nocase; fast_pattern; classtype:trojan-activity; sid:2016629; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan Sinowal/Torpig Phoning Home"; flow:established,to_server; content:"GET"; http_method; content:"/ld/"; http_uri; content:".php"; http_uri; content:"id="; http_uri; content:"&n="; http_uri; content:"&try="; http_uri; reference:url,doc.emergingthreats.net/2008580; classtype:trojan-activity; sid:2008580; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain photosmagnum.com"; dns_query; content:"photosmagnum.com"; depth:16; nocase; fast_pattern; classtype:trojan-activity; sid:2016630; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Kuluoz.B CnC"; flow:from_server,established; file_data; content:"c=run&u=/get/"; content:".exe"; distance:0; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-asprox-reborn.pdf; classtype:command-and-control; sid:2015902; rev:7; metadata:created_at 2012_09_21, former_category MALWARE, updated_at 2012_09_21;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain resume4jobs.net"; dns_query; content:"resume4jobs.net"; depth:15; nocase; fast_pattern; classtype:trojan-activity; sid:2016631; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Kuluoz.B CnC 2"; flow:from_server,established; file_data; content:"c=idl"; within:5; isdataat:!1,relative; reference:md5,a88ba0c2b30afba357ebb38df9898f9e; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-asprox-reborn.pdf; classtype:command-and-control; sid:2015903; rev:5; metadata:created_at 2012_09_25, former_category MALWARE, updated_at 2012_09_25;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain searching-job.net"; dns_query; content:"searching-job.net"; depth:17; nocase; fast_pattern; classtype:trojan-activity; sid:2016632; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ATTACKER IRCBot - net add PRIVMSG Command"; flow:established,from_server; content:"PRIVMSG "; content:"net"; within:200; content:"/add"; within:100; classtype:trojan-activity; sid:2017285; rev:4; metadata:created_at 2013_08_07, former_category MALWARE, updated_at 2013_08_07;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain servagency.com"; dns_query; content:"servagency.com"; depth:14; nocase; fast_pattern; classtype:trojan-activity; sid:2016633; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ATTACKER IRCBot - netsh - PRIVMSG Command"; flow:established,from_server; content:"PRIVMSG "; content:"netsh"; within:50; classtype:trojan-activity; sid:2017286; rev:4; metadata:created_at 2013_08_07, former_category MALWARE, updated_at 2013_08_07;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain gsasmartpay.org"; dns_query; content:"gsasmartpay.org"; depth:15; nocase; fast_pattern; classtype:trojan-activity; sid:2016634; rev:3; metadata:created_at 2013_03_20, updated_at 2019_09_03;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ATTACKER IRCBot - ipconfig - PRIVMSG Command"; flow:established,from_server; content:"PRIVMSG "; content:"ipconfig"; within:100; classtype:trojan-activity; sid:2017287; rev:4; metadata:created_at 2013_08_07, former_category MALWARE, updated_at 2013_08_07;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query Sykipot Domain tech-att.com"; dns_query; content:"tech-att.com"; depth:12; nocase; fast_pattern; classtype:trojan-activity; sid:2016635; rev:3; metadata:created_at 2013_03_20, former_category CURRENT_EVENTS, updated_at 2019_09_03;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ATTACKER IRCBot -  reg - PRIVMSG Command"; flow:established,from_server; content:"PRIVMSG "; content:"reg "; within:50; content:"HKEY_"; within:20; classtype:trojan-activity; sid:2017288; rev:4; metadata:created_at 2013_08_07, former_category MALWARE, updated_at 2013_08_07;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Likely Synolocker .onion DNS lookup"; dns_query; content:"cypherxffttr7hho"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2018948; rev:3; metadata:created_at 2014_08_18, updated_at 2019_09_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ATTACKER IRCBot - The command completed successfully - PRIVMSG Response"; flow:established,from_client; content:"PRIVMSG "; content:"The command completed successfully."; distance:0; classtype:trojan-activity; sid:2017289; rev:4; metadata:created_at 2013_08_07, updated_at 2013_08_07;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS query for Morto RDP worm related domain jifr.co.cc"; dns_query; content:"jifr.co.cc"; depth:10; fast_pattern; reference:url,www.f-secure.com/weblog/archives/00002227.html; classtype:bad-unknown; sid:2013483; rev:4; metadata:created_at 2011_08_29, updated_at 2019_09_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ATTACKER IRCBot - PRIVMSG Response - net command output"; flow:established,from_client; content:"PRIVMSG "; fast_pattern; content:"-------------------------------------------------------------------------------"; distance:0; classtype:trojan-activity; sid:2017291; rev:5; metadata:created_at 2013_08_07, updated_at 2013_08_07;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS query for Morto RDP worm related domain qfsl.co.be"; dns_query; content:"qfsl.co.be"; depth:10; fast_pattern; reference:url,contagiodump.blogspot.com/2011/08/aug-28-morto-tsclient-rdp-worm-with.html; classtype:bad-unknown; sid:2013493; rev:4; metadata:created_at 2011_08_30, updated_at 2019_09_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ATTACKER IRCBot - PRIVMSG Response - ipconfig command output"; flow:established,from_client; content:"PRIVMSG "; content:"Windows IP"; within:200; classtype:trojan-activity; sid:2017292; rev:4; metadata:created_at 2013_08_07, updated_at 2013_08_07;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS query for Morto RDP worm related domain qfsl.co.cc"; dns_query; content:"qfsl.co.cc"; depth:10; fast_pattern; reference:url,contagiodump.blogspot.com/2011/08/aug-28-morto-tsclient-rdp-worm-with.html; classtype:bad-unknown; sid:2013494; rev:4; metadata:created_at 2011_08_30, updated_at 2019_09_03;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ATTACKER IRCBot - net localgroup - PRIVMSG Command"; flow:established,from_server; content:"PRIVMSG "; content:"net localgroup"; within:200; classtype:trojan-activity; sid:2017284; rev:4; metadata:created_at 2013_08_07, updated_at 2013_08_07;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS query for Morto RDP worm related domain jifr.co.be"; dns_query; content:"jifr.co.be"; depth:10; fast_pattern; reference:url,contagiodump.blogspot.com/2011/08/aug-28-morto-tsclient-rdp-worm-with.html; classtype:bad-unknown; sid:2013496; rev:4; metadata:created_at 2011_08_30, updated_at 2019_09_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ATTACKER IRCBot - PRIVMSG Response - Directory Listing *nix"; flow:established,from_client; content:"PRIVMSG "; fast_pattern; content:"-rw-r--r--"; within:300; classtype:trojan-activity; sid:2017303; rev:5; metadata:created_at 2013_08_08, updated_at 2013_08_08;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Win32/Chanitor.A DNS Lookup"; dns_query; content:"svcz25e3m4mwlauz"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2019519; rev:3; metadata:created_at 2014_10_27, former_category MALWARE, updated_at 2019_09_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ATTACKER IRCBot - PRIVMSG Response - Directory Listing"; flow:established,from_client; content:"PRIVMSG "; content:"  "; within:200; classtype:trojan-activity; sid:2017290; rev:3; metadata:created_at 2013_08_07, updated_at 2013_08_07;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Cryptolocker .onion Proxy Domain"; dns_query; content:"r2bv3u64ytfi2ssf"; depth:16; fast_pattern; nocase; reference:url,barracudalabs.com/2014/12/new-cryptolocker-spear-phishing-campaign-looks-to-be-the-grinch-that-stole-christmas-in-australia/; classtype:trojan-activity; sid:2019979; rev:4; metadata:created_at 2014_12_20, updated_at 2019_09_03;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ATTACKER IRCBot - net user - PRIVMSG Command"; flow:established,from_server; content:"PRIVMSG "; content:"net user"; within:200; classtype:trojan-activity; sid:2017283; rev:4; metadata:created_at 2013_08_07, former_category MALWARE, updated_at 2013_08_07;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Critroni Variant .onion Proxy Domain"; dns_query; content:"qtrudrukmurps7tc"; depth:16; nocase; fast_pattern; reference:md5,35a7f70c5e0cd4814224c96e3c62fa42; classtype:trojan-activity; sid:2020206; rev:3; metadata:created_at 2015_01_19, updated_at 2019_09_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Optix Pro Trojan/Keylogger Reporting Installation via Email"; flow:established,to_server; content:"Optix Pro v"; content:"Installed Trojan Port|3a|"; distance:0; reference:url,en.wikipedia.org/wiki/Optix_Pro; classtype:trojan-activity; sid:2008212; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Critroni Variant .onion Proxy Domain"; dns_query; content:"tzsvejrzduo52siy"; depth:16; nocase; fast_pattern; reference:md5,49e988b04144b478e3f52b2abe8a5572; classtype:trojan-activity; sid:2020210; rev:3; metadata:created_at 2015_01_20, updated_at 2019_09_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DarkComet-RAT server join acknowledgement"; flow:to_server,established; dsize:12; content:"|39 34 41 35 41 44 30 41 45 46 36 39|"; flowbits:isset,ET.DarkCometJoin; reference:url,www.darkcomet-rat.com; reference:url,anubis.iseclab.org/?action=result&task_id=1a7326f61fef1ecb4ed4fbf3de3f3b8cb&format=txt; classtype:trojan-activity; sid:2013284; rev:3; metadata:created_at 2011_07_18, updated_at 2011_07_18;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Critroni Variant .onion Proxy Domain"; dns_query; content:"ohmva4gbywokzqso"; depth:16; nocase; fast_pattern; classtype:trojan-activity; sid:2020226; rev:3; metadata:created_at 2015_01_21, updated_at 2019_09_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DarkComet-RAT Client Keepalive"; flow:to_server,established; dsize:12; content:"|39 34 41 35 41 44 30 41 45 46 36 39|"; flowbits:isset,ET.DarkCometJoin; reference:url,www.darkcomet-rat.com; classtype:trojan-activity; sid:2013285; rev:2; metadata:created_at 2011_07_18, updated_at 2011_07_18;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query for Suspicious crptarv4hcu24ijv Domain - CryptoWall Domains"; dns_query; content:"crptarv4hcu24ijv"; depth:16; fast_pattern; nocase; reference:url,blogs.cisco.com/security/talos/cryptowall-2; reference:url,researchcenter.paloaltonetworks.com/2014/10/tracking-new-ransomware-cryptowall-2-0/; classtype:misc-activity; sid:2020280; rev:3; metadata:created_at 2015_01_23, updated_at 2019_09_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.APT.9002 CnC Traffic"; flow:to_server,established; dsize:24; content:"|0c 00 00 00 08 00 00 00 19 ff ff ff ff 00 00 00 00 11 00 00|"; offset:4; depth:20; reference:md5,81687637b7bf2b90258a5006683e781c; reference:url,www.fireeye.com/blog/technical/cyber-exploits/2013/08/the-sunshop-campaign-continues.html; classtype:targeted-activity; sid:2016398; rev:8; metadata:created_at 2012_06_28, former_category MALWARE, updated_at 2012_06_28;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query for Suspicious crptbfoi5i54ubez Domain - CryptoWall Domains"; dns_query; content:"crptbfoi5i54ubez"; depth:16; fast_pattern; nocase; reference:url,blogs.cisco.com/security/talos/cryptowall-2; reference:url,researchcenter.paloaltonetworks.com/2014/10/tracking-new-ransomware-cryptowall-2-0/; classtype:misc-activity; sid:2020281; rev:3; metadata:created_at 2015_01_23, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.admin@388 Keepalive to CnC"; flow:established,to_server; content:"|b0 f6 8f d3 1c 2b 0e 50 7e 16 85 de 0c ae 6e 67|"; offset:16; depth:16; dsize:48; reference:url,www.fireeye.com/resources/pdfs/fireeye-poison-ivy-report.pdf; classtype:command-and-control; sid:2017350; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_08_21, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query for Suspicious crptcj7wd4oaafdl Domain - CryptoWall Domains"; dns_query; content:"crptcj7wd4oaafdl"; depth:16; fast_pattern; nocase; reference:url,blogs.cisco.com/security/talos/cryptowall-2; reference:url,researchcenter.paloaltonetworks.com/2014/10/tracking-new-ransomware-cryptowall-2-0/; classtype:misc-activity; sid:2020282; rev:3; metadata:created_at 2015_01_23, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.th3bug Keepalive to CnC"; flow:established,to_server; content:"|35 d1 50 14 94 b2 24 ac 9b 00 2e f1 99 a0 82 4d|"; offset:16; depth:16; dsize:48; reference:url,www.fireeye.com/resources/pdfs/fireeye-poison-ivy-report.pdf; classtype:command-and-control; sid:2017351; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_08_21, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Win32/Critroni Tor DNS Proxy lookup"; dns_query; content:"23bteufi2kcqza2l"; depth:16; nocase; reference:md5,194a931aa49583191eedd19478396ebc; classtype:trojan-activity; sid:2019909; rev:5; metadata:created_at 2014_12_11, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.keaidestone Keepalive to CnC"; flow:established,to_server; content:"|82 ca 6f eb 66 ed 9e 86 dc 95 29 f0 68 a2 5d b8|"; offset:16; depth:16; dsize:48; reference:url,www.fireeye.com/resources/pdfs/fireeye-poison-ivy-report.pdf; classtype:command-and-control; sid:2017352; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_08_21, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Critroni Variant .onion Proxy Domain"; dns_query; content:"sgqjml3dstgmarn3"; depth:16; nocase; fast_pattern; classtype:trojan-activity; sid:2020357; rev:3; metadata:created_at 2015_02_04, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.suzuki Keepalive to CnC"; flow:established,to_server; content:"|d4 77 eb ff b6 94 cc d1 25 b6 30 12 23 d7 2e 24|"; offset:16; depth:16; dsize:48; reference:url,www.fireeye.com/resources/pdfs/fireeye-poison-ivy-report.pdf; classtype:command-and-control; sid:2017353; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_08_21, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Chanitor .onion Proxy Domain"; dns_query; content:"brk7tda32wtkxjpa"; depth:16; nocase; fast_pattern; reference:md5,34ad24860495397c994f8ae168d0e639; classtype:trojan-activity; sid:2020581; rev:3; metadata:created_at 2015_02_27, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.happyyongzi Keepalive to CnC"; flow:established,to_server; content:"|ad 4a 6c bb a7 9c 30 3e 44 bc cf a5 db 77 3c 62|"; offset:16; depth:16; dsize:48; reference:url,www.fireeye.com/resources/pdfs/fireeye-poison-ivy-report.pdf; classtype:command-and-control; sid:2017354; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_08_21, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Teerac/CryptoFortress .onion Proxy Domain (h63rbx7gkd3gygag)"; dns_query; content:"h63rbx7gkd3gygag"; depth:16; nocase; fast_pattern; classtype:trojan-activity; sid:2020616; rev:3; metadata:created_at 2015_03_04, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.key@123 Keepalive to CnC"; flow:established,to_server; content:"|ef 80 7b ec 93 e6 92 06 17 12 27 be e3 e2 e1 19|"; offset:16; depth:16; dsize:48; reference:url,www.fireeye.com/resources/pdfs/fireeye-poison-ivy-report.pdf; classtype:command-and-control; sid:2017355; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_08_21, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Cryptolocker .onion Proxy Domain (juf5pjk4sl7uojh4)"; dns_query; content:"juf5pjk4sl7uojh4"; depth:16; fast_pattern; nocase; reference:md5,499a46c23afe23de49346adf1b4f3a4f; reference:url,www.mogozobo.com/?p=2371; classtype:trojan-activity; sid:2020670; rev:3; metadata:created_at 2015_03_11, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.gwx@123 Keepalive to CnC"; flow:established,to_server; content:"|6c 6e d3 08 a6 26 34 c7 bf c6 d3 d9 df 04 25 97|"; offset:16; depth:16; dsize:48; reference:url,www.fireeye.com/resources/pdfs/fireeye-poison-ivy-report.pdf; classtype:command-and-control; sid:2017356; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_08_21, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Cryptolocker .onion Proxy Domain (4elcqmis624seeo7)"; dns_query; content:"4elcqmis624seeo7"; depth:16; fast_pattern; nocase; reference:url,teknoseyir.com/durum/291421; classtype:trojan-activity; sid:2020685; rev:3; metadata:created_at 2015_03_12, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.wwwst@Admin Keepalive to CnC"; flow:established,to_server; content:"|b4 7d 56 44 f3 23 e2 a2 1d 74 18 b6 bc 72 66 2a|"; offset:16; depth:16; dsize:48; reference:url,www.fireeye.com/resources/pdfs/fireeye-poison-ivy-report.pdf; classtype:command-and-control; sid:2017357; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_08_21, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Cryptolocker .onion Proxy Domain (erhitnwfvpgajfbu)"; dns_query; content:"erhitnwfvpgajfbu"; depth:16; nocase; reference:url,www.welivesecurity.com/2014/09/04/torrentlocker-now-targets-uk-royal-mail-phishing/; classtype:trojan-activity; sid:2019123; rev:5; metadata:created_at 2014_09_05, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.xiaoxiaohuli Keepalive to CnC"; flow:established,to_server; content:"|4e c3 69 55 10 ad 3f 34 31 cc d1 73 30 ae 16 64|"; offset:16; depth:16; dsize:48; reference:url,www.fireeye.com/resources/pdfs/fireeye-poison-ivy-report.pdf; classtype:command-and-control; sid:2017358; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_08_21, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Zbot .onion Proxy Domain (3bjpwsf3fjcwtnwx)"; dns_query; content:"3bjpwsf3fjcwtnwx"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2020727; rev:3; metadata:created_at 2015_03_23, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.smallfish Keepalive to CnC"; flow:established,to_server; content:"|19 07 1b 24 3b 7a 9d e7 77 1e 84 f6 0f 60 3e 27|"; offset:16; depth:16; dsize:48; reference:url,www.fireeye.com/resources/pdfs/fireeye-poison-ivy-report.pdf; classtype:command-and-control; sid:2017359; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_08_21, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Vawtrak/NeverQuest .onion Proxy Domain (otsaa35gxbcwvrqs)"; dns_query; content:"otsaa35gxbcwvrqs"; depth:16; nocase; fast_pattern; reference:url,now.avg.com/banking-trojan-vawtrak-harvesting-passwords-worldwide/; classtype:trojan-activity; sid:2020759; rev:3; metadata:created_at 2015_03_27, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.XGstone Keepalive to CnC"; flow:established,to_server; content:"|ed d2 c6 f2 b9 ca 1e df 5c ba b7 0c 59 8e 9c 49|"; offset:16; depth:16; dsize:48; reference:url,www.fireeye.com/resources/pdfs/fireeye-poison-ivy-report.pdf; classtype:command-and-control; sid:2017360; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_08_21, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Vawtrak/NeverQuest .onion Proxy Domain (4bpthx5z4e7n6gnb)"; dns_query; content:"4bpthx5z4e7n6gnb"; depth:16; nocase; fast_pattern; reference:url,now.avg.com/banking-trojan-vawtrak-harvesting-passwords-worldwide/; classtype:trojan-activity; sid:2020760; rev:3; metadata:created_at 2015_03_27, updated_at 2019_09_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Mashigoom/Tranwos/RevProxy ClickFraud - hello"; flow:established,to_server; threshold:type both,track by_src,seconds 60,count 1; dsize:<150; content:"hello/"; depth:6; content:"/"; within:3; distance:2; content:"/"; pcre:"/^hello\/[0-9]\.[0-9]\/[0-9]{3}/"; classtype:trojan-activity; sid:2016292; rev:6; metadata:created_at 2013_01_26, updated_at 2013_01_26;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Vawtrak/NeverQuest .onion Proxy Domain (bc3ywvif4m3lnw4o)"; dns_query; content:"bc3ywvif4m3lnw4o"; depth:16; nocase; fast_pattern; reference:url,now.avg.com/banking-trojan-vawtrak-harvesting-passwords-worldwide/; classtype:trojan-activity; sid:2020761; rev:3; metadata:created_at 2015_03_27, updated_at 2019_09_03;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Drive DDoS Tool get command received key=okokokjjk"; flow:established,from_server; file_data; content:"QgwKH08DHh4bVURA"; within:16; reference:url,www.arbornetworks.com/asert/2013/08/dirtjumper-drive-shifts-into-a-new-gear/; classtype:trojan-activity; sid:2017378; rev:5; metadata:created_at 2013_08_27, updated_at 2013_08_27;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE CryptoLocker .onion Proxy Domain (33p5mqkaj22irv4z)"; dns_query; content:"33p5mqkaj22irv4z"; depth:16; fast_pattern; nocase; reference:md5,1c6269fe48cba5f830a64a50bdf4ffe5; reference:url,www.bleepingcomputer.com/forums/t/547708/torrentlocker-ransomware-cracked-and-decrypter-has-been-made/page-13; classtype:trojan-activity; sid:2020915; rev:3; metadata:created_at 2015_04_15, updated_at 2019_09_03;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Drive DDoS Tool long command received key=okokokjjk"; flow:established,from_server; file_data; content:"QgcABQhLAh4fH1FA"; within:16; reference:url,www.arbornetworks.com/asert/2013/08/dirtjumper-drive-shifts-into-a-new-gear/; classtype:trojan-activity; sid:2017379; rev:5; metadata:created_at 2013_08_27, updated_at 2013_08_27;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE CryptoLocker .onion Proxy Domain (pf3tlgkpks7pu7yr)"; dns_query; content:"pf3tlgkpks7pu7yr"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2020952; rev:3; metadata:created_at 2015_04_21, updated_at 2019_09_03;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Drive DDoS Tool smart command received key=okokokjjk"; flow:established,from_server; file_data; content:"QhgCCh0fSgIfGxtV"; within:16; reference:url,www.arbornetworks.com/asert/2013/08/dirtjumper-drive-shifts-into-a-new-gear/; classtype:trojan-activity; sid:2017380; rev:5; metadata:created_at 2013_08_27, updated_at 2013_08_27;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Teerac/CryptoFortress .onion Proxy Domain (cld7vqwcvn2bii67)"; dns_query; content:"cld7vqwcvn2bii67"; depth:16; fast_pattern; nocase; reference:url,www.hybrid-analysis.com/sample/650d5a7d247fbe9c7f4d92e901319fec8c83fd07d4f5291f23c30f338a2e2974?environmentId=2#extracted-strings; reference:md5,4a20784de661675d281edbd48a6e2485; classtype:trojan-activity; sid:2021041; rev:3; metadata:created_at 2015_05_01, updated_at 2019_09_03;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Drive DDoS Tool post1 command received key=okokokjjk"; flow:established,from_server; file_data; content:"QhsAGBtaSgIfGxtV"; within:16; reference:url,www.arbornetworks.com/asert/2013/08/dirtjumper-drive-shifts-into-a-new-gear/; classtype:trojan-activity; sid:2017381; rev:5; metadata:created_at 2013_08_27, updated_at 2013_08_27;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE TeslaCrypt/AlphaCrypt Variant .onion Proxy Domain (is6xsotjdy4qtgur)"; dns_query; content:"is6xsotjdy4qtgur"; depth:16; fast_pattern; nocase; reference:url,www.malware-traffic-analysis.net/2015/05/06/index.html; reference:url,www.hybrid-analysis.com/sample/99fc04d82877aea0247286d41186b985ab773b19c8cef8786ffc1fa50e35af29?environmentId=1; reference:md5,a08784f5691a0a8ce6249e1981dea82c; classtype:trojan-activity; sid:2021077; rev:3; metadata:created_at 2015_05_08, updated_at 2019_09_03;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Drive DDoS Tool post2 command received key=okokokjjk"; flow:established,from_server; file_data; content:"QhsAGBtZSgIfGxtV"; within:16; reference:url,www.arbornetworks.com/asert/2013/08/dirtjumper-drive-shifts-into-a-new-gear/; classtype:trojan-activity; sid:2017382; rev:5; metadata:created_at 2013_08_27, updated_at 2013_08_27;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE CTB-Locker .onion Proxy Domain (tlunjscxn5n76iyz)"; dns_query; content:"tlunjscxn5n76iyz"; depth:16; fast_pattern; nocase; reference:url,www.hybrid-analysis.com/sample/3aed0cac4a7f3053e324276c72bbf3aead783da2eb8b53bf99134a0adbcd3267?environmentId=2; reference:md5,2df314974722ef6b5a66d81292679cb4; classtype:trojan-activity; sid:2021115; rev:3; metadata:created_at 2015_05_19, updated_at 2019_09_03;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Drive DDoS Tool byte command received key=okokokjjk"; flow:established,from_server; file_data; content:"QgkWHwpL"; within:8; pcre:"/^[A-Za-z0-9\/\+]+={0,2}$/R"; reference:url,www.arbornetworks.com/asert/2013/08/dirtjumper-drive-shifts-into-a-new-gear/; classtype:trojan-activity; sid:2017383; rev:5; metadata:created_at 2013_08_27, updated_at 2013_08_27;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query to TOX Ransomware onion (wdthvb6jut2rupu4)"; dns_query; content:"wdthvb6jut2rupu4"; depth:16; fast_pattern; nocase; reference:url,blogs.mcafee.com/mcafee-labs/meet-tox-ransomware-for-the-rest-of-us; reference:md5,91da679f417040558059ccd5b1063688; classtype:trojan-activity; sid:2021163; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_05_29, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Drive DDoS Tool byte command received key=okokokjjk"; flow:established,from_server; file_data; content:"QgIMBh9L"; within:8; pcre:"/^[A-Za-z0-9\/\+]+={0,2}$/R"; reference:url,www.arbornetworks.com/asert/2013/08/dirtjumper-drive-shifts-into-a-new-gear/; classtype:trojan-activity; sid:2017384; rev:5; metadata:created_at 2013_08_27, updated_at 2013_08_27;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query to TOX Ransomware onion (xwxwninkssujglja)"; dns_query; content:"xwxwninkssujglja"; depth:16; fast_pattern; nocase; reference:url,blogs.mcafee.com/mcafee-labs/meet-tox-ransomware-for-the-rest-of-us; reference:md5,91da679f417040558059ccd5b1063688; classtype:trojan-activity; sid:2021164; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_05_29, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Sweet Orange Payload Download Aug 28 2013"; flow:established,to_server; content:"=java.util.Random@"; http_uri; fast_pattern:only; content:"Java/1."; http_user_agent; classtype:exploit-kit; sid:2017388; rev:3; metadata:created_at 2013_08_28, former_category CURRENT_EVENTS, updated_at 2013_08_28;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DNS Query to TOX Ransomware onion (7fa6gldxg64t5wnt)"; dns_query; content:"7fa6gldxg64t5wnt"; depth:16; fast_pattern; nocase; reference:url,blogs.mcafee.com/mcafee-labs/meet-tox-ransomware-for-the-rest-of-us; reference:md5,91da679f417040558059ccd5b1063688; classtype:trojan-activity; sid:2021165; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_05_29, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely Bot Nick in IRC ([country|so version|CPU])"; flow:established,to_server; content:"NICK {"; content:"x86"; within:12; content:"}"; distance:0; pcre:"/NICK {[a-z]{2,3}\x2D.+?x86[a-z]}[a-z]/i"; flowbits:set,ET.IRC.BOT.CntSOCPU; classtype:trojan-activity; sid:2017395; rev:3; metadata:created_at 2013_08_28, updated_at 2013_08_28;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE TeslaCrypt/AlphaCrypt Variant .onion Proxy Domain (bpq4dub4rlivvswu)"; dns_query; content:"bpq4dub4rlivvswu"; depth:16; fast_pattern; nocase; reference:md5,0d7c227d4616254f9ae4976270f2f398; classtype:trojan-activity; sid:2021302; rev:3; metadata:created_at 2015_06_19, updated_at 2019_09_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Bladabindi/njrat CnC Keep-Alive (OUTBOUND)"; flow:to_server,established; content:"P[endof]"; dsize:8; reference:url,threatgeek.com/2013/07/njrat-detection-rules-using-yara-.html; classtype:command-and-control; sid:2017418; rev:2; metadata:created_at 2013_09_05, former_category MALWARE, updated_at 2013_09_05;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE TeslaCrypt/AlphaCrypt Variant .onion Proxy Domain (gzc7lj4rvmkg25dm)"; dns_query; content:"gzc7lj4rvmkg25dm"; depth:16; fast_pattern; nocase; reference:md5,0d7c227d4616254f9ae4976270f2f398; classtype:trojan-activity; sid:2021303; rev:3; metadata:created_at 2015_06_19, updated_at 2019_09_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Bladabindi/njrat CnC Checkin"; flow:to_server,established; content:"lv"; depth:2; content:"[endof]"; isdataat:!2,relative; dsize:>0; reference:url,threatgeek.com/2013/07/njrat-detection-rules-using-yara-.html; classtype:command-and-control; sid:2017419; rev:2; metadata:created_at 2013_09_05, former_category MALWARE, updated_at 2013_09_05;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Ransomware Variant .onion proxy Domain (kurrmpfx6kgmsopm)"; dns_query; content:"kurrmpfx6kgmsopm"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2021318; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_06_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Bladabindi/njrat CnC Command (File Manager)"; flow:from_server,established; content:"FM|7c 27 7c 27 7c|"; depth:7; dsize:>0; reference:url,threatgeek.com/2013/07/njrat-detection-rules-using-yara-.html; classtype:command-and-control; sid:2017420; rev:2; metadata:created_at 2013_09_05, former_category MALWARE, updated_at 2013_09_05;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE AlphaCrypt .onion proxy Domain (tkjthigtqlvohs7z)"; dns_query; content:"tkjthigtqlvohs7z"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2021319; rev:3; metadata:created_at 2015_06_22, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Bladabindi/njrat CnC Command Response (File Manager)"; flow:to_server,established; content:"rn|7c 27 7c 27 7c|"; depth:7; dsize:>0; reference:url,threatgeek.com/2013/07/njrat-detection-rules-using-yara-.html; classtype:command-and-control; sid:2017421; rev:2; metadata:created_at 2013_09_05, former_category MALWARE, updated_at 2013_09_05;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE CryptoLocker .onion Proxy Domain (xvha2ctkacx2ug3b)"; dns_query; content:"xvha2ctkacx2ug3b"; depth:16; fast_pattern; nocase; reference:url,www.dropboxforum.com/hc/communities/public/questions/203834265-virus; classtype:trojan-activity; sid:2021325; rev:3; metadata:created_at 2015_06_23, updated_at 2019_09_03;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Bladabindi/njrat CnC Command (Remote Desktop)"; flow:from_server,established; content:"sc~|7c 27 7c 27 7c|"; depth:8; dsize:>0; reference:url,threatgeek.com/2013/07/njrat-detection-rules-using-yara-.html; classtype:command-and-control; sid:2017422; rev:2; metadata:created_at 2013_09_05, former_category MALWARE, updated_at 2013_09_05;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Poshcoder .onion Proxy Domain (hlvumvvclxy2nw7j)"; dns_query; content:"hlvumvvclxy2nw7j"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2021534; rev:3; metadata:created_at 2015_07_27, updated_at 2019_09_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Bladabindi/njrat CnC Command Response (Remote Desktop)"; flow:to_server,established; content:"scPK|7c 27 7c 27 7c|"; depth:9; dsize:>0; reference:url,threatgeek.com/2013/07/njrat-detection-rules-using-yara-.html; classtype:command-and-control; sid:2017423; rev:2; metadata:created_at 2013_09_05, former_category MALWARE, updated_at 2013_09_05;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE CryptoLocker .onion Proxy Domain (vacdgwaw5djp5hmu)"; dns_query; content:"vacdgwaw5djp5hmu"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2021549; rev:3; metadata:created_at 2015_07_29, updated_at 2019_09_03;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Bladabindi/njrat CnC Command (Remote Cam)"; flow:from_server,established; content:"CAM|7c 27 7c 27 7c|"; depth:8; dsize:>0; reference:url,threatgeek.com/2013/07/njrat-detection-rules-using-yara-.html; classtype:command-and-control; sid:2017424; rev:2; metadata:created_at 2013_09_05, former_category MALWARE, updated_at 2013_09_05;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Critroni .onion Proxy Domain"; dns_query; content:"des7siw5vfkznjhi"; depth:16; fast_pattern; nocase; reference:md5,ca57b9de1cae18bda994aa4bd093c571; reference:url,www.file-analyzer.net/analysis/4825; classtype:trojan-activity; sid:2021551; rev:3; metadata:created_at 2015_07_30, updated_at 2019_09_03;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Bladabindi/njrat CnC Command (Remote Shell)"; flow:from_server,established; content:"rs|7c 27 7c 27 7c|"; depth:8; dsize:>0; reference:url,threatgeek.com/2013/07/njrat-detection-rules-using-yara-.html; classtype:command-and-control; sid:2017426; rev:2; metadata:created_at 2013_09_05, former_category MALWARE, updated_at 2013_09_05;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE EncryptorRaas .onion Proxy Domain (613cb6owitcouepv)"; dns_query; content:"613cb6owitcouepv"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2021561; rev:3; metadata:created_at 2015_07_31, updated_at 2019_09_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Bladabindi/njrat CnC Command Response (Process listing)"; flow:to_server,established; content:"proc|7c 27 7c 27 7c|"; depth:9; dsize:>0; reference:url,threatgeek.com/2013/07/njrat-detection-rules-using-yara-.html; classtype:command-and-control; sid:2017427; rev:2; metadata:created_at 2013_09_05, former_category MALWARE, updated_at 2013_09_05;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Critroni Variant .onion Proxy Domain"; dns_query; content:"7n4p5o6vlkdiqiee"; depth:16; nocase; fast_pattern; reference:md5,18dfcf3479bbd3878c0f19b80a01e813; classtype:trojan-activity; sid:2020213; rev:4; metadata:created_at 2015_01_20, updated_at 2019_09_03;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Bladabindi/njrat CnC Command (Kill Process)"; flow:from_server,established; content:"k|7c 27 7c 27 7c|"; depth:6; dsize:>0; reference:url,threatgeek.com/2013/07/njrat-detection-rules-using-yara-.html; classtype:command-and-control; sid:2017428; rev:2; metadata:created_at 2013_09_05, former_category MALWARE, updated_at 2013_09_05;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE TeslaCrypt/AlphaCrypt Variant .onion Proxy Domain"; dns_query; content:"h36fhvsupe4mi7mm"; depth:16; nocase; fast_pattern; classtype:trojan-activity; sid:2021849; rev:3; metadata:created_at 2015_09_30, updated_at 2019_09_03;)
+alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ZeroAccess Outbound udp traffic detected"; content:"|28 94 8d ab c9 c0 d1 99|"; offset:4; depth:8; dsize:16; threshold: type both, track by_src, count 10, seconds 600; classtype:trojan-activity; sid:2015482; rev:8; metadata:created_at 2012_07_17, updated_at 2012_07_17;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Critroni .onion Proxy Domain (tmclybfqzgkaeilm)"; dns_query; content:"tmclybfqzgkaeilm"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2022145; rev:3; metadata:created_at 2015_11_25, updated_at 2019_09_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE OSX/Leverage.A Checkin"; flow:established,to_server; content:"|00 00|"; offset:0; depth:2; content:"|00 00 00 01|"; distance:2; within:4; content:"RAM|0a 7c|"; pcre:"/^\d+\w+\/\d+\w+ free \(\d+% used\)/R"; classtype:command-and-control; sid:2017525; rev:2; metadata:created_at 2013_09_25, former_category MALWARE, updated_at 2013_09_25;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Win32/Teslacrypt .onion Proxy Domain (tw7kaqthui5ojcez)"; dns_query; content:"tw7kaqthui5ojcez"; depth:16; fast_pattern; nocase; reference:md5,45683c29a36ef8a15f216d7c4b2af822; classtype:trojan-activity; sid:2022191; rev:3; metadata:created_at 2015_11_30, updated_at 2019_09_03;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Worm.VBS.ayr CnC command response"; flow:established,from_server; file_data; content:"send|3c 7c 3e|"; within:7; pcre:"/^[A-Z]\x3a\x5f/R"; reference:url,www.fireeye.com/blog/uncategorized/2013/09/now-you-see-me-h-worm-by-houdini.html; classtype:command-and-control; sid:2017523; rev:5; metadata:created_at 2013_09_25, former_category MALWARE, updated_at 2013_09_25;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE EncryptorRaas .onion Domain (75nzutdjjtnpgscz)"; dns_query; content:"75nzutdjjtnpgscz"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2022236; rev:3; metadata:created_at 2015_12_08, updated_at 2019_09_03;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Hiloti/Mufanom CnC Response"; flow:established,from_server; flowbits:isset,ET.Hiloti; file_data; content:""; distance:0; classtype:command-and-control; sid:2017526; rev:3; metadata:created_at 2013_09_25, former_category MALWARE, updated_at 2013_09_25;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE TeslaCrypt/AlphaCrypt Variant .onion Domain"; dns_query; content:"vf4xdqg4mp3hnw5g"; depth:16; nocase; fast_pattern; classtype:trojan-activity; sid:2022237; rev:3; metadata:created_at 2015_12_08, updated_at 2019_09_03;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible CritX/SafePack/FlashPack EXE Download"; flow:established,from_server; content:"filename=e"; http_header; content:".exe"; distance:23; within:4; http_header; pcre:"/filename=e[a-f0-9]{23}\.exe/H"; classtype:exploit-kit; sid:2017297; rev:6; metadata:created_at 2013_08_08, former_category CURRENT_EVENTS, updated_at 2013_08_08;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE TeslaCrypt/AlphaCrypt Variant .onion Domain"; dns_query; content:"wv55abv6bde65ek6"; depth:16; nocase; fast_pattern; classtype:trojan-activity; sid:2022238; rev:3; metadata:created_at 2015_12_08, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET MALWARE SSH Connection on 443 - Mevade Banner"; flow:to_server,established; content:"SSH-2.0-PuTTY_Local|3a|_Feb__5_2013_18|3a|26|3a|54"; depth:41; classtype:trojan-activity; sid:2017559; rev:2; metadata:created_at 2013_10_05, updated_at 2013_10_05;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE TeslaCrypt/AlphaCrypt Variant .onion Payment Domain (czc57cr2pn3zfn4b)"; dns_query; content:"czc57cr2pn3zfn4b"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2022314; rev:3; metadata:created_at 2015_12_29, updated_at 2019_09_03;)
+#alert ip $HOME_NET any -> [195.22.26.231,195.22.26.232] any (msg:"ET MALWARE Connection to AnubisNetworks Sinkhole IP (Possible Infected Host)"; threshold:type limit,track by_src,seconds 3600,count 1; classtype:trojan-activity; sid:2016993; rev:3; metadata:created_at 2013_06_11, updated_at 2013_06_11;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE TeslaCrypt/AlphaCrypt Variant .onion Payment Domain (o7zeip6us33igmgw)"; dns_query; content:"o7zeip6us33igmgw"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2022315; rev:3; metadata:created_at 2015_12_29, updated_at 2019_09_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE NfLog Checkin"; flow:to_server,established; content:"POST"; http_method; nocase; content:"/Nfile.asp"; fast_pattern:only; http_uri; content:"Content-Length|3a| 7|0d 0a|"; http_header; content:"GetFile"; depth:7; http_client_body; reference:url,contagiodump.blogspot.com/2012/02/feb-9-cve-2011-1980-msoffice-dll.html; classtype:command-and-control; sid:2014229; rev:3; metadata:created_at 2012_02_16, former_category MALWARE, updated_at 2012_02_16;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE TeslaCrypt/AlphaCrypt Variant .onion Payment Domain (vr6g2curb2kcidou)"; dns_query; content:"vr6g2curb2kcidou"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2022316; rev:3; metadata:created_at 2015_12_29, updated_at 2019_09_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET !80 (msg:"ET MALWARE Possible Sakura Jar Download Oct 22 2013"; flow:to_server,established; content:!".jar"; http_uri; content:"Java/1."; http_user_agent; fast_pattern:only; content:".pl|3a|"; http_header; pcre:"/^\/[a-z]+([_-][a-z]+)*\.[a-z]{1,3}$/U"; pcre:"/^Host\x3a\x20[a-z0-9]+\.[a-z0-9]+\.[a-z0-9]+\.pl\x3a\d{2,5}\r$/Hm"; classtype:trojan-activity; sid:2017628; rev:4; metadata:created_at 2013_10_23, former_category CURRENT_EVENTS, updated_at 2013_10_23;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Android/Fakeinst.KD .onion Proxy Domain"; dns_query; content:"pc35hiptpcwqezgs"; depth:16; nocase; fast_pattern; reference:url,www.csis.dk/da/csis/blog/4818/; reference:md5,111b71c120167b5b571ee5501ffef65e; classtype:trojan-activity; sid:2022517; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, created_at 2016_02_13, deployment Perimeter, signature_severity Critical, tag Android, updated_at 2019_09_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.Win32.NfLog Checkin (TTip)"; flow:to_server,established; content:"/NfStart.asp?ClientId="; http_uri; nocase; reference:url,contagiodump.blogspot.com/2012/02/feb-9-cve-2011-1980-msoffice-dll.html; classtype:command-and-control; sid:2014266; rev:4; metadata:created_at 2012_02_21, former_category MALWARE, updated_at 2012_02_21;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE TeslaCrypt/AlphaCrypt Variant .onion Payment Domain(xlowfznrg4wf7dli)"; dns_query; content:"xlowfznrg4wf7dli"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2022561; rev:3; metadata:created_at 2016_02_23, updated_at 2019_09_03;)
+#alert tcp $HTTP_SERVERS any -> $EXTERNAL_NET 21 (msg:"ET MALWARE Fredcot campaign payload download"; flow:to_server,established; content:"PASS fredcot123|0d 0a|"; reference:md5,e69bbd29f2822c1846d569ace710c9d5; reference:url,permalink.gmane.org/gmane.comp.security.ids.snort.emerging-sigs/20243; classtype:trojan-activity; sid:2017664; rev:5; metadata:created_at 2013_11_05, former_category CURRENT_EVENTS, updated_at 2013_11_05;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Backdoor.AndroidOS.Torec.a .onion Proxy Domain"; dns_query; content:"yuwurw46taaep6ip"; depth:16; nocase; fast_pattern; reference:md5,58fed8b5b549be7ecbfbc6c63b84a728; classtype:trojan-activity; sid:2022562; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, created_at 2016_02_24, deployment Perimeter, signature_severity Critical, tag Android, updated_at 2019_09_03;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Backdoor.Adwind Download"; flow:established,from_server; file_data; content:"plugins/AdwindServer.class"; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2013-070113-1904-99&tabid=3; classtype:attempted-user; sid:2017668; rev:4; metadata:created_at 2013_11_06, updated_at 2013_11_06;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Backdoor.AndroidOS.Torec.a .onion Proxy Domain 2"; dns_query; content:"voooxrrw2wxnoyew"; depth:16; nocase; fast_pattern; reference:md5,8d260ab2bb36aeaf5b033b80b6bc1e6a; classtype:trojan-activity; sid:2022563; rev:3; metadata:affected_product Android, attack_target Client_Endpoint, created_at 2016_02_24, deployment Perimeter, signature_severity Critical, tag Android, updated_at 2019_09_03;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Saturn Proxy Checkin Response"; flow:established,from_server; flowbits:isset,ET.saturn.checkin; content:"200"; http_stat_code; content:"OK"; http_stat_msg; content:"Encryption|3a| on|0d 0a|"; depth:16; reference:url,doc.emergingthreats.net/2007752; classtype:command-and-control; sid:2007752; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE PadCrypt .onion Payment Domain"; dns_query; content:"gnkltbsaeq35rejl"; depth:16; fast_pattern; nocase; reference:md5,b6d25a5629221041e857266b9188ea3b; classtype:trojan-activity; sid:2022569; rev:3; metadata:created_at 2016_02_26, updated_at 2019_09_03;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Fake Codec Download"; flow:established,to_server; content:"/Setup.exe?tid="; http_uri; fast_pattern:only; classtype:trojan-activity; sid:2017711; rev:2; metadata:created_at 2013_11_14, former_category CURRENT_EVENTS, updated_at 2013_11_14;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Maktub Locker Payment Domain"; dns_query; content:"bs7aygotd2rnjl4o"; depth:16; fast_pattern; nocase; reference:md5,74add6536cdcfb8b77d10a1e7be6b9ef; classtype:trojan-activity; sid:2022634; rev:3; metadata:created_at 2016_03_21, updated_at 2019_09_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Athena Bot Nick in IRC"; flow:established,to_server; content:"NICK "; content:"|5b|"; distance:1; within:1; pcre:"/^[A-Z]{3}\|[UA]\|[DL]\|W([78]|_XP|VIS)\|x(86|64)\|/R"; reference:url,arbornetworks.com/asert/2013/11/athena-a-ddos-malware-odyssey/; reference:md5,859c2fec50ba1212dca9f00aa4a64ec4; classtype:trojan-activity; sid:2017716; rev:3; metadata:created_at 2013_11_15, updated_at 2013_11_15;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE ABUSE.CH Ransomware Domain Detected (Locky Payment)"; dns_query; content:"twbers4hmi6dc65f"; depth:16; fast_pattern; nocase; reference:url,ransomwaretracker.abuse.ch; classtype:trojan-activity; sid:2022663; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_03_26, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert icmp any any -> any any (msg:"ET MALWARE PWS Win32/Lmir.BMQ checkin"; dsize:19; content:"This|27|s|20|Ping|20|Packet|21|"; reference:md5,0fe0cf9a2d8c3ccd1c92acbb81ff6343; reference:url,www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=PWS%3AWin32%2FLmir.BMQ; classtype:command-and-control; sid:2017724; rev:3; metadata:created_at 2013_11_15, former_category MALWARE, updated_at 2013_11_15;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Ransomware/Coverton Onion Domain Lookup"; dns_query; content:"lnc57humvaxpqfv3"; depth:16; nocase; fast_pattern; reference:md5,c5c4f4860c69ea7469ca3be3caf5bf18; classtype:trojan-activity; sid:2022675; rev:3; metadata:attack_target Client_Endpoint, created_at 2016_03_28, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET MALWARE Trojan.Dropper.Win32.Dapato.braa.AMN CnC traffic"; flow:to_server,established; content:"9002"; depth:4; reference:md5,6ef66c2336b2b5aaa697c2d0ab2b66e2; classtype:command-and-control; sid:2017728; rev:2; metadata:created_at 2013_11_20, former_category MALWARE, updated_at 2013_11_20;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE TeslaCrypt/AlphaCrypt Variant .onion Payment Domain(xzjvzkgjxebzreap)"; dns_query; content:"xzjvzkgjxebzreap"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2022711; rev:3; metadata:created_at 2016_04_06, updated_at 2019_09_03;)
+alert tcp $EXTERNAL_NET any -> any 22 (msg:"ET MALWARE Possible SSH Linux.Fokirtor backchannel command"; flow:established,to_server; content:"|3a 21 3b 2e|"; pcre:"/^(?:[A-Za-z0-9\+\/]{4})*(?:[A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4})/R"; reference:url,www.symantec.com/connect/blogs/linux-back-door-uses-covert-communication-protocol; classtype:trojan-activity; sid:2017727; rev:6; metadata:created_at 2013_11_16, updated_at 2013_11_16;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Retefe Banker .onion Domain"; dns_query; content:"5qgerbbyhdz5bwca"; depth:16; fast_pattern; nocase; reference:url,isc.sans.edu/diary/Retefe+is+back+in+town/20957; classtype:trojan-activity; sid:2022764; rev:3; metadata:created_at 2016_04_26, malware_family Banking_Trojan, malware_family Retefe, updated_at 2019_09_03;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Darkness DDoS HTTP Target/EXE"; flow:from_server,established; file_data; content:"Z"; within:1; content:"PWh0dHA"; distance:2; within:9; pcre:"/^[a-z0-9\+\/]+={0,2}$/Rsi"; classtype:trojan-activity; sid:2017775; rev:7; metadata:created_at 2013_11_27, updated_at 2013_11_27;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Retefe Banker .onion Domain"; dns_query; content:"yycqx6ay5oedto5f"; depth:16; fast_pattern; nocase; reference:url,isc.sans.edu/diary/Retefe+is+back+in+town/20957; classtype:trojan-activity; sid:2022765; rev:3; metadata:created_at 2016_04_26, malware_family Banking_Trojan, malware_family Retefe, updated_at 2019_09_03;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Darkness DDoS Common Intial Check-in Response wtf"; flow:from_server,established; file_data; content:"d3Rm"; within:4; pcre:"/^(?:\r\n|$)/R"; reference:md5,a9af388f5a627aa66c34074ef45db1b7; classtype:trojan-activity; sid:2017776; rev:7; metadata:created_at 2013_11_27, updated_at 2013_11_27;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Retefe Banker .onion Domain"; dns_query; content:"j2pjkgrlaopysagn"; depth:16; fast_pattern; nocase; reference:url,isc.sans.edu/diary/Retefe+is+back+in+town/20957; classtype:trojan-activity; sid:2022766; rev:3; metadata:created_at 2016_04_26, malware_family Banking_Trojan, malware_family Retefe, updated_at 2019_09_03;)
+#alert tcp $HOME_NET 1023: -> $EXTERNAL_NET 53 (msg:"ET MALWARE Potential DNS Command and Control via TXT queries"; flow:established,to_server; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:4; content:"|00 00 10 00 01|"; threshold:type both, track by_src,count 10, seconds 300; reference:url,lists.emergingthreats.net/pipermail/emerging-sigs/2011-September/015625.html; classtype:trojan-activity; sid:2013515; rev:3; metadata:created_at 2011_09_02, updated_at 2011_09_02;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Retefe Banker .onion Domain"; dns_query; content:"i3e5y4ml7ru76n5e"; depth:16; fast_pattern; nocase; reference:url,isc.sans.edu/diary/Retefe+is+back+in+town/20957; classtype:trojan-activity; sid:2022767; rev:3; metadata:created_at 2016_04_26, malware_family Banking_Trojan, malware_family Retefe, updated_at 2019_09_03;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Trojan-Downloader Win32.Genome.AV server response"; flow:to_client,established; file_data; content:"|5b|Soft"; pcre:"/^\d+?\x5d/R"; content:"SoftTitle="; distance:0; flowbits:isset,et.GENOME.AV; reference:md5,d14314ceb74c8c1a8e1e8ca368d75501; classtype:trojan-activity; sid:2017747; rev:3; metadata:created_at 2013_11_25, updated_at 2013_11_25;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Retefe Banker .onion Domain"; dns_query; content:"iabni66w5xvwawbe"; depth:16; fast_pattern; nocase; reference:url,isc.sans.edu/diary/Retefe+is+back+in+town/20957; classtype:trojan-activity; sid:2022768; rev:3; metadata:created_at 2016_04_26, malware_family Banking_Trojan, malware_family Retefe, updated_at 2019_09_03;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE WEBC2-QBP Checkin Response 1 - Embedded CnC APT1 Related"; flow:established,from_server; file_data; content:"|3c|!--<2010QBP"; content:" 2010QBP//-->"; within:150; reference:url,intelreport.mandiant.com; reference:md5,0cf9e999c574ec89595263446978dc9f; reference:md5,fcdaa67e33357f64bc4ce7b57491fc53; classtype:targeted-activity; sid:2016451; rev:3; metadata:created_at 2013_02_20, former_category MALWARE, updated_at 2013_02_20;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Ransomware Locky .onion Payment Domain (hw5qrh6fxv2tnaqn)"; dns_query; content:"hw5qrh6fxv2tnaqn"; depth:16; fast_pattern; nocase; reference:url,nakedsecurity.sophos.com/2016/02/17/locky-ransomware-what-you-need-to-know/; classtype:trojan-activity; sid:2022806; rev:3; metadata:attack_target Client_Endpoint, created_at 2016_05_16, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE JAR Download From Crimepack Exploit Kit"; flow:established,from_server; flowbits:isset,ET.http.javaclient; file_data; content:"cpak/Crimepack"; nocase; reference:url,doc.emergingthreats.net/2011544; reference:url,krebsonsecurity.com/tag/crimepack/; reference:url,www.offensivecomputing.net/?q=node/1572; classtype:exploit-kit; sid:2011544; rev:7; metadata:created_at 2010_09_27, former_category MALWARE, updated_at 2010_09_27;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Ransomware Locky .onion Payment Domain (eqrvbczir5ua2emd)"; dns_query; content:"eqrvbczir5ua2emd"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2022817; rev:3; metadata:attack_target Client_Endpoint, created_at 2016_05_18, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE W32/GMUnpacker.Downloader Download Instructions Response From CnC"; flow:established,to_client; file_data; content:""; within:4; content:""; distance:0; content:""; distance:0; content:"HKEY_LOCAL_MACHINE|5c|SOFTWARE|5c|Microsoft|5c|Windows|5c|CurrentVersion|5c|"; distance:0; reference:md5,43e89125ad40b18d22e01f997da8929a; classtype:command-and-control; sid:2017891; rev:2; metadata:created_at 2013_12_20, former_category MALWARE, updated_at 2013_12_20;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE ABUSE.CH Ransomware Domain Detected (Locky C2)"; dns_query; content:"ajj3a7gfmgwmhhoz"; depth:16; fast_pattern; nocase; reference:url,ransomwaretracker.abuse.ch; classtype:command-and-control; sid:2022843; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_05_31, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible PDF Dictionary Entry with Hex/Ascii replacement"; flow:established,from_server; file_data; content:"%PDF-"; fast_pattern; within:5; content:"obj"; pcre:"/^[\r\n\s]*?<<(?:(?!>>).)+?\/[a-zA-Z\d]*?#(?:[46][1-9a-fA-F]|[57][\daA])(?:[a-zA-Z\d])*?#(?:[46][1-9a-fA-F]|[57][\daA])/Rsi"; classtype:trojan-activity; sid:2017899; rev:4; metadata:created_at 2013_12_24, former_category INFO, updated_at 2013_12_24;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE ABUSE.CH Ransomware Domain Detected"; dns_query; content:"gccxqpuuylioxoip"; depth:16; fast_pattern; nocase; reference:url,ransomwaretracker.abuse.ch; classtype:trojan-activity; sid:2022999; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_08_02, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE LDPinch Checkin (3)"; flow:established,to_server; content:"a="; content:"&b=Passes from"; distance:0; content:"&c="; distance:0; reference:url,doc.emergingthreats.net/2007862; classtype:command-and-control; sid:2007862; rev:11; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE ABUSE.CH Ransomware Domain Detected"; dns_query; content:"yuysikankhqvdwdv"; depth:16; fast_pattern; nocase; reference:url,ransomwaretracker.abuse.ch; classtype:trojan-activity; sid:2023003; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_08_02, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 2012:2014 (msg:"ET MALWARE Win32.Morix.B checkin"; flow:to_server,established; content:"|00 00 42 42 43 42 43|"; offset:2; depth:7; reference:md5,25623fa3a64f6bed301822f8fe6aa9b5; classtype:command-and-control; sid:2017922; rev:3; metadata:created_at 2014_01_03, former_category MALWARE, updated_at 2014_01_03;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Ransomware Locky .onion Payment Domain (f5xraa2y2ybtrefz)"; dns_query; content:"f5xraa2y2ybtrefz"; depth:16; fast_pattern; nocase; reference:md5,5eeeeb093ee02d3769886880f8a58a90; classtype:trojan-activity; sid:2023247; rev:3; metadata:attack_target Client_Endpoint, created_at 2016_09_19, deployment Perimeter, former_category MALWARE, malware_family Ransomware, malware_family Locky, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Upatre SSL Compromised site appsredeeem"; flow:established,to_client; content:"|12|www.appsredeem.com"; nocase; classtype:trojan-activity; sid:2017987; rev:2; metadata:created_at 2014_01_17, former_category CURRENT_EVENTS, updated_at 2014_01_17;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE ABUSE.CH TorrenLocker Payment Domain Detected"; dns_query; content:"anbqjdoyw6wkmpeu"; depth:16; fast_pattern; nocase; reference:url,ransomwaretracker.abuse.ch; classtype:trojan-activity; sid:2023328; rev:3; metadata:attack_target Client_Endpoint, created_at 2016_10_07, deployment Perimeter, tag Ransomware, updated_at 2019_09_03;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Cybergate/Rebhip/Spyrat Backdoor Keepalive Response"; flow:to_server,established; dsize:<100; content:"pong|7c|"; depth:5; classtype:trojan-activity; sid:2017991; rev:6; metadata:created_at 2011_04_09, updated_at 2011_04_09;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE XRatLocker/AiraCrop Ransomware Payment Domain"; dns_query; content:"6kaqkavhpu5dln6x"; depth:16; nocase; fast_pattern; reference:url,twitter.com/PolarToffee/status/796079699478900736; classtype:trojan-activity; sid:2023503; rev:3; metadata:attack_target Client_Endpoint, created_at 2016_11_14, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Java/Jacksbot Check-in"; flow:established,to_server; content:"|00 2d 00 68 00 20 00 32 00 66 00|"; pcre:"/^(?:4\x00[1-9a-f]|5\x00[\da])/Rs"; content:"|00 33 00 61 00|"; within:5; reference:md5,6d93fc6132ae6938013cdd95354bff4e; classtype:trojan-activity; sid:2017983; rev:3; metadata:created_at 2014_01_17, updated_at 2014_01_17;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE XRatLocker/AiraCrop Ransomware Payment Domain"; dns_query; content:"mvy3kbqc4adhosdy"; depth:16; nocase; fast_pattern; reference:url,twitter.com/PolarToffee/status/796079699478900736; classtype:trojan-activity; sid:2023504; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_11_14, deployment Perimeter, former_category MALWARE, malware_family Ransomware, malware_family XRatLocker, malware_family AiraCrop, signature_severity Major, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET MALWARE Limitless Logger Sending Data over SMTP 2"; flow:to_server,established; content:"Limitless Logger successfully ran on this computer."; nocase; reference:md5,243dda18666ae2a64685e51d82c5ad69; classtype:trojan-activity; sid:2018016; rev:2; metadata:created_at 2014_01_28, updated_at 2014_01_28;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"; dns_query; content:"27c73bq66y4xqoh7"; depth:16; fast_pattern; nocase; reference:url,ransomwaretracker.abuse.ch; classtype:command-and-control; sid:2023578; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_12_06, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Xtrat C2 Response"; flow:established,from_server; content:"S|00|T|00|A|00|R|00|T|00|S|00|E|00|R|00|V|00|E|00|R|00|B|00|U|00|F|00|F|00|E|00|R"; depth:33; reference:md5,f45b1b82c849fbbea3374ae7e9200092; classtype:command-and-control; sid:2018027; rev:2; metadata:created_at 2014_01_28, former_category MALWARE, updated_at 2014_01_28;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Ransomware Goldeneye .onion Payment Domain (goldenhjnqvc2lld)"; dns_query; content:"goldenhjnqvc2lld"; depth:16; fast_pattern; nocase; classtype:command-and-control; sid:2023584; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_12_06, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ehow/livestrong Malicious Flash 10/11"; flow:established,to_server; urilen:13; content:".swf"; http_uri; offset:9; depth:4; pcre:"/^\/[a-f0-9]{8}\.swf$/U"; pcre:"/^Referer\x3a[^\r\n]+\/[a-f0-9]{8}\/1(?:0\/[0-2]|1\/\d)\/\r$/Hm"; classtype:trojan-activity; sid:2018029; rev:2; metadata:created_at 2014_01_28, former_category CURRENT_EVENTS, updated_at 2014_01_28;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Ransomware Goldeneye .onion Payment Domain (golden2uqpiqcs6j)"; dns_query; content:"golden2uqpiqcs6j"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2023585; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_12_06, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Banker.AALV checkin"; flow:to_server,established; content:"CHEGOU-NOIS"; fast_pattern; content:"|20 7c 20|PLUGIN|3a|"; distance:0; content:"|20 7c 20|BROWSER|3a|"; reference:md5,74bfd81b345a6ef36be5fcf6964af6e1; classtype:command-and-control; sid:2018034; rev:1; metadata:created_at 2014_01_29, former_category MALWARE, updated_at 2014_01_29;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Ransomware Popcorn-Time .onion Payment Domain (3hnuhydu4pd247qb)"; dns_query; content:"3hnuhydu4pd247qb"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2023589; rev:3; metadata:attack_target Client_Endpoint, created_at 2016_12_08, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE SolarBot Plugin Download Server Response"; flow:from_server,established; file_data; content:"SOLAR|00|"; within:6; content:"MZP"; distance:0; classtype:trojan-activity; sid:2018036; rev:5; metadata:created_at 2014_01_30, updated_at 2014_01_30;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Ransomware Maktub .onion Payment Domain (maktubebz6z6cgtw)"; dns_query; content:"maktubebz6z6cgtw"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2023655; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_12_15, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 444 (msg:"ET MALWARE W32/FakeAlert.FT.gen.Eldorado Downloading DLL"; flow:to_server,established; content:"SIZE libcurl-4.dll|0d 0a|"; reference:md5,0f352448103f7d487e265220006a1c32; classtype:trojan-activity; sid:2018072; rev:2; metadata:created_at 2014_02_05, updated_at 2014_02_05;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE SHUJIN .onion Payment Page"; dns_query; content:"eqlc75eumpb77ced"; depth:16; fast_pattern; nocase; reference:md5,d59a27b1e0a46cc185f1937ca42f300a; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/chinese-language-ransomware-makes-appearance/; classtype:trojan-activity; sid:2022798; rev:4; metadata:created_at 2016_05_06, updated_at 2019_09_03;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/FakeAlert.FT.gen.Eldorado Downloading VBS"; flow:to_server,established; content:"SIZE explore.vbs|0d 0a|"; reference:md5,0f352448103f7d487e265220006a1c32; classtype:trojan-activity; sid:2018073; rev:2; metadata:created_at 2014_02_05, updated_at 2014_02_05;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Ransomware CrypMIC Payment Onion Domain"; dns_query; content:"fmwdvmk2ejgbl5pi"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2023737; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_01_11, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE TecSystems (Possible Mask) Signed PE EXE Download"; flow:established,to_client; flowbits:isset,ET.http.binary; content:"|55 04 0a|"; content:"|0e|TecSystem Ltd."; distance:1; within:15; reference:url,www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf; classtype:trojan-activity; sid:2018103; rev:2; metadata:created_at 2014_02_11, former_category CURRENT_EVENTS, updated_at 2014_02_11;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DeepEnd Research Ransomware PadCrypt .onion Proxy Domain"; dns_query; content:"hctppfblwfot6ces"; depth:16; fast_pattern; nocase; reference:url,www.deependresearch.org/2017/01/threat-intel-ransomware-payment-sites.html; classtype:trojan-activity; sid:2023729; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_01_11, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET MALWARE FTP File Upload - BlackPOS Naming Scheme"; flow:established,to_server; content:"STOR "; depth:5; content:".txt"; pcre:"/data_\d{4}_\d{1,2}_\d{1,2}_\d{1,2}_\d{1,2}\.txt/"; reference:url,www.cyphort.com/blog/cyphort-tracks-down-new-variants-of-target-malware/; classtype:trojan-activity; sid:2018115; rev:1; metadata:created_at 2014_02_12, updated_at 2014_02_12;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain"; dns_query; content:"j24ojpexpgaorlxj"; depth:16; fast_pattern; nocase; reference:url,www.deependresearch.org/2017/01/threat-intel-ransomware-payment-sites.html; classtype:trojan-activity; sid:2023730; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_01_11, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"ET MALWARE MS Remote Desktop edc User Login Request"; flow:to_server,established; content:"|03 00 00|"; depth:3; content:"|e0 00 00 00 00 00|"; distance:2; within:6; content:"Cookie|3a| mstshash=edc|0d 0a|"; nocase; reference:url,intelcrawler.com/about/press08; classtype:protocol-command-decode; sid:2018116; rev:1; metadata:created_at 2014_02_12, updated_at 2014_02_12;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain"; dns_query; content:"lmhrmbouhkffosig"; depth:16; fast_pattern; nocase; reference:url,www.deependresearch.org/2017/01/threat-intel-ransomware-payment-sites.html; classtype:trojan-activity; sid:2023731; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_01_11, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"ET MALWARE MS Remote Desktop micros User Login Request"; flow:to_server,established; content:"|03 00 00|"; depth:3; content:"|e0 00 00 00 00 00|"; distance:2; within:6; content:"Cookie|3a| mstshash=micros|0d 0a|"; nocase; reference:url,intelcrawler.com/about/press08; classtype:protocol-command-decode; sid:2018124; rev:3; metadata:created_at 2014_02_12, updated_at 2014_02_12;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain"; dns_query; content:"neo73ruk6mprlmww"; depth:16; fast_pattern; nocase; reference:url,www.deependresearch.org/2017/01/threat-intel-ransomware-payment-sites.html; classtype:trojan-activity; sid:2023732; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_01_11, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 1431 (msg:"ET MALWARE Win32/Tapazom.A"; flow:established,to_server; content:"GIVEME|7c|"; reference:md5,dc7284b199d212e73c26a21a0913c69d; classtype:trojan-activity; sid:2018133; rev:1; metadata:created_at 2014_02_13, updated_at 2014_02_13;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DeepEnd Research Ransomware PadCrypt .onion Proxy Domain"; dns_query; content:"padcrympj5rvgwed"; depth:16; fast_pattern; nocase; reference:url,www.deependresearch.org/2017/01/threat-intel-ransomware-payment-sites.html; classtype:trojan-activity; sid:2023733; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_01_11, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 1431 (msg:"ET MALWARE Win32/Tapazom.A 2"; flow:established,to_server; content:"GETSERVER|7c|"; reference:md5,030f3840d2729243280d3cea3d99d8e6; classtype:trojan-activity; sid:2018134; rev:1; metadata:created_at 2014_02_13, updated_at 2014_02_13;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DeepEnd Research Ransomware PadCrypt .onion Proxy Domain"; dns_query; content:"qli26fihoid5qwo5"; depth:16; fast_pattern; nocase; reference:url,www.deependresearch.org/2017/01/threat-intel-ransomware-payment-sites.html; classtype:trojan-activity; sid:2023734; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_01_11, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Generic CnC"; flow:established,to_server; content:" Mini BackDoor|00|"; offset:9; depth:20; reference:md5,398b6622a2c86d472a4340d3e79e654b; classtype:command-and-control; sid:2018167; rev:1; metadata:created_at 2014_02_21, former_category MALWARE, updated_at 2014_02_21;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain"; dns_query; content:"r4i3izmyccncfrsr"; depth:16; fast_pattern; nocase; reference:url,www.deependresearch.org/2017/01/threat-intel-ransomware-payment-sites.html; classtype:trojan-activity; sid:2023735; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_01_11, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gh0st Trojan CnC 3"; flow:established,to_server; dsize:14; content:"Gh0st"; depth:5; reference:md5,6a814cacb0c4b464d85ab874f68a5344; classtype:command-and-control; sid:2018165; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_02_21, deployment Perimeter, former_category MALWARE, malware_family Gh0st, malware_family PCRAT, signature_severity Critical, tag PCRAT, tag Gh0st, tag RAT, updated_at 2016_07_01;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DeepEnd Research Ransomware CryptoWall .onion Proxy Domain"; dns_query; content:"rq5w3yn6qgbu4mo5"; depth:16; fast_pattern; nocase; reference:url,www.deependresearch.org/2017/01/threat-intel-ransomware-payment-sites.html; classtype:trojan-activity; sid:2023736; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_01_11, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE W32/FakeFlash.Dropper Initial CnC Beacon"; flow:established,to_server; dsize:8; content:"PutToken"; depth:8; reference:md5,43839d131dff01e9b752d91c2c8f68a8; classtype:command-and-control; sid:2018185; rev:1; metadata:attack_target Client_Endpoint, created_at 2014_02_27, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2014_02_27, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE TorrentLocker .onion Proxy Domain (zbqxpjfvltb6d62m)"; dns_query; content:"zbqxpjfvltb6d62m"; depth:16; fast_pattern; nocase; reference:url,www.hybrid-analysis.com/sample/3ebc6999da89eaf44d94195b588cb869d894ca754a248b074893d11f6dd19188?environmentId=4; reference:md5,2c339dbb40b3b19ee275e4c7c1c17a18; classtype:trojan-activity; sid:2021252; rev:4; metadata:created_at 2015_06_11, former_category TROJAN, updated_at 2019_09_03;)
+#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE W32/FakeFlash.Dropper Initial CnC Beacon Acknowledgement"; flow:established,to_client; dsize:12; content:"TokenRecived"; depth:12; reference:md5,43839d131dff01e9b752d91c2c8f68a8; classtype:command-and-control; sid:2018186; rev:1; metadata:attack_target Client_Endpoint, created_at 2014_02_27, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2014_02_27, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain"; dns_query; content:"mjs2bcdrttpmm7pp"; depth:16; fast_pattern; nocase; reference:url,www.deependresearch.org/2017/01/threat-intel-ransomware-payment-sites.html; classtype:trojan-activity; sid:2024110; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_03_29, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE W32/FakeFlash.Dropper PutInformation CnC Beacon"; flow:established,to_server; dsize:18; content:"PutInformation_New"; depth:18; reference:md5,43839d131dff01e9b752d91c2c8f68a8; classtype:command-and-control; sid:2018187; rev:1; metadata:attack_target Client_Endpoint, created_at 2014_02_27, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2014_02_27, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain"; dns_query; content:"sloryvugp4abxnfu"; depth:16; fast_pattern; nocase; reference:url,www.deependresearch.org/2017/01/threat-intel-ransomware-payment-sites.html; classtype:trojan-activity; sid:2024111; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_03_29, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE W32/FakeFlash.Dropper GetInformation CnC Beacon Acknowledgement"; flow:established,to_client; dsize:14; content:"GetInformation"; depth:14; reference:md5,43839d131dff01e9b752d91c2c8f68a8; classtype:command-and-control; sid:2018188; rev:1; metadata:attack_target Client_Endpoint, created_at 2014_02_27, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2014_02_27, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain"; dns_query; content:"u73tcilcw2cw2by5"; depth:16; fast_pattern; nocase; reference:url,www.deependresearch.org/2017/01/threat-intel-ransomware-payment-sites.html; classtype:trojan-activity; sid:2024112; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_03_29, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.joggver backdoor initialization packet"; flow:established,to_server; dsize:32; content:"|03 01 74 80|"; depth:4; fast_pattern; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; distance:14; within:14; classtype:trojan-activity; sid:2018189; rev:1; metadata:created_at 2014_02_27, updated_at 2014_02_27;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain"; dns_query; content:"xijymvzq4zkyubfe"; depth:16; fast_pattern; nocase; reference:url,www.deependresearch.org/2017/01/threat-intel-ransomware-payment-sites.html; classtype:trojan-activity; sid:2024113; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_03_29, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Trojan.Delf-5496 New Infection Report"; flow:established,to_server; dsize:<500; content:"|7c|OnConnect|7c|"; depth:20; pcre:"/^\d+?\x7cOnConnect\x7c/"; reference:url,doc.emergingthreats.net/2008908; reference:md5,3a7f11fbaf815cd2338d633de175e252; classtype:trojan-activity; sid:2008908; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain"; dns_query; content:"zmsr22fviy7kxihf"; depth:16; fast_pattern; nocase; reference:url,www.deependresearch.org/2017/01/threat-intel-ransomware-payment-sites.html; classtype:trojan-activity; sid:2024114; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_03_29, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Darkshell.A Checkin XOR C0 Win XP"; flow:to_server,established; dsize:<512; content:"|e0 e0 e0 e0 97 89 8e 84 8f|"; content:"|98 90 e0|"; distance:2; within:3; classtype:command-and-control; sid:2018229; rev:2; metadata:created_at 2014_03_06, former_category MALWARE, updated_at 2014_03_06;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain"; dns_query; content:"zuotmsnm7vh2jx77"; depth:16; fast_pattern; nocase; reference:url,www.deependresearch.org/2017/01/threat-intel-ransomware-payment-sites.html; classtype:trojan-activity; sid:2024115; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_03_29, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Hack.PcClient.g CnC (OUTBOUND) XOR b5"; flow:to_server,established; content:"|d0 cd d0 db d4 d8 d0|"; content:"|d9 da d2 dc db|"; distance:0; content:"|d1 da d6 d8 d1|"; distance:0; content:"|dd da c6 c1 db d4 d8 d0|"; fast_pattern; distance:0; content:"|c2 dc db d1 da c2 c6|"; distance:0; reference:md5,dfd6b93dac698dccd9ef565a172123f3; classtype:command-and-control; sid:2018154; rev:3; metadata:created_at 2014_02_19, former_category MALWARE, updated_at 2014_02_19;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE DeepEnd Research Ransomware CrypMIC Payment Onion Domain"; dns_query; content:"zxungms47m6ecj7t"; depth:16; fast_pattern; nocase; reference:url,www.deependresearch.org/2017/01/threat-intel-ransomware-payment-sites.html; classtype:trojan-activity; sid:2024116; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_03_29, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE TDLv4 SSL Cert"; flow:established,from_server; content:"|55 04 03|"; content:"|0a|*.city.com"; distance:1; within:11; content:"|55 04 07|"; content:"|06|Cities"; distance:1; within:7; content:"|55 04 0a|"; content:"|0a|State Corp"; distance:1; within:11; classtype:trojan-activity; sid:2018256; rev:1; metadata:attack_target Client_Endpoint, created_at 2014_03_12, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Ransomware CrypMIC Payment Onion Domain"; dns_query; content:"cze2agbxnpkc5hdk"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2024117; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_03_29, deployment Perimeter, former_category MALWARE, malware_family Ransomware, signature_severity Major, tag Ransomware_Onion_Domain, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE Linux/Onimiki DNS trojan activity long format (Outbound)"; byte_test:1,!&,128,2; content:"|00 01 00 00 00 00 00 00 38|"; offset:4; depth:9; pcre:"/^[a-z0-9]{23}[a-f0-9]{33}.[a-z0-9\-_]+.[a-z0-9\-_]+\x00\x00\x01\x00\x01/Rsi"; reference:url,www.welivesecurity.com/wp-content/uploads/2014/03/operation_windigo.pdf; reference:url,github.com/eset/malware-ioc; classtype:trojan-activity; sid:2018275; rev:8; metadata:created_at 2014_03_14, updated_at 2014_03_14;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Win32/Cradle Ransomware Onion Domain"; dns_query; content:"pn6fsogszhqlxz4n"; depth:16; nocase; fast_pattern; reference:md5,53f6f9a0d0867c10841b815a1eea1468; classtype:trojan-activity; sid:2024205; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_04_14, deployment Perimeter, former_category MALWARE, malware_family Ransomware, malware_family Cradle, signature_severity Major, tag Ransomware, updated_at 2019_09_03, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"ET MALWARE Linux/Onimiki DNS trojan activity long format (Inbound)"; byte_test:1,!&,128,2; content:"|00 01 00 00 00 00 00 00 38|"; offset:4; depth:9; pcre:"/^[a-z0-9]{23}[a-f0-9]{33}.[a-z0-9\-_]+.[a-z0-9\-_]+\x00\x00\x01\x00\x01/Rsi"; reference:url,www.welivesecurity.com/wp-content/uploads/2014/03/operation_windigo.pdf; reference:url,github.com/eset/malware-ioc; classtype:trojan-activity; sid:2018276; rev:6; metadata:created_at 2014_03_14, updated_at 2014_03_14;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE Tor based locker .onion Proxy DNS lookup July 31 2014"; dns_query; content:"iet7v4dciocgxhdv"; depth:16; nocase; reference:md5,de81fab8ec96bef76db828f4c1a42e4d; classtype:trojan-activity; sid:2018874; rev:4; metadata:created_at 2014_08_01, former_category TROJAN, updated_at 2019_09_03;)
+#alert tcp any any -> any $SSH_PORTS (msg:"ET MALWARE Linux/Kimodin SSH backdoor activity"; flow:established,to_server; content:"SSH-2.0-"; depth:8; isdataat:22,relative; pcre:"/^[0-9a-f]{22,46}/R"; reference:url,www.welivesecurity.com/wp-content/uploads/2014/03/operation_windigo.pdf; reference:url,github.com/eset/malware-ioc; classtype:trojan-activity; sid:2018264; rev:8; metadata:created_at 2014_03_13, updated_at 2014_03_13;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"; dns_query; content:".velodrivve.biz"; fast_pattern; pcre:"/[a-z]{4,10}\.velodrivve\.biz$/"; reference:url,ransomwaretracker.abuse.ch; classtype:command-and-control; sid:2022704; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_04_05, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_08_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Bladabindi/njrat CnC Keep-Alive (INBOUND)"; flow:from_server,established; content:"P[endof]"; dsize:8; reference:md5,0ae2261385c482d55519be9b0e4afef3; reference:url,anubis.iseclab.org/?action=result&task_id=1043e1f5f61319b944d51d0d6d7e23f2e; reference:md5,41a0a4c0831dbcbbfd877c7d37b671e0; reference:url,www.fireeye.com/blog/technical/botnet-activities-research/2012/09/the-story-behind-backdoorlv.html; classtype:command-and-control; sid:2017417; rev:9; metadata:created_at 2012_07_31, former_category MALWARE, updated_at 2012_07_31;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"; dns_query; content:".bedrifg.org"; fast_pattern; pcre:"/[a-z]{4,10}\.bedrifg\.org$/"; reference:url,ransomwaretracker.abuse.ch; classtype:command-and-control; sid:2022705; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_04_05, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_08_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.WinSpy.pob Sending Data over SMTP"; flow:to_server,established; content:"filename="; content:"PC_Active_Time.txt"; within:19; content:"|0d 0a|"; within:3; reference:md5,d95845c510ec1f5ad38cb9ccab16c38b; classtype:trojan-activity; sid:2018019; rev:3; metadata:created_at 2014_01_28, updated_at 2014_01_28;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"; dns_query; content:".fedbook.org"; fast_pattern; pcre:"/[a-z]{4,10}\.fedbook\.org$/"; reference:url,ransomwaretracker.abuse.ch; classtype:command-and-control; sid:2022715; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_04_07, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_08_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE MultiThreat/Winspy.RAT Keep-Alive (flowbit set)"; flow:established,to_server; dsize:2; content:"/P"; depth:2; flowbits:set,WinSpy.KeepAlive; flowbits:noalert; reference:url,www.fireeye.com/blog/technical/2014/03/from-windows-to-droids-an-insight-in-to-multi-vector-attack-mechanisms-in-rats.html; reference:md5,815576890789003a7575c2948508c6b1; classtype:trojan-activity; sid:2018291; rev:1; metadata:created_at 2014_03_18, former_category MALWARE, updated_at 2014_03_18;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"; dns_query; content:".goodbird.biz"; fast_pattern; pcre:"/[a-z]{4,10}\.goodbird\.biz$/"; reference:url,ransomwaretracker.abuse.ch; classtype:command-and-control; sid:2022731; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_04_13, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_08_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE MultiThreat/Winspy.RAT Keep-Alive Server Response"; flow:established,from_server; dsize:2; content:"/P"; depth:2; flowbits:isset,WinSpy.KeepAlive; threshold:type limit,count 2,track by_src,seconds 300; reference:url,www.fireeye.com/blog/technical/2014/03/from-windows-to-droids-an-insight-in-to-multi-vector-attack-mechanisms-in-rats.html; classtype:trojan-activity; sid:2018292; rev:1; metadata:created_at 2014_03_18, updated_at 2014_03_18;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"; dns_query; content:".verekt.biz"; fast_pattern; pcre:"/[a-z]{4,10}\.verekt\.biz$/"; reference:url,ransomwaretracker.abuse.ch; classtype:command-and-control; sid:2022727; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_04_13, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_08_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 37 (msg:"ET MALWARE MultiThreat/Winspy.RAT SMTP Data Exfiltration"; flow:established,to_server; content:"X-Mailer|3A| SysMon v1.0.0"; reference:url,www.fireeye.com/blog/technical/2014/03/from-windows-to-droids-an-insight-in-to-multi-vector-attack-mechanisms-in-rats.html; classtype:trojan-activity; sid:2018293; rev:1; metadata:created_at 2014_03_18, updated_at 2014_03_18;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"; dns_query; content:".barrout.org"; fast_pattern; pcre:"/[a-z]{4,10}\.barrout\.org$/"; reference:url,ransomwaretracker.abuse.ch; classtype:command-and-control; sid:2022748; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_04_19, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_08_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 443 (msg:"ET MALWARE MultiThreat/Winspy.RAT FTP File Download Command"; flow:established,to_server; dsize:>0; content:"/CD |5C 5C 5C|"; depth:9; pcre:"/^(?:(?:PCACTIV|ONLIN)ETIME|WEBSITE[DS]|CHATROOM|KEYLOGS)/Ri"; reference:url,www.fireeye.com/blog/technical/2014/03/from-windows-to-droids-an-insight-in-to-multi-vector-attack-mechanisms-in-rats.html; classtype:trojan-activity; sid:2018294; rev:1; metadata:created_at 2014_03_18, updated_at 2014_03_18;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"; dns_query; content:".biojart.biz"; fast_pattern; pcre:"/[a-z]{4,10}\.biojart\.biz$/"; reference:url,ransomwaretracker.abuse.ch; classtype:command-and-control; sid:2022762; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_04_26, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_08_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Upatre SSL Compromised site trudeausociety"; flow:established,to_client; content:"|12|trudeausociety.com"; fast_pattern:only; classtype:trojan-activity; sid:2018319; rev:1; metadata:created_at 2014_03_25, former_category CURRENT_EVENTS, updated_at 2014_03_25;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE ABUSE.CH Ransomware Domain Detected (TorrentLocker C2)"; dns_query; content:".benefin.org"; fast_pattern; pcre:"/[a-z]{4,10}\.benefin\.org$/"; reference:url,ransomwaretracker.abuse.ch; classtype:command-and-control; sid:2022763; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_04_26, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2019_08_30, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Sisproc"; flow:established,to_server; content:"/page_"; content:"Cookie|3a 20|XX=0|3b 20|BX=0"; reference:url,www.fireeye.com/blog/technical/malware-research/2014/03/spear-phishing-the-news-cycle-apt-actors-leverage-interest-in-the-disappearance-of-malaysian-flight-mh-370.html; reference:md5,aaf73666cbd750ed22b80ed836d2b1e4; classtype:trojan-activity; sid:2018320; rev:3; metadata:created_at 2014_03_26, updated_at 2014_03_26;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET PHISHING Possible Fake AV Phone Scam Long Domain Sept 15 2016"; dns_query; content:"issuefound"; fast_pattern; nocase; isdataat:100,relative; classtype:social-engineering; sid:2023237; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_09_15, deployment Perimeter, former_category PHISHING, signature_severity Major, tag Phishing, updated_at 2019_08_30;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"ET MALWARE Bozok.RAT checkin"; flow:to_server; content:"|00 00 00|"; offset:1; depth:4; content:"|00 7C 00|"; within:32; content:"|00 7C 00|"; within:32; content:"|00 7C 00|"; within:64; content:"|00 7C 00|"; within:12; content:"|00 7C 00|"; within:5; content:"|00 7C 00|0|00 7c 00|2|00|"; within:32; reference:md5,a45d3564d1fa27161b33712f035a5962; reference:url,www.fireeye.com/blog/technical/2013/10/know-your-enemy-tracking-a-rapidly-evolving-apt-actor.html; classtype:command-and-control; sid:2018325; rev:3; metadata:created_at 2014_03_26, former_category MALWARE, updated_at 2014_03_26;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain M2 Feb 29"; dns_query; content:"errorcode"; fast_pattern; nocase; isdataat:100,relative; classtype:social-engineering; sid:2022576; rev:4; metadata:created_at 2016_03_01, former_category WEB_CLIENT, updated_at 2019_08_30;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.Win32.Dorkbot.AR Join IRC channel"; flow:to_server,established; content:"NICK n|7B|"; nocase; pcre:"/^\S{2,3}\x7c\S+?[au]\x7D\w{2,11}\x0d?\x0a/Ri"; reference:url,microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Worm%3AWin32/Dorkbot.AR; reference:md5,7e76c7db8706511fc59508af4aef27fa; classtype:trojan-activity; sid:2016768; rev:4; metadata:created_at 2013_04_18, updated_at 2013_04_18;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain Mar 15"; dns_query; content:"suspiciousactivity"; fast_pattern; nocase; isdataat:100,relative; classtype:social-engineering; sid:2022625; rev:4; metadata:created_at 2016_03_16, former_category WEB_CLIENT, updated_at 2019_08_30;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Upatre SSL Compromised site potpourriflowers"; flow:established,to_client; content:"|55 04 03|"; content:"|1a|www.potpourriflowers.co.uk"; distance:1; within:27; nocase; classtype:trojan-activity; sid:2018350; rev:2; metadata:created_at 2014_04_03, former_category CURRENT_EVENTS, updated_at 2014_04_03;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain Mar 21 M1"; dns_query; content:"errorunauthorized"; fast_pattern; nocase; isdataat:100,relative; classtype:social-engineering; sid:2022631; rev:4; metadata:created_at 2016_03_21, former_category WEB_CLIENT, updated_at 2019_08_30;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Upatre SSL Compromised site kionic"; flow:established,to_client; content:"|55 04 03|"; content:"|0a|kionic.com"; distance:1; within:11; nocase; reference:url,blog.malwaremustdie.org/2014/04/upatre-downloading-gmo-is-back-to-ssl.html; classtype:trojan-activity; sid:2018351; rev:2; metadata:created_at 2014_04_03, former_category CURRENT_EVENTS, updated_at 2014_04_03;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain Mar 21 M2"; dns_query; content:"drivercrashed"; fast_pattern; nocase; isdataat:100,relative; classtype:social-engineering; sid:2022632; rev:4; metadata:created_at 2016_03_21, former_category WEB_CLIENT, updated_at 2019_08_30;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible FakeAV binary download (setup)"; content:"GET"; http_method; content:"index.php?key="; http_uri; content:"&key2=download"; http_uri; classtype:trojan-activity; sid:2018352; rev:2; metadata:created_at 2014_04_03, former_category CURRENT_EVENTS, updated_at 2014_04_03;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain Mar 21 M3"; dns_query; content:"computer-is-locked"; fast_pattern; nocase; isdataat:100,relative; classtype:social-engineering; sid:2022633; rev:4; metadata:created_at 2016_03_21, former_category WEB_CLIENT, updated_at 2019_08_30;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Goldun Reporting User Activity 2"; flow:established,to_server; content:"?phid="; nocase; http_uri; content:"&ver="; nocase; http_uri; content:"&nn="; nocase; http_uri; content:"User-Agent|3a| z|0d 0a|"; http_header; reference:url,www.avira.com/en/threats/TR_Spy_Goldun_de_1_details.html; reference:url,doc.emergingthreats.net/2002780; classtype:trojan-activity; sid:2002780; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain Mar 23"; dns_query; content:"unauthorized-transaction"; fast_pattern; nocase; isdataat:100,relative; classtype:social-engineering; sid:2022648; rev:4; metadata:created_at 2016_03_23, former_category WEB_CLIENT, updated_at 2019_08_30;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Downloader.Small User Agent Detected (NetScafe)"; flow:established,to_server; content:"NetScafe"; http_user_agent; depth:8; reference:url,doc.emergingthreats.net/2003641; classtype:trojan-activity; sid:2003641; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain Mar 30 M1"; dns_query; content:"diskissue"; fast_pattern; nocase; isdataat:100,relative; classtype:social-engineering; sid:2022690; rev:4; metadata:created_at 2016_03_30, former_category WEB_CLIENT, updated_at 2019_08_30;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Vinself Backdoor Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"GIF89a|50 00 00 00|"; http_client_body; depth:10; fast_pattern; content:"|0A|Content-Length|3A| 90|0D 0A|"; http_header; pcre:"/^\/[A-Z]{1}[0-9]{1,3}\/[A-X]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}\/[A-Z]{1}[0-9]{4,5}[A-M]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}\/$/Um"; reference:url,blog.fireeye.com/research/2010/11/winself-a-new-backdoor-in-town.html; classtype:command-and-control; sid:2012865; rev:11; metadata:created_at 2010_12_22, former_category MALWARE, updated_at 2010_12_22;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain M3 Feb 29"; dns_query; content:"yourcomputer"; fast_pattern; nocase; isdataat:100,relative; classtype:social-engineering; sid:2022739; rev:4; metadata:created_at 2016_04_18, former_category WEB_CLIENT, updated_at 2019_08_30;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan/Hacktool.Sniffer Successful Install Message"; flow:established,to_server; content:"/Install/Post.asp?Uid="; http_uri; fast_pattern:only; classtype:trojan-activity; sid:2013199; rev:5; metadata:created_at 2011_07_05, updated_at 2011_07_05;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain Apr 18 M1"; dns_query; content:"unusualactivity"; fast_pattern; nocase; isdataat:100,relative; classtype:social-engineering; sid:2022740; rev:4; metadata:created_at 2016_04_18, former_category WEB_CLIENT, updated_at 2019_08_30;)
+#alert tcp any any -> any 445 (msg:"ET MALWARE Possible KAPTOXA Encoded Data Transferred Over SMB 1"; flow:to_server,established; flowbits:isset,ET.kaptoxa; content:"SMB"; content:"M1"; fast_pattern; distance:0; pcre:"/^[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])/R"; reference:url,securityintelligence.com/target-data-breach-kaptoxa-pos-malware/; classtype:trojan-activity; sid:2018059; rev:2; metadata:created_at 2014_02_04, updated_at 2014_02_04;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain Apr 18 M2"; dns_query; content:"yoursystem"; fast_pattern; nocase; isdataat:100,relative; classtype:social-engineering; sid:2022741; rev:4; metadata:created_at 2016_04_18, former_category WEB_CLIENT, updated_at 2019_08_30;)
+#alert tcp any any -> any 445 (msg:"ET MALWARE Possible KAPTOXA Encoded Data Transferred Over SMB 2"; flow:to_server,established; flowbits:isset,ET.kaptoxa; content:"SMB"; content:"Mf"; fast_pattern; distance:0; pcre:"/^[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])/R"; reference:url,securityintelligence.com/target-data-breach-kaptoxa-pos-malware/; classtype:trojan-activity; sid:2018060; rev:2; metadata:created_at 2014_02_04, updated_at 2014_02_04;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain Apr 18 M3"; dns_query; content:"howcanwehelp"; fast_pattern; nocase; isdataat:100,relative; classtype:social-engineering; sid:2022742; rev:4; metadata:created_at 2016_04_18, former_category WEB_CLIENT, updated_at 2019_08_30;)
+#alert tcp any any -> any 445 (msg:"ET MALWARE Possible KAPTOXA Encoded Data Transferred Over SMB 3"; flow:to_server,established; flowbits:isset,ET.kaptoxa; content:"SMB"; content:"Mh"; fast_pattern; distance:0; pcre:"/^[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])/R"; reference:url,securityintelligence.com/target-data-breach-kaptoxa-pos-malware/; classtype:trojan-activity; sid:2018061; rev:2; metadata:created_at 2014_02_04, updated_at 2014_02_04;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain Apr 18 M4"; dns_query; content:"bluescreen"; fast_pattern; nocase; isdataat:100,relative; classtype:social-engineering; sid:2022743; rev:4; metadata:created_at 2016_04_18, former_category WEB_CLIENT, updated_at 2019_08_30;)
+#alert tcp any any -> any 445 (msg:"ET MALWARE Possible KAPTOXA Encoded Data Transferred Over SMB 4"; flow:to_server,established; flowbits:isset,ET.kaptoxa; content:"SMB"; content:"Ml"; fast_pattern; distance:0; pcre:"/^[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])/R"; reference:url,securityintelligence.com/target-data-breach-kaptoxa-pos-malware/; classtype:trojan-activity; sid:2018062; rev:2; metadata:created_at 2014_02_04, updated_at 2014_02_04;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain Apr 18 M5"; dns_query; content:"cloud-on"; fast_pattern; nocase; isdataat:100,relative; classtype:social-engineering; sid:2022744; rev:4; metadata:created_at 2016_04_18, former_category WEB_CLIENT, updated_at 2019_08_30;)
+#alert tcp any any -> any 445 (msg:"ET MALWARE Possible KAPTOXA Encoded Data Transferred Over SMB 5"; flow:to_server,established; flowbits:isset,ET.kaptoxa; content:"SMB"; content:"T1"; fast_pattern; distance:0; pcre:"/^[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])/R"; reference:url,securityintelligence.com/target-data-breach-kaptoxa-pos-malware/; classtype:trojan-activity; sid:2018063; rev:3; metadata:created_at 2014_02_04, updated_at 2014_02_04;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET WEB_CLIENT Possible Fake AV Phone Scam Long Domain Apr 18 M6"; dns_query; content:"call-now"; fast_pattern; nocase; isdataat:100,relative; classtype:social-engineering; sid:2022745; rev:4; metadata:created_at 2016_04_18, former_category WEB_CLIENT, updated_at 2019_08_30;)
+#alert tcp any any -> any 445 (msg:"ET MALWARE Possible KAPTOXA Encoded Data Transferred Over SMB 6"; flow:to_server,established; flowbits:isset,ET.kaptoxa; content:"SMB"; content:"Tf"; fast_pattern; distance:0; pcre:"/^[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])/R"; reference:url,securityintelligence.com/target-data-breach-kaptoxa-pos-malware/; classtype:trojan-activity; sid:2018064; rev:2; metadata:created_at 2014_02_04, updated_at 2014_02_04;)
 
-alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:"ET DNS DNS Lookup for localhost.DOMAIN.TLD"; content:"|01|"; offset:2; depth:1; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"|09|localhost"; fast_pattern; nocase; classtype:bad-unknown; sid:2011802; rev:6; metadata:created_at 2010_10_13, updated_at 2019_09_03;)
+#alert tcp any any -> any 445 (msg:"ET MALWARE Possible KAPTOXA Encoded Data Transferred Over SMB 7"; flow:to_server,established; flowbits:isset,ET.kaptoxa; content:"SMB"; content:"Th"; fast_pattern; distance:0; pcre:"/^[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])/R"; reference:url,securityintelligence.com/target-data-breach-kaptoxa-pos-malware/; classtype:trojan-activity; sid:2018065; rev:2; metadata:created_at 2014_02_04, updated_at 2014_02_04;)
 
-#alert dns $HOME_NET any -> any any (msg:"ET MALWARE CryptoLocker .onion Proxy Domain (v7lfogalalzc2c4d)"; dns_query; content:"v7lfogalalzc2c4d"; depth:16; fast_pattern; nocase; classtype:trojan-activity; sid:2020953; rev:4; metadata:created_at 2015_04_21, updated_at 2019_09_03;)
+#alert tcp any any -> any 445 (msg:"ET MALWARE Possible KAPTOXA Encoded Data Transferred Over SMB 8"; flow:to_server,established; flowbits:isset,ET.kaptoxa; content:"SMB"; content:"Tl"; fast_pattern; distance:0; pcre:"/^[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])/R"; reference:url,securityintelligence.com/target-data-breach-kaptoxa-pos-malware/; classtype:trojan-activity; sid:2018066; rev:2; metadata:created_at 2014_02_04, updated_at 2014_02_04;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Successful Gmail Phish (set) 2016-09-12"; flow:to_server,established; content:"POST"; http_method; content:".php"; http_uri; content:"Email="; depth:6; nocase; http_client_body; content:"&Next=Next"; nocase; distance:0; http_client_body; fast_pattern; flowbits:set,ET.GmailPhish_1; flowbits:noalert; classtype:credential-theft; sid:2027956; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_09_12, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2019_09_06, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp any any -> any 445 (msg:"ET MALWARE Possible KAPTOXA Encoded Data Transferred Over SMB 9"; flow:to_server,established; flowbits:isset,ET.kaptoxa; content:"SMB"; content:"sh"; fast_pattern; distance:0; pcre:"/^[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])/R"; reference:url,securityintelligence.com/target-data-breach-kaptoxa-pos-malware/; classtype:trojan-activity; sid:2018067; rev:3; metadata:created_at 2014_02_04, updated_at 2014_02_04;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET DELETED Possible Successful Phishing Attempt Jan 20 2015"; flow:established,to_server; content:"POST"; http_method; urilen:20; content:"/js/moontools-1.7.js"; http_uri; fast_pattern:only; content:"username="; depth:9; http_client_body; content:"&password="; distance:0; http_client_body; classtype:credential-theft; sid:2020224; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_01_21, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2021_06_23, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp any any -> any 445 (msg:"ET MALWARE Possible KAPTOXA Encoded Data Transferred Over SMB 10"; flow:to_server,established; flowbits:isset,ET.kaptoxa; content:"SMB"; content:"sl"; fast_pattern; distance:0; pcre:"/^[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(?:M[1fhl]|T[1fhl]|s[hl])/R"; reference:url,securityintelligence.com/target-data-breach-kaptoxa-pos-malware/; classtype:trojan-activity; sid:2018068; rev:2; metadata:created_at 2014_02_04, updated_at 2014_02_04;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic XBALTI Phishing Landing"; flow:established,to_client; file_data; content:"|3c 21 2d 2d 20 7c 20 20 20 20 5c 20 20 5c 20 42 59 20 58 42 41 4c 54 49 20 2f 20 2d 2d 3e|"; fast_pattern; classtype:social-engineering; sid:2027966; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2019_09_09, deployment Perimeter, former_category PHISHING, signature_severity Major, tag Phishing, updated_at 2019_09_09;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE W32/Trojan-Gypikon Server Check-in Response"; flow:established,from_server; dsize:16; content:"|85 19 00 00 25 04 00 00 00 00|"; content:"|40 00 00 00 00|"; distance:1; within:6; reference:md5,f27bf471d2f2c0a76331d25fc4761e10; reference:md5,792b725b6a2a52e4eecde846b39eea7d; classtype:trojan-activity; sid:2018130; rev:3; metadata:created_at 2014_02_13, updated_at 2014_02_13;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"ET EXPLOIT HiSilicon DVR - Default Telnet Root Password Inbound"; flow:established,to_server; content:"xc3511"; fast_pattern; reference:url,github.com/tothi/pwn-hisilicon-dvr; classtype:default-login-attempt; sid:2027973; rev:2; metadata:affected_product DVR, attack_target IoT, created_at 2019_09_09, deployment Perimeter, former_category EXPLOIT, signature_severity Major, updated_at 2019_09_09;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Trojan-Gypikon Sending Data"; flow:established,to_server; content:"@"; pcre:"/^(?:x(?:86|64)@)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/R"; content:" OS|3a 20|Win"; within:8; content:" CPU|3a|"; distance:0; content:"Hz|2c|RAM|3a|"; distance:0; reference:md5,f27bf471d2f2c0a76331d25fc4761e10; reference:md5,792b725b6a2a52e4eecde846b39eea7d; classtype:trojan-activity; sid:2018129; rev:4; metadata:created_at 2014_02_13, updated_at 2014_02_13;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET [554,9527] (msg:"ET EXPLOIT HiSilicon DVR - Default Application Backdoor Password"; flow:established,to_server; content:"I0TO5Wv9"; fast_pattern; reference:url,github.com/tothi/pwn-hisilicon-dvr; classtype:default-login-attempt; sid:2027974; rev:2; metadata:affected_product DVR, attack_target IoT, created_at 2019_09_09, deployment Perimeter, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2019_09_09;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.BAT.Qhost - SET"; flow:established,to_server; content:"GET"; http_method; content:"/stat/tuk/"; http_uri; flowbits:set,ETPRO.Trojan.BAT.Qhost; flowbits:noalert; reference:md5,f6e1583aca310c4c0d55db1dae942b2b; classtype:trojan-activity; sid:2014758; rev:5; metadata:created_at 2012_05_16, former_category MALWARE, updated_at 2012_05_16;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - AcroCEF"; ja3_hash; content:"61d50e7771aee7f2f4b89a7200b4d45e"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2027975; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Trojan.BAT.Qhost Response from Controller"; flow:established,from_server; flowbits:isset,ETPRO.Trojan.BAT.Qhost; content:"Set-Cookie|3a| ci_session="; content:"session_id"; distance:0; content:"ip_address"; distance:0; content:"user_agent"; distance:0; content:"last_activity"; distance:0; content:"user_data"; distance:0; reference:md5,f6e1583aca310c4c0d55db1dae942b2b; classtype:trojan-activity; sid:2014759; rev:4; metadata:created_at 2012_05_16, updated_at 2012_05_16;)
 
-alert smtp any any -> $SMTP_SERVERS any (msg:"ET EXPLOIT Possible EXIM RCE Inbound (CVE-2019-15846)"; flow:established,to_server; content:"|16|"; depth:1; content:"|01|"; distance:4; within:1; content:"|5c 00|"; fast_pattern; distance:0; pcre:"/[\x20-\x7e]{5,}\x5c\x00[\x20-\x7e]{5,}/"; reference:cve,2019-15846; reference:url,exim.org/static/doc/security/CVE-2019-15846.txt; classtype:attempted-admin; sid:2027959; rev:2; metadata:created_at 2019_09_06, former_category EXPLOIT, performance_impact Significant, updated_at 2019_09_10;)
+#alert http $HOME_NET any -> $EXTERNAL_NET 110 (msg:"ET MALWARE Gh0st_Apple Checkin"; flow:to_server,established; content:"GET"; http_method; content:".gif?pid"; fast_pattern; content:"&v="; content:"Mozilla/4.0("; http_user_agent; reference:url,contagiodump.blogspot.com.br/2013/09/sandbox-miming-cve-2012-0158-in-mhtml.html; reference:md5,82644661f6639c9fcb021ad197b565f7; classtype:command-and-control; sid:2017412; rev:8; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_09_04, deployment Perimeter, former_category MALWARE, malware_family Gh0st, malware_family PCRAT, signature_severity Critical, tag PCRAT, tag Gh0st, tag RAT, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Adium 1.5.10 (b)"; ja3_hash; content:"e4adf57bf4a7a2dc08e9495f1b05c0ea"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027977; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor Win32/Zegost.Q CnC traffic (OUTBOUND)"; flow:to_server,established; dsize:>11; content:"|55 60 67 6c 69 70 9a|"; offset:8; depth:7; reference:url,www.securelist.com/en/descriptions/10155706/Trojan-GameThief.Win32.Magania.eogz; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPcClient.ZR&ThreatID=-2147325231; reference:md5,4f0d365408b439eb9aaf0b2352abb662; classtype:command-and-control; sid:2018390; rev:1; metadata:created_at 2014_04_16, former_category MALWARE, updated_at 2014_04_16;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - AIM"; ja3_hash; content:"49a6cf42956937669a01438f26e7c609"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2027978; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE CryptoDefense DNS Domain Lookup"; content:"|10|rj2bocejarqnpuhm"; nocase; pcre:"/^[^\x00]+?\x00/Rs"; classtype:trojan-activity; sid:2018397; rev:3; metadata:created_at 2014_04_16, updated_at 2014_04_16;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - AirCanada Android App"; ja3_hash; content:"0bb402a703d08a608bf82763b1b63313"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027979; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE BitCrypt Ransomware Domain"; flow:established,to_server; content:"bitcrypt.cc"; nocase; http_header; pcre:"/Host\x3a\x20(?:[^\r\n]+\.)?bitcrypt\.cc(?:\x3a\d{1,5})?\r\n/Hmi"; classtype:trojan-activity; sid:2018400; rev:2; metadata:attack_target Client_Endpoint, created_at 2014_04_18, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2014_04_18, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - AirCanada Android App"; ja3_hash; content:"d5169d6e19447685bf6f1af8c055d94d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027980; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan-Downloader Win32.Genome.avan"; flow:to_server,established; content:"mac="; http_uri; content:"&hdid="; http_uri; content:"&wlid="; http_uri; fast_pattern:only; content:"&start="; http_uri; content:"&os="; http_uri; content:"&mem="; http_uri; content:"&alive="; http_uri; content:"&ver="; http_uri; reference:url,doc.emergingthreats.net/2011236; classtype:trojan-activity; sid:2011236; rev:5; metadata:created_at 2010_07_30, updated_at 2022_05_03;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Airmail 3"; ja3_hash; content:"561145462cfc7de1d6a97e93d3264786"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2027981; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Wapomi.AD Variant Checkin"; flow:established,to_server; content:"/passport.asp?ID="; http_uri; content:"&fn="; http_uri; content:"&Var="; http_uri; reference:md5,37ab252df52f5e1a46b3b40e9afb40c0; classtype:command-and-control; sid:2013720; rev:5; metadata:created_at 2011_10_01, former_category MALWARE, updated_at 2011_10_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Alation Compose"; ja3_hash; content:"f6fd83a21f9f3c5f9ff7b5c63bbc179d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2027982; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PSW.Win32.Ruftar.lon File Stealer FTP File Upload"; flow:established,to_server; content:"CWD Stealer"; classtype:trojan-activity; sid:2013346; rev:4; metadata:created_at 2011_08_02, updated_at 2011_08_02;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Amazon Music"; ja3_hash; content:"6003b52942a2e1e1ea72d802d153ec08"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2027983; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ftpchk3.php possible upload success"; flow:to_client,established; content:"|0d 0a|150 "; content:"ftpchk3.php|0d 0a|226 "; distance:0; nocase; reference:url,digitalpbk.blogspot.com/2009/10/ftpchk3-virus-php-pl-hacked-website.html; reference:url,labs.mwrinfosecurity.com/system/assets/131/original/Journey-to-the-Centre-of-the-Breach.pdf; classtype:attempted-admin; sid:2018417; rev:3; metadata:created_at 2014_04_24, updated_at 2014_04_24;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Amazon Music,Dreamweaver,Spotify"; ja3_hash; content:"eb149984fc9c44d85ed7f12c90d818be"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2027984; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Cutwail.BE Checkin 2"; flow:established,from_client; dsize:32; content:"|00 00 00 00 FF FF FF FF 3F 57|"; depth:10; content:"|FE FF FF FF FF FF FF FF FF FF FF|"; distance:3; within:11; threshold: type limit, track by_src, seconds 60, count 1; reference:md5,c6d256edcc8879717539f348706061f2; reference:md5,8f17e2a9e7c6cbec772ae56dfffb13cb; classtype:command-and-control; sid:2014272; rev:3; metadata:created_at 2012_02_22, former_category MALWARE, updated_at 2012_02_22;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Android App"; ja3_hash; content:"662fdc668dd6af994a0f903dbcf25d66"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027985; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Cutwail.BE Checkin 1"; flow:established,from_client; dsize:234; content:"|16 03 00 00 37 01 00 00 33 03 00|"; depth:11; threshold: type limit, track by_src, seconds 60, count 1; reference:md5,4352407efc8891215b514a54db5b8a1d; reference:md5,45ab3554f3d60d07fc5228faff7784e1; classtype:command-and-control; sid:2014271; rev:3; metadata:created_at 2012_02_22, former_category MALWARE, updated_at 2012_02_22;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Android Google API Access"; ja3_hash; content:"515601c4141e718865697050a7a1765f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027986; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert icmp $HOME_NET any -> any any (msg:"ET MALWARE Backdoor.Win32.RShot Ping Outbound"; icode:0; itype:8; icmp_id:512; dsize:32; content:"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; reference:md5,34477e29f7408966d2703f3471741618; reference:md5,adf4c3a16f5f6d4baa634b2c50bf7454; classtype:trojan-activity; sid:2014270; rev:3; metadata:created_at 2012_02_21, updated_at 2012_02_21;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Android Webkit Thing"; ja3_hash; content:"1aab4c2c84b6979c707ed052f724734b"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027987; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Upatre Binary Download April 28 2014"; flow:established,from_server; file_data; content:"|ff d1 4e 8d|"; within:4; classtype:trojan-activity; sid:2018422; rev:3; metadata:created_at 2014_04_28, updated_at 2014_04_28;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Android Webkit Thing"; ja3_hash; content:"25b72c88f837567856118febcca761e0"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027988; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/ProxyChanger.InfoStealer Checkin"; flow:established,to_server; content:"POST"; nocase; http_method; content:"/abc.php"; http_uri; fast_pattern; content:"User-Agent|3A 20|Mozilla/3.0|20 28|compatible|3B 20|Indy Library|29|"; http_header; content:"ABC="; http_client_body; depth:4; content:"&XRE="; http_client_body; within:30; reference:md5,67c9799940dce6b9af2e6f98f52afdf7; classtype:command-and-control; sid:2014356; rev:5; metadata:created_at 2012_03_09, former_category MALWARE, updated_at 2012_03_09;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Android Webkit Thing"; ja3_hash; content:"5331a12866e19199b363f6e903381498"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027989; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Daemonize Trojan Proxy Initial Checkin"; flow:established,to_server; content:"/command.php?IP="; http_uri; content:"ID="; http_uri; content:"User-Agent|3a 20 5c 0d 0a|"; pcre:"/ID=\d{24}($|&)/U"; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanProxy%3AWin32%2FDaemonize.A&ThreatID=-2147464655; classtype:command-and-control; sid:2013723; rev:3; metadata:created_at 2011_10_01, former_category MALWARE, updated_at 2011_10_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Android Webkit Thing"; ja3_hash; content:"855953256ecc8e2b6d2360aff8e5d337"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027990; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Compromised site iclasshd.net"; flow:established,to_client; content:"|55 04 03|"; content:"|0c|iclasshd.net"; distance:1; within:14; nocase; reference:md5,abe131828ce5beae41ef341238016547; classtype:trojan-activity; sid:2018460; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2014_05_09, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Adium 1.5.10 (a)"; ja3_hash; content:"93948924e733e9df15a3bb44404cd909"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027976; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Compromised site sabzevarsez.com"; flow:established,to_client; content:"|55 04 03|"; content:"|13|www.sabzevarsez.com"; distance:1; within:21; nocase; reference:md5,36cf205b39bd27b6dc981dd0da8a311a; classtype:trojan-activity; sid:2018461; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2014_05_09, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Android Webkit Thing"; ja3_hash; content:"85bb8aa8e5ba373906348831bdbed41a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027991; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Backdoor.Unrecom Download"; flow:established,from_server; flowbits:isset,ET.http.javaclient; content:"Unrecom"; nocase; pcre:"/^[a-z0-9_-]*?\.class/Rsi"; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2013-070113-1904-99&tabid=3; reference:url,www.crowdstrike.com/blog/adwind-rat-rebranding/index.html; classtype:trojan-activity; sid:2018466; rev:6; metadata:created_at 2014_05_13, updated_at 2014_05_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Android Webkit Thing"; ja3_hash; content:"99d8afeec9a4422120336ad720a5d692"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027992; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PandoraRat/Refroso.bsp Activity"; flow:established,to_server; content:"|c3 b8 ba ab a0 bc b0 b1 c1 7c|"; depth:10; content:"|7c|N|7c|"; within:200; reference:md5,9972e686d36f1e98ba9bb82b5528255a; classtype:trojan-activity; sid:2018467; rev:4; metadata:created_at 2014_05_13, updated_at 2014_05_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - AnypointStudio"; ja3_hash; content:"8e3f1bf87bc652a20de63bfd4952b16a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2027993; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PandoraRat/Refroso.bsp Directory Listing Sent To Server"; flow:established,to_server; content:"|7C|DIR#0#bin|7C|DIR#0"; reference:md5,9972e686d36f1e98ba9bb82b5528255a; classtype:trojan-activity; sid:2018468; rev:4; metadata:created_at 2014_05_13, updated_at 2014_05_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Apple Push Notification System, apple.WebKit.Networking,CalendarAgent,Go for Gmail"; ja3_hash; content:"d4693422c5ce1565377aca25940ad80c"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027994; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Compromised site dfsdirect.ca"; flow:established,to_client; content:"|55 04 03|"; content:"|0c|dfsdirect.ca"; distance:1; within:14; nocase; reference:md5,fe56b5a28eac390aa8cfb1402360958b; classtype:trojan-activity; sid:2018480; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2014_05_16, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Apple Spotlight Search (OSX)"; ja3_hash; content:"3e404f1e1b5a79e614d7543a79f3a1da"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027995; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Zendran ELF IRCBot Joining Channel"; flow:established,to_server; content:"USER ass localhost localhost"; nocase; reference:url,blog.malwaremustdie.org/2014/05/threat-analysis-zendran-elf-ddos-scheme.html; reference:url,capsop.com/lightaidra-cc-investigation/; classtype:trojan-activity; sid:2018482; rev:2; metadata:created_at 2014_05_19, updated_at 2014_05_19;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Apple Spotlight"; ja3_hash; content:"69b2859aec70e8934229873fe53902fd"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027996; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Zendran ELF IRCBot Joining Channel 2"; flow:established,to_server; content:"PASS eYmUrmyAfG"; reference:url,blog.malwaremustdie.org/2014/05/threat-analysis-zendran-elf-ddos-scheme.html; reference:url,capsop.com/lightaidra-cc-investigation/; classtype:trojan-activity; sid:2018483; rev:2; metadata:created_at 2014_05_19, updated_at 2014_05_19;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Apple Spotlight"; ja3_hash; content:"6b9b64bbe95ea112d02c8812fc2e7ef0"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027997; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Zendran ELF IRCBot Server Banner"; dsize:>14; flow:established,from_server; content:"|3a|Hell.Network|0d 0a|"; depth:15; reference:url,blog.malwaremustdie.org/2014/05/threat-analysis-zendran-elf-ddos-scheme.html; reference:url,capsop.com/lightaidra-cc-investigation/; classtype:trojan-activity; sid:2018484; rev:2; metadata:created_at 2014_05_19, updated_at 2014_05_19;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Apple Spotlight"; ja3_hash; content:"e5e4c0eeb02fdcf30af8235b4de07780"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027998; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS [25,587] (msg:"ET MALWARE .gadget Email Attachment - Possible Upatre"; flow:established,to_server; content:"Content-Type|3a| application/zip|3b|"; nocase; content:".gadget|22|"; distance:7; within:30; nocase; pcre:"/name=\x22[a-z0-9\-_\.\s]{0,25}\.gadget\x22/i"; reference:url,pastebin.com/5eNDazpL; classtype:trojan-activity; sid:2018490; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2014_05_21, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Apple SpotlightNetHelper (OSX)"; ja3_hash; content:"97827640b0c15c83379b7d71a3c2c5b4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2027999; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Upatre SSL Cert May 20 2014"; flow:established,from_server; content:"|11|www.myparadis.com"; reference:md5,ba7debd3ff51356135866a76116f595b; reference:md5,8a49c032efb6aa3a347a173d196a8bcb; classtype:trojan-activity; sid:2018492; rev:1; metadata:attack_target Client_Endpoint, created_at 2014_05_21, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Apple usbmuxd iOS socket multiplexer"; ja3_hash; content:"47e42b00af27b87721e526ff85fd2310"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028000; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE OneLouder EXE download possibly installing Zeus P2P"; flow:to_client,established; flowbits:isset,ET.OneLouder.Header; file_data; content:"MZ"; within:2; byte_jump:4,60,little,from_beginning; content:"PE|00 00|"; within:4; classtype:trojan-activity; sid:2018464; rev:4; metadata:created_at 2014_05_13, former_category MALWARE, updated_at 2014_05_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - apple.geod"; ja3_hash; content:"5507277945374659a5b4572e1b6d9b9f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028001; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Upatre Compromised Site hot-buys"; flow:established,to_client; content:"|55 04 03|"; content:"|0c|hot-buys.org"; distance:1; within:14; nocase; reference:md5,bad758023d2e3cc17b61423720cdb5b7; classtype:trojan-activity; sid:2018506; rev:1; metadata:created_at 2014_05_29, updated_at 2014_05_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - apple.geod"; ja3_hash; content:"f753495f2eab5155c61b760c838018f8"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028002; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET [443,$HTTP_PORTS] -> $HOME_NET any (msg:"ET MALWARE TorExplorer Certificate - Potentially Linked To W32/Cryptowall.Ransomware"; flow:established,to_client; content:"|55 04 03|"; content:"torexplorer.com"; distance:0; reference:url,www.malware-traffic-analysis.net/2014/05/28/index.html; classtype:trojan-activity; sid:2018539; rev:1; metadata:attack_target Client_Endpoint, created_at 2014_06_06, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2014_06_06, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - apple.geod/parsecd,apple.photomoments"; ja3_hash; content:"ba40fea2b2638908a3b3b482ac78d729"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028003; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert"; flow:established,to_client; content:"|55 04 03|"; content:"|1e|static-182-18-143-140.ctrls.in"; distance:1; within:31; reference:md5,b4d63a1178027f64c4c868181437284d; classtype:trojan-activity; sid:2018542; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_06_07, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - apple.WebKit.Networking"; ja3_hash; content:"474e73aea21d1e0910f25c3e6c178535"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028004; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Putter Panda 3PARA RAT initial beacon"; flow:established,to_server; content:"|c4 65 f1 b3 cf a5 7e e2 c0 1a d4 7f 78 46 26 b5 86 15 f9 34 9c 3d 67 84 6a 48 aa df dc 30 60 24|"; depth:2000; reference:url,resources.crowdstrike.com/putterpanda/; classtype:trojan-activity; sid:2018555; rev:2; metadata:attack_target Client_Endpoint, created_at 2014_06_11, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2014_06_11, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - apple.WebKit.Networking"; ja3_hash; content:"eeeb5e7485f5e10cbc39db4cfb69b264"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028005; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Sharik C2 Incoming Crafted Request"; flow:established,from_server; content:"|4d 00 02 02 00|"; depth:5; fast_pattern; content:"/"; distance:4; within:5; content:" HTTP/1."; distance:0; reference:md5,f9f30307ca22d092c02701c108aa6402; classtype:command-and-control; sid:2018616; rev:1; metadata:created_at 2014_06_30, former_category MALWARE, updated_at 2014_06_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - apple.WebKit.Networking/Chatter/FieldServiceApp/socialstudio"; ja3_hash; content:"63de2b6188d5694e79b678f585b13264"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028006; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Downloader.Win32.Tesch.A Server Command (bot is ready to start receiving commands)"; flow:established,from_server; dsize:4; flowbits:isset,ET.Tesch; content:"|05 00 01 01|"; depth:4; reference:url,stopmalvertising.com/rootkits/analysis-of-a-triple-click-fraud-threat.html; classtype:trojan-activity; sid:2018626; rev:5; metadata:created_at 2014_07_02, updated_at 2014_07_02;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - apple.WebKit.Networking/itunesstored"; ja3_hash; content:"7b343af1092863fdd822d6f10645abfb"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028007; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Downloader.Win32.Tesch.A Server Command (Confirm C2 IP and port) 2"; flow:established,from_server; flowbits:isset,ET.Tesch; dsize:9; content:"|04 00 06|"; depth:3; reference:url,stopmalvertising.com/rootkits/analysis-of-a-triple-click-fraud-threat.html; classtype:command-and-control; sid:2018625; rev:5; metadata:created_at 2014_07_02, former_category MALWARE, updated_at 2014_07_02;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - apple.WebKit.Networking/Spotify/WhatsApp/Skype/iTunes"; ja3_hash; content:"a312f9162a08eeedf7feb7a13cd7e9bb"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028008; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET MALWARE Downloader.Win32.Tesch.A Bot Command (OK acknowledgement)"; flow:established,to_server; flowbits:isset,ET.Tesch; dsize:3; content:"|0a 00 00|"; depth:3; reference:url,stopmalvertising.com/rootkits/analysis-of-a-triple-click-fraud-threat.html; classtype:trojan-activity; sid:2018622; rev:6; metadata:created_at 2014_07_02, updated_at 2014_07_02;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - AppleWebKit/533.1 (KHTML like Gecko) Version/4.0 Mobile Safari/533.1"; ja3_hash; content:"1a6ef47ab8325fbb42c447048cea9167"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028009; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Downloader.Win32.Tesch.A Bot Command (Proxy command)"; flow:established,from_server; flowbits:isset,ET.Tesch; dsize:28; content:"|09 00 19|"; depth:3; reference:url,stopmalvertising.com/rootkits/analysis-of-a-triple-click-fraud-threat.html; classtype:trojan-activity; sid:2018623; rev:5; metadata:created_at 2014_07_02, updated_at 2014_07_02;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - AppleWebKit/533.1 (KHTML like Gecko) Version/4.0 Mobile Safari/533.1"; ja3_hash; content:"b677934e592ece9e09805bf36cd68d8a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028010; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1433 (msg:"ET MALWARE TrojanSpy.Win32/Banker.AMB SQL Checkin"; flow:established,to_server; content:"I|00|N|00|S|00|E|00|R|00|T"; content:"I|00|N|00|T|00|O"; distance:0; content:"B|00|R|00|O|00|W|00|S|00|E|00|R|00|L|00|O|00|G|00|U|00|S|00|B|00|"; reference:md5,dd141287cb45a2067592eeb9d3aa7162; classtype:command-and-control; sid:2018645; rev:2; metadata:created_at 2014_07_07, former_category MALWARE, updated_at 2014_07_07;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - AppleWebKit/534.30 (KHTML like Gecko) Version/4.0 Safari & Safari Mobile/534.30, AppleWebKit/534.30"; ja3_hash; content:"ef323f542a99ab12d6b5348bf039b7b4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028011; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert 999servers.com"; flow:established,to_client; content:"|55 04 03|"; content:"|10|*.999servers.com"; distance:1; within:17; reference:md5,b9ffad739bb47a0e4619b76af51d9a74; classtype:trojan-activity; sid:2018647; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_07, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - AppleWebKit/534.30"; ja3_hash; content:"e1e03b911a28815836d79c5cdd900a20"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028012; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Upatre SSL Cert July 7 2014"; flow:established,from_server; content:"|16 03 00|"; content:"|2a 86 48 86 f7 0d 01 09 01|"; content:"smalbach2424@hotmail.com"; distance:2; within:24; reference:md5,52084660d2ae0ee8f033621a9252cfb9; classtype:trojan-activity; sid:2018651; rev:1; metadata:attack_target Client_Endpoint, created_at 2014_07_08, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - AppleWebKit/534.46 Mobile/9A334"; ja3_hash; content:"04e1f90d8719caabafb76d4a7b13c984"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028013; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert udp any 53 -> $HOME_NET any (msg:"ET MALWARE Possible Zeus P2P Variant DGA NXDOMAIN Responses July 11 2014"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; pcre:"/^..[\x0d-\x20](?=\d{0,27}[a-z])(?=[a-z]{0,27}\d)[a-z0-9]{21,28}(?:\x03(?:biz|com|net|org))\x00\x00\x01\x00\x01/Rs"; threshold: type both, track by_dst, count 12, seconds 120; reference:url,blog.malcovery.com/blog/breaking-gameover-zeus-returns; reference:md5,5e5e46145409fb4a5c8a004217eef836; classtype:trojan-activity; sid:2018666; rev:4; metadata:created_at 2014_07_11, former_category MALWARE, updated_at 2014_07_11;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - AppleWebKit/534.46, iOS AppleWebKit/534.46"; ja3_hash; content:"dc08cf4510f70bf16d4106ee22f89197"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028014; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert acesecureshop.com"; flow:established,to_client; content:"|55 04 03|"; content:"|11|acesecureshop.com"; distance:1; within:18; reference:md5,c2e85512ceaacbf8306321f9cc2b1eaf; classtype:trojan-activity; sid:2018671; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_14, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - AppleWebKit/535 & Ubuntu Product Search"; ja3_hash; content:"4049550d5f57eae67d958440bdc133e4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028015; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert new-install.privatedns.com"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 03|"; distance:0; content:"|1a|new-install.privatedns.com"; distance:1; within:27; fast_pattern; content:"|2a 86 48 86 f7 0d 01 09 01|"; distance:0; content:"|1e|ssl@new-install.privatedns.com"; distance:1; within:31; reference:md5,280a3a944878d57bc44ead271a0cc457; classtype:trojan-activity; sid:2018672; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_14, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - AppleWebKit/600.7.12 or 600.1.4"; ja3_hash; content:"ef75a13be2ed7a82f16eefe6e84bc375"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028016; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert July 14 2014"; flow:established,to_client; content:"|55 04 03|"; content:"|0f|groberts.com.au"; distance:1; within:16; content:"|2a 86 48 86 f7 0d 01 09 01|"; distance:0; content:"|13|info@dctreasure.com"; distance:1; within:20; reference:md5,9f48eb74687492978259edb8f79ac397; classtype:trojan-activity; sid:2018673; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_14, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - AppleWebKit/600.7.12"; ja3_hash; content:"eaa8a172289b09a6789a415d1faac4c9"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028017; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert faithmentoringandmore.com"; flow:established,to_client; content:"|55 04 03|"; content:"|1d|www.faithmentoringandmore.com"; distance:1; within:31; reference:md5,b5df3ba04c987692929f35d9c64e0c0d; classtype:trojan-activity; sid:2018674; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_14, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - AT&T Connect"; ja3_hash; content:"c5c11e6105c56fd29cc72c3ac7a2b78b"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028018; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux DDoS bot Antiq IRC"; flow:established,to_server; content:"PRIVMSG|20|#"; content:"status checking progam online"; within:60; reference:url,deependresearch.org/2014/07/another-linux-ddos-bot-via-cve-2012-1823.html; classtype:trojan-activity; sid:2018675; rev:1; metadata:created_at 2014_07_14, updated_at 2014_07_14;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Atlassian SourceTree (git library?) (Tested v1.6.21.0)"; ja3_hash; content:"42215ee83bbf3a857a72ef42213cfbd6"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028019; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert karinejoncas.com"; flow:established,from_server; content:"|55 04 03|"; content:"|14|www.karinejoncas.com"; distance:1; within:21; reference:md5,87bbf4bc45ef30507b1d239edc727067; classtype:trojan-activity; sid:2018690; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_17, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Atlassian SourceTree (Tested v1.6.21.0)"; ja3_hash; content:"1c8a17e58c20b49e3786fc61e0533e50"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028020; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert deslematin.ca"; flow:established,from_server; content:"|55 04 03|"; content:"|0d|deslematin.ca"; distance:1; within:14; reference:md5,87bbf4bc45ef30507b1d239edc727067; classtype:trojan-activity; sid:2018691; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_17, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - atom.io #1"; ja3_hash; content:"4e5e5d9fbc43697be755696191fe649a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028021; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,from_server; content:"|55 04 03|"; content:"|14|www.newdomaininfo.ru"; distance:1; within:21; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2018692; rev:4; metadata:attack_target Client_and_Server, created_at 2014_07_17, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - atom.io #2"; ja3_hash; content:"c94858c6eb06de179493b3fac847143e"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028022; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL certificate detected (Vawtrak MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0d|duosecure.com"; distance:1; within:14; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2018696; rev:2; metadata:attack_target Client_and_Server, created_at 2014_07_17, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Aviator (Mystery 3rd) (37.0.2062.99) (OS X)"; ja3_hash; content:"58360f4f663a0f5657f415ac2f47fe1b"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028023; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,to_client; content:"|55 04 03|"; content:"|11|bloggershop.co.vu"; distance:1; within:19; nocase; reference:md5,fe56b5a28eac390aa8cfb1402360958b; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2018494; rev:2; metadata:attack_target Client_and_Server, created_at 2014_05_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Aviator Updates"; ja3_hash; content:"5149f53b5554a31116f9d86237552ee3"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028024; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert twitterbacklinks.com"; flow:established,from_server; content:"|55 04 03|"; content:"|18|www.twitterbacklinks.com"; distance:1; within:25; reference:md5,4cb5a748416b9f03d875245437344177; classtype:trojan-activity; sid:2018758; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_23, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Battle.net/Dropbox"; ja3_hash; content:"fa030dbcb2e3c7141d3c2803780ee8db"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028025; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre Serial Number in SSL Cert"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 f4 4b cc 89 9e b7 45 a8|"; within:35; fast_pattern; content:"|55 04 03|"; distance:0; content:"|09|localhost"; distance:1; within:10; reference:md5,55f8682aab1089b68a8a391b927d7a74; classtype:trojan-activity; sid:2018759; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_23, deployment Perimeter, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - bitgo/ShapeShift"; ja3_hash; content:"0ef9ca1c10d3f186f5786e1ef3461a46"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028026; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Malicious SSL Cert (KINS C2)"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|sslbl.abuse.ch"; distance:1; within:15; content:"|1b|we_love_selfsigned@abuse.ch"; distance:0; reference:md5,73705a4a8b03e5f866fac821aaec273a; classtype:domain-c2; sid:2018767; rev:2; metadata:attack_target Client_and_Server, created_at 2014_07_24, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - BlackBerry Browser (Tested BB10)"; ja3_hash; content:"add211c763889c665ae4ab675165cbc4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028027; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Likely Malicious SSL Cert With Script Tags"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:""; distance:0; content:"|55 04 03|"; reference:md5,73705a4a8b03e5f866fac821aaec273a; classtype:domain-c2; sid:2018768; rev:2; metadata:attack_target Client_and_Server, created_at 2014_07_24, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - BlackBerry Mail Client"; ja3_hash; content:"a921515f014005af03fc1e2c4c9e66ce"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028028; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert thelabelnashville.com"; flow:established,from_server; content:"|55 04 03|"; content:"|15|thelabelnashville.com"; distance:1; within:22; reference:md5,f75b9bffe33999339d189b1a3d8d8b4e; classtype:trojan-activity; sid:2018776; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_25, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Blackberry Messenger (Android) 2"; ja3_hash; content:"4692263d4130929ae222ef50816527ca"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028029; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert cactussports.com"; flow:established,from_server; content:"|55 04 03|"; content:"|10|cactussports.com"; distance:1; within:17; reference:md5,fe557165290ae68b768591eb746fa1c5; classtype:trojan-activity; sid:2018777; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_25, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Blackberry"; ja3_hash; content:"b5d42ca0e68a39d5c0a294134a21f020"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028030; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert yellowdevilgear.com"; flow:established,from_server; content:"|55 04 03|"; content:"|17|www.yellowdevilgear.com"; distance:1; within:24; reference:md5,2def687d8159d7859e86855b6c4a20c8; classtype:trojan-activity; sid:2018778; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_25, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Blackbery Messenger (Android)"; ja3_hash; content:"32b0ae286d1612c82cad93b4880ee512"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028031; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert michaelswinecellar.com"; flow:established,from_server; content:"|55 04 03|"; content:"|1a|www.michaelswinecellar.com"; distance:1; within:27; reference:md5,c9869431ad760912a553a63266173442; classtype:trojan-activity; sid:2018779; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_25, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - BlueCoat Proxy"; ja3_hash; content:"5182f54f9c6e99d117d9dde3fa2b4cff"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028032; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert migsparkle.com"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|migsparkle.com"; distance:1; within:15; reference:md5,bc74dd7e0350ad7ad8f75ca0de6fb9dc; classtype:trojan-activity; sid:2018780; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_25, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - BlueJeans,CEPHtmlEngine"; ja3_hash; content:"cdec81515ccc75a5aa41eb3db22226e6"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028033; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,from_server; content:"|2a 86 48 86 f7 0d 01 09 01|"; content:"|0d|fuck@abuse.ch"; distance:1; within:14; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2018745; rev:4; metadata:attack_target Client_and_Server, created_at 2014_07_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - BOT: Ahrefs, hola_svc"; ja3_hash; content:"5c1c89f930122bccc7a97d52f73bea2c"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028034; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert server.abaphome.net"; flow:established,from_server; content:"|55 04 03|"; content:"|13|server.abaphome.net"; distance:1; within:20; reference:md5,cfe7cade32e463f0ef7efd134c56b5c8; classtype:trojan-activity; sid:2018790; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_28, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - BOT: GoogleBot"; ja3_hash; content:"a1cb2295baf199acf82d11ba4553b4a8"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028035; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert 1stopmall.us"; flow:established,from_server; content:"|55 04 03|"; content:"|10|www.1stopmall.us"; distance:1; within:17; reference:md5,b833914b8171bc8f400b41449c3ef06b; classtype:trojan-activity; sid:2018791; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_28, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - BOT: Qwant"; ja3_hash; content:"706567223fbf37d112fba2d95b8ecac3"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028036; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET MALWARE Infostealer.KLPROXY Checkin via SMTP"; flow:to_server,established; content:"Subject|3a|"; content:"C-H-E-G-O A-V-I-S-O! |2e 3a 3a|Infect|3a 3a 2e|"; distance:5; within:33; reference:md5,422ce789b284eb5aa32124a6bbe86000; classtype:command-and-control; sid:2018798; rev:2; metadata:created_at 2014_07_29, former_category MALWARE, updated_at 2014_07_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - BrowserShots Script"; ja3_hash; content:"01aead19a1b1780978f732e056b183a6"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028037; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert host-galaxy.com"; flow:established,from_server; content:"|55 04 03|"; content:"|0f|host-galaxy.com"; distance:1; within:16; reference:md5,83c2eb9a2a5315e7fc15d85387886a19; classtype:trojan-activity; sid:2018802; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_29, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Browsershots"; ja3_hash; content:"a4dc1c39a68bffec1cc7767472ac85a8"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028038; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert fxbingpanel.fareexchange.co.uk"; flow:established,from_server; content:"|55 04 03|"; content:"|1e|fxbingpanel.fareexchange.co.uk"; distance:1; within:31; reference:md5,3c4e0c0e4dbe2bf0e4d3ca825b95209c; classtype:trojan-activity; sid:2018803; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_29, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - BurpSuite Free (1.6.01)"; ja3_hash; content:"93fbcdadc1bf98ff0e3c03e7f921edd1"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028039; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert 66h.66hosting.net"; flow:established,from_server; content:"|55 04 03|"; content:"|11|66h.66hosting.net"; distance:1; within:18; reference:md5,f9c0bc6e8c08acbe520df0ab6efcd962; classtype:trojan-activity; sid:2018804; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_29, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - BurpSuite Free (1.6.01)"; ja3_hash; content:"c3ca411515180e79c765dc2c3c8cea88"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028040; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert businesswebstudios.com"; flow:established,from_server; content:"|55 04 03|"; content:"|16|businesswebstudios.com"; distance:1; within:23; reference:md5,b8ca6c78deeb448421073a65f708c34e; classtype:trojan-activity; sid:2018805; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_29, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - BurpSuite Free (tested: 1.6.32 Kali)"; ja3_hash; content:"15617351d807aa3145547d0ad0c976cc"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028041; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert udderperfection.com"; flow:established,from_server; content:"|55 04 03|"; content:"|17|www.udderperfection.com"; distance:1; within:24; reference:md5,c8020934a53e888059e734b934043794; classtype:trojan-activity; sid:2018806; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_29, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - BurpSuite Free (tested: 1.6.32 Kali)"; ja3_hash; content:"34f8cac266d07bfc6bd3966e99b54d00"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028042; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert www.senorwooly.com"; flow:established,from_server; content:"|55 04 03|"; content:"|12|www.senorwooly.com"; distance:1; within:19; reference:md5,c860eee9ca6a7c570b3b4cd7b8e2cd17; classtype:trojan-activity; sid:2018849; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_30, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - BurpSuite Free (Tested: 1.7.03 on Windows 10), eclipse,JavaApplicationStub,idea"; ja3_hash; content:"8c5a50f1e833ed581e9cfc690814719a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028043; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert ns2.sicher.in"; flow:established,from_server; content:"|55 04 03|"; content:"|0d|ns2.sicher.in"; distance:1; within:14; reference:md5,c860eee9ca6a7c570b3b4cd7b8e2cd17; classtype:trojan-activity; sid:2018850; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_30, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Candy Crush (testing iOS 8.3)"; ja3_hash; content:"17a40616b856ec472714cd144471e0e0"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028044; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Malicious SSL Cert (KINS C2)"; flow:established,from_server; content:"|55 04 03|"; content:"|0d|badsokspad.in"; distance:1; within:14; reference:md5,c4fe829fc49bb9efec92fe4a8a5d29fc; classtype:domain-c2; sid:2018852; rev:2; metadata:attack_target Client_and_Server, created_at 2014_07_30, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Charles/java/eclipse"; ja3_hash; content:"424008725394c634a4616b8b1f2828a5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028045; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert chinasemservice.com"; flow:established,from_server; content:"|55 04 03|"; content:"|13|chinasemservice.com"; distance:1; within:20; reference:md5,c2ecc111018491cee3853e2c93472bb9; classtype:trojan-activity; sid:2018868; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_01, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Choqok 1.5 (KDE 4.14.18 Qt 4.8.6 on OpenSUSE 42.1)"; ja3_hash; content:"64bb259b446fe13f66bcd62d1f0d33df"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028046; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert ns7-777.777servers.com"; flow:established,from_server; content:"|55 04 03|"; content:"|16|ns7-777.777servers.com"; distance:1; within:23; reference:md5,b5b97b4da688aaa6ddbdb6a6e567ffba; classtype:trojan-activity; sid:2018870; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_01, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome (iOS)"; ja3_hash; content:"bec8267042d5885aa3acc07b4409cafc"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028047; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert adodis.com"; flow:established,from_server; content:"|55 04 03|"; content:"|0a|adodis.com"; distance:1; within:11; reference:md5,cca48e10973344ccc4e995be8e151176; classtype:trojan-activity; sid:2018871; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_01, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome (Possible 41.x)"; ja3_hash; content:"d54a0979516e607a1166e6efd157301c"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028048; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert power2.mschosting.com"; flow:established,from_server; content:"|55 04 03|"; content:"|15|power2.mschosting.com"; distance:1; within:22; reference:md5,fb89ab865465d9bf38e24af73cdcd656; classtype:trojan-activity; sid:2018881; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_02, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome (Tested: 47.0.2526.XX & 48.XX (64-bit)) #1"; ja3_hash; content:"ac67a2d0e3bd59459c32c996b5985979"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028049; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Windows Command Prompt OUTBOUND"; flow:established,to_server; content:"Microsoft Windows"; content:"[Version|20|"; distance:0; pcre:"/^\d\.\d\.\d{4}\]\r\n\(C\)\x20Copyright\x20\d{4}(\x2d\d{4})?\x20Microsoft Corp(:?\.|oration)/Ri"; content:"|0d 0a 0d 0a|C|3a 5c 3e|"; fast_pattern; distance:0; isdataat:!2,relative; classtype:trojan-activity; sid:2018885; rev:2; metadata:created_at 2014_08_04, updated_at 2014_08_04;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome (Tested: 47.0.2526.XX & 48.XX (64-bit)) #2"; ja3_hash; content:"34dfce2bb848da7c5dafa4d475f0ba41"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028050; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE BitcoinMiner C2 SSL Cert"; flow:established,from_server; content:"|55 04 03|"; content:"|19|www.webanalyticsystem.com"; distance:1; within:26; reference:url,www.malware-traffic-analysis.net/2014/07/28/index.html; classtype:coin-mining; sid:2018896; rev:2; metadata:attack_target Client_Endpoint, created_at 2014_08_05, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, tag Coinminer, updated_at 2016_07_01, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome (Tested: 47.0.2526.XX & 48.XX (64-bit)) #3"; ja3_hash; content:"937edefedb6fe13f26d1a425ef1c15a5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028051; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert tradeledstore.co.uk"; flow:established,from_server; content:"|55 04 03|"; content:"|15 2a 2e|tradeledstore.co.uk"; distance:1; within:22; reference:md5,5b447247c8778b91650e0a9c2e36b1e6; classtype:trojan-activity; sid:2018898; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_06, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome (Tested: 47.0.2526.XX & 48.XX (64-bit)) #4"; ja3_hash; content:"a342d14afad3a448029ec808295ccce9"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028052; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PRISM Backdoor"; content:"PRISM v"; pcre:"/^\d+?\.\d+?\sstarted/R"; classtype:trojan-activity; sid:2017314; rev:3; metadata:created_at 2013_08_12, updated_at 2013_08_12;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome (Tested: 47.0.2526.XX & 48.XX (64-bit)) #5"; ja3_hash; content:"71e74faaed87acd177bd3b47a543f476"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028053; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,to_client; content:"|55 04 03|"; content:"|12|alohafriends12.com"; distance:1; within:19; reference:md5,9c98ef776a651cc4269acde3755d3a5a; classtype:domain-c2; sid:2018935; rev:3; metadata:attack_target Client_and_Server, created_at 2014_08_12, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome (tested: Version 46.0.2490.86 (64-bit) - OS X)"; ja3_hash; content:"1d64ab25ad6f7258581d43077147b9b1"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028054; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (CryptoWall C2)"; flow:established,from_server; content:"|55 04 03|"; content:"|1f|kpai7ycr7jxqkilp.totortoweb.com"; distance:1; within:32; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2018939; rev:3; metadata:attack_target Client_and_Server, created_at 2014_08_14, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome (tested: Version 46.0.2490.86 (64-bit) - OS X)"; ja3_hash; content:"230018e44608686b64907360b6def678"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028055; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible ClickFraud Trojan Socks5 Connection"; flow:to_server,established; content:"socks5init|3a|"; depth:11; threshold: type limit,track by_src, count 1, seconds 300; flowbits:set,ET.2018855; reference:md5,2a0e042fdb2d85c2abf8bd35499ee1aa; reference:md5,c4d3db0eadc650372225d0093cd442ba; reference:md5,4c1f7c4f6d00869a6fca9fdcbadc9633; classtype:trojan-activity; sid:2018855; rev:2; metadata:created_at 2014_07_30, updated_at 2014_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome (tested: Version 46.0.2490.86 (64-bit) - OS X)"; ja3_hash; content:"dea05e8c68dfeb28003f21d22efc0aba"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028056; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ClickFraud Trojan Socks5 Init Response"; flow:established,from_server; flowbits:isset,ET.2018855; dsize:6<>9; content:"|fe|"; depth:1; content:"|1f|"; distance:4; within:1; reference:md5,de31e17ff4b3791c92a93b72d779e61f; classtype:trojan-activity; sid:2018941; rev:2; metadata:created_at 2014_08_14, updated_at 2014_08_14;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 10, Chrome 10.0.648.82 (Chromium Portable 9.0)"; ja3_hash; content:"62351d5ea3cd4f21f697965b10a9bbbe"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028057; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0f|koskoskos11.com"; distance:1; within:16; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2018942; rev:2; metadata:attack_target Client_and_Server, created_at 2014_08_18, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 11 - 18, Chrome 11.0.696.16 - 18.0.1025.33  Chrome 11.0.696.16 (Chromium Portable 9.2)"; ja3_hash; content:"a9da823fe77cd3df081644249edbf395"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028058; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Vawtrak MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|0d|atspotfto.com"; distance:1; within:14; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2018943; rev:2; metadata:attack_target Client_and_Server, created_at 2014_08_18, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 19 - 20, Chrome 19.0.1084.15 - 20.0.1132.57, Chrome 21.0.1180.89, Chrome 22.0.1229.96 - 23.0.1271.64 Safari/537.11"; ja3_hash; content:"df4a50323dfcaf1789f72e4946a7be44"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028059; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Vawtrak MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|10|www.securessl.in"; distance:1; within:17; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2018944; rev:2; metadata:attack_target Client_and_Server, created_at 2014_08_18, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 22.0.1201.0, Chrome/22.0.1229.96"; ja3_hash; content:"3c8cb61208e191af38b1fbef4eacd502"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028060; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,from_server; content:"|55 04 03|"; content:"|0a|zao-sky.ru"; distance:1; within:11; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2018947; rev:2; metadata:attack_target Client_and_Server, created_at 2014_08_18, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 24.0.1312.57 - 28.0.1500.72 Safari/537.36"; ja3_hash; content:"1ef061c02d85b7e2654e11a9959096f4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028061; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ZeroLocker EXE Download"; flow:established,from_server; flowbits:isset,ET.http.binary; file_data; content:"|5c 50 72 6f 6a 65 63 74 73 5c 5a 65 72 6f 4c 6f 63 6b 65 72 5c|"; reference:url,securelist.com/blog/incidents/66135/zerolocker-wont-come-to-your-rescue/; reference:url,webroot.com/blog/2014/08/14/zero-locker/; reference:url,symantec.com/security_response/writeup.jsp?docid=2014-081521-4509-9; classtype:trojan-activity; sid:2018963; rev:2; metadata:created_at 2014_08_19, former_category CURRENT_EVENTS, updated_at 2014_08_19;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 26.0.1410.43-27.0.1453.110 Safari/537.31"; ja3_hash; content:"89d37026246d4888e78e69af4f8d1147"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028062; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE PE downloaded malicious SSL certificate (CZ Solutions)"; flow:established,to_client; flowbits:isset,ET.http.binary; file_data; content:"|43 5a 20 53 6f 6c 75 74 69 6f 6e 20 43 6f 2e 2c 20 4c 74 64 2e|"; reference:url,www.fireeye.com/blog/technical/2014/07/the-little-signature-that-could-the-curious-case-of-cz-solution.html; classtype:domain-c2; sid:2018748; rev:3; metadata:attack_target Client_and_Server, created_at 2014_07_22, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 29.0.1547.0"; ja3_hash; content:"206ee819879457f7536d2614695a5029"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028063; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE LDPinch SMTP Password Report with mail client The Bat!"; flow:established,to_server; content:"X-Mailer|3a| The Bat!"; fast_pattern; content:"|0d 0a|Content-Disposition|3a| attachment|3b|"; content:!"|0d 0a|Subject|3a| Undeliverable|3a|"; reference:url,doc.emergingthreats.net/2008411; classtype:trojan-activity; sid:2008411; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 29.0.1547.62"; ja3_hash; content:"76d36fc79db002baa1b5e741fcd863bb"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028064; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Hoic.zip retrieval"; flow:from_server,established; file_data; content:"Hoic/buttons2/PK"; content:"Hoic/buttons2/buttons.rar"; distance:0; reference:url,blog.spiderlabs.com/2012/01/hoic-ddos-analysis-and-detection.html; classtype:trojan-activity; sid:2018976; rev:3; metadata:created_at 2014_08_21, updated_at 2014_08_21;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 29.0.1547.62"; ja3_hash; content:"bbc3992faa92affc0d835717ea557e99"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028065; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Machete FTP activity"; flow:established,to_server; content:"CWD |2e 2e 2f|KeyLog_History"; depth:21; classtype:trojan-activity; sid:2018980; rev:2; metadata:created_at 2014_08_22, updated_at 2014_08_22;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 30.0.0.0"; ja3_hash; content:"dc3eaee99a9221345698f8a8b2f4fc3f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028066; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET 1023: -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Backdoor.Win32.VB.Alsci/Dragon Eye RAT Checkin (sending user info)"; flow:to_server,established; content:"Auth"; nocase; depth:4; content:" @ "; within:128; content:"|5C 23 2F|"; within:128; content:"|5C 23 2F|"; within:32; content:"|5C 23 2F|"; fast_pattern; within:20; reference:md5,37207835e128516fe17af3dacc83a00c; reference:md5,e7d9bc670d69ad8a6ad2784255324eec; classtype:command-and-control; sid:2016913; rev:5; metadata:created_at 2011_05_17, former_category MALWARE, updated_at 2011_05_17;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 30.0.1599.101"; ja3_hash; content:"53c7ed581cbaf36951559878fcec4559"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028067; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Generic Info Stealer - HTTP POST"; flow:established,to_server; content:"POST"; nocase; http_method; content:"|0d 0a|Content-Type|3a| multipart/form-data|3b| boundary|3d|"; nocase; content:"name=\"id\"|0d 0a|"; nocase; content:"name=\"upt\"|0d 0a|"; nocase; content:"name=\"mode\"|0d 0a|"; nocase; content:"name=\"version\"|0d 0a|"; nocase; content:"name=\"cpu\"|0d 0a|"; nocase; fast_pattern; content:"name=\"ram\"|0d 0a|"; nocase; content:"name=\"os\"|0d 0a|"; nocase; content:"name=\"user\"|0d 0a|"; nocase; content:"name=\"user\"|0d 0a|"; nocase; reference:url,doc.emergingthreats.net/2009470; classtype:trojan-activity; sid:2009470; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 31.0.1650.57 & 32.0.1700.76 Safari/537.36"; ja3_hash; content:"fb8a6d2441ee9eaee8b560d48a8f59df"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028068; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $EXTERNAL_NET 1024: -> $HOME_NET 1023: (msg:"ET MALWARE Turkojan C&C nxt Command (nxt)"; flow:established,from_server; dsize:3; content:"nxt"; depth:3; reference:url,doc.emergingthreats.net/2008029; classtype:command-and-control; sid:2008029; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 31.0.1650.63"; ja3_hash; content:"f7c4dc1d9595c27369a183a5df9f7b52"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028069; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Windows systeminfo Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"Host Name|3a|"; content:"OS Name|3a|"; content:"OS Version|3a|"; content:"OS Manufacturer|3a|"; content:"Microsoft Corporation"; distance:0; content:"OS Configuration|3a|"; content:"OS Build Type|3a|"; content:"Registered Owner|3a|"; content:"Registered Organization|3a|"; content:"Product ID|3a|"; content:"Original Install Date|3a|"; content:"System Up Time|3a|"; content:"System Manufacturer|3a|"; content:"System Model|3a|"; content:"System type|3a|"; content:"Processor|28|s|29 3a|"; reference:md5,a22af4fc7fe011069704a15296634ca6; classtype:trojan-activity; sid:2019002; rev:1; metadata:created_at 2014_08_26, updated_at 2014_08_26;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 33.0.1750.117"; ja3_hash; content:"16d7ebc398d772ef9969d2ed2a15f4c0"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028070; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|00 b8 68 97 9e dc 1f a8 cc|"; distance:0; fast_pattern; content:"|55 04 03|"; distance:0; content:"|0c|local.domain"; distance:1; within:13; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019009; rev:2; metadata:attack_target Client_and_Server, created_at 2014_08_26, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 33.0.1750.117"; ja3_hash; content:"f3136cf565acf70dd2f98ca652f43780"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028071; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Vipdataend C&C Traffic - Status OK (variant 2)"; flowbits:isset,ET.vipdataend; flow:established,to_server; dsize:1; content:"1"; depth:1; reference:url,doc.emergingthreats.net/2009026; classtype:command-and-control; sid:2009026; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 33.0.1750.154"; ja3_hash; content:"af0ae1083ab10ac957e394c2e7ec4634"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028072; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE Dyreza RAT Checkin Response"; flow:established,to_client; content:"|a5 46 da 53 0a 00 68 00 65 00 6c 00 6c 00 6f|"; offset:4; depth:15; reference:md5,b61145a54698753cecf8748359c9d81e; reference:url,phishme.com/project-dyre-new-rat-slurps-bank-credentials-bypasses-ssl/; classtype:command-and-control; sid:2018596; rev:3; metadata:created_at 2014_06_12, former_category MALWARE, updated_at 2014_06_12;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 34.0.1847.116 & 35.0.1916.114 Safari/537.36"; ja3_hash; content:"4807d61f519249470ebed0b633e707cf"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028073; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Pakes/Cutwail/Kobcka Checkin Detected High Ports"; flow:established,to_server; content:"/?bot_id=0&mode=1"; http_uri; fast_pattern:only; reference:url,doc.emergingthreats.net/2008358; classtype:command-and-control; sid:2008358; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 34.0.1847.116 & 35.0.1916.114 Safari/537.36"; ja3_hash; content:"ef3364da4d76c98a669cb828f2e5283a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028074; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Srizbi requesting template"; flow:established,to_server; content:"GET|20|/"; depth:5; content:"|0d0a|X-Flags|3a20|"; within:200; content:"|0d0a|X-TM|3a20|"; within:20; content:"|0d0a|X-BI|3a20|"; within:20; reference:url,www.secureworks.com/research/threats/ronpaul/; reference:url,doc.emergingthreats.net/2007712; classtype:trojan-activity; sid:2007712; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 36.0.1985.125 & 37.0.2062.102 Safari/537.36"; ja3_hash; content:"5b348680dec77f585cfe82513213ac3a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028075; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Universal1337 FTP Upload of Compromised Data"; flow:established,to_server; content:"#############|0d 0a|"; content:"###########"; distance:0; content:" Universal1337 "; distance:0; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanUniversal1337; reference:url,www.megasecurity.org/trojans/u/universal1337/Universal1337v2.html; classtype:trojan-activity; sid:2007967; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 36.0.1985.125 - 40.0.2214.93 Safari/537.36"; ja3_hash; content:"52be6e88840d2211a243d9356550c4a5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028076; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Universal1337 Email Upload of Compromised Data"; flow:established,to_server; content:"#############|0d 0a|"; content:"###########"; distance:0; content:" Universal1337 "; distance:0; reference:url,doc.emergingthreats.net/bin/view/Main/TrojanUniversal1337; reference:url,www.megasecurity.org/trojans/u/universal1337/Universal1337v2.html; classtype:trojan-activity; sid:2007968; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 37.0.0.0 Safari & Mobile Safari/537.36"; ja3_hash; content:"5f775bbfc50459e900d464ca1cecd136"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028077; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Java Downloader likely malicious payload download src=xrun"; flow:established,to_server; content:"/get?src=xrun"; nocase; content:"Request|3a| "; nocase; http_header; reference:url,www.bluetack.co.uk/forums/lofiversion/index.php/t18462.html; reference:url,doc.emergingthreats.net/2010821; classtype:trojan-activity; sid:2010821; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 37.0.0.0"; ja3_hash; content:"a167568462b993d5787488ece82a439a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028078; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Steam Pass Stealer FTP Upload"; flow:established,to_server; dsize:33; content:"STEAM nicht eingespeichert!!!"; reference:url,doc.emergingthreats.net/2008332; classtype:trojan-activity; sid:2008332; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 37.0.2062.120"; ja3_hash; content:"98652faa7e0a4d85f91e37aa6b8c0135"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028079; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE VirtualProtect Packed Binary - Likely Hostile"; flow:established,from_server; content:"|2E 72 73 72 63|"; content:"|2E 70 61 63 6B 33 32 00|"; within:49; reference:url,bits.packetninjas.org/eblog/?p=3; reference:url,doc.emergingthreats.net/2008509; classtype:trojan-activity; sid:2008509; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 41.0.2272.89"; ja3_hash; content:"8b8322bad90e8bfbd66e664839b7a037"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028080; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Visual Shock Keylogger Reporting to Controller"; flow:established,to_server; dsize:<150; content:"|00 00|Visual Shock Keylogger "; offset:10; depth:34; flowbits:set,ET.vskeylogger; reference:url,research.sunbelt-software.com/threatdisplay.aspx?threatid=42573; reference:url,doc.emergingthreats.net/2008601; classtype:trojan-activity; sid:2008601; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 42.0.2311.135"; ja3_hash; content:"aa9074aa1ff31c65d01c35b9764762b6"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028081; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Visual Shock Keylogger Reporting Idle to Controller"; flowbits:isset,ET.vskeylogger; flow:established,to_server; dsize:8; content:"|08 00 00 00 00 00 00 00|"; reference:url,research.sunbelt-software.com/threatdisplay.aspx?threatid=42573; reference:url,doc.emergingthreats.net/2008602; classtype:trojan-activity; sid:2008602; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 42.0.2311.135"; ja3_hash; content:"de0963bc1f3a0f70096232b272774025"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028082; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Spy-Net Trojan Connection (2)"; flow:established; content:"conectado|7c 0a|"; depth:11; reference:url,doc.emergingthreats.net/2008645; classtype:trojan-activity; sid:2008645; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 43.0.2357.132 & 45.02454.94"; ja3_hash; content:"3bb36ec17fef5d3da04ceeb6287314c6"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028083; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Torpig Infection Reporting"; flow:established,to_server; content:"POST"; depth:4; http_method; content:!"User-Agent|3a| "; http_header; content:"Content-Length|3a| 0|0d 0a|"; http_header; content:"Connection|3a| close|0d 0a|"; http_header; pcre:"/^\/[0-9A-F]{16}\/[0-9A-Za-z\+\/]{100,}$/U"; reference:url,www2.gmer.net/mbr/; reference:url,www.cs.ucsb.edu/~seclab/projects/torpig/torpig.pdf; reference:url,doc.emergingthreats.net/2008660; reference:url,offensivecomputing.net/?q=node/909; classtype:trojan-activity; sid:2008660; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 48.0.2564.116"; ja3_hash; content:"cd3f72760dfd5575b91213a8016c596b"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028084; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Trash Family - HTTP POST"; flow:established,to_server; content:"POST"; depth:4; http_method; content:!"User-Agent|3a|"; http_header; nocase; content:"Type="; http_client_body; nocase; content:"&Dvip="; http_client_body; nocase; content:"&Mask="; http_client_body; nocase; content:"&Guid="; http_client_body; nocase; content:"&Addr="; http_client_body; nocase; content:"&Protect="; http_client_body; nocase; content:"Url"; http_client_body; nocase; content:"&OSVer="; http_client_body; nocase; reference:url,www.spywareguide.com/product_show.php?id=1935; reference:url,www.sunbeltsecurity.com/threatdisplay.aspx?name=Trojan.Trash.Gen&tid=178782&cs=03253E96A71C3EE824071E5BE3A32CCD; reference:url,doc.emergingthreats.net/2009449; classtype:trojan-activity; sid:2009449; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 48.0.2564.97"; ja3_hash; content:"5406c4a87aa6cbcb7fc469fee526a206"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028085; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET MALWARE VMProtect Demo version Packed Binary - Likely Hostile"; flow:from_server,established; content:"|2E|rsrc|00|"; content:"vmp0|00|"; within: 50; content:"vmp1|00|"; within:50; reference:url,www.vmprotect.ru; reference:url,www.packetninjas.net; reference:url,doc.emergingthreats.net/2009019; classtype:trojan-activity; sid:2009019; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 49.0.2623.75"; ja3_hash; content:"503fe06db7ef09b2cbd771c4e784c686"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028086; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET MALWARE Asprox-style Message ID"; flow:established,to_server; dsize:<80; content:"Message-ID|3a20|"; depth:12; content:"|0d0a|"; within: 68; flowbits:set,ET.asproxmessageid; flowbits:noalert; reference:url,www.secureworks.com/research/threats/danmecasprox; reference:url,doc.emergingthreats.net/2008221; classtype:trojan-activity; sid:2008221; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 50.0.2661.102 1"; ja3_hash; content:"bd4267e1672f9df843ada7c963490a0d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028087; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET MALWARE Asprox phishing email detected"; flow:established,to_server; content:"From|3a20|"; depth:6; content:"|0d0a|Bcc|3a20|"; within:150; flowbits:isset,ET.asproxmessageid; reference:url,www.secureworks.com/research/threats/danmecasprox; reference:url,doc.emergingthreats.net/2008222; classtype:trojan-activity; sid:2008222; rev:5; metadata:attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Phishing, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 50.0.2661.102 2"; ja3_hash; content:"caeb3b546fc7469776d51f1f54a792ca"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028088; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Delf Key Checkin (Clicker.Win32.Delf.afl)"; flow:established,to_server; content:".php?key=???????+????????????"; content:"+Dial-up+??????+?+??????????????"; reference:url,doc.emergingthreats.net/2008666; classtype:command-and-control; sid:2008666; rev:10; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 51.0.2704.106 (test)"; ja3_hash; content:"aa84deda2a937ad225ef94161887b0cb"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028089; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.Win32.Agent.fvt Checkin"; flow:established,to_server; content:"GET"; nocase; http_method; content:".php?"; nocase; http_uri; content:"lversion="; nocase; http_uri; content:"wversion=&eversion=&fid="; nocase; http_uri; content:"&mac="; nocase; http_uri; reference:url,doc.emergingthreats.net/2008667; classtype:command-and-control; sid:2008667; rev:7; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 51.0.2704.84 1"; ja3_hash; content:"473e8bad0e8e1572197be80faa1795c3"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028090; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 91 (msg:"ET MALWARE Backdoor.Win32.Assasin.20.C Control Session Start"; flow:established,to_server; content:"11000"; depth:5; content:"^"; distance:4; within:5; flowbits:isnotset,ET.assassin.start; flowbits:set,ET.assassin.start; reference:url,doc.emergingthreats.net/2008675; classtype:trojan-activity; sid:2008675; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 51.0.2704.84 2"; ja3_hash; content:"e0b0e6c934c686fd18a5727648b3ed4f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028091; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 91 -> $HOME_NET any (msg:"ET MALWARE Backdoor.Win32.Assasin.20.C Control Session Server Reply"; flowbits:isset,ET.assassin.start; flow:established,from_server; dsize:12; content:"10000002|5e 2a|"; depth:10; flowbits:set,ET.assassin.reply; reference:url,doc.emergingthreats.net/2008676; classtype:trojan-activity; sid:2008676; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 51.0.2704.84 3"; ja3_hash; content:"7ddfe8d6f8b51a90d10ab3fe2587c581"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028092; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 91 (msg:"ET MALWARE Backdoor.Win32.Assasin.20.C Control Channel Client Reply"; flow:established,to_server; dsize:10; content:"10000000|5e 2a|"; flowbits:isset,ET.assassin.reply; reference:url,doc.emergingthreats.net/2008677; classtype:trojan-activity; sid:2008677; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 51.0.2704.84 4"; ja3_hash; content:"bc76a4185cc9bd4c72471620e552618c"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028093; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert freeb4u.com"; flow:established,from_server; content:"|55 04 03|"; content:"|0b|freeb4u.com"; distance:1; within:12; reference:md5,3c140d775b33a5201089e8f8118b7fb5; classtype:trojan-activity; sid:2019025; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 51.0.2704.84 5"; ja3_hash; content:"8e3eea71cb5a932031d90cc0fba581bc"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028094; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert developmentinn.com"; flow:established,from_server; content:"|55 04 03|"; content:"|16|www.developmentinn.com"; distance:1; within:23; reference:md5,2f17d82e939efe315a89f1aa42e93cf1; classtype:trojan-activity; sid:2019026; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 51.0.2704.84 6"; ja3_hash; content:"653924bcb1d6fd09a048a4978574e2c5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028095; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert directory92.com"; flow:established,from_server; content:"|55 04 03|"; content:"|0f|directory92.com"; distance:1; within:16; reference:md5,dc7939920cb93e58c990a8e0a0295bb7; classtype:trojan-activity; sid:2019027; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome 51.0.2704.84 7"; ja3_hash; content:"1ef652ecfb8e60e771a4710166afc262"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028096; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert epr-co.ch"; flow:established,from_server; content:"|55 04 03|"; content:"|09|epr-co.ch"; distance:1; within:10; reference:md5,dc7939920cb93e58c990a8e0a0295bb7; classtype:trojan-activity; sid:2019028; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome Version 49.0.2623,87 (64-bit) Linux"; ja3_hash; content:"8a8159e6abf9fe493ca87efc38855149"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028097; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert pouyasazan.org"; flow:established,from_server; content:"|55 04 03|"; content:"|15|linux4.pouyasazan.org"; distance:1; within:22; reference:md5,b978929f93fe8e10d8f7f6f52953cbba; classtype:trojan-activity; sid:2019029; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome Version 49.0.2623,87 (64-bit) Linux"; ja3_hash; content:"a7f2d0376cdcfde3117bf6a8359b2ab8"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028098; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert ara-photos.net"; flow:established,from_server; content:"|55 04 03|"; content:"|12|www.ara-photos.net"; distance:1; within:19; reference:md5,b978929f93fe8e10d8f7f6f52953cbba; classtype:trojan-activity; sid:2019030; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome Version 57.0.2987.110 (64-bit) Linux"; ja3_hash; content:"d551fafc4f40f1dec2bb45980bfa9492"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028099; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert tecktalk.com"; flow:established,from_server; content:"|55 04 03|"; content:"|10|www.tecktalk.com"; distance:1; within:17; reference:md5,0181d134ff73743e8dd5e23b9cf7ff51; classtype:trojan-activity; sid:2019031; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome Version 57.0.2987.110 (64-bit) Linux"; ja3_hash; content:"e330bca99c8a5256ae126a55c4c725c5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028100; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert cyclivate.com"; flow:established,from_server; content:"|55 04 03|"; content:"|11|www.cyclivate.com"; distance:1; within:18; reference:md5,b911327d0ba6ce016e8e33ba97e87e83; classtype:trojan-activity; sid:2019032; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome Version 60/61.0.3163, Google Chrome"; ja3_hash; content:"94c485bca29d5392be53f2b8cf7f4304"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028101; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert mentoringgroup.com"; flow:established,from_server; content:"|55 04 03|"; content:"|16|www.mentoringgroup.com"; distance:1; within:23; reference:md5,444dd80b551ac28e43380c2ef0bc4df0; classtype:trojan-activity; sid:2019033; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome Version 60/61.0.3163, Google Chrome"; ja3_hash; content:"bc6c386f480ee97b9d9e52d472b772d8"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028102; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert ssshosting.net"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|ssshosting.net"; distance:1; within:15; reference:md5,8f13400f01f5ad3404bc6700279ac7aa; classtype:trojan-activity; sid:2019035; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome Version 61.0.3163,100(64-bit) Win10"; ja3_hash; content:"d3b972883dfbd24fd20fc200ad8ab22a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028103; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert erotikturk.com"; flow:established,from_server; content:"|55 04 03|"; content:"|15|server.erotikturk.com"; distance:1; within:22; reference:md5,8f13400f01f5ad3404bc6700279ac7aa; classtype:trojan-activity; sid:2019036; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome WebSockets (48.xxxx) - also TextSecure Desktop"; ja3_hash; content:"cafd1f84716def1a414c688943b99faf"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028104; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert mtnoutfitters.com"; flow:established,from_server; content:"|55 04 03|"; content:"|11|mtnoutfitters.com"; distance:1; within:18; reference:md5,ebca10e0a4eb99758f0fb3612fa970ba; classtype:trojan-activity; sid:2019037; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome WebSockets (48.xxxx)"; ja3_hash; content:"62d8823f52dd8e1ba75a9a83e8748313"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028105; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert jojik-international.com"; flow:established,from_server; content:"|55 04 03|"; content:"|17|jojik-international.com"; distance:1; within:24; reference:md5,ffa19cd3be6a89da96bcfb5a1a52b6ae; classtype:trojan-activity; sid:2019038; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome/30.0.1599.101"; ja3_hash; content:"c405bbbe31c0e53ac4c8448355b2af5b"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028106; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert abarsolutions.com"; flow:established,from_server; content:"|55 04 03|"; content:"|11|abarsolutions.com"; distance:1; within:18; reference:md5,029e3713002bd3514b1f2493caea8294; classtype:trojan-activity; sid:2019039; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome/41.0.2272.89"; ja3_hash; content:"2c3221f495d5e4debbb34935e1717703"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028107; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert eastwoodvalley.com"; flow:established,from_server; content:"|55 04 03|"; content:"|16|www.eastwoodvalley.com"; distance:1; within:23; reference:md5,450b394d88a69f6cb9722a5b56168ce6; classtype:trojan-activity; sid:2019040; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome/49.0.2623.112 WinXP"; ja3_hash; content:"248bdbc3873396b05198a7e001fbd49a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028108; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert pejlain.se"; flow:established,from_server; content:"|55 04 03|"; content:"|0a|pejlain.se"; distance:1; within:11; reference:md5,1658e12bb1fe8a25127e8bd09b923acd; classtype:trojan-activity; sid:2019042; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome/56.0.2924.87 Linux/Charles/Google Play Music Desktop Player/Postman/Slack/other desktop programs"; ja3_hash; content:"83e04bc58d402f9633983cbf22724b02"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028109; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert dominionthe.com"; flow:established,from_server; content:"|55 04 03|"; content:"|0f|dominionthe.com"; distance:1; within:16; reference:md5,911bc6e1c581e9295d193bcdbcce1ddd; classtype:trojan-activity; sid:2019043; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome/59.0.3071.115 Win10, node.js"; ja3_hash; content:"9811c1bb9f0f6835d5c13a831cca4173"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028110; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert delanecanada.ca"; flow:established,from_server; content:"|55 04 03|"; content:"|0f|delanecanada.ca"; distance:1; within:16; reference:md5,911bc6e1c581e9295d193bcdbcce1ddd; classtype:trojan-activity; sid:2019044; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chrome/60.0.3112.113 Win10, Chromium"; ja3_hash; content:"def8761e4bcaaf91d99801a22ac6f6d4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028111; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert hebergement-solutions.com"; flow:established,from_server; content:"|55 04 03|"; content:"|19|hebergement-solutions.com"; distance:1; within:26; reference:md5,e5f8caba2b2832de5c13a16d5b4f6d6f; classtype:trojan-activity; sid:2019045; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chromium"; ja3_hash; content:"be9f1360cf52dc1f61ae025252f192a3"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028112; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert sportofteniq.com"; flow:established,from_server; content:"|55 04 03|"; content:"|10|sportofteniq.com"; distance:1; within:17; reference:md5,d06ec89944b566df8dcd959a2196b37c; classtype:trojan-activity; sid:2019046; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Chromium"; ja3_hash; content:"fc5cb0985a5f5e295163cc8ffff8a6e1"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028113; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert adoraacc.com"; flow:established,from_server; content:"|55 04 03|"; content:"|0c|adoraacc.com"; distance:1; within:13; reference:md5,a938c50d686663f97d62dff812fc575b; classtype:trojan-activity; sid:2019047; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Cisco AnyConnect Secure Mobility Client (3.1.09013)"; ja3_hash; content:"7f340e6caa1fa4c979df919227160ff6"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028114; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert tristacey.com"; flow:established,from_server; content:"|55 04 03|"; content:"|0d|tristacey.com"; distance:1; within:14; reference:md5,e40ec448fd7cfea641a18fb6b38e4e92; classtype:trojan-activity; sid:2019048; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Cisco AnyConnect Secure Mobility Client"; ja3_hash; content:"e7d46c98b078477c4324031e0d3b22f5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028115; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert nbc-mail.com"; flow:established,from_server; content:"|55 04 03|"; content:"|0c|nbc-mail.com"; distance:1; within:13; reference:md5,348b8a9e693a6784a6cf26d9afe6fed9; classtype:trojan-activity; sid:2019049; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Cisco AnyConnect Secure Mobility Client"; ja3_hash; content:"ed36017db541879619c399c95e22067d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028116; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert tridayacipta.com"; flow:established,from_server; content:"|55 04 03|"; content:"|10|tridayacipta.com"; distance:1; within:17; reference:md5,010e6b78b6ec2fd6970b0c709e70acec; classtype:trojan-activity; sid:2019050; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Citrix Receiver 4.4.0.8014"; ja3_hash; content:"203157ed9f587f0cfd265061bf309823"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028117; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert trainthetrainerinternational.com"; flow:established,from_server; content:"|55 04 03|"; content:"|20|trainthetrainerinternational.com"; distance:1; within:33; reference:md5,010e6b78b6ec2fd6970b0c709e70acec; classtype:trojan-activity; sid:2019051; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Citrix Viewer"; ja3_hash; content:"5ee1a653fb824db7182714897fd3b5df"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028118; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert lingayasuniversity.edu.in"; flow:established,from_server; content:"|55 04 03|"; content:"|1d|www.lingayasuniversity.edu.in"; distance:1; within:30; reference:md5,b2c3bb2b56876e325d86731a693fd138; classtype:trojan-activity; sid:2019052; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Covenant Eyes"; ja3_hash; content:"a9d17f74e55dd53fcf7c234f8a240919"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028119; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert uleideargan.com"; flow:established,from_server; content:"|55 04 03|"; content:"|13|www.uleideargan.com"; distance:1; within:20; reference:md5,ba402e41e140af41d57788e24c4c56d4; classtype:trojan-activity; sid:2019053; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - CRAWLER: facebookexternalhit/1.1"; ja3_hash; content:"111da7c75fee7fe934b35a8d88eb350a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028120; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert picklingtank.com"; flow:established,from_server; content:"|55 04 03|"; content:"|10|picklingtank.com"; distance:1; within:17; reference:md5,ba402e41e140af41d57788e24c4c56d4; classtype:trojan-activity; sid:2019054; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Creative Cloud"; ja3_hash; content:"c882d9444412c00e71b643f3f54145ff"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028121; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert vcomdesign.com"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|vcomdesign.com"; distance:1; within:15; reference:md5,9ad86fc9a57b620e96082cd61aa1b494; classtype:trojan-activity; sid:2019055; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - cscan"; ja3_hash; content:"bc0608d33dc64506b42f7f5f87958f37"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028122; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert technosysuk.com"; flow:established,from_server; content:"|55 04 03|"; content:"|0f|technosysuk.com"; distance:1; within:16; reference:md5,fc23d6cbe926a022cac003214679ec7a; classtype:trojan-activity; sid:2019056; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - curl (tested: 7.22.0 on Linux)"; ja3_hash; content:"764b8952983230b0ac23dbd3741d2bb0"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028123; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert slmp-550-105.slc.westdc.net"; flow:established,from_server; content:"|55 04 03|"; content:"|1b|slmp-550-105.slc.westdc.net"; distance:1; within:28; reference:md5,f053b1aa875751944bae74fce67fe965; classtype:trojan-activity; sid:2019057; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - curl (tested: 7.43.0 OS X)"; ja3_hash; content:"9f198208a855994e1b8ec82c892b7d37"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028124; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert itiltrainingcertworkshop.com"; flow:established,from_server; content:"|55 04 03|"; content:"|23|server.itiltrainingcertworkshop.com"; distance:1; within:36; reference:md5,f7b715ad4235599ed21179a369279225; classtype:trojan-activity; sid:2019058; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - curl 7.35.0 (tested Ubuntu 14.x  openssl 1.0.1f)"; ja3_hash; content:"c458ae71119005c8bc26d38a215af68f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028125; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert udderperfection.com"; flow:established,from_server; content:"|55 04 03|"; content:"|13|udderperfection.com"; distance:1; within:20; reference:md5,27938e57f7928e9559e71d384a8fffe6; classtype:trojan-activity; sid:2019059; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - curl 7.37.0 / links 2.8 / git 2.6.6 (openSUSE Leap 42.1)"; ja3_hash; content:"e14d427fab707af91e4bbd0bf03076f8"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028126; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert efind.co.il"; flow:established,from_server; content:"|55 04 03|"; content:"|0b|efind.co.il"; distance:1; within:12; reference:md5,6d8a5b36f61e392aaa048b97b3d9e090; classtype:trojan-activity; sid:2019060; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - curl"; ja3_hash; content:"f672d8f0e827ca1e704a9489b14dd316"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028127; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert bloodsoft.com"; flow:established,from_server; content:"|55 04 03|"; content:"|0d|bloodsoft.com"; distance:1; within:14; reference:md5,1b1626f65c4bac3af1220898f971f3ac; classtype:trojan-activity; sid:2019061; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.16.2.3 Basic ECC zlib/1.2.3 libidn/1.18 libssh2/1.4.2"; ja3_hash; content:"e3891da2a758d67ba921e5eec0b9707d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028128; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert walletmix.com"; flow:established,from_server; content:"|55 04 03|"; content:"|11|www.walletmix.com"; distance:1; within:18; reference:md5,1b1626f65c4bac3af1220898f971f3ac; classtype:trojan-activity; sid:2019062; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Customised Postfix - Damnit Matt"; ja3_hash; content:"f865de0807a17e9cb797e618162356db"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028129; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert turnaliinsaat.com"; flow:established,from_server; content:"|55 04 03|"; content:"|11|turnaliinsaat.com"; distance:1; within:18; reference:md5,feb5304d966a0f1610e642984a64d54c; classtype:trojan-activity; sid:2019063; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Dashlane"; ja3_hash; content:"0217dc3bd88c696cc15374db0d848de4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028130; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert mdus-pp-wb12.webhostbox.net"; flow:established,from_server; content:"|55 04 03|"; content:"|1b|mdus-pp-wb12.webhostbox.net"; distance:1; within:28; reference:md5,309efe8603c6db1218e8a95b6f4d2840; classtype:trojan-activity; sid:2019064; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Debian APT-CURL/1.0 (1.2.15)"; ja3_hash; content:"f7baf7d9da27449e823a4003e14cd623"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028131; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert plastics-technology.com"; flow:established,from_server; content:"|55 04 03|"; content:"|1b|www.plastics-technology.com"; distance:1; within:28; reference:md5,309efe8603c6db1218e8a95b6f4d2840; classtype:trojan-activity; sid:2019065; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Debian APT-CURL/1.0 (1.2.20+)"; ja3_hash; content:"ec2e8760003621ca668b5f03e616cd57"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028132; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert deserve.org.uk"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|deserve.org.uk"; distance:1; within:15; reference:md5,9d16352f292d86f40236afc7e06bce08; classtype:trojan-activity; sid:2019067; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Deezer"; ja3_hash; content:"4fcd1770545298cc119865aeba81daba"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028133; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert worldbuy.biz"; flow:established,from_server; content:"|55 04 03|"; content:"|10|www.worldbuy.biz"; distance:1; within:17; reference:md5,57c73f511f3ed23df07e2c1b88e007ca; classtype:trojan-activity; sid:2019068; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Dropbox (installer?)"; ja3_hash; content:"ede63467191e9a12300e252c41ca9004"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028134; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert paydaypedro.co.uk"; flow:established,from_server; content:"|55 04 03|"; content:"|11|paydaypedro.co.uk"; distance:1; within:18; reference:md5,39877be17bd3435f275fc54577beaa6e; classtype:trojan-activity; sid:2019075; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - DropBox (tested: 3.12.5 - Ubuntu 14.04TS & Win 10)"; ja3_hash; content:"653d342bee5001569662198a672746af"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028135; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert chatso.com"; flow:established,from_server; content:"|55 04 03|"; content:"|0a|chatso.com"; distance:1; within:11; reference:md5,ef88df67a0bcb872143543ebad0ba91d; classtype:trojan-activity; sid:2019076; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Dropbox (Win 8.1)"; ja3_hash; content:"482a11a20da1629b77aaadf640478d13"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028136; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Sinowal/Torpig Checkin"; flow:to_server,established; content:"GET"; http_method; content:"idcomp="; http_uri; content:"MyValue="; http_uri; content:"&load1="; http_uri; content:"&hist=downloaded_user_"; http_uri; pcre:"/MyValue=[a-f0-9]{32}/Ui"; reference:url,doc.emergingthreats.net/2010267; classtype:command-and-control; sid:2010267; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Dropbox Client"; ja3_hash; content:"21ed4c7ee1daeb84c72199ceaf119b24"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028137; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32.SillyFDC Checkin"; flow:established,to_server; content:"GET"; http_method; content:".php"; nocase; http_uri; content:"getowner=1&uniqueid="; http_uri; content:"User-Agent|3a| WinHttp.WinHttpRequest"; http_header; reference:url,doc.emergingthreats.net/2010268; classtype:command-and-control; sid:2010268; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Dropbox Client"; ja3_hash; content:"30b168d81e38d9a55c474c1e30eaf9f9"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028138; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Pragma hack Detected Outbound - Likely Infected Source"; flow:established,to_client; content:"Pragma|3a| hack/"; nocase; http_header; classtype:trojan-activity; sid:2010872; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Dropbox Client"; ja3_hash; content:"f8e42933ba5b3990858ba621489047e3"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028139; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|00 fc 61 00 6b e6 e5 a0 17|"; distance:0; fast_pattern; content:"|55 04 06|"; distance:0; content:"|02|XX"; distance:1; within:3; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019079; rev:2; metadata:attack_target Client_and_Server, created_at 2014_08_28, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Dropbox Setup (tested: 3.10.11 on Win 8.x)"; ja3_hash; content:"2f8363419a9fb80ad46b380778d8eaf1"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028140; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET MALWARE Avzhan DDOS Bot Inbound Hardcoded Malformed GET Request Denial Of Service Attack Detected"; flow:established,to_server; content:"GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm"; depth:49; nocase; threshold:type limit, count 1, seconds 60, track by_src; reference:url,asert.arbornetworks.com/2010/09/another-family-of-ddos-bots-avzhan/; classtype:attempted-dos; sid:2011767; rev:4; metadata:created_at 2010_09_29, updated_at 2010_09_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Dropbox Splash Pages (Win 10)"; ja3_hash; content:"c1e8322501b4d56d484b50bd7273e798"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028141; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.Spy.YEK MAC and IP POST"; flow:established,to_server; content:"POST"; nocase; http_method; content:"Content-Disposition|3A| form-data|3B| name=|22|MAC|22|"; http_header; nocase; content:"Content-Disposition|3A| form-data|3B| name=|22|IP|22|"; nocase; http_header; reference:url,www.shadowserver.org/wiki/pmwiki.php/Calendar/20101115; classtype:trojan-activity; sid:2011999; rev:7; metadata:created_at 2010_12_07, updated_at 2010_12_07;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Dropbox Windows"; ja3_hash; content:"6c141f98cd79d8b505123e555c1c3119"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028142; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Windows arp -a Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"Interface|3a|"; content:"--- 0x"; distance:0; content:"Internet Address"; content:"Physical Address"; fast_pattern; distance:0; content:"Type"; content:"dynamic"; reference:md5,a22af4fc7fe011069704a15296634ca6; classtype:trojan-activity; sid:2019080; rev:1; metadata:created_at 2014_08_28, updated_at 2014_08_28;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Dropbox"; ja3_hash; content:"054c9f9d304b7a2add3d6fa75bc20ae4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028143; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Windows set Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"ALLUSERSPROFILE="; fast_pattern; content:"APPDATA="; distance:0; content:"CLIENTNAME="; content:"CommonProgramFiles="; distance:0; content:"COMPUTERNAME="; content:"ComSpec="; reference:md5,a22af4fc7fe011069704a15296634ca6; classtype:trojan-activity; sid:2019081; rev:1; metadata:created_at 2014_08_28, updated_at 2014_08_28;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Dropbox"; ja3_hash; content:"36bc8c7e10647bbfea3f740e7f05c0f1"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028144; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Syrian Malware Checkin"; flow:established,to_server; content:"|2f|j|7c|n|5c|"; offset:2; depth:5; content:"[endof]"; fast_pattern; distance:0; reference:url,fireeye.com/blog/technical/2014/08/connecting-the-dots-syrian-malware-team-uses-blackworm-for-attacks.html; reference:md5,a8cf815c3800202d448d035300985dc7; classtype:command-and-control; sid:2019084; rev:1; metadata:created_at 2014_08_29, former_category MALWARE, updated_at 2014_08_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Dynalist/Postman/Google Chrome/Franz/GOG Galaxy"; ja3_hash; content:"4c40bf8baa7c301c5dba8a20bc4119e2"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028145; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert dineshuthayakumar.in"; flow:established,from_server; content:"|55 04 03|"; content:"|14|dineshuthayakumar.in"; distance:1; within:21; reference:md5,0c96fd25ec4139063ac7d83511835d20; classtype:trojan-activity; sid:2019034; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_27, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - eclipse"; ja3_hash; content:"0411bbb5ff27ad46e1874a7a8beedacb"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028146; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Tor based locker Ransom Page"; flow:established,to_server; content:"/buy.php?"; http_uri; content:"iet7v4dciocgxhdv."; nocase; fast_pattern; http_header; classtype:trojan-activity; sid:2018873; rev:3; metadata:created_at 2014_08_01, updated_at 2014_08_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - eclipse"; ja3_hash; content:"4990c9da08f44a01ecd7ddc3837caf25"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028147; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls 66.147.244.132 any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert bluehost.com Aug 27 2014"; flow:established,from_server; content:"|55 04 03|"; content:"|0e 2a 2e|bluehost.com"; distance:1; within:15; reference:md5,19bb8e0b16c14194862d0750916ce338; classtype:trojan-activity; sid:2019105; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_09_03, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - eclipse"; ja3_hash; content:"fa106fe5beec443af7e211ef8902e7e0"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028148; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ed 7a 4e 2c 6d 48 5c a6|"; distance:0; fast_pattern; content:"|55 04 06|"; distance:0; content:"|02|XX"; distance:1; within:3; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019106; rev:2; metadata:attack_target Client_and_Server, created_at 2014_09_03, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - eclipse/java"; ja3_hash; content:"d74778f454e2b047e030b291b94dd698"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028149; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 f9 c6 af 2f 81 7b a2 2b|"; distance:0; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|My Company Ltd"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019107; rev:2; metadata:attack_target Client_and_Server, created_at 2014_09_03, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Facebook iOS"; ja3_hash; content:"576a1288426703ae0008c42f95499690"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028150; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE W32/Sogu Remote Access Trojan Social Media Embedded CnC Channel"; flow:established,to_client; content:"DZKS"; content:"DZJS"; within:50; reference:url,blogs.norman.com/2012/security-research/trojan-moves-its-configuration-to-twitter-linkedin-msdn-and-baidu; classtype:command-and-control; sid:2014618; rev:3; metadata:created_at 2012_04_20, former_category MALWARE, updated_at 2012_04_20;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Feedly/1.0, java,eclipse,Cyberduck"; ja3_hash; content:"f22bdd57e3a52de86cda40da2d84e83b"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028151; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Frosparf.B Downloading Hosts File"; flow:established,from_server; file_data; content:"9.9.9.9 "; within:8; pcre:"/^(?:[a-zA-Z0-9\x2d\x5f]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n]*?9\.9\.9\.9\s+?(?:[a-zA-Z0-9\_\-]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n]/R"; reference:md5,4ad55877464aa92e49231d913d00eb69; classtype:trojan-activity; sid:2019142; rev:2; metadata:created_at 2014_09_09, updated_at 2014_09_09;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - fetchmail 6.3.26 (openSUSE Leap 42.1)"; ja3_hash; content:"a698fe6c52d210e3376bb6667729d4d2"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028152; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 c2 33 9e 92 b0 3e 35 b8|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019147; rev:2; metadata:attack_target Client_and_Server, created_at 2014_09_10, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - FieldServiceApp/socialstudio"; ja3_hash; content:"1fbe5382f9d8430fe921df747c46d95f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028153; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ea c4 eb c7 a8 ae c0 8c|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019148; rev:2; metadata:attack_target Client_and_Server, created_at 2014_09_10, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox 24.0 Iceweasel24.3.0"; ja3_hash; content:"3d99dda4f6992b35fdb16d7ce1b6ccba"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028154; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,from_server; content:"|2a 86 48 86 f7 0d 01 09 01|"; content:"|19|groundbellsinc2@yahoo.com"; distance:1; within:26; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019149; rev:2; metadata:attack_target Client_and_Server, created_at 2014_09_10, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox 25.0"; ja3_hash; content:"c57914fadb301a73e712378023b4b177"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028155; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 f9 10 d6 2f a9 1d 55 7b|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019150; rev:2; metadata:attack_target Client_and_Server, created_at 2014_09_10, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox 26.0, Firefox/26.0"; ja3_hash; content:"755cdaa3496eb8728247a639dee17aad"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028156; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 96 2c 97 86 ef 94 08 62|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|MyCompany Ltd"; distance:1; within:14; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019151; rev:2; metadata:attack_target Client_and_Server, created_at 2014_09_10, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox 27.0"; ja3_hash; content:"ff9223b5c9a5d44a8a423833751fa158"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028157; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 c2 33 9e 92 b0 3e 35 b8|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019152; rev:2; metadata:attack_target Client_and_Server, created_at 2014_09_10, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox 3.0.19"; ja3_hash; content:"df9bedd5713fe0cc2e9184d7c16a5913"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028158; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|02 69 ac|"; within:30; fast_pattern; content:"|55 04 03|"; distance:0; content:"|0f|serveradmin.com"; distance:1; within:16; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019153; rev:2; metadata:attack_target Client_and_Server, created_at 2014_09_10, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox 3.5 - 3.6, Firefox 3.5.19  3.6.27  SeaMonkey 2.0.14"; ja3_hash; content:"4a9bd55341e1ffe6fedb06ad4d3010a0"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028159; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TSPY_POCARDL.U Possible FTP Login"; flow:established,to_server; content:"USER user drupalzf"; reference:md5,ceb5b99c13b107cf07331bcbddb43b1f; reference:url,trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-pos-ram-scraper-malware.pdf; classtype:trojan-activity; sid:2019159; rev:2; metadata:created_at 2014_09_11, updated_at 2014_09_11;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - FireFox 40.0.3 (tested Windows 8), Firefox/37.0"; ja3_hash; content:"2872afed8370401ec6fe92acb53e5301"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028160; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,from_server; content:"|55 04 03|"; content:"|11|googleforking.com"; distance:1; within:18; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2018912; rev:3; metadata:attack_target Client_and_Server, created_at 2014_08_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox 46.0"; ja3_hash; content:"46129449560e5731dc9c5106f111a3db"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028161; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert webhostingpad.com"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|10 00 89 36 39 2c a7 4f ef 26 13 4f 11 2e d4 22 64|"; fast_pattern:only; content:"|55 04 03|"; content:"|13|*.webhostingpad.com"; distance:1; within:20; reference:md5,be7a7252865b3407498170f142efe471; classtype:trojan-activity; sid:2018594; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_06_23, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox 46.0"; ja3_hash; content:"d06b3234356cb3df0983fc8dd02ece68"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028162; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible JKDDOS download 500.exe"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/500.exe"; nocase; http_uri; reference:url,asert.arbornetworks.com/2011/03/jkddos-ddos-bot-with-an-interest-in-the-mining-industry; classtype:trojan-activity; sid:2012456; rev:3; metadata:created_at 2011_03_10, updated_at 2011_03_10;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox 47.0 2"; ja3_hash; content:"05ece02fb23acf2efbfff54ce4099a45"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028163; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible JKDDOS download desyms.exe"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/desyms.exe"; nocase; http_uri; reference:url,asert.arbornetworks.com/2011/03/jkddos-ddos-bot-with-an-interest-in-the-mining-industry; classtype:trojan-activity; sid:2012458; rev:3; metadata:created_at 2011_03_10, updated_at 2011_03_10;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox 47.x 1 / FireFox 47.x (Windows 7SP1)"; ja3_hash; content:"aa907c2c4720b6f54cd8b67a14cef0a3"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028164; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible JKDDOS download 1691.exe"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/1691.exe"; nocase; http_uri; reference:url,asert.arbornetworks.com/2011/03/jkddos-ddos-bot-with-an-interest-in-the-mining-industry; classtype:trojan-activity; sid:2012459; rev:3; metadata:created_at 2011_03_10, updated_at 2011_03_10;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - FireFox 49 (dev edition)"; ja3_hash; content:"f586111542f330901d9a3885a9c821b5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028165; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp any any -> $HOME_NET any (msg:"ET MALWARE Backdoor.Perl.Shellbot.cd IRC Bot that have DoS/DDoS functions"; flow:from_server,established; flowbits:isset,is_proto_irc; content:"PRIVMSG|20|"; pcre:"/^PRIVMSG.*@(portscan|back|(tcp|udp|http)flood|tsunami|(de)?voice|reset|die|say|join|part|(de)?op)/mi"; reference:url,theprojectxblog.net/another-perl-irc-bot-that-have-dosddos-functions/; classtype:trojan-activity; sid:2025065; rev:3; metadata:created_at 2012_05_22, former_category TROJAN, updated_at 2017_11_28;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - FireFox 49 (TLSv1.3 enabled - I think websockets)"; ja3_hash; content:"1996e434b11323df4e87f8fe0e702209"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028166; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET MALWARE DHL Spam Inbound"; flow:established,to_server; content:"name=|22|DHL"; nocase; content:".zip|22|"; within:68; nocase; pcre:"/name=\x22DHL(\s|_|\-)?[a-z0-9\-_\.\s]{0,63}\.zip\x22/i"; reference:url,doc.emergingthreats.net/2010148; classtype:trojan-activity; sid:2010148; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - FireFox 49 (TLSv1.3 enabled)"; ja3_hash; content:"8ed0a2cdcad81fc29313910eb94941d8"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028167; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Tinba Server Response"; flow:established,to_client; flowbits:isset,ET.Tinba.Checkin; file_data; content:"|64 b4 dc a4|"; within:4; reference:md5,1e644fe146f62bd2fc585b8df6712ff6; classtype:trojan-activity; sid:2019169; rev:4; metadata:created_at 2014_09_12, updated_at 2014_09_12;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox 49.0a2 Developer TLS 1.3 enabled"; ja3_hash; content:"8b18c5b0c54cba1ffb2438fe24792b63"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028168; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely TDSS Download (pcdef.exe)"; flow:established,to_server; content:"GET"; http_method; content:"/pcdef.exe"; http_uri; nocase; classtype:trojan-activity; sid:2010055; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox 63.0"; ja3_hash; content:"b20b44b18b853ef29ab773e921b03422"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028169; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Client Visiting Possibly Compromised Site (HaCKeD By BeLa & BodyguarD)"; flow:established,from_server; content:"HaCKeD By BeLa & BodyguarD"; content:".js"; reference:url,www.incidents.org/diary.html?storyid=4405; classtype:web-application-attack; sid:2008206; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - firefox"; ja3_hash; content:"0a81538cf247c104edb677bdb8902ed5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028170; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert udp $HOME_NET any -> $DNS_SERVERS 53 (msg:"ET MALWARE Infected System Looking up chr.santa-inbox.com CnC Server"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|03|chr|0b|santa-inbox|03|com"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2008531; classtype:command-and-control; sid:2008531; rev:4; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - firefox"; ja3_hash; content:"0b6592fd91d4843c823b75e49b43838d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028171; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Executable Download named to be .com FQDN"; flow:established,to_server; content:"GET"; nocase; http_method; content:".com.exe"; http_uri; nocase; reference:url,malwareurl.com; classtype:trojan-activity; sid:2011495; rev:3; metadata:created_at 2010_09_28, updated_at 2010_09_28;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - firefox"; ja3_hash; content:"1c15aca4a38bad90f9c40678f6aface9"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028172; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Executable Download named to be FQDN"; flow:established,to_server; content:"GET"; nocase; http_method; content:".exe"; http_uri; nocase; fast_pattern; content:"."; depth:200; content:".exe"; nocase; distance:2; within:6; pcre:"/\/.+(www\.)?[a-z0-9]+\.[a-z]{2,3}\.exe$/Ui"; reference:url,malwareurl.com; classtype:trojan-activity; sid:2011496; rev:3; metadata:created_at 2010_09_28, updated_at 2010_09_28;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - firefox"; ja3_hash; content:"5163bc7c08f57077bc652ec370459c2f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028173; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE FAKEAV landing page - sector.hdd.png no-repeat"; flow:established,to_client; content:"sector.hdd.png) no-repeat"; classtype:bad-unknown; sid:2011419; rev:3; metadata:created_at 2010_09_28, updated_at 2010_09_28;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - firefox"; ja3_hash; content:"a88f1426c4603f2a8cd8bb41e875cb75"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028174; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FAKEAV client requesting image - sector.hdd.png"; flow:established,to_server; content:"sector.hdd.png"; nocase; http_uri; classtype:bad-unknown; sid:2011420; rev:4; metadata:created_at 2010_09_28, updated_at 2010_09_28;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - firefox"; ja3_hash; content:"b03910cc6de801d2fcfa0c3b9f397df4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028175; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE FAKEAV scanner page enocuntered - .hdd_icon"; flow:established,to_client; content:".hdd_icon"; nocase; classtype:bad-unknown; sid:2011475; rev:4; metadata:created_at 2010_09_29, updated_at 2010_09_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - firefox"; ja3_hash; content:"bfcc1a3891601edb4f137ab7ab25b840"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028176; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious executable download adobe-flash.v"; flow:established,to_server; content:"GET"; nocase; http_method; content:"/adobe-flash.v"; nocase; http_uri; pcre:"/adobe-flash\.v\.\d{5}\.exe/Ui"; reference:url,www.malwareurl.com/listing.php?domain=realmultimediaonline.com; classtype:bad-unknown; sid:2011989; rev:2; metadata:created_at 2010_12_01, updated_at 2010_12_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - firefox"; ja3_hash; content:"f15797a734d0b4f171a86fd35c9a5e43"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028177; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious invoice.scr Download Request"; flow:established,to_server; content:"GET"; http_method; content:"|2F|invoice.scr"; nocase; http_uri; pcre:"/\x2Finvoice\x2Escr$/Ui"; classtype:trojan-activity; sid:2011995; rev:4; metadata:created_at 2010_12_02, updated_at 2010_12_02;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/10.0.11esrpre Iceape/2.7.12"; ja3_hash; content:"55f2bd38d462d74fb6bb72d3630aae16"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028178; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DoS.Linux/Elknot.E Checkin"; flow:established,to_server; dsize:401; content:!"|00 00|"; depth:2; content:"|10 27 60 ea|Linux|20|"; offset:4; depth:64; reference:md5,9a2a00f4bba2f3e0b1211a1f0cb48896; classtype:command-and-control; sid:2019171; rev:2; metadata:created_at 2014_09_12, former_category MALWARE, updated_at 2014_09_12;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/13.0-25.0"; ja3_hash; content:"85c420ab089dac5025034444789a8fb5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028179; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MUROFET/Licat Trojan Checkin Forum"; flow:established,to_server; content:"GET"; http_method; content:!"|0d 0a|Referer|3a|"; nocase; content:"/forum/?"; http_uri; fast_pattern; pcre:"/forum\/\?[0-9a-f]{8}$/U"; reference:md5,531e84b0894a7496479d186712acd7d2; reference:url,extraexploit.blogspot.com/2010/10/some-domains-for-licatmurofettrojanzbot.html; classtype:command-and-control; sid:2012248; rev:5; metadata:created_at 2011_01_29, former_category MALWARE, updated_at 2011_01_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/14.0.1 Linux"; ja3_hash; content:"847b0c334fd0f6f85457054fabff3145"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028180; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET MALWARE USPS Inbound SPAM"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"filename=|22|USPS_Document.zip"; nocase; classtype:trojan-activity; sid:2012276; rev:2; metadata:created_at 2011_02_03, updated_at 2011_02_03;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/25.0"; ja3_hash; content:"e98db583389531a37f2fe8d251f0f7ae"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028181; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SpyEye HTTP Library Checkin"; flow:established,to_server; content:"POST"; http_method; content:"form-data|3b 20|name=|22|sid|22|"; http_client_body; content:"form-data|3b 20|name=|22|ping|22|"; http_client_body; content:"form-data|3b 20|name=|22|guid|22|"; http_client_body; content:"form-data|3b 20|name=|22|GB|22 3b 20|filename=|22|GB.TXT|22|"; http_client_body; fast_pattern; reference:url,nakedsecurity.sophos.com/2011/02/01/outbreak-post-express-service-malware-attack-spammed-out; classtype:command-and-control; sid:2012279; rev:4; metadata:created_at 2011_02_03, former_category MALWARE, updated_at 2011_02_03;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/27.0-32.0, IceWeasel 31.8.0"; ja3_hash; content:"cc9bcf019b339c01d200515d1cb39092"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028182; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET MALWARE IRS Inbound SMTP Malware"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"filename=|22|irs_legalauth-tax_payment_notice_"; nocase; content:".zip|22|"; nocase; classtype:trojan-activity; sid:2012319; rev:2; metadata:created_at 2011_02_18, updated_at 2011_02_18;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/28.0-30.0"; ja3_hash; content:"45d22e6403f053bfb2cc223755588533"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028183; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET MALWARE IRS Inbound SPAM"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"filename=|22|IRS-TaxPaymentNotification"; nocase; content:".zip|22|"; nocase; classtype:trojan-activity; sid:2012320; rev:2; metadata:created_at 2011_02_18, updated_at 2011_02_18;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/31 Linux, firefox"; ja3_hash; content:"ce694315cbb81ce95e6ae4ae8cbafde6"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028184; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET MALWARE IRS Inbound SPAM variant 3"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"filename=|22|Individual_Income_Tax_Rtrn_"; nocase; content:".zip|22|"; nocase; classtype:trojan-activity; sid:2012329; rev:2; metadata:created_at 2011_02_21, updated_at 2011_02_21;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/32.0"; ja3_hash; content:"8df37d4e7430e2d9a291ae9ee500a1a9"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028185; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET MALWARE USPS SPAM Inbound possible spyeye trojan"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:"filename=|22|USPS_"; nocase; content:".zip|22|"; nocase; reference:url,www.virustotal.com/file-scan/report.html?id=ed1766eb13cc7f41243dd722baab9973560c999c1489763c0704debebe8f4cb1-1298551066; classtype:trojan-activity; sid:2012388; rev:2; metadata:created_at 2011_02_27, updated_at 2011_02_27;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/33.0"; ja3_hash; content:"5ba6ed04b246c96c6839e0268a8b826f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028186; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET MALWARE UPS Inbound bad attachment v.5"; flow:established,to_server; content:"Content-Disposition|3a| attachment|3b|"; nocase; content:"filename=|22|UPS"; nocase; content:".zip|22|"; nocase; pcre:"/ups(_parcel_delivery-tracking-notice-|-Delivery-Notification-Message_)\S*\.zip/Ui"; classtype:trojan-activity; sid:2012443; rev:2; metadata:created_at 2011_03_09, updated_at 2011_03_09;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/33.0"; ja3_hash; content:"c5392af25feaf95cfefe858abd01c86b"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028187; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET MALWARE UPS Inbound bad attachment v.6"; flow:established,to_server; content:"From|3a| |22|United Parcel Service|22|"; nocase; content:"|40|ups.com"; nocase; content:"Content-Disposition|3a| attachment|3b|"; nocase; content:"filename=|22|document.zip|22|"; nocase; classtype:trojan-activity; sid:2012444; rev:3; metadata:created_at 2011_03_09, updated_at 2011_03_09;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/34.0-35.00"; ja3_hash; content:"9250f97ba65d86e7b0e60164c820d91a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028188; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET MALWARE Post Express Inbound bad attachment"; flow:established,to_server; content:"Post Express|22|"; nocase; content:"Content-Disposition|3a| attachment|3b|"; nocase; content:"filename=|22|Post_Express_"; nocase; content:".zip|22|"; nocase; classtype:trojan-activity; sid:2012445; rev:6; metadata:created_at 2011_03_09, updated_at 2011_03_09;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/34.0-35.00"; ja3_hash; content:"ab834ac5135f2204d473878821979cea"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028189; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET MALWARE DHL Spam Inbound"; flow:established,to_server; content:"|40|dhl.com"; nocase; content:"Content-Disposition|3A| attachment|3b|"; nocase; content:".zip|22|"; nocase; classtype:trojan-activity; sid:2012492; rev:2; metadata:created_at 2011_03_12, updated_at 2011_03_12;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/37.0, Google Chrome 45.0.2454.85 or FireFox 41-42"; ja3_hash; content:"514058a66606ae870bcc670e95ca7e68"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028190; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"ET MALWARE DHL Spam Inbound"; flow:established,to_server; content:"Content-Disposition|3A| attachment|3b|"; content:"|22|filename=dhl_"; nocase; content:".zip|22|"; nocase; classtype:trojan-activity; sid:2012493; rev:3; metadata:created_at 2011_03_12, updated_at 2011_03_12;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/38 Linux"; ja3_hash; content:"edf844351bc867631b5ebceda318669b"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028191; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE FakeAV InstallInternetDefender Download"; flow:established,from_server; content:"attachment|3b 20|filename=|22|InstallInternetDefender_"; nocase; classtype:trojan-activity; sid:2012494; rev:4; metadata:created_at 2011_03_14, updated_at 2011_03_14;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/40.1 Windows 7"; ja3_hash; content:"05af1f5ca1b87cc9cc9b25185115607d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028192; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Generic Win32 Banker Trojan CheckIn"; flow:established,to_server; content:"GET"; http_method; content:"User-Agent|3a| Mozilla/3.0 (compatible|3b| Indy Library)"; http_header; content:"/sys7."; http_uri; fast_pattern; reference:url,www.xandora.net/xangui/malware/view/18e5c43b3d430526e90799e7cc2c3ec8; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=TrojanSpy%3AWin32%2FBancos.ZY; classtype:command-and-control; sid:2012521; rev:3; metadata:created_at 2011_03_21, former_category MALWARE, updated_at 2011_03_21;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/45.0 Linux, firefox,thunderbird"; ja3_hash; content:"07b4162d4db57554961824a21c4a0fde"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028193; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Unknown Malware PatchPathNewS3.dat Request"; flow:established,to_server; content:"/PatchPathNewS3.dat"; nocase; http_uri; classtype:trojan-activity; sid:2012617; rev:5; metadata:created_at 2011_04_01, updated_at 2011_04_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/51.0 Windows 10, firefox,thunderbird"; ja3_hash; content:"61d0d709fe7ac199ef4b2c52bc8cef75"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028194; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE HTTP Request to a Malware Related Numerical .cn Domain"; flow:established,to_server; content:"Host|3a| "; http_header; content:".cn|0d 0a|"; within:25; http_header; fast_pattern; pcre:"/Host\x3A\x20[^a-z]*[0-9]{4,30}\x2Ecn\x0D\x0A/Hi"; classtype:misc-activity; sid:2012650; rev:7; metadata:created_at 2011_04_08, updated_at 2011_04_08;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/52 Linux"; ja3_hash; content:"4e66f5ad78f3d9ad8d5c7c88d138db43"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028195; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE FakeAV BestAntivirus2011 Download"; flow:established,from_server; content:"|3b 20|filename=|22|BestAntivirus20"; nocase; classtype:trojan-activity; sid:2012714; rev:4; metadata:created_at 2011_04_22, updated_at 2011_04_22;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/52"; ja3_hash; content:"ca0f3f4c08cbd372720beb1af7d2721f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028196; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE Known Hostile Domain citi-bank.ru Lookup"; content:"|09|citi-bank|02|ru|00|"; nocase; classtype:trojan-activity; sid:2012728; rev:4; metadata:created_at 2011_04_26, updated_at 2011_04_26;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/55 Windows 10"; ja3_hash; content:"1885aa9927f99ed538ed895d9335995c"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028197; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan-GameThief.Win32.OnLineGames.bnye Checkin"; flow:to_server,established; content:"|20|HTTP|2f|1|2e|1|0d 0a|User-Agent|3a 20|"; fast_pattern; content:"|0d 0a|Host|3a 20|"; within:13; content:"|3a|8080|0d 0a|Cache-Control|3a 20|no-cache|0d 0a 0d 0a|"; distance:0; content:!"|0d 0a|Accept"; http_header; pcre:"/User-Agent\x3a\x20[a-z]{3,4}\x0d\x0a/H"; reference:md5,014945cf93ffc94833f7a3efd92fe263; classtype:command-and-control; sid:2012736; rev:9; metadata:created_at 2011_04_28, former_category MALWARE, updated_at 2011_04_28;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/55/56 Mac/Win/Linux"; ja3_hash; content:"0ffee3ba8e615ad22535e7f771690a28"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028198; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible TDSS Trojan GET with xxxx_ string"; flow:established,to_server; content:"/xxxx_"; http_uri; pcre:"/\/xxxx_\d+\//U"; classtype:trojan-activity; sid:2012918; rev:4; metadata:created_at 2011_06_02, updated_at 2011_06_02;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/56.0 Windows 10"; ja3_hash; content:"be1a7de97ea176604a3c70622189d78d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028199; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE FAKEAV Gemini - JavaScript Redirection To Scanning Page"; flow:established,to_client; content:"|28|navigator.appVersion.indexof|28 22|Mac|22 29|!=-1|29|"; nocase; content:"window.location="; nocase; within:17; classtype:bad-unknown; sid:2011917; rev:4; metadata:created_at 2010_11_10, updated_at 2010_11_10;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Firefox/6.0.1 - 12.0"; ja3_hash; content:"2aef69b4ba1938c3a400de4188743185"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028200; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE FAKEAV CryptMEN - Random Named DeObfuscation JavaScript File Download"; flow:established,from_server; content:"encrypt|3a| function|28|m, e, n|29|"; depth:64; classtype:bad-unknown; sid:2011922; rev:5; metadata:created_at 2010_11_11, updated_at 2010_11_11;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Flux"; ja3_hash; content:"504ecb2d3e5e83a179316f098dadbaeb"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028201; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Unknown Dropper HTTP POST Check-in"; flow:established,to_server; content:"POST"; http_method; content:"User-Agent|3a| NSIS_InetLoad (Mozilla)"; http_header; content:"spill&a="; http_client_body; reference:url,www.mywot.com/en/forum/13816-clickjacking-scam-spreading-on-facebook; classtype:trojan-activity; sid:2013189; rev:3; metadata:created_at 2011_07_05, updated_at 2011_07_05;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Franz/Google Chrome/Kiwi/Spotify/nwjs/Slack"; ja3_hash; content:"8498fe4268764dbf926a38283e9d3d8f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028202; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE HTran/SensLiceld.A response to infected host"; flow:established,from_server; dsize:<80; content:"|5b|SERVER|5d|connection|20|to|20|"; depth:22; reference:url,www.secureworks.com/research/threats/htran/; reference:url,www.symantec.com/connect/blogs/truth-behind-shady-rat; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2010-120716-4344-99&tabid=2; reference:url,www.securelist.com/en/descriptions/10120120/Trojan-Spy.Win32.Agent.bptu; classtype:trojan-activity; sid:2013361; rev:5; metadata:created_at 2011_08_05, updated_at 2011_08_05;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - FullTilt Poker v16.5 (OS X) #1"; ja3_hash; content:"a6090977601dc1345948f101e46d5759"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028203; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE HTran/SensLiceld.A Checkin 2 (unicode)"; flow:established,from_server; dsize:<120; content:"|5b00|S|00|E|00|R|00|V|00|E|00|R|005d00|c|00|o|00|n|00|n|00|e|00|c|00|t|00|i|00|o|00|n|002000|t|00|o|002000|"; depth:44; reference:url,www.secureworks.com/research/threats/htran/; reference:url,www.symantec.com/connect/blogs/truth-behind-shady-rat; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2010-120716-4344-99&tabid=2; reference:url,www.securelist.com/en/descriptions/10120120/Trojan-Spy.Win32.Agent.bptu; classtype:command-and-control; sid:2013362; rev:7; metadata:created_at 2011_08_05, former_category MALWARE, updated_at 2011_08_05;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - FullTilt Poker v16.5 (OS X) or DropBox"; ja3_hash; content:"f1b9f86645cb839bd6992e848d943898"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028204; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE windows_security_update Fake AV download"; flow:established,from_server; content:"|0d 0a 0d 0a|"; content:"filename=|22|windows_security_update_"; distance:0; classtype:trojan-activity; sid:2013364; rev:7; metadata:created_at 2011_08_05, updated_at 2011_08_05;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Fuze"; ja3_hash; content:"900c1fa84b4ea86537e1d148ee16eae8"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028205; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE FakeAV Landing Page Checking firewall status"; flow:established,from_server; content:"|5c|r|5c|n Checking firewall status|5c|r|5c|n"; classtype:command-and-control; sid:2013413; rev:3; metadata:created_at 2011_08_16, former_category MALWARE, updated_at 2011_08_16;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - geod"; ja3_hash; content:"107144b88827da5da9ed42d8776ccdc5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028206; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Likely CryptMEN FakeAV Download vclean"; flow:established,from_server; content:"filename=|22|vclean"; nocase; http_header; content:".exe"; nocase; http_header; within:20; classtype:trojan-activity; sid:2014028; rev:3; metadata:created_at 2011_12_15, updated_at 2011_12_15;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - geod"; ja3_hash; content:"c46941d4de99445aef6b497679474cf4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028207; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspicious executable download possible Trojan NgrBot"; flow:established,to_server; content:"GET"; http_method; content:"/adobe-flash.exe"; http_uri; classtype:bad-unknown; sid:2014150; rev:3; metadata:created_at 2012_01_26, updated_at 2012_01_26;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - git commandline (tested: 1.9. Linux)"; ja3_hash; content:"3e765b7a69050906e5e48d020921b98e"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028208; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TROJAN ClickCounter Connectivity Check"; flow:established,to_server; content:" clickme=1|0d 0a|"; http_header; content:"clickme=1"; http_cookie; classtype:trojan-activity; sid:2014172; rev:3; metadata:created_at 2012_01_31, updated_at 2012_01_31;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Git-Bash (Tested v2.6.0) / curl 7.47.1 (cygwin)"; ja3_hash; content:"d0df7f7c9ca173059b2cd17ce5c2e5cc"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028209; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE FakeAV Landing Page - Initializing Protection System"; flow:established,from_server; content:">Initializing Protection System...System Tasks any any (msg:"ET DELETED Hash - GitHub Desktop (tested build 216 on OSX)"; ja3_hash; content:"f8c50bbee59c526ca66da05f3dc4b735"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028210; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE HTTP Request to a known malware domain (regicsgf.net)"; flow: to_server,established; content:"regicsgf.net|0D 0A|"; http_header; reference:url,www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~Coswid-C/detailed-analysis.aspx; classtype:trojan-activity; sid:2014570; rev:6; metadata:created_at 2012_04_16, updated_at 2012_04_16;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Glympse Location Tracking??"; ja3_hash; content:"c5cbafbbcf53dfbfc2a803ca3833fce2"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028211; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Backdoor.BAT.Agent.W User Botnet"; flow:established,to_server; content:"USER botnet"; reference:md5,fc7059ec1e3e86fd0a664c3747f09725; classtype:trojan-activity; sid:2014700; rev:3; metadata:created_at 2012_05_02, updated_at 2012_05_02;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - GMail SMTP Relay"; ja3_hash; content:"a3b2fe29619fdcb7a9422b8fddb37a67"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028212; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/HupigonUser.Backdoor Rabclib UA Checkin"; flow:established,to_server; content:".txt"; http_uri; content:"User-Agent|3A 20|RAbcLib|0D 0A|"; http_header; reference:md5,65467e7ff3140f42f4758eca7b76185c; classtype:command-and-control; sid:2014755; rev:4; metadata:created_at 2012_05_17, former_category MALWARE, updated_at 2012_05_17;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - GNU Wget 1.16.1 built on darwin14.0.0"; ja3_hash; content:"94b94048a438e77122fc4eee3a6a4a26"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028213; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE HTTP Request to RunForestRun DGA Domain 16-alpha.waw.pl"; flow:established,to_server; content:".waw.pl|0D 0A|"; nocase; http_header; pcre:"/^Host\x3a\s[^\r\n]+?\.[abedgfihkmlonqpsruwvyxz]{16}\.waw\.pl\r$/Hmi"; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:bad-unknown; sid:2015530; rev:5; metadata:created_at 2012_07_27, updated_at 2012_07_27;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - GNUTLS Commandline"; ja3_hash; content:"0267b752d6a8b5fd195096b41ea5839c"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028214; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE DNS Query to RunForestRun DGA Domain 16-alpha.waw.pl"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|10|"; distance:0; content:"|03|waw|02|pl|00|"; fast_pattern; within:24; nocase; pcre:"/\x10[abedgfihkmlonqpsruwvyxz]{16}\x03waw\x02pl\x00/i"; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; reference:url,blog.opendns.com/2012/07/10/opendns-security-team-blackhole-exploit/; classtype:bad-unknown; sid:2015531; rev:4; metadata:created_at 2012_07_27, updated_at 2012_07_27;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - golang (tested: 1.4.1)"; ja3_hash; content:"f11b0fca6c063aa69d8d39e0d68b6178"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028215; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Karagany checkin (sid5 1)"; flow:to_server,established; content:"?f="; http_uri; content:"&t="; http_uri; content:"&sid5="; http_uri; fast_pattern; content:!"Accept|3a| "; http_header; classtype:command-and-control; sid:2015533; rev:4; metadata:created_at 2012_07_27, former_category MALWARE, updated_at 2012_07_27;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Calendar Agent (Tested on OSX)"; ja3_hash; content:"07ef3a7f5f8ffef08affb186284f2af4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028216; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Karagany checkin (sid5 2)"; flow:to_server,established; content:"?mode="; http_uri; content:"&f="; http_uri; content:"&sid5="; http_uri; fast_pattern; content:!"Accept|3a| "; http_header; classtype:command-and-control; sid:2015534; rev:4; metadata:created_at 2012_07_27, former_category MALWARE, updated_at 2012_07_27;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome (43.0.2357.130 64-bit OSX)"; ja3_hash; content:"abe568de919448adcd756aea9a136aea"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028217; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan Cridex checkin"; flow:established,to_server; content:"POST"; http_method; content:"/mx5/B/in/"; http_uri; reference:url,blog.webroot.com/2012/07/13/spamvertised-american-airlines-themed-emails-lead-to-black-hole-exploit-kit/; reference:url,stopmalvertising.com/rootkits/analysis-of-cridex.html; classtype:command-and-control; sid:2015546; rev:5; metadata:created_at 2012_07_31, former_category MALWARE, updated_at 2012_07_31;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome (Android)"; ja3_hash; content:"400961c8161ba7661a7029d3f7e8bb95"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028218; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Hupigon CnC Data Post (variant abb)"; flow:established,to_server; dsize:>200; content:"Windows "; content:"Service Pack "; distance:0; content:"HACK|00 00|"; fast_pattern; distance:100; reference:url,doc.emergingthreats.net/2008042; classtype:command-and-control; sid:2008042; rev:5; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome (tested: 43.0.2357.130 64-bit OSX)"; ja3_hash; content:"072c0469aa4f2f597bb38bcc17095c51"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028219; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Infostealer.Banprox Proxy.pac Download 3"; flow:from_server,established; file_data; content:"FindProxyForURL"; fast_pattern; distance:0; content:"return |22|PROXY"; pcre:"/^[^\x3b]+\\x(?:[57][0-9a]|4[0-9a-f]|6[1-9a-f]|3[0-9])/Ri"; reference:md5,6f2dc4ba05774f3e5ebf6c502db48a71; classtype:trojan-activity; sid:2019191; rev:13; metadata:created_at 2014_09_18, updated_at 2014_09_18;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome (tested: 43.0.2357.130 64-bit OSX)"; ja3_hash; content:"696cd0c8c241e19e3d6336c3d3d9e2e0"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028220; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 fb 27 b3 4f ab ba bf 8b|"; distance:0; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|MyCompany Ltd|2e|"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019192; rev:2; metadata:attack_target Client_and_Server, created_at 2014_09_18, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome (tested: 43.0.2357.130 64-bit OSX)"; ja3_hash; content:"c40b51e2a59425b6a2b500d569962a60"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028221; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Infostealer.Banprox Proxy.pac Download 2"; flow:from_server,established; file_data; content:"FindProxyForURL"; fast_pattern; distance:0; content:"|22|PROXY"; distance:0; pcre:"/^(?P[\x22\x27])(?:(?!(?P=q))[^\r\n\x2c])+?(?P=q)\s*?\+\s*?[\x22\x27][^\r\n\x2c]*?[cg][\x22\x27\+\s]*?[o][\x22\x27\+\s]*?[vm][\x22\x27\+\s]*?\.[\x22\x27\+\s]*?b[\x22\x27\+\s]*?r[\x22\x27\+\s]*?\x2c/m"; reference:md5,6e4a990b1540fa6b5896034b976ccecf; classtype:trojan-activity; sid:2019190; rev:14; metadata:created_at 2014_09_18, updated_at 2014_09_18;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome 45.0.2454.101"; ja3_hash; content:"e8aabc4fe1fc8d47c648d37b2df7485f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028222; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET !25 (msg:"ET MALWARE Gh0st Trojan CnC 2"; flow:established,to_server; dsize:<250; content:"Gh0st"; offset:8; depth:5; classtype:command-and-control; sid:2017505; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_09_21, deployment Perimeter, former_category MALWARE, malware_family Gh0st, malware_family PCRAT, signature_severity Critical, tag PCRAT, tag Gh0st, tag RAT, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome 46.0.2490.71 m"; ja3_hash; content:"7ea3e17d09294aee8425ae05588f0c66"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028223; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE DNS Query to Unknown CnC DGA Domain palauone.com 09/20/12"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|"; distance:0; content:"|08|palauone|03|com|00|"; nocase; distance:4; within:14; fast_pattern; classtype:command-and-control; sid:2015719; rev:2; metadata:created_at 2012_09_21, former_category MALWARE, updated_at 2012_09_21;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome 46.0.2490.71"; ja3_hash; content:"a9030ea4837810ce89fb8a3d39ca12ed"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028224; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE DNS Query to Unknown CnC DGA Domain traindiscover.com 09/20/12"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|"; distance:0; content:"|0d|traindiscover|03|com|00|"; nocase; distance:4; within:19; fast_pattern; classtype:command-and-control; sid:2015720; rev:3; metadata:created_at 2012_09_21, former_category MALWARE, updated_at 2012_09_21;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome Helper"; ja3_hash; content:"0e46737668fe75092919ee047a0b5945"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028225; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE DNS Query to Unknown CnC DGA Domain manymanyd.com 09/20/12"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|"; distance:0; content:"|09|manymanyd|03|com|00|"; nocase; distance:4; within:15; fast_pattern; classtype:command-and-control; sid:2015721; rev:3; metadata:created_at 2012_09_21, former_category MALWARE, updated_at 2012_09_21;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome Helper"; ja3_hash; content:"39fa85654105398ee7ef6a3a1c81d685"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028226; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE DNS Query to Unknown CnC DGA Domain whatandwhyeh.com 09/20/12"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|"; distance:0; content:"|0c|whatandwhyeh|03|com|00|"; nocase; distance:4; within:18; fast_pattern; classtype:command-and-control; sid:2015722; rev:3; metadata:created_at 2012_09_21, former_category MALWARE, updated_at 2012_09_21;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome Helper"; ja3_hash; content:"4ba7b7022f5f5e1e500bb19199d8b1a4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028227; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE DNS Query to Unknown CnC DGA Domain bktwenty.com 09/20/12"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|"; distance:0; content:"|08|bktwenty|03|com|00|"; nocase; distance:4; within:14; fast_pattern; classtype:command-and-control; sid:2015728; rev:3; metadata:created_at 2012_09_22, former_category MALWARE, updated_at 2012_09_22;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome"; ja3_hash; content:"002205d0f96c37c5e660b9f041363c11"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028228; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert udp $HOME_NET any -> any 53 (msg:"ET MALWARE DNS Query to Unknown CnC DGA Domain sleeveblouse.com 09/20/12"; content:"|01 00 00 01 00 00 00 00 00 00|"; depth:10; offset:2; content:"|04|"; distance:0; content:"|0c|sleeveblouse|03|com|00|"; nocase; distance:4; within:18; fast_pattern; classtype:command-and-control; sid:2015730; rev:3; metadata:created_at 2012_09_22, former_category MALWARE, updated_at 2012_09_22;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome"; ja3_hash; content:"073eede15b2a5a0302d823ecbd5ad15b"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028229; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Fake Anti-Hacking Tool"; flow:established,to_server; content:"/update/WinUpdater.exe"; http_uri; content:!"User-Agent|3a|"; http_header; reference:md5,93443e59c473b89b5afad940a843982a; reference:url,eff.org/deeplinks/2012/08/syrian-malware-post; classtype:trojan-activity; sid:2015748; rev:3; metadata:created_at 2012_09_28, updated_at 2012_09_28;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome"; ja3_hash; content:"0b61c673ee71fe9ee725bd687c455809"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028230; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TROJAN Unk_Banker - Check In"; flow:established,to_server; content:"POST"; http_method; content:"Opera/11.1"; depth:10; http_user_agent; content:"&action=check"; http_client_body; content:"&id="; http_client_body; content:"&version2="; http_client_body; classtype:trojan-activity; sid:2016087; rev:4; metadata:created_at 2012_12_22, updated_at 2012_12_22;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome"; ja3_hash; content:"6cd1b944f5885e2cfbe98a840b75eeb8"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028231; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE CommentCrew UGX Backdoor initial connection"; flow:established,to_server; content:"|dd b5 61 f0 20 47 20 57 d6 65 9c cb 31 1b 65 42 00 00 00 00|"; depth:20; classtype:targeted-activity; sid:2016474; rev:3; metadata:created_at 2013_02_22, former_category MALWARE, updated_at 2013_02_22;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome"; ja3_hash; content:"b4f4e6164f938870486578536fc1ffce"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028232; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"ET MALWARE CommentCrew Possible APT c2 communications get system"; flow:established,to_client; content:"Y29tbWFuZD1nZXRzeXN0ZW07"; classtype:targeted-activity; sid:2016476; rev:4; metadata:attack_target Client_Endpoint, created_at 2013_02_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2013_02_22, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1071, mitre_technique_name Application_Layer_Protocol;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome"; ja3_hash; content:"b8f81673c0e1d29908346f3bab892b9b"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028233; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"ET MALWARE CommentCrew Possible APT c2 communications html return 1"; flow:established,to_client; content:"|48 54 54 50 2f 31 2e 30 20 32 30 30 20 4f 4b 0d 0a|"; content:"|43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 0d 0a|"; content:"|43 6f 6e 65 63 74 69 6f 6e 3a 20 4b 65 65 70 2d 41 6c 69 76 65 0d 0a|"; content:"|53 65 74 2d 43 6f 6f 6b 69 65 3a|"; content:"|0d 0a 20 31|"; classtype:targeted-activity; sid:2016477; rev:3; metadata:attack_target Client_Endpoint, created_at 2013_02_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2013_02_22, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1071, mitre_technique_name Application_Layer_Protocol;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome"; ja3_hash; content:"baaac9b6bf25ad098115c71c59d29e51"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028234; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET 80 -> $HOME_NET any (msg:"ET MALWARE CommentCrew Possible APT c2 communications sleep"; flow:established,to_client; file_data; content:""; classtype:targeted-activity; sid:2016478; rev:3; metadata:attack_target Client_Endpoint, created_at 2013_02_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2013_02_22, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1071, mitre_technique_name Application_Layer_Protocol;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome"; ja3_hash; content:"da949afd9bd6df820730f8f171584a71"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028235; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET 80 -> $HOME_NET any (msg:"ET MALWARE CommentCrew Possible APT c2 communications sleep2"; flow:established,to_client; file_data; content:""; classtype:targeted-activity; sid:2016479; rev:3; metadata:attack_target Client_Endpoint, created_at 2013_02_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2013_02_22, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1071, mitre_technique_name Application_Layer_Protocol;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome"; ja3_hash; content:"fd6314b03413399e4f23d1524d206692"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028237; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET 80 -> $HOME_NET any (msg:"ET MALWARE CommentCrew Possible APT c2 communications sleep3"; flow:established,to_client; file_data; content:""; classtype:targeted-activity; sid:2016480; rev:4; metadata:attack_target Client_Endpoint, created_at 2013_02_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2013_02_22, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1071, mitre_technique_name Application_Layer_Protocol;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome/Slack"; ja3_hash; content:"5498cef2cca704eb01cf2041cc1089c1"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028238; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET 80 -> $HOME_NET any (msg:"ET MALWARE CommentCrew Possible APT c2 communications sleep5"; flow:established,to_client; file_data; content:""; classtype:targeted-activity; sid:2016482; rev:4; metadata:attack_target Client_Endpoint, created_at 2013_02_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2013_02_22, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1071, mitre_technique_name Application_Layer_Protocol;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Drive (tested: 1.26.0707.2863 - Win 8.x & Win 10)"; ja3_hash; content:"c1741dd3d2eec548df0bcd89e08fa431"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028239; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET 80 -> $HOME_NET any (msg:"ET MALWARE CommentCrew Possible APT c2 communications download client.png"; flow:established,to_client; file_data; content:""; classtype:targeted-activity; sid:2016483; rev:4; metadata:attack_target Client_Endpoint, created_at 2013_02_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2013_02_22, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1071, mitre_technique_name Application_Layer_Protocol;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Drive File Stream"; ja3_hash; content:"d27fb8deca6e3b9739db3fda2b229fe3"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028240; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET 80 -> $HOME_NET any (msg:"ET MALWARE CommentCrew Possible APT crabdance backdoor base64 head 2"; flow:established,to_client; file_data; content:"FSssJi01MWwnOic="; classtype:targeted-activity; sid:2016484; rev:4; metadata:created_at 2013_02_22, former_category MALWARE, updated_at 2013_02_22;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Earth Linux 7.1.4.1529"; ja3_hash; content:"b16614e71d26ba348c94bfc8e33b1767"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028241; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET 80 -> $HOME_NET any (msg:"ET MALWARE CommentCrew Possible APT crabdance backdoor base64 head"; flow:established,to_client; file_data; content:"MS4nJzJ4cHZyeQ=="; classtype:targeted-activity; sid:2016485; rev:4; metadata:created_at 2013_02_22, former_category MALWARE, updated_at 2013_02_22;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Earth"; ja3_hash; content:"ae340571b4fd0755c4a0821b18d8fa93"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028242; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET 80 -> $HOME_NET any (msg:"ET MALWARE CommentCrew Possible APT backdoor stage 2 download base64 update.gif"; flow:established,to_client; file_data; content:"IHVwZGF0ZS5naWY="; classtype:targeted-activity; sid:2016486; rev:4; metadata:created_at 2013_02_22, former_category MALWARE, updated_at 2013_02_22;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Mail server starttls connection"; ja3_hash; content:"9af622c65a17a0bf90d6e9504be96a43"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028243; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET 80 -> $HOME_NET any (msg:"ET MALWARE CommentCrew Possible APT c2 communications get command client key"; flow:established,to_client; content:"Y29tbWFuZD1HZXRDb21tYW5kO2NsaWVudGtleT"; content:"O2hvc3RuYW1lPW"; classtype:targeted-activity; sid:2016488; rev:5; metadata:attack_target Client_Endpoint, created_at 2013_02_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2013_02_22, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1071, mitre_technique_name Application_Layer_Protocol;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Photos Backup"; ja3_hash; content:"f059212ce3de94b1e8253a7522cb1b44"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028244; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE ZeuS Ransomware win_unlock"; flow:established,to_server; content:"/locker/lock.php?id="; http_uri; reference:url,www.f-secure.com/weblog/archives/00002367.html; reference:md5,14a1d23b5a8b4f5c186bc5082ede4596; classtype:trojan-activity; sid:2014797; rev:4; metadata:attack_target Client_Endpoint, created_at 2012_05_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2012_05_22, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - GoogleBot"; ja3_hash; content:"50dfee94717e9640b1c384e5bd78e61e"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028245; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Zeus Spam Campaign pdf.exe In ZIP - 26th Feb 2014"; flow:established,to_client; file_data; content:"PK"; within:2; content:"pdf.exe"; distance:42; within:500; classtype:trojan-activity; sid:2018182; rev:3; metadata:created_at 2014_02_27, updated_at 2014_02_27;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - gramblr"; ja3_hash; content:"fd10cc8cce9493a966c57249e074755f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028246; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert udp any 53 -> $HOME_NET any (msg:"ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; pcre:"/^..[\x0d-\x20][a-z]{13,32}(?:\x03(?:biz|com|net|org)|\x04info|\x02ru)\x00\x00\x01\x00\x01/Rs"; threshold: type both, track by_dst, count 12, seconds 120; reference:url,vrt-blog.snort.org/2014/03/decoding-domain-generation-algorithms.html; classtype:trojan-activity; sid:2018316; rev:4; metadata:created_at 2014_03_25, former_category MALWARE, updated_at 2014_03_25;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Great Firewall of China Probe (via pcaps from https://nymity.ch/active-probing/)"; ja3_hash; content:"e76ac6872939f6ebfdf75f1ea73b4daf"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028247; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Probable OneLouder downloader (Zeus P2P) exe download"; flow:established,to_client; flowbits:isset,ET.Onelouder.bin; content:"MZ"; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; classtype:trojan-activity; sid:2018982; rev:2; metadata:created_at 2014_08_22, updated_at 2014_08_22;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - HipChat"; ja3_hash; content:"d9b07b9095590f4ff910ceee7b6af88a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028248; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Unknown Trojan Dropped by Angler Aug 29 2014"; flow:established,to_client; content:"|16|"; content:"|0b|"; within:8; content:"|00 c4 a8 4b da 47 94 14 c1|"; within:35; content:"|55 04 0b|"; distance:0; content:"|55 04 0b|"; distance:0; content:"|06|office"; distance:1; within:7; classtype:trojan-activity; sid:2019086; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_08_29, deployment Perimeter, malware_family Angler, signature_severity Critical, tag Angler, tag Exploit_Kit, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - hola_svc"; ja3_hash; content:"3e860202fc555b939e83e7a7ab518c38"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028249; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 a3 e8 dc 5d 2a ee 44 a3|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019205; rev:2; metadata:attack_target Client_and_Server, created_at 2014_09_22, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - hola_svc"; ja3_hash; content:"54328bd36c14bd82ddaa0c04b25ed9ad"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028250; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 f9 b7 93 80 9f 87 5d ab|"; within:35; content:"|55 04 03|"; distance:0; content:"|0c 31 30 38 2e 36 31 2e 34 39 2e 33 30|"; distance:1; within:13; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019206; rev:2; metadata:attack_target Client_and_Server, created_at 2014_09_22, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - hola_svc"; ja3_hash; content:"56ac3a0bef0824c49e4b569941937088"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028251; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux/BillGates Checkin"; flow:established,to_server; content:"|01 00 00 00|"; depth:4; content:"|00 00 00 f4 01 00 00 32 00 00 00 e8 03|"; distance:0; content:"|01 01 02 00 00 00 01 00 00 00|"; distance:0; reference:md5,b4dd0283c73d0b288e7322b95df0cb1b; classtype:command-and-control; sid:2019207; rev:1; metadata:created_at 2014_09_22, former_category MALWARE, updated_at 2014_09_22;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - hola_svc"; ja3_hash; content:"8bd59c4b7f3193db80fd64318429bcec"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028252; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux/BillGates Checkin Response"; flow:established,from_server; dsize:20; content:"|08 00 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 e8 fd 00 00|"; reference:md5,b4dd0283c73d0b288e7322b95df0cb1b; classtype:command-and-control; sid:2019208; rev:1; metadata:created_at 2014_09_22, former_category MALWARE, updated_at 2014_09_22;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - hola_svc"; ja3_hash; content:"d1f9f9b224387d2597f02095fcec96d7"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028253; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux/AES.DDoS Sending Real/Fake CPU&BW Info"; flow:established,to_server; content:"INFO|3a|"; depth:5; pcre:"/^\d/R"; content:"|25 7c|"; distance:0; threshold: type both, count 1, seconds 30, track by_src; reference:md5,d8059b555dde05e184c0b16bbff523f1; classtype:trojan-activity; sid:2019177; rev:3; metadata:created_at 2014_09_15, updated_at 2014_09_15;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - hola_svc"; ja3_hash; content:"ff1040ba1e3d235855ef0d7cd9237fdc"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028254; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.Win32.PcClient.bal CnC (OUTBOUND) 3"; flow:to_server,established; content:"|33 33|"; offset:2; depth:2; content:!"|33 33|"; within:2; content:"|33 33|"; distance:2; within:2; content:!"|33 33|"; within:2; content:"|33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33 33|"; pcre:"/[^\x33][^\x6f\x19\x18\x0e\x4f\x09\x08\x11\x0c\x0f\x0d\x1f\x10\x39][\x00-\x07\x0b\x0a\x1e\x1d\x12\x13\x15\x10\x1b\x1a\x54-\x5f\x50-\x52\x40-\x4b\x4d\x4e\x70-\x7f\x60-\x67\x69-\x6d]{1,14}\x33/R"; reference:md5,c150f9738142278e2d39417a7ef53cae; classtype:command-and-control; sid:2019203; rev:2; metadata:created_at 2014_09_22, former_category MALWARE, updated_at 2014_09_22;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - HTTRack"; ja3_hash; content:"a1ec6fd012b9ee6f84c50339c4205270"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028255; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (UPATRE CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 82 1f ee 3e 8f cb 87 80|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019225; rev:2; metadata:attack_target Client_and_Server, created_at 2014_09_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - IDSyncDaemon"; ja3_hash; content:"5af143afdbf58ec11ab3b3d53dd4e5e3"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028256; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux/Yangji.A Checkin"; flow:established,to_server; dsize:1024; content:"cngameanti|7c|"; depth:11; pcre:"/^\x2d?\d/R"; reference:md5,b5badeb16414cba66999742601c092b8; classtype:command-and-control; sid:2019229; rev:1; metadata:created_at 2014_09_24, former_category MALWARE, updated_at 2014_09_24;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - IE 11 Win10"; ja3_hash; content:"fee8ec956f324c71e58a8c0baf7223ef"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028257; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET [443,$HTTP_PORTS] (msg:"ET MALWARE Pushdo v3 Checkin"; flow:established,to_server; dsize:20; content:"|02 00 00 00|"; depth:4; reference:md5,776d6c20a7016cb0f0db354785fe0d71; classtype:command-and-control; sid:2019235; rev:1; metadata:created_at 2014_09_25, former_category MALWARE, updated_at 2014_09_25;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - IE 11"; ja3_hash; content:"4cafc7a0acf83a49317ca199b2f25c82"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028258; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Kuluoz/Asprox CnC Response"; flow:from_server,established; flowbits:isset,ET.Kuluoz; content:"|0d 0a 0d 0a|"; content:"|0d 0a 80 00 00 00|"; distance:2; within:6; reference:md5,a3e0f51356d48124fba25485d1871b28; reference:url,www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-asprox-reborn.pdf; reference:url,blog.fortinet.com/post/changes-in-the-asprox-botnet; classtype:command-and-control; sid:2019187; rev:5; metadata:created_at 2014_09_17, former_category MALWARE, updated_at 2014_09_17;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - IE 11"; ja3_hash; content:"78273d33877a36c0c30e3fb7578ee9e7"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028259; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert santa.my"; flow:established,from_server; content:"|55 04 03|"; content:"|0c|www.santa.my"; distance:1; within:13; reference:md5,cfbfac0a9bf37b71e46ed43d95df4aec; classtype:trojan-activity; sid:2019277; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_09_26, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - In all the malware samples - Java updater perhaps, java"; ja3_hash; content:"a61299f9b501adcf680b9275d79d4ac6"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028260; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert glynwedasia.com"; flow:established,from_server; content:"|55 04 03|"; content:"|0f|glynwedasia.com"; distance:1; within:16; reference:md5,cfbfac0a9bf37b71e46ed43d95df4aec; classtype:trojan-activity; sid:2019278; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_09_26, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Inbox OSX"; ja3_hash; content:"d06acbe8ac31e753f40600a9d6717cba"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028261; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 bf ac 1a b8 3d 7f 11 16|"; within:35; fast_pattern; content:"|55 04 03|"; distance:0; content:"|06|debian"; distance:1; within:7; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019279; rev:2; metadata:attack_target Client_and_Server, created_at 2014_09_26, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - inoreader.com-like FeedFetcher-Google, inoreader.com"; ja3_hash; content:"3ca5d63fa122552463772d3e87d276f2"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028262; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 bf ac 1a b8 3d 7f 11 16|"; within:35; fast_pattern; content:"|55 04 03|"; distance:0; content:"|06|debian"; distance:1; within:7; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019280; rev:2; metadata:attack_target Client_and_Server, created_at 2014_09_26, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Internet Explorer 11 .0.9600.1731.(Win 8.1)"; ja3_hash; content:"a6776199188c09f5124b46b895772fa2"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028263; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux/ShellshockCampaign.DDOSBot Reporting IP"; flow:established,to_server; dsize:<24; content:"My IP|3A| "; depth:7; pcre:"/My\x20IP\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x0A/"; reference:url,research.zscaler.com/2014/09/shellshock-attacks-spotted-in-wild.html; reference:cve,2014-6271; classtype:trojan-activity; sid:2019294; rev:1; metadata:created_at 2014_09_29, updated_at 2014_09_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Internet Explorer 11.0.9600.17959"; ja3_hash; content:"a264c0bb146b2fade4410bcd61744b69"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028264; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e4 75 2c 71 a2 5b fd 9f|"; within:35; content:"|55 04 07|"; distance:0; content:"|07|Houston"; distance:1; within:8; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019316; rev:2; metadata:attack_target Client_and_Server, created_at 2014_09_30, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Internet Explorer 11.0.9600.18349 / TeamViewer 10.0.47484P / Notepad++ Update Check / Softperfect Network Scanner Update Check / Wireshark 2.0.4 Update Check"; ja3_hash; content:"d54b3eb800cbeccf99fd5d5cdcd7b5b5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028265; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (UPATRE CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 cb f9 86 23 19 20 43 f0|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019317; rev:4; metadata:attack_target Client_and_Server, created_at 2014_09_30, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - iOS AppleWebKit/536.26"; ja3_hash; content:"06d930b072bf052b10d0a9eea1554f60"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028266; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 f9 7e e9 92 50 35 4f 1e|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019328; rev:2; metadata:attack_target Client_and_Server, created_at 2014_10_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - iOS Mail App (tested: iOS 9.3.3)"; ja3_hash; content:"99204897b101b15f87e9b07f67453f4e"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028267; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 90 47 1b dd 5a 78 af e5|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019329; rev:2; metadata:attack_target Client_and_Server, created_at 2014_10_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - iPad CPU OS 9_3_5 Safari 601.1 Used by many programs - apple.WebKit.Networking"; ja3_hash; content:"a9aecaa66ad9c6cfe1c361da31768506"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028268; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely Bot Nick in IRC (Country Code ISO 3166-1 alpha-2)"; flow:established,to_server; content:"NICK"; depth:5; pcre:"/^[^\r\n]{0,7}\b(?:M[ACDEFGHKLMNOPQRSTUVWXYZ]|B[ABDEFGHIJLMNOQRSTVWYZ]|S[ABCDEGHIJKLMNORSTVXYZ]|C[ACDFGHIKLMNORUVWXYZ]|G[ABDEFGHILMNPQRSTUWY]|A[DEFGILMOQRSTUWXZ]|T[CDFGHJKLMNORTVWZ]|P[AEFGHKLMNRSTWY]|N[ACEFGILOPRUZ]|K[EGHIMNPRWYZ]|L[ABCIKRSTUVY]|I[DELMNOQRST]|E[CEGHRST]|V[ACEGINU]|D[EJKMOZ]|F[IJKMOR]|H[KMNRTU]|U[AGMSYZ]|R[EOSUW]|J[EMOP]|Z[AMW]|W[FS]|Y[ET]|OM|QA)\b/R"; classtype:trojan-activity; sid:2019326; rev:6; metadata:created_at 2014_10_01, former_category MALWARE, updated_at 2014_10_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - iPhone OS 10_3_3 Safari 602.1, Used by many programs on OSX,apple.WebKit.Networking"; ja3_hash; content:"7e72698146290dd68239f788a452e7d8"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028269; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Likely Bot Nick in IRC (Country Code ISO 3166-1 alpha-3)"; flow:established,to_server; content:"NICK"; depth:5; pcre:"/^[^\r\n]{0,7}\b(?:M(?:A[CFR]|D[AGV]|N[EGP]|L[IT]|Y[ST]|[MS]R|CO|EX|HL|KD|OZ|RT|TQ|US|WI)|S(?:L[BEV]|[DEH]N|[JOP]M|G[PS]|V[KN]|W[EZ]|Y[CR]|[MU]R|AU|RB|SD|TP)|B(?:L[MRZ]|R[ABN]|E[LN]|G[DR]|H[RS]|[FW]A|DI|IH|MU|OL|TN|VT)|C(?:O[DGKLM]|H[ELN]|A[FN]|Y[MP]|[IP]V|[MX]R|CK|RI|UB|ZE)|A(?:R[EGM]|T[AFG]|L[AB]|N[DT]|U[ST]|BW|FG|GO|IA|SM|ZE)|G(?:R[CDL]|U[FMY]|I[BN]|N[BQ]|[AM]B|BR|EO|GY|HA|LP|TM)|T(?:U[NRV]|C[AD]|K[LM]|[GT]O|[HZ]A|[OW]N|JK|LS)|P(?:R[IKTY]|A[KN]|[HO]L|CN|ER|LW|NG|SE|YF)|N(?:[CPZ]L|I[CU]|[EO]R|AM|FK|GA|LD|RU)|L(?:B[NRY]|[CKV]A|[AS]O|IE|TU|UX)|I(?:R[LNQ]|S[LR]|[DM]N|ND|OT|TA)|K(?:[AG]Z|[IO]R|EN|HM|NA|WT)|E(?:S[HPT]|CU|GY|RI|TH)|V(?:[ACU]T|EN|GB|IR|NM)|D(?:[MZ]A|EU|JI|NK|OM)|F(?:R[AO]|IN|JI|LK|SM)|H(?:[MN]D|KG|RV|TI|UN)|U(?:[GS]A|KR|MI|RY|ZB)|J(?:AM|EY|OR|PN)|R(?:[EO]U|US|WA)|Z(?:AF|MB|WE)|W(?:LF|SM)|OMN|QAT|YEM)\b/R"; classtype:trojan-activity; sid:2019327; rev:6; metadata:created_at 2014_10_01, former_category MALWARE, updated_at 2014_10_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - iTunes/iBooks #1"; ja3_hash; content:"c6ecc5ba2a6ab724a7430fa4890d957d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028270; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (UPATRE CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 b8 ea 18 ab 15 ab 25 ad|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019330; rev:2; metadata:attack_target Client_and_Server, created_at 2014_10_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - iTunes/iBooks #2"; ja3_hash; content:"c07295da5465d5705a38f044e53ef7c4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028271; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Backdoor.Adwind Download 2"; flow:established,from_server; flowbits:isset,ET.http.javaclient; file_data; content:"Adwin"; pcre:"/^[a-z0-9_-]*?\.class/Rsi"; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2013-070113-1904-99&tabid=3; reference:url,www.crowdstrike.com/blog/adwind-rat-rebranding/index.html; classtype:trojan-activity; sid:2018465; rev:6; metadata:created_at 2014_05_13, updated_at 2014_05_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Java 8U91 Update Check, Windows Java Plugin (tested: v8 Update 60), BurpSuite Free (Tested: 1.7.03 on Windows 10), java,studio,eclipse"; ja3_hash; content:"2db6873021f2a95daa7de0d93a1d1bf2"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028272; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert mypreschool.sg"; flow:established,from_server; content:"|55 04 03|"; content:"|0e|mypreschool.sg"; distance:1; within:15; reference:md5,f186984320d0cf0a4fd501e50c7a40c5; classtype:trojan-activity; sid:2019337; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_10_02, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - java"; ja3_hash; content:"093081b45872912be9a1f2a8163fe041"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028273; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Protux.B Download Update"; flow:from_client,established; content:"Mozilla/4.2.20 (compatible|3B| MSIE 5.0.2|3B| Win32|29 0D 0A|"; http_header; reference:md5,0cab2e1959a2c9eaa3aed1f2e556bf17; classtype:trojan-activity; sid:2014361; rev:3; metadata:created_at 2012_03_10, updated_at 2012_03_10;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - java"; ja3_hash; content:"2080bf56cb87e64303e27fcd781e7efd"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028274; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible CryptoLocker TorComponent DL"; flow:from_server,established; flowbits:isset,FakeIEMinimal; file_data; byte_extract:1,0,size,relative; content:"|00 00 00|"; within:3; content:!"|00|"; within:size; content:"|00|"; distance:size; within:1; pcre:"/^.\x00\x00\x00[a-z0-9]+?\x00/s"; reference:url,malware-traffic-analysis.net/2014/10/01/index.html; classtype:trojan-activity; sid:2019345; rev:2; metadata:created_at 2014_10_03, former_category CURRENT_EVENTS, updated_at 2014_10_03;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - java"; ja3_hash; content:"225a24b45f0f1adbc2e245d4624c6e08"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028275; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE SpyClicker.ClickFraud Query Instructions CnC Response"; flow:established,to_client; content:"|0D 0A 0D 0A|{|22|query|22 3A|"; content:"|22|tasks|22 3A|"; distance:0; content:"|22|referer|22 3A|"; distance:0; content:"|22|useragent|22 3A|"; distance:0; content:"|22|clickurl|22 3A|"; distance:0; reference:url,stopmalvertising.com/malware-reports/anatomy-of-a-net-click-fraud-bot.html; reference:md5,17b077840ab874a8370c98c840b6c671; classtype:command-and-control; sid:2019357; rev:2; metadata:created_at 2014_10_06, former_category MALWARE, updated_at 2014_10_06;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - java"; ja3_hash; content:"3afe1fb5976d0999abe833b14b7d6485"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028276; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e1 57 49 5f fb bc c6 aa|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019360; rev:2; metadata:attack_target Client_and_Server, created_at 2014_10_06, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - java"; ja3_hash; content:"3b844830bfbb12eb5d2f8dc281d349a9"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028277; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 97 31 cd 1f 49 b2 be 4c|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019361; rev:2; metadata:attack_target Client_and_Server, created_at 2014_10_06, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - java"; ja3_hash; content:"550628650380ff418de25d3d890e836e"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028278; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32.Virut.A joining an IRC Channel"; flow:established,to_server; content:"JOIN &virtu"; depth:27; reference:md5,06b522eacdfe51bed5d041fd672e880f; reference:url,doc.emergingthreats.net/2003603; classtype:trojan-activity; sid:2003603; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - java"; ja3_hash; content:"5b270b309ad8c6478586a15dece20a88"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028279; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TeslaCrypt)"; flow:established,from_server; content:"|55 04 03|"; content:"|12|www.reomesoess.com"; distance:1; within:19; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019363; rev:2; metadata:attack_target Client_and_Server, created_at 2014_10_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - java"; ja3_hash; content:"5d7abe53ae15b4272a34f10431e06bf3"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028280; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Smoke Loader C2 Response"; flow:established,from_server; content:"Content-Length|3a| 4|0d 0a|"; http_header; file_data; content:"Smk"; depth:3; fast_pattern; pcre:"/^\d+[\r\n]*?$/Rs"; classtype:command-and-control; sid:2015835; rev:7; metadata:created_at 2012_10_23, former_category MALWARE, updated_at 2012_10_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - java"; ja3_hash; content:"7c7a68b96d2aab15d678497a12119f4f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028281; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Job314 EK Payload Checkin"; flow:established,to_server; content:"GET"; http_method; content:"/knock"; depth:6; http_uri; fast_pattern; content:!"Referer|3a|"; http_header; content:"Mozilla/5.0 (X11|3b| Ubuntu|3b| Linux x86_64|3b| rv|3a|15.0) Gecko/20100101 Firefox/15.0.1"; http_user_agent; classtype:command-and-control; sid:2019286; rev:4; metadata:created_at 2014_09_27, former_category MALWARE, updated_at 2014_09_27;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - java"; ja3_hash; content:"88afa0dea1608e28f50acbad32d7f195"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028282; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,from_server; content:"|55 04 03|"; content:"|0a|junrio.com"; distance:1; within:11; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2018719; rev:3; metadata:attack_target Client_and_Server, created_at 2014_07_17, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - java"; ja3_hash; content:"8ce6933b8c12ce931ca238e9420cc5dd"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028283; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|0c|whaugirls.ru"; distance:1; within:13; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019388; rev:2; metadata:attack_target Client_and_Server, created_at 2014_10_10, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - java"; ja3_hash; content:"a9fead344bf3ac09f62df3cd9b22c268"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028284; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible SandWorm INF Download"; flow:to_client,established; file_data; content:"Software|5c|Microsoft|5c|Windows|5c|CurrentVersion|5c|Run"; nocase; content:"7EBEFBC0-3200-11d2-B4C2-00A0C9697D17"; nocase; content:"ClassGuid"; nocase; content:"DefaultInstall"; nocase; classtype:attempted-user; sid:2019395; rev:2; metadata:created_at 2014_10_14, former_category CURRENT_EVENTS, updated_at 2014_10_14;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - java/eclipse/STS"; ja3_hash; content:"028563cffc7a3a2e32090aee0294d636"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028285; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible SandWorm INF Download (UNICODE)"; flow:to_client,established; file_data; content:"S|00|o|00|f|00|t|00|w|00|a|00|r|00|e|00 5c 00|M|00|i|00|c|00|r|00|o|00|s|00|o|00|f|00|t|00 5c 00|W|00|i|00|n|00|d|00|o|00|w|00|s|00 5c 00|C|00|u|00|r|00|r|00|e|00|n|00|t|00|V|00|e|00|r|00|s|00|i|00|o|00|n|00 5c 00|R|00|u|00|n|00|"; nocase; content:"7|00|E|00|B|00|E|00|F|00|B|00|C|00|0|00 2d 00|3|00|2|00|0|00|0|00 2d 00|1|00|1|00|d|00|2|00 2d 00|B|00|4|00|C|00|2|00 2d 00|0|00|0|00|A|00|0|00|C|00|9|00|6|00|9|00|7|00|D|00|1|00|7"; nocase; content:"C|00|l|00|a|00|s|00|s|00|G|00|u|00|i|00|d|00|"; nocase; content:"D|00|e|00|f|00|a|00|u|00|l|00|t|00|I|00|n|00|s|00|t|00|a|00|l|00|l|00|"; nocase; classtype:attempted-user; sid:2019397; rev:2; metadata:created_at 2014_10_14, former_category CURRENT_EVENTS, updated_at 2014_10_14;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - java/JavaApplicationStub"; ja3_hash; content:"5f9b53f0d39dc9d940a3b5568fe5f0bb"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028286; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET [445,139] -> $HOME_NET any (msg:"ET MALWARE Possible SandWorm INF Download (SMB)"; flow:to_client,established; content:"Software|5c|Microsoft|5c|Windows|5c|CurrentVersion|5c|Run"; nocase; content:"7EBEFBC0-3200-11d2-B4C2-00A0C9697D17"; fast_pattern; nocase; content:"ClassGuid"; nocase; content:"DefaultInstall"; nocase; classtype:attempted-user; sid:2019398; rev:2; metadata:created_at 2014_10_14, former_category CURRENT_EVENTS, updated_at 2014_10_14;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - JavaApplicationStub"; ja3_hash; content:"c376061f96329e1020865a1dc726927d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028287; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET [445,139] -> $HOME_NET any (msg:"ET MALWARE Possible SandWorm INF Download (SMB UNICODE)"; flow:to_client,established; content:"S|00|o|00|f|00|t|00|w|00|a|00|r|00|e|00 5c 00|M|00|i|00|c|00|r|00|o|00|s|00|o|00|f|00|t|00 5c 00|W|00|i|00|n|00|d|00|o|00|w|00|s|00 5c 00|C|00|u|00|r|00|r|00|e|00|n|00|t|00|V|00|e|00|r|00|s|00|i|00|o|00|n|00 5c 00|R|00|u|00|n|00|"; nocase; content:"7|00|E|00|B|00|E|00|F|00|B|00|C|00|0|00 2d 00|3|00|2|00|0|00|0|00 2d 00|1|00|1|00|d|00|2|00 2d 00|B|00|4|00|C|00|2|00 2d 00|0|00|0|00|A|00|0|00|C|00|9|00|6|00|9|00|7|00|D|00|1|00|7"; fast_pattern; nocase; content:"C|00|l|00|a|00|s|00|s|00|G|00|u|00|i|00|d|00|"; nocase; content:"D|00|e|00|f|00|a|00|u|00|l|00|t|00|I|00|n|00|s|00|t|00|a|00|l|00|l|00|"; nocase; classtype:attempted-user; sid:2019399; rev:3; metadata:created_at 2014_10_14, former_category CURRENT_EVENTS, updated_at 2014_10_14;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - K9 Mail (Android)"; ja3_hash; content:"ced7418dee422dd70d2a6f42bb042432"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028288; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 85 d5 29 cf 78 44 88 25|"; distance:0; fast_pattern; content:"|55 04 06|"; distance:0; content:"|02|XX"; distance:1; within:3; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019414; rev:3; metadata:attack_target Client_and_Server, created_at 2014_10_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Kindle/stack/nextcloud"; ja3_hash; content:"e516ad69a423f8e0407307aa7bfd6344"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028289; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|55 04 03|"; content:"|13|www.arrystreamre.ru"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019466; rev:2; metadata:attack_target Client_and_Server, created_at 2014_10_17, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Konqueror 4.14.18 (openSUSE Leap 42.1) 2"; ja3_hash; content:"8194818a46f5533268472f2167ffec70"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028290; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 b4 9e 90 15 d2 12 7f c0|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019477; rev:2; metadata:attack_target Client_and_Server, created_at 2014_10_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Konqueror 4.14.18 / Kmail 4.14.18 (openSUSE Leap 42.1) 1"; ja3_hash; content:"78253eb48a1431a4bbbe6bb4358464ac"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028291; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible IRCBot.DDOS Common Commands"; flow:established,to_client; content:"PRIVMSG "; depth:8; pcre:"/^[^\r\n]*?\x3a[^\r\n]*?(?:port(?:scan)?|udp[1-3]|tcp|http|download)[^\r\n]+?(?:\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}|https?\x3A\x2F\x2F)/Ri"; reference:md5,ef54080af1782dd29356032b7ff20849; classtype:trojan-activity; sid:2019471; rev:3; metadata:created_at 2014_10_20, updated_at 2014_10_20;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Konqueror 4.8, OpenSSL s_client (tested: 1.0.1f - Ubuntu 14.04TS)"; ja3_hash; content:"0e0b798d0208ad365eec733b29da92a6"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028292; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible IRC Bot Common PRIVMSG Commands"; flow:established,to_client; content:"PRIVMSG "; depth:8; pcre:"/^[^\r\n]*?(?:p[ao]rt|udp|c?tcp|http|d(?:ie|ownload)|mail|c?back|(?:msg|notice)?flood)/Ri"; classtype:trojan-activity; sid:2019486; rev:1; metadata:created_at 2014_10_21, updated_at 2014_10_21;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - LeagueClientUx"; ja3_hash; content:"3959d0a1344896e9fb5c0564ca0a2956"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028293; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE BlackEnergy SSL Cert"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 9a ba cb 13 6d 76 5b 79|"; distance:0; fast_pattern; content:"|55 04 06|"; distance:0; content:"|02|XX"; distance:1; within:3; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/sandworm-to-blacken-the-scada-connection; classtype:trojan-activity; sid:2019504; rev:2; metadata:attack_target Client_Endpoint, created_at 2014_10_24, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - LINE Messaging"; ja3_hash; content:"0fe51fa93812c2ebb50a655222a57bf2"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028294; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE BlackEnergy SSL Cert"; flow:from_server,established; content:"|55 04 07|"; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0b|"; distance:0; content:"|07|NETWORK"; distance:1; within:8; content:"|55 04 03|"; distance:0; content:"|0d|144.76.119.48"; distance:1; within:14; fast_pattern; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/sandworm-to-blacken-the-scada-connection; classtype:trojan-activity; sid:2019505; rev:2; metadata:attack_target Client_Endpoint, created_at 2014_10_24, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - LINE Messaging"; ja3_hash; content:"2e094913d88f0ad8dc69447cb7d2ce65"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028295; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE FAKEAV CryptMEN - Landing Page Download Contains .hdd_icon"; flow:established,to_client; content:".hdd_icon"; content:!"nmap.org"; content:!"seclists.org"; classtype:bad-unknown; sid:2011921; rev:7; metadata:created_at 2010_11_11, updated_at 2010_11_11;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - LogMeIn Client"; ja3_hash; content:"193349d34561d1d5d1a270172eb2d97e"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028296; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE DarkComet-RAT init connection"; flow:from_server,established; dsize:12; content:"|38 45 41 34 41 42 30 35 46 41 37 45|"; flowbits:set,ET.DarkCometJoin; reference:url,www.darkcomet-rat.com; reference:url,anubis.iseclab.org/?action=result&task_id=1a7326f61fef1ecb4ed4fbf3de3f3b8cb&format=txt; classtype:trojan-activity; sid:2013283; rev:4; metadata:created_at 2011_07_18, updated_at 2011_07_18;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Mail app iOS"; ja3_hash; content:"0cbbafcdaf63cbf1e490c4a2d903f24b"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028297; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert Oct 24 2014"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e6 91 76 a5 11 ca 47 2d|"; within:35; fast_pattern; content:"|55 04 0b|"; distance:0; content:"|04|none"; distance:1; within:5; content:"|55 04 08|"; distance:0; content:"|0c|Someprovince"; distance:1; within:13; reference:md5,35f6b510f94bd96ed9bc44e1f7bf7f38; classtype:trojan-activity; sid:2019506; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_10_24, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Marble (KDE 5.21.0 QT 5.5.1 openSUSE Leap 42.1)"; ja3_hash; content:"fc5574de96793b73355ca9e555748225"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028298; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert www.tradeledstore.co.uk"; flow:established,from_server; content:"|55 04 03|"; content:"|17|www.tradeledstore.co.uk"; distance:1; within:24; reference:md5,b12730a51341a8bfaa5c7d7e4421fe6c; classtype:trojan-activity; sid:2019507; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_10_24, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Maxthon"; ja3_hash; content:"d732ca39155f38942f90e9fc2b0f97f7"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028299; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Backoff CnC)"; flow:from_server,established; content:"|55 04 08|"; content:"|0a|Some-State"; distance:1; within:11; content:"|55 04 03|"; distance:0; content:"|0d|cyberwise.biz"; distance:1; within:14; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019516; rev:2; metadata:attack_target Client_and_Server, created_at 2014_10_27, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Messenger/Jumpshare"; ja3_hash; content:"c9dbeed362a32f9a50a26f4d9b32bbd8"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028300; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|55 04 03|"; content:"|0e|rikitifer.info"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019517; rev:2; metadata:attack_target Client_and_Server, created_at 2014_10_27, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Microsoft Smartscreen"; ja3_hash; content:"bedb7e0ff43a24272eb0a41993c65faf"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028305; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE W32/ZxShell Server Checkin Response"; flow:established,from_server; dsize:16; content:"|85 19 00 00 25 04 00 00|"; depth:8; reference:url,blogs.cisco.com/talos/opening-zxshell/; classtype:command-and-control; sid:2019587; rev:1; metadata:created_at 2014_10_29, former_category MALWARE, updated_at 2014_10_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Microsoft Updater (Windows 7SP1) / TeamViewer 11.0.56083P"; ja3_hash; content:"bff2c7b5c666331bfe9afacefd1bdb51"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028306; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/ZxShell Checkin"; flow:established,from_server; dsize:16; content:"|86 19 00 00 04 01 00 00|"; depth:8; reference:url,blogs.cisco.com/talos/opening-zxshell/; classtype:command-and-control; sid:2019588; rev:1; metadata:created_at 2014_10_29, former_category MALWARE, updated_at 2014_10_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Microsoft Windows Socket (Tested: Windows 10)"; ja3_hash; content:"48cf5fb702315efbfc88ee3c8c94c6cb"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028307; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy Keepalive to CnC (Operation SMN Variant)"; flow:established,to_server; dsize:48; content:"|b6 8b ac d3 d7 e0 e7 36 f0 b5 63 65 1e 1a 31 ae|"; offset:16; depth:16; reference:md5,184a9d13616702154fb10ff9c5d67041; classtype:command-and-control; sid:2019589; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_10_29, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - mj12bot.com"; ja3_hash; content:"11e1137464a4343105031631d470cd92"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028310; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy Keepalive to CnC (Operation SMN Variant)"; flow:established,to_server; dsize:48; content:"|01 ec 7e 05 1d 5f 65 ab db 1c df 93 99 cd 06 21|"; offset:16; depth:16; reference:md5,09d4c2f1f24fbdcb1c286b2f4c5589d2; classtype:command-and-control; sid:2019590; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_10_29, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Mobile Safari/537.35+ BB10"; ja3_hash; content:"87c6dda19108d68e526a72d9ae09fb9e"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028311; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy Keepalive to CnC (Operation SMN Variant)"; flow:established,to_server; dsize:48; content:"|52 13 34 da 18 3d 2f 45 a2 09 93 52 01 23 51 e3|"; offset:16; depth:16; reference:md5,2b825e46ae60a9d15b5a731e57410425; classtype:command-and-control; sid:2019592; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_10_29, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - mono-sgen/Syncplicity/Axure RP 8/Amazon Drive"; ja3_hash; content:"6acb250ada693067812c3335705dae79"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028312; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy Keepalive to CnC (Operation SMN Variant)"; flow:established,to_server; dsize:48; content:"|3e 5c d1 68 e7 8c 47 8c ea 2f da 02 fe 43 62 47|"; offset:16; depth:16; reference:md5,afc4d73bde2a536d7a9b7596288ce180; classtype:command-and-control; sid:2019593; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_10_29, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Mozilla Sync Services (Android)"; ja3_hash; content:"d65ddade944f9acfe4052b2c9435eb85"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028313; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE FlashPack Payload Download Oct 29"; flow:established,to_server; content:"/lofla1.php"; http_uri; classtype:trojan-activity; sid:2019595; rev:2; metadata:created_at 2014_10_30, former_category CURRENT_EVENTS, updated_at 2014_10_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Mozilla Thunderbird (tested: 31.5.0)"; ja3_hash; content:"c2116e5bb14394aafbefe12ade9bd8ab"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028314; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS C2)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 a9 39 70 34 44 e2 04 31|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019603; rev:2; metadata:attack_target Client_and_Server, created_at 2014_10_30, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Mozilla Thunderbird (tested: 38.3.0), ThunderBird (v38.0.1 OS X)"; ja3_hash; content:"6fd163150b060dd7d07add280f42f4ed"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028315; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Ropest.H CnC - INBOUND set"; flow:established,from_server; content:"|28 00 00 00 00 01 00 00|"; depth:8; flowbits:set,ET.Zberp; flowbits:noalert; reference:md5,a0d843b52e33ba4f1dc72f5a28729806; classtype:command-and-control; sid:2025068; rev:1; metadata:created_at 2014_10_30, former_category MALWARE, updated_at 2017_11_28;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Mozilla/4.0 MSIE 6.0 or MSIE 7.0 User-Agent"; ja3_hash; content:"de350869b8c85de67a350c8d186f11e6"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028316; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Ropest.H CnC - INBOUND"; flow:established,from_server; flowbits:isset,ET.Zberp; dsize:24; content:"|10 00 00 00 00 01 00 00|"; depth:8; reference:md5,a0d843b52e33ba4f1dc72f5a28729806; classtype:command-and-control; sid:2025069; rev:1; metadata:created_at 2014_10_30, former_category MALWARE, updated_at 2017_11_28;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - MS Edge"; ja3_hash; content:"5bf43fbca3454853c26df6d996954aca"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028317; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert udp any 53 -> $HOME_NET any (msg:"ET MALWARE Possible Tinba DGA NXDOMAIN Responses (2)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|ru|00|"; distance:15; within:4; fast_pattern; content:"|0c|"; distance:-17; within:1; pcre:"/^[a-z]{12}/R"; threshold:type both, track by_src, count 50, seconds 10; reference:md5,5808cc73c78263a8114eb205f510f6a7; reference:url,blog.malwarebytes.org/exploits-2/2014/10/exposing-the-flash-eitest-malware-campaign/; classtype:trojan-activity; sid:2019609; rev:1; metadata:created_at 2014_10_31, updated_at 2014_10_31;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - MS Edge"; ja3_hash; content:"888ecd3b5821a497195932b0338f2f12"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028318; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible EITest Flash Redirect"; flow:established,to_client; file_data; content:"|20|name=|22|EITest|22 20|"; fast_pattern; reference:url,blog.malwarebytes.org/exploits-2/2014/10/exposing-the-flash-eitest-malware-campaign/; classtype:trojan-activity; sid:2019610; rev:2; metadata:created_at 2014_10_31, updated_at 2014_10_31;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - MS Edge"; ja3_hash; content:"8d2e46c9e2b1ee9b1503cab4905cb3e0"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028319; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32.TrojanProxy Configuration file Download"; flow:established,from_server; file_data; content:"@$@"; fast_pattern; within:3; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x40\x24\x40$/Ri"; reference:url,fireeye.com/blog/technical/2014/11/operation-poisoned-handover-unveiling-ties-between-apt-activity-in-hong-kongs-pro-democracy-movement.html; classtype:trojan-activity; sid:2019631; rev:2; metadata:created_at 2014_11_03, updated_at 2014_11_03;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - MS Office Components"; ja3_hash; content:"f66b0314f269695fe3528ef39a27c158"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028320; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Genome Download.php HTTP Request"; flow:established,to_server; content:"GET"; http_method; content:"/download.php?nd="; http_uri; content:"&id="; http_uri; classtype:trojan-activity; sid:2013197; rev:3; metadata:created_at 2011_07_05, updated_at 2011_07_05;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - MSIE 10.0 Trident/6.0"; ja3_hash; content:"2201d8e006f8f005a6b415f61e677532"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028321; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ROM/BackOff C2 SSL Cert"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ed fd 42 65 de 77 35 ea|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,blog.fortinet.com/post/rom-a-new-version-of-the-backoff-pos-malware; classtype:command-and-control; sid:2019635; rev:3; metadata:attack_target Client_Endpoint, created_at 2014_11_04, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - MSIE 10.0 Trident/6.0)"; ja3_hash; content:"7b3b37883b5e80065b35f27888ed2b04"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028322; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp any any -> $EXTERNAL_NET any (msg:"ET MALWARE Shellshock Backdoor.Perl.Shellbot.F C2"; flow:to_server,established; content:"JOIN #shock 777"; content:"PRIVMSG #shock|20 3a|uid="; distance:0; reference:url,pastebin.com/JpnznR3j; reference:md5,fc230c9f998c196ac6897a979e08c58d; classtype:command-and-control; sid:2019637; rev:1; metadata:created_at 2014_11_04, former_category MALWARE, updated_at 2014_11_04;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - MSIE 8.0 & 9.0 Trident/5.0)"; ja3_hash; content:"2baf01616e930d378df97576e2686df3"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028323; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> 195.22.26.192/26 any (msg:"ET MALWARE AnubisNetworks Sinkhole TCP Connection"; flow:to_server; classtype:trojan-activity; sid:2019629; rev:2; metadata:created_at 2014_11_03, updated_at 2014_11_03;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - mutt (tested: 1.5.23 OSX)"; ja3_hash; content:"dc7c914e1817944435dd6b82a8495fbb"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028324; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Shellshock Backdoor.Perl.Shellbot.F retrieval"; flow:to_client,established; file_data; content:"#you got shellshocked???"; depth:24; reference:url,pastebin.com/JpnznR3j; reference:md5,fc230c9f998c196ac6897a979e08c58d; classtype:trojan-activity; sid:2019644; rev:2; metadata:created_at 2014_11_05, updated_at 2014_11_05;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - mutt"; ja3_hash; content:"6761a36cfa692fcd3bc7d570b23cc168"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028325; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Bedep SSL Cert"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 0a|"; content:"|0b|Company Ltd"; distance:1; within:12; fast_pattern; content:"|55 04 0b|"; content:"|06|office"; distance:1; within:7; reference:url,malware-traffic-analysis.net/2014/11/02/index.html; reference:md5,11837229f834d296342b205433e9bc48; classtype:trojan-activity; sid:2019645; rev:2; metadata:attack_target Client_Endpoint, created_at 2014_11_05, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - NetFlix App on AppleTV (possibly others also)"; ja3_hash; content:"146c6a6537ba4cc22d874bf8ff346144"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028326; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ff 33 b2 e5 24 44 a4 09|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019648; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_05, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - node-webkit/Kindle"; ja3_hash; content:"3ee4aaac7147ff2b80ada31686db660c"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028330; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 a6 08 2f bd 75 7f 25 39|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019649; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_05, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - node.js"; ja3_hash; content:"641df9d6dbe7fdb74f70c8ad93def8cc"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028331; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e0 62 d9 f2 16 04 d1 be|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019670; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_07, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - node.js/Postman/WhatsApp"; ja3_hash; content:"106ecbd3d14b4dc6e413494263720afe"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028332; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 de 17 24 ba 29 9a a6 c6|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019671; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_07, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Non-Specific Microsoft Socket"; ja3_hash; content:"1d095e68489d3c535297cd8dffb06cb9"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028333; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 a9 db 12 6f 49 21 41 f0|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019691; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_11, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - NVIDEA GeForce Experience, Windows Diagnostic and Telemetry (also Security Essentials and Microsoft Defender) (Tested Win7)"; ja3_hash; content:"4025f224557638ee81afc4f272fd7577"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028334; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert udp any 53 -> $HOME_NET any (msg:"ET MALWARE Possible Emotet DGA NXDOMAIN Responses"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|eu|00|"; distance:19; within:4; fast_pattern; content:"|10|"; distance:-21; within:1; pcre:"/^[a-z]{16}/R"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,3083b68cb5c2a345972a5f79e735c7b9; classtype:trojan-activity; sid:2019692; rev:1; metadata:created_at 2014_11_12, updated_at 2014_11_12;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - nwjs/Chromium"; ja3_hash; content:"49de9b1c7e60bd3b8e1d4f7a49ba362e"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028335; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Dridex Campaign Download Nov 11 2014"; flow:established,to_server; content:"/get/get.php"; http_uri; fast_pattern:only; content:!"Referer|3a|"; http_header; pcre:"/\/get\/get\.php$/U"; classtype:trojan-activity; sid:2019697; rev:2; metadata:created_at 2014_11_12, former_category CURRENT_EVENTS, updated_at 2014_11_12;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - One Drive"; ja3_hash; content:"388a4049af7e631f8d36eb0f909de65a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028336; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE OSX/WireLurker CnC Beacon"; flow:established,from_server; file_data; content:"|7b 22|result|22 3a 7b 22|version|22 3a 22|"; flowbits:isset,ET.WireLurkerUA; reference:url,paloaltonetworks.com/content/dam/paloaltonetworks-com/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf; classtype:command-and-control; sid:2019663; rev:3; metadata:attack_target Client_Endpoint, created_at 2014_11_06, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2014_11_06, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - OpenConnect version v7.01"; ja3_hash; content:"a35c1457421bcfaf5edaccb910bfea1d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028337; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 b9 a5 38 e3 56 d4 39 67|"; distance:0; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|MyCompany Ltd|2e|"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019708; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_14, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - OpenConnect version v7.06 / wget 1.17.1-1 (cygwin)"; ja3_hash; content:"07aa6d7cac645c8845d6e96503f7d985"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028338; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 9e 9b 4d b2 c7 f6 6f f2|"; distance:0; fast_pattern; content:"|55 04 06|"; distance:0; content:"|02|XX"; distance:1; within:3; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019709; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_14, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - openssl s_client / msmtp 1.6.2 (openSUSE Leap 42.1)"; ja3_hash; content:"6fffa2be612102d25dbed5f433b8238c"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028339; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Windows executable base64 encoded in XML"; flow: established,from_server; file_data; content:"bin.base64"; nocase; content:" any any (msg:"ET DELETED Hash - Opera 10.53  10.60  11.61  11.64  12.02, Presto 2.5.24  2.6.30  2.10.229  2.10.289"; ja3_hash; content:"4e6f7f036fb2b05a50ee8a686b1176a6"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028340; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET [8000,8003,9004:] (msg:"ET MALWARE W32Autorun.worm.aaeh Checkin"; flow:established,to_server; content:"Host|3a| ns1.help"; pcre:"/^Host\x3a\x20ns1\.help(?:update(?:d\.(?:com?|net?|org?)|k\.(?:at?|eu?|tw)|r\.net|s\.com)|checks\.net)/mi"; reference:url,www.mcafee.com/threat-intelligence/malware/default.aspx?id=1607456; classtype:command-and-control; sid:2019711; rev:4; metadata:created_at 2014_11_15, former_category MALWARE, updated_at 2014_11_15;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Opera 11.11  11.52, Presto 2.8.131  2.9.168"; ja3_hash; content:"ceee08c3603b53be80c8afdc98babdd6"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028341; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ce 60 aa 87 c5 4a 56 2f|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|0f|fvhch6y1sszzgbh"; distance:1; within:16; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019720; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_18, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Opera 12.14 - 12.16, Presto 2.12.388"; ja3_hash; content:"561271bdcbfe68504ce78b38c957eef0"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028342; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ce 63 1a 95 03 94 55 2e|"; distance:0; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0c|HAMBURG GMBH"; distance:1; within:13; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019721; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_18, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Opera/9.80 (X11 Linux x86_64 U en) Presto/2.6.30 Version/10.60"; ja3_hash; content:"8b475d6105c72827a234fbd47e25b0a3"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028343; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Bamital Checkin Response 1"; flow:established,from_server; file_data; content:"$$$$"; within:4; fast_pattern; pcre:"/^<(?P[a-z])>[a-z0-9/]+<\/(?P=var1)><(?P[a-z])>[a-z0-9/]+<\/(?P=var2)>/Ri"; classtype:command-and-control; sid:2019757; rev:2; metadata:created_at 2014_11_20, former_category MALWARE, updated_at 2014_11_20;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Opera/9.80 Presto/2.10.229 Version/11.62"; ja3_hash; content:"44f37c3ceccb551271bfe0ba6d39426c"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028344; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 f0 34 4a fb 16 96 9d 25|"; within:35; fast_pattern; content:"|55 04 03|"; distance:0; content:"|09|ewgcetiyu"; distance:1; within:10; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019786; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_24, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Opera/9.80 Presto/2.10.289 & Presto/2.10.229"; ja3_hash; content:"a16170ff03466c8ee703dd71feda9bfe"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028345; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e3 90 3b 8c 56 23 94 93|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|0b|1234567egeg"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019787; rev:3; metadata:attack_target Client_and_Server, created_at 2014_11_24, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Opera/9.80 Presto/2.10.289 Version/12.00"; ja3_hash; content:"b237ac4bcc16c142168df03a871677bd"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028346; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 1913 (msg:"ET MALWARE W32/DoubleTap.APT Downloader Socks5 Setup Request"; flow:established,to_server; content:"|05 01 00|"; depth:3; reference:url,www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html; classtype:targeted-activity; sid:2019809; rev:2; metadata:created_at 2014_11_26, former_category MALWARE, updated_at 2014_11_26;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Opera/9.80 Presto/2.12.388"; ja3_hash; content:"07715901e2c6fe4c45e7c42587847d5d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028347; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e1 d9 8a 80 b1 c5 98 08|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|0f|tvd5w4gytsfheyh"; distance:1; within:16; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019810; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_26, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Opera/9.80 Presto/2.12.388"; ja3_hash; content:"329ff4616732b84de926caa7fd6777b0"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028348; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|55 04 03|"; content:"|11|b85937-static.com"; distance:1; within:18; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019811; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_26, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - OS X WebSockets"; ja3_hash; content:"43bb6a18756587426681e4964e5ea4bf"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028349; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 c1 b6 2a 4d 61 3d fa c6|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|09|vgergvwtd"; distance:1; within:10; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019812; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_26, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - osc (python openSUSE Leap 42.1) 1"; ja3_hash; content:"3b6da2971936ac24457616e8ad46f362"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028350; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Hesperbot CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ff 02 6f 9a b5 ff c3 9c|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019813; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_26, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - osc (python openSUSE Leap 42.1) 2"; ja3_hash; content:"95baa3d2068d8c8da71990a353cf8453"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028351; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 f9 f1 2d d7 7c 92 29 6b|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019814; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_26, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Outlook 2007 (Win 8.1)"; ja3_hash; content:"53eb89fe6147474039c1162e4d9d3dc0"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028352; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 d9 5c 3f 2b dc 29 86 c4|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019815; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_26, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - p4v/owncloud"; ja3_hash; content:"38cbe70b308f42da7c9980c0e1c89656"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028353; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e3 73 b3 58 98 16 a7 5b|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|0d|cewceawf2c4ed"; distance:1; within:14; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019818; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_26, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - PaleMoon Browser"; ja3_hash; content:"d82cbe0b93f2b02d490a14f6bc1d421a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028354; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e7 df 16 fb ce 8d dc 5f|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|0c|wrgw4r3gwrgh"; distance:1; within:13; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019819; rev:2; metadata:attack_target Client_and_Server, created_at 2014_11_26, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - parsecd/apple.geod/apple.photomoments/photoanalysisd/FreedomProxy"; ja3_hash; content:"62448833d8230241227c03b7d441e31b"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028355; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|03 15 45 cd|"; within:35; content:"|55 04 03|"; distance:0; content:"|14|static-630567398.com"; distance:1; within:21; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019839; rev:2; metadata:attack_target Client_and_Server, created_at 2014_12_02, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - php script (tested 5.5.27)"; ja3_hash; content:"16765fe48127809dc0ca406769c9391e"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028356; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux/ShellshockCampaign.DDOSBot Execute Shell Command CnC Server Message"; flow:established,to_client; content:"! SH"; depth:4; pcre:"/^[^\r\n]+?\n$/R"; reference:url,research.zscaler.com/2014/09/shellshock-attacks-spotted-in-wild.html; reference:cve,2014-6271; classtype:command-and-control; sid:2019298; rev:2; metadata:created_at 2014_09_29, former_category MALWARE, updated_at 2014_09_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Pidgin (tested 2.10.11)"; ja3_hash; content:"b74f9ecf158e0575101c16c5265a85b0"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028357; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE AlienSpy RAT Checkin Set"; flow:established,to_server; dsize:4; content:"|ac ed|"; depth:2; flowbits:set,ET.rat.alienspy; flowbits:noalert; reference:url,contagiodump.blogspot.com/2014/11/alienspy-java-rat-samples-and-traffic.html?m=1; classtype:command-and-control; sid:2019738; rev:2; metadata:created_at 2014_11_18, former_category MALWARE, updated_at 2014_11_18;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Pocket/Slack/Duo (Android)"; ja3_hash; content:"6ea7cfa450ce959818178b420f59fec4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028358; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE BitCrypt site accessed via .onion SSL Proxy"; flow:established,from_server; content:"|55 04 03|"; content:"kphijmuo2x5expag."; nocase; distance:2; within:17; classtype:trojan-activity; sid:2018399; rev:2; metadata:created_at 2014_04_18, updated_at 2014_04_18;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Polycom IP Phone Directory Lookup"; ja3_hash; content:"9e41b6bf545347abccf0dc8fd76083a5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028359; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux/ShellshockCampaign.DDOSBot Terminate Process CnC Server Message"; flow:established,to_client; dsize:12; content:"! LOLNOGTFO|0A|"; depth:12; reference:url,research.zscaler.com/2014/09/shellshock-attacks-spotted-in-wild.html; reference:cve,2014-6271; classtype:command-and-control; sid:2019304; rev:2; metadata:created_at 2014_09_29, former_category MALWARE, updated_at 2014_09_29;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE [TGI] BlackRAT Checkin"; flow:established,to_server; content:"Clientx|2c 20|Version="; fast_pattern; content:"ProClient.Data"; distance:0; content:"data|05|bytes"; distance:0; reference:md5,7aa313d007a538f7453a0f0f3b76ba1f; classtype:command-and-control; sid:2028564; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_09_10, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2019_09_10;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux/ShellshockCampaign.DDOSBot UDP Flood CnC Server Message"; flow:established,to_client; content:"! UDP "; depth:6; pcre:"/\x21\x20UDP\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}/"; reference:url,research.zscaler.com/2014/09/shellshock-attacks-spotted-in-wild.html; reference:cve,2014-6271; classtype:command-and-control; sid:2019300; rev:2; metadata:created_at 2014_09_29, former_category MALWARE, updated_at 2014_09_29;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE [TGI] BlackRAT Checkin Response"; flow:established,to_client; content:"|2c 20|Version="; content:"BlackRAT.Data"; distance:0; fast_pattern; content:"data|05|bytes"; distance:0; reference:md5,7aa313d007a538f7453a0f0f3b76ba1f; classtype:command-and-control; sid:2028565; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_09_10, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2019_09_10;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux/ShellshockCampaign.DDOSBot TCP Flood CnC Server Message"; flow:established,to_client; content:"! TCP "; depth:6; pcre:"/\x21\x20TCP\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}/"; reference:url,research.zscaler.com/2014/09/shellshock-attacks-spotted-in-wild.html; reference:cve,2014-6271; classtype:command-and-control; sid:2019301; rev:2; metadata:created_at 2014_09_29, former_category MALWARE, updated_at 2014_09_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - postbox-bin"; ja3_hash; content:"e846898acc767ebeb2b4388e58a968d4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028404; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux/ShellshockCampaign.DDOSBot HOLD TCP Flood CnC Server Message"; flow:established,to_client; content:"! HOLD "; depth:7; pcre:"/\x21\x20HOLD\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}/"; reference:url,research.zscaler.com/2014/09/shellshock-attacks-spotted-in-wild.html; reference:cve,2014-6271; classtype:command-and-control; sid:2019302; rev:2; metadata:created_at 2014_09_29, former_category MALWARE, updated_at 2014_09_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Postfix with StartTLS"; ja3_hash; content:"26fa3da4032424ab61dc9be62c8e3ed0"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028405; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux/ShellshockCampaign.DDOSBot Kill Attack CnC Server Message"; flow:established,to_client; dsize:11; content:"! KILLATTK|0A|"; depth:11; reference:url,research.zscaler.com/2014/09/shellshock-attacks-spotted-in-wild.html; reference:cve,2014-6271; classtype:command-and-control; sid:2019303; rev:2; metadata:created_at 2014_09_29, former_category MALWARE, updated_at 2014_09_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - PubNub data stream #1 & Apteligent"; ja3_hash; content:"ef48bf8b2ccaab35642fd0a9f1bbe831"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028406; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Enchanim C2 Client Check-in"; flow:established,to_server; content:"some_magic_code1"; depth:16; reference:md5,2642999a085443e9055b292c4d405e64; reference:md5,37066ed52cd7510bf04808c332599f1c; reference:url,www.seculert.com/blog/2013/04/magic-persistent-threat.html; classtype:command-and-control; sid:2016772; rev:2; metadata:created_at 2013_04_19, former_category MALWARE, updated_at 2013_04_19;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - PubNub data stream #2"; ja3_hash; content:"8cc24a6ff485c62e3eb213d2ca61cf12"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028407; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE W32/SpyBanker Infection Confirmation Email"; flow:established,to_server; content:"From|3A 20 22|Bitch Infected|22|"; reference:md5,007eb53d1b0de237f86750a239cae48e; classtype:trojan-activity; sid:2014668; rev:2; metadata:created_at 2012_05_02, updated_at 2012_05_02;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Pusherapp API"; ja3_hash; content:"12ad03cb3faa2748e92c9a38faab949f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028408; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Winlock.6870 SSL Cert"; flow:from_server,established; content:"|00 cc 05 c7 80 14 cf 3f 50|"; content:"|55 04 08 13 0c|Someprovince"; distance:0; content:"|55 04 07 13 08|Sometown"; distance:0; classtype:trojan-activity; sid:2015795; rev:2; metadata:attack_target Client_Endpoint, created_at 2012_10_12, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - py2app application (including box.net & google drive clients)"; ja3_hash; content:"ba502b2f5d64ac3d1d54646c0d6dd4dc"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028409; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET [25,587] (msg:"ET MALWARE Possible Double Flated Encoded Inbound Malicious PDF"; flow:to_server,established; content:"Wy9GbCAvRmxd"; classtype:trojan-activity; sid:2019117; rev:2; metadata:created_at 2014_09_05, former_category CURRENT_EVENTS, updated_at 2014_09_05;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Python Requests Library 2.4.3"; ja3_hash; content:"c398c55518355639c5a866c15784f969"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028410; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET [25,587] (msg:"ET MALWARE Possible Double Flated Encoded Inbound Malicious PDF"; flow:to_server,established; content:"IFsvRmwgL0Zs"; classtype:trojan-activity; sid:2019119; rev:2; metadata:created_at 2014_09_05, former_category CURRENT_EVENTS, updated_at 2014_09_05;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - python-requests/2.7.0 CPython/2.6.6 Linux/2.6.32-504.23.4.el6.x86_64"; ja3_hash; content:"1a9fb04aa1b4439666672be8661f9386"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028411; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET [25,587] (msg:"ET MALWARE Possible Double Flated Encoded Inbound Malicious PDF"; flow:to_server,established; content:"L0ZsIC9GbF0g"; classtype:trojan-activity; sid:2019118; rev:3; metadata:created_at 2014_09_05, former_category CURRENT_EVENTS, updated_at 2014_09_05;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Qsync Client"; ja3_hash; content:"a7823092705a5e91ce2b7f561b6e5b98"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028412; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux/ShellshockCampaign.DDOSBot Ping CnC Server Message"; flow:established,to_client; dsize:7; content:"! PING|0A|"; depth:7; reference:url,research.zscaler.com/2014/09/shellshock-attacks-spotted-in-wild.html; reference:cve,2014-6271; classtype:command-and-control; sid:2019296; rev:2; metadata:created_at 2014_09_29, former_category MALWARE, updated_at 2014_09_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Reported as -"; ja3_hash; content:"4b06b445e3e12cdae777cec815ab90f5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028414; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux/ShellshockCampaign.DDOSBot Scanner CnC Server Message"; flow:established,to_client; dsize:12<>15; content:"! SCANNER "; depth:10; pcre:"/\x21\x20SCANNER\x20(ON|OFF)\x0A/"; reference:url,research.zscaler.com/2014/09/shellshock-attacks-spotted-in-wild.html; reference:cve,2014-6271; classtype:command-and-control; sid:2019297; rev:2; metadata:created_at 2014_09_29, former_category MALWARE, updated_at 2014_09_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - RescueTime/Plantronics Hub"; ja3_hash; content:"c048d9f26a79e11ca7276499ef24daf3"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028415; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux/ShellshockCampaign.DDOSBot Get Bot IP CnC Server Message"; flow:established,to_client; dsize:13; content:"! GETLOCALIP|0A|"; depth:13; reference:url,research.zscaler.com/2014/09/shellshock-attacks-spotted-in-wild.html; reference:cve,2014-6271; classtype:command-and-control; sid:2019295; rev:2; metadata:created_at 2014_09_29, former_category MALWARE, updated_at 2014_09_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - RingCentral App #2"; ja3_hash; content:"90f755509cba37094eb66be02335b932"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028416; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE OSX/AlienSpy RAT Checkin"; flow:established,to_server; flowbits:isset,ET.rat.alienspy; content:"|78 70|"; depth:2; content:"|1f 8b 08 00 00 00 00 00 00 00 75 54|"; distance:4; within:12; reference:url,contagiodump.blogspot.com/2014/11/alienspy-java-rat-samples-and-traffic.html?m=1; classtype:command-and-control; sid:2019740; rev:2; metadata:created_at 2014_11_18, former_category MALWARE, updated_at 2014_11_18;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - RingCentral App"; ja3_hash; content:"7743db23afb26f18d632420e6c36e076"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028417; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Linux/ShellshockCampaign.DDOSBot Random Byte Flood CnC Server Message"; flow:established,to_client; content:"! JUNK "; depth:7; pcre:"/\x21\x20JUNK\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}/"; reference:url,research.zscaler.com/2014/09/shellshock-attacks-spotted-in-wild.html; reference:cve,2014-6271; classtype:command-and-control; sid:2019299; rev:2; metadata:created_at 2014_09_29, former_category MALWARE, updated_at 2014_09_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - RSiteAuditor"; ja3_hash; content:"35c0a31c481927f022a3b530255ac080"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028418; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 81 (msg:"ET MALWARE W32/DoubleTap.APT Downloader CnC Beacon"; flow:established,to_server; content:"|05 01 00 01 c0 b8 3c e5 00 51|"; depth:10; reference:url,www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html; classtype:targeted-activity; sid:2019808; rev:2; metadata:attack_target Client_Endpoint, created_at 2014_11_26, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2014_11_26, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - ruby script (tested: 2.0.0p481)"; ja3_hash; content:"688b34ca00a291ece0bc07b264b1344c"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028419; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE W32/SCKeyLog.InfoStealer Installation Confirmation Via SMTP"; flow:established,to_server; content:"Subject|3A 20|Installation of SC-KeyLog on host"; nocase; reference:url,home.mcafee.com/VirusInfo/VirusProfile.aspx?key=910563; reference:md5,cc439073eeb244e6bcecee8b6774b672; classtype:trojan-activity; sid:2014354; rev:2; metadata:created_at 2012_03_09, updated_at 2012_03_09;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - ruby"; ja3_hash; content:"d219efd07cbb8fbe547e6a5335843f0f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028420; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 15525 (msg:"ET MALWARE W32/Keylogger.CI Checkin"; flow:established,to_server; dsize:5; content:"|47 00 46 00 49|"; reference:url,microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=TrojanSpyWin32/Keylogger.CI#tab=2; reference:url,www.virustotal.com/en/file/95c65d44a2dd717b27c8008470f95fe46637f624b20d9e19e0c06573b94d20f9/analysis/; classtype:command-and-control; sid:2019712; rev:2; metadata:created_at 2014_11_15, former_category MALWARE, updated_at 2014_11_15;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Safari 525 - 533  534.57.2, Safari 525.21  525.29  531.22.7  533.21.1  534.57.2 / Adobe Reader DC 15.x Updater"; ja3_hash; content:"cbcd1d81f242de31fd683d5acbc70dca"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028421; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MS Office Macro Dridex Download URI Dec 5 2014"; flow:established,to_server; content:"GET"; http_method; urilen:13; content:"/stat/lld.php"; http_uri; fast_pattern:only; content:!"Referer|3A|"; http_header; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/banking-trojan-dridex-uses-macros-for-infection/; classtype:trojan-activity; sid:2019877; rev:2; metadata:created_at 2014_12_05, former_category CURRENT_EVENTS, updated_at 2014_12_05;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Safari 534.34"; ja3_hash; content:"4c551900711d12c864cfe2f95e1c98c2"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028422; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Destover RAT Check-in"; flow:established,to_server; content:"|17 03 01 00 0C E2 C4 Fd D9 E8 E3 F2 9F|"; reference:md5,d1c27ee7ce18675974edf42d4eea25c6; reference:url,www.symantec.com/connect/blogs/destover-destructive-malware-has-links-attacks-south-korea; classtype:trojan-activity; sid:2019878; rev:2; metadata:created_at 2014_12_06, updated_at 2014_12_06;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Safari 534.34, rekonq1.1  Arora0.11.0"; ja3_hash; content:"30701f5050d504c31805594fb5c083b8"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028423; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 97 62 ab fb 64 b9 bc de|"; within:35; content:"|55 04 03|"; distance:0; content:"|05|USTiD"; distance:1; within:6; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019879; rev:2; metadata:attack_target Client_and_Server, created_at 2014_12_06, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Safari 534.34, Safari/537.21"; ja3_hash; content:"41ba55231de6643721fbe2ae25fab85d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028424; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert udp any 53 -> $HOME_NET any (msg:"ET MALWARE Possible Dyre DGA NXDOMAIN Responses (.cc)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|cc|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019882; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Safari 534.59.8"; ja3_hash; content:"fb1d89e16f4dd558ad99011070785cce"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028425; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert udp any 53 -> $HOME_NET any (msg:"ET MALWARE Possible Dyre DGA NXDOMAIN Responses (.ws)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|ws|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019883; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Safari 536.30.1"; ja3_hash; content:"e2a482fbb281f7662f12ff6cc871cfe7"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028426; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert udp any 53 -> $HOME_NET any (msg:"ET MALWARE Possible Dyre DGA NXDOMAIN Responses (.to)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|to|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019884; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Safari 537.71"; ja3_hash; content:"cc5925c4720edb550491a12a35c15d4d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028427; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert udp any 53 -> $HOME_NET any (msg:"ET MALWARE Possible Dyre DGA NXDOMAIN Responses (.in)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|in|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019885; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Safari 537.78.2"; ja3_hash; content:"88770e3ad9e9d85b2e463be2b5c5a026"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028428; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert udp any 53 -> $HOME_NET any (msg:"ET MALWARE Possible Dyre DGA NXDOMAIN Responses (.hk)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|hk|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019886; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Safari"; ja3_hash; content:"c36fb08942cf19508c08d96af22d4ffc"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028429; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert udp any 53 -> $HOME_NET any (msg:"ET MALWARE Possible Dyre DGA NXDOMAIN Responses (.cn)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|ck|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019887; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Safari/534.57.2, hola_svc"; ja3_hash; content:"77310efe11f1943306ee317cf02150b7"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028430; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert udp any 53 -> $HOME_NET any (msg:"ET MALWARE Possible Dyre DGA NXDOMAIN Responses (.tk)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|tk|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019888; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Safari/604.1.38 Macintosh, Used by many programs on OSX,apple.WebKit.Networking"; ja3_hash; content:"c07cb55f88702033a8f52c046d23e0b2"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028431; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert udp any 53 -> $HOME_NET any (msg:"ET MALWARE Possible Dyre DGA NXDOMAIN Responses (.so)"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|so|00|"; distance:37; within:4; fast_pattern; content:"|22|"; distance:-39; within:1; pcre:"/^[a-z][a-f0-9]{33}/Ri"; threshold:type both, track by_src, count 12, seconds 120; reference:md5,c5d2a2287424ab9508ae15261020e48d; classtype:trojan-activity; sid:2019889; rev:1; metadata:created_at 2014_12_08, updated_at 2014_12_08;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Safari/604.3.1 Macintosh/apple.WebKit.Networking,itunesstored"; ja3_hash; content:"3e4e87dda5a3162306609b7e330441d2"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028432; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ee 63 19 d5 6a 4c 09 cf|"; distance:0; fast_pattern; content:"|55 04 06|"; distance:0; content:"|02|UA"; distance:1; within:3; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019890; rev:2; metadata:attack_target Client_and_Server, created_at 2014_12_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Salesforce Files"; ja3_hash; content:"844166382cc98d98595e6778c470f5d5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028433; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Backdoor.Linux.Turla Download"; flow:from_server,established; flowbits:isset,ET.ELFDownload; content:"__we_are_happy__"; content:"__TREX__STOP__STRING__"; distance:0; content:"/dev/random"; distance:1; within:11; reference:url,securelist.com/blog/research/67962/the-penquin-turla-2/; reference:md5,19fbd8cbfb12482e8020a887d6427315; classtype:targeted-activity; sid:2019896; rev:2; metadata:created_at 2014_12_09, updated_at 2014_12_09;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - SCANNER: hoax Firefox/40.1"; ja3_hash; content:"9a35e493f961ac377f948690b5334a9c"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028434; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Cridex CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e9 00 83 69 b1 31 15 7b|"; within:35; fast_pattern; content:"|55 04 03|"; distance:0; content:"|0b|176.99.6.57"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019906; rev:2; metadata:attack_target Client_and_Server, created_at 2014_12_10, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - SCANNER: wordpress wp-login Firefox/40.1"; ja3_hash; content:"ce5f3254611a8c095a3d821d44539877"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028435; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Dalexis.A Possible SSL Cert (smartoptionsinc.com)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|05 11 32 08 1d 81|"; within:30; content:"|55 04 0a|"; distance:0; content:"|0d|Synology Inc."; distance:1; within:14; reference:md5,ef2f9909c76d32b51598c54d5685af7e; classtype:trojan-activity; sid:2019923; rev:2; metadata:attack_target Client_Endpoint, created_at 2014_12_12, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - SCRAPER: DotBot"; ja3_hash; content:"d8844f000e5571807e9094e0fcd795fe"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028436; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Dalexis.A Possible SSL Cert (ppc.cba.pl)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|11 00 81 3d 59 00 8d f2 04 04 8c 3a d3 d0 8e 36 d4 2a|"; distance:9; within:40; content:"|55 04 03|"; distance:0; content:"|06|cba.pl"; distance:1; within:7; reference:md5,ef2f9909c76d32b51598c54d5685af7e; classtype:trojan-activity; sid:2019924; rev:2; metadata:attack_target Client_Endpoint, created_at 2014_12_12, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - SeznamBot/3.2"; ja3_hash; content:"6cc3c7debc31952d05ecaacb6021925f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028438; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Dalexis.A Possible SSL Cert (cargol.cat)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e3 a7 5c ad 38 d2 d7 fe|"; distance:9; within:30; content:"|55 04 0a|"; distance:0; content:"|13|Tirabol Produccions"; distance:1; within:20; reference:md5,ef2f9909c76d32b51598c54d5685af7e; classtype:trojan-activity; sid:2019925; rev:2; metadata:attack_target Client_Endpoint, created_at 2014_12_12, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - ShadowServer Scanner 1"; ja3_hash; content:"fa8b8ed07b1dd0e4a262bd44d31251ec"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028439; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET MALWARE HawkEye Keylogger Report SMTP"; flow:established,to_server; content:"From|3a|"; nocase; content:"Subject|3a| HawkEye Keylogger"; nocase; reference:md5,3bbd5ae250b2d912a701f8d74d85353b; classtype:trojan-activity; sid:2019926; rev:1; metadata:created_at 2014_12_13, updated_at 2014_12_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - ShadowServer Scanner 2"; ja3_hash; content:"c05809230e9f7a6bf627a48b72dc4e1c"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028440; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET MALWARE Beastdoor Keylogger Report via SMTP"; flow:established,to_server; content:"From|3a|"; nocase; content:"Subject|3a 20|Keylogger"; content:"Victim IP-"; reference:md5,ad99a0a85e1410559030464aac390969; classtype:trojan-activity; sid:2019927; rev:1; metadata:created_at 2014_12_13, updated_at 2014_12_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - ShadowServer Scanner 3"; ja3_hash; content:"0ad94fcb7d3a2c56679fbd004f6b12cd"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028441; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET MALWARE Probable Keylogger Report SMTP"; flow:established,to_server; content:"From|3a|"; nocase; content:"Subject|3a 20|Keylogger"; classtype:trojan-activity; sid:2019928; rev:2; metadata:created_at 2014_12_13, updated_at 2014_12_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Shodan"; ja3_hash; content:"0add6ceb611a7613f97329af3b6828d9"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028442; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Net Crawler SMB Share Access unicode (Operation Cleaver)"; flow:established,to_server; content:"|FF|SMB"; offset:4; depth:4; byte_test:1,!&,0x80,6,relative; content:"|00|_|00|A|00|u|00|t|00|o|00|S|00|h|00|a|00|r|00|e|00|$"; distance:0; reference:md5,8994e16b14cde144a9cebdff685d8676; reference:url,www0.cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf; classtype:trojan-activity; sid:2019929; rev:1; metadata:created_at 2014_12_13, updated_at 2014_12_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Shodan"; ja3_hash; content:"0b63812a99e66c82a20d30c3b9ba6e06"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028443; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Net Crawler SMB Share Access ascii (Operation Cleaver)"; flow:established,to_server; content:"|FF|SMB"; offset:4; depth:4; byte_test:1,&,0x80,6,relative; content:"_AutoShare$"; distance:0; reference:md5,8994e16b14cde144a9cebdff685d8676; reference:url,www0.cylance.com/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf; classtype:trojan-activity; sid:2019930; rev:1; metadata:created_at 2014_12_13, updated_at 2014_12_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Shodan"; ja3_hash; content:"109dbd9238634b21363c3d62793c029c"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028444; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET MALWARE Trojan/Win32.Espy Report via SMTP"; flow:established,to_server; content:"From|3a|"; nocase; content:"SUBJECT|3a| I Q - S P Y KeyLogger ["; content:"victim computer name"; reference:md5,1a9a06b11aa537734931f8098bae6b00; classtype:trojan-activity; sid:2019932; rev:1; metadata:created_at 2014_12_13, updated_at 2014_12_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Shodan"; ja3_hash; content:"11e49581344c117df2c9ceb46e5594c4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028445; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 10001 (msg:"ET MALWARE Win32.Bumrat.B Checkin"; flow:established,to_server; dsize:19; content:"|0f 00 00 00|"; depth:4; content:"mconfig_10"; reference:md5,647edeb30a04eeb30b7f8921645c7369; classtype:command-and-control; sid:2019941; rev:1; metadata:created_at 2014_12_16, former_category MALWARE, updated_at 2014_12_16;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Shodan"; ja3_hash; content:"302579fd4ba13eca27932664f66725ad"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028446; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 c8 da 58 e3 bc 80 72 25|"; distance:0; fast_pattern; content:"|55 04 03|"; distance:0; content:"|09|localhost"; distance:1; within:10; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019962; rev:2; metadata:attack_target Client_and_Server, created_at 2014_12_18, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Shodan"; ja3_hash; content:"badc09d74edf43c0204c4827a038c2fa"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028447; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/AGENT.NXNX checkin"; flow:established,to_server; content:"|24 5d 3b 30 2e 29 23 28 30 34 3b 14 1e 14 13 02 0a 54 55 59|"; reference:url,ahnlabasec.tistory.com/1007; classtype:command-and-control; sid:2019964; rev:1; metadata:created_at 2014_12_18, former_category MALWARE, updated_at 2014_12_18;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Shodan"; ja3_hash; content:"f59a024cf47fdb835053ebf144189a47"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028448; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET MALWARE Syrian.Slideshow Sending Information via SMTP"; flow:established,to_server; content:"Subject|3a 20|repo|0d 0a|"; content:"filename=|22|mxtd|22|"; reference:md5,f8bfb82aa92ea6a8e4e0b378781b3859; reference:url,citizenlab.org/2014/12/malware-attack-targeting-syrian-isis-critics; classtype:trojan-activity; sid:2019975; rev:1; metadata:created_at 2014_12_18, updated_at 2014_12_18;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Shodan"; ja3_hash; content:"f8f522671d2d2eba5803e6c002760c05"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028449; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Dridex Distribution Campaign Dec 19 2014"; flow:established,to_server; content:"GET"; http_method; content:"stat/lldv"; http_uri; fast_pattern:only; content:".php"; offset:10; http_uri; pcre:"/\/s?stat\/lldvs?\.php$/U"; pcre:"/^Host\x3A[^\r\n]+?\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}(?:\x3a\d{1,5})?\r?$/Hmi"; reference:url,blog.dynamoo.com/2014/12/pl-remittance-details-ref844127rh.html; classtype:trojan-activity; sid:2019977; rev:3; metadata:created_at 2014_12_20, former_category CURRENT_EVENTS, updated_at 2014_12_20;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Shodan, mutt (tested: 1.5.23 - OS X)"; ja3_hash; content:"9d5869f950eeca2e39196c61fdf510c8"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028450; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 c9 8c 5b 96 3a e7 56 95|"; distance:0; fast_pattern; content:"|55 04 03|"; distance:0; content:"|09|localhost"; distance:1; within:10; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2019987; rev:2; metadata:attack_target Client_and_Server, created_at 2014_12_22, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Shodan, mutt (tested: 1.6.2 OS X)"; ja3_hash; content:"3fcc12d9ee1f75a0212d1d16f7b9f8ad"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028451; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp any any -> any any (msg:"ET MALWARE US-CERT TA14-353A Wiper 2"; flow:established; content:"|c9 06 d9 96 fc 37 23 5a fe f9 40 ba 4c 94 14 98|"; depth:16; reference:url,www.us-cert.gov/ncas/alerts/TA14-353A; classtype:trojan-activity; sid:2019994; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Signal (tested: 3.16.0 - Android)"; ja3_hash; content:"7dde4e4f0dceb29f711fb34b4bdbf420"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028452; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp any any -> any any (msg:"ET MALWARE US-CERT TA14-353A Listening Implant 1"; flow:established; content:"|0c 1f 1f 1f 4d 5a 4c 4f 50 51 4c 5a 3f 2d 2f 2f 3f 50 54 3e 3e 3e|"; depth:22; reference:url,www.us-cert.gov/ncas/alerts/TA14-353A; classtype:trojan-activity; sid:2019995; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Signal Chrome App"; ja3_hash; content:"07931ada5b9dd93ec706e772ee60782d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028453; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp any any -> any any (msg:"ET MALWARE US-CERT TA14-353A Listening Implant 2"; flow:established; content:"|d3 c4 d2 d1 ce cf d2 c4 a1 b3 b1 b1 a1 ce ca a0 a0 a0|"; depth:18; reference:url,www.us-cert.gov/ncas/alerts/TA14-353A; classtype:trojan-activity; sid:2019996; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - SkipFish (tested: v2.10b kali)"; ja3_hash; content:"cfb6d1c72d09d4eaa4c7d2c0b1ecbce7"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028454; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert ip any any -> any any (msg:"ET MALWARE US-CERT TA14-353A Listening Implant 3"; content:"|17 08 14 13 67 0f 13 13 17 67 15 02 16 12 02 14 13 78 47 47|"; depth:24; classtype:trojan-activity; sid:2019997; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Skype (additional Win 10)"; ja3_hash; content:"7a75198d3e18354a6763860d331ff46a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028455; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert ip any any -> any any (msg:"ET MALWARE US-CERT TA14-353A Listening Implant 4"; content:"|4f 50 4c 4b 3f 57 4b 4b 4f 3f 4d 5a 4e 4a 5a 4c 4b 20 1f|"; depth:23; reference:url,www.us-cert.gov/ncas/alerts/TA14-353A; classtype:trojan-activity; sid:2019998; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Skype (multiple platforms)"; ja3_hash; content:"06207a1730b5deeb207b0556e102ded2"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028456; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert ip any any -> any any (msg:"ET MALWARE US-CERT TA14-353A Listening Implant 5"; content:"|15 02 14 17 08 09 14 02 67 75 77 77 67 08 0c 66 66 66|"; depth:22; classtype:trojan-activity; sid:2019999; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Skype (tested 7.18(341) on OSX)"; ja3_hash; content:"5ef08bc989a9fcc18d5011f07d953c14"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028457; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp any any -> any any (msg:"ET MALWARE US-CERT TA14-353A Listening Implant 8"; flow:established; content:"|43 47 47 47 45 67 47 47 43 47 47 47 44 67 47 47|"; reference:url,www.us-cert.gov/ncas/alerts/TA14-353A; classtype:trojan-activity; sid:2020002; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Skype"; ja3_hash; content:"49a341a21f4fd4ac63b027ff2b1a331f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028458; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp any any -> any any (msg:"ET MALWARE US-CERT TA14-353A Listening Implant 9"; flow:established; content:"|43 47 47 47 42 67 47 47 43 47 47 47 4f 67 47 47 43 47 47 47 43 67 47 47 43 47 47 47 4e 67 47 47|"; reference:url,www.us-cert.gov/ncas/alerts/TA14-353A; classtype:trojan-activity; sid:2020003; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Slack Desktop App"; ja3_hash; content:"c8ada45922a3e7857e4bfd4fc13e8f64"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028459; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp any any -> any any (msg:"ET MALWARE US-CERT TA14-353A Listening Implant 10"; flow:established; content:"|d1 ce d2 d5 a1 c9 d5 d5 d1 a1 d3 c4 d0 d4 c4 d2 d5 be|"; depth:18; reference:url,www.us-cert.gov/ncas/alerts/TA14-353A; classtype:trojan-activity; sid:2020004; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Slack"; ja3_hash; content:"3d72e4827837391cd5b6f5c6b2d5b1e1"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028460; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp any any -> any any (msg:"ET MALWARE US-CERT TA14-353A Listening Implant 11"; flow:established; content:"|17 08 14 13 67 0f 13 13 17 67 15 02 16 12 02 14 13 78|"; depth:18; reference:url,www.us-cert.gov/ncas/alerts/TA14-353A; classtype:trojan-activity; sid:2020005; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Slack"; ja3_hash; content:"a5aa6e939e4770e3b8ac38ce414fd0d5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028461; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp any any -> any any (msg:"ET MALWARE US-CERT TA14-353A Listening Implant 12"; flow:established; content:"|0c 1f 1f 1f 4f 50 4c 4b 3f 57 4b 4b 4f 3f 4d 5a 4e 4a 5a 4c 4b 20|"; reference:url,www.us-cert.gov/ncas/alerts/TA14-353A; classtype:trojan-activity; sid:2020006; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Slack"; ja3_hash; content:"cdd8179dc9c0e4802f557b62bae73d43"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028462; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp any any -> any any (msg:"ET MALWARE US-CERT TA14-353A Lightweight Backdoor 3"; flow:established; content:"|4c 4c|"; depth:2; offset:16; content:"|75 14 2a 2a|"; distance:4; within:4; reference:url,www.us-cert.gov/ncas/alerts/TA14-353A; classtype:trojan-activity; sid:2020009; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Slackbot Link Expander"; ja3_hash; content:"22cca8ed59288f4984724f0ee03484ea"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028463; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp any [547,8080,133,117,189,159] -> any any (msg:"ET MALWARE US-CERT TA14-353A Lightweight Backdoor 7"; flow:established,from_server; content:"|7b 08 2a 2a|"; offset:17; content:"|08 2a 2a 01 00|"; distance:0; reference:url,www.us-cert.gov/ncas/alerts/TA14-353A; classtype:trojan-activity; sid:2020013; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Spark"; ja3_hash; content:"116ffc8889873efad60457cd55eaf543"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028464; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp any any -> any any (msg:"ET MALWARE US-CERT TA14-353A Proxy Tool 2"; flow:established; content:!"HTTP/1"; content:"|e2 1d 49 49|"; depth:4; fast_pattern; content:"|49 49 49 49|"; distance:4; within:4; reference:url,www.us-cert.gov/ncas/alerts/TA14-353A; classtype:trojan-activity; sid:2020018; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - SpiderOak (tested: 6.0.1)"; ja3_hash; content:"f51156bcd5033603e750c8bd4db254e3"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028465; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp any any -> any [8000,8080] (msg:"ET MALWARE US-CERT TA14-353A WIPER4"; flow:established,to_server; dsize:42; content:"|28 00|"; depth:2; content:"|04 00 00 00|"; offset:38; depth:4; reference:url,www.us-cert.gov/ncas/alerts/TA14-353A; classtype:trojan-activity; sid:2020020; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - SpotlightNetHelper/Safari"; ja3_hash; content:"8db4b0f8e9dd8f2fff38ee7c5a1e4496"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028466; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Operation Poisoned Helmand jar download"; flow:established,from_server; flowbits:isset,ET.http.javaclient; file_data; content:"jre7u61windows/x86/Update.class"; reference:url,threatconnect.com/news/operation-poisoned-helmand/; classtype:trojan-activity; sid:2020021; rev:2; metadata:created_at 2014_12_23, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - SSLPing Scanner 1"; ja3_hash; content:"24339ea346521d98a8c50fd3713090c9"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028469; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $HOME_NET [139,445] (msg:"ET MALWARE US-CERT TA14-353A Network Propagation Wiper"; flow:to_server,established; content:"|FF|SMB|a2|"; offset:4; depth:5; byte_test:1,!&,0x80,6,relative; content:"taskhost"; content:".exe"; distance:2; within:4; reference:url,www.us-cert.gov/ncas/alerts/TA14-353A; classtype:trojan-activity; sid:2020023; rev:1; metadata:created_at 2014_12_23, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - SSLPing Scanner 2"; ja3_hash; content:"ad5d6f490f3819dc60b2a2fbe5bd1cba"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028470; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Spy.Agent.OHT - AnunakAPT TCP Checkin 2"; flow:established,to_server; dsize:27; content:"bestpobeda"; depth:10; pcre:"/^[a-f0-9]+$/R"; reference:url,fox-it.com/en/files/2014/12/Anunak_APT-against-financial-institutions2.pdf; classtype:targeted-activity; sid:2020025; rev:2; metadata:created_at 2014_12_23, former_category MALWARE, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - SSLPing Scanner 3"; ja3_hash; content:"1e9557c377f8ff50b80b7f87b60b1054"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028471; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Spy.Agent.OHT - AnunakAPT TCP Keep-Alive"; flow:established,to_server; dsize:24; content:"|09 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00|"; depth:20; threshold:type both, track by_src, count 1, seconds 120; reference:url,fox-it.com/en/files/2014/12/Anunak_APT-against-financial-institutions2.pdf; classtype:targeted-activity; sid:2020026; rev:2; metadata:created_at 2014_12_23, former_category MALWARE, updated_at 2014_12_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - SSLPing Scanner 4"; ja3_hash; content:"c3c59ec21835721c92571e7742fadb88"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028472; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Trojan.Nurjax SSL Cert"; flow:established,from_server; content:"|55 04 03|"; content:"|0d|www.njaxjs.me"; distance:1; within:14; classtype:trojan-activity; sid:2020033; rev:2; metadata:attack_target Client_Endpoint, created_at 2014_12_23, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Steam OSX"; ja3_hash; content:"39cf5b7a13a764494de562add874f016"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028473; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 d7 5e db d7 9c 6d e0 4f|"; distance:0; fast_pattern; content:"|55 04 03|"; distance:0; content:"|09|localhost"; distance:1; within:10; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020079; rev:2; metadata:attack_target Client_and_Server, created_at 2014_12_29, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Synology DDNS Beacon"; ja3_hash; content:"cab4a6a0c7ac91c2bd9e93cb0507ad4e"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028474; rev:1; metadata:attack_target Client_Endpoint, created_at 2019_09_10, deployment Perimeter, former_category JA3, signature_severity Major, tag c2, updated_at 2019_10_14, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 9090 (msg:"ET MALWARE Win32.Akdoor Reporting MAC Address"; flow:to_server,established; dsize:20; content:"|01 00 00 00 0c 00 00 00|"; fast_pattern; pcre:"/^[0-9A-F]{12}$/R"; reference:md5,f5ba42117dd02f50b12542131dcd8b5f; classtype:trojan-activity; sid:2020081; rev:1; metadata:created_at 2014_12_29, updated_at 2014_12_29;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Tableau"; ja3_hash; content:"2d3854d1cbcdceece83eabd85bdcc056"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028475; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|55 04 03|"; content:"|0d|tdmodsecur.pw"; distance:1; within:14; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020075; rev:3; metadata:attack_target Client_and_Server, created_at 2014_12_29, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Tableau"; ja3_hash; content:"a585c632a2b49be1256881fb0c16c864"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028476; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Worm.Win32.Ngrbot.lof Join IRC channel"; flow:to_server,established; content:"NICK New|7B|"; nocase; pcre:"/^\S{2,3}\x2d(XP|2K3|VIS|2K8|W7|ERR)\w?\x2d\w+?\x7D\w+?\r\n?/Ri"; reference:url,microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Worm%3AWin32/Dorkbot.AR; reference:md5,dd05fcd2368d8d410a5b85e8d504a435; classtype:trojan-activity; sid:2016849; rev:3; metadata:created_at 2013_05_14, updated_at 2013_05_14;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Tableau"; ja3_hash; content:"cd7c06b9459c9cfd4af2dba5696ea930"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028477; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert udp any any -> 1.1.1.0 80 (msg:"ET MALWARE TROJ_WHAIM.A message"; content:"|57 68 6f 20 61 6d 20 49 3f 20 57 68 6f 20 61 6d 20 49 3f 20 57 68 6f 20 61 6d 20 49 3f 20 57 68 6f 20 61 6d 20 49 3f 20 00|"; threshold: type limit, track by_src, seconds 60, count 1; classtype:trojan-activity; sid:2020069; rev:3; metadata:created_at 2014_12_26, updated_at 2014_12_26;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Tenable Passive Vulnerability Scanner Plugin Updater"; ja3_hash; content:"24993abb75ddda7eaf0709395e47ab4e"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028478; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Malware CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 fd 0c f3 42 0f 46 07 68|"; distance:0; fast_pattern; content:"|55 04 06|"; distance:0; content:"|02|xx"; distance:1; within:3; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020104; rev:2; metadata:attack_target Client_and_Server, created_at 2015_01_07, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - TextSecure Name Lookup (Tested: Android)"; ja3_hash; content:"97d3b9036d5a4d7f1fe33fe730f38231"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028479; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 86 c7 7d 23 ec c3 18 fb|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020149; rev:2; metadata:attack_target Client_and_Server, created_at 2015_01_07, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - ThunderBird (v17.0 OS X)"; ja3_hash; content:"207409c2b30e670ca50e1eac016a4831"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028480; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $EXTERNAL_NET 9000:10000 -> $HOME_NET any (msg:"ET MALWARE Win32/Recslurp.D C2 Response"; flow:established,from_server; flowbits:isset,ET.Reslurp.D.Client; content:"|e8 03 00 00|"; depth:4; reference:md5,fcf364abd9c82d89f8d0b4b091276b41; classtype:command-and-control; sid:2020155; rev:2; metadata:created_at 2015_01_08, former_category MALWARE, updated_at 2015_01_08;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - ThunderBird (v38.0.1 OS X), Thunderbird 38.7.0 (openSUSE Leap 42.1)"; ja3_hash; content:"4623da8b4586a8a4b86e31d689aa0c15"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028481; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux/DDoS.M distributed via CVE-2014-6271 Checkin"; flow:established,to_server; content:"BUILD "; depth:6; pcre:"/^(?:MIPS(?:EL)?|POWERPC|ARM|X86)\x0a$/R"; flowbits:set,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; classtype:command-and-control; sid:2019242; rev:2; metadata:created_at 2014_09_26, former_category MALWARE, updated_at 2014_09_26;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Tor Browser (tested: 5.0.1f - May clash with FF38)"; ja3_hash; content:"0ed768d6e3bc66af60d31315afd423f2"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028482; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET MALWARE Linux/DDoS.M JUNK command"; flow:established,to_client ; content:"JUNK "; depth:5; flowbits:isset,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; reference:url,github.com/pop-pop-ret/lizkebab; classtype:trojan-activity; sid:2020162; rev:1; metadata:created_at 2015_01_13, updated_at 2015_01_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Tor Browser (v4.5.3 OS X - based on FF 31.8.0)"; ja3_hash; content:"8c9a7fe81ba61dab1454e08f42f0a004"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028483; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET MALWARE Linux/DDoS.M GETLOCALIP command"; flow:established,to_client ; content:"GETLOCALIP "; depth:11; flowbits:isset,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; reference:url,github.com/pop-pop-ret/lizkebab; classtype:trojan-activity; sid:2020163; rev:1; metadata:created_at 2015_01_13, updated_at 2015_01_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Tor Relay Traffic (tested 0.2.7.6)"; ja3_hash; content:"5b3eee2766b876e623ba05508d269830"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028484; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET MALWARE Linux/DDoS.M SCANNER command"; flow:established,to_client ; content:"SCANNER "; depth:8; pcre:"/^(?:ON|OFF)/R"; flowbits:isset,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; reference:url,github.com/pop-pop-ret/lizkebab; classtype:trojan-activity; sid:2020164; rev:1; metadata:created_at 2015_01_13, updated_at 2015_01_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Tor Relay Traffic (tested 0.2.7.6), Tor Uplink (via Tails distro)"; ja3_hash; content:"79f0842a32b359d1b683c569bd07f23b"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028485; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET MALWARE Linux/DDoS.M KILLATTK command"; flow:established,to_client ; content:"KILLATTK "; depth:9; flowbits:isset,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; reference:url,github.com/pop-pop-ret/lizkebab; classtype:trojan-activity; sid:2020165; rev:1; metadata:created_at 2015_01_13, updated_at 2015_01_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - tor uplink (tested 0.2.2.35)"; ja3_hash; content:"3b8f3ace50a7c7cd5205af210f17bb70"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028486; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET MALWARE Linux/DDoS.M LOLNOGTFO command"; flow:established,to_client ; content:"LOLNOGTFO "; depth:10; flowbits:isset,ET.lizkebab; reference:md5,5924bcc045bb7039f55c6ce29234e29a; reference:url,github.com/pop-pop-ret/lizkebab; classtype:trojan-activity; sid:2020166; rev:2; metadata:created_at 2015_01_13, updated_at 2015_01_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Tor uplink (tested: 0.2.6.10)"; ja3_hash; content:"659007d8bae74d1053f6ca4a329d25a7"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028487; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp any any -> any 1024: (msg:"ET MALWARE Linux/DDoS.M Admin console status"; flow:established,to_client ; content:"|1b 5d 30 3b|Bots connected|3a 20|"; content:"|7c 20|Clients connected|3a 20|"; distance:0; threshold: type both, count 1, seconds 10, track by_src; reference:url,github.com/pop-pop-ret/lizkebab; classtype:trojan-activity; sid:2020167; rev:1; metadata:created_at 2015_01_13, updated_at 2015_01_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Tracking something (noted with Dropbox Installer & Skype - Win 10)"; ja3_hash; content:"bc329d2a71e749067424502f1f72e13a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028488; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET [80,443] (msg:"ET MALWARE Hong Kong SWC Attack PcClient CnC Beacon"; flow:established,to_server; content:"|BB 4E 4E BC BC BC 7E 7E|"; nocase; offset:160; depth:8; reference:url,blog.dragonthreatlabs.com/2015/01/dtl-12012015-01-hong-kong-swc-attack.html; classtype:command-and-control; sid:2020169; rev:1; metadata:attack_target Client_Endpoint, created_at 2015_01_13, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_01_13, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Trident/7.0"; ja3_hash; content:"2a458dd9c65afbcf591cd8c2a194b804"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028489; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Office Doc with Embedded VBA containing Reverse Meterpreter Shell"; flow:established,from_server; flowbits:isset,et.DocVBAProject; file_data; content:"windows/meterpreter/reverse_"; nocase; reference:url,github.com/enigma0x3/Generate-Macro/blob/master/Generate-Macro.ps1; classtype:trojan-activity; sid:2020170; rev:2; metadata:created_at 2015_01_13, former_category MALWARE, updated_at 2015_01_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Trident/7.0"; ja3_hash; content:"aea96546ac042f29fed1e2203a9b4c3f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028490; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 9e 7d f1 a1 50 bc 27 18|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020187; rev:2; metadata:attack_target Client_and_Server, created_at 2015_01_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - True Key"; ja3_hash; content:"df65746370dcabc9b4f370c6e14a8156"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028491; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux/ChinaZ DDoS Bot Checkin"; flow:established,to_server; content:"|00 00 00 00|"; depth:4; content:!"|00|"; within:1; content:"MHz|00|"; distance:0; content:"|20 2a 20|"; distance:-12; within:5; pcre:"/^\d+MHz\x00/R"; content:"|20|MB|00|"; distance:0; fast_pattern; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3682; classtype:command-and-control; sid:2020188; rev:1; metadata:created_at 2015_01_15, former_category MALWARE, updated_at 2015_01_15;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Twitterbot/1.0"; ja3_hash; content:"edcf2fd479271286879efebd22bc8d16"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028492; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 9d 36 ff 20 e3 b5 4d 15|"; within:35; fast_pattern; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020196; rev:2; metadata:attack_target Client_and_Server, created_at 2015_01_16, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Ubuntu Software Center"; ja3_hash; content:"633e9558d4b25b46e8b1c49e10faaff4"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028493; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 1024:65535 (msg:"ET MALWARE Win32.ChinaZ.DDoSClient Checkin"; flow:established,to_server; content:"Windows "; depth:8; content:"|20|MHZ|00|"; fast_pattern; distance:0; content:"|00|Win"; distance:0; content:"|00|"; distance:2; within:2; reference:md5,8643a44febdf73159b2d5c437dc40cd3; classtype:command-and-control; sid:2020209; rev:2; metadata:created_at 2015_01_20, former_category MALWARE, updated_at 2015_01_20;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Ubuntu Software Center"; ja3_hash; content:"b9b4d1f7283b5ddc59d0b8d15e386106"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028494; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (URLzone CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 b9 84 73 78 53 8f 36 69|"; distance:0; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|MyCompany Ltd|2e|"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020216; rev:2; metadata:attack_target Client_and_Server, created_at 2015_01_20, deployment Perimeter, former_category MALWARE, malware_family URLZone, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, tag Banking_Trojan, updated_at 2018_04_23, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Ubuntu Web Socket #1"; ja3_hash; content:"ac206b75530d569a0a64cec378eb4b66"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028495; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET [443,4443] -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e9 91 eb 37 30 e6 41 f6|"; within:35; fast_pattern; content:"|55 04 06|"; distance:0; content:"|02|CN"; distance:1; within:3; content:"|55 04 08|"; distance:0; content:"|02|ST"; distance:1; within:3; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020217; rev:2; metadata:attack_target Client_and_Server, created_at 2015_01_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Ubuntu Web Socket #2"; ja3_hash; content:"94feb9008aeb393e76bac31b30af6ad0"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028496; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 9e b5 fa 1e d4 7a 9e 36|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020218; rev:2; metadata:attack_target Client_and_Server, created_at 2015_01_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Ubuntu Web Socket #3"; ja3_hash; content:"f1b7bbeb8b79cecd728c72bba350d173"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028497; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 f3 1c c2 15 72 83 e3 79|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020219; rev:2; metadata:attack_target Client_and_Server, created_at 2015_01_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Ubuntu Web Socket #4"; ja3_hash; content:"3f00755c412442e642f5572ed4f2eaf2"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028498; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ae 79 0b f9 9e bd 14 a1|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020220; rev:2; metadata:attack_target Client_and_Server, created_at 2015_01_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - UMich Scanner (can use: zgrab)"; ja3_hash; content:"0e580f864235348848418123f96bbaa0"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028499; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Nitol.A Checkin 2"; flow:from_client,established; dsize:260; content:"MB|00 00|"; content:"Windows|20|"; distance:0; content:"V1.0|00 00|"; offset:180; fast_pattern; reference:md5,b9096b87cf643c5f86789d995e9e773d; classtype:command-and-control; sid:2020222; rev:1; metadata:created_at 2015_01_21, former_category MALWARE, updated_at 2015_01_21;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - UMich Scanner (can use: zgrab)"; ja3_hash; content:"9a1c3fed39b016b8d81cc77dae70f60f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028500; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 b6 24 74 c1 1f 18 de bb|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020242; rev:2; metadata:attack_target Client_and_Server, created_at 2015_01_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - UMich Scanner (can use: zgrab)"; ja3_hash; content:"dc76bc3a4e3bc38939dfd90d8b7214b7"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028501; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Scieron Possible SSL Cert"; flow:established,from_server; content:"|0b|"; content:"|10 6d 7a 85 10 89 c8 6f bb 41 41 46 e6 96 f2 68 cd|"; within:45; content:"|55 04 03|"; distance:0; content:"|10|RibbonLocalHTTPS"; distance:1; within:17; reference:url,symantec.com/connect/blogs/scarab-attackers-took-aim-select-russian-targets-2012; classtype:trojan-activity; sid:2020243; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_01_23, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Unidentified attack tool"; ja3_hash; content:"90f6c4b0577fb24a31bea0acc1fcc27d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028502; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Scieron Retrieving Information Response"; flow:established,from_server; file_data; content:"system"; within:6; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})system$/R"; flowbits:isset,ET.Trojan.Scieron.Ret; reference:url,symantec.com/connect/blogs/scarab-attackers-took-aim-select-russian-targets-2012; reference:md5,a36db258d0f6f085e8e5030d8e9a9bf4; classtype:trojan-activity; sid:2020297; rev:2; metadata:created_at 2015_01_23, updated_at 2015_01_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Unknown BrowserStack timeframe SMTP STARTLS"; ja3_hash; content:"7bc3475b771c44c764614397da069d28"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028503; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE W32/AGENT.NXNX Checkin 2"; flow:to_server,established; dsize:200; content:"D|3a 00 00 00|"; offset:7; depth:13; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}D\x3a\x00+?$/"; reference:md5,fdcf0e3e3ad69cdd570387c4ce9aa8b3; reference:url,ahnlabasec.tistory.com/1007; reference:url,global.ahnlab.com/global/upload/download/asecreport/ASEC%20Report_Vol.58_Eng.pdf; classtype:command-and-control; sid:2020303; rev:2; metadata:created_at 2015_01_23, former_category MALWARE, updated_at 2015_01_23;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Unknown SMTP server (207.46.100.103)"; ja3_hash; content:"23a9b0eb3584e358816a123c208a2c8b"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028504; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 9d 12 4e cf d7 61 de 81|"; distance:0; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|MyCompany Ltd|2e|"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020307; rev:4; metadata:attack_target Client_and_Server, created_at 2015_01_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Unknown SMTP Server (used by Facebook)"; ja3_hash; content:"26cdef14ec70c2d6ebd943fe8069c4da"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028505; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET 1025 -> $HOME_NET any (msg:"ET MALWARE Possible Mailer Dropped by Dyre SSL Cert"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|06 03 55 04 06 13 02 41 55|"; distance:0; content:"|55 04 08|"; distance:0; pcre:"/^.{2}(?P[a-z0-9]{4,16}[01]).+?\x06\x03\x55\x04\x08.{2}(?P=var)/Rs"; reference:md5,dbcdaf617e19d2a35f763ac996cf8cd7; classtype:trojan-activity; sid:2020205; rev:4; metadata:attack_target Client_Endpoint, created_at 2015_01_19, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Unknown Something on Android that talks to Google Analytics"; ja3_hash; content:"335ec05b3ddb3800a8df47641c2d8e33"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028506; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $HOME_NET [139,445] (msg:"ET MALWARE Regin Hopscotch Module Accessing SMB2 Named Pipe (Unicode) 1"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"|00|{|00|6|00|6|00|f|00|b|00|e|00|8|00|7|00|a|00|-|00|4|00|3|00|7|00|2|00|-|00|1|00|f|00|5|00|1|00|-|00|1|00|0|00|1|00|d|00|-|00|1|00|a|00|a|00|f|00|0|00|0|00|4|00|3|00|1|00|2|00|7|00|a|00|}"; distance:0; nocase; reference:url,securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin; classtype:trojan-activity; sid:2020309; rev:1; metadata:created_at 2015_01_26, updated_at 2015_01_26;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Unknown TLS Scanner"; ja3_hash; content:"18e9afaf91db6f8a2470e7435c2a1d6b"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028507; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $HOME_NET [139,445] (msg:"ET MALWARE Regin Hopscotch Module Accessing SMB Named Pipe (Unicode) 2"; flow:to_server,established; content:"|FF|SMB"; offset:4; depth:4; content:"|00|{|00|4|00|4|00|f|00|d|00|g|00|2|00|3|00|a|00|-|00|1|00|5|00|2|00|2|00|-|00|6|00|f|00|9|00|e|00|-|00|d|00|0|00|5|00|d|00|-|00|1|00|a|00|a|00|f|00|0|00|1|00|7|00|6|00|1|00|3|00|8|00|a|00|}"; distance:0; nocase; reference:url,securelist.com/blog/research/68438/an-analysis-of-regins-hopscotch-and-legspin; classtype:trojan-activity; sid:2020310; rev:1; metadata:created_at 2015_01_26, updated_at 2015_01_26;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - UNVERIFIED: May be BlueCoat proxy"; ja3_hash; content:"f6bae8bacf93b5e97e80b594ffeba859"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028508; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 e4 10 f0 a9 8b a2 9b 82|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020313; rev:2; metadata:attack_target Client_and_Server, created_at 2015_01_26, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - urlgrabber/3.10 yum/3.4.3"; ja3_hash; content:"37f691b063c10372135db21579643bf1"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028509; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 99 95 bf 9b 4f 7d 85 0e|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020314; rev:2; metadata:attack_target Client_and_Server, created_at 2015_01_26, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Used by many desktop apps,Quip,Spotify,GitHub Desktop"; ja3_hash; content:"84071ea96fc8a60c55fc8a405e214c0f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028510; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 9d 98 f4 2b 01 ee fc d3|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020322; rev:2; metadata:attack_target Client_and_Server, created_at 2015_01_28, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Used by many programs on OSX,apple.WebKit.Networking"; ja3_hash; content:"40fd0a5e81ebdcf0ec82a4710a12dec1"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028511; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 97 45 b9 f1 e8 a9 d8 52|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020331; rev:3; metadata:attack_target Client_and_Server, created_at 2015_01_30, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Used by many programs on OSX,apple.WebKit.Networking"; ja3_hash; content:"618ee2509ef52bf0b8216e1564eea909"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028512; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE MSIL/Agent.PYO Receiving Config"; flow:established,from_server; file_data; content:"path = "; within:7; content:"|0a|delay = "; distance:0; pcre:"/^\d+\n/R"; content:"hash = "; within:7; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/R"; reference:url,welivesecurity.com/2015/01/29/msilagent-pyo-have-botnet-will-travel/; classtype:trojan-activity; sid:2020335; rev:2; metadata:created_at 2015_01_30, updated_at 2015_01_30;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Used by many programs on OSX,apple.WebKit.Networking"; ja3_hash; content:"799135475da362592a4be9199d258726"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028513; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE BePush/Kilim Checkin response"; flow:established,from_server; file_data; content:"Server_ok"; depth:9; flowbits:isset,ET.FB.troj; reference:url,seclists.org/fulldisclosure/2015/Jan/131; reference:md5,cdcc132fad2e819e7ab94e5e564e8968; classtype:command-and-control; sid:2020349; rev:2; metadata:created_at 2015_02_03, former_category MALWARE, updated_at 2015_02_03;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Used by many programs on OSX,apple.WebKit.Networking"; ja3_hash; content:"7b530a25af9016a9d12de5abc54d9e74"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028514; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DDoS.XOR Checkin"; flow:to_server,established; content:"BB2FA36AAA9541F0"; depth:500; reference:url,blog.malwaremustdie.org/2014/09/mmd-0028-2014-fuzzy-reversing-new-china.html; classtype:command-and-control; sid:2020381; rev:3; metadata:created_at 2015_02_07, former_category MALWARE, malware_family XorDDoS, updated_at 2015_02_07;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Used by many programs on OSX,apple.WebKit.Networking"; ja3_hash; content:"c05de18b01a054f2f6900ffe96b3da7a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028515; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $HOME_NET [139,445] (msg:"ET MALWARE Skeleton Key Filename in SMB Traffic (ASCII)"; flow:to_server,established; content:"|FF|SMB|a2|"; offset:4; depth:5; byte_test:1,!&,0x80,6,relative; content:"|5c|msuta64.dll"; reference:url,www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis; classtype:trojan-activity; sid:2020173; rev:2; metadata:created_at 2015_01_13, updated_at 2015_01_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Used by many programs on OSX,apple.WebKit.Networking"; ja3_hash; content:"e4d448cdfe06dc1243c1eb026c74ac9a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028516; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $HOME_NET [139,445] (msg:"ET MALWARE Skeleton Key Filename in SMB Traffic (ASCII)"; flow:to_server,established; content:"|FF|SMB|a2|"; offset:4; depth:5; byte_test:1,!&,0x80,6,relative; content:"|5c|ole64.dll"; reference:url,www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis; classtype:trojan-activity; sid:2020174; rev:2; metadata:created_at 2015_01_13, updated_at 2015_01_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Used by many programs on OSX,apple.WebKit.Networking"; ja3_hash; content:"f1c5cf087b959cec31bd6285407f689a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028517; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $HOME_NET [139,445] (msg:"ET MALWARE Skeleton Key Filename in SMB Traffic (ASCII)"; flow:to_server,established; content:"|FF|SMB|a2|"; offset:4; depth:5; byte_test:1,!&,0x80,6,relative; content:"|5c|ole.dll"; reference:url,www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis; classtype:trojan-activity; sid:2020175; rev:2; metadata:created_at 2015_01_13, updated_at 2015_01_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Used by many programs/Python/PHP/Git/dotnet/Adobe"; ja3_hash; content:"488b6b601cb141b062d4da7f524b4b22"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028518; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $HOME_NET [139,445] (msg:"ET MALWARE Skeleton Key Filename in SMB Traffic (Unicode)"; flow:to_server,established; content:"|FF|SMB|a2|"; offset:4; depth:5; byte_test:1,&,0x80,6,relative; content:"|5c 00|m|00|s|00|u|00|t|00|a|00|6|00|4|00|.|00|d|00|l|00|l"; reference:url,www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis; classtype:trojan-activity; sid:2020176; rev:3; metadata:created_at 2015_01_13, updated_at 2015_01_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Used by many programs/Quip/Aura/Spotify/Chatty"; ja3_hash; content:"f28d34ce9e732f644de2350027d74c3f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028519; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $HOME_NET [139,445] (msg:"ET MALWARE Skeleton Key Filename in SMB Traffic (Unicode)"; flow:to_server,established; content:"|FF|SMB|a2|"; offset:4; depth:5; byte_test:1,&,0x80,6,relative; content:"|5c 00|o|00|l|00|e|00|6|00|4|00|.|00|d|00|l|00|l"; reference:url,www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis; classtype:trojan-activity; sid:2020177; rev:3; metadata:created_at 2015_01_13, updated_at 2015_01_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Used by many programs/Quip/Spotify/Dropbox/GitHub Desktop/etc"; ja3_hash; content:"190dfb280fe3b541acc6a2e5f00690e6"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028520; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $HOME_NET [139,445] (msg:"ET MALWARE Skeleton Key Filename in SMB Traffic (Unicode)"; flow:to_server,established; content:"|FF|SMB|a2|"; offset:4; depth:5; byte_test:1,&,0x80,6,relative; content:"|5c 00|o|00|l|00|e|00|.|00|d|00|l|00|l"; reference:url,www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis; classtype:trojan-activity; sid:2020178; rev:3; metadata:created_at 2015_01_13, updated_at 2015_01_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Used by many programs/Slack/Postman/Spotify/Google Chrome"; ja3_hash; content:"20dd18bdd3209ea718989030a6f93364"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028521; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $HOME_NET [139,445] (msg:"ET MALWARE Skeleton Key Filename in SMB2 Traffic"; flow:established,to_server; content:"|FE|SMB|40|"; offset:4; depth:5; content:"|16 00|"; distance:0; content:"m|00|s|00|u|00|t|00|a|00|6|00|4|00|.|00|d|00|l|00|l"; distance:8; within:21; reference:url,www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis; classtype:trojan-activity; sid:2020382; rev:5; metadata:created_at 2015_02_07, former_category MALWARE, updated_at 2015_02_07;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Valve Steam Client #1"; ja3_hash; content:"2d96ffb535c7c7a30cad924b9b9f2b52"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028522; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $HOME_NET [139,445] (msg:"ET MALWARE Skeleton Key Filename in SMB2 Traffic"; flow:established,to_server; content:"|FE|SMB|40|"; offset:4; depth:5; content:"|12 00|"; distance:0; content:"o|00|l|00|e|00|6|00|4|00|.|00|d|00|l|00|l"; distance:8; within:17; reference:url,www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis; classtype:trojan-activity; sid:2020383; rev:4; metadata:created_at 2015_02_07, updated_at 2015_02_07;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Valve Steam Client #2"; ja3_hash; content:"ab1fa6468096ab057291aa381d5de2b7"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028523; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $HOME_NET [139,445] (msg:"ET MALWARE Skeleton Key Filename in SMB2 Traffic"; flow:established,to_server; content:"|FE|SMB|40|"; offset:4; depth:5; content:"|0e 00|"; distance:0; content:"o|00|l|00|e|00|.|00|d|00|l|00|l"; distance:8; within:13; reference:url,www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis; classtype:trojan-activity; sid:2020384; rev:2; metadata:created_at 2015_02_07, updated_at 2015_02_07;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Viber"; ja3_hash; content:"e0224fc1c33658f2d3d963bfb0a76a85"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028524; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/AlienSpy RAT Checkin"; flow:established,to_server; flowbits:isset,ET.rat.alienspy; content:"|78 70|"; depth:2; content:"|1f 8b 08 00 00 00 00 00 00 00 6d|"; distance:4; within:11; pcre:"/^[\x53\x54]/R"; reference:url,contagiodump.blogspot.com/2014/11/alienspy-java-rat-samples-and-traffic.html?m=1; classtype:command-and-control; sid:2019739; rev:3; metadata:created_at 2014_11_18, former_category MALWARE, updated_at 2014_11_18;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - VirtualBox Update Poll (tested 5.0.8 r103449)"; ja3_hash; content:"41e3681b7c8c915e33b1f80d275c19d5"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028525; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET MALWARE MSIL/Golroted.B Keylogger FTP"; flow:established,to_server; content:"STOR Logger_"; reference:md5,b2b82fd662dd0ddf53aa37bb9025bf92; classtype:trojan-activity; sid:2020411; rev:1; metadata:created_at 2015_02_12, updated_at 2015_02_12;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - VLC"; ja3_hash; content:"81fb3e51bf3f18c5755146c28d07431b"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028526; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 21 (msg:"ET MALWARE Predator Pain Keylogger FTP"; flow:established,to_server; content:"STOR Predator_Pain"; reference:md5,c9025c9835d1b7d6f0dd2390ea7d5e18; classtype:trojan-activity; sid:2020412; rev:1; metadata:created_at 2015_02_12, updated_at 2015_02_12;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - VMWare Fusion / Workstation / Player Update Check 8.x-12.x"; ja3_hash; content:"cff90930827e8b0f4e5a6fcc17319954"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028527; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Gulcrypt.B Downloading components"; flow:established,from_server; flowbits:isset,ET.Gulcrypt; file_data; content:"MZ"; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; reference:md5,6c41449d6c3efd4c9f98374a0d132ff6; classtype:trojan-activity; sid:2020421; rev:2; metadata:created_at 2015_02_13, updated_at 2015_02_13;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - VMWare Update Check 6.x"; ja3_hash; content:"a50a861119aceb0ccc74902e8fddb618"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028528; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Carbanak APT CnC Beacon 2"; flow:established,to_server; content:"|00 00|OS|3a 20|"; offset:10; depth:6; fast_pattern; content:"|2c 20|Domain|3a 20|"; distance:0; content:"|2c 20|User|3a 20|"; distance:0; content:"|00|"; distance:0; reference:url,securelist.com/files/2015/02/Carbanak_APT_eng.pdf; classtype:targeted-activity; sid:2020456; rev:1; metadata:attack_target Client_Endpoint, created_at 2015_02_17, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_02_17, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - VMware vSphere Client (Tested v4.1.0)"; ja3_hash; content:"48e69b57de145720885af2894f2ab9e7"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028529; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE SuperFish Possible SSL Cert CnC Traffic"; flow:established,from_server; content:"|55 04 0a|"; content:"|0e|Superfish Inc."; distance:1; within:15; content:"|55 04 03|"; distance:0; content:"|19|*.best-deals-products.com"; distance:1; within:26; reference:url,blog.erratasec.com/2015/02/extracting-superfish-certificate.html; reference:url,myce.com/news/lenovo-laptops-come-with-preinstalled-advertisement-injecting-adware-74290/; classtype:command-and-control; sid:2020492; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_02_20, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - vpnkit"; ja3_hash; content:"01319090aea981dde6fc8d6ae71ead54"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028530; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Carbanak APT CnC Beacon 1"; flow:established,to_server; dsize:24; content:"|08|"; depth:1; byte_extract:1,1,Carbanak.Pivot,relative; byte_test:1,!=,Carbanak.Pivot,0,relative; byte_test:1,=,Carbanak.Pivot,3,relative; content:"|00 00 00 02 00 00 00 00 00 00 00 00 00|"; distance:4; within:13; fast_pattern; content:!"|00 00 00|"; within:3; reference:md5,6ae1bb06d10f253116925371c8e3e74b; reference:url,securelist.com/files/2015/02/Carbanak_APT_eng.pdf; classtype:targeted-activity; sid:2020455; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_02_17, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_02_17, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - w3af (tested: v1.6.54 Kali 1)"; ja3_hash; content:"10a686de1c41107df06c21df245e24cd"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028531; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 94 65 e5 77 66 3b be 2b|"; distance:0; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|MyCompany Ltd|2e|"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020564; rev:2; metadata:attack_target Client_and_Server, created_at 2015_02_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - w3af (tested: v1.6.54 Kali 2)"; ja3_hash; content:"f13e6d84b915e17f76fdf4ea8c959b4d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028532; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 94 65 e5 77 66 3b be 2b|"; distance:0; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|MyCompany Ltd|2e|"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020567; rev:2; metadata:attack_target Client_and_Server, created_at 2015_02_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - w3af (tested: v1.6.54 Kali 3)"; ja3_hash; content:"345b5717dae9006a8bcd4cb1a5f09891"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028533; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET !1433 (msg:"ET MALWARE Unknown Trojan Downloading PE via MSSQL Connection to Non-Standard Port"; flow:from_server,established; flowbits:isset,ET.MSSQL; content:"MZ"; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; reference:md5,754b48c57a00b7c9f0e0640166ac7bb5; classtype:trojan-activity; sid:2020569; rev:1; metadata:created_at 2015_02_25, updated_at 2015_02_25;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - w3c HTML Validator"; ja3_hash; content:"74ebac04b642a0cab032dd46e8099fdc"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028534; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (CryptoLocker CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 c5 a5 39 20 2d fb d7 22|"; within:35; fast_pattern; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020582; rev:2; metadata:attack_target Client_and_Server, created_at 2015_03_02, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - w3c HTML Validator, java,eclipse"; ja3_hash; content:"4056657a50a8a4e5cfac40ba48becfa2"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028535; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre SSL Cert www.eshaalfoundation.org"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 c2 06 49 5e 75 fb 3f 44|"; within:35; fast_pattern; content:"|55 04 03|"; content:"|18|www.eshaalfoundation.org"; distance:1; within:25; reference:md5,e36073ba13e2df22348cd624ab0a9fbc; classtype:trojan-activity; sid:2020624; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_03_06, deployment Perimeter, former_category CURRENT_EVENTS, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - w3m (tested: 0.5.3 OS X)"; ja3_hash; content:"975ef0826e8485f2335db71873cb34c6"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028536; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 cd 0b f5 0a 93 34 88 77|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020625; rev:2; metadata:attack_target Client_and_Server, created_at 2015_03_06, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - w3m 0.5.3 (OS X version)"; ja3_hash; content:"6b4b535249a1dcd95e3b4b6e9e572e5e"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028537; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 b0 11 9a 92 44 f0 ee 1a|"; distance:0; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|MyCompany Ltd|2e|"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020647; rev:2; metadata:attack_target Client_and_Server, created_at 2015_03_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - w3m 0.5.3 / lynx 3.2 / svn 1.8.10 (openSUSE Leap 42.1)"; ja3_hash; content:"575771dbc723df24b764ac0303c19d10"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028538; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible malicious Office doc hidden in XML file"; flow:established,from_server; file_data; content:""; nocase; distance:0; content:"macrosPresent=|22|yes|22|"; distance:0; fast_pattern; reference:url,trustwave.com/Resources/SpiderLabs-Blog/Attackers-concealing-malicious-macros-in-XML-files/; classtype:trojan-activity; sid:2020657; rev:2; metadata:created_at 2015_03_10, updated_at 2015_03_10;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Web"; ja3_hash; content:"0172e9e41a8940e6a809967e4835214a"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028539; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Banker Boleto Fraud JS_BROBAN.SM Firefox Plug-In Download"; flow:to_client,established; file_data; content:"PK|03 04|"; distance:0; content:"/addon-sdk/"; content:"|00 00|resources|2f|numberchangerfirefox|2f|PK"; distance:0; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/multiplatform-boleto-fraud-hits-users-in-brazil/; classtype:trojan-activity; sid:2020653; rev:3; metadata:created_at 2015_03_09, updated_at 2015_03_09;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - WebKit per Safari 9.0.1 (11601.2.7.2)"; ja3_hash; content:"58d97971a14d0520c5c56caa75470948"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028540; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 c5 a3 08 37 22 97 2f 50|"; distance:0; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|MyCompany Ltd|2e|"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020687; rev:2; metadata:attack_target Client_and_Server, created_at 2015_03_12, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - WebKit per Safari 9.0.1 (11601.2.7.2)"; ja3_hash; content:"9ef7a86952e78eeb83590ff4d82a5538"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028541; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 d7 2b 72 5e 83 81 97 47|"; distance:0; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|MyCompany Ltd|2e|"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020688; rev:2; metadata:attack_target Client_and_Server, created_at 2015_03_13, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - WeeChat"; ja3_hash; content:"8e1172bd5dcc4698928c7eb454a2c3de"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028542; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ransomware CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 a7 90 ac fd cd 02 3c 0d|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:command-and-control; sid:2020689; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_03_13, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, tag Ransomware, updated_at 2016_07_01, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - wget (tested GNU Wget 1.16.1 & 1.17 on OS X)"; ja3_hash; content:"5f1d4c631ddedf942033c9ae919158b8"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028543; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 c9 a9 58 45 25 d7 de 84|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020697; rev:2; metadata:attack_target Client_and_Server, created_at 2015_03_16, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - wget 1.14 (openSUSE Leap 42.1)"; ja3_hash; content:"70663c6da28b3b9ac281d7b31d6b97c3"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028544; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux.DDoS Checkin"; flow:established,to_server; dsize:1024; content:"VERSONEX|3a|"; depth:9; content:"|7c|Hacker|00 00 00|"; distance:0; reference:md5,0eab12cebbf1c8f25d82c65f34aab9d7; classtype:command-and-control; sid:2019172; rev:4; metadata:created_at 2014_08_19, former_category MALWARE, updated_at 2014_08_19;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Wii-U"; ja3_hash; content:"444434ebe3f52b8453c3803bff077ebd"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028545; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ransomware CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 bf 74 65 6a f0 91 13 26|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:command-and-control; sid:2020735; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_03_24, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, tag Ransomware, updated_at 2016_07_01, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Win default thing a la webkit"; ja3_hash; content:"c8d1364bba308db5a4a20c65c58ffde1"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028546; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert udp any 53 -> $HOME_NET any (msg:"ET MALWARE Win32.Hyteod.acox Domain Generation Algorithm (DGA) Lookup NXDOMAIN Response"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|su|00|"; distance:53; within:4; content:"|32|"; distance:-55; within:1; pcre:"/^[a-z0-9]{50}/R"; threshold: type both, track by_src, count 3, seconds 60; classtype:trojan-activity; sid:2020741; rev:1; metadata:created_at 2015_03_25, updated_at 2015_03_25;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Win10 Mail Client"; ja3_hash; content:"123b8f4705d525caffa3f2b36447f481"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028547; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert udp any 53 -> $HOME_NET any (msg:"ET MALWARE Win32.Hyteod.acox Domain Generation Algorithm (DGA) Lookup NXDOMAIN Response"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; content:"|00 01 00 00 00 01|"; offset:4; depth:6; content:"|02|ru|00|"; distance:53; within:4; content:"|32|"; distance:-55; within:1; pcre:"/^[a-z0-9]{50}/R"; threshold: type both, track by_src, count 3, seconds 60; classtype:trojan-activity; sid:2020742; rev:1; metadata:created_at 2015_03_25, updated_at 2015_03_25;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Windows 10 Native Connection"; ja3_hash; content:"aee020803d10a4d39072817184c8eedc"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028548; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 d5 72 08 75 83 27 6f ba|"; distance:0; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|MyCompany Ltd|2e|"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020745; rev:2; metadata:attack_target Client_and_Server, created_at 2015_03_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Windows 10 WebSockets (inc Edge) #1"; ja3_hash; content:"205200cdaac61b110838556b834070d1"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028549; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ransomware CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ac 19 e6 fb 11 28 a2 20|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:command-and-control; sid:2020802; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_03_30, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, tag Ransomware, updated_at 2016_07_01, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Windows 10 WebSockets (inc Edge) #2"; ja3_hash; content:"5a0fa8873e5ffe7d9385647adc8912d7"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028550; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Volatile Cedar Win32.Explosive CnC Beacon 1"; flow:established,to_server; content:"==gKg5XI+BmK"; depth:12; reference:md5,11657162940dcc1c124e607b0f248039; reference:url,checkpoint.com/downloads/volatile-cedar-technical-report.pdf; classtype:command-and-control; sid:2020807; rev:1; metadata:attack_target Client_Endpoint, created_at 2015_03_31, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_03_31, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Windows 8.x Apps Store thing (unconfirmed)"; ja3_hash; content:"a7b2f0639f58f97aec151e015be1f684"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028551; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Volatile Cedar Win32.Explosive CnC Beacon 2"; flow:established,to_server; content:"|3C 2A 60|"; depth:3; fast_pattern; content:"|60 2A 3E|"; distance:0; pcre:"/^\x3c\x2a\x60[\x20-\x7e]+\x60\x2a\x3e$/"; reference:url,checkpoint.com/downloads/volatile-cedar-technical-report.pdf; classtype:command-and-control; sid:2020808; rev:1; metadata:attack_target Client_Endpoint, created_at 2015_03_31, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_03_31, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Windows 8.x Builtin Mail Client"; ja3_hash; content:"0d15924fe8f8950a3ec3a916e97c8498"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028552; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Volatile Cedar Win32.Explosive CnC Beacon 3"; flow:established,to_server; content:">Explosive"; offset:4; depth:10; reference:url,checkpoint.com/downloads/volatile-cedar-technical-report.pdf; classtype:command-and-control; sid:2020809; rev:1; metadata:attack_target Client_Endpoint, created_at 2015_03_31, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_03_31, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Windows 8.x TLS Socket"; ja3_hash; content:"a8ee937cf82bb0972fecc23d63c9cd82"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028553; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 6666:7000 (msg:"ET MALWARE IRC Bot dropped by Mikey Variant CnC Beacon"; flow:established,to_server; content:"["; content:"]"; distance:0; content:"["; distance:0; content:"]"; distance:0; content:"|0d 0a|NICK|20|"; pcre:"/^[a-z0-9]+\[\d+\]/R"; content:"-"; distance:0; content:"["; distance:0; pcre:"/^\d+\]\r\n$/R"; reference:md5,0ebaf8a6292237b33045f5e81947004b; classtype:command-and-control; sid:2020836; rev:1; metadata:attack_target Client_Endpoint, created_at 2015_04_02, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_04_02, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Windows Watson WCEI Telemetry Gather"; ja3_hash; content:"2c14bfb3f8a2067fbc88d8345e9f97f3"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028554; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET 3460 (msg:"ET MALWARE PoisonIvy Key Exchange with CnC Init"; flow:established,to_server; dsize:256; flowbits:set,ET.Poison1; flowbits:noalert; reference:url,doc.emergingthreats.net/2008380; classtype:command-and-control; sid:2008380; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - wineserver"; ja3_hash; content:"84607748f3887541dd60fe974a042c71"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028555; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET 3460 -> $HOME_NET any (msg:"ET MALWARE PoisonIvy Key Exchange with CnC Response"; flow:established,from_server; dsize:256; flowbits:isset,ET.Poison1; reference:url,doc.emergingthreats.net/2008381; classtype:command-and-control; sid:2008381; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Yahoo! Slurp Indexer"; ja3_hash; content:"1202a58b454f54a47d2c216567ebd4fb"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028557; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE PoisonIvy RAT/Backdoor follow on POST Data PUSH Packet"; flow:established,to_server; flags:AP,12; content:"op="; nocase; content:"&servidor="; nocase; content:"&senha="; nocase; content:"&usuario="; nocase; content:"&base="; nocase; content:"&sgdb="; nocase; reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FPoisonivy.I&ThreatID=-2147363597; reference:url,www.viruslist.com/en/viruses/encyclopedia?virusid=133781; reference:url,doc.emergingthreats.net/2009806; classtype:trojan-activity; sid:2009806; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Yahoo! Slurp Indexer"; ja3_hash; content:"de364c46b0dfc283b5e38c79ceae3f8f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028558; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Chorns/PoisonIvy related Backdoor Initial Connection"; flow:established; dsize:12; content:"/FIRSTINF/|0d0a|"; reference:url,doc.emergingthreats.net/2010344; reference:md5,9fbd691ffdb797cebe8761006b26b572; classtype:trojan-activity; sid:2010344; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Yandex Bot, wget 1.18"; ja3_hash; content:"d83881675de3f6aacbcc0b2bae6f8923"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028559; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Chorns/PoisonIvy related Backdoor Keep Alive"; flow:established; dsize:12; content:"/AVAILABL/|0d0a|"; reference:url,doc.emergingthreats.net/2010345; reference:md5,9fbd691ffdb797cebe8761006b26b572; classtype:trojan-activity; sid:2010345; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - youtube-dl 2016.06.03 (openSUSE Leap 42.1)"; ja3_hash; content:"11404429d240670cc018bed04e918b6f"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028560; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy.2013Jan04 victim beacon"; flow:established,to_server; dsize:48; content:"|1e de 5c f1 1f f6 94 12 d1 fa f1 42 8c fe 8d f7|"; offset:16; depth:16; reference:md5,62f20326e0f08c0786df6886f0427ea7; classtype:trojan-activity; sid:2016167; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_01_05, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Major, tag PoisonIvy, tag c2, updated_at 2016_07_01, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Zite (Android) 1 - May collide with Chrome"; ja3_hash; content:"f8f5b71e02603b283e55b50d17ede861"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028561; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE PoisonIvy.2013Jan04 server response"; flow:established,from_server; dsize:48; content:"|48 3A E9 78 C0 B9 2E 3F 9A 49 C5 56 65 5F CE 22|"; offset:16; depth:16; reference:md5,62f20326e0f08c0786df6886f0427ea7; classtype:trojan-activity; sid:2016168; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_01_05, deployment Perimeter, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Zite (Android) 2 - May collide with Chome"; ja3_hash; content:"5ae88f37a16f1b054f2edff1c8730471"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; classtype:unknown; sid:2028562; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE PoisonIvy Variant Jan 24 2013"; flow:established,from_server; dsize:48; content:"|52 13 34 da 18 3d 2f 45 a2 09 93 52 01 23 51 e3|"; offset: 16; depth:16; reference:url,blog.avast.com/2013/01/22/reporters-without-borders-website-misused-in-wateringhole-attack/; classtype:trojan-activity; sid:2016270; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_01_25, deployment Perimeter, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - ZwiftApp"; ja3_hash; content:"c2b4710c6888a5d47befe865c8e6fb19"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028563; rev:1; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy Variant Jan 24 2013"; flow:established,to_server; dsize:48; content:"|84 a5 f0 be 11 da ce 7e c9 4a 9a af 40 24 8a f5|"; offset:16; depth:16; reference:url,blog.avast.com/2013/01/22/reporters-without-borders-website-misused-in-wateringhole-attack/; classtype:trojan-activity; sid:2016271; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_01_25, deployment Perimeter, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Lets Encrypt Free SSL Cert Observed in Possible Coinhive Javascript Cryptocurrency Mining"; flow:established,from_server; content:"|55 04 0a|"; content:"|0d|Let|27|s Encrypt"; distance:1; within:14; fast_pattern; content:"|55 04 03|"; distance:0; content:"coin-hive"; within:50; nocase; pcre:!"/#http:\/\/cert.*coinhive/i"; reference:url,coin-hive.com; classtype:policy-violation; sid:2024720; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_09_18, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, updated_at 2020_08_20;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PoisonIvy [victim beacon]"; flow:established; dsize:48; content:"|a160339a8a1b3bc0d1ab956cf98855a8|"; offset: 16; depth:16; classtype:trojan-activity; sid:2017052; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_06_22, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Major, tag PoisonIvy, tag c2, updated_at 2016_07_01, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE [TGI] Cobalt Strike Malleable C2 Response (O365 Profile) M2"; flow:established,to_client; http.header; content:"16723708fc9|0d 0a|X-CalculatedBETarget|3a 20|BY2PR06MB549.namprd06.prod.outlook.com"; content:"X-FEServer|3a 20|CY4PR02CA0010"; distance:0; reference:md5,a26722fc7e5882b5a273239cddfe755f; reference:url,attack.mitre.org/groups/G0080/; classtype:command-and-control; sid:2028589; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_09_17, deployment Perimeter, former_category MALWARE, malware_family Cobalt_Strike, signature_severity Major, updated_at 2019_09_17, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1001, mitre_technique_name Data_Obfuscation;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE PoisonIvy [server response]"; flow:established; dsize:48; content:"|b8abf415033717b74132d503b6ea381d|"; offset:16; depth:16; classtype:trojan-activity; sid:2017053; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_06_22, deployment Perimeter, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE [TGI] Cobalt Strike Malleable C2 Response (YouTube Profile)"; flow:established,to_client; http.header; content:"Frontend Proxy|0d 0a|Set-Cookie|3a 20|YSC=LT4ZGGSgKoE|3b|"; fast_pattern; content:"X-FEServer|3a 20|CY4PR02CA0010"; distance:0; reference:md5,69c6e302cc4394cae7ed8c6f7b288e92; reference:url,attack.mitre.org/groups/G0080/; classtype:command-and-control; sid:2028590; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_09_17, deployment Perimeter, former_category MALWARE, malware_family Cobalt_Strike, signature_severity Major, updated_at 2019_09_17, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1001, mitre_technique_name Data_Obfuscation;)
+alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Miniduke variant FTP upload"; flow:to_server,established; content:"USER "; pcre:"/^(?:(?:menelao|ho[mr]u)s|adair|johan|kweku)\r\n/R"; reference:md5,e175be029dd2b78c059278a567b3ada1; reference:url,www.f-secure.com/static/doc/labs_global/Whitepapers/cosmicduke_whitepaper.pdf; classtype:targeted-activity; sid:2023911; rev:4; metadata:created_at 2014_07_03, former_category MALWARE, updated_at 2017_02_16;)
 
-alert http any any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible GhostMiner CCBOT Component - CnC Checkin"; flow:established,to_server; content:"/Update/CC/CC.php"; startswith; endswith; fast_pattern; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/fileless-cryptocurrency-miner-ghostminer-weaponizes-wmi-objects-kills-other-cryptocurrency-mining-payloads/; classtype:command-and-control; sid:2028604; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_09_19, deployment Perimeter, former_category MALWARE, malware_family GhostMiner, performance_impact Low, signature_severity Major, updated_at 2019_09_19;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 a1 b6 29 6e e4 aa ec fe|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020843; rev:2; metadata:attack_target Client_and_Server, created_at 2015_04_06, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS PHPStudy Remote Code Execution Backdoor"; flow:established,to_server; http.method; content:"GET"; http.header; content:"Accept-Charset|3a 20|"; fast_pattern; nocase; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x0d\x0a/R"; reference:url,www.cnblogs.com/-qing-/p/11575622.html; reference:url,www.uedbox.com/post/59265/; classtype:attempted-admin; sid:2028629; rev:1; metadata:affected_product Web_Server_Applications, attack_target Server, created_at 2019_09_25, deployment Perimeter, former_category WEB_SPECIFIC_APPS, performance_impact Significant, signature_severity Major, updated_at 2019_09_25;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Enchanim C2 Injection Download"; flow:established,to_client; content:"set_url "; content:"|0d 0a|data_before|0d 0a|"; distance:0; content:"|0d 0a|data_end|0d 0a|"; distance:0; content:"|0d 0a|data_inject|0d 0a|"; distance:0; fast_pattern; content:"|0d 0a|data_end|0d 0a|"; distance:0; content:"|0d 0a|data_after|0d 0a|"; distance:0; content:"|0d 0a|data_end|0d 0a|"; distance:0; reference:md5,2642999a085443e9055b292c4d405e64; reference:md5,37066ed52cd7510bf04808c332599f1c; reference:url,www.seculert.com/blog/2013/04/magic-persistent-threat.html; classtype:command-and-control; sid:2016771; rev:5; metadata:created_at 2013_04_19, former_category MALWARE, updated_at 2013_04_19;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Hyves Inbox Access"; flow:established,to_server; content:"Host|3a| www.hyves."; http_header; content:"/messages/inbox/"; http_uri; reference:url,doc.emergingthreats.net/2007628; classtype:policy-violation; sid:2007628; rev:6; metadata:created_at 2010_07_30, updated_at 2019_09_26;)
+#alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TinyLoader.A Sending UUID and Processes x86"; content:"|00 00 00 02 00 00 00 00 00 00 32 32|"; depth:12; content:"|7b|"; distance:0; pcre:"/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\x7d/R"; reference:md5,ad7e8dd9140d02f47eca2d8402e2ecc4; classtype:trojan-activity; sid:2020152; rev:2; metadata:created_at 2015_01_07, updated_at 2015_01_07;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Hyves Message Access"; flow:established,to_server; content:"Host|3a| www.hyves."; http_header; content:"/messages/inbox/messages/"; http_uri; reference:url,doc.emergingthreats.net/2007629; classtype:policy-violation; sid:2007629; rev:6; metadata:created_at 2010_07_30, updated_at 2019_09_26;)
+#alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TinyLoader.A Sending UUID and Processes x64"; content:"|00 00 00 02 00 00 00 00 00 00 64 32|"; depth:12; content:"|7b|"; distance:0; pcre:"/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\x7d/R"; reference:md5,ad7e8dd9140d02f47eca2d8402e2ecc4; classtype:trojan-activity; sid:2020153; rev:3; metadata:created_at 2015_01_07, updated_at 2015_01_07;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Hyves Compose Message"; flow:established,to_server; content:"Host|3a| www.hyves."; http_header; content:"index.php?l1=mg"; http_uri; reference:url,doc.emergingthreats.net/2007630; classtype:policy-violation; sid:2007630; rev:7; metadata:created_at 2010_07_30, updated_at 2019_09_26;)
+#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|55 04 03|"; content:"|04|gu2m"; distance:1; within:5; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020864; rev:2; metadata:attack_target Client_and_Server, created_at 2015_04_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Hyves Message Submit"; flow:established,to_server; content:"Host|3a| www.hyves."; http_header; content:"/messages/"; http_uri; content:"POST"; http_method; content:"/messages/"; http_uri; content:"postman_secret"; reference:url,doc.emergingthreats.net/2007631; classtype:policy-violation; sid:2007631; rev:7; metadata:created_at 2010_07_30, updated_at 2019_09_26;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET [25,465,587] (msg:"ET MALWARE Kriptovor SMTP Traffic"; flow:established,to_server; content:"|0d 0a|PC|3a 20|"; content:"|0d 0a|Text|3a 20|"; distance:0; content:"|0d 0a|IP|3a 20|"; distance:0; content:"|0d 0a|TS|3a 20|"; distance:0; reference:url,fireeye.com/blog/threat-research/2015/04/analysis_of_kriptovo.html; reference:md5,c3ab87f85ca07a7d026d3cbd54029bbe; classtype:trojan-activity; sid:2020884; rev:1; metadata:created_at 2015_04_09, updated_at 2015_04_09;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Tech Support Phone Scam Landing Aug 10 M3"; flow:from_server,established; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"SYSTEM ERROR"; fast_pattern; nocase; content:"getURLParameter"; distance:0; content:"decodeURI"; distance:0; content:"loadNumber"; distance:0; content:"confirmExit"; distance:0; classtype:social-engineering; sid:2023039; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_08_10, deployment Perimeter, former_category WEB_CLIENT, performance_impact Low, signature_severity Major, tag Phishing, updated_at 2019_09_26;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Netwire RAT Check-in"; flow:established,to_server; dsize:>68; content:"|41 00 00 00 03|"; depth:5; flowbits:set,ET.NetwireRAT.Client; flowbits:noalert; reference:url,www.circl.lu/pub/tr-23/; classtype:trojan-activity; sid:2018426; rev:2; metadata:created_at 2014_04_28, updated_at 2014_04_28;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT EITest SocENG Payload DL"; flow:established,from_server; content:"|3b 20 66 69 6c 65 6e 61 6d 65 3d 43 68 72 ce bf 6d d0 b5 20 66 ce bf 6e e1 b9 ab 2e 65 78 65|"; http_header; nocase; file_data; content:"MZ"; within:2; classtype:social-engineering; sid:2024198; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_04_11, deployment Perimeter, former_category CURRENT_EVENTS, malware_family EITest, signature_severity Major, updated_at 2019_09_26;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE CoinVault CnC Beacon Response"; flow:established,from_server; file_data; content:"eyJrbm9ja3RpbWUiOj"; within:18; reference:md5,c7e34daa9e9160ce433a6cae74867711; reference:url,kernelmode.info/forum/viewtopic.php?f=16&t=3581; classtype:command-and-control; sid:2020909; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_04_14, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_04_14, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert tcp $HOME_NET any -> [85.93.0.0/24,194.165.16.0/24,31.184.192.0/24] 80 (msg:"ET EXPLOIT_KIT EITest Flash Redirect Aug 09 2016"; flow:established,to_server; urilen:>20; content:"x-flash-version|3a 20|"; http_header; content:!"/crossdomain.xml"; http_header; content:!".swf"; http_header; nocase; content:!".flv"; http_header; nocase; content:!"[DYNAMIC]"; http_header; content:!".swf"; nocase; http_uri; content:!".flv"; nocase; http_uri; content:!"/crossdomain.xml"; http_uri; content:!"|0d 0a|Cookie|3a|"; classtype:exploit-kit; sid:2023036; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_08_10, deployment Perimeter, performance_impact Low, signature_severity Major, tag Redirector, updated_at 2019_09_26;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Unit42 PoisonIvy Keepalive to CnC"; flow:established,to_server; dsize:48; content:"|b8 98 30 04 e8 10 e5 8c e4 06 39 1b e0 51 96 40|"; offset:16; depth:16; reference:url,researchcenter.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/; classtype:command-and-control; sid:2020923; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_04_16, deployment Perimeter, former_category MALWARE, malware_family PoisonIvy, signature_severity Critical, tag PoisonIvy, updated_at 2016_07_01;)
 
-alert tcp $HOME_NET any -> $HOME_NET 2555 (msg:"ET SCAN Internal to Internal UPnP Request tcp port 2555"; flow:established,to_server; content:"GET "; depth:4; content:"/upnp/"; nocase; pcre:"/^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{16}\//Ri"; reference:url,www.upnp-hacks.org/upnp.html; reference:url,doc.emergingthreats.net/2008092; classtype:attempted-recon; sid:2008092; rev:4; metadata:created_at 2010_07_30, updated_at 2019_09_26;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Dalexis downloader encrypted binary (1)"; flow:established,to_client; file_data; content:"|fc 6e 8e d1 0a 7a be 86|"; within:2048; classtype:trojan-activity; sid:2020929; rev:2; metadata:created_at 2015_04_16, updated_at 2015_04_16;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET 2555 (msg:"ET SCAN External to Internal UPnP Request tcp port 2555"; flow:established,to_server; content:"GET "; depth:4; content:"/upnp/"; nocase; pcre:"/^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{16}\//Ri"; reference:url,www.upnp-hacks.org/upnp.html; reference:url,doc.emergingthreats.net/2008093; classtype:attempted-recon; sid:2008093; rev:6; metadata:created_at 2010_07_30, updated_at 2019_09_26;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Dalexis downloader encrypted binary (2)"; flow:established,to_client; file_data; content:"|35 8c 0c 43 e2 1c f7 e4|"; distance:40; within:8; classtype:trojan-activity; sid:2020930; rev:2; metadata:created_at 2015_04_16, updated_at 2015_04_16;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET 7777 (msg:"ET WEB_SERVER Oracle Secure Enterprise Search 10.1.8 search Script XSS attempt"; flow:to_server,established; content:"GET "; depth:4; content:"/search/query/search"; nocase; content:"search_p_groups="; nocase; content:"script"; nocase; pcre:"/<?(java|vb)?script>?/i"; reference:url,dsecrg.com/pages/vul/show.php?id=125; reference:url,doc.emergingthreats.net/2009643; classtype:web-application-attack; sid:2009643; rev:6; metadata:created_at 2010_07_30, updated_at 2019_09_26;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Dalexis downloader encrypted binary (3)"; flow:established,to_client; file_data; content:"|fc 6e 8e d1 0a 7a be 86|"; distance:32; within:8; classtype:trojan-activity; sid:2020931; rev:2; metadata:created_at 2015_04_16, updated_at 2015_04_16;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET 7011 (msg:"ET WEB_SERVER Oracle BEA Weblogic Server 10.3 searchQuery XSS attempt"; flow:to_server,established; content:"GET "; depth:4; content:"/consolehelp/console-help.portal"; nocase; content:"searchQuery="; nocase; content:"script"; nocase; pcre:"/<?(java|vb)?script>?.*<.+\/script>?/i"; reference:url,dsecrg.com/pages/vul/show.php?id=131; reference:url,doc.emergingthreats.net/2009644; classtype:web-application-attack; sid:2009644; rev:6; metadata:created_at 2010_07_30, updated_at 2019_09_26;)
+#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|10 58 85 8a 21 5a 27 a4 1f be 8f a1 3a f0 13 c5 94|"; within:40; content:"|55 04 03|"; distance:0; content:"|13|www.tennomewerto.ru"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020932; rev:2; metadata:attack_target Client_and_Server, created_at 2015_04_16, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/Adware.iBryte.BO CnC Activity"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/impression.do/?event="; depth:22; fast_pattern; content:"&user_id="; distance:0; http.user_agent; content:"download manager"; reference:md5,be6363e960d9a40b8e8c5825b13645c7; classtype:pup-activity; sid:2028633; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_09_26, deployment Perimeter, former_category ADWARE_PUP, performance_impact Low, signature_severity Major, tag PUP, updated_at 2019_09_26;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Windows nbtstat -s Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"NetBIOS Connection Table"; fast_pattern; content:"Local Name"; distance:0; content:"State"; distance:0; content:"In/Out"; distance:0; content:"Remote Host"; distance:0; content:"Input"; distance:0; content:"Output"; distance:0; classtype:trojan-activity; sid:2020957; rev:2; metadata:created_at 2015_04_21, updated_at 2015_04_21;)
 
-#alert tls any any -> any any (msg:"ET DELETED Hash - Google Chrome"; ja3_hash; content:"f58966d34ff9488a83797b55c804724d"; reference:url,github.com/trisulnsm/trisul-scripts/blob/master/lua/frontend_scripts/reassembly/ja3/prints/ja3fingerprint.json; reference:url,raw.githubusercontent.com/salesforce/ja3/master/lists/osx-nix-ja3.csv; classtype:unknown; sid:2028236; rev:2; metadata:created_at 2019_09_10, former_category JA3, updated_at 2019_10_14;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Windows nbtstat -a Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"NetBIOS Remote Machine Name Table"; fast_pattern; content:"Name"; distance:0; content:"Type"; content:"Status"; distance:0; classtype:trojan-activity; sid:2020954; rev:2; metadata:created_at 2015_04_21, updated_at 2015_04_21;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Vaccineprogram.co.kr Related Spyware User Agent (pcsafe)"; flow:established,to_server; content:"User-Agent|3a| pcsafe"; reference:url,doc.emergingthreats.net/2006420; classtype:pup-activity; sid:2006420; rev:8; metadata:created_at 2010_07_30, former_category USER_AGENTS, updated_at 2019_09_27;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Windows nbtstat -n Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"NetBIOS Local Name Table"; fast_pattern; content:"Name"; distance:0; content:"Type"; content:"Status"; distance:0; classtype:trojan-activity; sid:2020955; rev:2; metadata:created_at 2015_04_21, updated_at 2015_04_21;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET P2P Soulseek"; flow: established; content:"slsknet"; reference:url,www.slsknet.org; reference:url,doc.emergingthreats.net/bin/view/Main/2001188; classtype:policy-violation; sid:2001188; rev:9; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE CozyDuke APT HTTP CnC Beacon Response"; flow:established,from_server; file_data; content:"<--"; within:3; pcre:"/^[A-F0-9]{8,12}/R"; content:"-->|0a|<"; fast_pattern; within:5; flowbits:isset,ET.CozyDuke.HTTP; reference:url,securelist.com/blog/69731/the-cozyduke-apt/; reference:md5,98a6484533fa12a9ba6b1bd9df1899dc; classtype:targeted-activity; sid:2020965; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_04_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_04_22, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN DEBUG Method Request with Command"; flow:established,to_server; content:"DEBUG "; depth:6; content:"|0d 0a|Command|3a| "; distance:0; reference:url,doc.emergingthreats.net/2008312; classtype:attempted-recon; sid:2008312; rev:5; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET MALWARE Possible Infection Report Mail - Indy Mail lib and Nome do Computador in Body"; flow:established,to_server; content:"|0d 0a|X-Library|3a| Indy "; content:"Nome do Computador.."; nocase; distance:0; reference:url,doc.emergingthreats.net/2007950; classtype:trojan-activity; sid:2007950; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET SCAN Possible Fast-Track Tool Spidering User-Agent Detected"; flow:established,to_server; content:"|0d 0a|User-Agent|3A| pymills-spider/"; reference:url,www.offensive-security.com/metasploit-unleashed/Fast-Track-Modes; reference:url,doc.emergingthreats.net/2011721; classtype:attempted-recon; sid:2011721; rev:4; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+alert smtp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Email Contains InternetOpen WinInet API Call - Potentially Dridex MalDoc 1"; flow:established,to_server; content:"SW50ZXJuZXRPcGVu"; fast_pattern; classtype:trojan-activity; sid:2021006; rev:2; metadata:created_at 2015_04_24, updated_at 2015_04_24;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET SCAN SQLBrute SQL Scan Detected"; flow:to_server,established; content:"AND not exists (select * from master..sysdatabases)"; offset:60; depth:60; reference:url,www.justinclarke.com/archives/2006/03/sqlbrute.html; reference:url,www.darknet.org.uk/2007/06/sqlbrute-sql-injection-brute-force-tool/; reference:url,doc.emergingthreats.net/2009477; classtype:attempted-recon; sid:2009477; rev:4; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+alert smtp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Email Contains InternetOpen WinInet API Call - Potentially Dridex MalDoc 2"; flow:established,to_server; content:"ludGVybmV0T3Blb"; fast_pattern; classtype:trojan-activity; sid:2021007; rev:2; metadata:created_at 2015_04_24, updated_at 2015_04_24;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET SCAN SQLNinja MSSQL User Scan"; content:"?param=a"; flow:to_server,established; content:"if%20ascii%28substring%28%28select%20system%5Fuser"; distance:2; threshold: type threshold, track by_src, count 20, seconds 10; reference:url,sqlninja.sourceforge.net/index.html; reference:url,doc.emergingthreats.net/2009040; classtype:attempted-recon; sid:2009040; rev:5; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+alert smtp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Email Contains InternetOpen WinInet API Call - Potentially Dridex MalDoc 3"; flow:established,to_server; content:"JbnRlcm5ldE9wZW"; fast_pattern; classtype:trojan-activity; sid:2021008; rev:2; metadata:created_at 2015_04_24, updated_at 2015_04_24;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET SCAN SQLNinja MSSQL Database User Rights Scan"; flow:to_server,established; content:"?param=a"; content:"if%20is%5Fsrvrolemember%28%27sysadmin"; distance:2; reference:url,sqlninja.sourceforge.net/index.html; reference:url,doc.emergingthreats.net/2009041; classtype:attempted-recon; sid:2009041; rev:5; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+alert smtp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Email Contains wininet.dll Call - Potentially Dridex MalDoc 1"; flow:established,to_server; content:"d2luaW5ldC5kbG"; fast_pattern; classtype:trojan-activity; sid:2021009; rev:2; metadata:created_at 2015_04_24, updated_at 2015_04_24;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET SCAN SQLNinja MSSQL Authentication Mode Scan"; flow:to_server,established; content:"?param=a"; content:"if%20not%28%28select%20serverproperty%28%27IsIntegratedSecurityOnly"; distance:2; reference:url,sqlninja.sourceforge.net/index.html; reference:url,doc.emergingthreats.net/2009042; classtype:attempted-recon; sid:2009042; rev:6; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+alert smtp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Email Contains wininet.dll Call - Potentially Dridex MalDoc 2"; flow:established,to_server; content:"dpbmluZXQuZGxs"; fast_pattern; classtype:trojan-activity; sid:2021010; rev:2; metadata:created_at 2015_04_24, updated_at 2015_04_24;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET SCAN SQLNinja Attempt To Recreate xp_cmdshell Using sp_configure"; flow:to_server,established; content:"?param=a"; content:"exec%20master%2E%2Esp%5Fconfigure%20%27show%20advanced%20options"; distance:2; reference:url,sqlninja.sourceforge.net/index.html; reference:url,doc.emergingthreats.net/2009043; classtype:attempted-admin; sid:2009043; rev:5; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+alert smtp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Email Contains wininet.dll Call - Potentially Dridex MalDoc 3"; flow:established,to_server; content:"3aW5pbmV0LmRsb"; fast_pattern; classtype:trojan-activity; sid:2021011; rev:2; metadata:created_at 2015_04_24, updated_at 2015_04_24;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET SCAN SQLNinja Attempt To Create xp_cmdshell Session"; flow:to_server,established; content:"?param=a"; content:"exec%20master%2E%2Exp%5Fcmdshell%20%27cmd%20%2FC%20%25TEMP"; distance:2; reference:url,sqlninja.sourceforge.net/index.html; reference:url,doc.emergingthreats.net/2009044; classtype:attempted-admin; sid:2009044; rev:5; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE CORESHELL Malware Response from server"; flow:from_server,established; file_data; content:"O|00|K|00 00 00|"; within:6; pcre:"/^(?:(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))?$/R"; reference:url,www.fireeye.com/resources/pdfs/apt28.pdf; classtype:trojan-activity; sid:2019584; rev:3; metadata:created_at 2014_10_29, updated_at 2014_10_29;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET SCAN Stompy Web Application Session Scan"; flow:to_server,established; content:"Session Stomper"; offset:100; depth:25; reference:url,www.darknet.org.uk/2007/03/stompy-the-web-application-session-analyzer-tool/; reference:url,doc.emergingthreats.net/2008605; classtype:attempted-recon; sid:2008605; rev:4; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE TorrentLocker SSL Cert"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ea a3 3c b6 6e 62 16 33|"; within:35; fast_pattern; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:md5,8b2b618a463b906a1005ff1ed7d5f875; classtype:trojan-activity; sid:2021014; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_04_27, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET SCAN w3af Scan In Progress ARGENTINA Req Method"; flow:to_server,established; content:"ARGENTINA "; depth:10; reference:url,w3af.sourceforge.net; reference:url,doc.emergingthreats.net/2011027; classtype:attempted-recon; sid:2011027; rev:5; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Ruckguv.A SSL Cert"; flow:established,from_server; content:"|10 05 86 8b f3 dc 2c ad 1f 00 dd ad fa 27 3c ea d0|"; content:"|55 04 03|"; distance:0; content:"|12|thewinesteward.com"; distance:1; within:19; reference:md5,331bec58cb113999f83c866de4976b62; classtype:trojan-activity; sid:2021015; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_04_27, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET SCAN WhatWeb Web Application Fingerprint Scanner Default User-Agent Detected"; flow:established,to_server; content:"|0d 0a|User-Agent|3A| WhatWeb/"; reference:url,www.morningstarsecurity.com/research/whatweb; reference:url,doc.emergingthreats.net/2010960; classtype:attempted-recon; sid:2010960; rev:4; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ransomware CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 bf 88 cb e4 d5 79 99 98|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:command-and-control; sid:2021016; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_04_28, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, tag Ransomware, updated_at 2016_07_01, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX AVTECH Software ActiveX SendCommand Method Buffer Overflow Attempt"; flow:established,to_client; content:"<OBJECT "; nocase; content:"classid"; nocase; distance:0; content:"clsid"; nocase; distance:0; content:"8214B72E-B0CD-466E-A44D-1D54D926038D"; nocase; distance:0; content:"SendCommand"; nocase; reference:url,zeroscience.mk/en/vulnerabilities/ZSL-2010-4934.php; reference:url,exploit-db.com/exploits/12294; reference:url,doc.emergingthreats.net/2011200; classtype:attempted-user; sid:2011200; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Malicious SSL Cert (KINS C2)"; flow:established,from_server; content:"|55 04 03|"; content:"|0f|terriblekira.su"; distance:1; within:16; reference:md5,f752cfdc6aa1d3eac013201357ada0f6; classtype:domain-c2; sid:2021031; rev:1; metadata:attack_target Client_and_Server, created_at 2015_04_30, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX AVTECH Software ActiveX Login Method Buffer Oveflow Attempt"; flow:established,to_client; content:"<OBJECT "; nocase; content:"classid"; nocase; distance:0; content:"clsid"; nocase; distance:0; content:"8214B72E-B0CD-466E-A44D-1D54D926038D"; nocase; distance:0; content:"Login"; nocase; reference:url,zeroscience.mk/en/vulnerabilities/ZSL-2010-4934.php; reference:url,exploit-db.com/exploits/12294; reference:url,doc.emergingthreats.net/2011201; classtype:attempted-user; sid:2011201; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+#alert tcp $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Malicious SSL Cert (KINS C2)"; flow:established,from_server; content:"|55 04 03|"; content:"|0b|lidline.com"; distance:1; within:112; reference:md5,f752cfdc6aa1d3eac013201357ada0f6; classtype:domain-c2; sid:2021032; rev:1; metadata:attack_target Client_and_Server, created_at 2015_04_30, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX AVTECH Software ActiveX _DownloadPBOpen Method Buffer Overflow Attempt"; flow:established,to_client; content:"<OBJECT "; nocase; content:"classid"; nocase; distance:0; content:"clsid"; nocase; distance:0; content:"8214B72E-B0CD-466E-A44D-1D54D926038D"; nocase; distance:0; content:"_DownloadPBOpen"; nocase; reference:url,zeroscience.mk/en/vulnerabilities/ZSL-2010-4934.php; reference:url,exploit-db.com/exploits/12294; reference:url,doc.emergingthreats.net/2011203; classtype:attempted-user; sid:2011203; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux.Trojan.IptabLex Variant Checkin"; flow:to_server,established; dsize:157; content:"|77|"; depth:1; pcre:"/^[\x01\x03\x08\x09\x0b]\x00/R"; content:"|20 40 20|"; distance:0; content:"Hz"; nocase; within:15; reference:md5,019765009f7142a89af15aaaac7400cc; reference:url,blog.malwaremustdie.org/2014/06/mmd-0025-2014-itw-infection-of-elf.html; classtype:command-and-control; sid:2021050; rev:1; metadata:created_at 2015_05_04, former_category MALWARE, updated_at 2015_05_04;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX AVTECH Software ActiveX _DownloadPBClose Method Buffer Overflow Attempt"; flow:established,to_client; content:"<OBJECT "; nocase; content:"classid"; nocase; distance:0; content:"clsid"; nocase; distance:0; content:"8214B72E-B0CD-466E-A44D-1D54D926038D"; nocase; distance:0; content:"_DownloadPBClose"; nocase; reference:url,zeroscience.mk/en/vulnerabilities/ZSL-2010-4934.php; reference:url,exploit-db.com/exploits/12294; reference:url,doc.emergingthreats.net/2011204; classtype:attempted-user; sid:2011204; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET MALWARE Linux.Mumblehard Spam Command CnC"; flow:to_server,established; content:"POST / HTTP/1."; depth:14; content:"|0d 0a 0d 0a 0f 0f|"; pcre:"/^\d{1,3}[0-2]/R"; reference:url,www.welivesecurity.com/wp-content/uploads/2015/04/mumblehard.pdf; reference:md5,86f0b0b74fe8b95b163a1b31d76f7917; classtype:command-and-control; sid:2021053; rev:1; metadata:created_at 2015_05_04, former_category MALWARE, updated_at 2015_05_04;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX AVTECH Software ActiveX Snapshot Method Buffer Overflow Attempt"; flow:established,to_client; content:"<OBJECT "; nocase; content:"classid"; nocase; distance:0; content:"clsid"; nocase; distance:0; content:"8214B72E-B0CD-466E-A44D-1D54D926038D"; nocase; distance:0; content:"Snapshot"; nocase; reference:url,zeroscience.mk/en/vulnerabilities/ZSL-2010-4934.php; reference:url,exploit-db.com/exploits/12294; reference:url,doc.emergingthreats.net/2011202; classtype:attempted-user; sid:2011202; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dyre Downloading Mailer 2"; flow:established,to_server; content:"GET"; http_method; content:".tar"; http_uri; content:!"Accept"; content:!"Connection|3a|"; http_header; content:!"Referer|3a|"; content:"User-Agent|3a 20|Mozilla/5.0 (Windows NT 6.1|3b 20|WOW64|3b 20|Trident/7.0|3b 20|SLCC2|3b 20|.NET CLR 2.0.50727|3b 20|.NET CLR 3.5.30729|3b 20|.NET CLR 3.0.30729|3b 20|Media Center PC 6.0|3b 20|.NET4.0E|3b 20|.NET4.0C|3b 20|rv|3a|11.0) like Gecko|0d 0a|Host|3a|"; http_header; depth:195; pcre:"/^[^\r\n]+\r\n(?:\r\n)?$/RHi"; pcre:"/\.tar$/U"; reference:url,www.seculert.com/blog/2015/04/new-dyre-version-evades-sandboxes.html; reference:md5,999bc5e16312db6abff5f6c9e54c546f; classtype:trojan-activity; sid:2021056; rev:5; metadata:created_at 2015_05_04, former_category MALWARE, updated_at 2015_05_04;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX AVTECH Software ActiveX _DownloadPBControl Method Buffer Overflow Attempt"; flow:established,to_client; content:"<OBJECT "; nocase; content:"classid"; nocase; distance:0; content:"clsid"; nocase; distance:0; content:"8214B72E-B0CD-466E-A44D-1D54D926038D"; nocase; distance:0; content:"_DownloadPBControl"; nocase; reference:url,zeroscience.mk/en/vulnerabilities/ZSL-2010-4934.php; reference:url,exploit-db.com/exploits/12294; reference:url,doc.emergingthreats.net/2011205; classtype:attempted-user; sid:2011205; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Ursnif SSL Cert"; flow:established,from_server; content:"|55 04 03|"; content:"|16|athereforeencourage.pw"; distance:1; within:23; classtype:trojan-activity; sid:2021061; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_06, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX AVTECH Software ActiveX Buffer Overflow Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"AVC781Viewer.CV781Object"; nocase; distance:0; pcre:"/(SendCommand|Login|Snapshot|_DownloadPBControl|_DownloadPBClose|_DownloadPBOpen)/i"; reference:url,zeroscience.mk/en/vulnerabilities/ZSL-2010-4934.php; reference:url,exploit-db.com/exploits/12294; reference:url,doc.emergingthreats.net/2011206; classtype:attempted-user; sid:2011206; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ransomware CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 8d 3d d5 97 44 08 33 d8|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:command-and-control; sid:2021063; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_07, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, tag Ransomware, updated_at 2016_07_01, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Adobe browser document ActiveX DoS Function call Attempt"; flow:from_server,established; content:"ActiveXObject"; nocase; content:"AcroPDFLib.AcroPDF"; distance:0; nocase; content:"src"; nocase; reference:url,www.packetstormsecurity.nl/0911-exploits/acropdf-dos.txt; reference:url,doc.emergingthreats.net/2010705; classtype:attempted-user; sid:2010705; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Likely Trojan Multi-part Macro Download M1"; flow:established,from_server; file_data; content:"PAB0AGUAeAB0ADEAMAA+ACQA"; within:24; classtype:trojan-activity; sid:2020911; rev:3; metadata:created_at 2015_04_15, former_category CURRENT_EVENTS, updated_at 2015_04_15;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Adobe browser document ActiveX DoS Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"CA8A9780-280D-11CF-A24D-444553540000"; nocase; distance:0; content:"src"; nocase; pcre:"/<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CA8A9780-280D-11CF-A24D-444553540000/si"; reference:url,www.packetstormsecurity.nl/0911-exploits/acropdf-dos.txt; reference:url,doc.emergingthreats.net/2010726; classtype:attempted-user; sid:2010726; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|10 62 16 fe 1e af 85 65 68 82 0d d7 6f 8e 27 33 02|"; content:"|55 04 03|"; distance:0; content:"|0d|mainbytes.com"; distance:1; within:14; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021086; rev:2; metadata:attack_target Client_and_Server, created_at 2015_05_11, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Ask.com Toolbar askBar.dll ActiveX ShortFormat Buffer Overflow Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"5A074B2B-F830-49DE-A31B-5BB9D7F6B407"; nocase; distance:0; content:"ShortFormat"; nocase; pcre:"/<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A074B2B-F830-49DE-A31B-5BB9D7F6B407/si"; reference:url,www.packetstormsecurity.nl/0911-exploits/ask_shortformat.rb.txt; reference:url,secunia.com/advisories/26960/; reference:url,doc.emergingthreats.net/2010921; classtype:web-application-attack; sid:2010921; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ransomware CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 a5 12 0c 27 cc 24 bb ef|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:command-and-control; sid:2021087; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_11, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, tag Ransomware, updated_at 2016_07_01, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER Bot Search RFI Scan (ByroeNet/Casper-Like sun4u)"; flow:established,to_server; content:"|0D 0A|User-Agent|3a| Mozilla/4.76 [ru] (X11|3b| U|3b| SunOS 5.7 sun4u)"; nocase; reference:url,eromang.zataz.com/2010/07/13/byroenet-casper-bot-search-e107-rce-scanner/; reference:url,doc.emergingthreats.net/2011244; classtype:web-application-attack; sid:2011244; rev:6; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Malware CnC)"; flow:from_server,established; content:"|55 04 03|"; content:"|0b|roobox.info"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021096; rev:3; metadata:attack_target Client_and_Server, created_at 2015_05_14, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER Bot Search RFI Scan (Casper-Like MaMa Cyber/ebes)"; flow:established,to_server; content:"|0D 0A|User-Agent|3a| MaMa "; nocase; reference:url,eromang.zataz.com/2010/07/13/byroenet-casper-bot-search-e107-rce-scanner/; reference:url,doc.emergingthreats.net/2011286; classtype:web-application-attack; sid:2011286; rev:5; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Ruckguv.A SSL Cert"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|11 21 e9 a1 69 3a 6e e9 a8 fb a3 ba 5b ee 9d 6e 60 02|"; fast_pattern; content:"|55 04 03|"; content:"|15|elyseeinvestments.com"; distance:1; within:22; reference:md5,1225b8c9b52d4828b9031267939e8260; classtype:trojan-activity; sid:2021097; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_14, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible Cherokee Web Server GET AUX Request Denial Of Service Attempt"; flow:established,to_server; content:"GET |2F|AUX HTTP|2F|1|2E|"; nocase; depth:16; reference:url,securitytracker.com/alerts/2009/Oct/1023095.html; reference:url,www.securityfocus.com/bid/36814/info; reference:url,www.securityfocus.com/archive/1/507456; reference:url,doc.emergingthreats.net/2010229; classtype:attempted-dos; sid:2010229; rev:4; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Rofin.A CnC traffic (OUTBOUND)"; flow:to_server,established; dsize:>11; content:"|dd aa 99 66|"; depth:4; byte_jump:4,4,relative,little,from_beginning, post_offset -2; isdataat:!2,relative; reference:md5,6b71398418c7c6b01cf8abb105bc884d; classtype:command-and-control; sid:2020671; rev:3; metadata:created_at 2015_03_11, former_category MALWARE, updated_at 2015_03_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER Possible Cisco ASA Appliance Clientless SSL VPN HTML Rewriting Security Bypass Attempt/Cross Site Scripting Attempt"; flow:to_client,established; content:"CSCO_WebVPN"; nocase; content:"csco_wrap_js"; within:100; nocase; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=18442; reference:url,www.securityfocus.com/archive/1/504516; reference:url,www.securityfocus.com/bid/35476; reference:cve,2009-1201; reference:cve,2009-1202; reference:url,doc.emergingthreats.net/2010730; classtype:web-application-attack; sid:2010730; rev:4; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag XSS, tag Cross_Site_Scripting, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex CnC)"; flow:established,from_server; content:"|55 04 08|"; content:"|07|Glasgow"; distance:1; within:8; content:"|55 04 07|"; distance:0; content:"|06|Glasgo"; distance:1; within:7; content:"|55 04 0a|"; distance:0; content:"|0b|Green Peace"; distance:1; within:12; reference:md5,3cecc935eb92ed03dc9908fc96b0f795; classtype:domain-c2; sid:2021102; rev:2; metadata:attack_target Client_and_Server, created_at 2015_05_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $HTTP_SERVERS any -> $EXTERNAL_NET 1024: (msg:"ET WEB_SERVER Possible HTTP 405 XSS Attempt (Local Source)"; flow:from_server,established; content:"HTTP/1.1 405 Method Not Allowed|0d 0a|"; depth:33; nocase; content:"<script"; nocase; within:512; reference:url,doc.emergingthreats.net/2010519; classtype:web-application-attack; sid:2010519; rev:4; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ransomware CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ea 29 4d 2c d5 53 a8 8e|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:command-and-control; sid:2021109; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_16, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, tag Ransomware, updated_at 2016_07_01, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
 
-alert http $HTTP_SERVERS any -> $EXTERNAL_NET 1024: (msg:"ET WEB_SERVER Possible HTTP 406 XSS Attempt (Local Source)"; flow:from_server,established; content:"HTTP/1.1 406 Not Acceptable|0d 0a|"; depth:29; nocase; content:"<script"; nocase; within:512; reference:url,doc.emergingthreats.net/2010521; classtype:web-application-attack; sid:2010521; rev:4; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE TROJ_NAIKON.A SSL Cert"; flow:established,from_server; content:"|55 04 03|"; content:"|04|donc"; fast_pattern; distance:1; within:5; content:"|55 04 0b|"; content:"|03|abc"; distance:1; within:4; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/targeted-attack-campaign-hides-behind-ssl-communication/; classtype:trojan-activity; sid:2016795; rev:5; metadata:attack_target Client_Endpoint, created_at 2013_04_27, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-alert http $HTTP_SERVERS any -> $EXTERNAL_NET 1024: (msg:"ET WEB_SERVER Possible HTTP 500 XSS Attempt (Internal Source)"; flow:from_server,established; content:"HTTP/1.1 500 Internal Server Error|0d 0a|"; depth:36; nocase; content:"<script"; nocase; within:512; reference:url,doc.emergingthreats.net/2010524; classtype:web-application-attack; sid:2010524; rev:4; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; within:30; content:"|55 04 0a|"; distance:0; content:"|13|Widgets Numbers PTY"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021112; rev:2; metadata:attack_target Client_and_Server, created_at 2015_05_18, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $HTTP_SERVERS any -> $EXTERNAL_NET 1024: (msg:"ET WEB_SERVER Possible HTTP 503 XSS Attempt (Internal Source)"; flow:from_server,established; content:"HTTP/1.1 503 Service Unavailable|0d 0a|"; depth:34; nocase; content:"<script"; nocase; within:512; reference:url,doc.emergingthreats.net/2010526; classtype:web-application-attack; sid:2010526; rev:4; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|14|srv2415.domain.local"; distance:1; within:21; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021113; rev:2; metadata:attack_target Client_and_Server, created_at 2015_05_18, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER SQL sp_password attempt"; flow:to_server,established; content:"sp_password"; nocase; reference:url,doc.emergingthreats.net/2000105; classtype:attempted-user; sid:2000105; rev:6; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; within:30; content:"|55 04 0a|"; distance:0; content:"|11|Facebook Porn PTY"; distance:1; within:18; classtype:domain-c2; sid:2021106; rev:3; metadata:attack_target Client_and_Server, created_at 2015_05_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER SQL sp_delete_alert attempt"; flow:to_server,established; content:"sp_delete_alert"; nocase; reference:url,doc.emergingthreats.net/2000106; classtype:attempted-user; sid:2000106; rev:6; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert ip $HOME_NET any -> [199.2.137.0/24,207.46.90.0/24] any (msg:"ET MALWARE Connection to Microsoft Sinkhole IP (Possbile Infected Host)"; threshold:type limit,track by_src,seconds 3600,count 1; classtype:trojan-activity; sid:2016999; rev:4; metadata:created_at 2013_06_11, updated_at 2013_06_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ATTACK_RESPONSE Windows LMHosts File Download - Likely DNSChanger Infection"; flow:established,to_client; content:"#|0d 0a|#|20|This|20|is|20|a|20|sample|20|HOSTS|20|file|20|used|20|by|20|Microsoft|20|TCP/IP|20|for|20|Windows.|0d 0a|#|0d 0a|#|20|This|20|file|20|contains|20|the|20|mappings|20|of|20|IP|20|addresses|20|to|20|host|20|names."; reference:url,doc.emergingthreats.net/bin/view/Main/2008559; classtype:trojan-activity; sid:2008559; rev:8; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible APT17 CnC Content in Public Website"; flow:from_server,established; file_data; content:"@MICR0S0FT"; pcre:"/^[a-zA-Z0-9]{8}/R"; content:"C0RP0RATI0N"; within:11; reference:url,github.com/fireeye/iocs/tree/master/APT17; classtype:targeted-activity; sid:2021116; rev:2; metadata:created_at 2015_05_19, former_category MALWARE, updated_at 2015_05_19;)
 
-alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE r57 phpshell footer detected"; flow:established,from_server; content:"r57shell - http-shell by RST/GHC"; reference:url,www.pestpatrol.com/spywarecenter/pest.aspx?id=453096755; reference:url,doc.emergingthreats.net/bin/view/Main/2003535; classtype:web-application-activity; sid:2003535; rev:8; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 c2 19 ef 92 11 51 27 f3|"; within:35; fast_pattern; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021121; rev:2; metadata:attack_target Client_and_Server, created_at 2015_05_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE x2300 phpshell detected"; flow:established,from_server; content:"x2300 Locus7Shell"; reference:url,www.rfxn.com/vdb.php; reference:url,doc.emergingthreats.net/bin/view/Main/2007651; classtype:web-application-activity; sid:2007651; rev:7; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE JavaScriptBackdoor SSL Cert"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 b7 2f ae e8 e2 55 b5 bf|"; distance:0; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|My Company Ltd"; distance:1; within:15; reference:md5,2a63b3a621d8e555734582d83b5e06a5; classtype:trojan-activity; sid:2021134; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_21, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Adobe Reader and Acrobat Forms Data Format Remote Security Bypass Attempt"; flow:established,to_client; content:"|0d 0a|%FDF-"; depth:600; content:"/F(JavaScript|3a|"; nocase; distance:0; reference:url,www.securityfocus.com/bid/37763; reference:cve,2009-3956; reference:url,doc.emergingthreats.net/2010664; reference:url,www.stratsec.net/files/SS-2010-001_Stratsec_Acrobat_Script_Injection_Security_Advisory_v1.0.pdf; classtype:attempted-user; sid:2010664; rev:6; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Likely Dridex SSL Cert"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; within:30; content:"|55 04 08|"; distance:0; content:"|07|Montana"; distance:1; within:8; content:"|55 04 07|"; distance:0; content:"|09|Liverpool"; distance:1; within:10; content:"|55 04 03|"; distance:0; content:"|0e|southnorth.org"; distance:1; within:15; fast_pattern; reference:md5,440e5c0aee33cba3c4707ada0856ff6d; classtype:trojan-activity; sid:2021145; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_05_26, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET SCAN Wapiti Web Server Vulnerability Scan"; flow:to_server,established; content:"GET /"; depth:5; content:"?http|3A|//www.google."; within:100; nocase; content:"|0d 0a|User-Agent|3A 20|Python-httplib2"; distance:0; reference:url,wapiti.sourceforge.net/; reference:url,doc.emergingthreats.net/2008417; classtype:attempted-recon; sid:2008417; rev:9; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Linux/Moose Telnet CnC Beacon"; flow:established,to_server; dsize:40; content:"|0e 00 00 00|"; offset:4; depth:4; fast_pattern; content:!"|00|"; within:1; content:!"|00|"; distance:3; within:1; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; distance:4; within:28; content:!"|00 00 00 00|"; depth:4; reference:url,welivesecurity.com/wp-content/uploads/2015/05/Dissecting-LinuxMoose.pdf; classtype:command-and-control; sid:2021149; rev:1; metadata:attack_target Client_Endpoint, created_at 2015_05_26, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_05_26, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Microsoft Internet Explorer URI Validation Remote Code Execution Attempt"; flow:established,to_client; content:"#|3A|../../"; content:"C|3A 5C|"; nocase; within:50; pcre:"/\x2E\x2E\x2F\x2E\x2E\x2F.+C\x3A\x5C[a-z]/si"; reference:url,www.securityfocus.com/bid/37884; reference:cve,2010-0027; reference:url,doc.emergingthreats.net/2010798; classtype:attempted-user; sid:2010798; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|17|ns343677.ip-94-23-16.eu"; distance:1; within:24; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021154; rev:3; metadata:attack_target Client_and_Server, created_at 2015_05_28, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER MSSQL Server OLEDB asp error"; flow: established,from_server; content:"Microsoft OLE DB Provider for SQL Server error"; reference:url,www.wiretrip.net/rfp/p/doc.asp/i2/d42.htm; reference:url,doc.emergingthreats.net/2001768; classtype:web-application-activity; sid:2001768; rev:12; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Yakes CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 bd 4b 4b 98 c9 8b 2f 20|"; within:35; content:"|2a 86 48 86 f7 0d 01 09 01|"; distance:0; content:"|13|webmaster@localhost"; distance:1; within:20; reference:md5,6cdd93dcb1c54a4e2b036d2e13b51216; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021155; rev:2; metadata:attack_target Client_and_Server, created_at 2015_05_28, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT PDF Containing Windows Commands Downloaded"; flow:established,to_client; content:"%PDF-"; content:"|3C 3C 0D 0A 20 2f|type|20 2F|action|0D 0A 20 2F|s|20 2F|launch|0D 0A 20 2F|win"; distance:0; nocase; reference:url,doc.emergingthreats.net/2011245; classtype:bad-unknown; sid:2011245; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Downloader CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ea d4 96 1c 0a 8b 6f a4|"; within:35; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021175; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_02, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible HTTP 406 XSS Attempt (External Source)"; flow:from_server,established; content:"HTTP/1.1 406 Not Acceptable|0d 0a|"; depth:29; nocase; content:"<script"; nocase; within:512; reference:url,doc.emergingthreats.net/2010522; classtype:web-application-attack; sid:2010522; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible BlackEnergy Accessing SMB/SMB2 Named Pipe (ASCII)"; flow:to_server,established; content:"SMB"; offset:5; depth:4; content:"{AA0EED25-4167-4CBB-BDA8-9A0F5FF93EA8}"; distance:0; nocase; reference:url,cyberx-labs.com/wp-content/uploads/2015/05/BlackEnergy-CyberX-Report_27_May_2015_FINAL.pdf; classtype:trojan-activity; sid:2021179; rev:1; metadata:created_at 2015_06_04, updated_at 2015_06_04;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible HTTP 500 XSS Attempt (External Source)"; flow:from_server,established; content:"HTTP/1.1 500 Internal Server Error|0d 0a|"; depth:36; nocase; content:"<script"; nocase; within:512; reference:url,doc.emergingthreats.net/2010525; classtype:web-application-attack; sid:2010525; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible BlackEnergy Accessing SMB/SMB2 Named Pipe (Unicode)"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"{|00|A|00|A|00|0|00|E|00|E|00|D|00|2|00|5|00|-|00|4|00|1|00|6|00|7|00|-|00|4|00|C|00|B|00|B|00|-|00|B|00|D|00|A|00|8|00|-|00|9|00|A|00|0|00|F|00|5|00|F|00|F|00|9|00|3|00|E|00|A|00|8|00|}"; distance:0; nocase; reference:url,cyberx-labs.com/wp-content/uploads/2015/05/BlackEnergy-CyberX-Report_27_May_2015_FINAL.pdf; classtype:trojan-activity; sid:2021180; rev:1; metadata:created_at 2015_06_04, updated_at 2015_06_04;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible HTTP 503 XSS Attempt (External Source)"; flow:from_server,established; content:"HTTP/1.1 503 Service Unavailable|0d 0a|"; depth:34; nocase; content:"<script"; nocase; within:512; reference:url,doc.emergingthreats.net/2010527; classtype:web-application-attack; sid:2010527; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; within:30; content:"|55 04 0a|"; distance:0; content:"|0b|YouPorn Ltd"; distance:1; within:12; content:"|55 04 03|"; distance:0; content:"|0b|pornhub.xxx"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021186; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_05, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Encoded javascriptdocument.write - usually hostile"; flow: established,to_client; content:"|313030|,111,99,117,109,101,110,116,46,119,114,105,116,101"; reference:url,doc.emergingthreats.net/2001811; classtype:misc-activity; sid:2001811; rev:9; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0b|povawfas.us"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021192; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Adobe Acrobat Reader Newclass Invalid Pointer Remote Code Execution Attempt"; flowbits:isset,ET.flash.pdf; flow:established,to_client; content:"|F2 3D 8D 23|"; reference:url,www.exploit-db.com/adobe-acrobat-newclass-invalid-pointer-vulnerability/; reference:cve,2010-1297; classtype:attempted-user; sid:2011519; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_29, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gootkit CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 fb 01 dc 12 42 31 23 93|"; distance:0; fast_pattern; content:"|55 04 0a|"; distance:0; content:"|0e|My Company Ltd"; distance:1; within:15; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021193; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Adobe Acrobat newfunction Remote Code Execution Attempt"; flowbits:isset,ET.flash.pdf; flow:established,to_client; content:"|40 E8 D4 F1 FF 33|"; reference:url,www.adobe.com/support/security/bulletins/apsb10-15.html; reference:url,www.exploit-db.com/moaub-23-adobe-acrobat-and-reader-newfunction-remote-code-execution-vulnerability/; reference:bid,41236; reference:cve,2010-2168; classtype:attempted-user; sid:2011575; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_29, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Qadars WebInject SSL Cert"; flow:established,from_server; content:"|55 04 03|"; content:"|1e|www.freechristmasgifts2014.com"; distance:1; within:31; reference:md5,06588acf0112a84fe5f684bbafd7dc00; classtype:trojan-activity; sid:2021194; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_06_08, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Microsoft Internet Explorer CSS Cross-Origin Theft Attempt"; flow:established,to_client; content:"document.body.currentStyle.fontFamily"; nocase; content:".indexOf(|22|authenticity_token"; nocase; distance:0; reference:url,www.theregister.co.uk/2010/09/06/mystery_ie_bug/; reference:url,www.darknet.org.uk/2010/09/microsoft-investigate-ie-css-cross-origin-theft-vulnerability/; reference:url,seclists.org/fulldisclosure/2010/Sep/64; classtype:bad-unknown; sid:2011472; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_29, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Spy.Shiz CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|01 01|"; distance:18; within:2; content:"|55 04 03|"; distance:0; content:"|0d|web.gibnos.pw"; distance:1; within:14; reference:md5,c8131a48e834291be6c7402647250e73; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021196; rev:3; metadata:attack_target Client_and_Server, created_at 2015_06_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT phoenix exploit kit - admin login page detected"; flow:established,to_client; content:"<title>Phoenix Exploit's Kit - Log In"; classtype:exploit-kit; sid:2011281; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_28, deployment Perimeter, former_category EXPLOIT_KIT, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0b|povawer.biz"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021197; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Adobe Acrobat and Reader Pushstring Memory Corruption Attempt"; flow:established,to_client; flowbits:isset,ET.flash.pdf; content:"|2C E8 88 F0 FF 33|"; reference:url,www.exploit-db.com/moaub12-adobe-acrobat-and-reader-pushstring-memory-corruption/; reference:bugtraq,41237; reference:cve,2010-2201; classtype:attempted-user; sid:2011500; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_27, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0a|laxitr.biz"; distance:1; within:11; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021198; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Gootkit Website Infection Receiving FTP Credentials from Control Server"; flowbits:isset,ET.GOOTKIT; flow:established,from_server; content:""; nocase; content:""; nocase; distance:0; content:""; nocase; distance:0; content:"21"; nocase; distance:0; reference:url,www.m86security.com/labs/i/GootKit--Automated-Website-Infection,trace.1368~.asp; reference:url,doc.emergingthreats.net/2011287; classtype:web-application-attack; sid:2011287; rev:4; metadata:created_at 2010_09_28, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0b|dazopla.biz"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021199; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER Local Website Infected By Gootkit"; flow:established,from_server; content:"Gootkit iframer component"; nocase; reference:url,www.m86security.com/labs/i/GootKit--Automated-Website-Infection,trace.1368~.asp; reference:url,doc.emergingthreats.net/2011285; classtype:web-application-attack; sid:2011289; rev:4; metadata:created_at 2010_09_28, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0b|gipladfe.us"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021208; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Possible AOL SuperBuddy ActiveX Control Remote Code Execution Attempt"; flow:from_server,established; content:"189504B8-50D1-4AA8-B4D6-95C8F58A6414"; nocase; content:"SetSuperBuddy"; nocase; content:"//"; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*189504B8-50D1-4AA8-B4D6-95C8F58A6414/si"; reference:url,www.securityfocus.com/bid/36580/info; reference:url,www.securityfocus.com/archive/1/506889; reference:url,doc.emergingthreats.net/2010039; classtype:attempted-user; sid:2010039; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0a|lazeca.biz"; distance:1; within:11; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021209; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Awingsoft Web3D Player Remote Buffer Overflow"; flow:to_client,established; content:"17A54E7D-A9D4-11D8-9552-00E04CB09903"; nocase; content:"SceneURL"; nocase; reference:url,secunia.com/advisories/35764/; reference:url,milw0rm.com/exploits/9116; reference:url,shinnai.net/xplits/TXT_nsGUdeley3EHfKEV690p.html; reference:url,doc.emergingthreats.net/2009857; classtype:web-application-attack; sid:2009857; rev:8; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0a|zolaxap.us"; distance:1; within:11; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021210; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX ChilkatHttp ActiveX 2.3 Arbitrary Files Overwrite"; flow:to_client,established; content:"B973393F-27C7-4781-877D-8626AAEDF119"; nocase; pcre:"/.*\.(ini|exe|dll|bat|com|cab|txt)/Ri"; content:"SaveLastError"; nocase; reference:bugtraq,28546; reference:url,www.milw0rm.com/exploits/5338; reference:url,doc.emergingthreats.net/2008099; classtype:web-application-attack; sid:2008099; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0c|babapoti.biz"; distance:1; within:13; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021211; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Dart Communications PowerTCP FTP for ActiveX DartFtp.dll Control Buffer Overflow"; flow:to_client,established; content:"39FDA070-61BA-11D2-AD84-00105A17B608"; nocase; content:"%5F%DC%02%10%cc"; nocase; distance:0; content:"SecretKey"; nocase; reference:bugtraq,31814; reference:url,www.milw0rm.com/exploits/6793; reference:url,doc.emergingthreats.net/2008683; classtype:web-application-attack; sid:2008683; rev:10; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|09|poknop.us"; distance:1; within:10; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021212; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Avzhan DDOS Bot Outbound Hardcoded Malformed GET Request Denial Of Service Attack Detected"; flow:established,to_server; content:"GET ^&&%$%$^%$#^&**(*((&*^%$##$%^&*(*&^%$%^&*.htm"; depth:49; nocase; threshold:type limit, count 1, seconds 60, track by_src; reference:url,asert.arbornetworks.com/2010/09/another-family-of-ddos-bots-avzhan/; classtype:trojan-activity; sid:2011585; rev:4; metadata:created_at 2010_09_29, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:from_server,established; content:"|55 04 03|"; content:"|10|www.carinsup.com"; distance:1; within:17; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021220; rev:3; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Avaya CallPilot Unified Messaging ActiveX InstallFrom Method Access Attempt"; flow:to_client,established; content:" $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0a|polasde.us"; distance:1; within:11; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021221; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Avaya CallPilot Unified Messaging ActiveX Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"NMWEBINST.NMWebInstCtrl.1"; nocase; distance:0; content:"InstallFrom"; nocase; reference:url,secunia.com/advisories/40184/; reference:bugtraq,40535; reference:url,doc.emergingthreats.net/2011681; classtype:attempted-user; sid:2011681; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0a|paxerba.us"; distance:1; within:11; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021222; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Axis Media Controller ActiveX SetImage Method Remote Code Execution Attempt"; flow:to_client,established; content:" $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0b|molared.biz"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021223; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX DjVu DjVu_ActiveX_MSOffice.dll ActiveX Component Heap Buffer Overflow"; flow:to_client,established; content:"CLSID"; nocase; content:"4A46B8CD-F7BD-11D4-B1D8-000102290E7C"; nocase; distance:0; content:"0x400000"; distance:0; content:"ImageURL"; nocase; reference:bugtraq,31987; reference:url,milw0rm.com/exploits/6878; reference:url,doc.emergingthreats.net/2008790; classtype:web-application-attack; sid:2008790; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Geodo MITM)"; flow:from_server,established; content:"|55 04 03|"; content:"|0b|halowsin.us"; distance:1; within:12; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021224; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX EasyMail Object SMTP Component Buffer Overflow Function call Attempt"; flow:from_server,established; content:"ActiveXObject"; nocase; content:"EasyMail.SMTP.6"; distance:0; nocase; pcre:"/(AddAttachment|SubmitToExpress)/i"; reference:url,secunia.com/advisories/24199/; reference:url,www.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/browser/oracle_dc_submittoexpress.rb; reference:url,doc.emergingthreats.net/2010657; classtype:web-application-attack; sid:2010657; rev:6; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 1"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"{AAFFC4F0-E04B-4C7C-B40A-B45DE971E81E}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021230; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX AoA Audio Extractor ActiveX Control Buffer Overflow Attempt"; flow:to_client,established; content:" any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 2"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"{AB6172ED-8105-4996-9D2A-597B5F827501}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021231; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Microsoft DirectX 9 ActiveX Control Format String Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"MSVidCtlLib.MSVidVMR9"; nocase; distance:0; content:".CustomCompositorClass"; nocase; reference:url,packetstorm.linuxsecurity.com/1009-exploits/msvidctl-activex.txt; classtype:attempted-user; sid:2011590; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_10_02, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 3"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"{0710880F-3A55-4A2D-AA67-1123384FD859}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021232; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Softek Barcode Reader Toolkit ActiveX Control Format String Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"SoftekATL.CBarcode"; nocase; distance:0; content:".DebugTraceFile"; nocase; reference:url,exploit-db.com/exploits/15071/; classtype:attempted-user; sid:2011870; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_10_29, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 4"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"{6C51A4DB-E3DE-4FEB-86A4-32F7F8E73B99}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021233; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Softek Barcode Reader Toolkit ActiveX Control Buffer Overflow Attempt"; flow:to_client,established; content:"]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*11E7DA45-B56D-4078-89F6-D3D651EC4CD6/si"; reference:url,exploit-db.com/exploits/15071; classtype:web-application-attack; sid:2011869; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_10_29, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 5"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"{7F9BCFC0-B36B-45EC-B377-D88597BE5D78}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021234; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Trend Micro Internet Security Pro 2010 ActiveX extSetOwner Remote Code Execution Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"15DBC3F9-9F0A-472E-8061-043D9CEC52F0"; nocase; distance:0; content:"extSetOwner"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15DBC3F9-9F0A-472E-8061-043D9CEC52F0/si"; reference:url,www.exploit-db.com/trend-micro-internet-security-pro-2010-activex-extsetowner-remote-code-execution/; classtype:attempted-user; sid:2011867; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_10_29, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (ASCII) 6"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"{57D2DE92-CE17-4A57-BFD7-CD3C6E965C6A}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021235; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Microsoft DirectX 9 msvidctl.dll ActiveX Control Code Execution Attempt"; flow:to_client,established; content:"24DC3975-09BF-4231-8655-3EE71F43837D"; nocase; content:".CustomCompositorClass"; nocase; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*24DC3975-09BF-4231-8655-3EE71F43837D/si"; reference:url,packetstorm.linuxsecurity.com/1009-exploits/msvidctl-activex.txt; classtype:web-application-attack; sid:2011589; rev:7; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_10_02, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 1"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"|00|{|00|A|00|A|00|F|00|F|00|C|00|4|00|F|00|0|00|-|00|E|00|0|00|4|00|B|00|-|00|4|00|C|00|7|00|C|00|-|00|B|00|4|00|0|00|A|00|-|00|B|00|4|00|5|00|D|00|E|00|9|00|7|00|1|00|E|00|8|00|1|00|E|00|}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021236; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS JcomBand toolbar ActiveX Control isRegistered Property Buffer Overflow Attempt"; flow:established,to_client; content:"clsid"; nocase; content:"952E3F80-0C34-48CD-829B-A45913B29670"; nocase; distance:0; content:"isRegistered"; nocase; distance:0; pcre:"/]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*952E3F80-0C34-48CD-829B-A45913B29670/si"; reference:url,www.exploit-db.com/exploits/11059; reference:url,secunia.com/advisories/38081/; reference:url,doc.emergingthreats.net/2010976; classtype:attempted-user; sid:2010976; rev:6; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 2"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"|00|{|00|A|00|B|00|6|00|1|00|7|00|2|00|E|00|D|00|-|00|8|00|1|00|0|00|5|00|-|00|4|00|9|00|9|00|6|00|-|00|9|00|D|00|2|00|A|00|-|00|5|00|9|00|7|00|B|00|5|00|F|00|8|00|2|00|7|00|5|00|0|00|1|00|}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021237; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT VLC Media Player .ass File Buffer Overflow Attempt"; flowbits:isset,ET.ass.request; flow:established,to_client; content:"Dialogue|3A|"; nocase; isdataat:60000,relative; content:!"|0A|"; within:60000; reference:url,www.securityfocus.com/bid/37832/info; reference:url,doc.emergingthreats.net/2010758; classtype:attempted-user; sid:2010758; rev:6; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 3"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"|00|{|00|0|00|7|00|1|00|0|00|8|00|8|00|0|00|F|00|-|00|3|00|A|00|5|00|5|00|-|00|4|00|A|00|2|00|D|00|-|00|A|00|A|00|6|00|7|00|-|00|1|00|1|00|2|00|3|00|3|00|8|00|4|00|F|00|D|00|8|00|5|00|9|00|}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021238; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT VLC Media Player smb URI Handling Remote Buffer Overflow Attempt"; flow:established,to_client; content:""; nocase; content:"smb|3A|//"; within:20; nocase; content:!"|0A|"; within:1000; isdataat:1000,relative; pcre:"/\x3Clocation\x3D.+smb\x3A\x2F\x2F.{1000}.+\x3C\x2Flocation\x3E/smi"; reference:url,www.securityfocus.com/bid/35500/info; reference:url,doc.emergingthreats.net/2010813; classtype:attempted-user; sid:2010813; rev:6; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 4"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"|00|{|00|6|00|C|00|5|00|1|00|A|00|4|00|D|00|B|00|-|00|E|00|3|00|D|00|E|00|-|00|4|00|F|00|E|00|B|00|-|00|8|00|6|00|A|00|4|00|-|00|3|00|2|00|F|00|7|00|F|00|8|00|E|00|7|00|3|00|B|00|9|00|9|00|}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021239; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT eval String.fromCharCode String Which May Be Malicious"; flow:established,to_client; content:"eval|28|"; fast_pattern; nocase; content:"String.fromCharCode|28|"; nocase; within:40; pcre:"/eval\x28(String\x2EfromCharCode\x28|[a-z,0-9]{1,20}\x28String\x2EfromCharCode\x28)/i"; classtype:bad-unknown; sid:2012173; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_01_12, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 5"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"|00|{|00|7|00|F|00|9|00|B|00|C|00|F|00|C|00|0|00|-|00|B|00|3|00|6|00|B|00|-|00|4|00|5|00|E|00|C|00|-|00|B|00|3|00|7|00|7|00|-|00|D|00|8|00|8|00|5|00|9|00|7|00|B|00|E|00|5|00|D|00|7|00|8|00|}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021240; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Possible Unescape Encoded Content With Split String Obfuscation"; flow:established,to_client; content:"unescape|28 22|"; content:!"|29|"; within:100; content:"|22| +|0a|"; within:80; content:"|22| +|0a|"; within:80; content:"|22| "; within:80; content:"|22| +|0a|"; within:80; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; classtype:shellcode-detect; sid:2012196; rev:4; metadata:created_at 2011_01_17, updated_at 2019_09_27;)
+alert tcp any any -> any [139,445] (msg:"ET MALWARE Possible Duqu 2.0 Accessing SMB/SMB2 Named Pipe (Unicode) 6"; flow:to_server,established; content:"SMB"; offset:5; depth:3; content:"|00|{|00|5|00|7|00|D|00|2|00|D|00|E|00|9|00|2|00|-|00|C|00|E|00|1|00|7|00|-|00|4|00|A|00|5|00|7|00|-|00|B|00|F|00|D|00|7|00|-|00|C|00|D|00|3|00|C|00|6|00|E|00|9|00|6|00|5|00|C|00|6|00|A|00|}"; distance:0; nocase; reference:url,securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/; classtype:trojan-activity; sid:2021241; rev:1; metadata:created_at 2015_06_10, updated_at 2015_06_10;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Possible Unescape Encoded Content With Split String Obfuscation 2"; flow:established,to_client; content:"unescape|28 27|"; content:!"|29|"; within:100; content:"|27| +|0a|"; within:80; content:"|27| +|0a|"; within:80; content:"|27| +|0a|"; within:80; content:"|27| +|0a|"; within:80; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; classtype:shellcode-detect; sid:2012197; rev:5; metadata:created_at 2011_01_17, updated_at 2019_09_27;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Dridex Download June 10 2015"; flow:established,from_server; content:"filename=|22|crypted.120.exe|22|"; http_header; nocase; classtype:trojan-activity; sid:2021244; rev:2; metadata:created_at 2015_06_11, updated_at 2015_06_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX Oracle Document Capture File Overwrite or Buffer Overflow Attempt"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"NCSECWLib.NCSRenderer"; nocase; distance:0; content:"WriteJPG"; nocase; distance:0; reference:cve,2010-3599; classtype:attempted-user; sid:2012234; rev:4; metadata:created_at 2011_01_27, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE Torrentlocker C2 SSL cert"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 b3 b2 82 08 58 32 5e 8e|"; within:35; fast_pattern; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; threshold: type limit, track by_src, count 1, seconds 60; reference:md5,77c99b6f06fe443b72a0efaf8f285e4d; classtype:command-and-control; sid:2021260; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_06_12, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Possible Encoded %90 NOP SLED"; flow:established,to_client; content:"%90%90%90%90"; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; reference:url,www.windowsecurity.com/articles/Obfuscated-Shellcode-Part1.html; classtype:shellcode-detect; sid:2012112; rev:5; metadata:created_at 2010_12_28, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TeslaCrypt MITM)"; flow:established,from_server; content:"|55 04 03|"; content:"|12 2a 2e|pillspharm24.com"; distance:1; within:19; reference:md5,1b4e97af9f327126146338b8cd21dd86; classtype:domain-c2; sid:2021273; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_15, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Possible UTF-8 %u90 NOP SLED"; flow:established,to_client; content:"%u90%u90"; nocase; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; reference:url,www.windowsecurity.com/articles/Obfuscated-Shellcode-Part1.html; classtype:shellcode-detect; sid:2012110; rev:4; metadata:created_at 2010_12_28, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Backdoor.Elise SSL Cert"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; within:30; content:"|55 04 03|"; distance:0; content:"|0b|eric-office"; distance:1; within:12; reference:md5,8334f346585aa27ac6ae86e5adcaefa2; reference:url,github.com/pan-unit42/iocs/tree/master/lotusblossom; classtype:trojan-activity; sid:2021279; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_06_16, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible Internet Explorer srcElement Memory Corruption Attempt"; flow:established,to_client; content:"document.createEventObject"; nocase; content:".innerHTML"; within:100; nocase; content:"window.setInterval"; distance:0; nocase; content:"srcElement"; fast_pattern; nocase; distance:0; reference:url,www.microsoft.com/technet/security/bulletin/ms10-002.mspx; reference:url,tools.cisco.com/security/center/viewAlert.x?alertId=19726; reference:url,www.kb.cert.org/vuls/id/492515; reference:cve,2010-0249; reference:url,doc.emergingthreats.net/2010799; classtype:attempted-user; sid:2010799; rev:6; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Likely Malicious wininet UA Downloading EXE"; flow:established,from_server; flowbits:isset,ET.wininet.UA; file_data; content:"MZ"; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; classtype:trojan-activity; sid:2021312; rev:2; metadata:created_at 2015_06_19, former_category CURRENT_EVENTS, updated_at 2015_06_19;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Hex Obfuscation of replace Javascript Function % Encoding"; flow:established,to_client; content:"%72%65%70%6c%61%63%65%28"; nocase; fast_pattern; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; classtype:bad-unknown; sid:2012398; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_03_01, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Downloader.Win32.Adload (KaiXin Payload) Checkin Response"; flow:established,from_server; file_data; content:"[Config]|0d 0a|"; within:10; content:"[Process]|0d 0a|1="; distance:0; reference:md5,c45810710617f0149678cc1c6cbec7a6; classtype:command-and-control; sid:2021301; rev:4; metadata:created_at 2015_06_18, former_category MALWARE, updated_at 2015_06_18;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Hex Obfuscation of replace Javascript Function %u UTF-8 Encoding"; flow:established,to_client; content:"%u72%u65%u70%u6c%u61%u63%u65%u28"; nocase; fast_pattern; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; classtype:bad-unknown; sid:2012399; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_03_01, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Spy.Shiz CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|09|howtoe.pw"; distance:1; within:14; reference:md5,40368db3a68f2db17853750e68cfc662; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021314; rev:3; metadata:attack_target Client_and_Server, created_at 2015_06_22, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Hex Obfuscation of replace Javascript Function %u UTF-16 Encoding"; flow:established,to_client; content:"%u7265%u706c%u6163%u6528"; nocase; fast_pattern; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; classtype:bad-unknown; sid:2012400; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_03_01, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Possible Sinkhole)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 ef ee 78 a7 ef c6 52 20|"; within:35; content:"|55 04 03|"; distance:0; content:"|0c|mainsinkhole"; distance:1; within:13; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021315; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_22, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Hex Obfuscation of Script Tag %u UTF-8 Encoding"; flow:established,to_client; content:"%u3c%u73%u63%u72%u69%u70%u74"; nocase; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; classtype:bad-unknown; sid:2012264; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_02_03, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux/ChinaZ DDoS Bot Checkin 2"; flow:established,to_server; content:"*"; pcre:"/^\d+/R"; content:"MHZ|00 00 00 00|"; fast_pattern; within:7; content:"MB|00 00 00 00|"; distance:0; content:"M|00 00 00 00|"; distance:0; content:"|3b|"; distance:0; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/R"; reference:url,blog.malwaremustdie.org/2015/06/the-elf-chinaz-reloaded.html; classtype:command-and-control; sid:2021316; rev:1; metadata:created_at 2015_06_22, former_category MALWARE, updated_at 2015_06_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Hex Obfuscation of Script Tag %u UTF-16 Encoding"; flow:established,to_client; content:"%u3c73%u6372%u6970%u74"; nocase; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; classtype:bad-unknown; sid:2012265; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_02_03, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tcp $HOME_NET any -> [88.53.215.64,217.96.33.164,203.131.222.102,208.105.226.235,212.31.102.100,58.185.154.99,200.87.126.116] any (msg:"ET MALWARE Sony Breach Wiper Callout"; flow:established; threshold:type limit,count 2,track by_src,seconds 300; reference:url,krebsonsecurity.com/2014/12/sony-breach-may-have-exposed-employee-healthcare-salary-data; classtype:trojan-activity; sid:2019848; rev:3; metadata:created_at 2014_12_03, updated_at 2014_12_03;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Hex Obfuscation of unescape % Encoding"; flow:established,to_client; content:"%75%6e%65%73%63%61%70%65"; nocase; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; classtype:bad-unknown; sid:2012266; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_02_03, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 03|"; distance:0; content:"|13|1024sslsecurity.com"; distance:1; within:20; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021339; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Hex Obfuscation of unescape %u UTF-8 Encoding"; flow:established,to_client; content:"%u75%u6e%u65%u73%u63%u61%u70%u65"; nocase; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; classtype:bad-unknown; sid:2012267; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_02_03, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 03|"; distance:0; content:"|0e|typeofways.com"; distance:1; within:15; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021340; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Hex Obfuscation of unescape %u UTF-16 Encoding"; flow:established,to_client; content:"%u756e%u6573%u6361%u7065"; nocase; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; classtype:bad-unknown; sid:2012268; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_02_03, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 03|"; distance:0; content:"|0f|digination.info"; distance:1; within:16; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021341; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Hex Obfuscation of substr % Encoding"; flow:established,to_client; content:"%73%75%62%73%74%72"; nocase; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; classtype:bad-unknown; sid:2012269; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_02_03, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 03|"; distance:0; content:"|12|ssl.savingscore.pw"; distance:1; within:19; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021342; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Hex Obfuscation of substr %u UTF-8 Encoding"; flow:established,to_client; content:"%u73%u75%u62%u73%u74%u72"; nocase; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; classtype:bad-unknown; sid:2012270; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_02_03, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 03|"; distance:0; content:"|12|supportupdate.info"; distance:1; within:19; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021343; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Hex Obfuscation of substr %u UTF-16 Encoding"; flow:established,to_client; content:"%u7375%u6273%u7472"; nocase; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; classtype:bad-unknown; sid:2012271; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_02_03, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 03|"; distance:0; content:"|17|patient-advertising.com"; distance:1; within:24; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021344; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Hex Obfuscation of eval % Encoding"; flow:established,to_client; content:"%65%76%61%6c"; nocase; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; classtype:bad-unknown; sid:2012272; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_02_03, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 03|"; distance:0; content:"|0c|pdata-next.ru"; distance:1; within:14; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021345; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Hex Obfuscation of eval %u UTF-8 Encoding"; flow:established,to_client; content:"%u65%u76%u61%u6c"; nocase; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; classtype:bad-unknown; sid:2012273; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_02_03, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 03|"; distance:0; content:"|0f|live-advert.com"; distance:1; within:16; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021346; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Hex Obfuscation of eval %u UTF-16 Encoding"; flow:established,to_client; content:"%u6576%u616c"; nocase; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; classtype:bad-unknown; sid:2012274; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_02_03, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 03|"; distance:0; content:"|0a|can-ip.com"; distance:1; within:11; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021347; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Common %u0a0a%u0a0a UTF-16 Heap Spray String"; flow:established,to_client; content:"%u0a0a%u0a0a"; nocase; reference:url,www.darkreading.com/security/vulnerabilities/221901428/index.html; classtype:shellcode-detect; sid:2012254; rev:4; metadata:created_at 2011_02_03, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 03|"; distance:0; content:"|0b|pandolin.ru"; distance:1; within:12; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021348; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Common %u0a%u0a%u0a%u0a UTF-8 Heap Spray String"; flow:established,to_client; content:"%u0a%u0a%u0a%u0a"; nocase; reference:url,www.darkreading.com/security/vulnerabilities/221901428/index.html; classtype:shellcode-detect; sid:2012255; rev:4; metadata:created_at 2011_02_03, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 03|"; distance:0; content:"|0c|securebnk.eu"; distance:1; within:13; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021349; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Common %0c%0c%0c%0c Heap Spray String"; flow:established,to_client; content:"%0c%0c%0c%0c"; nocase; reference:url,www.darkreading.com/security/vulnerabilities/221901428/index.html; classtype:shellcode-detect; sid:2012257; rev:4; metadata:created_at 2011_02_03, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (KINS CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 03|"; distance:0; content:"|0b|fuxaloba.com"; distance:1; within:13; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021350; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Common %u0c0c%u0c0c UTF-16 Heap Spray String"; flow:established,to_client; content:"%u0c0c%u0c0c"; nocase; reference:url,www.darkreading.com/security/vulnerabilities/221901428/index.html; classtype:shellcode-detect; sid:2012258; rev:4; metadata:created_at 2011_02_03, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; within:30; content:"|55 04 08|"; distance:0; content:"|07|Indiana"; distance:1; within:8; content:"|55 04 03|"; distance:0; content:"|0d|koalashelp.au"; distance:1; within:14; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021353; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_26, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Common %u0c%u0c%u0c%u0c UTF-8 Heap Spray String"; flow:established,to_client; content:"%u0c%u0c%u0c%u0c"; nocase; reference:url,www.darkreading.com/security/vulnerabilities/221901428/index.html; classtype:shellcode-detect; sid:2012259; rev:4; metadata:created_at 2011_02_03, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET 443 -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Ransomware CnC)"; flow:from_server,established; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 8f e3 5b c8 ea 55 d6 4a|"; within:35; fast_pattern; content:"|55 04 07|"; distance:0; content:"|0c|Default City"; distance:1; within:13; content:"|55 04 0a|"; distance:0; content:"|13|Default Company Ltd"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:command-and-control; sid:2021354; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_06_26, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, tag Ransomware, updated_at 2016_07_01, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET ACTIVEX ASUS Net4Switch ipswcom.dll ActiveX Stack Buffer Overflow"; flow:to_client,established; content:"CLSID"; nocase; content:"1B9E86D8-7CAF-46C8-9938-569B21E17A8E"; nocase; distance:0; content:"CxDbgPrint"; nocase; reference:url,packetstormsecurity.org/files/110296/ASUS-Net4Switch-ipswcom.dll-ActiveX-Stack-Buffer-Overflow.html; classtype:attempted-user; sid:2014325; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2012_03_06, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Tinba MITM)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|55 04 03|"; distance:0; content:"|0b|tsescase.tk"; distance:1; within:12; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021355; rev:2; metadata:attack_target Client_and_Server, created_at 2015_06_26, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Suspicious Windows Executable CreateRemoteThread"; flow:established,to_client; content:"|0d 0a 0d 0a|MZ"; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; content:"CreateRemoteThread"; nocase; reference:url,sans.org/reading_room/whitepapers/malicious/rss_33649; reference:url,jessekornblum.livejournal.com/284641.html; reference:url,msdn.microsoft.com/en-us/library/windows/desktop/ms682437%28v=vs.85%29.aspx; classtype:misc-activity; sid:2015589; rev:6; metadata:created_at 2012_08_08, former_category POLICY, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi CnC)"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00 b8 95 12 ee 90 e8 0f 66|"; within:35; content:"|55 04 0A|"; distance:0; content:"|18|Internet Widgits Pty Ltd"; distance:1; within:25; reference:md5,22b0d4ff64d3cb3080feb47ce52988e9; classtype:domain-c2; sid:2021375; rev:2; metadata:attack_target Client_and_Server, created_at 2015_07_02, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SHELLCODE Possible UTF-16 %u9090 NOP SLED"; flow:established,to_client; content:"%u9090%u"; nocase; pcre:"/^[a-f0-9]{4}/Ri"; reference:url,cansecwest.com/slides07/csw07-nazario.pdf; reference:url,www.sophos.com/security/technical-papers/malware_with_your_mocha.html; reference:url,www.windowsecurity.com/articles/Obfuscated-Shellcode-Part1.html; classtype:shellcode-detect; sid:2012111; rev:5; metadata:created_at 2010_12_28, updated_at 2019_09_27;)
+alert tls $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET MALWARE Mocelpa Client Hello CnC Beacon"; flow:established,to_server; content:"|16 03 01|"; depth:3; content:"|54 b4 c9 7b|"; distance:0; content:"|00 00 00 12 00 10 00 00 0d|www.apple.com"; distance:0; reference:url,blog.dragonthreatlabs.com/2015/07/dtl-06282015-01-apt-on-taiwan-insight.html; classtype:command-and-control; sid:2021379; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_07_06, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_07_06, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Hostile _dsgweed.class JAR exploit"; flow:established,from_server; flowbits:isset,ET.http.javaclient; file_data; content:"_dsgweed.class"; classtype:trojan-activity; sid:2018031; rev:3; metadata:created_at 2014_01_28, former_category CURRENT_EVENTS, updated_at 2019_09_27;)
+alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Denisca.A CnC Beacon"; content:"|7c 2a 26|"; depth:3; fast_pattern; content:"|7c|"; distance:0; content:"|7c|"; distance:16; within:1; content:"|7c|"; distance:0; pcre:"/\x7c[a-f0-9]{16}\x7c\d+\x7c$/"; reference:md5,0075c4d976984436443b30926ad818dd; classtype:command-and-control; sid:2021385; rev:1; metadata:attack_target Client_Endpoint, created_at 2015_07_07, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_07_07, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER Possible Successful Juniper NetScreen ScreenOS Firmware Version Disclosure Attempt"; flow:established,from_server; content:"Juniper Networks, Inc"; content:"Version|3A|"; within:100; content:"ScreenOS"; distance:0; reference:url,securitytracker.com/alerts/2009/Apr/1022123.html; reference:url,www.securityfocus.com/bid/34710; reference:url,seclists.org/bugtraq/2009/Apr/242; reference:url,www.procheckup.com/vulnerability_manager/vulnerabilities/pr09-05; reference:url,doc.emergingthreats.net/2010162; classtype:attempted-recon; sid:2010162; rev:5; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Dridex SSL Cert 30 June 2015"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; within:30; content:"|55 04 0b|"; distance:0; content:"|0a|Passio dpt"; distance:1; within:11; content:"|55 04 03|"; distance:0; content:"|0b|romantik.it"; distance:1; within:12; reference:md5,0a977dfcb93301f1841dbe2272d3102b; classtype:trojan-activity; sid:2021370; rev:5; metadata:attack_target Client_Endpoint, created_at 2015_06_30, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE W32/Eclipse.DDOSBot CnC Beacon Response"; flow:established,to_client; file_data; content:"PGNtZD"; within:12; reference:url,www.arbornetworks.com/asert/2014/04/trojan-eclipse-a-bad-moon-rising/; classtype:command-and-control; sid:2018423; rev:3; metadata:attack_target Client_Endpoint, created_at 2014_04_28, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2019_09_27, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Dridex SSL Cert 1 July 2015"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; within:30; content:"|55 04 0b|"; distance:0; content:"|0a|gay rights"; distance:1; within:11; content:"|55 04 03|"; distance:0; content:"|07|pace.eu"; distance:1; within:12; reference:md5,865164ef97c50bdd8e8740621234a3cf; classtype:trojan-activity; sid:2021372; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_07_02, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET SCAN SQLNinja MSSQL XPCmdShell Scan"; flow:to_server,established; content:"?param=a"; content:"exec%20master%2E%2Exp%5Fcmdshell"; distance:2; reference:url,sqlninja.sourceforge.net/index.html; classtype:attempted-recon; sid:2009039; rev:5; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Likely Dridex SSL Cert"; flow:established,from_server; content:"|16|"; content:"|0b|"; within:8; content:"|09 00|"; within:30; content:"|55 04 0b|"; distance:0; content:"|08|portable"; distance:1; within:9; content:"|55 04 03|"; distance:0; content:"|0b|nintendo.jp"; distance:1; within:12; classtype:trojan-activity; sid:2021388; rev:2; metadata:attack_target Client_Endpoint, created_at 2015_07_07, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M2"; flow:established,from_server; file_data; content:"pQGLlxyasMGLhxCco42bpR3YuVnZowWY2V"; classtype:exploit-kit; sid:2020427; rev:3; metadata:created_at 2015_02_16, updated_at 2019_09_27;)
+alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Denisca.A CnC Beacon 2"; dsize:37; content:"|2a 26|"; depth:2; content:"|26 5e|"; distance:22; fast_pattern; reference:md5,aaa4304dd5f22a017930a9eeebc8898f; classtype:command-and-control; sid:2021389; rev:1; metadata:attack_target Client_Endpoint, created_at 2015_07_07, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2015_07_07, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DRIVEBY [PwC CTD] -- MultiGroup - TH3BUG and Non-Targetted Groups Watering Hole Deobfuscation function"; flow:established,from_server; file_data; content:"Chr(CInt(ns(i)) Xor n)"; reference:url,pwc.blogs.com/cyber_security_updates/2014/10/scanbox-framework-whosaffected-and-whos-using-it-1.html; classtype:exploit-kit; sid:2020563; rev:4; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2015_02_25, deployment Perimeter, signature_severity Major, tag DriveBy, updated_at 2019_09_27;)
+#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|13|disaronnoterrace.es"; distance:1; within:20; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021391; rev:2; metadata:attack_target Client_and_Server, created_at 2015_07_07, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2016_07_01, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT Unknown Exploit Pack URL Detected"; flow:to_server,established; content:"/imgurl"; nocase; http_uri; content:".php"; nocase; http_uri; content:"hl="; nocase; http_uri; classtype:bad-unknown; sid:2012324; rev:5; metadata:created_at 2011_02_21, updated_at 2019_09_27;)
+#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Wekby PCRat/Gh0st CnC Beacon (Outbound)"; flow:to_server,established; content:"HTTP|5c|1.1 Sycmentec"; depth:18; reference:md5,cfbcb83f8515bd169afd0b22488b4430; reference:url,www.volexity.com/blog/?p=158; classtype:command-and-control; sid:2021395; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_07_09, deployment Perimeter, former_category MALWARE, malware_family Gh0st, malware_family PCRAT, signature_severity Major, tag PCRAT, tag Gh0st, tag RAT, tag c2, updated_at 2016_07_01, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE Possible /etc/passwd via HTTP (BSD style)"; flow:established,from_server; file_data; content:"root|3a|*|3a|0|3a|0|3a|"; nocase; content:"|3a|/root|3a|/bin"; nocase; reference:url,doc.emergingthreats.net/bin/view/Main/2003071; classtype:successful-recon-limited; sid:2003071; rev:9; metadata:created_at 2010_07_30, updated_at 2019_09_27;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Wekby PCRat/Gh0st CnC Beacon (Inbound)"; flow:established,to_client; content:"HTTP|5c|1.1 Sycmentec"; depth:18; reference:md5,cfbcb83f8515bd169afd0b22488b4430; reference:url,www.volexity.com/blog/?p=158; classtype:command-and-control; sid:2021396; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_07_09, deployment Perimeter, former_category MALWARE, malware_family Gh0st, malware_family PCRAT, signature_severity Major, tag PCRAT, tag Gh0st, tag RAT, tag c2, updated_at 2016_07_01, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Jul 12 2016"; flow:established,from_server; file_data; content:"|3c 73 70 61 6e 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 2d 31|"; pcre:"/^\d{3}px\x3b\swidth\x3a3\d{2}px\x3b\sheight\x3a3\d{2}px\x3b\x22>[^<>]*?"; fast_pattern; content:" $EXTERNAL_NET any (msg:"ET MALWARE Matryoshka CnC Beacon 1"; flow:established,to_server; urilen:>50; http.method; content:"GET"; http.uri; content:"/img/"; depth:5; content:"/"; distance:32; within:1; content:"/general.png"; endswith; fast_pattern; pcre:"/^\/img\/[a-f0-9]{32}\/[a-f0-9]+\/general\.png$/"; http.header_names; content:!"Referer|0d 0a|"; reference:md5,9853fc1f4d7ba23d728f4ee80842faf9; reference:url,minerva-labs.com/#!CopyKittens-Attack-Group/c7a5/5655651e0cf20a760c4cae95; classtype:command-and-control; sid:2022146; rev:4; metadata:attack_target Client_Endpoint, created_at 2015_11_25, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2020_10_05, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Mozilla Firefox mChannel Object Dangling Pointer Use-After-Free Memory Corruption Attempt"; flow:established,to_client; content:"QueryInterface|28|Components.interfaces.nsIChannelEventSink|29|"; nocase; content:"onChannelRedirect|28|null"; nocase; distance:0; reference:url,www.mozilla.org/security/announce/2011/mfsa2011-13.html; reference:bid,47635; reference:cve,2011-0065; classtype:attempted-user; sid:2013417; rev:2; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_08_18, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Scieron-A Checkin via HTTP POST 2"; flow:established,to_server; http.method; content:"POST"; http.uri; pcre:"/^\/\d+$/"; http.user_agent; content:"Sony|3b|"; fast_pattern; startswith; http.header_names; content:!"Referer|0d 0a|"; content:!"Accept"; reference:md5,f184c13be617754e394ecb8c972c8861; reference:url,symantec.com/connect/blogs/scarab-attackers-took-aim-select-russian-targets-2012; classtype:command-and-control; sid:2022188; rev:4; metadata:created_at 2015_11_26, former_category MALWARE, updated_at 2020_10_05;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Google Chrome Multiple Iframe PDF File Handling Memory Corruption Attempt"; flow:established,to_client; content:".pdf|22|><|2F|iframe>"; nocase; content:".pdf|22|><|2F|iframe>"; nocase; distance:0; content:".pdf|22|><|2F|iframe>"; nocase; distance:0; content:".pdf|22|><|2F|iframe>"; nocase; distance:0; content:".pdf|22|><|2F|iframe>"; nocase; distance:0; content:".pdf|22|><|2F|iframe>"; nocase; distance:0; reference:bid,49933; reference:cve,2011-2841; classtype:attempted-user; sid:2013742; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_10_05, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY External IP Lookup ip2nation.com"; flow:established,to_server; http.host; content:"www.ip2nation.com"; fast_pattern; bsize:17; classtype:external-ip-check; sid:2022222; rev:4; metadata:created_at 2015_12_07, former_category POLICY, updated_at 2020_10_05;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Adobe Shockwave Director tSAC Chunk memory corruption Attempt"; flowbits:isset,ET.flash.pdf; flow:established,to_client; content:"|74 53 41 43 1D 02 00 00 00 00 00 0F 00 00 00 AE 00 00 01 63 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 14 00 00 01 00 FF FF 11 11 00 00|"; reference:url,exploit-db.com/download_pdf/15077; classtype:attempted-user; sid:2011543; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_27, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET SCAN COMMIX Command injection scan attempt"; flow:to_server,established; threshold: type limit, count 1, seconds 60, track by_src; http.header; content:"|55 73 65 72 2d 41 67 65 6e 74 3a 20 63 6f 6d 6d 69 78|"; fast_pattern; reference:url,github.com/stasinopoulos/commix/blob/master/README.md; classtype:web-application-activity; sid:2022243; rev:4; metadata:created_at 2015_12_11, updated_at 2020_10_05;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Lilupophilupop Injected Script Being Served to Client"; flow:established,to_client; content:"|3C|script src=|22|http|3A|//lilupophilupop.com/sl.php|22|>|3C 2F|script>"; nocase; classtype:bad-unknown; sid:2013978; rev:3; metadata:created_at 2011_12_02, former_category CURRENT_EVENTS, updated_at 2011_12_02;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Joomla RCE M2 (Serialized PHP in UA)"; flow:established,to_server; http.header; content:"O|3a|"; fast_pattern; pcre:"/^User-Agent\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\}/mi"; reference:url,blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html; classtype:web-application-attack; sid:2022263; rev:4; metadata:created_at 2015_12_15, updated_at 2020_10_05;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Lilupophilupop Injected Script Being Served from Local Server"; flow:established,from_server; content:"|3C|script src=|22|http|3A|//lilupophilupop.com/sl.php|22|>|3C 2F|script>"; nocase; classtype:bad-unknown; sid:2013979; rev:3; metadata:created_at 2011_12_02, former_category CURRENT_EVENTS, updated_at 2011_12_02;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Possible MSXMLHTTP Request (exe) unset (no exe)"; flow:to_server,established; flowbits:isset,et.MS.XMLHTTP.no.exe.request; flowbits:unset,et.MS.XMLHTTP.no.exe.request; flowbits:noalert; http.uri; content:".exe"; nocase; fast_pattern; classtype:misc-activity; sid:2022264; rev:6; metadata:created_at 2015_12_15, updated_at 2020_10_05;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT User-Agent used in Injection Attempts"; flow:established,to_server; content:"User-Agent|3a| MOT-MPx220/1.400 Mozilla/4.0"; http_header; reference:url,lists.emergingthreats.net/pipermail/emerging-sigs/2011-December/016882.html; classtype:trojan-activity; sid:2014054; rev:2; metadata:created_at 2011_12_30, former_category CURRENT_EVENTS, updated_at 2011_12_30;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Possible MSXMLHTTP Request (msi) unset (no exe)"; flow:to_server,established; flowbits:isset,et.MS.XMLHTTP.no.exe.request; flowbits:unset,et.MS.XMLHTTP.no.exe.request; flowbits:noalert; http.uri; content:".msi"; nocase; fast_pattern; classtype:misc-activity; sid:2022265; rev:6; metadata:created_at 2015_12_15, updated_at 2020_10_05;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL WEB_CLIENT local resource redirection attempt"; flow:to_client,established; content:"Location|3A|"; nocase; pcre:"/^Location\x3a\s*URL\s*\x3a/smi"; reference:cve,2004-0549; reference:url,www.kb.cert.org/vuls/id/713878; classtype:attempted-user; sid:2102577; rev:7; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_23, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Possible MSXMLHTTP Request (msp) unset (no exe)"; flow:to_server,established; flowbits:isset,et.MS.XMLHTTP.no.exe.request; flowbits:unset,et.MS.XMLHTTP.no.exe.request; flowbits:noalert; http.uri; content:".msp"; nocase; fast_pattern; classtype:misc-activity; sid:2022266; rev:6; metadata:created_at 2015_12_15, updated_at 2020_10_05;)
+alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_CLIENT Adobe Reader and Acrobat U3D File Invalid Array Index Remote Code Execution Attempt"; flow:established,to_client; content:"/U3D/Length 172"; pcre:"/<<[^>]*\x2FU3D\x2FLength\x20172[0-5][0-9]{2}/sm"; reference:url,labs.idefense.com/intelligence/vulnerabilities/display.php?id=827; reference:url,www.adobe.com/support/security/bulletins/apsb09-15.html; reference:bid,36638; reference:cve,2009-2990; classtype:attempted-user; sid:2012179; rev:6; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_01_15, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Joomla RCE M3 (Serialized PHP in XFF)"; flow:established,to_server; http.header; content:"O|3a|"; fast_pattern; pcre:"/^X-Forwarded-For\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\}/mi"; reference:url,blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html; classtype:web-application-attack; sid:2022268; rev:4; metadata:created_at 2015_12_16, updated_at 2020_10_05;)
+#alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_CLIENT Clickpayz redirection to *.clickpayz.com"; flow:established,from_server; content:"HTTP/1.1 30"; depth:11; content:"clickpayz.com/"; classtype:bad-unknown; sid:2014318; rev:2; metadata:created_at 2012_03_06, former_category CURRENT_EVENTS, updated_at 2012_03_06;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Ragnarok Ransomware CnC Activity M2"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"&prv_ip="; fast_pattern; content:".doc"; content:".xls"; content:".ppt"; content:".sql"; content:".pdf"; reference:url,twitter.com/malwrhunterteam/status/1256263426441125888; reference:md5,32ed52d918a138ddad24dd3a84e20e56; classtype:command-and-control; sid:2030117; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_05_06, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2020_10_05, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Likely Malicious PDF Containing StrReverse"; flow:established,to_client; content:"%PDF-"; content:"StrReverse|28|"; distance:0; nocase; reference:url,doc.emergingthreats.net/2011246; classtype:bad-unknown; sid:2011246; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET USER_AGENTS User-Agent (Internet Explorer)"; flow:established,to_server; http.user_agent; content:"Internet Explorer"; depth:17; endswith; nocase; http.host; content:!"pnrws.skype.com"; content:!"iecvlist.microsoft.com"; content:!".lenovo.com"; reference:url,doc.emergingthreats.net/bin/view/Main/2008052; classtype:bad-unknown; sid:2008052; rev:20; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2020_10_05;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Internet Explorer CTableRowCellsCollectionCacheItem.GetNext Memory Use-After-Free Attempt"; flow:established,to_client; content:"document.getElementById|28 27|tableid|27 29|.cloneNode"; nocase; content:"cells.urns"; nocase; distance:0; content:"cells.item"; nocase; distance:0; reference:url,dvlabs.tippingpoint.com/blog/2012/03/15/pwn2own-2012-challenge-writeup; reference:url,technet.microsoft.com/en-us/security/bulletin/MS10-002; reference:bid,37894; reference:cve,2010-0248; classtype:attempted-user; sid:2014463; rev:3; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2012_04_04, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible Evil Macro Downloading Trojan Dec 16 2015 Post to EXE"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".exe"; nocase; fast_pattern; pcre:"/^[\x2fa-z\d]+\.exe$/"; http.header; content:"Content-Length|3a 20|0|0d 0a|Connection|3a 20|"; content:"Accept|3a 20|*/*|0d 0a|"; depth:13; content:"Accept-Encoding|3a 20|gzip, deflate|0d 0a|User-Agent|3a 20|Mozilla/4.0 (compatible|3b 20|MSIE 7.0|3b|"; http.header_names; content:!"Referer|0d 0a|"; classtype:trojan-activity; sid:2022270; rev:4; metadata:created_at 2015_12_17, former_category CURRENT_EVENTS, updated_at 2020_10_05;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT PDF Name Representation Obfuscation of /Subtype"; flow:established,to_client; content:"|0d 0a 0d 0a|PDF-"; content:"/"; distance:0; content:!"Subtype"; within:7; content:"#"; within:19; pcre:"/\x2F(?!Subtype)(S|#53)(u|#75)(b|#62)(t|#74)(y|#79)(p|#70)(e|#65)/"; reference:url,blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/; classtype:bad-unknown; sid:2011528; rev:6; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_22, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/ProPoS CnC Beacon"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php"; endswith; http.user_agent; content:"Pro PoS"; fast_pattern; startswith; http.accept; content:"application/octet-stream"; bsize:24; http.header_names; content:!"Referer|0d 0a|"; reference:url,blog.talosintel.com/2015/12/pro-pos.html; classtype:command-and-control; sid:2022282; rev:4; metadata:attack_target Client_Endpoint, created_at 2015_12_18, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2020_10_05, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT PDF Name Representation Obfuscation of Action"; flow:established,to_client; content:"|0d 0a 0d 0a|PDF-"; content:"/"; distance:0; content:!"Action"; within:6; content:"#"; within:16; pcre:"/\x2F(?!Action)(A|#41)(c|#63)(t|#74)(i|#69)(o|#6F)(n|#6E)/"; reference:url,blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/; classtype:bad-unknown; sid:2011529; rev:6; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_27, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Acecard.c  Checkin"; flow:to_server,established; urilen:1; http.method; content:"POST"; nocase; http.request_body; content:"{|22|type|22 3a|"; depth:8; content:",|22|text|22 3a|"; content:",|22|code|22 3a|"; fast_pattern; content:",|22|from|22 3a|"; content:"|22|}"; http.header_names; content:!"Referer|0d 0a|"; reference:md5,c9d3237885072b796e5849f7b9ec1a64; reference:url,b0n1.blogspot.com.br/2015/11/android-malware-drops-banker-from-png.html?m=1; reference:url,fireeye.com/blog/threat-research/2015/12/slembunk_an_evolvin.html; classtype:trojan-activity; sid:2022137; rev:5; metadata:affected_product Android, attack_target Mobile_Client, created_at 2015_11_24, deployment Perimeter, former_category MOBILE_MALWARE, tag Android, updated_at 2020_10_05, mitre_tactic_id TA0037, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT PDF Name Representation Obfuscation of Pages"; flow:established,to_client; content:"|0d 0a 0d 0a|PDF-"; content:"/"; distance:0; content:!"Pages"; within:5; content:"#"; within:13; pcre:"/\x2F(?!Pages)(P|#40)(a|#61)(g|#67)(e|#65)(s|#73)/"; reference:url,blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/; classtype:bad-unknown; sid:2011536; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_27, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY IOS Download from Vshare Marketplace (Possible DarkSideLoading)"; flow:to_server,established; http.uri; content:".ipa"; nocase; http.host; content:"appvv.com"; endswith; fast_pattern; classtype:policy-violation; sid:2022296; rev:4; metadata:created_at 2015_12_22, updated_at 2020_10_05;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible PDF Launch Function Remote Code Execution Attempt with Name Representation Obfuscation"; flow:to_client,established; content:"|0d 0a 0d 0a|PDF-"; content:"/"; distance:0; content:!"Launch"; within:6; content:"#"; within:16; content:".exe"; nocase; distance:0; pcre:"/\x2F(?!Launch)(L|#4C)(a|#61)(u|#75)(n#6E)(c|#63)(h|#68).+\x2F(W|#57)(i|#69)(n|#6E).+\x2Eexe/sm"; reference:url,www.kb.cert.org/vuls/id/570177; reference:url,www.h-online.com/security/news/item/Criminals-attempt-to-exploit-unpatched-hole-in-Adobe-Reader-979286.html; reference:url,www.sudosecure.net/archives/673; reference:url,www.h-online.com/security/news/item/Adobe-issues-official-workaround-for-PDF-vulnerability-971932.html; reference:url,blog.didierstevens.com/2010/03/31/escape-from-foxit-reader/; reference:url,www.m86security.com/labs/i/PDF-Launch-Feature-Used-to-Install-Zeus,trace.1301~.asp; reference:url,blog.didierstevens.com/2008/04/29/pdf-let-me-count-the-ways/; classtype:bad-unknown; sid:2011329; rev:5; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_09_28, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Android Download from Vshare Marketplace (Possible DarkSideLoading)"; flow:to_server,established; http.uri; content:".apk"; nocase; http.host; content:"appvv.com"; endswith; fast_pattern; classtype:policy-violation; sid:2022297; rev:4; metadata:created_at 2015_12_22, updated_at 2020_10_05;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT RedKit - Landing Page Received - applet and code"; flow:established,to_client; content:" $EXTERNAL_NET any (msg:"ET MALWARE Possible Win32/Dimegup.A Downloading Image Common URI Struct"; flow:established,to_server; http.uri; content:"/444.jpg"; fast_pattern; http.host; content:"postimg.org"; endswith; http.header_names; content:!"Referer|0d 0a|"; reference:md5,914c58df5d868f7c3438921d682f7fe5; classtype:trojan-activity; sid:2018022; rev:7; metadata:created_at 2014_01_28, updated_at 2020_10_05;)
+#alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET WEB_CLIENT Request to malicious info.php drive-by landing"; flow:established,to_server; content:"/info.php?n="; http_uri; fast_pattern:only; content:!"&"; http_uri; content:!"|0d 0a|Referer|3a|"; pcre:"/\/info.php\?n=\d/U"; classtype:trojan-activity; sid:2013010; rev:3; metadata:created_at 2011_06_10, former_category CURRENT_EVENTS, updated_at 2011_06_10;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Htbot.B Checkin"; flow:to_server,established; http.uri; content:".php?command="; fast_pattern; pcre:"/\.php\?command=(?:g(?:hl|et(?:ip|id|backconnect))|update2?|dl|log)(?:$|&)/"; http.user_agent; content:"pb"; bsize:2; reference:md5,bdd2328d466e563a650bb7ccdb9aca79; reference:md5,ba1404af71ecf3ca8b0e30a2b365f6fd; reference:url,www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Backdoor%3AWin32%2FHtbot.B; classtype:command-and-control; sid:2020089; rev:6; metadata:created_at 2015_01_05, former_category MALWARE, updated_at 2020_10_05;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT FoxxySoftware - Landing Page Received - applet and 0px"; flow:established,to_client; content:" $EXTERNAL_NET any (msg:"ET MALWARE Malicious VBS Downloader fake image zip"; flow:to_server,established; http.method; content:"GET"; http.uri; content:".zip"; endswith; nocase; fast_pattern; pcre:"/\.(?:gif|jpe?g)\.zip$/i"; http.content_type; content:"text/plain|3b 20|Charset=UTF-8"; bsize:25; reference:md5,7b678a25c533652dbb0c2a2ac37cf1e3; classtype:trojan-activity; sid:2022334; rev:4; metadata:created_at 2016_01_06, updated_at 2020_10_05;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Base64 - Landing Page Received - base64encode(GetOs()"; flow:established,to_client; content:"base64encode(GetOs()"; classtype:trojan-activity; sid:2014960; rev:2; metadata:created_at 2012_06_26, former_category CURRENT_EVENTS, updated_at 2012_06_26;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.CruseWin Retriving XML File from Hard Coded CnC"; flow:established,to_server; flowbits:set,ET.And.CruseWin; flowbits:noalert; http.uri; content:"/flash/test.xml"; fast_pattern; reference:url,www.fortiguard.com/encyclopedia/virus/android_crusewin.a!tr.html; classtype:command-and-control; sid:2013193; rev:5; metadata:affected_product Android, attack_target Client_Endpoint, created_at 2011_07_05, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Critical, tag Android, updated_at 2020_10_05;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT FoxxySoftware - Landing Page Received - foxxysoftware"; flow:established,to_client; content:"|7C|foxxysoftware|7C|"; classtype:trojan-activity; sid:2014935; rev:4; metadata:created_at 2012_06_22, former_category CURRENT_EVENTS, updated_at 2012_06_22;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER WEBSHELL Linux/Torte Uploaded"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"JGVudiA9ICJYRFZTTl9TRVNTSU9OX0NPT0tJR"; fast_pattern; content:"eval(base64_decode($_REQUEST["; reference:url,blog.malwaremustdie.org/2016/01/mmd-0050-2016-incident-report-elf.html; classtype:attempted-admin; sid:2022359; rev:4; metadata:created_at 2016_01_13, updated_at 2020_10_05;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT c3284d Malware Network Compromised Redirect (comments 1)"; flow:established,to_client; file_data; content:"#c3284d#"; distance:0; content:"#/c3284d#"; distance:0; reference:url,stopmalvertising.com/malware-reports/the-c3284d-malware-network-stats.php.html; classtype:trojan-activity; sid:2015051; rev:4; metadata:created_at 2012_07_12, updated_at 2012_07_12;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Linux/Torte Checkin"; flow:established,to_server; http.uri; content:"/logo.gif?sessd="; fast_pattern; content:"&sessc="; content:"&sessk="; distance:0; http.header; pcre:"/^(?:zh-CN|en-US)\x3b rv\x3a1\.7\.6\)\r\n/R"; http.user_agent; content:"Mozilla/5.0 (Windows|3b 20|U|3b 20|Windows NT 5.1|3b 20|"; startswith; reference:url,blog.malwaremustdie.org/2016/01/mmd-0050-2016-incident-report-elf.html; classtype:command-and-control; sid:2022358; rev:5; metadata:created_at 2016_01_13, former_category MALWARE, updated_at 2020_10_05;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT c3284d Malware Network Compromised Redirect (comments 2)"; flow:established,to_client; file_data; content:""; distance:0; content:""; distance:0; reference:url,stopmalvertising.com/malware-reports/the-c3284d-malware-network-stats.php.html; classtype:trojan-activity; sid:2015052; rev:4; metadata:created_at 2012_07_12, updated_at 2012_07_12;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER WEBSHELL JSP/Backdoor Shell Access"; flow:established,to_server; http.uri; content:".war?cmd="; fast_pattern; content:"&winurl="; content:"&linurl="; pcre:"/\.war\?cmd=[a-zA-Z0-9+/=]+&winurl=[a-zA-Z0-9+/=]*&linurl=[a-zA-Z0-9+/=]*/"; reference:url,blog.malwaremustdie.org/2016/01/mmd-0049-2016-case-of-java-trojan.html; classtype:successful-admin; sid:2022348; rev:5; metadata:created_at 2016_01_12, updated_at 2020_10_05;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT c3284d Malware Network Compromised Redirect (comments 3)"; flow:established,from_server; file_data; content:"/*c3284d*/"; reference:url,blog.unmaskparasites.com/2012/06/22/runforestrun-and-pseudo-random-domains/; classtype:trojan-activity; sid:2015524; rev:2; metadata:created_at 2012_07_25, updated_at 2022_05_03;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY External IP Lookup - ip.tyk.nu"; flow:established,to_server; urilen:1; http.host; content:"ip.tyk.nu"; fast_pattern; bsize:9; classtype:external-ip-check; sid:2022368; rev:4; metadata:created_at 2016_01_14, former_category POLICY, updated_at 2020_10_05;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Fake-AV Conditional Redirect (Blackmuscats)"; flow:established,to_server; content:"/blackmuscats?"; fast_pattern:only; http_uri; reference:url,blog.sucuri.net/2012/07/blackmuscats-conditional-redirections-to-faveav.html/; classtype:trojan-activity; sid:2015553; rev:3; metadata:created_at 2012_07_31, former_category CURRENT_EVENTS, updated_at 2012_07_31;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspicious LastPass URI Structure - Possible Phishing"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/tabDialog.html?dialog=login"; fast_pattern; reference:url,www.seancassidy.me/lostpass.html; classtype:social-engineering; sid:2022374; rev:4; metadata:attack_target Client_Endpoint, created_at 2016_01_19, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2020_10_05, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Malicious PHP 302 redirect response with avtor URI and cookie"; flow:established,from_server; content:"302"; http_stat_code; content:".php?avtor="; fast_pattern; content:"Set-Cookie|3a| "; content:"avtor="; within:40; classtype:trojan-activity; sid:2013011; rev:6; metadata:created_at 2011_06_10, former_category CURRENT_EVENTS, updated_at 2011_06_10;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY External IP Lookup - meuip.net.br"; flow:established,to_server; http.host; content:"meuip.net.br"; fast_pattern; bsize:12; classtype:external-ip-check; sid:2022405; rev:4; metadata:created_at 2016_01_25, former_category POLICY, updated_at 2020_10_05;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Foxit PDF Reader Title Stack Overflow"; flow:established,to_client; content:"|0d 0a 0d 0a|PDF-"; content:"|2f|Title"; nocase; distance:0; isdataat:540,relative; content:!"|0A|"; within:540; reference:url,www.exploit-db.com/exploits/15532/; classtype:attempted-user; sid:2012064; rev:4; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_12_17, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Feb 05 2016"; flow:established,to_server; http.uri; content:"/?keyword="; fast_pattern; pcre:"/\/\?keyword=(?:(?=[a-f]{0,31}[0-9])(?=[0-9]{0,31}[a-f])[a-f0-9]{32}|\d{5})$/"; classtype:exploit-kit; sid:2022493; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_02_06, deployment Perimeter, signature_severity Major, tag Redirector, updated_at 2020_10_05;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Malicious Redirect n.php h=*&s=*"; flow:to_server,established; content:"/n.php?h="; fast_pattern:only; http_uri; content:"&s="; http_uri; content:".rr.nu|0d 0a|"; http_header; pcre:"/\/n\.php\?h=\w*?&s=\w{1,5}$/Ui"; reference:url,0xicf.wordpress.com/category/security-updates/; reference:url,urlquery.net/report.php?id=111302; classtype:attempted-user; sid:2015669; rev:10; metadata:created_at 2012_08_23, former_category WEB_CLIENT, updated_at 2012_08_23;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/LockScreen CnC HTTP Pattern"; flow:established,to_server; http.method; content:"GET"; http.uri; content:",0x"; fast_pattern; pcre:"/(?:,0x[0-9a-f]{2}){10}$/"; http.header_names; content:"|0d 0a|Host|0d 0a 0d 0a|"; bsize:10; reference:md5,8df8d0cd70f96538211c65fb6361704d; classtype:command-and-control; sid:2022494; rev:4; metadata:created_at 2016_02_08, former_category MALWARE, updated_at 2020_10_05;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Microsoft Rich Text File download - SET"; flow:from_server,established; file_data; content:"|7B 5C 72 74 66 31|"; within:6; flowbits:set,ET.http.rtf.download; flowbits:noalert; reference:cve,2012-0183; classtype:attempted-user; sid:2015790; rev:2; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2012_10_10, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/HydraCrypt CnC Beacon 1"; flow:established,to_server; urilen:11; http.method; content:"GET"; http.uri; content:"/flamme.php"; fast_pattern; http.header; content:"Cache-Control|3a 20|no-cache"; http.header_names; content:"|0d 0a|Host|0d 0a|Connection|0d 0a|Cache-Control|0d 0a 0d 0a|"; startswith; http.connection; content:"Keep-Alive"; bsize:10; classtype:command-and-control; sid:2022495; rev:4; metadata:attack_target Client_Endpoint, created_at 2016_02_08, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2020_10_05, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Microsoft OLE Compound File Magic Bytes Flowbit Set"; flow:to_client,established; file_data; content:"|d0 cf 11 e0 a1 b1 1a e1|"; within:8; content:!".msi"; flowbits:set,OLE.CompoundFile; flowbits:noalert; classtype:protocol-command-decode; sid:2012520; rev:7; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2010_12_15, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Putter Panda HTTPClient CnC HTTP Request"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/Microsoft"; nocase; content:"/default.asp"; distance:0; content:"?tmp="; fast_pattern; pcre:"/\/default\.aspx?\?tmp=(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$/"; http.header_names; content:!"Referer|0d 0a|"; reference:url,resources.crowdstrike.com/putterpanda/; reference:md5,544fca6eb8181f163e2768c81f2ba0b3; classtype:command-and-control; sid:2018554; rev:6; metadata:created_at 2014_06_11, former_category MALWARE, updated_at 2020_10_05;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Potential MSXML2.FreeThreadedDOMDocument Uninitialized Memory Corruption Attempt"; flow:to_client,established; content:"f6d90f12-9c73-11d3-b32e-00c04f990bb4"; nocase; content:"definition"; nocase; pcre:"/clsid\s*\x3a\s*\x7B?\s*f6d90f12-9c73-11d3-b32e-00c04f990bb4/si"; pcre:"/(?:\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\(/"; reference:cve,2012-1889; classtype:attempted-user; sid:2015557; rev:6; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2012_07_10, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Bedep HTTP POST CnC Beacon 2"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php?"; fast_pattern; pcre:"/\.php(?:\?[a-zA-Z0-9=&]+)?$/"; http.header; pcre:"/^(?:Connection\x3a[^\r\n]+\r\n)?(?:Content-Type\x3a[^\r\n]+\r\n)?Accept\x3a[^\r\n]+\r\n(?:Accept-Encoding\x3a[^\r\n]+\r\n)?Accept-Language\x3a[^\r\n]+\r\n(?:Referer\x3a[^\r\n]+\.php[^\r\n]*?\r\n)?User-Agent\x3a[^\r\n]+(?: MSIE |rv\x3a11)/i"; http.cookie; content:"PHPSESSID="; pcre:"/(?:[a-z]+=\d{3,4}\x3b\x20){4}/"; http.request_body; pcre:"/^[a-z]+\d*=(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(?:&[a-z]+\d*=(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})){2,}$/"; http.accept; content:"text/html, application/xhtml+xml, */*"; bsize:37; classtype:command-and-control; sid:2021718; rev:6; metadata:attack_target Client_Endpoint, created_at 2015_08_26, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2020_10_05, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT MALVERTISING FlashPost - Redirection IFRAME"; flow:established,to_client; file_data; content:"{|22|iframe|22 3a|true,|22|url|22|"; within:20; classtype:bad-unknown; sid:2016022; rev:2; metadata:created_at 2012_12_13, former_category CURRENT_EVENTS, updated_at 2012_12_13;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Ransomware/Coverton Checkin"; flow:to_server,established; http.uri; content:".php?ch="; fast_pattern; http.header; content:"|0d 0a|Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a|Content-length|3a 20|0|0d 0a|"; http.header_names; content:!"User-Agent|0d 0a|"; content:!"Referer|0d 0a|"; reference:md5,c5c4f4860c69ea7469ca3be3caf5bf18; classtype:command-and-control; sid:2022676; rev:4; metadata:attack_target Client_Endpoint, created_at 2016_03_28, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2020_10_05, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Drupal Mass Injection Campaign Inbound"; flow:established,from_server; file_data; content:"if (i5463 == null) { var i5463 = 1|3b|"; classtype:bad-unknown; sid:2016098; rev:2; metadata:created_at 2012_12_28, former_category CURRENT_EVENTS, updated_at 2012_12_28;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Ransomware/Coverton CnC 1"; flow:to_server,established; http.request_body; content:"task=report&id="; fast_pattern; http.header_names; content:!"User-Agent|0d 0a|"; content:!"Referer|0d 0a|"; reference:md5,c5c4f4860c69ea7469ca3be3caf5bf18; classtype:command-and-control; sid:2022677; rev:4; metadata:attack_target Client_Endpoint, created_at 2016_03_28, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2020_10_05, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Drupal Mass Injection Campaign Outbound"; flow:established,from_server; file_data; content:"if (i5463 == null) { var i5463 = 1|3b|"; classtype:bad-unknown; sid:2016099; rev:2; metadata:created_at 2012_12_28, former_category CURRENT_EVENTS, updated_at 2012_12_28;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Ransomware/Coverton CnC 2"; flow:to_server,established; http.request_body; content:"task=knock&pub="; fast_pattern; http.header_names; content:!"User-Agent|0d 0a|"; content:!"Referer|0d 0a|"; reference:md5,c5c4f4860c69ea7469ca3be3caf5bf18; classtype:command-and-control; sid:2022678; rev:4; metadata:attack_target Client_Endpoint, created_at 2016_03_28, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Ransomware, updated_at 2020_10_05, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT RedKit - Landing Page"; flow:established,to_client; file_data; content:".jar"; nocase; fast_pattern; content:".pdf"; nocase; content:"Msxml2.XMLHTTP"; nocase; classtype:exploit-kit; sid:2016128; rev:2; metadata:created_at 2012_12_29, former_category CURRENT_EVENTS, updated_at 2012_12_29;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.TreasureHunter Checkin"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/gate.php"; content:"request=true"; fast_pattern; http.request_body; content:"request="; depth:8; http.header_names; content:!"Referer|0d 0a|"; content:!"|0d 0a|Accept-"; reference:md5,070e9a317ee53ac3814eb86bc7d5bf49; reference:url,isc.sans.edu/forums/diary/How+Malware+Generates+Mutex+Names+to+Evade+Detection/19429/; classtype:command-and-control; sid:2022681; rev:3; metadata:created_at 2016_03_29, former_category MALWARE, updated_at 2020_10_05;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Microsoft OLE Compound File With Flash"; flow:to_client,established; content:"CONTROL ShockwaveFlash.ShockwaveFlash"; flowbits:isset,OLE.CompoundFile; flowbits:set,OLE.WithFlash; classtype:protocol-command-decode; sid:2016395; rev:7; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2013_02_09, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Observed Malicious SSL Cert (Fullz House CC Skimmer)"; flow:established,to_client; tls.cert_subject; content:"CN=google-sale.com"; bsize:18; fast_pattern; reference:url,blog.malwarebytes.com/malwarebytes-news/2020/10/mobile-network-operator-falls-into-the-hands-of-fullz-house-criminal-group/; classtype:domain-c2; sid:2030969; rev:1; metadata:affected_product Web_Browsers, attack_target Client_and_Server, created_at 2020_10_06, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, tag CardSkimmer, updated_at 2020_10_06, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Office File With Embedded Executable"; flow:established,to_client; file_data; content:"|D0 CF 11 E0 A1 B1 1A E1|"; within:8; content:"MZ"; distance:0; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; classtype:trojan-activity; sid:2012684; rev:8; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2011_04_11, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2016_07_01;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.Elise CnC Beacon 2"; flow:to_server,established; http.method; content:"POST"; http.uri; content:".html"; nocase; fast_pattern; pcre:"/\/\d{8,10}\.html$/i"; http.content_len; byte_test:0,=,0,0,string,dec; http.host; content:!"www.youdao.com"; startswith; http.header_names; content:!"Content-Type|0d 0a|"; content:!"Accept-"; content:!"Referer|0d 0a|"; reference:md5,cfa7954722d4277d26e96edc3289a4ce; reference:url,github.com/pan-unit42/iocs/tree/master/lotusblossom; classtype:command-and-control; sid:2021276; rev:6; metadata:attack_target Client_Endpoint, created_at 2015_06_16, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2020_10_06, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Microsoft Rich Text File download with vulnerable ActiveX control flowbit set 1"; flow:from_server,established; flowbits:isset,ETPRO.RTF; file_data; content:"|5c|object"; distance:0; content:"|5c|objocx"; distance:0; content:"|5c|objdata"; distance:0; content:"4BF0D1BD8B85D111B16A00C0F0283628"; distance:0; flowbits:set,ETPRO.RTF.OBJ; flowbits:noalert; reference:cve,2012-0158; classtype:attempted-user; sid:2025082; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2012_04_11, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, tag ActiveX, tag Web_Client_Attacks, updated_at 2017_11_29;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY External IP Address Lookup via dawhois.com"; flow:established,to_server; http.host; content:"www.dawhois.com"; fast_pattern; bsize:15; classtype:external-ip-check; sid:2022687; rev:4; metadata:created_at 2016_03_30, updated_at 2020_10_06;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Microsoft Rich Text File download with vulnerable ActiveX control flowbit set 2"; flow:from_server,established; flowbits:isset,ETPRO.RTF; file_data; content:"|5c|object"; distance:0; content:"|5c|objocx"; distance:0; content:"|5c|objdata"; distance:0; content:"E0F56B9944805046ADEB0B013914E99C"; distance:0; flowbits:set,ETPRO.RTF.OBJ; flowbits:noalert; reference:cve,2012-0158; classtype:attempted-user; sid:2025083; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2012_04_11, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, tag ActiveX, tag Web_Client_Attacks, updated_at 2017_11_29;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Backdoor.Dripion External IP Check"; flow:established,to_server; urilen:1; http.method; content:"GET"; http.uri; content:"/"; http.user_agent; content:"Mozilla/4.0"; bsize:11; http.host; content:"www.dawhois.com"; fast_pattern; bsize:15; http.content_type; content:"application/x-www-form-urlencoded"; bsize:33; reference:md5,e7205c0b80035b629d80b5e7aeff7b0e; reference:url,symantec.com/connect/blogs/taiwan-targeted-new-cyberespionage-back-door-trojan; classtype:external-ip-check; sid:2022688; rev:4; metadata:created_at 2016_03_30, updated_at 2020_10_06;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Microsoft Rich Text File download with vulnerable ActiveX control flowbit set 3"; flow:from_server,established; flowbits:isset,ETPRO.RTF; content:"|5c|object"; content:"|5c|objocx"; distance:0; content:"|5c|objdata"; distance:0; content:"5FDC81917DE08A41ACA68EEA1ECB8E9E"; distance:0; flowbits:set,ETPRO.RTF.OBJ; flowbits:noalert; reference:cve,2012-0158; classtype:attempted-user; sid:2025084; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2012_04_11, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, tag ActiveX, tag Web_Client_Attacks, updated_at 2017_11_29;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Backdoor.Dripion HTTP CnC Checkin"; flow:established,to_server; urilen:1; http.method; content:"GET"; http.uri; content:"/"; http.user_agent; content:"Mozilla/4.0"; fast_pattern; bsize:11; http.request_body; content:"|40 24|"; depth:2; pcre:"/^\x40\x24[^\x20-\x7e\r\n]+$/s"; http.content_type; content:"application/x-www-form-urlencoded"; bsize:33; reference:md5,e7205c0b80035b629d80b5e7aeff7b0e; reference:url,symantec.com/connect/blogs/taiwan-targeted-new-cyberespionage-back-door-trojan; classtype:command-and-control; sid:2022689; rev:4; metadata:created_at 2016_03_30, former_category MALWARE, updated_at 2020_10_06;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT SofosFO/NeoSploit possible second stage landing page"; flow:established,to_server; urilen:>25; content:"/50a"; http_uri; depth:4; pcre:"/^\/50a[a-f0-9]{21}\/(((\d+,)+\d+)|null)\//U"; flowbits:set,et.exploitkitlanding; classtype:trojan-activity; sid:2015847; rev:5; metadata:created_at 2012_10_27, former_category CURRENT_EVENTS, updated_at 2012_10_27;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/Opfake.A Country CnC Beacon"; flow:established,to_server; http.uri; content:".php?"; content:"co"; content:"untry="; content:"phone="; content:"&op="; content:"imei="; fast_pattern; http.user_agent; content:"Apache-HttpClient/"; depth:18; http.header_names; content:!"Referer|0d 0a|"; reference:url,quequero.org/2013/09/android-opfake-malware-analysis/; classtype:command-and-control; sid:2017588; rev:8; metadata:affected_product Android, attack_target Client_Endpoint, created_at 2013_10_14, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, tag Android, tag c2, updated_at 2020_10_06, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Injection - var j=0"; flow:established,to_client; file_data; content:"00|3a|00|3a|00|3b| path=/|22 3b|var j=0|3b| while(j"; classtype:trojan-activity; sid:2016830; rev:2; metadata:created_at 2013_05_07, former_category CURRENT_EVENTS, updated_at 2013_05_07;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Agent.XST Keepalive"; flow:established,to_server; threshold: type limit, count 1, seconds 60, track by_src; http.method; content:"POST"; http.uri; content:".asp"; http.header; content:"Content-Length|3a 20|2|0d 0a|"; fast_pattern; http.request_body; content:"ok"; depth:2; http.content_type; content:"text/html"; bsize:9; http.header_names; content:!"Referer|0d 0a|"; content:!"Accept|0d 0a|"; reference:md5,d579d7a42ff140952da57264614c37bc; reference:url,asert.arbornetworks.com/wp-content/uploads/2016/01/ASERT-Threat-Intelligence-Brief-Uncovering-the-Seven-Pointed-Dagger.pdf; classtype:trojan-activity; sid:2022363; rev:5; metadata:created_at 2016_01_13, updated_at 2020_10_06;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT MALVERTISING Flash - URI - /loading?vkn="; flow:established,to_server; content:"/loading?vkn="; http_uri; classtype:trojan-activity; sid:2017032; rev:2; metadata:created_at 2013_06_19, former_category CURRENT_EVENTS, updated_at 2013_06_19;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Agent.XST/UP007 Keepalive 2"; flow:established,to_server; threshold: type limit, count 1, seconds 60, track by_src; http.method; content:"POST"; http.uri; content:".asp"; http.header; content:"Content-Length|3a 20|5|0d 0a|"; fast_pattern; http.request_body; content:"READY"; depth:5; http.content_type; content:"text/html"; bsize:9; http.header_names; content:!"Referer|0d 0a|"; content:!"Accept|0d 0a|"; reference:url,citizenlab.org/2016/04/between-hong-kong-and-burma; classtype:trojan-activity; sid:2022750; rev:4; metadata:created_at 2016_04_20, updated_at 2020_10_06;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT DRIVEBY Redirection - Wordpress Injection"; flow:established,to_client; file_data; content:"15,15,155,152,44,54"; classtype:trojan-activity; sid:2017124; rev:2; metadata:affected_product Any, affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2013_07_09, deployment Perimeter, deployment Datacenter, former_category CURRENT_EVENTS, signature_severity Major, tag DriveBy, tag Wordpress, updated_at 2016_07_01;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TrojanDownloader.Banload.XDL Checkin"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/okok/Notify.php"; fast_pattern; http.user_agent; content:"Mozilla/3.0 (compatible|3b 20|Indy Library)"; bsize:38; reference:md5,70adf5506c767590e11bdc473c91bb38; classtype:command-and-control; sid:2022754; rev:4; metadata:created_at 2016_04_22, former_category MALWARE, updated_at 2020_10_06;)
+#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT DRIVEBY Redirection - phpBB Injection"; flow:established,to_server; content:".js?"; http_uri; content:"&"; distance:6; within:1; http_uri; pcre:"/\/[0-9]{6}\.js\?[0-9]{6}&[0-9a-f]{16}$/Ui"; classtype:trojan-activity; sid:2017149; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2013_07_16, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag DriveBy, updated_at 2016_07_01;)
 
-alert http any any -> $HOME_NET 8080 (msg:"ET EXPLOIT Linksys Router Unauthenticated Remote Code Execution"; flow:to_server,established; http.method; content:"POST"; http.uri; content:".cgi"; nocase; http.header; content:"Authorization|3a 20|Basic"; http.request_body; content:"%74%74%63%70%5f%69%70%3d%2d%68%20%60"; fast_pattern; reference:url,sans.org/reading-room/whitepapers/malicious/analyzing-backdoor-bot-mips-platform-35902; classtype:attempted-user; sid:2022758; rev:4; metadata:created_at 2016_04_25, updated_at 2020_10_06;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Malicious Redirect June 18 2013"; flow:established,to_client; file_data; content:",53,154,170,170,164,76,63,63,"; classtype:trojan-activity; sid:2017035; rev:3; metadata:created_at 2013_06_19, former_category CURRENT_EVENTS, updated_at 2013_06_19;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Fullz House Credit Card Skimmer Data Exfil"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/ga.php?analytic=WyJ1cmwl"; fast_pattern; reference:url,blog.malwarebytes.com/malwarebytes-news/2020/10/mobile-network-operator-falls-into-the-hands-of-fullz-house-criminal-group/; classtype:command-and-control; sid:2030979; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_10_06, deployment Perimeter, deployment SSLDecrypt, former_category MALWARE, performance_impact Low, signature_severity Major, tag CardSkimmer, updated_at 2020_10_06;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT JS Browser Based Ransomware"; flow:established,from_server; file_data; content:"YOUR BROWSER HAS BEEN LOCKED.|5c|n|5c|nALL PC DATA WILL BE DETAINED"; reference:url,blog.malwarebytes.org/intelligence/2013/07/fbi-ransomware-now-targeting-apples-mac-os-x-users/; reference:url,www.f-secure.com/weblog/archives/00002577.html; classtype:trojan-activity; sid:2017165; rev:2; metadata:attack_target Client_Endpoint, created_at 2013_07_19, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, tag Ransomware, updated_at 2013_07_19, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER ImageMagick CVE-2016-3718 SSRF Inbound (mvg + fill + url)"; flow:established,to_server; http.request_body; content:"viewbox|20|"; nocase; fast_pattern; content:"fill"; content:"url("; distance:0; nocase; pcre:"/^\s*https?\x3a\/\//Ri"; classtype:web-application-attack; sid:2022791; rev:5; metadata:created_at 2016_05_04, updated_at 2020_10_06;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT FlimKit Landing 07/22/13"; flow:established,to_client; flowbits:isnotset,FlimKit.Landing; flowbits:set,FlimKit.Landing; file_data; content:"applet"; nocase; fast_pattern:only; content:".substring("; content:"|3b|document.write("; nocase; distance:0; content:"|3b|var "; pcre:"/^\s*?(?P[a-z]{3,6})\s*?=[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]*?\x3bdocument\.write\((?P=var)\)\x3b<\/script>/R"; classtype:trojan-activity; sid:2017168; rev:4; metadata:created_at 2013_07_23, former_category CURRENT_EVENTS, updated_at 2013_07_23;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER ImageMagick CVE-2016-3715 File Deletion Inbound (ephermeral:+ mvg)"; flow:established,to_server; http.request_body; content:"viewbox|20|"; nocase; fast_pattern; content:"ephemeral"; nocase; pcre:"/^\s*\x3a\s*[./]/Ri"; classtype:web-application-attack; sid:2022792; rev:5; metadata:created_at 2016_05_04, updated_at 2020_10_06;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT c0896 Hacked Site Response (Inbound) 1"; flow:established,to_client; file_data; content:""; fast_pattern; content:"split"; distance:0; classtype:trojan-activity; sid:2017184; rev:2; metadata:created_at 2013_07_24, former_category CURRENT_EVENTS, updated_at 2013_07_24;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER ImageMagick CVE-2016-3716 Move File Inbound (msl: + mvg)"; flow:established,to_server; http.request_body; content:"viewbox|20|"; nocase; fast_pattern; content:"msl"; nocase; pcre:"/^\s*\x3a\s*[./]/Ri"; classtype:web-application-attack; sid:2022793; rev:5; metadata:created_at 2016_05_04, updated_at 2020_10_06;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT c0896 Hacked Site Response (Inbound) 2"; flow:established,to_client; file_data; content:"#0c0896#"; fast_pattern; content:"split"; distance:0; classtype:trojan-activity; sid:2017185; rev:2; metadata:created_at 2013_07_24, former_category CURRENT_EVENTS, updated_at 2013_07_24;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER ImageMagick CVE-2016-3717 Local File Read Inbound (label: + mvg)"; flow:established,to_server; http.request_body; content:"viewbox|20|"; nocase; fast_pattern; content:"label"; nocase; pcre:"/^\s*\x3a\s*\x40/Ri"; classtype:web-application-attack; sid:2022794; rev:5; metadata:created_at 2016_05_04, updated_at 2020_10_06;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT c0896 Hacked Site Response (Inbound) 3"; flow:established,to_client; file_data; content:"/*0c0896*/"; fast_pattern; content:"split"; distance:0; classtype:trojan-activity; sid:2017186; rev:2; metadata:created_at 2013_07_24, former_category CURRENT_EVENTS, updated_at 2013_07_24;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Xbagger Macro Encrypted DL"; flow:established,to_server; http.uri; content:".jpg?"; fast_pattern; pcre:"/^\/[a-z0-9]+\.jpg\?(?=[a-z0-9]*[A-Z]+[a-z0-9])[A-Za-z0-9]+=\d{1,4}$/"; http.header; content:"Range"; http.user_agent; content:"MSIE 7.0|3b 20|Windows NT"; classtype:trojan-activity; sid:2022500; rev:7; metadata:created_at 2016_02_10, former_category CURRENT_EVENTS, updated_at 2020_10_06;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT c0896 Hacked Site Response Hex (Inbound)"; flow:established,to_client; file_data; content:"0c0896"; fast_pattern; content:"="; distance:0; pcre:"/^[^\x22\x27\x3b]*?[\x22\x27](?P[a-f0-9]{2})(?P[^0-9a-f])(?P[a-f0-9]{2})(?P=sep)[a-f0-9]{2}(?P=sep)(?P(?!(?P=f))[a-f0-9]{2})(?P=sep)([a-f0-9]{2}(?P=sep)){4}(?P=n)(?P=sep)(?P=space)(?P=sep)(?P(?!((?P=f)|(?P=n)))[a-f0-9]{2})(?P=sep)(?P=z)(?P=sep)(?P=z)(?P=sep)(?P=f)(?P=sep)(?P=f)(?P=sep)(?P=f)/R"; classtype:trojan-activity; sid:2017195; rev:3; metadata:created_at 2013_07_25, former_category CURRENT_EVENTS, updated_at 2013_07_25;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Sality-GR Checkin 2"; flow:to_server,established; http.uri; content:".png?"; fast_pattern; pcre:"/\.png\x3f[0-9a-f]{4,8}\x3d\d+?$/"; http.header_names; content:!"Accept"; content:!"Referer"; content:"|0d 0a|User-Agent|0d 0a|"; startswith; reference:md5,99d614964eafe83ec4ed1a4537be35b9; classtype:command-and-control; sid:2022804; rev:4; metadata:created_at 2016_05_13, former_category MALWARE, updated_at 2020_10_06;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT c0896 Hacked Site Response Octal (Inbound)"; flow:established,to_client; file_data; content:"0c0896"; fast_pattern; content:"="; distance:0; pcre:"/^[^\x22\x27\x3b]*?[\x22\x27](?P[0-7]{1,3})(?P[^0-9a-f])(?P[0-7]{1,3})(?P=sep)[0-7]{1,3}(?P=sep)(?P(?!(?P=f))[0-7]{1,3})(?P=sep)([0-7]{1,3}(?P=sep)){4}(?P=n)(?P=sep)(?P=space)(?P=sep)(?P(?!((?P=f)|(?P=n)))[0-7]{1,3})(?P=sep)(?P=z)(?P=sep)(?P=z)(?P=sep)(?P=f)(?P=sep)(?P=f)(?P=sep)(?P=f)/R"; classtype:trojan-activity; sid:2017194; rev:3; metadata:created_at 2013_07_25, former_category CURRENT_EVENTS, updated_at 2013_07_25;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Enfal CnC POST"; flow:to_server,established; http.method; content:"POST"; http.uri; content:".cgi"; fast_pattern; endswith; http.header; pcre:"/^Host\x3a[^\r\n]+\r\nContent-Length\x3a\x20\d+\r\n(?:Cache-Control|Pragma)\x3a\x20no-cache\r\n(?:\r\n)?$/mi"; http.header_names; content:!"User-Agent|0d 0a|"; content:!"Referer|0d 0a|"; content:!"Content-Type|0d 0a|"; reference:md5,f1b341d3383b808ecfacfa22dcbe9196; classtype:command-and-control; sid:2021079; rev:5; metadata:created_at 2015_05_09, former_category MALWARE, updated_at 2020_10_06;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT c0896 Hacked Site Response (Inbound) 4"; flow:established,to_client; file_data; content:"0c0896"; fast_pattern; flowbits:isset,ET.JS.Obfus.Func; classtype:trojan-activity; sid:2017247; rev:2; metadata:created_at 2013_07_30, former_category CURRENT_EVENTS, updated_at 2013_07_30;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER ImageMagick CVE-2016-3714 Inbound (mvg)"; flow:established,to_server; http.request_body; content:"viewbox|20|"; nocase; fast_pattern; pcre:"/https\x3a.+(?<].*?(:[\x22\x27]|\\x2[27])/si"; classtype:web-application-attack; sid:2022789; rev:6; metadata:created_at 2016_05_04, updated_at 2020_10_06;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible FortDisco Wordpress Brute-force Site list download 10+ wp-login.php"; flow:established,to_client; file_data; content:"/wp-login.php|0d 0a|"; nocase; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; content:"/wp-login.php|0d 0a|"; nocase; distance:0; reference:url,www.arbornetworks.com/asert/2013/08/fort-disco-bruteforce-campaign/; reference:md5,722a1809bd4fd75743083f3577e1e6a4; classtype:trojan-activity; sid:2017310; rev:3; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2013_08_12, deployment Datacenter, former_category CURRENT_EVENTS, signature_severity Major, tag Wordpress, updated_at 2016_07_01;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER ImageMagick CVE-2016-3714 Inbound (svg)"; flow:established,to_server; http.request_body; content:" $HOME_NET any (msg:"ET WEB_CLIENT FlimKit/Other - Landing Page - 100HexChar value and applet"; flow:established,to_client; file_data; content:" $EXTERNAL_NET any (msg:"ET MALWARE Possible Malicious Macro DL EXE May 2016 (Mozilla compatible)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".exe"; nocase; fast_pattern; pcre:"/(?:\/(?:(?:p(?:lugins\/content\/vote\/\.ssl\/[a-z0-9]|a(?:nel\/includes\/[^\x2f]+|tric)|osts?\/[a-z0-9]+|rogcicicic)|s(?:ystem\/(?:logs|engine)\/[^\x2f]+?|e(?:rv(?:au|er)|ct)|gau\/.*?|alam|ucks|can|ke)|(?=[a-z]*[0-9])(?=[0-9]*[a-z])(?!setup\d+\.exe$)[a-z0-9]{5,10}|a(?:d(?:min\/images\/\w+|obe)|salam|live|us)|m(?:edia\/files\/\w+|a(?:cros?|rch)|soffice)|d(?:o(?:c(?:\/[a-z0-9]+)?|ne)|bust)|(?:~.+?\/\.[^\x2f]+|\.css)\/.+?|in(?:voice\/[^\x2f]+|fos?)|c(?:onfig|hris|alc)|u(?:swinz\w+|pdate)|xml\/load\/[^\x2f]+|(?:[Dd]ocumen|ve)t|Ozonecrytedserver|w(?:or[dk]|insys)|t(?:mp\/.+?|est)|fa(?:cture|soo)|n(?:otepad|ach)|k(?:be|ey|is)|ArfBtxz|office|yhaooo|[a-z]|etna|link|\d+)\.exe$|(?:(?=[a-z0-9]*?[3456789][a-z0-9]*?[3456789])(?=[a-z0-9]*?[h-z])[a-z0-9]{3,31}\+|PasswordRecovery|RemoveWAT|Dejdisc|Host\d+|Msword)\.exe)|(?:^\/(?:image\/.+?\/[^\x2f]+|x\/setup)|keem)\.exe$)/i"; http.user_agent; content:"Mozilla/4.0|20|(compatible|3b|)"; http.accept; content:"*/*"; bsize:3; reference:md5,f29a3564b386e7899f45ed5155d16a96; classtype:trojan-activity; sid:2022830; rev:4; metadata:created_at 2016_05_19, former_category CURRENT_EVENTS, updated_at 2020_10_06;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Possible CookieBomb Generic JavaScript Format"; flow:from_server,established; file_data; content:"/*/"; fast_pattern; pcre:"/^[a-f0-9]{6}\*\//R"; content:"="; pcre:"/^[\r\n\s]*?\x5c?[\x22\x27]/R"; content:!"|22|"; within:500; content:!"|27|"; within:500; pcre:"/^([a-f0-9]{2}[^\x22\x27a-f0-9]{0,10})?(?P[a-f0-9]{2})(?P[^\x22\x27a-f0-9]{0,10})(?P(?!(?P=f))[a-f0-9]{2})(?P=sep)(?P(?!(?:(?P=f)|(?P=u)))[a-f0-9]{2})(?P=sep)(?P(?!(?:(?P=f)|(?P=u)|(?P=n)))[a-f0-9]{2})(?P=sep)(?P(?!(?:(?P=f)|(?P=u)|(?P=n)|(?P=c)))[a-f0-9]{2})(?P=sep)(?P(?!(?:(?P=f)|(?P=u)|(?P=n)|(?P=c)|(?P=t)))[a-f0-9]{2})(?P=sep)(?P(?!(?:(?P=f)|(?P=u)|(?P=n)|(?P=c)|(?P=t)|(?P=i)))[a-f0-9]{2})(?P=sep)(?P=n)(?P=sep)(?P[a-f0-9]{2})(?P=sep)([a-f0-9]{2}(?P=sep)){1,100}(?P=spc)/Ri"; classtype:trojan-activity; sid:2017373; rev:6; metadata:created_at 2013_08_26, former_category CURRENT_EVENTS, updated_at 2013_08_26;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Unusually Fast HTTP Requests With Referer Url Matching DoS Tool"; flow:to_server,established; threshold: type both, track by_src, count 15, seconds 30; http.referer; content:"/slowhttptest/"; fast_pattern; reference:url,community.qualys.com/blogs/securitylabs/2012/01/05/slow-read; classtype:web-application-activity; sid:2014103; rev:6; metadata:created_at 2012_01_10, updated_at 2020_10_06;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT CookieBomb Generic PHP Format"; flow:from_server,established; file_data; content:"echo "; fast_pattern; content:"#/"; distance:0; pcre:"/^[a-f0-9]{6}#/R"; content:"="; pcre:"/^[\r\n\s]*?\x5c?[\x22\x27]/R"; content:!"|22|"; within:500; content:!"|27|"; within:500; pcre:"/^([a-f0-9]{2}[^\x22\x27a-f0-9]{0,10})?(?P[a-f0-9]{2})(?P[^\x22\x27a-f0-9]{0,10})(?P(?!(?P=f))[a-f0-9]{2})(?P=sep)(?P(?!(?:(?P=f)|(?P=u)))[a-f0-9]{2})(?P=sep)(?P(?!(?:(?P=f)|(?P=u)|(?P=n)))[a-f0-9]{2})(?P=sep)(?P(?!(?:(?P=f)|(?P=u)|(?P=n)|(?P=c)))[a-f0-9]{2})(?P=sep)(?P(?!(?:(?P=f)|(?P=u)|(?P=n)|(?P=c)|(?P=t)))[a-f0-9]{2})(?P=sep)(?P(?!(?:(?P=f)|(?P=u)|(?P=n)|(?P=c)|(?P=t)|(?P=i)))[a-f0-9]{2})(?P=sep)(?P=n)(?P=sep)(?P[a-f0-9]{2})(?P=sep)([a-f0-9]{2}(?P=sep)){1,100}(?P=spc)/Ri"; classtype:trojan-activity; sid:2017374; rev:6; metadata:created_at 2013_08_26, former_category CURRENT_EVENTS, updated_at 2013_08_26;)
 
-alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2016-5118 Exploit MVG attempt M1"; flow:established,to_server; http.request_body; content:"viewbox|20|"; nocase; fast_pattern; content:"|20 27 7c|"; nocase; reference:url,seclists.org/oss-sec/2016/q2/432; reference:cve,2016-5118; classtype:trojan-activity; sid:2022848; rev:4; metadata:created_at 2016_06_01, updated_at 2020_10_06;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT CookieBomb Generic HTML Format"; flow:from_server,established; file_data; content:" powered by zehir"; content:"Sistem Bilgileri"; content:"color=red>Local Adres $HOME_NET any (msg:"ET MALWARE Observed Malicious SSL Cert (AsyncRAT CnC)"; flow:established,to_client; tls.cert_subject; content:"CN=carlossaldanhacertificado"; bsize:28; fast_pattern; tls.cert_issuer; content:"CN=carlossaldanhacertificado"; bsize:28; classtype:domain-c2; sid:2031059; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2020_10_19, deployment Perimeter, former_category MALWARE, malware_family AsyncRAT, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_04_18, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER SQL Injection Attempt (Agent NV32ts)"; flow:to_server,established; content:"User-Agent|3a| NV32ts"; reference:url,doc.emergingthreats.net/2009029; classtype:web-application-attack; sid:2009029; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_10_15;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Observed Malicious SSL Cert (AsyncRAT CnC)"; flow:established,to_client; tls.cert_subject; content:"CN=PatataDorito"; bsize:15; fast_pattern; tls.cert_issuer; content:"CN=PatataDorito"; bsize:15; classtype:domain-c2; sid:2031060; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2020_10_19, deployment Perimeter, former_category MALWARE, malware_family AsyncRAT, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_04_18, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+#alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SERVER PHP Attack Tool Morfeus F Scanner - M"; flow:established,to_server; content:"M Fucking Scanner"; http_user_agent; nocase; reference:url,www.webmasterworld.com/search_engine_spiders/3227720.htm; reference:url,doc.emergingthreats.net/2003466; classtype:web-application-attack; sid:2009799; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (bollywoods .co .in in DNS Lookup)"; dns.query; content:"bollywoods.co.in"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031030; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Apache mod_perl Apache Status and Apache2 Status Cross Site Scripting Attempt"; flow:established,to_server; content:"|2F|APR|3A 3A|SockAddr|3A 3A|port|2F|"; http_uri; nocase; pcre:"/(script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)/Ui"; reference:url,www.securityfocus.com/bid/34383/info; reference:cve,2009-0796; reference:url,doc.emergingthreats.net/2010281; classtype:attempted-user; sid:2010281; rev:4; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag XSS, tag Cross_Site_Scripting, updated_at 2016_07_01;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (chat2hire .net in DNS Lookup)"; dns.query; content:"chat2hire.net"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031031; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER RFI Scanner Success (Fx29ID)"; flow:established,from_server; content:"FeeLCoMzFeeLCoMz"; reference:url,doc.emergingthreats.net/2010463; reference:url,opinion.josepino.com/php/howto_website_hack1; classtype:successful-user; sid:2010463; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (chuki .mozillaupdates .us in DNS Lookup)"; dns.query; content:"chuki.mozillaupdates.us"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031032; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER TIEHTTP User-Agent"; flow:to_server,established; content:"User-Agent|3a| tiehttp"; nocase; reference:url,www.torry.net/authorsmore.php?id=4292; classtype:web-application-activity; sid:2011759; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (click2chat .org in DNS Lookup)"; dns.query; content:"click2chat.org"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031033; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER Successful DD-WRT Information Disclosure"; flowbits:isset,et.ddwrt.infodis; flow:established,from_server; content:"lan_mac|3A 3A|"; content:"wlan_mac|3A 3A|"; distance:0; content:"lan_ip|3A 3A|"; distance:0; content:"mem_info|3A 3A|"; distance:0; reference:url,www.exploit-db.com/exploits/15842/; classtype:successful-recon-limited; sid:2012117; rev:3; metadata:created_at 2010_12_30, updated_at 2010_12_30;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (cvstyler .co .in in DNS Lookup)"; dns.query; content:"cvstyler.co.in"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031034; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER Possible File Injection Compromise (HaCKeD By BeLa & BodyguarD)"; flow:established,to_server; content:"HaCKeD By BeLa & BodyguarD"; reference:url,www.incidents.org/diary.html?storyid=4405; classtype:web-application-attack; sid:2008207; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (daily .windowsupdates .eu in DNS Lookup)"; dns.query; content:"daily.windowsupdates.eu"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031035; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 1"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"%28%29|20|{|20|"; nocase; fast_pattern; within:9; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019244; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (dailybuild .mozillaupdates .com in DNS Lookup)"; dns.query; content:"dailybuild.mozillaupdates.com"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031036; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 2"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"%28%29|20|{%20"; nocase; fast_pattern; within:11; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019245; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (enigma .net .in in DNS Lookup)"; dns.query; content:"enigma.net.in"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031037; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 3"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"%28%29|20|%7b|20|"; nocase; fast_pattern; within:11; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019246; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (gozap .co .in in DNS Lookup)"; dns.query; content:"gozap.co.in"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031038; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 4"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"%28%29|20|%7b%20"; nocase; fast_pattern; within:13; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019247; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (gyzu .mozillaupdates .us in DNS Lookup)"; dns.query; content:"gyzu.mozillaupdates.us"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031039; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 5"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"%28%29%20{|20|"; nocase; fast_pattern; within:11; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019248; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (melodymate .co .in in DNS Lookup)"; dns.query; content:"melodymate.co.in"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031040; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 6"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"%28%29%20{%20"; nocase; fast_pattern; within:13; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019249; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (nortonupdates .online in DNS Lookup)"; dns.query; content:".nortonupdates.online"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031041; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 7"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"%28%29%20%7b|20|"; nocase; fast_pattern; within:13; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019250; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (nightly .windowsupdates .eu in DNS Lookup)"; dns.query; content:"nightly.windowsupdates.eu"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031042; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 8"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"%28%29%20%7b%20"; nocase; fast_pattern; within:15; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019251; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (nightlybuild .mozillaupdates .com in DNS Lookup)"; dns.query; content:"nightlybuild.mozillaupdates.com"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031043; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 9"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"%28|20|{|20|"; nocase; fast_pattern; within:6; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019252; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (orangevault .net in DNS Lookup)"; dns.query; content:"orangevault.net"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031044; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 10"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"%28|20|{%20"; nocase; fast_pattern; within:8; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019253; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (sake .mozillaupdates .us in DNS Lookup)"; dns.query; content:"sake.mozillaupdates.us"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031045; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 11"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"%28|20|%7b|20|"; nocase; fast_pattern; within:8; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019254; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (savitabhabi .co .in in DNS Lookup)"; dns.query; content:"savitabhabi.co.in"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031046; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 12"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"%28|20|%7b%20"; nocase; fast_pattern; within:10; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019255; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (sharify .co .in in DNS Lookup)"; dns.query; content:"sharify.co.in"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031047; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 13"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"%28%20{|20|"; nocase; fast_pattern; within:8; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019256; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (strongbox .in in DNS Lookup)"; dns.query; content:"strongbox.in"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031048; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 14"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"%28%20{%20"; nocase; fast_pattern; within:10; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019257; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (teraspace .co .in in DNS Lookup)"; dns.query; content:"teraspace.co.in"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031049; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 15"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"%28%20%7b|20|"; nocase; fast_pattern; within:10; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019258; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (titaniumx .co .in in DNS Lookup)"; dns.query; content:"titaniumx.co.in"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031050; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 16"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"%28%20%7b%20"; nocase; fast_pattern; within:12; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019259; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (msoftserver .eu in DNS Lookup)"; dns.query; content:".msoftserver.eu"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031051; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 17"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"(%29|20|{|20|"; nocase; fast_pattern; within:7; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019260; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (microsoftupdate .in in DNS Lookup)"; dns.query; content:".microsoftupdate.in"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031052; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 18"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"(%29|20|{%20"; nocase; fast_pattern; within:9; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019261; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (wesharex .net in DNS Lookup)"; dns.query; content:"wesharex.net"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031053; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 19"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"(%29|20|%7b|20|"; nocase; fast_pattern; within:9; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019262; rev:4; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (x-trust .net in DNS Lookup)"; dns.query; content:"x-trust.net"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031054; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 20"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"(%29|20|%7b%20"; nocase; fast_pattern; within:11; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019263; rev:3; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GravityRAT CnC Domain (zen .mozillaupdates .us in DNS Lookup)"; dns.query; content:"zen.mozillaupdates.us"; nocase; endswith; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:trojan-activity; sid:2031055; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Android, attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 21"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"(%29%20{|20|"; nocase; fast_pattern; within:9; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019264; rev:3; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MSIL/GravityRAT CnC Checkin M2"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php"; endswith; http.request_body; content:"signatureHash="; fast_pattern; content:"signatureString="; content:"userName="; content:"pcName="; content:"macId="; content:"cpuId="; content:"agent="; reference:url,securelist.com/gravityrat-the-spy-returns/99097/; classtype:command-and-control; sid:2031061; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_10_19, deployment Perimeter, former_category MALWARE, malware_family GravityRAT, signature_severity Major, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 22"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"(%29%20{%20"; nocase; fast_pattern; within:11; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019265; rev:3; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Enosch.A gtalk connectivity check"; flow:to_server; http.uri; content:"/index.html"; http.user_agent; content:"gtalk"; fast_pattern; bsize:5; http.host; content:"www.google.com"; http.header_names; content:"|0d 0a|User-Agent|0d 0a|Host|0d 0a 0d 0a|"; depth:22; endswith; reference:md5,b13db8b21289971b3c88866d202fad49; classtype:trojan-activity; sid:2018508; rev:5; metadata:created_at 2014_05_30, updated_at 2020_10_19;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 23"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"(%29%20%7b|20|"; nocase; fast_pattern; within:11; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019266; rev:3; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE VBS/Dojos Downloader Activity M2"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".php"; endswith; http.user_agent; content:"|3a 3a|"; content:"|3a 3a 2f 2e|"; distance:0; fast_pattern; reference:md5,be75ac1d9f26bee3cfdc7bdd977c0cdd; classtype:trojan-activity; sid:2035025; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_10_20, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2020_10_20;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 24"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"(%29%20%7b%20"; nocase; fast_pattern; within:13; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019267; rev:3; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET USER_AGENTS Suspicious User-Agent (Fire-Cloud)"; flow:established,to_server; http.user_agent; content:"Fire-Cloud"; bsize:10; reference:md5,804c8f7d3b10b421ab5c09d675644212; classtype:trojan-activity; sid:2031065; rev:1; metadata:attack_target Client_Endpoint, created_at 2020_10_20, deployment Perimeter, former_category USER_AGENTS, performance_impact Low, signature_severity Minor, updated_at 2020_10_20;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 26"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"()|20|%7b|20|"; nocase; fast_pattern; within:7; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019269; rev:3; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Toplist.cz Related Spyware Checkin"; flow:to_server,established; http.user_agent; content:"BWL"; depth:3; pcre:"/^BWL(?:\sToplist|\d_UPDATE)/"; classtype:pup-activity; sid:2003505; rev:13; metadata:created_at 2010_07_30, former_category ADWARE_PUP, updated_at 2020_10_20;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 27"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"()|20|%7b%20"; nocase; fast_pattern; within:9; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019270; rev:3; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Farfli.BHQ!tr Dropper CnC Beacon"; flow:established,to_server; urilen:8; http.method; content:"GET"; http.uri; content:"/php.php"; fast_pattern; http.host; pcre:"/^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}/"; http.user_agent; content:"Mozilla/4.0 (compatible)"; depth:24; reference:md5,cb53a6e8d65d86076fc0c94dac62aa77; classtype:command-and-control; sid:2019946; rev:4; metadata:attack_target Client_Endpoint, created_at 2014_12_16, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2020_10_20, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP URLENCODE Generic 28"; flow:established,to_server; pcre:"/[\?\=\x3a\s\x2f]/"; content:"()%20{|20|"; nocase; fast_pattern; within:7; reference:url,blogs.akamai.com/2014/09/environment-bashing.html; classtype:attempted-admin; sid:2019271; rev:3; metadata:created_at 2014_09_26, updated_at 2014_09_26;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Suntrust Captcha Phishing Landing"; flow:established,to_client; file.data; content:"|0d 0a|"; content:"|0d 0a|Content-Type|3a 20|text/plain|0d 0a|"; reference:url,seclists.org/fulldisclosure/2011/May/322; classtype:successful-recon-largescale; sid:2012809; rev:3; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2011_05_15, deployment Datacenter, signature_severity Major, tag Wordpress, updated_at 2016_07_01;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE BAZAR CnC Domain in DNS Lookup"; dns.query; content:"bestgame.bazar"; nocase; bsize:14; reference:url,www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html; classtype:command-and-control; sid:2030042; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_28, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Mambo Zorder zorder Parameter UNION SELECT SQL Injection Vulnerability"; flow:established,to_server; content:"GET"; http_method; content:"/administrator/index2.php?"; nocase; http_uri; content:"limit="; nocase; http_uri; content:"limitstart="; nocase; http_uri; content:"zorder="; nocase; http_uri; content:"UNION"; nocase; http_uri; content:"SELECT"; nocase; http_uri; pcre:"/UNION.+SELECT/Ui"; reference:url,dl.packetstormsecurity.net/1111-exploits/zorder-sql.txt; classtype:web-application-attack; sid:2014079; rev:4; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2012_01_03, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE BAZAR CnC Domain in DNS Lookup"; dns.query; content:"thegame.bazar"; nocase; bsize:13; reference:url,www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html; classtype:command-and-control; sid:2030043; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_28, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Athena Web Registration Remote Command Execution Attempt"; flow: to_server,established; content:"/athenareg.php?pass= |3b|"; nocase; http_uri; reference:cve,CAN-2004-1782; reference:bugtraq,9349; reference:url,doc.emergingthreats.net/2001949; classtype:web-application-attack; sid:2001949; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE BAZAR CnC Domain in DNS Lookup"; dns.query; content:"newgame.bazar"; nocase; bsize:13; reference:url,www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html; classtype:command-and-control; sid:2030044; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_28, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Possible Mambo Cache_Lite Class mosConfig_absolute_path Remote File Inclusion Attempt"; flow:established,to_server; content:"/includes/Cache/Lite/Output.php?mosConfig_absolute_path="; nocase; http_uri; pcre:"/=\s*(https|ftps|php|http|ftp)\x3A\x2F/Ui"; reference:url,www.securityfocus.com/bid/29716/info; reference:url,downloads.securityfocus.com/vulnerabilities/exploits/29716.rb; reference:url,doc.emergingthreats.net/2010223; classtype:web-application-attack; sid:2010223; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE BAZAR CnC Domain in DNS Lookup"; dns.query; content:"portgame.bazar"; nocase; bsize:14; reference:url,www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html; classtype:command-and-control; sid:2030045; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_04_28, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS SaschArt SasCam Webcam Server ActiveX Buffer Overflow Function Call"; flow:to_client,established; content:"ActiveXObject"; nocase; content:"XHTTP.HTTP"; fast_pattern; nocase; distance:0; content:"Head"; nocase; reference:url,exploit-db.com/exploits/14215/; reference:bugtraq,41343; reference:url,doc.emergingthreats.net/2011208; classtype:attempted-user; sid:2011208; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, signature_severity Major, tag ActiveX, updated_at 2016_07_01;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING DNS Lookup for Possible Common Brand Phishing Hosted on Legitimate Windows Service"; dns.query; content:".core.windows.net"; endswith; pcre:"/^(?:d(?:(?:ocu|uco)sign|ropbox)|o(?:ffice365|nedrive)|adobe|gdoc)/"; pcre:!"/^onedrivecl[a-z]{2}prod[a-z]{2}[0-9]{5}\./"; classtype:policy-violation; sid:2026486; rev:10; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_10_15, deployment Perimeter, former_category POLICY, signature_severity Minor, tag Phishing, updated_at 2020_11_17;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS SmE FileMailer SQL Injection Attempt -- index.php us INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"us="; distance:0; nocase; http_uri; content:"INSERT"; nocase; http_uri; distance:0; content:"INTO"; nocase; http_uri; distance:0; reference:cve,CVE-2007-0350; reference:url,www.frsirt.com/english/advisories/2007/0221; reference:url,doc.emergingthreats.net/2005526; classtype:web-application-attack; sid:2005526; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Request for Possible Common Brand Phishing Hosted on Legitimate Windows Service"; flow:established,to_server; tls.sni; content:".core.windows.net"; endswith; pcre:"/^(?:d(?:(?:ocu|uco)sign|ropbox)|o(?:ffice365|nedrive)|adobe|gdoc)/"; pcre:!"/^onedrivecl[a-z]{2}prod[a-z]{2}[0-9]{5}\./"; classtype:policy-violation; sid:2026487; rev:12; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_10_15, deployment Perimeter, former_category POLICY, signature_severity Minor, tag Phishing, updated_at 2020_11_17;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS myBloggie SQL Injection Attempt -- index.php cat_id SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"cat_id="; nocase; distance:0; http_uri; content:"SELECT"; http_uri; nocase; distance:0; content:"FROM"; http_uri; nocase; distance:0; reference:cve,CVE-2007-3003; reference:url,www.securityfocus.com/bid/24249; reference:url,doc.emergingthreats.net/2004492; classtype:web-application-attack; sid:2004492; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE PHANTOMLANCE CnC Domain in DNS Lookup"; dns.query; content:"mine.remaariegarcia.com"; nocase; bsize:23; reference:url,securelist.com/apt-phantomlance/96772/; reference:md5,0d5c03da348dce513bf575545493f3e3; classtype:command-and-control; sid:2030089; rev:2; metadata:attack_target Mobile_Client, created_at 2020_05_01, deployment Perimeter, former_category MOBILE_MALWARE, malware_family APT32, malware_family OceanLotus, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"GPL WEB_SPECIFIC_APPS NetScreen SA 5000 delhomepage.cgi access"; flow:to_server,established; content:"/delhomepage.cgi"; http_uri; reference:bugtraq,9791; classtype:web-application-activity; sid:2103062; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE PHANTOMLANCE CnC Domain in DNS Lookup"; dns.query; content:"egg.stralisemariegar.com"; nocase; bsize:24; reference:url,securelist.com/apt-phantomlance/96772/; reference:md5,0d5c03da348dce513bf575545493f3e3; classtype:command-and-control; sid:2030090; rev:2; metadata:attack_target Mobile_Client, created_at 2020_05_01, deployment Perimeter, former_category MOBILE_MALWARE, malware_family APT32, malware_family OceanLotus, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"GPL WEB_SPECIFIC_APPS oracle web arbitrary command execution attempt"; flow:to_server,established; content:"/ows-bin/"; nocase; http_uri; content:"?&"; http_uri; reference:bugtraq,1053; reference:cve,2000-0169; reference:nessus,10348; classtype:web-application-attack; sid:2101193; rev:13; metadata:created_at 2010_09_23, updated_at 2010_09_23;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE PHANTOMLANCE CnC Domain in DNS Lookup"; dns.query; content:"api.anaehler.com"; nocase; bsize:16; reference:url,securelist.com/apt-phantomlance/96772/; reference:md5,0d5c03da348dce513bf575545493f3e3; classtype:command-and-control; sid:2030091; rev:2; metadata:attack_target Mobile_Client, created_at 2020_05_01, deployment Perimeter, former_category MOBILE_MALWARE, malware_family APT32, malware_family OceanLotus, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS CVSTrac filediff Arbitrary Remote Code Execution"; flow: to_server,established; content:"filediff|3f|f="; nocase; http_uri; pcre:"/\/filediff\?((&?v\d?=[\d.]+?)+?&f\x3d|f\x3d.+?(&v\d?=[\d.]+?)+?).+?\x3b.+?\x3b/Ui"; reference:bugtraq,10878; reference:cve,2004-1456; reference:url,doc.emergingthreats.net/bin/view/Main/2002697; classtype:web-application-attack; sid:2002697; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE IXWARE Stealer Domain in DNS Lookup"; dns.query; content:"ixware.dev"; nocase; bsize:10; reference:url,twitter.com/James_inthe_box/status/1248010996502769664; classtype:domain-c2; sid:2030096; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_05_04, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Awstats Remote Code Execution Attempt"; flow: established,from_client; content:"/awstats.pl?"; nocase; http_uri; pcre:"/(configdir|update|pluginmode)=.*(\|.+\||system)/Ui"; reference:url,www.k-otik.com/exploits/20050124.awexpl.c.php; reference:url,www.k-otik.com/exploits/20050302.awstats_shell.c.php; reference:url,awstats.sourceforge.net; reference:url,www.idefense.com/application/poi/display?id=185&type=vulnerabilities&flashstatus=false; reference:bugtraq,12298; reference:cve,CAN-2005-0116; reference:url,doc.emergingthreats.net/2001686; classtype:web-application-attack; sid:2001686; rev:17; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE IXWARE Stealer Domain in DNS Lookup"; dns.query; content:"ixware.xyz"; nocase; bsize:10; reference:url,twitter.com/James_inthe_box/status/1248010996502769664; classtype:domain-c2; sid:2030097; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_05_04, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS CutePHP CuteNews directory traversal vulnerability - show_news"; flow:to_server,established; content:"/show_news.php"; nocase; http_uri; content:"template="; nocase; http_uri; pcre:"/template=[./]/Ui"; reference:bugtraq,15295; reference:url,doc.emergingthreats.net/2002668; classtype:misc-activity; sid:2002668; rev:10; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE IXWARE Stealer CnC Activity"; flow:established,to_server; http.request_body; content:"checkAcc="; startswith; http.content_type; bsize:33; content:"application/x-www-form-urlencoded"; http.start; content:"POST /stubCheck HTTP/"; depth:21; fast_pattern; reference:url,twitter.com/James_inthe_box/status/1248010996502769664; classtype:command-and-control; sid:2030098; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_05_04, deployment Perimeter, deployment SSLDecrypt, former_category MALWARE, performance_impact Low, signature_severity Minor, updated_at 2020_11_17;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS CutePHP CuteNews directory traversal vulnerability - show_archives"; flow:to_server,established; content:"/show_archives.php"; nocase; http_uri; content:"template="; nocase; http_uri; pcre:"/template=[./]/Ui"; reference:bugtraq,15295; reference:url,doc.emergingthreats.net/2003152; classtype:misc-activity; sid:2003152; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns $HOME_NET any -> any any (msg:"ET WEB_CLIENT SEO Injection/Fraud DNS Lookup (count.trackstatisticsss .com)"; dns.query; content:"count.trackstatisticsss.com"; nocase; bsize:27; classtype:bad-unknown; sid:2030099; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_05_04, deployment Perimeter, former_category CURRENT_EVENTS, performance_impact Low, signature_severity Minor, updated_at 2020_11_17;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS GeekLog Remote File Include Vulnerability"; flow:established,to_server; content:".php?"; nocase; http_uri; content:"_CONF"; nocase; http_uri; pcre:"/_CONF\[.*\]=(data|https?|ftps?|php)\:\//Ui"; reference:url,securitydot.net/xpl/exploits/vulnerabilities/articles/1122/exploit.html; reference:url,doc.emergingthreats.net/2002996; classtype:web-application-attack; sid:2002996; rev:9; metadata:affected_product Any, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Remote_File_Include, updated_at 2016_07_01;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE WEBMONITOR RAT CnC Domain in DNS Lookup (dabmaster.wm01 .to)"; dns.query; content:"dabmaster.wm01.to"; nocase; bsize:17; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/webmonitor-rat-bundled-with-zoom-installer/?web_view=true; classtype:command-and-control; sid:2030100; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_05_04, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS JMweb MP3 src Multiple Local File Inclusion"; flow:established,to_server; content:"GET"; http_method; pcre:"/(listen.php|download.php)/Ui"; content:"?src="; nocase; http_uri; pcre:"/(\.\.\/){1}/"; reference:url,www.exploit-db.com/exploits/6669/; reference:url,doc.emergingthreats.net/2008651; classtype:web-application-attack; sid:2008651; rev:8; metadata:affected_product Web_Server_Applications, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Local_File_Inclusion, updated_at 2016_07_01;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious User-Agent (1 space)"; flow:to_server,established; http.header; content:"User-Agent|3a 20 0d 0a|"; http.host; content:!"connectivitycheck.gstatic.com"; endswith; content:!".mcafee.com"; content:!"deezer.com"; endswith; content:!"googlezip.net"; content:!"metrics.tbliab.net"; endswith; content:!"dajax.com"; endswith; content:!"update.eset.com"; endswith; content:!".sketchup.com"; endswith; content:!".yieldmo.com"; endswith; content:!"ping-start.com"; endswith; content:!".bluekai.com"; content:!".stockstracker.com"; content:!".doubleclick.net"; content:!".pingstart.com"; content:!".colis-logistique.com"; content:!"android-lrcresource.wps.com"; content:!"track.package-buddy.com"; content:!"talkgadget.google.com"; endswith; content:!".visualstudio.com"; endswith; content:!".slack-edge.com"; endswith; content:!".slack.com"; endswith; content:!".lifesizecloud.com"; endswith; reference:url,doc.emergingthreats.net/bin/view/Main/2007994; classtype:unknown; sid:2007994; rev:24; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, former_category INFO, signature_severity Major, tag User_Agent, updated_at 2020_11_17;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Open Web Analytics mw_plugin.php IP Parameter Remote File inclusion Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/mw_plugin.php?"; nocase; http_uri; content:"IP="; nocase; http_uri; pcre:"/IP=\s*(?:(?:ht|f)tps?|data|php)\x3a\//Ui"; reference:url,exploit-db.com/exploits/11903/; classtype:web-application-attack; sid:2011881; rev:5; metadata:created_at 2010_10_29, updated_at 2010_10_29;)
 
-alert dns $HOME_NET any -> any any (msg:"ET WEB_CLIENT SEO Injection/Fraud Domain in DNS Lookup (stat.trackstatisticsss .com)"; dns.query; content:"stat.trackstatisticsss.com"; nocase; bsize:26; reference:url,www.wordfence.com/blog/2020/05/nearly-a-million-wp-sites-targeted-in-large-scale-attacks/; classtype:bad-unknown; sid:2030118; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_05_06, deployment Perimeter, deployment SSLDecrypt, former_category CURRENT_EVENTS, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Possible Zenoss Cross Site Request Forgery UserCommand Attempt"; flow:established,to_server; content:"/zport/dmd/Devices/devices/localhost/manage_doUserCommand"; nocase; http_uri; content:"commandId="; http_uri; nocase; distance:0; pcre:"/commandId\x3D[a-z]/Ui"; reference:url,www.securityfocus.com/bid/37843; reference:url,doc.emergingthreats.net/2010762; classtype:web-application-attack; sid:2010762; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert dns $HOME_NET any -> any any (msg:"ET POLICY moanmyip .com DNS Lookup"; dns.query; content:"moanmyip.com"; nocase; endswith; classtype:policy-violation; sid:2030127; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_05_07, deployment Perimeter, former_category POLICY, performance_impact Low, signature_severity Informational, updated_at 2020_11_17;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS trac q variable open redirect"; flow:to_server,established; content:"/search?q"; nocase; http_uri; pcre:"/search\?q=(ht|f)tp?\:\//iU"; reference:cve,CVE-2008-2951; reference:url,doc.emergingthreats.net/2008648; classtype:web-application-attack; sid:2008648; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE EVILNUM CnC Host Checkin"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/register.php"; http.request_body; content:"av="; depth:3; content:"&cpu-name="; fast_pattern; distance:0; content:"&ref="; distance:0; content:"&user="; distance:0; reference:url,blog.prevailion.com/2020/05/phantom-in-command-shell5.html; classtype:command-and-control; sid:2030125; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_05_07, deployment Perimeter, signature_severity Major, updated_at 2020_11_17;)
+#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Horde 3.0.9-3.1.0 Help Viewer Remote PHP Exploit"; flow:established,to_server; content:"/services/help/"; nocase; http_uri; pcre:"/module=[^\;]*\;.*\"/UGi"; reference:url,www.exploit-db.com/exploits/1660; reference:cve,2006-1491; reference:bugtraq,17292; classtype:web-application-attack; sid:2002867; rev:12; metadata:created_at 2010_07_30, updated_at 2010_07_30;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Bisonal CnC Checkin"; flow:established,to_server; http.uri; content:".txt"; pcre:"/^\/[a-z]{4}(?:\d{1,3}\.){3}\d{1,3}[a-z]{6}\.txt/"; http.header; content:"User-Agent|3a 20|Mozilla/4.0 (compatible|3b 20|MSIE 6.0|3b 20|Windows NT 5.0|3b 20|.NET CLR 1.1.4322|0d 0a|Host|3a 20|"; depth:88; fast_pattern; reference:md5,CC71620DE7216B186DA2C9BA06703613; reference:url,researchcenter.paloaltonetworks.com/2018/07/unit42-bisonal-malware-used-attacks-russia-south-korea/; reference:url,blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html; classtype:command-and-control; sid:2025922; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_07_31, deployment Perimeter, former_category MALWARE, malware_family Bisonal, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Design4Online UserPages2 SQL Injection Attempt -- page.asp art_id ASCII"; flow:established,to_server; content:"/page.asp?"; nocase; http_uri; content:"art_id="; nocase; http_uri; content:"SELECT"; nocase; http_uri; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-1077; reference:url,www.securityfocus.com/bid/22636; reference:url,doc.emergingthreats.net/2004838; classtype:web-application-attack; sid:2004838; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE MAZE Ransomware Payment Domain in DNS Lookup"; dns.query; content:"aoacugmutagkwctu.onion"; nocase; bsize:22; reference:url,www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html; classtype:trojan-activity; sid:2030133; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_05_08, deployment Perimeter, former_category MALWARE, malware_family Maze_Ransomware, signature_severity Major, tag Ransomware, updated_at 2020_11_17, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Possible WordpressPingbackPortScanner detected"; flow:established,to_server; content:"POST"; http_method; nocase; content:"/xmlrpc.php"; http_uri; content:"pingback.ping"; http_client_body; nocase; threshold: type both, track by_src, seconds 60, count 5; reference:url,seclists.org/bugtraq/2012/Dec/101; reference:url,github.com/FireFart/WordpressPingbackPortScanner/; reference:url,www.acunetix.com/blog/web-security-zone/wordpress-pingback-vulnerability/; classtype:web-application-attack; sid:2016061; rev:4; metadata:affected_product Wordpress, affected_product Wordpress_Plugins, attack_target Web_Server, created_at 2012_12_19, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, tag Wordpress, updated_at 2016_07_01;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE MAZE Ransomware Payment Domain DNS Lookup"; dns.query; content:"mazedecrypt.top"; nocase; bsize:15; reference:url,www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html; classtype:trojan-activity; sid:2030134; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_05_08, deployment Perimeter, former_category MALWARE, malware_family Maze_Ransomware, signature_severity Major, tag Ransomware, updated_at 2020_11_17, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Versatile Bulletin Board SQL Injection Attack"; flow:to_server,established; content:"/index.php?"; http_uri; nocase; content:"select="; nocase; http_uri; fast_pattern; pcre:"/UNION\s+SELECT/URi"; reference:bugtraq,15068; reference:url,doc.emergingthreats.net/2002494; classtype:web-application-attack; sid:2002494; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2016_07_01;)
 
-alert dns $HOME_NET any -> any any (msg:"ET POLICY MAZE Ransomware Victim Publishing Site DNS Lookup (mazenews .top)"; dns.query; content:"mazenews.top"; nocase; bsize:12; reference:url,www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html; classtype:bad-unknown; sid:2030135; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_05_08, deployment Perimeter, former_category POLICY, malware_family Maze_Ransomware, signature_severity Major, tag Ransomware, updated_at 2020_11_17, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+#alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Wordpress Host Header Injection (CVE-2016-10033) M1"; flow:to_server,established; content:"Host|3a|"; http_header; nocase; content:"("; http_header; nocase; content:")"; http_header; pcre:"/^Host\x3a[^\r\n]+?[\x28\x29\x27\x22\x7b\x7d]/Hmi"; reference:url,exploitbox.io/vuln/WordPress-Exploit-4-6-RCE-CODE-EXEC-CVE-2016-10033.html; classtype:web-application-attack; sid:2024277; rev:3; metadata:affected_product Wordpress, attack_target Web_Server, created_at 2017_05_05, deployment Perimeter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2017_05_08;)
 
-alert dns $HOME_NET any -> any any (msg:"ET POLICY MAZE Ransomware Victim Publishing Site DNS Lookup (newsmaze .top)"; dns.query; content:"newsmaze.top"; nocase; bsize:12; reference:url,www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html; classtype:bad-unknown; sid:2030136; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_05_08, deployment Perimeter, former_category POLICY, malware_family Maze_Ransomware, signature_severity Major, tag Ransomware, updated_at 2020_11_17, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS e107 CMS backdoor access admin-access cookie and HTTP POST"; flow:established,to_server; content:"POST "; nocase; depth:5; content:"|0d 0a|Cookie\: "; nocase; content:"admin-access="; content:"e107language_"; pcre:"/Cookie: .*admin-access=/i"; reference:url,seclists.org/fulldisclosure/2010/Jan/480; reference:url,www.e107.org/news.php; reference:url,doc.emergingthreats.net/2010719; classtype:attempted-admin; sid:2010719; rev:3; metadata:created_at 2010_07_30, former_category WEB_SPECIFIC_APPS, updated_at 2017_05_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET POLICY ipchicken .com DNS Lookup"; dns.query; content:"ipchicken.com"; nocase; endswith; classtype:policy-violation; sid:2030138; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_05_08, deployment Perimeter, former_category POLICY, performance_impact Low, signature_severity Informational, updated_at 2020_11_17;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS DAMICMS Cross-Site Request Forgery (Add Admin)"; flow:from_server,established; file_data; content:"history.pushState"; content:"/admin.php?s=/Admin/doadd|22| method=|22|POST|22|>"; nocase; fast_pattern; content:"name=|22|username|22|"; content:"name=|22|password|22|"; reference:url,exploit-db.com/exploits/44960/; classtype:web-application-attack; sid:2025771; rev:1; metadata:attack_target Client_Endpoint, created_at 2018_07_02, deployment Perimeter, former_category WEB_SPECIFIC_APPS, performance_impact Low, signature_severity Major, updated_at 2018_07_18;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Unk.VBSLoader Retrieving Payload"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".png?uid=VwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcg"; fast_pattern; http.header_names; content:!"Referer"; reference:md5,f1864d53ba7512471182cd100fb96c4b; classtype:trojan-activity; sid:2030148; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_05_11, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2020_11_17;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS cmd powershell base64 encoded to Web Server 1"; flow:established,to_server; content:"Y21kIC9jIHBvd2Vyc2hlbGwuZXhl"; classtype:attempted-user; sid:2025827; rev:1; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_12, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_07_18;)
 
-alert dns $HOME_NET any -> any any (msg:"ET POLICY NEPHILIM Ransomware Victim Publishing Site DNS Lookup (corpleaks .net)"; dns.query; content:"corpleaks.net"; nocase; bsize:13; reference:url,app.any.run/tasks/c8d61923-ae7c-42e4-9b92-f4be92b2b04e; classtype:policy-violation; sid:2030161; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_05_12, deployment Perimeter, former_category POLICY, signature_severity Major, tag Ransomware, updated_at 2020_11_17, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS cmd powershell base64 encoded to Web Server 2"; flow:established,to_server; content:"NtZCAvYyBwb3dlcnNoZWxsLmV4Z"; classtype:attempted-user; sid:2025828; rev:1; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_12, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_07_18;)
 
-alert dns $HOME_NET any -> any any (msg:"ET POLICY NEPHILIM Ransomware Victim Publishing Site DNS Lookup (hxt254aygrsziejn .onion) DNS Lookup"; dns.query; content:"hxt254aygrsziejn.onion"; nocase; bsize:22; reference:url,app.any.run/tasks/c8d61923-ae7c-42e4-9b92-f4be92b2b04e; classtype:policy-violation; sid:2030162; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_05_12, deployment Perimeter, former_category POLICY, signature_severity Major, tag Ransomware, updated_at 2020_11_17, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS cmd powershell base64 encoded to Web Server 3"; flow:established,to_server; content:"jbWQgL2MgcG93ZXJzaGVsbC5leG"; classtype:attempted-user; sid:2025829; rev:1; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2018_07_12, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_07_18;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Emotet.C Variant Checkin"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/download.php?listfiles="; http.content_len; byte_test:0,=,0,0,string,dec; http.header_names; content:!"User-Agent|0d 0a|"; content:!"Referer|0d 0a|"; content:!"|0d 0a|Accept"; reference:md5,cd74438c04b09baa5c32ad0e5a0306e7; classtype:command-and-control; sid:2020157; rev:4; metadata:created_at 2015_01_08, former_category MALWARE, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 Inbound Web Servers Likely Command Execution 1"; flow:established,to_server; content:"base64"; fast_pattern; content:"f0VM"; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})/R"; classtype:attempted-user; sid:2025716; rev:3; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_16, deployment Datacenter, former_category WEB_SPECIFIC_APPS, updated_at 2018_07_16;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Known Sinkhole Response Header CERT.PL"; flow:established,from_server; http.content_len; byte_test:0,=,24,0,string,dec; file.data; content:"Sinkholed by CERT.PL"; within:24; fast_pattern; classtype:trojan-activity; sid:2020172; rev:4; metadata:created_at 2015_01_13, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 Inbound Web Servers Likely Command Execution 2"; flow:established,to_server; content:"base64"; fast_pattern; content:"9FT"; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})/R"; classtype:attempted-user; sid:2025717; rev:3; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_16, deployment Datacenter, former_category WEB_SPECIFIC_APPS, updated_at 2018_07_16;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE eleethub botnet CnC Domain in DNS Lookup (irc.eleethub .com)"; dns.query; content:"irc.eleethub.com"; nocase; bsize:16; reference:url,unit42.paloaltonetworks.com/los-zetas-from-eleethub-botnet; classtype:command-and-control; sid:2030195; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_05_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 Inbound Web Servers Likely Command Execution 3"; flow:established,to_server; content:"base64"; fast_pattern; content:"/RU"; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})/R"; classtype:attempted-user; sid:2025718; rev:3; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_16, deployment Datacenter, former_category WEB_SPECIFIC_APPS, updated_at 2018_07_16;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE eleethub botnet CnC Domain in DNS Lookup (ghost.eleethub .com)"; dns.query; content:"ghost.eleethub.com"; nocase; bsize:18; reference:url,unit42.paloaltonetworks.com/los-zetas-from-eleethub-botnet; classtype:command-and-control; sid:2030196; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_05_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded ASCII Inbound Web Servers Likely Command Execution 4"; flow:established,to_server; content:"5c5c7837665c5c7834355c5c7834635c5c783436"; classtype:attempted-user; sid:2025732; rev:2; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_17, deployment Datacenter, former_category WEB_SPECIFIC_APPS, performance_impact Low, signature_severity Major, updated_at 2018_07_17;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE eleethub .com Domain in DNS Lookup (eleethub .com)"; dns.query; content:"eleethub.com"; nocase; bsize:12; reference:url,unit42.paloaltonetworks.com/los-zetas-from-eleethub-botnet; classtype:trojan-activity; sid:2030197; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_05_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 UTF-8 Inbound Web Servers Likely Command Execution 5"; flow:established,to_server; content:"XDE3N1wxMDVcMTE0XDEwN"; classtype:attempted-user; sid:2025832; rev:1; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_18, deployment Datacenter, former_category WEB_SPECIFIC_APPS, updated_at 2018_07_18;)
 
-alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Tomcat File Upload Payload Request (CVE-2017-12615)"; flow:to_server,established; http.method; content:"GET"; http.uri; content:".jsp?view="; fast_pattern; content:"&os="; distance:0; content:"&address="; distance:0; reference:cve,2017-12615; reference:url,forums.juniper.net/t5/Threat-Research/Anatomy-of-the-Bulehero-Cryptomining-Botnet/ba-p/458787; classtype:attempted-user; sid:2027517; rev:3; metadata:created_at 2019_06_26, deployment Perimeter, former_category EXPLOIT, performance_impact Moderate, signature_severity Major, updated_at 2020_11_17;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 UTF-8 Inbound Web Servers Likely Command Execution 6"; flow:established,to_server; content:"wxNzdcMTA1XDExNFwxMD"; classtype:attempted-user; sid:2025833; rev:1; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_18, deployment Datacenter, former_category WEB_SPECIFIC_APPS, updated_at 2018_07_18;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Observed DNS Query to known Avaddon Ransomware Payment Domain"; dns.query; content:"avaddonbotrxmuyl.onion.pet"; bsize:26; reference:md5,c9ec0d9ff44f445ce5614cc87398b38d; classtype:trojan-activity; sid:2030251; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_06_05, deployment Perimeter, former_category MALWARE, malware_family Ransomware, malware_family Avaddon, signature_severity Major, tag Ransomware, updated_at 2020_11_17, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 UTF-8 Inbound Web Servers Likely Command Execution 7"; flow:established,to_server; content:"cMTc3XDEwNVwxMTRcMTA2"; classtype:attempted-user; sid:2025834; rev:1; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_18, deployment Datacenter, former_category WEB_SPECIFIC_APPS, updated_at 2018_07_18;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE DonotGroup Staging Domain in DNS Query"; dns.query; content:"yourcontents.xyz"; nocase; endswith; classtype:domain-c2; sid:2030333; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_06_12, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2020_11_17;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 Hex Escape Inbound Web Servers Likely Command Execution 8"; flow:established,to_server; content:"XFx4N2ZcXHg0NVxceDRjXFx4ND"; classtype:attempted-user; sid:2025865; rev:1; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_19, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_07_19;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE DonotGroup Staging Domain in DNS Query"; dns.query; content:"filepage.icu"; nocase; endswith; classtype:domain-c2; sid:2030332; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_06_12, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2020_11_17;)
+alert tcp $EXTERNAL_NET any -> any any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 Hex Escape Inbound Web Servers Likely Command Execution 9"; flow:established,to_server; content:"xceDdmXFx4NDVcXHg0Y1xceDQ2"; classtype:attempted-user; sid:2025866; rev:1; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_19, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_07_19;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE DonotGroup Staging Domain in DNS Query"; dns.query; content:"datasecure.icu"; nocase; endswith; classtype:domain-c2; sid:2030331; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_06_12, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2020_11_17;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic encoded Base64 Hex Escape Inbound Web Servers Likely Command Execution 10"; flow:established,to_server; content:"cXHg3ZlxceDQ1XFx4NGNcXHg0N"; classtype:attempted-user; sid:2025867; rev:1; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_19, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_07_19;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Outdated Flash Version M1"; flow:established,to_server; threshold: type limit, count 1, seconds 60, track by_src; http.header; content:"x-flash-version|3a 20|"; content:!"32.0.0.387|0d 0a|"; within:12; content:!"32,0,0,387|0d 0a|"; within:12; reference:url,www.adobe.com/software/flash/about/; classtype:policy-violation; sid:2014726; rev:127; metadata:affected_product Adobe_Flash, created_at 2012_05_09, former_category POLICY, performance_impact Low, signature_severity Informational, updated_at 2020_11_17;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic plain Inbound Web Servers Likely Command Execution 11"; flow:established,to_server; content:"|5c|177|5c|105|5c|114|5c|106|5c|"; fast_pattern; classtype:attempted-user; sid:2025868; rev:2; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_19, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_07_19;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET [7080,8080,443,80,4143,995,21,50000,20,8090,8443,990,22] (msg:"ET MALWARE Win32/Emotet CnC Activity (POST) M6"; flow:established,to_server; http.method; content:"POST"; http.uri; content:!"."; content:!"&"; content:!"-"; http.header; content:"DNT|3a 20|1|0d 0a|"; http.user_agent; content:"Mozilla/4.0 (compatible|3b 20|MSIE 7.0|3b 20|Windows NT 6."; startswith; http.request_body; content:!"."; content:"%2B"; fast_pattern; http.content_len; byte_test:0,<,800,0,string,dec; byte_test:0,>,200,0,string,dec; http.start; pcre:"/^POST\s(?P\/(?:[A-Z0-9a-z]{2,25}){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(?:\x3a[0-9]{2,5})?(?P=urivar)\r\n/"; http.header_names; content:"|0d 0a|Referer|0d 0a|Content-Type|0d 0a|DNT|0d 0a|User-Agent|0d 0a|Host|0d 0a|Content-Length|0d 0a|Connection|0d 0a|Cache-Control|0d 0a 0d 0a|"; depth:93; reference:md5,e5fecd3be1747f6a934f70e921399a10; classtype:command-and-control; sid:2029060; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_11_27, deployment Perimeter, former_category MALWARE, malware_family Emotet, signature_severity Major, updated_at 2020_11_17;)
+alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ELF file magic plain Inbound Web Servers Likely Command Execution 12"; flow:established,to_server; content:"|5c 5c|x7f|5c 5c|x45|5c 5c|x4c|5c 5c|x46|5c 5c|"; classtype:attempted-user; sid:2025869; rev:2; metadata:affected_product Linux, attack_target Web_Server, created_at 2018_07_19, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_07_19;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Zebrocy Screenshot Upload"; flow:established,to_server; http.method; content:"POST"; http.request_body; pcre:"/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+/"; http.accept; content:"text/html, */*"; depth:14; endswith; http.accept_enc; content:"identity"; depth:8; endswith; http.content_len; byte_test:0,>,50000,0,string,dec; byte_test:0,<,120000,0,string,dec; http.start; content:".php HTTP/1.0|0d 0a|Connection|3a 20|keep-alive|0d 0a|Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a|Content-Length|3a 20|"; fast_pattern; http.header_names; content:!"User-Agent|0d 0a|"; reference:md5,5b2eca6abe1903955d1dfd41e301e0af; classtype:targeted-activity; sid:2030122; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_04_23, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_04_18;)
+alert http any any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Oracle WebLogic Deserialization  (CVE-2018-2893)"; flow:established,to_server; content:"t3|20|12"; depth:5; fast_pattern; content:"AS|3a|255"; distance:0; content:"HL|3a|19"; distance:0; content:"MS|3a|10000000"; distance:0; content:"PU|3a|t3|3a|//"; distance:0; reference:cve,2018-2893; reference:url,github.com/pyn3rd/CVE-2018-2893; classtype:attempted-admin; sid:2025929; rev:2; metadata:affected_product Web_Server_Applications, attack_target Server, created_at 2018_08_01, deployment Datacenter, former_category WEB_SPECIFIC_APPS, signature_severity Major, updated_at 2018_08_01;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE NSO Group Domain in DNS Lookup (urlpush .net)"; dns.query; content:".urlpush.net"; nocase; endswith; reference:url,www.amnesty.org/en/latest/research/2020/06/moroccan-journalist-targeted-with-network-injection-attacks-using-nso-groups-tools/; classtype:trojan-activity; sid:2030379; rev:3; metadata:attack_target Mobile_Client, created_at 2020_06_22, deployment Perimeter, former_category MOBILE_MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS DGNews XSS Attempt -- news.php catid"; flow:established,to_server; content:"/news.php?"; http_uri; nocase; content:"catid="; http_uri; nocase; pcre:"/.*?.*<.+\/script>?/iU"; reference:cve,CVE-2007-0693; reference:url,www.securityfocus.com/bid/24201; reference:url,doc.emergingthreats.net/2004585; classtype:web-application-attack; sid:2004585; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE NSO Group Domain in DNS Lookup (free247downloads .com)"; dns.query; content:"free247downloads.com"; nocase; endswith; reference:url,www.amnesty.org/en/latest/research/2020/06/moroccan-journalist-targeted-with-network-injection-attacks-using-nso-groups-tools/; classtype:trojan-activity; sid:2030380; rev:3; metadata:attack_target Mobile_Client, created_at 2020_06_22, deployment Perimeter, former_category MOBILE_MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS FSphp pathwirte.php FSPHP_LIB Parameter Remote File Inclusion Attempt"; flow:to_server,established; content:"/lib/pathwirte.php?"; http_uri; nocase; content:"FSPHP_LIB="; http_uri; nocase; pcre:"/FSPHP_LIB\s*=\s*(https?|ftps?|php)\:\//Ui"; reference:url,osvdb.org/show/osvdb/58317; reference:url,www.milw0rm.com/exploits/9720; reference:url,doc.emergingthreats.net/2010361; classtype:web-application-attack; sid:2010361; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Patchwork Staging Domain in DNS Query"; dns.query; content:"dnsresolve.live"; nocase; endswith; classtype:domain-c2; sid:2030378; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_06_22, deployment Perimeter, former_category MALWARE, signature_severity Major, tag Patchwork, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS News Manager ch_readalso.php read_xml_include Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/ch_readalso.php?"; http_uri; nocase; content:"read_xml_include="; http_uri; nocase; pcre:"/read_xml_include=\s*(https?|ftps?|php)\:\//Ui"; reference:bugtraq,29251; reference:url,xforce.iss.net/xforce/xfdb/42459; reference:url,milw0rm.com/exploits/5624; reference:url,doc.emergingthreats.net/2010099; classtype:web-application-attack; sid:2010099; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Evil Google Drive Download"; flow:established,to_server; http.method; content:"GET"; http.header; content:"User-Agent|3a 20|CODE|0d 0a|"; fast_pattern; http.host; content:"drive.google.com"; reference:md5,f5ee4c578976587586202c15e98997ed; classtype:bad-unknown; sid:2030438; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Nitrotech common.php root Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/includes/common.php?"; http_uri; nocase; content:"root="; http_uri; nocase; pcre:"/root=\s*(ftps?|https?|php)\:\//Ui"; reference:url,xforce.iss.net/xforce/xfdb/29904; reference:url,milw0rm.com/exploits/7218; reference:url,doc.emergingthreats.net/2008922; classtype:web-application-attack; sid:2008922; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed StrongPity CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"ms6-upload-serv3.com"; bsize:20; reference:url,blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html; classtype:domain-c2; sid:2030418; rev:2; metadata:affected_product Web_Browsers, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag StrongPity, tag SSL_TLS_SNI, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS NoAH Remote Inclusion Attempt -- mfa_theme.php tpls"; flow:established,to_server; content:"/modules/noevents/templates/mfa_theme.php?"; http_uri; nocase; content:"tpls["; http_uri; nocase; reference:cve,CVE-2007-2572; reference:url,www.milw0rm.com/exploits/3861; reference:url,doc.emergingthreats.net/2003694; classtype:web-application-attack; sid:2003694; rev:5; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed StrongPity CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"updt-servc-app2.com"; bsize:19; reference:url,blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html; classtype:domain-c2; sid:2030419; rev:2; metadata:affected_product Web_Browsers, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag StrongPity, tag SSL_TLS_SNI, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Nokia Intellisync Mobile Suite XSS Attempt -- dev_logon.asp username"; flow:established,to_server; content:"/de/pda/dev_logon.asp?"; http_uri; nocase; content:"username="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2592; reference:url,www.securityfocus.com/archive/1/archive/1/468048/100/0/threaded; reference:url,doc.emergingthreats.net/2003894; classtype:web-application-attack; sid:2003894; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed StrongPity CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"cdn2-system3-secrv.com"; bsize:22; reference:url,blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html; classtype:domain-c2; sid:2030420; rev:2; metadata:affected_product Web_Browsers, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag StrongPity, tag SSL_TLS_SNI, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Nokia Intellisync Mobile Suite XSS Attempt -- registerAccount.asp"; flow:established,to_server; content:"/usrmgr/registerAccount.asp?"; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2592; reference:url,www.securityfocus.com/archive/1/archive/1/468048/100/0/threaded; reference:url,doc.emergingthreats.net/2003895; classtype:web-application-attack; sid:2003895; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed StrongPity CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"file3-netwk-system.com"; bsize:22; reference:url,blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html; classtype:domain-c2; sid:2030421; rev:2; metadata:affected_product Web_Browsers, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag StrongPity, tag SSL_TLS_SNI, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Nokia Intellisync Mobile Suite XSS Attempt -- create_account.asp"; flow:established,to_server; content:"/de/create_account.asp?"; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2592; reference:url,www.securityfocus.com/archive/1/archive/1/468048/100/0/threaded; reference:url,doc.emergingthreats.net/2003896; classtype:web-application-attack; sid:2003896; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed StrongPity CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"service-net2-file.com"; bsize:21; reference:url,blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html; classtype:domain-c2; sid:2030422; rev:2; metadata:affected_product Web_Browsers, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag StrongPity, tag SSL_TLS_SNI, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS ODARS resource_categories_view.php CLASSES_ROOT parameter Remote file inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/resource_categories_view.php?"; http_uri; nocase; content:"CLASSES_ROOT="; http_uri; nocase; pcre:"/CLASSES_ROOT=\s*(https?|ftps?|php)\:\//Ui"; reference:url,secunia.com/advisories/30784/; reference:url,milw0rm.com/exploits/5906; reference:url,doc.emergingthreats.net/2009333; classtype:web-application-attack; sid:2009333; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed StrongPity CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"system2-access-sec43.com"; bsize:24; reference:url,blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html; classtype:domain-c2; sid:2030423; rev:2; metadata:affected_product Web_Browsers, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag StrongPity, tag SSL_TLS_SNI, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS OSTicket Remote Code Execution Attempt"; flow: established,from_client; content:"/osticket/include"; http_uri; nocase; pcre:"/.*\[.*\].*\;/U"; reference:url,secunia.com/advisories/15216; reference:url,www.gulftech.org/?node=research&article_id=00071-05022005; reference:cve,CAN-2005-1438; reference:cve,CAN-2005-1439; reference:url,doc.emergingthreats.net/bin/view/Main/2002702; classtype:web-application-attack; sid:2002702; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed StrongPity CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"network-msx-system33.com"; bsize:24; reference:url,blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html; classtype:domain-c2; sid:2030424; rev:2; metadata:affected_product Web_Browsers, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag StrongPity, tag SSL_TLS_SNI, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Open Translation Engine Remote Inclusion Attempt -- header.php ote_home"; flow:established,to_server; content:"/skins/header.php?"; http_uri; nocase; content:"ote_home="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2676; reference:url,www.milw0rm.com/exploits/3838; reference:url,doc.emergingthreats.net/2003741; classtype:web-application-attack; sid:2003741; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed StrongPity CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"mx3-rewc-state.com"; bsize:18; reference:url,blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html; classtype:domain-c2; sid:2030425; rev:2; metadata:affected_product Web_Browsers, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag StrongPity, tag SSL_TLS_SNI, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Open Translation Engine (OTE) XSS Attempt -- header.php ote_home"; flow:established,to_server; content:"/skins/header.php?"; http_uri; nocase; content:"ote_home="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2676; reference:url,www.milw0rm.com/exploits/3838; reference:url,doc.emergingthreats.net/2003878; classtype:web-application-attack; sid:2003878; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed StrongPity CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"upd3-srv-system-app.com"; bsize:23; reference:url,blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html; classtype:domain-c2; sid:2030426; rev:2; metadata:affected_product Web_Browsers, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag StrongPity, tag SSL_TLS_SNI, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS openEngine filepool.php oe_classpath parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/filepool.php?"; http_uri; nocase; content:"oe_classpath="; http_uri; nocase; pcre:"/oe_classpath=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,31423; reference:url,milw0rm.com/exploits/6585; reference:url,doc.emergingthreats.net/2009164; classtype:web-application-attack; sid:2009164; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed StrongPity CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"syse-update-app4.com"; bsize:20; reference:url,blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html; classtype:domain-c2; sid:2030427; rev:2; metadata:affected_product Web_Browsers, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag StrongPity, tag SSL_TLS_SNI, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Orlando CMS classes init.php GLOBALS Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/modules/core/logger/init.php?"; http_uri; nocase; content:"GLOBALS[preloc]="; http_uri; nocase; pcre:"/GLOBALS\[preloc\]=\s*(https?|ftps?|php)\:\//Ui"; reference:bugtraq,29820; reference:url,milw0rm.com/exploits/5864; reference:url,doc.emergingthreats.net/2009459; classtype:web-application-attack; sid:2009459; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed StrongPity CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"system2-cdn5-mx8.com"; bsize:20; reference:url,blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html; classtype:domain-c2; sid:2030428; rev:2; metadata:affected_product Web_Browsers, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag StrongPity, tag SSL_TLS_SNI, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Orlando CMS newscat.php GLOBALS Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/newscat.php?"; http_uri; nocase; content:"GLOBALS[preloc]="; http_uri; nocase; pcre:"/GLOBALS\[preloc\]=\s*(https?|ftps?|php)\:\//Ui"; reference:bugtraq,29820; reference:url,milw0rm.com/exploits/5864; reference:url,doc.emergingthreats.net/2009460; classtype:web-application-attack; sid:2009460; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed StrongPity CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"secure-upd21-app2.com"; bsize:21; reference:url,blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html; classtype:domain-c2; sid:2030429; rev:2; metadata:affected_product Web_Browsers, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag StrongPity, tag SSL_TLS_SNI, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Client_ID SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Client_ID="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006528; classtype:web-application-attack; sid:2006528; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed StrongPity CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"ms21-app3-upload.com"; bsize:20; reference:url,blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html; classtype:domain-c2; sid:2030430; rev:2; metadata:affected_product Web_Browsers, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag StrongPity, tag SSL_TLS_SNI, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Client_ID UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Client_ID="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006529; classtype:web-application-attack; sid:2006529; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed StrongPity CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"apt5-secure3-state.com"; bsize:22; reference:url,blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html; classtype:domain-c2; sid:2030431; rev:2; metadata:affected_product Web_Browsers, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag StrongPity, tag SSL_TLS_SNI, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Client_ID INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Client_ID="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006530; classtype:web-application-attack; sid:2006530; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed StrongPity CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"upd8-sys2-apt.com"; bsize:17; reference:url,blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html; classtype:domain-c2; sid:2030432; rev:2; metadata:affected_product Web_Browsers, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag StrongPity, tag SSL_TLS_SNI, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Client_ID DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Client_ID="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006531; classtype:web-application-attack; sid:2006531; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed StrongPity CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"update5-sec3-system.com"; bsize:23; reference:url,blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html; classtype:domain-c2; sid:2030433; rev:2; metadata:affected_product Web_Browsers, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag StrongPity, tag SSL_TLS_SNI, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Client_ID ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Client_ID="; http_uri; nocase; content:"ASCII"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006532; classtype:web-application-attack; sid:2006532; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed StrongPity CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"state-awe3-apt.com"; bsize:18; reference:url,blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html; classtype:domain-c2; sid:2030434; rev:2; metadata:affected_product Web_Browsers, created_at 2020_07_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag StrongPity, tag SSL_TLS_SNI, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Client_ID UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Client_ID="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006533; classtype:web-application-attack; sid:2006533; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"advertstv.com"; bsize:13; classtype:domain-c2; sid:2030459; rev:2; metadata:created_at 2020_07_03, deployment Perimeter, former_category MALWARE, malware_family Cobalt_Strike, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Invoice_ID SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Invoice_ID="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006534; classtype:web-application-attack; sid:2006534; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"amazingdonutco.com"; bsize:18; classtype:domain-c2; sid:2030461; rev:2; metadata:created_at 2020_07_03, deployment Perimeter, former_category MALWARE, malware_family Cobalt_Strike, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Invoice_ID UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Invoice_ID="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006535; classtype:web-application-attack; sid:2006535; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"mwebsoft.com"; bsize:12; classtype:domain-c2; sid:2030463; rev:2; metadata:created_at 2020_07_03, deployment Perimeter, former_category MALWARE, malware_family Cobalt_Strike, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Invoice_ID INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Invoice_ID="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006536; classtype:web-application-attack; sid:2006536; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"rostraffic.com"; bsize:14; classtype:domain-c2; sid:2030465; rev:2; metadata:created_at 2020_07_03, deployment Perimeter, former_category MALWARE, malware_family Cobalt_Strike, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Invoice_ID DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Invoice_ID="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006537; classtype:web-application-attack; sid:2006537; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed CobaltStrike CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"typiconsult.com"; bsize:15; classtype:domain-c2; sid:2030467; rev:2; metadata:created_at 2020_07_03, deployment Perimeter, former_category MALWARE, malware_family Cobalt_Strike, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Invoice_ID ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Invoice_ID="; http_uri; nocase; content:"ASCII"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006538; classtype:web-application-attack; sid:2006538; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Magecart/Skimmer Domain in DNS Lookup (cddn .site)"; dns.query; content:"cddn.site"; nocase; bsize:9; reference:url,blog.malwarebytes.com/threat-analysis/2020/06/web-skimmer-hides-within-exif-metadata-exfiltrates-credit-cards-via-image-files/; classtype:trojan-activity; sid:2030480; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_07_07, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Invoice_ID UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Invoice_ID="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006539; classtype:web-application-attack; sid:2006539; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Magecart/Skimmer Domain in DNS Lookup (cxizi .net)"; dns.query; content:"cxizi.net"; nocase; bsize:9; reference:url,blog.malwarebytes.com/threat-analysis/2020/06/web-skimmer-hides-within-exif-metadata-exfiltrates-credit-cards-via-image-files/; classtype:trojan-activity; sid:2030481; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_07_07, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Vendor_ID SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Vendor_ID="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006540; classtype:web-application-attack; sid:2006540; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Magecart/Skimmer Domain in DNS Lookup (yzxi .net)"; dns.query; content:"yzxi.net"; nocase; bsize:8; reference:url,blog.malwarebytes.com/threat-analysis/2020/06/web-skimmer-hides-within-exif-metadata-exfiltrates-credit-cards-via-image-files/; classtype:trojan-activity; sid:2030482; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_07_07, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Vendor_ID UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Vendor_ID="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006541; classtype:web-application-attack; sid:2006541; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed TaurusStealer CnC Domain in TLS SNI"; flow:established,to_server; tls.sni; content:"zyvcin.xyz"; bsize:10; classtype:domain-c2; sid:2030477; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2020_07_07, deployment Perimeter, former_category MALWARE, malware_family Taurus, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Vendor_ID INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Vendor_ID="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006542; classtype:web-application-attack; sid:2006542; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert smtp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Phorpiex Template 6 Active - Outbound Malicious Email Spam"; flow:established,to_server; content:"Subject|3a 20|YOU|20|BETTER|20|READ|20|THIS|0d|"; fast_pattern; content:"COLLECTED|20|ALL|20|YOUR|20|FILES"; content:"in|20|Bitcoin"; nocase; content:"receiving|20|the|20|Bitcoin"; nocase; threshold: type limit, count 1, seconds 30, track by_src; classtype:command-and-control; sid:2031210; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2020_11_17, deployment Perimeter, deployment Internal, former_category MALWARE, malware_family Phorpiex, performance_impact Low, signature_severity Major, tag SpamBot, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Vendor_ID DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Vendor_ID="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006543; classtype:web-application-attack; sid:2006543; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT AVTECH Authenticated Command Injection in CloudSetup.cgi (Outbound)"; flow:to_server,established; http.uri; content:"/cgi-bin/supervisor/CloudSetup.cgi?exefile="; nocase; depth:43; fast_pattern; reference:url,github.com/Trietptm-on-Security/AVTECH; classtype:attempted-recon; sid:2030503; rev:2; metadata:affected_product Web_Server_Applications, attack_target Client_Endpoint, created_at 2020_07_14, deployment Perimeter, former_category EXPLOIT, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Vendor_ID ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Vendor_ID="; http_uri; nocase; content:"ASCII"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006544; classtype:web-application-attack; sid:2006544; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Possible Successful Generic Phish to .ml Domain 2018-10-23"; flow:established,to_server; flowbits:isset,ET.genericphish; http.method; content:"POST"; http.host; content:".ml"; endswith; fast_pattern; classtype:credential-theft; sid:2026532; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_10_23, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2020_11_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPAccounts SQL Injection Attempt -- index.php Vendor_ID UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"Vendor_ID="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-3345; reference:url,pridels-team.blogspot.com/2007/06/phpaccounts-vuln.html; reference:url,doc.emergingthreats.net/2006545; classtype:web-application-attack; sid:2006545; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Possible Successful Generic Phish to .cf Domain 2018-10-23"; flow:established,to_server; flowbits:isset,ET.genericphish; http.method; content:"POST"; http.host; content:".cf"; endswith; fast_pattern; classtype:credential-theft; sid:2026533; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_10_23, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2020_11_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPauction GPL converter.inc.php include_path Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/includes/converter.inc.php?"; http_uri; nocase; content:"include_path="; http_uri; nocase; pcre:"/include_path=\s*(ftps?|https?|php)\://Ui"; reference:url,vupen.com/english/advisories/2008/0908; reference:bugtraq,28284; reference:url,milw0rm.com/exploits/5266; reference:url,doc.emergingthreats.net/2009871; classtype:web-application-attack; sid:2009871; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Possible Successful Generic Phish to .ga Domain 2018-10-23"; flow:established,to_server; flowbits:isset,ET.genericphish; http.method; content:"POST"; http.host; content:".ga"; endswith; fast_pattern; classtype:credential-theft; sid:2026534; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_10_23, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2020_11_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPauction GPL messages.inc.php include_path Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/includes/messages.inc.php?"; http_uri; nocase; content:"include_path="; http_uri; nocase; pcre:"/include_path=\s*(ftps?|https?|php)\://Ui"; reference:url,vupen.com/english/advisories/2008/0908; reference:bugtraq,28284; reference:url,milw0rm.com/exploits/5266; reference:url,doc.emergingthreats.net/2009872; classtype:web-application-attack; sid:2009872; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Possible Successful Generic Phish to .gq Domain 2018-10-23"; flow:established,to_server; flowbits:isset,ET.genericphish; http.method; content:"POST"; http.host; content:".gq"; endswith; fast_pattern; classtype:credential-theft; sid:2026535; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_10_23, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2020_11_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPauction GPL settings.inc.php include_path Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/includes/settings.inc.php?"; http_uri; nocase; content:"include_path="; http_uri; nocase; pcre:"/include_path=\s*(ftps?|https?|php)\://Ui"; reference:url,vupen.com/english/advisories/2008/0908; reference:bugtraq,28284; reference:url,milw0rm.com/exploits/5266; reference:url,doc.emergingthreats.net/2009873; classtype:web-application-attack; sid:2009873; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Possible Successful Generic Phish to .gqn Domain 2018-10-23"; flow:established,to_server; flowbits:isset,ET.genericphish; http.method; content:"POST"; http.host; content:".gqn"; endswith; fast_pattern; classtype:credential-theft; sid:2026536; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_10_23, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2020_11_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB Remote Code Execution Attempt"; flow:established,to_server; content:"/viewtopic.php?"; http_uri; pcre:"/highlight=.*?(\'|\%[a-f0-9]{4})(\.|\/|\\|\%[a-f0-9]{4}).+?(\'|\%[a-f0-9]{4})/Ui"; reference:url,secunia.com/advisories/15845/; reference:bugtraq,14086; reference:url,www.securiteam.com/unixfocus/6Z00R2ABPY.html; reference:url,doc.emergingthreats.net/2002070; classtype:web-application-attack; sid:2002070; rev:9; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Possible Successful Generic Phish to .icu Domain 2019-02-06"; flow:established,to_server; flowbits:isset,ET.genericphish; http.method; content:"POST"; http.host; content:".icu"; endswith; fast_pattern; classtype:credential-theft; sid:2026886; rev:5; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2019_02_06, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2020_11_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Generic phpbb arbitrary command attempt"; flow:established,to_server; content:".php?"; http_uri; nocase; content:"phpbb_root_path="; http_uri; nocase; pcre:"/phpbb_root_path=(ftps?|https?|php)/Ui"; reference:url,cve.mitre.org/cgi-bin/cvekey.cgi?keyword=phpbb_root_path; reference:url,doc.emergingthreats.net/2002731; classtype:web-application-attack; sid:2002731; rev:9; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET INFO Suspicious Outbound SIG DNS Query"; content:"|00 00 18 00 01|"; fast_pattern; dns.query; pcre:"/^\d/"; classtype:bad-unknown; sid:2030547; rev:2; metadata:created_at 2020_07_16, former_category INFO, performance_impact Significant, signature_severity Informational, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 registration (Step1 GET)"; flow:to_server,established; content:"GET "; depth:4; nocase; content:"/ucp.php"; http_uri; nocase; content:"mode=register"; http_uri; flowbits:set,ET.phpBB3_test; flowbits:set,ET.phpBB3_register_stage1; flowbits:noalert; reference:url,doc.emergingthreats.net/2010890; classtype:attempted-user; sid:2010890; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Cisco ASA/Firepower Unauthenticated File Read (CVE-2020-3452) M1"; flow:established,to_server; http.uri; content:"/+CSCOT+/translation-table?type=mst&textdomain=/|2b|CSCOE|2b|/"; fast_pattern; content:"&default-language&lang="; distance:0; http.uri.raw; content:"&default-language&lang=../"; reference:url,tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ro-path-KJuQhB86; reference:cve,2020-3452; classtype:attempted-user; sid:2030581; rev:3; metadata:affected_product Web_Server_Applications, attack_target Networking_Equipment, created_at 2020_07_23, deployment Perimeter, deployment Datacenter, deployment SSLDecrypt, former_category EXPLOIT, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 registration (Step2 POST)"; flow:to_server,established; content:"POST "; depth:5; nocase; content:"/ucp.php"; http_uri; nocase; content:"mode=register"; http_uri; content:"agreed=I+agree+to+these+terms"; content:"change_lang="; content:"creation_time"; content:"form_token"; flowbits:set,ET.phpBB3_test; flowbits:isset,ET.phpBB3_register_stage1; flowbits:set,ET.phpBB3_register_stage2; flowbits:noalert; reference:url,doc.emergingthreats.net/2010891; classtype:attempted-user; sid:2010891; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Cisco ASA/Firepower Unauthenticated File Read (CVE-2020-3452) M2"; flow:established,to_server; http.uri; content:"/+CSCOT+/oem-customization?app=AnyConnect&type=oem&platform="; fast_pattern; content:"&name=|2b|CSCOE|2b 2f|"; distance:0; http.uri.raw; content:"&platform=..&resource-type=.."; reference:url,tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ro-path-KJuQhB86; reference:cve,2020-3452; classtype:attempted-user; sid:2030582; rev:2; metadata:affected_product Web_Server_Applications, attack_target Networking_Equipment, created_at 2020_07_23, deployment Perimeter, deployment Datacenter, deployment SSLDecrypt, former_category EXPLOIT, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 registration (Step3 GET)"; flow:to_server,established; content:"GET "; depth:4; nocase; content:"/ucp.php"; http_uri; nocase; content:"mode=confirm"; http_uri; content:"confirm_id="; http_uri; content:"type="; http_uri; flowbits:set,ET.phpBB3_test; flowbits:set,ET.phpBB3_register_stage3; flowbits:noalert; reference:url,doc.emergingthreats.net/2010892; classtype:attempted-user; sid:2010892; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Successful Generic Phish 2018-06-27 (set)"; flow:established,to_server; flowbits:set,ET.genericphish; flowbits:noalert; http.method; content:"POST"; http.request_body; content:"id1="; depth:4; nocase; content:"&id2="; nocase; distance:0; fast_pattern; classtype:credential-theft; sid:2025630; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_06_27, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2020_11_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 registration (Step4 POST)"; flow:to_server,established; content:"POST "; depth:5; nocase; content:"/ucp.php"; http_uri; nocase; content:"mode=register"; http_uri; content:"username="; content:"email="; content:"email_confirm="; content:"new_password"; content:"password_confirm"; content:"lang="; content:"tz="; content:"confirm_code="; content:"refresh_vc="; content:"confirm_id="; content:"agreed="; content:"change_lang="; content:"confirm_id="; content:"creation_time="; content:"form_token="; flowbits:set,ET.phpBB3_test; flowbits:isset,ET.phpBB3_register_stage3; flowbits:set,ET.phpBB3_register_stage4; flowbits:noalert; reference:url,doc.emergingthreats.net/2010893; classtype:attempted-user; sid:2010893; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE ThiefQuest CnC Domain in DNS Lookup"; dns.query; content:"andrewka6.pythonanywhere.com"; nocase; bsize:28; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/updates-on-thiefquest-the-quickly-evolving-macos-malware/; classtype:command-and-control; sid:2030613; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_07_29, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 Brute-Force reg attempt (Bad pf_XXXXX)"; flowbits:isset,ET.phpBB3_test; flow:to_server,established; content:"POST "; depth:5; nocase; content:"/ucp.php"; http_uri; nocase; content:"mode=register"; http_uri; content:"username="; content:"email="; content:"pf_XXXXX="; pcre:!"/^Y$/R"; flowbits:unset,ET.phpBB3_test; reference:url,doc.emergingthreats.net/2010894; classtype:web-application-attack; sid:2010894; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Magecart/Skimmer Domain in DNS Lookup (cloud-sources .com)"; dns.query; content:"cloud-sources.com"; nocase; bsize:17; reference:url,twitter.com/felixaime/status/1287409263623770112; classtype:trojan-activity; sid:2030636; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_08_03, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 Brute-Force reg attempt (Bad pf_XXXXX)"; flowbits:isset,ET.phpBB3_test; flow:to_server,established; content:"POST "; depth:5; nocase; content:"/ucp.php"; http_uri; nocase; content:"mode=register"; http_uri; content:"username="; content:"email="; content:"pf_XXXXX="; pcre:!"/^YYY$/R"; flowbits:unset,ET.phpBB3_test; reference:url,doc.emergingthreats.net/2010895; classtype:web-application-attack; sid:2010895; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Magecart/Skimmer Domain in DNS Lookup (cdn-filestorm .com)"; dns.query; content:"cdn-filestorm.com"; nocase; bsize:17; reference:url,twitter.com/felixaime/status/1287409263623770112; classtype:trojan-activity; sid:2030637; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_08_03, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 registration (Bogus Stage3 GET)"; flow:to_server,established; content:"GET "; depth:4; nocase; content:"/ucp.php"; http_uri; nocase; content:"mode=confirm"; http_uri; content:"id="; http_uri; pcre:"/(\?|&)id=/Ui"; content:"type="; http_uri; reference:url,doc.emergingthreats.net/2010898; classtype:web-application-attack; sid:2010898; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup (chretiendaujoudhui .com)"; dns.query; content:"chretiendaujoudhui.com"; nocase; bsize:22; reference:url,citizenlab.ca/2020/08/nothing-sacred-nso-sypware-in-togo/; classtype:targeted-activity; sid:2030638; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_08_03, deployment Perimeter, former_category MOBILE_MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 multiple login attempts"; flow:to_server,established; content:"POST "; depth:5; nocase; content:"/ucp.php"; http_uri; nocase; content:"mode=login"; http_uri; threshold: type threshold, track by_src, count 2, seconds 60; reference:url,doc.emergingthreats.net/2010899; classtype:attempted-user; sid:2010899; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup (leprotestant .com)"; dns.query; content:"leprotestant.com"; nocase; bsize:16; reference:url,citizenlab.ca/2020/08/nothing-sacred-nso-sypware-in-togo/; classtype:targeted-activity; sid:2030639; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_08_03, deployment Perimeter, former_category MOBILE_MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpBB3 possible spammer posting attempts"; flow:to_server,established; content:"POST "; depth:5; nocase; content:"/posting.php"; http_uri; nocase; content:"mode=post"; http_uri; threshold: type threshold, track by_src, count 2, seconds 30; reference:url,doc.emergingthreats.net/2010900; classtype:web-application-attack; sid:2010900; rev:3; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup (vie-en-islam .com)"; dns.query; content:"vie-en-islam.com"; nocase; bsize:16; reference:url,citizenlab.ca/2020/08/nothing-sacred-nso-sypware-in-togo/; classtype:targeted-activity; sid:2030640; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_08_03, deployment Perimeter, former_category MOBILE_MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPChain XSS Attempt -- settings.php catid"; flow:established,to_server; content:"/settings.php?"; http_uri; nocase; content:"catid="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2670; reference:url,www.securityfocus.com/bid/23761; reference:url,doc.emergingthreats.net/2003879; classtype:web-application-attack; sid:2003879; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE NSO Group CnC Domain in DNS Lookup (viedechretien .org)"; dns.query; content:"viedechretien.org"; nocase; bsize:17; reference:url,citizenlab.ca/2020/08/nothing-sacred-nso-sypware-in-togo/; classtype:targeted-activity; sid:2030641; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_08_03, deployment Perimeter, former_category MOBILE_MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPChain XSS Attempt -- cat.php catid"; flow:established,to_server; content:"/cat.php?"; http_uri; nocase; content:"catid="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/?.*<.+\/script>?/Ui"; reference:cve,CVE-2007-2670; reference:url,www.securityfocus.com/bid/23761; reference:url,doc.emergingthreats.net/2003880; classtype:web-application-attack; sid:2003880; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE TAIDOOR CnC Domain in DNS Lookup (www.cnaweb.mrslove .com)"; dns.query; content:"www.cnaweb.mrslove.com"; nocase; bsize:22; reference:url,us-cert.cisa.gov/ncas/analysis-reports/ar20-216a; classtype:command-and-control; sid:2030642; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_08_03, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPChess Remote Inclusion Attempt -- language.php config"; flow:established,to_server; content:"/includes/language.php?"; http_uri; nocase; content:"config="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2677; reference:url,www.milw0rm.com/exploits/3837; reference:url,doc.emergingthreats.net/2003742; classtype:web-application-attack; sid:2003742; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE TAIDOOR CnC Domain in DNS Lookup (www.infonew.dubya .net)"; dns.query; content:"www.infonew.dubya.net"; nocase; bsize:21; reference:url,us-cert.cisa.gov/ncas/analysis-reports/ar20-216a; classtype:command-and-control; sid:2030643; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_08_03, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPChess Remote Inclusion Attempt -- layout_admin_cfg.php Root_Path"; flow:established,to_server; content:"/layout_admin_cfg.php?"; http_uri; nocase; content:"Root_Path="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2677; reference:url,www.milw0rm.com/exploits/3837; reference:url,doc.emergingthreats.net/2003743; classtype:web-application-attack; sid:2003743; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Dropbox Phishing Landing - Title over non SSL"; flow:established,to_client; http.header; content:!"https://www.dropbox.com/"; file.data; content:"Dropbox Business"; nocase; classtype:social-engineering; sid:2024403; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_06_16, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPChess Remote Inclusion Attempt -- layout_cfg.php Root_Path"; flow:established,to_server; content:"/layout_cfg.php?"; http_uri; nocase; content:"Root_Path="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2677; reference:url,www.milw0rm.com/exploits/3837; reference:url,doc.emergingthreats.net/2003744; classtype:web-application-attack; sid:2003744; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Paypal Phishing Landing 2018-01-18 M1"; flow:established,to_client; http.header; content:!"https://*.paypal.com"; file.data; content:"|73 63 72 69 70 74 3a 20 6e 6f 64 65 2c 20 74 65 6d 70 6c 61 74 65 3a 20 20 2c 20 64 61 74 65 3a 20 4a 75 6c 20 33|"; content:"Log in to your PayPal account"; fast_pattern; nocase; distance:0; classtype:social-engineering; sid:2025214; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_01_18, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPChess Remote Inclusion Attempt -- layout_t_top.php Root_Path"; flow:established,to_server; content:"/skins/phpchess/layout_t_top.php?"; http_uri; nocase; content:"Root_Path="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2677; reference:url,www.milw0rm.com/exploits/3837; reference:url,doc.emergingthreats.net/2003745; classtype:web-application-attack; sid:2003745; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Paypal Phishing Landing - Title over non SSL"; flow:established,to_client; http.header; content:!"https://*.paypal.com"; file.data; content:""; nocase; content:"your PayPal account"; nocase; within:100; fast_pattern; pcre:"/<title>\s*(?:log\s*in|sign\s*in)/i"; classtype:social-engineering; sid:2024391; rev:5; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_06_16, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPEventMan remote file include"; flow:established,to_server; content:"/controller/"; http_uri; nocase; pcre:"/(text\.ctrl\.php|common\.function\.php)\?level=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,22358; reference:url,doc.emergingthreats.net/2003372; classtype:web-application-attack; sid:2003372; rev:6; metadata:affected_product Any, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Remote_File_Include, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Paypal Phishing Landing - Title over non SSL"; flow:established,to_client; http.header; content:!"https://*.paypal.com"; file.data; content:"<title>"; nocase; content:"|20|-|20|paypal"; nocase; within:100; fast_pattern; pcre:"/<title>\s*(?:s(?:e(?:nd money, pay online or set up a merchant|cure) account|uspicious (?:transaction |activities))|con(?:firm card security information|to limitato)|(?:profile updat|mot de pass)e|login)\s*-\s*paypal\s*<\/title>/i"; classtype:social-engineering; sid:2024970; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_11_07, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPFirstPost Remote Inclusion Attempt block.php Include"; flow:established,to_server; content:"/block.php?"; http_uri; nocase; content:"Include="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2665; reference:url,www.milw0rm.com/exploits/3906; reference:url,doc.emergingthreats.net/2003740; classtype:web-application-attack; sid:2003740; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible iCloud Phishing Landing - Title over non SSL"; flow:established,to_client; http.header; content:!"X-Apple-Request-UUID|3a|"; file.data; content:"<title>iCloud"; nocase; classtype:social-engineering; sid:2024385; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_06_16, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPGenealogy CoupleDB.php DataDirectory Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/CoupleDB.php?"; http_uri; nocase; content:"DataDirectory="; http_uri; nocase; pcre:"/DataDirectory=\s*(ftps?|https?|php)\:\//Ui"; reference:url,milw0rm.com/exploits/9155; reference:url,packetstormsecurity.org/0907-exploits/phpgenealogy-rfi.txt; reference:url,doc.emergingthreats.net/2010095; classtype:web-application-attack; sid:2010095; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Facebook Phishing Landing - Title over non SSL"; flow:established,to_client; http.header; content:!"*.facebook.com"; file.data; content:"Welcome to Facebook"; nocase; classtype:social-engineering; sid:2024402; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_06_16, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_USER SELECT"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_USER="; http_uri; nocase; content:"SELECT"; http_uri; nocase; content:"FROM"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003805; classtype:web-application-attack; sid:2003805; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Facebook Phishing Landing - Title over non SSL"; flow:established,to_client; http.header; content:!"*.facebook.com"; file.data; content:""; nocase; content:"facebook email security"; within:40; nocase; fast_pattern; classtype:social-engineering; sid:2024451; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_07_10, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_USER UNION SELECT"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_USER="; http_uri; nocase; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003806; classtype:web-application-attack; sid:2003806; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Facebook Phishing Landing - Title over non SSL"; flow:established,to_client; http.header; content:!"*.facebook.com"; file.data; content:"<title"; nocase; content:"Log in to Facebook"; nocase; within:100; fast_pattern; classtype:social-engineering; sid:2024807; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_10_05, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_USER INSERT"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_USER="; http_uri; nocase; content:"INSERT"; http_uri; nocase; content:"INTO"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003807; classtype:web-application-attack; sid:2003807; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Facebook Phishing Landing - Title over non SSL"; flow:established,to_client; http.header; content:!"*.facebook.com"; file.data; content:"<title"; nocase; content:"About Copyright|20 7c 20|Facebook Help Center"; within:100; nocase; fast_pattern; classtype:social-engineering; sid:2025137; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_12_06, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_USER DELETE"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_USER="; http_uri; nocase; content:"DELETE"; http_uri; nocase; content:"FROM"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003808; classtype:web-application-attack; sid:2003808; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Wells Fargo Phishing Landing - Title over non SSL"; flow:established,to_client; http.header; content:!"wellsfargo.com/"; file.data; content:"<title>Wells Fargo Sign On to View Your Accounts"; nocase; classtype:social-engineering; sid:2025360; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_15, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_USER ASCII"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_USER="; http_uri; nocase; content:"ASCII("; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003809; classtype:web-application-attack; sid:2003809; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Wells Fargo Phishing Landing 2018-02-02 M4"; flow:established,to_client; http.header; content:!".wellsfargo.com/"; file.data; content:"antiClickjack.parentNode.removeChild"; within:1000; content:"Wells Fargo Sign On to View Your Accounts"; nocase; distance:0; fast_pattern; classtype:social-engineering; sid:2025295; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_02_02, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_USER UPDATE"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_USER="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; content:"SET"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003810; classtype:web-application-attack; sid:2003810; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Paypal Phishing Landing Feb 24 2017"; flow:from_server,established; http.header; content:"!*.paypal.com"; file.data; content:""; nocase; fast_pattern; content:" $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_PASS SELECT"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_PASS="; http_uri; nocase; content:"SELECT"; http_uri; nocase; content:"FROM"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003811; classtype:web-application-attack; sid:2003811; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Magecart CnC Domain Observed in DNS Query"; dns.query; content:"cdnapis.com"; nocase; endswith; depth:11; reference:url,www.riskiq.com/blog/labs/magecart-reused-domains/?utm_campaign=magecart-reused-domains; classtype:domain-c2; sid:2028605; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2019_09_19, deployment Perimeter, former_category MALWARE, malware_family MageCart, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_PASS UNION SELECT"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_PASS="; http_uri; nocase; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003812; classtype:web-application-attack; sid:2003812; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Successful Facebook Mobile Phish 2017-08-15"; flow:to_server,established; http.method; content:"POST"; http.host; content:!".facebook.com"; endswith; http.request_body; content:"lsd="; depth:4; nocase; content:"&m_ts="; nocase; distance:0; content:"&li="; nocase; distance:0; content:"&try_number="; nocase; distance:0; fast_pattern; content:"&email="; nocase; distance:0; content:"&pass="; nocase; distance:0; content:"&login="; nocase; distance:0; content:"&_fb_noscript="; nocase; distance:0; classtype:credential-theft; sid:2029661; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_08_15, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2020_11_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_PASS INSERT"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_PASS="; http_uri; nocase; content:"INSERT"; http_uri; nocase; content:"INTO"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003813; classtype:web-application-attack; sid:2003813; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Successful Facebook Phish 2018-01-26"; flow:established,to_server; flowbits:isset,ET.genericphish; http.method; content:"POST"; http.host; content:!".facebook.com"; endswith; http.request_body; content:"lsd="; depth:4; nocase; content:"&try_number="; nocase; distance:0; content:"&unrecognized_tries="; nocase; distance:0; content:"&prefill_contact_point="; nocase; distance:0; content:"&prefill_source="; nocase; distance:0; content:"&prefill_type="; nocase; distance:0; content:"&first_prefill_source="; nocase; distance:0; content:"&first_prefill_type="; nocase; distance:0; content:"&had_cp_prefilled="; nocase; distance:0; content:"&had_password_prefilled="; nocase; distance:0; fast_pattern; classtype:credential-theft; sid:2029665; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2018_01_25, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2020_11_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_PASS DELETE"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_PASS="; http_uri; nocase; content:"DELETE"; http_uri; nocase; content:"FROM"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003814; classtype:web-application-attack; sid:2003814; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Successful Facebook Phish 2019-04-26"; flow:established,to_server; http.method; content:"POST"; http.host; content:!".facebook.com"; endswith; http.request_body; content:"lsd="; depth:4; nocase; content:"&jazoest="; nocase; distance:0; fast_pattern; content:"&m_ts="; nocase; distance:0; content:"&try_number="; nocase; distance:0; content:"&unrecognized_tries="; nocase; distance:0; content:"&email="; nocase; distance:0; content:"|25|40"; distance:0; content:"&pass="; nocase; distance:0; content:"&login="; nocase; distance:0; content:"&prefill_contact_point="; nocase; distance:0; content:"&_fb_noscript="; nocase; distance:0; classtype:credential-theft; sid:2029673; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2019_04_26, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2020_11_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_PASS ASCII"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_PASS="; http_uri; nocase; content:"ASCII("; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003815; classtype:web-application-attack; sid:2003815; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Successful Facebook Phish 2019-08-29"; flow:established,to_server; http.method; content:"POST"; http.host; content:!".facebook.com"; endswith; http.request_body; content:"lsd="; depth:4; nocase; content:"&m_ts="; nocase; distance:0; content:"&li="; nocase; distance:0; content:"&try_number="; nocase; distance:0; content:"&unrecognized_tries="; nocase; distance:0; fast_pattern; content:"&email="; nocase; distance:0; content:"|25|40"; distance:0; content:"&pass="; nocase; distance:0; classtype:credential-theft; sid:2029678; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2019_08_29, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2020_11_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpHoo3 SQL Injection Attempt -- admin.php ADMIN_PASS UPDATE"; flow:established,to_server; content:"/admin.php?"; http_uri; nocase; content:"ADMIN_PASS="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; content:"SET"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-2534; reference:url,www.securityfocus.com/bid/23854; reference:url,doc.emergingthreats.net/2003816; classtype:web-application-attack; sid:2003816; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Successful Facebook Phish 2020-01-10"; flow:established,to_server; http.method; content:"POST"; http.host; content:!".facebook.com"; endswith; http.request_body; content:"lsd="; depth:4; nocase; content:"&m_ts="; nocase; distance:0; content:"&li="; nocase; distance:0; content:"&try_number="; nocase; distance:0; content:"&unrecognized_tries="; nocase; distance:0; content:"&email="; nocase; distance:0; content:"|25|40"; distance:0; content:"&login="; nocase; distance:0; content:"&_fb_noscript="; nocase; distance:0; fast_pattern; classtype:credential-theft; sid:2029683; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_01_10, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2020_11_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPHtmlLib Remote Inclusion Attempt -- widget8.php phphtmllib"; flow:established,to_server; content:"/examples/widget8.php?"; http_uri; nocase; content:"phphtmllib="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2614; reference:url,www.securityfocus.com/archive/1/archive/1/467837/100/0/threaded; reference:url,doc.emergingthreats.net/2003730; classtype:web-application-attack; sid:2003730; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Successful Amazon Phish 2016-10-27"; flow:to_server,established; http.method; content:"POST"; http.host; content:!"amazon.com"; endswith; content:!".amazon.co.jp"; endswith; http.request_body; content:"appActionToken="; nocase; content:"&appAction=SIGNIN"; nocase; distance:0; fast_pattern; content:"|25|40"; distance:0; content:"&pass"; nocase; distance:0; classtype:credential-theft; sid:2032713; rev:8; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_10_27, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2020_11_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPLojaFacil Remote Inclusion Attempt -- ftp.php path_local"; flow:established,to_server; content:"/ftp.php?"; http_uri; nocase; content:"path_local="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2615; reference:url,www.milw0rm.com/exploits/3875; reference:url,doc.emergingthreats.net/2003731; classtype:web-application-attack; sid:2003731; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Bank of America Phishing Landing Aug 19 2015"; flow:to_client,established; http.header; content:!"X-BOA-RequestID|3a|"; file.data; content:"boaVIPAAuseGzippedBundles"; fast_pattern; content:"boaVIPAAjawrEnabled"; distance:0; classtype:social-engineering; sid:2025666; rev:5; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2015_08_19, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPLojaFacil Remote Inclusion Attempt -- db.php path_local"; flow:established,to_server; content:"/libs/db.php?"; http_uri; nocase; content:"path_local="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2615; reference:url,www.milw0rm.com/exploits/3875; reference:url,doc.emergingthreats.net/2003732; classtype:web-application-attack; sid:2003732; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Successful Bank of America Phish M2 2016-08-31"; flow:to_server,established; http.method; content:"POST"; http.host; content:!".bankofamerica.com"; endswith; http.request_body; content:"csrfTokenHidden="; depth:16; nocase; content:"&lpPasscodeErrorCounter="; nocase; distance:0; content:"&onlineid="; nocase; distance:0; fast_pattern; classtype:credential-theft; sid:2032696; rev:5; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_08_31, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing_07012016, tag Phishing, updated_at 2020_11_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPLojaFacil Remote Inclusion Attempt -- libs_ftp.php path_local"; flow:established,to_server; content:"/libs/ftp.php?"; http_uri; nocase; content:"path_local="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2615; reference:url,www.milw0rm.com/exploits/3875; reference:url,doc.emergingthreats.net/2003733; classtype:web-application-attack; sid:2003733; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Successful Craigslist Phish 2016-07-11"; flow:to_server,established; http.method; content:"POST"; http.host; content:!".craigslist.org"; endswith; http.request_body; content:"inputEmailHandle="; nocase; content:"|25|40"; distance:0; content:"&inputPassword="; nocase; distance:0; fast_pattern; classtype:credential-theft; sid:2032686; rev:6; metadata:attack_target Client_Endpoint, created_at 2016_07_11, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2020_11_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPmyGallery confdir parameter Remote File Inclusion"; flow:established,to_server; content:"GET "; depth:4; content:"/_conf/core/common-tpl-vars.php?"; http_uri; nocase; content:"confdir="; http_uri; nocase; pcre:"/confdir=\s*(ftps?|https?|php)\:\//Ui"; reference:url,milw0rm.com/exploits/7392; reference:bugtraq,32705; reference:url,doc.emergingthreats.net/2008962; classtype:web-application-attack; sid:2008962; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Apple Phishing Landing - Title over non SSL"; flow:established,to_client; http.header; content:!"X-Apple-I-Request-ID|3a|"; file.data; content:"Manage your Apple ID"; fast_pattern; nocase; classtype:social-engineering; sid:2024707; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_09_15, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPOutsourcing Zorum prod.php Remote Command Execution Attempt"; flow:to_server,established; content:"/prod.php?"; http_uri; nocase; pcre:"/(argv[1]=\|.+)/"; reference:bugtraq,14601; reference:url,doc.emergingthreats.net/2002314; classtype:web-application-attack; sid:2002314; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible CIBC Phishing Landing - Title over non SSL"; flow:established,to_client; http.header; content:!"Server|3a 20|ServerNoWhere"; file.data; content:"CIBC"; nocase; classtype:social-engineering; sid:2024797; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_10_03, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Minor, tag Phishing, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPSecurityAdmin Remote Inclusion Attempt -- logout.php PSA_PATH"; flow:established,to_server; content:"/include/logout.php?"; http_uri; nocase; content:"PSA_PATH="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2628; reference:url,www.securityfocus.com/bid/23801; reference:url,doc.emergingthreats.net/2003735; classtype:web-application-attack; sid:2003735; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Spy.Agent.OHT - AnunakAPT HTTP Checkin 1"; flow:established,to_server; urilen:>100; flowbits:set,ET.Anunanak.HTTP.1; content:"Accept|3a 20 2a 2f 2a 0d 0a 0d 0a|"; fast_pattern; http.user_agent; pcre:"/(?: MSIE |rv\x3a11)/"; http.method; content:"GET"; http.uri; pcre:"/^[a-zA-Z0-9=/&?\x2e-]+$/"; http.host; content:!".imodules.com"; http.header_names; content:"|0d 0a|Host|0d 0a|User-Agent|0d 0a|Accept|0d 0a 0d 0a|"; depth:30; endswith; reference:url,fox-it.com/en/files/2014/12/Anunak_APT-against-financial-institutions2.pdf; classtype:targeted-activity; sid:2020027; rev:7; metadata:created_at 2014_12_23, former_category MALWARE, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPStore Yahoo Answers id parameter SQL Injection"; flow:to_server,established; content:"GET "; depth:4; content:"/index.php?"; http_uri; nocase; content:"cmd=4"; http_uri; nocase; content:"id="; http_uri; nocase; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/UNION.+SELECT/Ui"; reference:url,secunia.com/advisories/32717/; reference:url,milw0rm.com/exploits/7131; reference:url,doc.emergingthreats.net/2008874; classtype:web-application-attack; sid:2008874; rev:4; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Ave Maria RAT CnC Domain in DNS Lookup (uknwn.linkpc .net)"; dns.query; content:"uknwn.linkpc.net"; nocase; bsize:16; reference:url,twitter.com/James_inthe_box/status/1293267162258272256?cn=ZmxleGlibGVfcmVjcw%3D%3D&refsrc=email; reference:url,app.any.run/tasks/49ba0acb-fd7a-47ec-9998-cacc6eb875d5/; classtype:command-and-control; sid:2030679; rev:2; metadata:attack_target Client_Endpoint, created_at 2020_08_12, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPNuke general XSS attempt"; flow: to_server,established; content:"/modules.php?"; http_uri; content:"name="; http_uri; content:"SCRIPT"; http_uri; nocase; pcre:"/<\s*SCRIPT\s*>/iU"; reference:url,www.waraxe.us/?modname=sa&id=030; reference:url,doc.emergingthreats.net/2001218; classtype:web-application-attack; sid:2001218; rev:12; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Successful Facebook Phish 2019-04-12"; flow:established,to_server; http.method; content:"POST"; http.host; content:!".facebook.com"; endswith; content:!".messenger.com"; endswith; http.request_body; content:"jazoest="; depth:8; nocase; fast_pattern; content:"&lsd="; nocase; distance:0; content:"&email="; nocase; distance:0; content:"|25|40"; distance:0; content:"&pass="; nocase; distance:0; classtype:credential-theft; sid:2029672; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2019_04_12, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2020_11_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHP PHPNuke Remote File Inclusion Attempt"; flow:established,to_server; content:"/iframe.php"; http_uri; nocase; content:"file="; http_uri; nocase; pcre:"/file=\s*(ftps?|https?|php)\:\//Ui"; reference:url,www.zone-h.org/en/advisories/read/id=8694/; reference:url,doc.emergingthreats.net/2002800; classtype:web-application-attack; sid:2002800; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE GratefulPOS Covert DNS CnC Initial Checkin"; dns.query; content:".grp"; within:12; content:"ping.adm."; within:15; fast_pattern; isdataat:30,relative; pcre:"/^[a-f0-9]{8}\.grp[0-9]*\.ping\.adm\.(?:[a-f0-9]+\.){2,}/"; reference:md5,67a53bd24ee8499fed79c8c368e05f7a; reference:url,community.rsa.com/community/products/netwitness/blog/2017/12/08/gratefulpos-credit-card-stealing-malware-just-in-time-for-the-shopping-season; classtype:command-and-control; sid:2025144; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2017_12_11, deployment Perimeter, former_category MALWARE, malware_family Grateful_POS, performance_impact Moderate, signature_severity Major, updated_at 2020_11_17;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHP Web Calendar Remote File Inclusion Attempt"; flow:established,to_server; content:"/send_reminders.php"; http_uri; nocase; pcre:"/includedir=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,14651; reference:cve,2005-2717; reference:url,doc.emergingthreats.net/2002898; classtype:web-application-attack; sid:2002898; rev:8; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Base64 Obfuscated Phishing Landing 2015-11-30"; flow:established,from_server; http.stat_code; content:"200"; http.header; content:"Content-Encoding|3a 20|gzip"; http.content_type; content:"text/html"; startswith; file.data; content:" $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PHPtree Remote Inclusion Attempt -- cms2.php s_dir"; flow:established,to_server; content:"/plugin/HP_DEV/cms2.php?"; http_uri; nocase; content:"s_dir="; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2573; reference:url,www.milw0rm.com/exploits/3860; reference:url,doc.emergingthreats.net/2003693; classtype:web-application-attack; sid:2003693; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Generic Google Firebase Hosted Phishing Landing"; flow:established,to_server; http.uri; content:"/v0/b/"; depth:6; content:".appspot.com/"; distance:0; fast_pattern; pcre:"/^\/v0\/b\/(?:send|hit|few|lik|mtn|eli|rfda)\d.*\.appspot\.com\//i"; http.host; content:"firebasestorage.googleapis.com"; classtype:social-engineering; sid:2031211; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_11_18, deployment Perimeter, signature_severity Minor, tag Phishing, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PmWiki Globals Variables Overwrite Attempt"; flow:to_server,established; content:"/pmwiki.php"; http_uri; nocase; content:"GLOBALS[FarmD]="; nocase; pcre:"/GLOBALS\x5bFarmD\x5d\x3d/i"; reference:cve,CVE-2006-0479; reference:bugtraq,16421; reference:nessus,20891; reference:url,doc.emergingthreats.net/2002837; classtype:web-application-attack; sid:2002837; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/AutoIt.NU Miner Dropper CnC Checkin"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/?id="; depth:5; content:"&pt="; within:20; fast_pattern; http.user_agent; pcre:"/^[a-f0-9]{32}$/i"; http.request_body; pcre:"/^(?:[A-Z0-9+/]{4})*(?:[A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$/i"; http.content_type; content:"application/x-www-form-urlencoded"; http.header_names; content:"Accept"; content:!"Accept-"; content:!"Cache"; content:!"Referer"; reference:md5,cd7a49513771efd9d4de873956ef8af5; classtype:command-and-control; sid:2025598; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_06_21, deployment Perimeter, former_category MALWARE, malware_family Autoit_NU, performance_impact Low, signature_severity Major, tag Dropper, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PNphpBB2 SQL Injection Attempt -- index.php c SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"c="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/SELECT.+FROM/Ui"; reference:cve,CVE-2007-3052; reference:url,www.milw0rm.com/exploits/4026; reference:url,doc.emergingthreats.net/2004606; classtype:web-application-attack; sid:2004606; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake 404 With Hidden Login Form"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"404 Not Found"; fast_pattern; depth:28; content:"background-color|3a 23|fff|3b|"; distance:0; content:""; distance:0; content:"input type=password"; within:50; classtype:trojan-activity; sid:2025872; rev:3; metadata:attack_target Client_and_Server, created_at 2018_07_19, deployment Perimeter, former_category CURRENT_EVENTS, performance_impact Low, signature_severity Major, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PNphpBB2 SQL Injection Attempt -- index.php c UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"c="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/UNION\s+SELECT/Ui"; reference:cve,CVE-2007-3052; reference:url,www.milw0rm.com/exploits/4026; reference:url,doc.emergingthreats.net/2004607; classtype:web-application-attack; sid:2004607; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE [PTsecurity] Win32/Ramnit Stage 0 Communicating with CnC"; flow:established,to_client; http.stat_code; content:"200"; file.data; content:"WAIT|20|"; depth:15; content:"CERT|20|"; fast_pattern; within:20; pcre:"/^(?:[A-Z0-9+/]{4})*(?:[A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})/Ri"; reference:md5,20148e48668cb5e0b22d437ee0443cfe; reference:url,research.checkpoint.com/ramnits-network-proxy-servers/; classtype:command-and-control; sid:2026113; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_09_14, deployment Perimeter, former_category MALWARE, malware_family Ramnit, performance_impact Low, signature_severity Major, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PNphpBB2 SQL Injection Attempt -- index.php c INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"c="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/INSERT.+INTO/Ui"; reference:cve,CVE-2007-3052; reference:url,www.milw0rm.com/exploits/4026; reference:url,doc.emergingthreats.net/2004608; classtype:web-application-attack; sid:2004608; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Possibly Malicious VBS Writing to Persistence Registry Location"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"on|20|error|20|resume|20|next"; nocase; content:".regwrite|20 22|"; distance:0; content:"|5c|software|5c|microsoft|5c|windows|5c|currentversion|5c|run"; within:80; fast_pattern; reference:md5,cac1aedbcb417dcba511db5caae4b8c0; classtype:trojan-activity; sid:2026427; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2018_09_28, deployment Perimeter, former_category INFO, performance_impact Low, signature_severity Major, tag VBS, tag Persistence, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PNphpBB2 SQL Injection Attempt -- index.php c DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"c="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/DELETE.+FROM/Ui"; reference:cve,CVE-2007-3052; reference:url,www.milw0rm.com/exploits/4026; reference:url,doc.emergingthreats.net/2004609; classtype:web-application-attack; sid:2004609; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Observed Malicious SSL Cert (DonotGroup CnC)"; flow:from_server,established; tls.cert_subject; content:"CN=pvtchat.live"; nocase; fast_pattern; endswith; tls.cert_issuer; content:"C=US, O=Let's Encrypt, CN=Let's Encrypt Authority X3"; classtype:domain-c2; sid:2031215; rev:1; metadata:attack_target Client_and_Server, created_at 2020_11_18, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, tag DonotGroup, updated_at 2020_11_18, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PNphpBB2 SQL Injection Attempt -- index.php c ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"c="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-3052; reference:url,www.milw0rm.com/exploits/4026; reference:url,doc.emergingthreats.net/2004610; classtype:web-application-attack; sid:2004610; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Generic Personalized Google Firebase Hosted Phishing Landing"; flow:established,to_server; http.uri; content:"/v0/b/"; depth:6; content:".appspot.com/"; distance:0; fast_pattern; content:"email="; distance:0; content:"@"; distance:0; http.host; content:"firebasestorage.googleapis.com"; classtype:social-engineering; sid:2031212; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_11_18, deployment Perimeter, signature_severity Minor, tag Phishing, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PNphpBB2 SQL Injection Attempt -- index.php c UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"c="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/UPDATE.+SET/Ui"; reference:cve,CVE-2007-3052; reference:url,www.milw0rm.com/exploits/4026; reference:url,doc.emergingthreats.net/2004611; classtype:web-application-attack; sid:2004611; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Generic Personalized Google Firebase Hosted Phishing Landing"; flow:established,to_server; http.uri; content:"/v0/b/"; depth:6; content:".appspot.com/"; distance:0; fast_pattern; content:"#"; distance:0; content:"@"; distance:0; http.host; content:"firebasestorage.googleapis.com"; classtype:social-engineering; sid:2031213; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_11_18, deployment Perimeter, signature_severity Minor, tag Phishing, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Particle Gallery XSS Attempt -- search.php order"; flow:established,to_server; content:"/search.php?"; http_uri; nocase; content:"order="; http_uri; nocase; content:"script"; http_uri; nocase; pcre:"/.*?.*<.+\/script>?/iU"; reference:cve,CVE-2007-2962; reference:url,www.securityfocus.com/archive/1/archive/1/469985/100/0/threaded; reference:url,doc.emergingthreats.net/2004582; classtype:web-application-attack; sid:2004582; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Generic Personalized Google Firebase Hosted Phishing Landing"; flow:established,to_server; http.uri; content:"/v0/b/"; depth:6; content:".appspot.com/"; distance:0; fast_pattern; content:"login="; distance:0; content:"@"; distance:0; http.host; content:"firebasestorage.googleapis.com"; classtype:social-engineering; sid:2031214; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2020_11_18, deployment Perimeter, signature_severity Minor, tag Phishing, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt - Headerfile.php System"; flow:established,to_server; content:"/blocks/headerfile.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003660; classtype:web-application-attack; sid:2003660; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Inbound PowerShell Executing Base64 Decoded VBE from Temp 2018-11-29"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"|3a 3a|FromBase64String"; nocase; content:"-Path|20|C|3a 5c|windows|5c|temp|5c|"; distance:0; nocase; content:"start-process|20|c|3a 5c|windows|5c|system32|5c|wscript.exe|20|-ArgumentList|20 22|c|3a 5c|windows|5c|temp|5c|"; distance:0; nocase; fast_pattern; content:".vbe|22|"; within:20; reference:url,www.clearskysec.com/muddywater-operations-in-lebanon-and-oman/; classtype:trojan-activity; sid:2026677; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_11_29, deployment Perimeter, former_category CURRENT_EVENTS, performance_impact Low, signature_severity Major, tag PowerShell, tag Obfuscated, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- latest_files.php System"; flow:established,to_server; content:"/files/blocks/latest_files.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003661; classtype:web-application-attack; sid:2003661; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE OSX/LamePyre Screenshot Upload"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php?uid="; pcre:"/^[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}$/Ri"; http.user_agent; content:"curl/"; depth:5; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name=|22|scr|22 3b 20|filename=|22|"; fast_pattern; content:".png|22 0d 0a|"; within:30; http.header_names; content:!"Referer"; reference:md5,1dc949fbb35b816b3046731d8db98a3d; reference:url,objective-see.com/blog/blog_0x3C.html; classtype:trojan-activity; sid:2026823; rev:3; metadata:affected_product Mac_OSX, attack_target Client_Endpoint, created_at 2019_01_17, deployment Perimeter, former_category TROJAN, malware_family LamePyre, performance_impact Moderate, signature_severity Major, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- latest_posts.php System"; flow:established,to_server; content:"/forums/blocks/latest_posts.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003662; classtype:web-application-attack; sid:2003662; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE MSIL/KeyRedirEx Banker Receiving Redirect/Inject List"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"REDIR|3b|"; depth:15; content:"|7c 2d 7c|http"; within:50; fast_pattern; reference:md5,ec33cc6cb625197587410840bce5983b; reference:url,otx.alienvault.com/pulse/5bd339328f32ad2db2e03f1a; classtype:trojan-activity; sid:2026563; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_10_29, deployment Perimeter, former_category TROJAN, malware_family KeyRedirEx, performance_impact Low, signature_severity Major, tag Banker, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- groups_headerfile.php System"; flow:established,to_server; content:"/groups/headerfile.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003663; classtype:web-application-attack; sid:2003663; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Linksys E1500/E2500 apply.cgi RCE Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/apply.cgi"; depth:10; http.request_body; content:"submit_button="; depth:14; content:"&submit_type=start_ping"; distance:0; fast_pattern; content:"&ping_size="; distance:0; content:"|3b|"; within:30; reference:url,www.exploit-db.com/exploits/24936; classtype:attempted-user; sid:2027099; rev:3; metadata:attack_target IoT, created_at 2019_03_19, deployment Perimeter, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- filters_headerfile.php System"; flow:established,to_server; content:"/filters/headerfile.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003664; classtype:web-application-attack; sid:2003664; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (cookies.txt) M2"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name="; content:".zip|22 0d 0a|"; within:150; content:"|0d 0a|PK"; distance:0; content:"cookies.txt"; distance:26; within:50; nocase; fast_pattern; classtype:trojan-activity; sid:2027104; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag Stealer, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- links.php System"; flow:established,to_server; content:"/links/blocks/links.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003665; classtype:web-application-attack; sid:2003665; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name="; content:".zip|22 0d 0a|"; within:150; content:"|0d 0a|PK"; distance:0; content:"passwords.txt"; distance:26; within:50; nocase; fast_pattern; classtype:trojan-activity; sid:2027106; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag Stealer, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- menu_headerfile.php System"; flow:established,to_server; content:"/menu/headerfile.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003666; classtype:web-application-attack; sid:2003666; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (wallet.dat) M2"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name="; content:".zip|22 0d 0a|"; within:150; content:"|0d 0a|PK"; distance:0; content:"wallet.dat"; distance:26; within:50; nocase; fast_pattern; classtype:trojan-activity; sid:2027115; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_25, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag Stealer, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- latest_news.php System"; flow:established,to_server; content:"/news/blocks/latest_news.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003667; classtype:web-application-attack; sid:2003667; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (screenshot.) M2"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name="; content:".zip|22 0d 0a|"; within:150; content:"|0d 0a|PK"; distance:0; content:"screenshot."; distance:26; within:300; nocase; fast_pattern; pcre:"/^(?:(?:jp|pn)g|bmp)/Ri"; classtype:trojan-activity; sid:2027108; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_03_20, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag Stealer, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- settings_headerfile.php System"; flow:established,to_server; content:"/settings/headerfile.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003668; classtype:web-application-attack; sid:2003668; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (cookie.txt) M2"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name="; content:".zip|22 0d 0a|"; within:150; content:"|0d 0a|PK"; distance:0; content:"cookie.txt"; distance:26; within:50; nocase; fast_pattern; classtype:trojan-activity; sid:2027270; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2019_04_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag T1005, tag Data_from_local_system, tag Collection, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Persism CMS Remote Inclusion Attempt -- users_headerfile.php System"; flow:established,to_server; content:"/modules/users/headerfile.php?"; http_uri; nocase; content:"system["; http_uri; nocase; pcre:"/=\s*(https?|ftps?|php)\:\//Ui"; reference:cve,CVE-2007-2545; reference:url,www.milw0rm.com/exploits/3853; reference:url,doc.emergingthreats.net/2003681; classtype:web-application-attack; sid:2003681; rev:7; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (ccdata.txt) M2"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name="; content:".zip|22 0d 0a|"; within:150; content:"|0d 0a|PK"; distance:0; content:"ccdata.txt"; distance:26; within:50; nocase; fast_pattern; classtype:trojan-activity; sid:2027272; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2019_04_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag T1005, tag Data_from_local_system, tag Collection, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Phil-a-Form SQL Injection Attempt -- index.php form_id SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"form_id="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+SELECT.+FROM/Ui"; reference:cve,CVE-2007-2933; reference:url,www.milw0rm.com/exploits/4003; reference:url,doc.emergingthreats.net/2004089; classtype:web-application-attack; sid:2004089; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (google_chrome_default_) M2"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name="; content:".zip|22 0d 0a|"; within:150; content:"|0d 0a|PK"; distance:0; content:"google_chrome_default_"; distance:26; within:100; nocase; fast_pattern; pcre:"/^(?:logins|c(?:cdata|ookie))/Ri"; classtype:trojan-activity; sid:2027277; rev:3; metadata:attack_target Client_and_Server, created_at 2019_04_24, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag T1002, tag data_compressed, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Phil-a-Form SQL Injection Attempt -- index.php form_id UNION SELECT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"form_id="; http_uri; nocase; content:"UNION"; http_uri; nocase; pcre:"/.+UNION\s+SELECT/Ui"; reference:cve,CVE-2007-2933; reference:url,www.milw0rm.com/exploits/4003; reference:url,doc.emergingthreats.net/2004090; classtype:web-application-attack; sid:2004090; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Suspicious Zipped Filename in Outbound POST Request (Mozilla_Firefox_Cookies) M2"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name="; content:".zip|22 0d 0a|"; within:150; content:"|0d 0a|PK"; distance:0; content:"Mozilla_Firefox_Cookies"; distance:26; within:100; nocase; fast_pattern; classtype:trojan-activity; sid:2027279; rev:3; metadata:attack_target Client_and_Server, created_at 2019_04_24, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag T1002, tag data_compressed, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Phil-a-Form SQL Injection Attempt -- index.php form_id INSERT"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"form_id="; http_uri; nocase; content:"INSERT"; http_uri; nocase; pcre:"/.+INSERT.+INTO/Ui"; reference:cve,CVE-2007-2933; reference:url,www.milw0rm.com/exploits/4003; reference:url,doc.emergingthreats.net/2004091; classtype:web-application-attack; sid:2004091; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Wide HTA with PowerShell Execution Inbound"; flow:established,from_server; http.stat_code; content:"200"; http.content_type; content:"application/hta"; file.data; content:"W|00|s|00|c|00|r|00|i|00|p|00|t"; nocase; content:"S|00|h|00|e|00|l|00|l|00|"; distance:0; nocase; content:"p|00|o|00|w|00|e|00|r|00|s|00|h|00|e|00|l|00|l|00|"; distance:0; nocase; fast_pattern; content:"h|00|i|00|d|00|d|00|e|00|n"; within:200; reference:md5,e5a9c413812b5217ef0da962668e9651; classtype:trojan-activity; sid:2027335; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_05_08, deployment Perimeter, former_category CURRENT_EVENTS, performance_impact Low, signature_severity Major, tag PowerShell, tag T1086, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Phil-a-Form SQL Injection Attempt -- index.php form_id DELETE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"form_id="; http_uri; nocase; content:"DELETE"; http_uri; nocase; pcre:"/.+DELETE.+FROM/Ui"; reference:cve,CVE-2007-2933; reference:url,www.milw0rm.com/exploits/4003; reference:url,doc.emergingthreats.net/2004092; classtype:web-application-attack; sid:2004092; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE CSharp SMB Scanner Assembly in PowerShell Inbound M1"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"=|20|ReadSmbResponse|28|"; content:"|20|==|20|0x72|20|&&|20|"; within:400; fast_pattern; content:"|20|==|20|00"; within:400; reference:md5,e5a9c413812b5217ef0da962668e9651; classtype:trojan-activity; sid:2027336; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_05_08, deployment Perimeter, deployment Internal, former_category CURRENT_EVENTS, performance_impact Low, signature_severity Major, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Phil-a-Form SQL Injection Attempt -- index.php form_id ASCII"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"form_id="; http_uri; nocase; content:"SELECT"; http_uri; nocase; pcre:"/.+ASCII\(.+SELECT/Ui"; reference:cve,CVE-2007-2933; reference:url,www.milw0rm.com/exploits/4003; reference:url,doc.emergingthreats.net/2004093; classtype:web-application-attack; sid:2004093; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE CSharp SMB Scanner Assembly in PowerShell Inbound M2"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"|20|=|20|new|20|byte|5b 5d|"; content:"0xff,0x53,0x4d,0x42"; within:300; fast_pattern; content:"0x01,0x28"; distance:0; content:"0x02,0x4c,0x41,0x4e"; reference:md5,e5a9c413812b5217ef0da962668e9651; classtype:trojan-activity; sid:2027337; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_05_08, deployment Perimeter, deployment Internal, former_category CURRENT_EVENTS, performance_impact Low, signature_severity Major, tag PowerShell, tag T1086, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Phil-a-Form SQL Injection Attempt -- index.php form_id UPDATE"; flow:established,to_server; content:"/index.php?"; http_uri; nocase; content:"form_id="; http_uri; nocase; content:"UPDATE"; http_uri; nocase; pcre:"/.+UPDATE.+SET/Ui"; reference:cve,CVE-2007-2933; reference:url,www.milw0rm.com/exploits/4003; reference:url,doc.emergingthreats.net/2004094; classtype:web-application-attack; sid:2004094; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY Inbound PowerShell Capable of Enumerating Internal Network via WMI"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"|20|Win32_NetworkAdapterConfiguration"; nocase; content:"_.IPEnabled|20|-ne|20|$null"; within:200; nocase; content:"_.DefaultIPGateway|20|-ne|20|$null"; within:200; nocase; content:"select|20|IPAddress"; within:200; nocase; fast_pattern; reference:md5,e5a9c413812b5217ef0da962668e9651; classtype:trojan-activity; sid:2027338; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, created_at 2019_05_08, deployment Perimeter, deployment Internal, former_category POLICY, performance_impact Low, signature_severity Major, tag PowerShell, tag T1086, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS PhpBlock basicfogfactory.class.php PATH_TO_CODE Parameter Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/basicfogfactory.class.php?"; http_uri; nocase; content:"PATH_TO_CODE="; http_uri; nocase; pcre:"/PATH_TO_CODE=\s*(https?|ftps?|php)\:\//Ui"; reference:bugtraq,28588; reference:url,milw0rm.com/exploits/5348; reference:url,doc.emergingthreats.net/2009415; classtype:web-application-attack; sid:2009415; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER China Chopper WebShell Observed Outbound"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"<%@|20|Page|20|Language=|22|Jscript|22|%>"; within:50; classtype:trojan-activity; sid:2027341; rev:4; metadata:created_at 2019_05_09, former_category WEB_SERVER, performance_impact Low, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS phpFan init.php Remote File Inclusion"; flow:to_server,established; content:"GET "; depth:4; content:"/includes/init.php?"; http_uri; nocase; content:"includepath="; http_uri; nocase; pcre:"/includepath=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,32335; reference:url,milw0rm.com/exploits/7143; reference:url,doc.emergingthreats.net/2008871; classtype:web-application-attack; sid:2008871; rev:4; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Unknown VBScript Loader with Encoded PowerShell Execution Inbound"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"powershell"; nocase; content:"-e"; within:40; nocase; content:".Get|28 22|Win32_ProcessStartup|22 29|"; distance:0; nocase; fast_pattern; content:"Process.Create|28|"; distance:0; nocase; reference:md5,f17e15a9d28a85bd41d74233859d4df4; classtype:trojan-activity; sid:2027374; rev:4; metadata:created_at 2019_05_23, former_category CURRENT_EVENTS, tag Loader, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Pie RSS module lib parameter remote file inclusion"; flow:established,to_server; content:"GET "; depth:4; content:"/lib/action/rss.php?"; http_uri; nocase; content:"lib="; http_uri; nocase; pcre:"/lib=\s*(ftps?|https?|php)\:\//Ui"; reference:bugtraq,32465; reference:url,milw0rm.com/exploits/7225; reference:url,doc.emergingthreats.net/2008899; classtype:web-application-attack; sid:2008899; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $HTTP_SERVERS any -> $EXTERNAL_NET any (msg:"ET WEB_SERVER BlackSquid JSP Webshell Outbound"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"<|25 25|java.io.InputStream|20|"; depth:25; content:"Runtime.getRunetime|28 29|.exec|28|request"; within:50; content:".getInputStream|28 29 3b|int|20|"; distance:0; fast_pattern; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/blacksquid-slithers-into-servers-and-drives-with-8-notorious-exploits-to-drop-xmrig-miner/; classtype:attempted-admin; sid:2027433; rev:3; metadata:attack_target Web_Server, created_at 2019_06_04, deployment Perimeter, former_category WEB_SERVER, performance_impact Low, signature_severity Major, updated_at 2020_11_18;)
+#alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Piranha default passwd attempt"; flow:to_server,established; content:"/piranha/secure/control.php3"; http_uri; content:"Authorization\: Basic cGlyYW5oYTp"; reference:bugtraq,1148; reference:cve,2000-0248; reference:nessus,10381; reference:url,doc.emergingthreats.net/2002331; classtype:attempted-recon; sid:2002331; rev:6; metadata:created_at 2010_07_30, updated_at 2019_08_22;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT IE Scripting Engine Memory Corruption Vulnerability M1 (CVE-2019-0752)"; flow:established,from_server; http.stat_code; content:"200"; http.content_type; content:"text/html"; startswith; file.data; content:""; nocase; distance:100; classtype:credential-theft; sid:2035294; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_23, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_24;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- my_progress.php course DELETE"; flow:established,to_server; http.uri; content:"/main/auth/my_progress.php?"; nocase; content:"course="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-2902; reference:url,www.milw0rm.com/exploits/3974; reference:url,doc.emergingthreats.net/2004068; classtype:web-application-attack; sid:2004068; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT TOTOLINK Realtek SDK RCE (CVE-2019-19824)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/boafrm/formSysCmd"; fast_pattern; http.request_body; content:"Run|2b|Command|26|sysCmd|3d|"; nocase; reference:cve,2019-19824; classtype:attempted-admin; sid:2035282; rev:2; metadata:attack_target Server, created_at 2022_02_23, cve CVE_2019_19824, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_02_23;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- my_progress.php course ASCII"; flow:established,to_server; http.uri; content:"/main/auth/my_progress.php?"; nocase; content:"course="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-2902; reference:url,www.milw0rm.com/exploits/3974; reference:url,doc.emergingthreats.net/2004069; classtype:web-application-attack; sid:2004069; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gamaredon APT Related Activity (GET)"; flow:established,to_server; http.request_line; content:"GET /chd.php HTTP/1.1"; fast_pattern; http.header_names; content:!"Referer"; http.user_agent; content:!"Linux"; content:!"Android"; http.host; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/"; reference:md5,0981f1145c1cec6a5de51c7d585affe3; reference:md5,bcbcc87f61fad5d558b25c1200b2c34d; reference:md5,ab8a866434329d643273b3dab0473bbc; classtype:trojan-activity; sid:2035283; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_02_24, deployment Perimeter, former_category MALWARE, malware_family Gamaredon, signature_severity Major, updated_at 2022_02_24;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Dokeos SQL Injection Attempt -- my_progress.php course UPDATE"; flow:established,to_server; http.uri; content:"/main/auth/my_progress.php?"; nocase; content:"course="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-2902; reference:url,www.milw0rm.com/exploits/3974; reference:url,doc.emergingthreats.net/2004070; classtype:web-application-attack; sid:2004070; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert tls $HOME_NET any -> 195.22.26.192/26 443 (msg:"ET INFO invalid.cab domain in SNI"; flow:established,to_server; tls.sni; content:"invalid.cab"; fast_pattern; flowbits:set,ET.invalid.cab; flowbits:noalert; classtype:misc-activity; sid:2020888; rev:4; metadata:created_at 2015_04_10, former_category INFO, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Dragon Business Directory SQL Injection Attempt -- bus_details.asp ID SELECT"; flow:established,to_server; http.uri; content:"/bus_details.asp?"; nocase; content:"ID="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6804; reference:url,www.milw0rm.com/exploits/2992; reference:url,doc.emergingthreats.net/2006141; classtype:web-application-attack; sid:2006141; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY SSL Certificate IRC GEEKS Likely Encrypted IRC or CnC"; flow:established,to_client; tls.cert_subject; content:"O=IRC geeks"; fast_pattern; classtype:command-and-control; sid:2019387; rev:3; metadata:attack_target Client_Endpoint, created_at 2014_10_10, deployment Perimeter, former_category POLICY, signature_severity Informational, tag SSL_Malicious_Cert, updated_at 2022_03_23;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Dragon Business Directory SQL Injection Attempt -- bus_details.asp ID UNION SELECT"; flow:established,to_server; http.uri; content:"/bus_details.asp?"; nocase; content:"ID="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6804; reference:url,www.milw0rm.com/exploits/2992; reference:url,doc.emergingthreats.net/2006142; classtype:web-application-attack; sid:2006142; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed URL Shortening Service Domain in TLS SNI (litby .us)"; flow:established,to_server; tls.sni; content:"litby.us"; bsize:8; fast_pattern; classtype:bad-unknown; sid:2035284; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_02_24, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_02_24;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Dragon Business Directory SQL Injection Attempt -- bus_details.asp ID INSERT"; flow:established,to_server; http.uri; content:"/bus_details.asp?"; nocase; content:"ID="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6804; reference:url,www.milw0rm.com/exploits/2992; reference:url,doc.emergingthreats.net/2006143; classtype:web-application-attack; sid:2006143; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gamaredon APT Related Activity (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/get.php"; bsize:8; fast_pattern; http.host; pcre:"/^[0-9]{6,10}\./"; http.header_names; content:!"Referer"; http.user_agent; content:!"Linux"; content:!"Android"; reference:md5,2dd5a4237122e73027404a91276f0235; reference:md5,9c8f6b38035c72421e1c71d2bb21ced9; reference:md5,860137d224440fd7c1cb3652199dcd58; classtype:trojan-activity; sid:2035288; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_02_25, deployment Perimeter, former_category MALWARE, malware_family Gamaredon, signature_severity Major, updated_at 2022_02_25;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Dragon Business Directory SQL Injection Attempt -- bus_details.asp ID DELETE"; flow:established,to_server; http.uri; content:"/bus_details.asp?"; nocase; content:"ID="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6804; reference:url,www.milw0rm.com/exploits/2992; reference:url,doc.emergingthreats.net/2006144; classtype:web-application-attack; sid:2006144; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gamaredon APT Related Activity (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/junk.flv?"; startswith; fast_pattern; http.user_agent; content:"junk/"; http.header_names; content:!"Referer"; reference:md5,61c4a0ab7b156744fcc24fb0813fb9b3; reference:url,github.com/stamparm/maltrail/blob/master/trails/static/malware/apt_gamaredon.txt; classtype:trojan-activity; sid:2035289; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_02_25, deployment Perimeter, former_category MALWARE, malware_family Gamaredon, signature_severity Major, updated_at 2022_04_18;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Dragon Business Directory SQL Injection Attempt -- bus_details.asp ID UPDATE"; flow:established,to_server; http.uri; content:"/bus_details.asp?"; nocase; content:"ID="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6804; reference:url,www.milw0rm.com/exploits/2992; reference:url,doc.emergingthreats.net/2006146; classtype:web-application-attack; sid:2006146; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Buhtrap SourSnack Domain in DNS Lookup (widget .forum-pokemon .com)"; dns.query; content:".widget.forum-pokemon.com"; nocase; endswith; reference:url,cert.gov.ua/article/37246; reference:md5,4ac6e6c6668cac064b16cf786e3cab6f; classtype:domain-c2; sid:2035286; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_25, deployment Perimeter, deployment Internal, former_category MALWARE, malware_family SourSnack, performance_impact Low, signature_severity Major, tag Buhtrap, updated_at 2022_02_25;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Dros core.write_compiled_include.php smarty Remote File Inclusion Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/include/libs/internals/core.write_compiled_include.php?"; nocase; content:"smarty="; nocase; pcre:"/smarty\s*=\s*(https?|ftps?|php)\:\//i"; reference:url,www.exploit-db.com/exploits/10682; reference:url,doc.emergingthreats.net/2010707; classtype:web-application-attack; sid:2010707; rev:6; metadata:created_at 2010_07_30, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Malicious lnk Downloader Activity (GET)"; flow:established,to_server; http.request_line; content:"GET /joking.html HTTP/1.1"; fast_pattern; http.header_names; content:!"Referer"; http.user_agent; content:!"Linux"; content:!"Android"; http.host; content:".ru"; endswith; reference:md5,d6b182c825d961154b5415de1a061ae0; classtype:trojan-activity; sid:2035290; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_02_25, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_04_18;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Dros core.process_compiled_include.php smarty Remote File Inclusion Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/include/libs/internals/core.process_compiled_include.php?"; nocase; content:"smarty="; nocase; pcre:"/smarty\s*=\s*(https?|ftps?|php)\:\//i"; reference:url,www.exploit-db.com/exploits/10682; reference:url,doc.emergingthreats.net/2010708; classtype:web-application-attack; sid:2010708; rev:6; metadata:created_at 2010_07_30, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (id .bigmir .space)"; dns.query; dotprefix; content:".id.bigmir.space"; nocase; endswith; reference:url,www.bleepingcomputer.com/news/security/ukraine-links-phishing-targeting-military-to-belarusian-hackers/; classtype:trojan-activity; sid:2035295; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_25, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_02_25;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Dros function.config_load.php _compile_file Remote File Inclusion Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/include/libs/plugins/function.config_load.php?"; nocase; content:"_compile_file="; nocase; pcre:"/_compile_file\s*=\s*(https?|ftps?|php)\:\//i"; reference:url,www.exploit-db.com/exploits/10682; reference:url,doc.emergingthreats.net/2010709; classtype:web-application-attack; sid:2010709; rev:6; metadata:created_at 2010_07_30, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (aplikacje .ron-mil .space)"; dns.query; dotprefix; content:".aplikacje.ron-mil.space"; nocase; endswith; reference:url,www.bleepingcomputer.com/news/security/ukraine-links-phishing-targeting-military-to-belarusian-hackers/; classtype:trojan-activity; sid:2035296; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_25, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_02_25;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS fystyq Duyuru Scripti SQL Injection Attempt -- goster.asp id SELECT"; flow:established,to_server; http.uri; content:"/goster.asp?"; nocase; content:"id="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-1422; reference:url,www.securityfocus.com/bid/22910; reference:url,doc.emergingthreats.net/2004385; classtype:web-application-attack; sid:2004385; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (i .ua-passport .space)"; dns.query; dotprefix; content:".i.ua-passport.space"; nocase; endswith; reference:url,www.bleepingcomputer.com/news/security/ukraine-links-phishing-targeting-military-to-belarusian-hackers/; classtype:trojan-activity; sid:2035297; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_25, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_02_25;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS fystyq Duyuru Scripti SQL Injection Attempt -- goster.asp id INSERT"; flow:established,to_server; http.uri; content:"/goster.asp?"; nocase; content:"id="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2007-1422; reference:url,www.securityfocus.com/bid/22910; reference:url,doc.emergingthreats.net/2004387; classtype:web-application-attack; sid:2004387; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (akademia-mil .space)"; dns.query; dotprefix; content:".akademia-mil.space"; nocase; endswith; reference:url,www.bleepingcomputer.com/news/security/ukraine-links-phishing-targeting-military-to-belarusian-hackers/; classtype:trojan-activity; sid:2035298; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_25, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_02_25;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS fystyq Duyuru Scripti SQL Injection Attempt -- goster.asp id DELETE"; flow:established,to_server; http.uri; content:"/goster.asp?"; nocase; content:"id="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-1422; reference:url,www.securityfocus.com/bid/22910; reference:url,doc.emergingthreats.net/2004388; classtype:web-application-attack; sid:2004388; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (akademia-mil .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".akademia-mil.space"; endswith; fast_pattern; reference:url,www.bleepingcomputer.com/news/security/ukraine-links-phishing-targeting-military-to-belarusian-hackers/; classtype:trojan-activity; sid:2035299; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_25, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS fystyq Duyuru Scripti SQL Injection Attempt -- goster.asp id ASCII"; flow:established,to_server; http.uri; content:"/goster.asp?"; nocase; content:"id="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-1422; reference:url,www.securityfocus.com/bid/22910; reference:url,doc.emergingthreats.net/2004389; classtype:web-application-attack; sid:2004389; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (aplikacje .ron-mil .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".aplikacje.ron-mil.space"; endswith; fast_pattern; reference:url,www.bleepingcomputer.com/news/security/ukraine-links-phishing-targeting-military-to-belarusian-hackers/; classtype:trojan-activity; sid:2035300; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_25, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS fystyq Duyuru Scripti SQL Injection Attempt -- goster.asp id UPDATE"; flow:established,to_server; http.uri; content:"/goster.asp?"; nocase; content:"id="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-1422; reference:url,www.securityfocus.com/bid/22910; reference:url,doc.emergingthreats.net/2004390; classtype:web-application-attack; sid:2004390; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (id .bigmir .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".id.bigmir.space"; endswith; fast_pattern; reference:url,www.bleepingcomputer.com/news/security/ukraine-links-phishing-targeting-military-to-belarusian-hackers/; classtype:trojan-activity; sid:2035301; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_25, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp iFile SELECT"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iFile="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6367; reference:url,www.securityfocus.com/bid/21405; reference:url,doc.emergingthreats.net/2006687; classtype:web-application-attack; sid:2006687; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (i .ua-passport .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".i.ua-passport.space"; endswith; fast_pattern; reference:url,www.bleepingcomputer.com/news/security/ukraine-links-phishing-targeting-military-to-belarusian-hackers/; classtype:trojan-activity; sid:2035302; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_25, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp iFile UNION SELECT"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iFile="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6367; reference:url,www.securityfocus.com/bid/21405; reference:url,doc.emergingthreats.net/2006688; classtype:web-application-attack; sid:2006688; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Malicious Downloader Activity (GET)"; flow:established,to_server; http.request_line; content:"GET /joking.html HTTP/1.1"; fast_pattern; http.header_names; content:!"Referer"; http.user_agent; content:!"Linux"; content:!"Android"; http.host; content:".ru"; endswith; reference:md5,d6b182c825d961154b5415de1a061ae0; classtype:trojan-activity; sid:2035291; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_02_25, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_04_18;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp iFile INSERT"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iFile="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6367; reference:url,www.securityfocus.com/bid/21405; reference:url,doc.emergingthreats.net/2006689; classtype:web-application-attack; sid:2006689; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspected PlugX Checkin Activity (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/^\/[a-zA-z]{14}\//U"; content:"/update.php"; endswith; fast_pattern; http.header_names; content:"|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|"; bsize:22; reference:md5,ab96e541284afe6ffc3fcf4d05bc971e; reference:url,twitter.com/vupt_bka/status/1497147010927194112; classtype:trojan-activity; sid:2035292; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_02_25, deployment Perimeter, former_category MALWARE, malware_family PlugX, signature_severity Major, updated_at 2022_02_25;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp iFile DELETE"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iFile="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6367; reference:url,www.securityfocus.com/bid/21405; reference:url,doc.emergingthreats.net/2006690; classtype:web-application-attack; sid:2006690; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PlugX Activity (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; pcre:"/^\/[a-zA-z]{14}\//U"; content:"/plplpMj.php"; endswith; fast_pattern; http.header_names; content:"|0d 0a|Content-Type|0d 0a|Host|0d 0a|Content-Length|0d 0a|Expect|0d 0a|Connection|0d 0a 0d 0a|"; content:!"Referer"; http.request_body; content:"1="; startswith; reference:md5,ab96e541284afe6ffc3fcf4d05bc971e; reference:url,twitter.com/vupt_bka/status/1497147010927194112; classtype:trojan-activity; sid:2035293; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_02_25, deployment Perimeter, former_category MALWARE, malware_family PlugX, signature_severity Major, updated_at 2022_02_25;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp iFile ASCII"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iFile="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6367; reference:url,www.securityfocus.com/bid/21405; reference:url,doc.emergingthreats.net/2006691; classtype:web-application-attack; sid:2006691; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp any any -> $HOME_NET 445 (msg:"ET EXPLOIT Suspicious SVCCTL CreateService Command via SMB - Observed Zerologon Post Compromise Activity"; flow:established,to_server; content:"SMB"; depth:8; content:"|09 00|"; distance:8; within:2; content:"|05 00 00|"; distance:0; content:"|0c 00|"; distance:19; within:2; content:"|15 00 00 00 00 00 00 00 15 00 00 00|"; within:32; pcre:"/^(?:[A-Z]\x00){20}\x00\x00/R"; content:"|15 00 00 00 00 00 00 00 15 00 00 00|"; fast_pattern; distance:6; within:12; pcre:"/^(?:[A-Z]\x00){20}\x00\x00/R"; content:"|03 00 00 00|"; distance:10; within:4; reference:url,thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/; reference:md5,59e7f22d2c290336826700f05531bd30; classtype:attempted-admin; sid:2035287; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Server, created_at 2022_02_25, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2022_02_25;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp iFile UPDATE"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iFile="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6367; reference:url,www.securityfocus.com/bid/21405; reference:url,doc.emergingthreats.net/2006692; classtype:web-application-attack; sid:2006692; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert smb any any -> $HOME_NET 445 (msg:"ET EXPLOIT CreateService via SMB to Reset-ComputerMachinePassword - Observed Post Zerologon Activity"; flow:established,to_server; content:"SMB"; depth:8; content:"|09 00|"; distance:8; within:2; content:"|05 00 00|"; distance:0; content:"|0c 00|"; distance:19; within:2; content:"|00|R|00|e|00|s|00|e|00|t|00|-|00|C|00|o|00|m|00|p|00|u|00|t|00|e|00|r|00|M|00|a|00|c|00|h|00|i|00|n|00|e|00|P|00|a|00|s|00|s|00|w|00|o|00|r|00|d|00|"; nocase; distance:0; reference:url,thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/; classtype:attempted-admin; sid:2035285; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Server, created_at 2022_02_24, deployment Internet, former_category EXPLOIT, performance_impact Low, signature_severity Major, updated_at 2022_02_25;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp action SELECT"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"action="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6367; reference:url,www.securityfocus.com/bid/21405; reference:url,doc.emergingthreats.net/2006694; classtype:web-application-attack; sid:2006694; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY Nessus Server SSL certificate detected"; flow:established,to_client; tls.cert_issuer; content:"OU=Nessus Certification Authority"; fast_pattern; classtype:bad-unknown; sid:2013298; rev:3; metadata:attack_target Client_Endpoint, created_at 2011_07_21, deployment Perimeter, former_category POLICY, signature_severity Informational, tag SSL_Malicious_Cert, updated_at 2022_02_26;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp action UNION SELECT"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"action="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6367; reference:url,www.securityfocus.com/bid/21405; reference:url,doc.emergingthreats.net/2006695; classtype:web-application-attack; sid:2006695; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed URL Shortening Service Domain (0sh .org in TLS SNI)"; flow:established,to_server; tls.sni; content:"0sh.org"; bsize:7; fast_pattern; classtype:bad-unknown; sid:2035304; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, signature_severity Informational, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp action INSERT"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"action="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6367; reference:url,www.securityfocus.com/bid/21405; reference:url,doc.emergingthreats.net/2006696; classtype:web-application-attack; sid:2006696; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed URL Shortening Service Domain (prourl .in in TLS SNI)"; flow:established,to_server; tls.sni; content:"prourl.in"; bsize:9; fast_pattern; classtype:bad-unknown; sid:2035305; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, signature_severity Informational, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp action DELETE"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"action="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6367; reference:url,www.securityfocus.com/bid/21405; reference:url,doc.emergingthreats.net/2006697; classtype:web-application-attack; sid:2006697; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)"; flow:established,to_server; tls.sni; content:"community.chocolatey.org"; bsize:24; fast_pattern; classtype:bad-unknown; sid:2035303; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, signature_severity Informational, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp action ASCII"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"action="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6367; reference:url,www.securityfocus.com/bid/21405; reference:url,doc.emergingthreats.net/2006698; classtype:web-application-attack; sid:2006698; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Chocolatey Windows Package Management Installation File Retrieval"; flow:established,to_server; http.request_line; content:"GET /install.ps1 HTTP/1.1"; http.host; content:"community.chocolatey.org"; fast_pattern; bsize:24; classtype:bad-unknown; sid:2035306; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUdownload SQL Injection Attempt -- detail.asp action UPDATE"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"action="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6367; reference:url,www.securityfocus.com/bid/21405; reference:url,doc.emergingthreats.net/2006699; classtype:web-application-attack; sid:2006699; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SunSeed Lua Downloader Activity (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/^\/[0-9]{9,10}$/"; http.header_names; content:"|0d 0a|host|0d 0a|te|0d 0a|connection|0d 0a|user-agent|0d 0a 0d 0a|"; http.host; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/"; http.user_agent; content:"LuaSocket|20|"; fast_pattern; startswith; classtype:trojan-activity; sid:2035360; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUpaypal SQL Injection Attempt -- detail.asp iType SELECT"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iType="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6365; reference:url,www.securityfocus.com/bid/14034; reference:url,doc.emergingthreats.net/2006700; classtype:web-application-attack; sid:2006700; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SunSeed Downloader Retrieving Binary (set)"; flow:established,to_server; flowbits:set,ETPRO.SunSeed.Downloader; flowbits:noalert; http.request_line; content:"GET / HTTP/1.1"; http.user_agent; content:"Windows Installer"; bsize:17; fast_pattern; http.host; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/"; classtype:trojan-activity; sid:2035361; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_04_18;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUpaypal SQL Injection Attempt -- detail.asp iType UNION SELECT"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iType="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6365; reference:url,www.securityfocus.com/bid/14034; reference:url,doc.emergingthreats.net/2006701; classtype:web-application-attack; sid:2006701; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE SunSeed Download Retrieving Binary"; flow:established,to_client; flowbits:isset,ETPRO.SunSeed.Downloader; http.response_line; content:"HTTP/1.1 200 OK"; http.header; content:"Content-Disposition|3a 20|attachment|3b 20|filename="; content:".msi|0d 0a|"; distance:0; file.data; content:"http.lua"; fast_pattern; classtype:trojan-activity; sid:2035362; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUpaypal SQL Injection Attempt -- detail.asp iType INSERT"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iType="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6365; reference:url,www.securityfocus.com/bid/14034; reference:url,doc.emergingthreats.net/2006702; classtype:web-application-attack; sid:2006702; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE PurpleFox Backdoor Related Domain in DNS Lookup (qq .c1c .ren)"; dns.query; content:"qq.c1c.ren"; nocase; bsize:10; reference:md5,757e04a9da1083b797b9dadc94300937; reference:url,twitter.com/0xrb/status/1496747426505531398; classtype:domain-c2; sid:2035307; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUpaypal SQL Injection Attempt -- detail.asp iType DELETE"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iType="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6365; reference:url,www.securityfocus.com/bid/14034; reference:url,doc.emergingthreats.net/2006703; classtype:web-application-attack; sid:2006703; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Trickbot Checkin Response"; flow:established,from_server; http.stat_code; content:"200"; http.content_type; content:"text/plain"; bsize:10; http.header; content:"Content-Length|3a 20|3|0d 0a|"; fast_pattern; nocase; file.data; content:"/1/"; depth:3; endswith; reference:md5,5d2d59d6cbff1dc1d108bdcae0294c51; classtype:command-and-control; sid:2032218; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_02_15, deployment Perimeter, former_category MALWARE, malware_family TrickBot, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUpaypal SQL Injection Attempt -- detail.asp iType ASCII"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iType="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6365; reference:url,www.securityfocus.com/bid/14034; reference:url,doc.emergingthreats.net/2006704; classtype:web-application-attack; sid:2006704; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Pterodo CnC Activity (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".html"; endswith; http.user_agent; content:"|3a 3a|"; content:"_"; distance:0; content:"|3a 3a|/."; distance:0; fast_pattern; http.header_names; content:!"Referer"; reference:md5,dddd77f42bfb365f36762ad4db4a741e; reference:md5,f4e7c05fde022ec76f8c2f0a4cf2e1b3; reference:url,twitter.com/h2jazi/status/1498017819539116033; classtype:trojan-activity; sid:2035309; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category MALWARE, malware_family Gamaredon, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DUware DUpaypal SQL Injection Attempt -- detail.asp iType UPDATE"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iType="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6365; reference:url,www.securityfocus.com/bid/14034; reference:url,doc.emergingthreats.net/2006705; classtype:web-application-attack; sid:2006705; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Pterodo CnC Activity (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".html"; endswith; http.request_body; content:"username="; startswith; content:"_"; distance:0; content:"&cart="; distance:0; fast_pattern; http.content_type; content:"application/x-www-form-urlencoded"; bsize:33; http.header_names; content:!"Referer"; http.user_agent; content:!"Android"; content:!"Linux"; reference:md5,dddd77f42bfb365f36762ad4db4a741e; reference:md5,f4e7c05fde022ec76f8c2f0a4cf2e1b3; reference:url,twitter.com/h2jazi/status/1498017819539116033; classtype:trojan-activity; sid:2035310; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category MALWARE, malware_family Gamaredon, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DuWare DuClassmate SQL Injection Attempt -- default.asp iCity SELECT"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"iCity="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6355; reference:url,www.securityfocus.com/archive/1/archive/1/453318/100/0/threaded; reference:url,doc.emergingthreats.net/2006706; classtype:web-application-attack; sid:2006706; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (creditals-email .space)"; dns.query; dotprefix; content:".creditals-email.space"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035316; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DuWare DuClassmate SQL Injection Attempt -- default.asp iCity UNION SELECT"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"iCity="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6355; reference:url,www.securityfocus.com/archive/1/archive/1/453318/100/0/threaded; reference:url,doc.emergingthreats.net/2006707; classtype:web-application-attack; sid:2006707; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (ua-passport .space)"; dns.query; dotprefix; content:".ua-passport.space"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035317; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DuWare DuClassmate SQL Injection Attempt -- default.asp iCity INSERT"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"iCity="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6355; reference:url,www.securityfocus.com/archive/1/archive/1/453318/100/0/threaded; reference:url,doc.emergingthreats.net/2006708; classtype:web-application-attack; sid:2006708; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (mil-gov .space)"; dns.query; dotprefix; content:".mil-gov.space"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035318; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DuWare DuClassmate SQL Injection Attempt -- default.asp iCity DELETE"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"iCity="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6355; reference:url,www.securityfocus.com/archive/1/archive/1/453318/100/0/threaded; reference:url,doc.emergingthreats.net/2006709; classtype:web-application-attack; sid:2006709; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (verify-email .space)"; dns.query; dotprefix; content:".verify-email.space"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035319; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DuWare DuClassmate SQL Injection Attempt -- default.asp iCity ASCII"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"iCity="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6355; reference:url,www.securityfocus.com/archive/1/archive/1/453318/100/0/threaded; reference:url,doc.emergingthreats.net/2006710; classtype:web-application-attack; sid:2006710; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (weryfikacja-konta .space)"; dns.query; dotprefix; content:".weryfikacja-konta.space"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035320; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DuWare DuClassmate SQL Injection Attempt -- default.asp iCity UPDATE"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"iCity="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6355; reference:url,www.securityfocus.com/archive/1/archive/1/453318/100/0/threaded; reference:url,doc.emergingthreats.net/2006711; classtype:web-application-attack; sid:2006711; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (konto-verify .space)"; dns.query; dotprefix; content:".konto-verify.space"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035321; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DuWare DuNews SQL Injection Attempt -- detail.asp iNews SELECT"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iNews="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6354; reference:url,www.securityfocus.com/bid/15681; reference:url,doc.emergingthreats.net/2006712; classtype:web-application-attack; sid:2006712; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (walidacja-uzytkownika .space)"; dns.query; dotprefix; content:".walidacja-uzytkownika.space"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035322; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DuWare DuNews SQL Injection Attempt -- detail.asp iNews DELETE"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iNews="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6354; reference:url,www.securityfocus.com/bid/15681; reference:url,doc.emergingthreats.net/2006715; classtype:web-application-attack; sid:2006715; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (kontrola-poczty .space)"; dns.query; dotprefix; content:".kontrola-poczty.space"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035323; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DuWare DuNews SQL Injection Attempt -- detail.asp iNews UNION SELECT"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iNews="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6354; reference:url,www.securityfocus.com/bid/15681; reference:url,doc.emergingthreats.net/2006713; classtype:web-application-attack; sid:2006713; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (weryfikacja-poczty .space)"; dns.query; dotprefix; content:".weryfikacja-poczty.space"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035324; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DuWare DuNews SQL Injection Attempt -- detail.asp iNews INSERT"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iNews="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6354; reference:url,www.securityfocus.com/bid/15681; reference:url,doc.emergingthreats.net/2006714; classtype:web-application-attack; sid:2006714; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (walidacja-poczty .space)"; dns.query; dotprefix; content:".walidacja-poczty.space"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035325; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DuWare DuNews SQL Injection Attempt -- detail.asp iNews ASCII"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iNews="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6354; reference:url,www.securityfocus.com/bid/15681; reference:url,doc.emergingthreats.net/2006716; classtype:web-application-attack; sid:2006716; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (bigmir .space)"; dns.query; dotprefix; content:".bigmir.space"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035326; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS DuWare DuNews SQL Injection Attempt -- detail.asp iNews UPDATE"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"iNews="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6354; reference:url,www.securityfocus.com/bid/15681; reference:url,doc.emergingthreats.net/2006717; classtype:web-application-attack; sid:2006717; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (mod-mil .site)"; dns.query; dotprefix; content:".mod-mil.site"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035327; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS E-Shop Shopping Cart Script search_results.php SQL Injection"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/search_results.php?cid="; nocase; pcre:"/UNION.+SELECT/i"; reference:bugtraq,30692; reference:url,doc.emergingthreats.net/2008684; classtype:web-application-attack; sid:2008684; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (mirrohost .space)"; dns.query; dotprefix; content:".mirrohost.space"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035328; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank SELECT"; flow:established,to_server; http.uri; content:"/listmembers.php?"; nocase; content:"rank="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-3077; reference:url,www.milw0rm.com/exploits/4030; reference:url,doc.emergingthreats.net/2004624; classtype:web-application-attack; sid:2004624; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (mirohost .online)"; dns.query; dotprefix; content:".mirohost.online"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035329; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank UNION SELECT"; flow:established,to_server; http.uri; content:"/listmembers.php?"; nocase; content:"rank="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-3077; reference:url,www.milw0rm.com/exploits/4030; reference:url,doc.emergingthreats.net/2004625; classtype:web-application-attack; sid:2004625; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (meta-ua .space)"; dns.query; dotprefix; content:".meta-ua.space"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035330; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank INSERT"; flow:established,to_server; http.uri; content:"/listmembers.php?"; nocase; content:"rank="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2007-3077; reference:url,www.milw0rm.com/exploits/4030; reference:url,doc.emergingthreats.net/2004626; classtype:web-application-attack; sid:2004626; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (mod-mil .online)"; dns.query; dotprefix; content:".mod-mil.online"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035331; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank DELETE"; flow:established,to_server; http.uri; content:"/listmembers.php?"; nocase; content:"rank="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-3077; reference:url,www.milw0rm.com/exploits/4030; reference:url,doc.emergingthreats.net/2004627; classtype:web-application-attack; sid:2004627; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (kontrola-poczty .site)"; dns.query; dotprefix; content:".kontrola-poczty.site"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035332; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank ASCII"; flow:established,to_server; http.uri; content:"/listmembers.php?"; nocase; content:"rank="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-3077; reference:url,www.milw0rm.com/exploits/4030; reference:url,doc.emergingthreats.net/2004628; classtype:web-application-attack; sid:2004628; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (creditals-mirohost .space)"; dns.query; dotprefix; content:".creditals-mirohost.space"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035333; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EQdkp SQL Injection Attempt -- listmembers.php rank UPDATE"; flow:established,to_server; http.uri; content:"/listmembers.php?"; nocase; content:"rank="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-3077; reference:url,www.milw0rm.com/exploits/4030; reference:url,doc.emergingthreats.net/2004629; classtype:web-application-attack; sid:2004629; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (verify-mail .space)"; dns.query; dotprefix; content:".verify-mail.space"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035334; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EZPX photoblog tpl_base_dir Parameter Remote File Inclusion Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/application/views/public/commentform.php?"; nocase; content:"tpl_base_dir="; nocase; pcre:"/tpl_base_dir=\s*(ftps?|https?|php)\:\//i"; reference:url,exploit-db.com/exploits/13890/; reference:url,vupen.com/english/advisories/2010/1497; reference:bugtraq,40881; reference:url,doc.emergingthreats.net/2011725; classtype:web-application-attack; sid:2011725; rev:6; metadata:created_at 2010_07_30, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain in DNS Lookup (mirohost .site)"; dns.query; dotprefix; content:".mirohost.site"; nocase; endswith; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035335; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Easebay Resources Paypal Subscription Manager SQL Injection Attempt -- memberlist.php keyword SELECT"; flow:established,to_server; http.uri; content:"/admin/memberlist.php?"; nocase; content:"keyword="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0403; reference:url,www.securityfocus.com/archive/1/archive/1/457506/100/0/threaded; reference:url,doc.emergingthreats.net/2005268; classtype:web-application-attack; sid:2005268; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (creditals-email .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".creditals-email.space"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035336; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Easebay Resources Paypal Subscription Manager SQL Injection Attempt -- memberlist.php keyword UNION SELECT"; flow:established,to_server; http.uri; content:"/admin/memberlist.php?"; nocase; content:"keyword="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0403; reference:url,www.securityfocus.com/archive/1/archive/1/457506/100/0/threaded; reference:url,doc.emergingthreats.net/2005269; classtype:web-application-attack; sid:2005269; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (ua-passport .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".ua-passport.space"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035337; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Easebay Resources Paypal Subscription Manager SQL Injection Attempt -- memberlist.php keyword INSERT"; flow:established,to_server; http.uri; content:"/admin/memberlist.php?"; nocase; content:"keyword="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2007-0403; reference:url,www.securityfocus.com/archive/1/archive/1/457506/100/0/threaded; reference:url,doc.emergingthreats.net/2005270; classtype:web-application-attack; sid:2005270; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (mil-gov .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".mil-gov.space"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035338; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Easebay Resources Paypal Subscription Manager SQL Injection Attempt -- memberlist.php keyword DELETE"; flow:established,to_server; http.uri; content:"/admin/memberlist.php?"; nocase; content:"keyword="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0403; reference:url,www.securityfocus.com/archive/1/archive/1/457506/100/0/threaded; reference:url,doc.emergingthreats.net/2005271; classtype:web-application-attack; sid:2005271; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (verify-email .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".verify-email.space"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035339; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Easebay Resources Paypal Subscription Manager SQL Injection Attempt -- memberlist.php keyword ASCII"; flow:established,to_server; http.uri; content:"/admin/memberlist.php?"; nocase; content:"keyword="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0403; reference:url,www.securityfocus.com/archive/1/archive/1/457506/100/0/threaded; reference:url,doc.emergingthreats.net/2005272; classtype:web-application-attack; sid:2005272; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (weryfikacja-konta .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".weryfikacja-konta.space"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035340; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Easebay Resources Paypal Subscription Manager SQL Injection Attempt -- memberlist.php keyword UPDATE"; flow:established,to_server; http.uri; content:"/admin/memberlist.php?"; nocase; content:"keyword="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-0403; reference:url,www.securityfocus.com/archive/1/archive/1/457506/100/0/threaded; reference:url,doc.emergingthreats.net/2005273; classtype:web-application-attack; sid:2005273; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (konto-verify .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".konto-verify.space"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035341; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Easebay Resources Login Manager SQL Injection Attempt -- memberlist.php init_row SELECT"; flow:established,to_server; http.uri; content:"/admin/memberlist.php?"; nocase; content:"init_row="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0401; reference:url,www.securityfocus.com/archive/1/archive/1/457505/100/0/threaded; reference:url,doc.emergingthreats.net/2005274; classtype:web-application-attack; sid:2005274; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (walidacja-uzytkownika .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".walidacja-uzytkownika.space"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035342; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Easebay Resources Login Manager SQL Injection Attempt -- memberlist.php init_row UNION SELECT"; flow:established,to_server; http.uri; content:"/admin/memberlist.php?"; nocase; content:"init_row="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0401; reference:url,www.securityfocus.com/archive/1/archive/1/457505/100/0/threaded; reference:url,doc.emergingthreats.net/2005275; classtype:web-application-attack; sid:2005275; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (kontrola-poczty .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".kontrola-poczty.space"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035343; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Easebay Resources Login Manager SQL Injection Attempt -- memberlist.php init_row INSERT"; flow:established,to_server; http.uri; content:"/admin/memberlist.php?"; nocase; content:"init_row="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2007-0401; reference:url,www.securityfocus.com/archive/1/archive/1/457505/100/0/threaded; reference:url,doc.emergingthreats.net/2005276; classtype:web-application-attack; sid:2005276; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (weryfikacja-poczty .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".weryfikacja-poczty.space"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035344; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Easebay Resources Login Manager SQL Injection Attempt -- memberlist.php init_row DELETE"; flow:established,to_server; http.uri; content:"/admin/memberlist.php?"; nocase; content:"init_row="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0401; reference:url,www.securityfocus.com/archive/1/archive/1/457505/100/0/threaded; reference:url,doc.emergingthreats.net/2005277; classtype:web-application-attack; sid:2005277; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (walidacja-poczty .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".walidacja-poczty.space"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035345; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Easebay Resources Login Manager SQL Injection Attempt -- memberlist.php init_row ASCII"; flow:established,to_server; http.uri; content:"/admin/memberlist.php?"; nocase; content:"init_row="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0401; reference:url,www.securityfocus.com/archive/1/archive/1/457505/100/0/threaded; reference:url,doc.emergingthreats.net/2005278; classtype:web-application-attack; sid:2005278; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Pterodo CnC Activity (POST)"; flow:established,to_server; http.request_line; content:"POST /set.lgo/"; startswith; fast_pattern; content:!".php"; content:!".asp"; http.header_names; content:!"Referer"; http.user_agent; content:!"Linux"; content:!"Android"; http.request_body; content:"username="; startswith; content:"_"; distance:0; content:"&cart="; distance:0; reference:md5,30342cff84f9b4ea94b0415cd26e2ee2; reference:url,twitter.com/h2jazi/status/1498017819539116033; classtype:trojan-activity; sid:2035312; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category MALWARE, malware_family Gamaredon, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Easebay Resources Login Manager SQL Injection Attempt -- memberlist.php init_row UPDATE"; flow:established,to_server; http.uri; content:"/admin/memberlist.php?"; nocase; content:"init_row="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-0401; reference:url,www.securityfocus.com/archive/1/archive/1/457505/100/0/threaded; reference:url,doc.emergingthreats.net/2005279; classtype:web-application-attack; sid:2005279; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (bigmir .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".bigmir.space"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035346; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Easyedit CMS page.php intpageID parameter sql injection"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/page.php?"; nocase; content:"intPageID="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:url,secunia.com/advisories/32822/; reference:url,packetstormsecurity.org/0811-exploits/easyeditcms-sql.txt; reference:url,doc.emergingthreats.net/2008883; classtype:web-application-attack; sid:2008883; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (mod-mil .site in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".mod-mil.site"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035347; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Easyedit CMS subcategory.php intSubCategoryID parameter sql injection"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"subcategory.php?"; nocase; content:"intSubCategoryID="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:url,secunia.com/advisories/32822/; reference:url,packetstormsecurity.org/0811-exploits/easyeditcms-sql.txt; reference:url,doc.emergingthreats.net/2008884; classtype:web-application-attack; sid:2008884; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (mirrohost .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".mirrohost.space"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035348; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Easyedit CMS news.php intPageID parameter sql injection"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"news.php?"; nocase; content:"intPageID="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:url,secunia.com/advisories/32822/; reference:url,packetstormsecurity.org/0811-exploits/easyeditcms-sql.txt; reference:url,doc.emergingthreats.net/2008885; classtype:web-application-attack; sid:2008885; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (mirohost .online in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".mirohost.online"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035349; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php i SELECT"; flow:established,to_server; http.uri; content:"/add_comment.php?"; nocase; content:"i="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005039; classtype:web-application-attack; sid:2005039; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (meta-ua .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".meta-ua.space"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035350; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php i UNION SELECT"; flow:established,to_server; http.uri; content:"/add_comment.php?"; nocase; content:"i="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005040; classtype:web-application-attack; sid:2005040; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (mod-mil .online in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".mod-mil.online"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035351; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php i INSERT"; flow:established,to_server; http.uri; content:"/add_comment.php?"; nocase; content:"i="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005041; classtype:web-application-attack; sid:2005041; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (kontrola-poczty .site in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".kontrola-poczty.site"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035352; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php i DELETE"; flow:established,to_server; http.uri; content:"/add_comment.php?"; nocase; content:"i="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005042; classtype:web-application-attack; sid:2005042; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (creditals-mirohost .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".creditals-mirohost.space"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035353; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php i ASCII"; flow:established,to_server; http.uri; content:"/add_comment.php?"; nocase; content:"i="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005043; classtype:web-application-attack; sid:2005043; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (verify-mail .space in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".verify-mail.space"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035354; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php i UPDATE"; flow:established,to_server; http.uri; content:"/add_comment.php?"; nocase; content:"i="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005045; classtype:web-application-attack; sid:2005045; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Suspected TA445 Spearphishing Related Domain (mirohost .site in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:".mirohost.site"; endswith; fast_pattern; reference:url,otx.alienvault.com/pulse/621cce4e2752128dbfe537ed; classtype:credential-theft; sid:2035355; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php post_id SELECT"; flow:established,to_server; http.uri; content:"/add_comment.php?"; nocase; content:"post_id="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005044; classtype:web-application-attack; sid:2005044; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Pterodo CnC Activity (POST)"; flow:established,to_server; http.request_line; content:"POST /index.arc/"; startswith; fast_pattern; content:!".php"; content:!".asp"; http.header_names; content:!"Referer"; http.user_agent; content:!"Linux"; content:!"Android"; http.request_body; content:"username="; startswith; content:"_"; distance:0; content:"&cart="; distance:0; reference:md5,0d7d8cc1756b932854e20dbe5d233afd; reference:url,twitter.com/h2jazi/status/1498017819539116033; classtype:trojan-activity; sid:2035311; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category MALWARE, malware_family Gamaredon, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php post_id UNION SELECT"; flow:established,to_server; http.uri; content:"/add_comment.php?"; nocase; content:"post_id="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005046; classtype:web-application-attack; sid:2005046; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET USER_AGENTS Suspcious LeakIX User-Agent (l9explore)"; flow:established,to_server; http.user_agent; content:"l9explore"; startswith; fast_pattern; reference:url,ithub.com/LeakIX/l9format; classtype:bad-unknown; sid:2035314; rev:2; metadata:affected_product Linux, attack_target Server, created_at 2022_02_28, deployment Perimeter, former_category USER_AGENTS, signature_severity Minor, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php post_id INSERT"; flow:established,to_server; http.uri; content:"/add_comment.php?"; nocase; content:"post_id="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005047; classtype:web-application-attack; sid:2005047; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Linux/Attempted Hosts File Exfil"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"?url=file|3a 2f 2f 2f|etc|2f|hosts"; endswith; http.header_names; content:!"Referer"; classtype:attempted-admin; sid:2035315; rev:2; metadata:affected_product Linux, attack_target Server, created_at 2022_02_28, deployment Perimeter, former_category EXPLOIT, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php post_id DELETE"; flow:established,to_server; http.uri; content:"/add_comment.php?"; nocase; content:"post_id="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005048; classtype:web-application-attack; sid:2005048; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp-stream $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET MALWARE Win32/Agent.UHC CnC Activity"; flow:established,to_client; stream_size:client,<,40; content:"|2e 2e 61 58 63 66|"; fast_pattern; reference:md5,042261407926beaaf0e3ed8bba5307cc; classtype:command-and-control; sid:2034219; rev:3; metadata:attack_target Client_Endpoint, created_at 2021_10_18, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php post_id ASCII"; flow:established,to_server; http.uri; content:"/add_comment.php?"; nocase; content:"post_id="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005049; classtype:web-application-attack; sid:2005049; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE BigLock Ransomware CnC Activity (gen)"; flow:established,to_server; content:"|0d 0a 0d 0a|gen="; fast_pattern; http.request_body; content:!"&syncID="; nocase; http.method; content:"POST"; http.uri; content:".php"; endswith; http.header_names; content:!"Referer"; content:!"Pragma"; content:!"Cache-"; reference:md5,ca9f28f5ae85fd014cbf07041117a735; classtype:command-and-control; sid:2030183; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2020_05_19, deployment Perimeter, former_category MALWARE, malware_family Ransomware, malware_family BigLock, signature_severity Major, tag Ransomware, updated_at 2022_02_28, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- add_comment.php post_id UPDATE"; flow:established,to_server; http.uri; content:"/add_comment.php?"; nocase; content:"post_id="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005050; classtype:web-application-attack; sid:2005050; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspected Snugy DNS Backdoor CnC Activity (Hostname Send)"; dns.query; bsize:>22; content:"266"; offset:3; depth:8; pcre:"/^[zjr9x]{1}[tmdhpz]{1}[0-9a-z]{1,6}266(?:[a-zA-Z0-9]{1,6})?+\./"; content:!".trendmicro.com"; content:!"cnr.io"; endswith; reference:url,unit42.paloaltonetworks.com/xhunt-campaign-backdoors/; classtype:command-and-control; sid:2031194; rev:3; metadata:attack_target Client_Endpoint, created_at 2020_11_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- list_comments.php i SELECT"; flow:established,to_server; http.uri; content:"/list_comments.php?"; nocase; content:"i="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005051; classtype:web-application-attack; sid:2005051; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/PurpleFox Related Activity (GET)"; flow:established,to_server; http.request_line; content:"GET /i.php?i="; fast_pattern; startswith; http.user_agent; content:"Windows Installer"; bsize:17; http.header_names; content:!"Referer"; content:"|0d 0a|Connection|0d 0a|Accept|0d 0a|User-Agent|0d 0a|Host|0d 0a 0d 0a|"; reference:md5,7f757563585debbbccc3e34664de04fe; reference:md5,c793425d192af8f89b1b8c7e1ea6f792; reference:url,twitter.com/Max_Mal_/status/1498351091066589184; classtype:trojan-activity; sid:2035313; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category MALWARE, malware_family PurpleFox, signature_severity Major, updated_at 2022_02_28;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- list_comments.php i UNION SELECT"; flow:established,to_server; http.uri; content:"/list_comments.php?"; nocase; content:"i="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005052; classtype:web-application-attack; sid:2005052; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Generic Credential Phish Landing Page 2022-03-01"; flow:established,to_client; http.stat_code; content:"200"; file.data; content:"method|3d 22|post|22 20|action|3d 22 2e 2f|index|2e|aspx|3f|code|3d|"; fast_pattern; content:"id|3d 22 5f 5f|VIEWSTATE|22|"; distance:0; content:"id|3d 22 5f 5f|VIEWSTATEGENERATOR|22|"; distance:0; content:"type|3d 22|password|22|"; distance:0; reference:md5,121de0ed6f4ec91eb75bae5ef1d9765b; classtype:credential-theft; sid:2035369; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_03_01;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- list_comments.php i INSERT"; flow:established,to_server; http.uri; content:"/list_comments.php?"; nocase; content:"i="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005053; classtype:web-application-attack; sid:2005053; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Successful Generic Credential Phish Landing Page 2022-03-02"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/index.aspx?code="; fast_pattern; pcre:"/[a-z0-9]{32}/Ri"; http.content_len; byte_test:0,>=,2000,0,string,dec; http.request_body; content:"__VIEWSTATE="; content:"&__VIEWSTATEGENERATOR="; distance:2000; reference:md5,121de0ed6f4ec91eb75bae5ef1d9765b; classtype:credential-theft; sid:2035377; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_03_02;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- list_comments.php i DELETE"; flow:established,to_server; http.uri; content:"/list_comments.php?"; nocase; content:"i="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005054; classtype:web-application-attack; sid:2005054; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspected PlugX Checkin Activity (udp)"; dsize:24; content:"|30 00|"; startswith; content:"|00 00 00 bf 68|"; distance:1; within:5; content:"|00 04 00 00 00 10 00 00 00 00 00 00|"; distance:4; within:12; fast_pattern; threshold: type limit, count 1, seconds 20, track by_src; reference:md5,3db876a7ab11ce98687d381ec9207256; reference:md5,98b2faafb027cc4c225d9de1616f430c; reference:url,twitter.com/0xrb/status/1496747426505531398; classtype:trojan-activity; sid:2035308; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_02_28, deployment Perimeter, former_category MALWARE, malware_family PlugX, signature_severity Major, updated_at 2022_03_01;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- list_comments.php i ASCII"; flow:established,to_server; http.uri; content:"/list_comments.php?"; nocase; content:"i="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005055; classtype:web-application-attack; sid:2005055; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Backdoor.Daxin CnC Activity"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/index.php?htpmgcid="; startswith; fast_pattern; http.header_names; content:"Content-Type|0d 0a|Host|0d 0a|Content-Length|0d 0a|"; content:!"Referer"; reference:md5,fb7c61ef427f9b2fdff3574ee6b1819b; reference:url,symantec-enterprise-blogs.security.com/blogs/threat-intelligence/daxin-backdoor-espionage; classtype:command-and-control; sid:2035365; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_01, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_03_01;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyMoblog SQL Injection Attempt -- list_comments.php i UPDATE"; flow:established,to_server; http.uri; content:"/list_comments.php?"; nocase; content:"i="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-0759; reference:url,www.securityfocus.com/bid/22369; reference:url,doc.emergingthreats.net/2005056; classtype:web-application-attack; sid:2005056; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Trickbot Data Exfiltration M3"; flow:established,to_server; http.method; content:"POST"; http.content_type; content:"multipart/form-data|3b 20|boundary=---------"; startswith; bsize:55; pcre:"/^[A-Z]{16}$/R"; http.request_body; content:"|0d 0a|Content|2d|Disposition|3a 20|form|2d|data|3b 20|name|3d 22|data|22 0d 0a 0d 0a|"; content:"|0d 0a|Content|2d|Disposition|3a 20|form|2d|data|3b 20|name|3d 22|source|22 0d 0a 0d 0a|"; distance:0; content:"|20|cookies|0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d|"; distance:0; fast_pattern; reference:url,www.malware-traffic-analysis.net/2021/09/01/index.html; classtype:command-and-control; sid:2035357; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_01, deployment Perimeter, former_category MALWARE, malware_family TrickBot, signature_severity Major, updated_at 2022_03_01;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyPage SQL Injection Attempt -- default.aspx docId SELECT"; flow:established,to_server; http.uri; content:"/sptrees/default.aspx?"; nocase; content:"docId="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6486; reference:url,www.securityfocus.com/archive/1/archive/1/453586/100/100/threaded; reference:url,doc.emergingthreats.net/2006554; classtype:web-application-attack; sid:2006554; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gamaredon APT Maldoc Related Activity (POST)"; flow:established,to_server; http.method; content:"POST"; http.user_agent; content:"|3a 3a|"; content:"_"; distance:0; content:"|3a 3a|/."; distance:0; fast_pattern; http.header_names; content:!"Referer"; reference:md5,cc088f6cdcc6536404d1527f5addbde6; reference:md5,3543111b570bd274ba5d0f1a10268c84; reference:url,twitter.com/500mk500/status/1497837117572980740; classtype:trojan-activity; sid:2035363; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_01, deployment Perimeter, former_category MALWARE, malware_family Gamaredon, signature_severity Major, updated_at 2022_03_01;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyPage SQL Injection Attempt -- default.aspx docId UNION SELECT"; flow:established,to_server; http.uri; content:"/sptrees/default.aspx?"; nocase; content:"docId="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6486; reference:url,www.securityfocus.com/archive/1/archive/1/453586/100/100/threaded; reference:url,doc.emergingthreats.net/2006555; classtype:web-application-attack; sid:2006555; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed Malicious Filename in Outbound POST Request (Browsers/Cookies/Microsoft Edge_)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Browsers/Cookies/Microsoft Edge_"; fast_pattern; reference:md5,758f815f3775e1b063eba3ab33479a9f; reference:url,asec.ahnlab.com/ko/31703; classtype:trojan-activity; sid:2035366; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2022_03_01, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_03_01;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyPage SQL Injection Attempt -- default.aspx docId INSERT"; flow:established,to_server; http.uri; content:"/sptrees/default.aspx?"; nocase; content:"docId="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6486; reference:url,www.securityfocus.com/archive/1/archive/1/453586/100/100/threaded; reference:url,doc.emergingthreats.net/2006556; classtype:web-application-attack; sid:2006556; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Observed Malicious Filename in Outbound POST Request (Information.txt)"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"Information.txt"; fast_pattern; reference:md5,50f2b28aba4d4cb47544bcc98980a63e; reference:url,asec.ahnlab.com/ko/31703; classtype:trojan-activity; sid:2035367; rev:2; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2022_03_01, deployment Perimeter, former_category HUNTING, signature_severity Major, updated_at 2022_03_01;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyPage SQL Injection Attempt -- default.aspx docId DELETE"; flow:established,to_server; http.uri; content:"/sptrees/default.aspx?"; nocase; content:"docId="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6486; reference:url,www.securityfocus.com/archive/1/archive/1/453586/100/100/threaded; reference:url,doc.emergingthreats.net/2006557; classtype:web-application-attack; sid:2006557; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET [465,993] (msg:"ET JA3 HASH - Possible AnchorMail CnC Traffic"; flow:established,to_server; ja3.hash; content:"c216e752cae6f8755fd27f561d031636"; reference:url,securityintelligence.com/posts/new-malware-trickbot-anchordns-backdoor-upgrades-anchormail/; reference:md5,139e70aa7f26f998c1058c270a51783d; classtype:command-and-control; sid:2035359; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_01, deployment Perimeter, former_category JA3, signature_severity Major, updated_at 2022_03_01;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyPage SQL Injection Attempt -- default.aspx docId ASCII"; flow:established,to_server; http.uri; content:"/sptrees/default.aspx?"; nocase; content:"docId="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6486; reference:url,www.securityfocus.com/archive/1/archive/1/453586/100/100/threaded; reference:url,doc.emergingthreats.net/2006558; classtype:web-application-attack; sid:2006558; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MuddyWater APT Related Telegram Activity"; flow:established,to_server; http.uri; content:"/bot2003026094:AAGoitvpcx3SFZ2_6YzIs4La_kyDF1PbXrY/"; fast_pattern; startswith; http.host; content:"api.telegram.com"; bsize:16; reference:url,www.ic3.gov/Media/News/2022/220224.pdf; classtype:trojan-activity; sid:2035364; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_01, deployment Perimeter, former_category MALWARE, malware_family MuddyWater, signature_severity Major, updated_at 2022_03_01;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasyPage SQL Injection Attempt -- default.aspx docId UPDATE"; flow:established,to_server; http.uri; content:"/sptrees/default.aspx?"; nocase; content:"docId="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6486; reference:url,www.securityfocus.com/archive/1/archive/1/453586/100/100/threaded; reference:url,doc.emergingthreats.net/2006559; classtype:web-application-attack; sid:2006559; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MSIL/TrojanDownloader.Agent.JVN CnC Checkin"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/?username="; bsize:<16; startswith; fast_pattern; pcre:"/^\/\x3fusername\x3d[a-z0-9]{2,3}_\d$/U"; http.connection; content:"Keep-Alive"; http.header_names; content:!"Referer"; content:!"User-Agent"; content:!"Accept"; reference:md5,f1006f3968f9edf76090e34702e647e6; reference:url,asec.ahnlab.com/ko/31703; classtype:trojan-activity; sid:2035368; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_01, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_03_01;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EasySiteNetwork Riddles Complete Website riddle.php riddleid Parameter SQL Injection"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/riddle.php?"; nocase; content:"riddleid="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:bugtraq,29966; reference:url,milw0rm.com/exploits/5946; reference:url,doc.emergingthreats.net/2009366; classtype:web-application-attack; sid:2009366; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Trickbot Data Exfiltration M2"; flow:established,to_server; http.method; content:"POST"; http.content_type; content:"multipart/form-data|3b 20|boundary=---------"; startswith; bsize:55; pcre:"/^[A-Z]{16}$/R"; http.request_body; content:"|0d 0a|Content|2d|Disposition|3a 20|form|2d|data|3b 20|name|3d 22|data|22 0d 0a 0d 0a|"; content:"|0d 0a|Content|2d|Disposition|3a 20|form|2d|data|3b 20|name|3d 22|source|22 0d 0a 0d 0a|"; distance:0; content:"|20|passwords|0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d|"; distance:0; fast_pattern; reference:url,www.malware-traffic-analysis.net/2021/09/01/index.html; classtype:command-and-control; sid:2035356; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_01, deployment Perimeter, former_category MALWARE, malware_family TrickBot, signature_severity Major, updated_at 2022_03_01;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Easynet4u Link Host directory.php cat_id parameter SQL Injection"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/directory.php?"; nocase; content:"ax=list"; nocase; content:"cat_id="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:bugtraq,31717; reference:url,www.milw0rm.com/exploits/6728; reference:url,doc.emergingthreats.net/2009117; classtype:web-application-attack; sid:2009117; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Trickbot Data Exfiltration M4"; flow:established,to_server; http.method; content:"POST"; http.content_type; content:"multipart/form-data|3b 20|boundary=---------"; startswith; bsize:55; pcre:"/^[A-Z]{16}$/R"; http.request_body; content:"|0d 0a|Content|2d|Disposition|3a 20|form|2d|data|3b 20|name|3d 22|formdata|22 0d 0a 0d 0a 7b|"; content:"|0d 0a|Content|2d|Disposition|3a 20|form|2d|data|3b 20|name|3d 22|billinfo|22 0d 0a 0d 0a 7b|"; distance:0; content:"|0d 0a|Content|2d|Disposition|3a 20|form|2d|data|3b 20|name|3d 22|cardinfo|22 0d 0a 0d 0a 7b|"; distance:0; fast_pattern; reference:url,www.malware-traffic-analysis.net/2021/09/01/index.html; classtype:command-and-control; sid:2035358; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_01, deployment Perimeter, former_category MALWARE, malware_family TrickBot, signature_severity Major, updated_at 2022_03_01;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp grup SELECT"; flow:established,to_server; http.uri; content:"/admin.asp?"; nocase; content:"grup="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2005985; classtype:web-application-attack; sid:2005985; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Cobalt Strike Activity (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/case"; bsize:5; fast_pattern; http.cookie; content:"wordpress_52345768e930f1ec699e4f12ab015a4f="; startswith; http.header_names; content:!"Referer"; http.header; content:"User-Agent|3a 20|Opera/9.61|20|(Windows|20|NT|20|5.1|3b 20|U|3b 20|ru)|20|Presto/2.1.1"; reference:md5,6b8d63299b70fb04a71bcadcf2f5f72b; reference:md5,2069c823d67e2d5d59606b3d8f6a7e22; reference:url,thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/; classtype:trojan-activity; sid:2035370; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_02, deployment Perimeter, former_category MALWARE, malware_family Cobalt_Strike, signature_severity Major, updated_at 2022_03_02, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1001, mitre_technique_name Data_Obfuscation;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp grup UNION SELECT"; flow:established,to_server; http.uri; content:"/admin.asp?"; nocase; content:"grup="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2005986; classtype:web-application-attack; sid:2005986; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Cobalt Strike Activity (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/jquery-3.3.2.min.js?__cfduid="; startswith; fast_pattern; http.user_agent; content:"Mozilla/5.0 (Windows NT 6.3|3b 20|Trident/7.0|3b 20|rv:11.0) like Gecko"; http.header; content:"Referer|3a 20|http|3a|//code.jquery.com/|0d 0a|"; reference:url,twitter.com/Unit42_Intel/status/1498802280992227330?s=20&t=iDY6vP8NF3muXpkS4ERenw; classtype:trojan-activity; sid:2035376; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_02, deployment Perimeter, former_category MALWARE, malware_family Cobalt_Strike, signature_severity Major, updated_at 2022_04_18, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1001, mitre_technique_name Data_Obfuscation;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp grup INSERT"; flow:established,to_server; http.uri; content:"/admin.asp?"; nocase; content:"grup="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2005987; classtype:web-application-attack; sid:2005987; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Miras C2 Activity"; flow:established,to_server; dsize:<1000; content:"|36 36 36 36 58 36 36 36|"; offset:2; depth:8; reference:md5,98a3a68f76ed2eba763eb7bfb6648562; classtype:command-and-control; sid:2018979; rev:3; metadata:created_at 2014_08_22, former_category MALWARE, updated_at 2022_03_02;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp grup DELETE"; flow:established,to_server; http.uri; content:"/admin.asp?"; nocase; content:"grup="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2005988; classtype:web-application-attack; sid:2005988; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Successful Royal Bank of Canada Credential Phish 2022-03-02"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cgibin/rbaccess/"; fast_pattern; http.request_body; content:"username="; content:"&password="; distance:0; reference:md5,e29fe69e683c7c04e9b14e46cdfd2e17; classtype:credential-theft; sid:2035378; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_02, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_03_02;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp grup ASCII"; flow:established,to_server; http.uri; content:"/admin.asp?"; nocase; content:"grup="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2005989; classtype:web-application-attack; sid:2005989; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT VMware Spring Cloud Gateway Code Injection (CVE-2022-22947) (set)"; flow:established,to_server; flowbits:set,ET.vmware.2022.22947; http.request_line; content:"POST /actuator/gateway/routes/"; startswith; fast_pattern; http.request_body; content:"|22|filters|22 3a|"; nocase; content:"|22 23 7b|"; within:115; reference:cve,2022-22947; classtype:attempted-admin; sid:2035380; rev:2; metadata:attack_target Server, created_at 2022_03_02, cve CVE_2022_22947, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_02;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp grup UPDATE"; flow:established,to_server; http.uri; content:"/admin.asp?"; nocase; content:"grup="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2005990; classtype:web-application-attack; sid:2005990; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT VMware Spring Cloud Gateway Code Injection (CVE-2022-22947)"; flow:established,to_server; flowbits:isset,ET.vmware.2022.22947; http.request_line; content:"POST /actuator/gateway/refresh"; startswith; fast_pattern; http.request_body; content:"|22|filters|22 3a|"; nocase; content:"|22 23 7b|"; within:115; reference:cve,2022-22947; classtype:attempted-admin; sid:2035381; rev:2; metadata:attack_target Server, created_at 2022_03_02, cve CVE_2022_22947, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_02;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp id SELECT"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"id="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2005991; classtype:web-application-attack; sid:2005991; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Kimsuky APT BabyShark Related Domain in DNS Lookup (worldinfocontact .club)"; dns.query; content:"worldinfocontact.club"; nocase; bsize:21; reference:md5,fe3ad944d07b66c83dc433c39fc054f4; reference:url,www.huntress.com/blog/targeted-apt-activity-babyshark-is-out-for-blood; classtype:domain-c2; sid:2035374; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_02, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_03_02;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp id UNION SELECT"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"id="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2005992; classtype:web-application-attack; sid:2005992; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed DangerousPassword APT Related Domain (cop .osonlines .co in TLS SNI)"; flow:established,to_server; tls.sni; content:"cop.osonlines.co"; bsize:16; fast_pattern; reference:url,twitter.com/cyber__sloth/status/1498698178585104385; classtype:domain-c2; sid:2035382; rev:1; metadata:created_at 2022_03_02, updated_at 2022_03_02;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp id INSERT"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"id="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2005993; classtype:web-application-attack; sid:2005993; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE DangerousPassword APT Related  Domain in DNS Lookup"; dns.query; content:"cop.osonlines.co"; nocase; bsize:16; reference:url,twitter.com/cyber__sloth/status/1498698178585104385; classtype:domain-c2; sid:2035383; rev:1; metadata:created_at 2022_03_02, updated_at 2022_03_02;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp id DELETE"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"id="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2005994; classtype:web-application-attack; sid:2005994; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Suspected Gamaredon APT Related Maldoc Activity (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".mtl"; endswith; fast_pattern; http.user_agent; content:"|3b 20|ms-office|3b 20|"; http.header_names; content:!"Referer"; reference:md5,11d19db057c4eee965878dd92181803e; reference:url,twitter.com/500mk500/status/1498769941998223366; classtype:trojan-activity; sid:2035375; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_02, deployment Perimeter, former_category MALWARE, malware_family Gamaredon, signature_severity Major, updated_at 2022_04_18;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp id ASCII"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"id="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2005995; classtype:web-application-attack; sid:2005995; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Zabbix v5.4.0 - 5.4.8 SSO/SALM Auth Bypass (CVE-2022-23131) M1"; flow:established,to_server; http.uri; content:"/index_sso.php"; startswith; http.cookie; content:"zbx_session="; content:"InVzZXJuYW1lX2F0dHJpYnV0ZSI6"; distance:0; fast_pattern; pcre:"/(?:InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)/"; reference:url,blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage; reference:cve,2022-23131; classtype:trojan-activity; sid:2035371; rev:2; metadata:attack_target Server, created_at 2022_03_02, cve CVE_2022_23131, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_02;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp id UPDATE"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"id="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2005996; classtype:web-application-attack; sid:2005996; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Zabbix v5.4.0 - 5.4.8 SSO/SALM Auth Bypass (CVE-2022-23131) M2"; flow:established,to_server; http.uri; content:"/index_sso.php"; startswith; http.cookie; content:"zbx_session="; content:"J1c2VybmFtZV9hdHRyaWJ1dGUiO"; distance:0; fast_pattern; pcre:"/(?:InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)/"; reference:url,blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage; reference:cve,2022-23131; classtype:trojan-activity; sid:2035372; rev:2; metadata:created_at 2022_03_02, cve CVE_2022_23131, updated_at 2022_03_02;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp id SELECT"; flow:established,to_server; http.uri; content:"/admin.asp?"; nocase; content:"id="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2005997; classtype:web-application-attack; sid:2005997; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Zabbix v5.4.0 - 5.4.8 SSO/SALM Auth Bypass (CVE-2022-23131) M3"; flow:established,to_server; http.uri; content:"/index_sso.php"; startswith; http.cookie; content:"zbx_session="; content:"idXNlcm5hbWVfYXR0cmlidXRlIj"; distance:0; fast_pattern; pcre:"/(?:InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)/"; reference:url,blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage; reference:cve,2022-23131; classtype:trojan-activity; sid:2035373; rev:2; metadata:created_at 2022_03_02, cve CVE_2022_23131, updated_at 2022_03_02;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp id UNION SELECT"; flow:established,to_server; http.uri; content:"/admin.asp?"; nocase; content:"id="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2005998; classtype:web-application-attack; sid:2005998; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Win32/PurpleFox Related Domain in DNS Lookup"; dns.query; content:"oip.xioerabn.site"; nocase; bsize:17; reference:md5,57b8bccf9cb8592ae86b4453cf74b4e8; classtype:domain-c2; sid:2035384; rev:1; metadata:attack_target Client_and_Server, created_at 2022_03_03, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_03_03;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp id INSERT"; flow:established,to_server; http.uri; content:"/admin.asp?"; nocase; content:"id="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2005999; classtype:web-application-attack; sid:2005999; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET MALWARE Win32/PurpleFox Retrieving File (GET)"; flow:established,to_server; http.request_line; content:"GET /conf.dat HTTP/1.1"; fast_pattern; http.user_agent; content:"Mozilla/4.0|20|(compatible|3b 20|MSIE 6.0|3b 20|Windows|20|NT|20|5.0)"; bsize:50; http.header_names; content:!"Referer"; reference:md5,57b8bccf9cb8592ae86b4453cf74b4e8; classtype:trojan-activity; sid:2035385; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_03, deployment Perimeter, former_category MALWARE, malware_family PurpleFox, signature_severity Major, updated_at 2022_03_03;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp id DELETE"; flow:established,to_server; http.uri; content:"/admin.asp?"; nocase; content:"id="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2006000; classtype:web-application-attack; sid:2006000; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Win32/PlugX Related Domain in DNS Lookup"; dns.query; content:"aoisudoisadn.kkb.tv"; nocase; bsize:19; reference:md5,1634d4a7ffdd698f6ccb541719fbff5c; reference:url,twitter.com/0xrb/status/1499287458500194304; classtype:domain-c2; sid:2035386; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_03, deployment Perimeter, signature_severity Major, updated_at 2022_03_03;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp id ASCII"; flow:established,to_server; http.uri; content:"/admin.asp?"; nocase; content:"id="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2006001; classtype:web-application-attack; sid:2006001; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE TA402/Molerats Related Domain in DNS Lookup"; dns.query; content:"diet-days.com"; nocase; bsize:13; reference:md5,b76199c0aaaa9c676ac7c6041f73be57; classtype:domain-c2; sid:2035394; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_03, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2022_03_03;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- admin.asp id UPDATE"; flow:established,to_server; http.uri; content:"/admin.asp?"; nocase; content:"id="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6828; reference:url,www.frsirt.com/english/advisories/2006/5150; reference:url,doc.emergingthreats.net/2006002; classtype:web-application-attack; sid:2006002; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE TA402/Molerats Related Domain in DNS Lookup"; dns.query; content:"socialskinclub.com"; nocase; bsize:18; reference:md5,b76199c0aaaa9c676ac7c6041f73be57; classtype:domain-c2; sid:2035395; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_03, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2022_03_03;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp grup SELECT"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"grup="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6794; reference:url,www.securityfocus.com/bid/21726; reference:url,doc.emergingthreats.net/2006159; classtype:web-application-attack; sid:2006159; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/BumbleBee Loader Activity (GET)"; flow:established,to_server; http.request_line; content:"GET /gate HTTP/1.1"; http.user_agent; content:"bumblebee"; bsize:9; fast_pattern; http.request_body; content:"|22|client_id|22|"; content:"|22|group_name|22|"; distance:0; content:"|22|sys_version|22|"; distance:0; content:"User name|3a 20|"; distance:0; reference:md5,555b77d23549e231c8d7f0b003cc5164; reference:md5,3f34d94803e9c8bc0a9cd09f507bc515; classtype:trojan-activity; sid:2035387; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_03, deployment Perimeter, deployment SSLDecrypt, former_category MALWARE, malware_family Bumblebee_Loader, signature_severity Major, updated_at 2022_03_03;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp grup UNION SELECT"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"grup="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6794; reference:url,www.securityfocus.com/bid/21726; reference:url,doc.emergingthreats.net/2006160; classtype:web-application-attack; sid:2006160; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Cobalt Strike Related Domain in DNS Lookup (jaxebiridi .com)"; dns.query; content:"jaxebiridi.com"; nocase; bsize:14; reference:md5,07d3e518022aec38af7cb4cb709fd4e3; reference:md5,1cd603a9c0f9f251552e070d16591bef; classtype:domain-c2; sid:2035388; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_03, deployment Perimeter, former_category MALWARE, malware_family Cobalt_Strike, signature_severity Major, updated_at 2022_03_03;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp grup INSERT"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"grup="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6794; reference:url,www.securityfocus.com/bid/21726; reference:url,doc.emergingthreats.net/2006161; classtype:web-application-attack; sid:2006161; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Cobalt Strike Activity (GET)"; flow:established,to_server; http.request_line; content:"GET /wp-includes/RELEASE.gif HTTP/1.1"; fast_pattern; http.user_agent; content:"Mozilla/5.0 (Linux|3b 20|Android 6.0|3b 20|HTC One X10 Build/MRA58K|3b 20|wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0"; bsize:113; http.header_names; content:"|0d 0a|Cache-Control|0d 0a|Host|0d 0a|Accept|0d 0a|User-Agent|0d 0a|Connection|0d 0a 0d 0a|"; bsize:57; reference:md5,07d3e518022aec38af7cb4cb709fd4e3; reference:md5,1cd603a9c0f9f251552e070d16591bef; classtype:trojan-activity; sid:2035389; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_03, deployment Perimeter, former_category MALWARE, malware_family Cobalt_Strike, signature_severity Major, updated_at 2022_03_03, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1001, mitre_technique_name Data_Obfuscation;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp grup DELETE"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"grup="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6794; reference:url,www.securityfocus.com/bid/21726; reference:url,doc.emergingthreats.net/2006162; classtype:web-application-attack; sid:2006162; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Pterodo Activity (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/descent.php?id="; startswith; fast_pattern; http.header_names; content:!"Referer"; http.request_body; content:"name="; startswith; content:"_"; distance:0; content:"&count="; distance:8; reference:md5,8184d72f1ce59bba32afc7a2b5953d52; classtype:trojan-activity; sid:2035390; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_03, deployment Perimeter, deployment SSLDecrypt, former_category MALWARE, malware_family Gamaredon, signature_severity Major, updated_at 2022_03_03;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp grup ASCII"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"grup="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6794; reference:url,www.securityfocus.com/bid/21726; reference:url,doc.emergingthreats.net/2006163; classtype:web-application-attack; sid:2006163; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Arkei Stealer CnC Checkin (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/tratata.php"; startswith; bsize:12; fast_pattern; http.header_names; content:!"Referer"; content:!"User-Agent"; http.header; content:"Cache-Control: no-cache"; reference:url,blogs.blackberry.com/en/2022/02/threat-thursday-arkei-infostealer?utm_medium=social&utm_source=bambu; classtype:trojan-activity; sid:2035392; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_03, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_03_03;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Efkan Forum SQL Injection Attempt -- default.asp grup UPDATE"; flow:established,to_server; http.uri; content:"/default.asp?"; nocase; content:"grup="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6794; reference:url,www.securityfocus.com/bid/21726; reference:url,doc.emergingthreats.net/2006164; classtype:web-application-attack; sid:2006164; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Arkei Stealer CnC Checkin (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/tratata.php"; startswith; bsize:12; fast_pattern; http.header_names; content:!"Referer"; content:!"User-Agent"; http.header; content:"Cache-Control: no-cache"; reference:url,blogs.blackberry.com/en/2022/02/threat-thursday-arkei-infostealer?utm_medium=social&utm_source=bambu; classtype:trojan-activity; sid:2035393; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_03, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_03_03;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Ektron CMS400.NET reterror.aspx info Parameter Cross Site Scripting Attempt"; flow:established,to_server; http.uri; content:"/WorkArea/reterror.aspx?"; nocase; content:"info="; nocase; pcre:"/(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)/i"; reference:bugtraq,39679; reference:url,secunia.com/advisories/39547/; reference:url,doc.emergingthreats.net/2011153; classtype:web-application-attack; sid:2011153; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag XSS, tag Cross_Site_Scripting, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gamaredon APT Related Maldoc Activity (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".maxc"; endswith; fast_pattern; http.user_agent; content:"|3b 20|ms-office|3b 20|"; content:!"Linux"; content:!"Android"; http.header_names; content:!"Referer"; reference:md5,8842acb150e1625ff20a84190073ece6; reference:url,twitter.com/500mk500/status/1498769941998223366; classtype:trojan-activity; sid:2035391; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_03, deployment Perimeter, former_category MALWARE, malware_family Gamaredon, signature_severity Major, updated_at 2022_03_03;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Ektron CMS400.NET medialist.aspx selectids Parameter Cross Site Scripting Attempt"; flow:established,to_server; http.uri; content:"/workarea/medialist.aspx?"; nocase; content:"selectids="; nocase; pcre:"/(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)/i"; reference:bugtraq,39679; reference:url,secunia.com/advisories/39547/; reference:url,doc.emergingthreats.net/2011154; classtype:web-application-attack; sid:2011154; rev:6; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag XSS, tag Cross_Site_Scripting, updated_at 2020_09_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Multiple User-Agent Components in a single UA"; flow:established,to_server; http.user_agent; content:"Compatible|3b 20|"; nocase; content:"Compatible|3b 20|"; nocase; distance:0; content:"MSIE|20|"; nocase; content:"MSIE|20|"; distance:0; nocase; fast_pattern; content:"|20|Windows|20|NT|20|"; nocase; content:"|20|Windows|20|NT|20|"; distance:0; nocase; reference:md5,0fc3d71e211f8d5101311d2800c459f7; classtype:misc-activity; sid:2035396; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_03_03, deployment Perimeter, deprecation_reason Performance, former_category HUNTING, performance_impact Significant, signature_severity Informational, updated_at 2022_03_07;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Elxis CMS SQL Injection Attempt -- mod_banners.php SELECT"; flow:established,to_server; http.uri; content:"/mod_banners.php?"; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-3250; reference:url,www.securityfocus.com/bid/24478; reference:url,doc.emergingthreats.net/2006449; classtype:web-application-attack; sid:2006449; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Microsoft Credential Phish 2022-03-14"; flow:established,to_client; http.stat_code; content:"200"; file.data; content:"username|3a 20|this|2e|email"; content:"password|3a 20|this|2e|password"; distance:0; content:"from|3a 20 22|Microsoft|20|Login|22|"; distance:0; content:"this|2e|error|20 3d 20 22|An|20|error|20|occured|2c 20|please|20|check|20|input|20|and|20|try|20|again|22 3b|"; distance:0; content:"this|2e|submitCount"; distance:0; content:"window|2e|location|2e|replace|28|"; distance:0; classtype:credential-theft; sid:2035453; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_04, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_03_04;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Elxis CMS SQL Injection Attempt -- mod_banners.php UNION SELECT"; flow:established,to_server; http.uri; content:"/mod_banners.php?"; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-3250; reference:url,www.securityfocus.com/bid/24478; reference:url,doc.emergingthreats.net/2006450; classtype:web-application-attack; sid:2006450; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Blackenergy Bot Checkin to C&C (2)"; flow:to_server,established; http.method; content:"POST"; nocase; http.host; content:!".bitdefender.net"; http.content_len; byte_test:0,<=,200,0,string,dec; http.request_body; content:"id="; nocase; startswith; content:"&cn="; nocase; content:"&bid="; nocase; fast_pattern; http.header_names; content:!"Referer|0d 0a|"; reference:url,doc.emergingthreats.net/2010875; classtype:command-and-control; sid:2010875; rev:13; metadata:created_at 2010_07_30, former_category MALWARE, updated_at 2022_03_04;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Elxis CMS SQL Injection Attempt -- mod_banners.php INSERT"; flow:established,to_server; http.uri; content:"/mod_banners.php?"; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2007-3250; reference:url,www.securityfocus.com/bid/24478; reference:url,doc.emergingthreats.net/2006451; classtype:web-application-attack; sid:2006451; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"ET MALWARE CobaltStrike DNS Beacon Response"; content:"|81 80 00 01 00 01 00 00 00 00|"; offset:2; depth:10; content:"|c0 0c 00 01 00 01 00 00 00 00 00 04 00 00 00 00|"; endswith; threshold: type both, count 10, seconds 90, track by_dst; content:!"|06|nessus|03|org"; content:!"trr|03|dns|07|nextdns|02|io"; content:!"|08|cloudapp|03|net"; reference:url,www.youtube.com/watch?v=zAB5G-QOyx8; classtype:targeted-activity; sid:2026040; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_08_28, deployment Perimeter, former_category MALWARE, malware_family Cobalt_Strike, signature_severity Major, tag c2, updated_at 2022_03_05, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Elxis CMS SQL Injection Attempt -- mod_banners.php DELETE"; flow:established,to_server; http.uri; content:"/mod_banners.php?"; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-3250; reference:url,www.securityfocus.com/bid/24478; reference:url,doc.emergingthreats.net/2006452; classtype:web-application-attack; sid:2006452; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine (Log Poisoning) (CVE-2020-16152) M1"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/login.php5"; http.request_body; content:"|3c 3f|php|20|system|28 24 5f|POST|5b 27|"; nocase; fast_pattern; reference:cve,2020-16152; classtype:attempted-admin; sid:2035401; rev:2; metadata:attack_target Server, created_at 2022_03_07, cve CVE_2020_16152, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_07;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Elxis CMS SQL Injection Attempt -- mod_banners.php ASCII"; flow:established,to_server; http.uri; content:"/mod_banners.php?"; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-3250; reference:url,www.securityfocus.com/bid/24478; reference:url,doc.emergingthreats.net/2006453; classtype:web-application-attack; sid:2006453; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine (LFI) (CVE-2020-16152) M2"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/action.php5"; http.request_body; content:"|2f 2e 2e 2f 2e 2e|"; fast_pattern; content:"/tmp/messages"; reference:cve,2020-16152; classtype:attempted-admin; sid:2035402; rev:2; metadata:attack_target Server, created_at 2022_03_07, cve CVE_2020_16152, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_07;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Elxis CMS SQL Injection Attempt -- mod_banners.php UPDATE"; flow:established,to_server; http.uri; content:"/mod_banners.php?"; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-3250; reference:url,www.securityfocus.com/bid/24478; reference:url,doc.emergingthreats.net/2006454; classtype:web-application-attack; sid:2006454; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed IP Tracking Domain (grabify .link in TLS SNI)"; flow:established,to_server; tls.sni; content:"grabify.link"; bsize:12; fast_pattern; classtype:bad-unknown; sid:2035419; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_07, deployment Perimeter, former_category INFO, signature_severity Major, updated_at 2022_03_07;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eMates SQL Injection Attempt -- newsdetail.asp ID SELECT"; flow:established,to_server; http.uri; content:"/newsdetail.asp?"; nocase; content:"ID="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6806; reference:url,www.milw0rm.com/exploits/2990; reference:url,doc.emergingthreats.net/2006135; classtype:web-application-attack; sid:2006135; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Azure Automation Authentication Bypass"; flow:established,to_server; http.uri; content:"/oauth2/token"; http.request_body; content:"resource"; content:"management.azure.com"; within:60; fast_pattern; http.header; content:"metadata"; nocase; content:!"X-IDENTITY-HEADER"; nocase; reference:url,orca.security/resources/blog/autowarp-microsoft-azure-automation-service-vulnerability/; classtype:attempted-admin; sid:2035403; rev:2; metadata:attack_target Server, created_at 2022_03_07, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_07;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eMates SQL Injection Attempt -- newsdetail.asp ID UNION SELECT"; flow:established,to_server; http.uri; content:"/newsdetail.asp?"; nocase; content:"ID="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6806; reference:url,www.milw0rm.com/exploits/2990; reference:url,doc.emergingthreats.net/2006136; classtype:web-application-attack; sid:2006136; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MSIL/BlackGuard Stealer Exfil Activity"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php?user="; content:"&coockieCount="; distance:0; fast_pattern; content:"&searche="; distance:0; http.request_body; content:"Content|2d|Disposition|3a 20|form|2d|data|3b 20|name|3d 22|file|22 3b 20|filename|3d 22 28|"; content:"|29 5f 5b|"; within:255; content:"|5d 2e|"; within:255; content:"|22 0d 0a|Content|2d|Type|3a 20|application|2f|octet|2d|stream|0d 0a 0d 0a|PK|03 04|"; within:53; reference:url,app.any.run/tasks/3c8c54c1-d39f-4a14-af0c-242fd364ef15/; reference:md5,bb5f22fc74149158b637a2bac5064ddb; classtype:command-and-control; sid:2035398; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_07, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2022_03_07;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eMates SQL Injection Attempt -- newsdetail.asp ID INSERT"; flow:established,to_server; http.uri; content:"/newsdetail.asp?"; nocase; content:"ID="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6806; reference:url,www.milw0rm.com/exploits/2990; reference:url,doc.emergingthreats.net/2006137; classtype:web-application-attack; sid:2006137; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE JS/Skimmer Inbound (Likely MageCart) M2"; flow:established,to_client; http.response_body; content:"W1sibmFtZSIsICJmaXJzdG5hbWUiL"; offset:50; depth:40; fast_pattern; content:"WyJuYW1lIiwgImxhc3RuYW1lIiw"; distance:0; content:"WyJuYW1lIiwgInN0cmVldFs"; distance:0; content:"WyJpZCIsICJhdXRobmV0Y2ltLWNjLW51bWJlciIs"; distance:0; content:"BbImlkIiwgImF1dGhuZXRjaW0tY2MtZXhwLXllYXI"; distance:0; reference:url,twitter.com/felixaime/status/1500812201262829568?s=20&t=xfD8gOOJuH7IZav4YxGkcw; reference:md5,a41474baac5a91c8033cfee943cea903; classtype:trojan-activity; sid:2035400; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_07, deployment Perimeter, former_category MALWARE, malware_family MageCart, signature_severity Major, updated_at 2022_03_07;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eMates SQL Injection Attempt -- newsdetail.asp ID ASCII"; flow:established,to_server; http.uri; content:"/newsdetail.asp?"; nocase; content:"ID="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6806; reference:url,www.milw0rm.com/exploits/2990; reference:url,doc.emergingthreats.net/2006139; classtype:web-application-attack; sid:2006139; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SystemBC Powershell bot registration"; flow:established,to_server; dsize:100; content: "|00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31|"; offset: 0; depth: 50; reference:md5,d1fb59de13a2394622c84aca8d963071; reference:url,medium.com/walmartglobaltech/systembc-powershell-version-68c9aad0f85c; classtype:command-and-control; sid:2035399; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_07, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_03_07;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eMates SQL Injection Attempt -- newsdetail.asp ID UPDATE"; flow:established,to_server; http.uri; content:"/newsdetail.asp?"; nocase; content:"ID="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6806; reference:url,www.milw0rm.com/exploits/2990; reference:url,doc.emergingthreats.net/2006140; classtype:web-application-attack; sid:2006140; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE TA445/Ghostwrite APT Related Domain in DNS Lookup (xbeta .online)"; dns.query; content:"xbeta.online"; nocase; bsize:12; reference:url,cert.gov.ua/article/37626; reference:md5,e34d6387d3ab063b0d926ac1fca8c4c4; reference:url,twitter.com/h2jazi/status/1500607147989684224; classtype:domain-c2; sid:2035404; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_08, deployment Perimeter, former_category MALWARE, malware_family Ghostwriter, signature_severity Major, updated_at 2022_03_08;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eCars SQL Injection Attempt -- Types.asp Type_id SELECT"; flow:established,to_server; http.uri; content:"/Types.asp?"; nocase; content:"Type_id="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6803; reference:url,www.milw0rm.com/exploits/2989; reference:url,doc.emergingthreats.net/2006147; classtype:web-application-attack; sid:2006147; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MSIL/BlackGuard Stealer Variant Exfil via Telegram"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/bot"; depth:4; content:"/sendDocument?chat_id="; distance:0; content:"&caption="; distance:0; content:"|e2 9a 99 ef b8 8f 20|Windows|20|"; distance:0; fast_pattern; content:"BROWSER|3a 0a|"; distance:0; content:"|0a 0a 20|Link|20|"; distance:0; http.host; content:"api.telegram.org"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b 20|name|3d 22|document|22 3b 20|filename|3d 22|"; content:".zip|22 0d 0a|Content-Type|3a 20|application/x-ms-dos-executable"; distance:0; reference:md5,d4e02002916f18576204a3f1722a958b; reference:md5,eb6c563af372d1af92ac2b60438d076d; reference:md5,ae84bf01058b29c178ae724df445c0c8; reference:url,twitter.com/3xp0rtblog/status/1499748871362261001; classtype:command-and-control; sid:2035397; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_07, deployment Perimeter, deployment SSLDecrypt, former_category MALWARE, malware_family BlackGuard, performance_impact Low, signature_severity Major, tag Stealer, updated_at 2022_03_08;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eCars SQL Injection Attempt -- Types.asp Type_id UNION SELECT"; flow:established,to_server; http.uri; content:"/Types.asp?"; nocase; content:"Type_id="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6803; reference:url,www.milw0rm.com/exploits/2989; reference:url,doc.emergingthreats.net/2006148; classtype:web-application-attack; sid:2006148; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING FancyBear/APT28 Related Phish Landing Page 2022-03-08"; flow:established,to_client; http.response_line; content:"HTTP/1.1 200 OK"; file.data; content:"|22|https|3a 2f 2f|webhook.site/3cc37709-f3bd-47bf-8b79-f090f0e8075b"; fast_pattern; reference:url,blog.google/threat-analysis-group/update-threat-landscape-ukraine/; classtype:credential-theft; sid:2035405; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_08, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, malware_family APT28, malware_family Fancy_Bear, signature_severity Major, updated_at 2022_03_08;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eCars SQL Injection Attempt -- Types.asp Type_id INSERT"; flow:established,to_server; http.uri; content:"/Types.asp?"; nocase; content:"Type_id="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6803; reference:url,www.milw0rm.com/exploits/2989; reference:url,doc.emergingthreats.net/2006149; classtype:web-application-attack; sid:2006149; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING FancyBear/APT28 Related Phish Landing Page 2022-03-08"; flow:established,to_client; http.response_line; content:"HTTP/1.1 200 OK"; file.data; content:"|22|https|3a 2f 2f|webhook.site/d466f7a7-63a1-4c04-8347-fe2d0a96081f"; fast_pattern; reference:url,blog.google/threat-analysis-group/update-threat-landscape-ukraine/; classtype:credential-theft; sid:2035406; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_08, deployment Perimeter, deployment SSLDecrypt, former_category PHISHING, malware_family APT28, malware_family Fancy_Bear, signature_severity Major, updated_at 2022_03_08;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eCars SQL Injection Attempt -- Types.asp Type_id DELETE"; flow:established,to_server; http.uri; content:"/Types.asp?"; nocase; content:"Type_id="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6803; reference:url,www.milw0rm.com/exploits/2989; reference:url,doc.emergingthreats.net/2006150; classtype:web-application-attack; sid:2006150; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TA450 Nagual/STARWHALE Beacon Activity (POST)"; flow:established,to_server; urilen:>15; http.method; content:"POST"; http.uri; content:!".asp"; content:!".php"; content:!".htm"; http.user_agent; content:"Mozilla/4.0 (compatible|3b 20|Win32|3b 20|WinHttp.WinHttpRequest.5)"; bsize:57; http.header_names; content:"|0d 0a|CharSet|0d 0a|Content-Length|0d 0a|Host|0d 0a 0d 0a|"; fast_pattern; content:!"Referer"; http.request_body; content:"vl="; startswith; reference:url,www.mandiant.com/resources/telegram-malware-iranian-espionage; classtype:trojan-activity; sid:2035407; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_08, deployment Perimeter, former_category MALWARE, malware_family TA450, signature_severity Major, updated_at 2022_03_08;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eCars SQL Injection Attempt -- Types.asp Type_id ASCII"; flow:established,to_server; http.uri; content:"/Types.asp?"; nocase; content:"Type_id="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6803; reference:url,www.milw0rm.com/exploits/2989; reference:url,doc.emergingthreats.net/2006151; classtype:web-application-attack; sid:2006151; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/ArmyOfUkraine Bot Activity"; flow:established,to_server; http.method; content:"GET"; http.request_line; content:"GET / HTTP/1.1"; bsize:14; http.header; content:"accept|3a 20 2a 2f 2a 0d 0a|"; content:"host|3a|"; http.host; content:".ru"; endswith; http.header_names; content:"|0d 0a|accept|0d 0a|host|0d 0a 0d 0a|"; fast_pattern; bsize:18; threshold:type both, seconds 600, count 20, track by_src; reference:md5,62d49fed7c54621b507a02541ee55066; reference:url,twitter.com/GossiTheDog/status/1497681806094737411; classtype:trojan-activity; sid:2035421; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_08, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_03_10;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eCars SQL Injection Attempt -- Types.asp Type_id UPDATE"; flow:established,to_server; http.uri; content:"/Types.asp?"; nocase; content:"Type_id="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6803; reference:url,www.milw0rm.com/exploits/2989; reference:url,doc.emergingthreats.net/2006152; classtype:web-application-attack; sid:2006152; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TA450 Nagual/STARWHALE GoLang Beacon Activity (POST)"; flow:established,to_server; urilen:>15; http.method; content:"POST"; http.uri; content:!".asp"; content:!".php"; content:!".htm"; http.user_agent; content:"Go-http-client/1.1"; bsize:18; http.content_type; content:"application/json"; bsize:16; http.header_names; content:"|0d 0a|Host|0d 0a|User-Agent|0d 0a|Content-Length|0d 0a|Content-Type|0d 0a|Accept-Encoding|0d 0a 0d 0a|"; fast_pattern; content:!"Referer"; http.request_body; content:"|7b 22|vl|22 3a 22|"; startswith; reference:url,www.mandiant.com/resources/telegram-malware-iranian-espionage; classtype:trojan-activity; sid:2035408; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_08, deployment Perimeter, former_category MALWARE, malware_family TA450, signature_severity Major, updated_at 2022_03_08;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID SELECT"; flow:established,to_server; http.uri; content:"/actualpic.asp?"; nocase; content:"Biz_ID="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6802; reference:url,www.milw0rm.com/exploits/2991; reference:url,doc.emergingthreats.net/2006153; classtype:web-application-attack; sid:2006153; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE TA450 GRAMDOOR Telegram CnC Activity (POST)"; flow:established,to_server; http.method; content:"POST"; http.host; content:"api.telegram.org"; bsize:16; http.uri; content:"/bot2003026094:AAGoitvpcx3SFZ2_6YzIs4La_kyDF1PbXrY/sendMessage?"; fast_pattern; startswith; reference:url,www.mandiant.com/resources/telegram-malware-iranian-espionage; classtype:trojan-activity; sid:2035409; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_08, deployment Perimeter, deployment SSLDecrypt, former_category MALWARE, signature_severity Major, updated_at 2022_03_08;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID UNION SELECT"; flow:established,to_server; http.uri; content:"/actualpic.asp?"; nocase; content:"Biz_ID="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6802; reference:url,www.milw0rm.com/exploits/2991; reference:url,doc.emergingthreats.net/2006154; classtype:web-application-attack; sid:2006154; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE TransparentTribe CnC Domain in DNS Lookup"; dns.query; content:"swissaccount.ddns.net"; nocase; bsize:21; reference:url,twitter.com/0xrb/status/1501061897604730881; classtype:domain-c2; sid:2035410; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2022_03_08;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID INSERT"; flow:established,to_server; http.uri; content:"/actualpic.asp?"; nocase; content:"Biz_ID="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6802; reference:url,www.milw0rm.com/exploits/2991; reference:url,doc.emergingthreats.net/2006155; classtype:web-application-attack; sid:2006155; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE TransparentTribe CnC Domain in DNS Lookup"; dns.query; content:"sunjaydut.ddns.net"; nocase; bsize:18; reference:url,twitter.com/0xrb/status/1501061897604730881; classtype:domain-c2; sid:2035411; rev:1; metadata:created_at 2022_03_08, updated_at 2022_03_08;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID DELETE"; flow:established,to_server; http.uri; content:"/actualpic.asp?"; nocase; content:"Biz_ID="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6802; reference:url,www.milw0rm.com/exploits/2991; reference:url,doc.emergingthreats.net/2006156; classtype:web-application-attack; sid:2006156; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE SoulSearcher Malware Domain in DNS Lookup (gmy .cimadlicks .net)"; dns.query; dotprefix; content:".gmy.cimadlicks.net"; nocase; endswith; reference:url,www.fortinet.com/blog/threat-research/unraveling-the-evolution-of-the-soul-searcher-malware; classtype:domain-c2; sid:2035412; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_09, deployment Perimeter, malware_family SoulSearcher, performance_impact Low, signature_severity Major, updated_at 2022_03_09;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb ePages SQL Injection Attempt -- actualpic.asp Biz_ID ASCII"; flow:established,to_server; http.uri; content:"/actualpic.asp?"; nocase; content:"Biz_ID="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6802; reference:url,www.milw0rm.com/exploits/2991; reference:url,doc.emergingthreats.net/2006157; classtype:web-application-attack; sid:2006157; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE SoulSearcher Malware Domain in DNS Lookup (community .weblives .net)"; dns.query; dotprefix; content:".community.weblives.net"; nocase; endswith; reference:url,www.fortinet.com/blog/threat-research/unraveling-the-evolution-of-the-soul-searcher-malware; classtype:domain-c2; sid:2035413; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_09, deployment Perimeter, malware_family SoulSearcher, performance_impact Low, signature_severity Major, updated_at 2022_03_09;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp AD_ID SELECT"; flow:established,to_server; http.uri; content:"/ad.asp?"; nocase; content:"AD_ID="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007042; classtype:web-application-attack; sid:2007042; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE SoulSearcher Malware Domain in DNS Lookup (app .tomelife .com)"; dns.query; dotprefix; content:".app.tomelife.com"; nocase; endswith; reference:url,www.fortinet.com/blog/threat-research/unraveling-the-evolution-of-the-soul-searcher-malware; classtype:domain-c2; sid:2035414; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_09, deployment Perimeter, malware_family SoulSearcher, performance_impact Low, signature_severity Major, updated_at 2022_03_09;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp AD_ID UNION SELECT"; flow:established,to_server; http.uri; content:"/ad.asp?"; nocase; content:"AD_ID="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007043; classtype:web-application-attack; sid:2007043; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET INFO Free Hosting Domain (*.freehostia .com in DNS Lookup)"; dns.query; dotprefix; content:".freehostia.com"; nocase; endswith; classtype:misc-activity; sid:2035422; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_09, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_03_09;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp AD_ID INSERT"; flow:established,to_server; http.uri; content:"/ad.asp?"; nocase; content:"AD_ID="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007044; classtype:web-application-attack; sid:2007044; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Pripyat Activity (POST)"; flow:established,to_server; http.request_line; content:"POST /api/endpoint.php HTTP/1.1"; fast_pattern; http.header_names; content:!"Referer"; http.user_agent; content:"cpp-httplib/0.9"; bsize:15; http.request_body; content:"|22|computername|22 3a 22|"; content:"|22|username|22 3a 22|"; distance:0; content:"|22|hashrate|22 3a|"; distance:0; reference:md5,ffb7bbf6e3e3199555b979b46d3789a6; reference:url,twitter.com/3xp0rtblog/status/1501330153900703745; reference:md5,a12ba07fcdb4eb1c1ea65e8fa49ec4ad; classtype:trojan-activity; sid:2035420; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_09, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_03_09;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp AD_ID DELETE"; flow:established,to_server; http.uri; content:"/ad.asp?"; nocase; content:"AD_ID="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007045; classtype:web-application-attack; sid:2007045; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SoulSearcher Checkin M1"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/msn-msn/log/2/debug?tim="; startswith; fast_pattern; http.host; content:"trc.taboola.com"; http.request_body; content:"|00 00 00 11|"; startswith; byte_jump:4,8,relative,little,post_offset -1; isdataat:!2,relative; content:"|78 9c|"; offset:16; depth:2; reference:url,www.fortinet.com/blog/threat-research/unraveling-the-evolution-of-the-soul-searcher-malware; reference:md5,9a32e5a45336e705d23adc865bd30704; classtype:command-and-control; sid:2035415; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_09, deployment Perimeter, former_category MALWARE, malware_family SoulSearcher, performance_impact Low, signature_severity Major, tag c2, updated_at 2022_04_18, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1071, mitre_technique_name Application_Layer_Protocol;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp AD_ID ASCII"; flow:established,to_server; http.uri; content:"/ad.asp?"; nocase; content:"AD_ID="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007046; classtype:web-application-attack; sid:2007046; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE SoulSearcher Checkin M2"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/en-my/CMSStyles/style.csx?k="; startswith; fast_pattern; http.host; content:"c.s-microsoft.com"; http.request_body; content:"|00 00 00 11|"; startswith; byte_jump:4,8,relative,little,post_offset -1; isdataat:!2,relative; content:"|78 9c|"; offset:16; depth:2; reference:url,www.fortinet.com/blog/threat-research/unraveling-the-evolution-of-the-soul-searcher-malware; classtype:command-and-control; sid:2035416; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_09, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag c2, updated_at 2022_04_18, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1071, mitre_technique_name Application_Layer_Protocol;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp AD_ID UPDATE"; flow:established,to_server; http.uri; content:"/ad.asp?"; nocase; content:"AD_ID="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007047; classtype:web-application-attack; sid:2007047; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Interactsh CnC Activity"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"|2e|php|3f|Event|3d|"; fast_pattern; pcre:"/^(?:\x3b|\x0a|\x26|\x60|\x7C|\x24)/R"; http.header_names; content:!"Referer"; threshold:type limit, seconds 600, count 5, track by_src; reference:url,unit42.paloaltonetworks.com/exploits-interactsh/; classtype:attempted-admin; sid:2034200; rev:3; metadata:affected_product Web_Server_Applications, attack_target Server, created_at 2021_10_15, cve CVE_2020_28188, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_03_09;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp cat_id INSERT"; flow:established,to_server; http.uri; content:"/ad.asp?"; nocase; content:"cat_id="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007050; classtype:web-application-attack; sid:2007050; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp-pkt any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET MALWARE HermeticWizard - WMI Spreader - File Copy via SMB2 (NT Create AndX Request)"; flow:established,to_server; content:"SMB"; depth:8; content:"|05 00|"; distance:8; within:2; content:"|22 00|"; distance:0; content:"|63 00|"; distance:8; within:2; pcre:"/^(?:[A-F0-9]\x00){12}/R"; content:"|2e 00|d|00|l|00|l|00|"; within:8; fast_pattern; reference:url,www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/; reference:md5,517d2b385b846d6ea13b75b8adceb061; classtype:trojan-activity; sid:2035417; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2022_03_09, deployment Internal, deployment Datacenter, former_category MALWARE, malware_family HermeticWizard, performance_impact Moderate, signature_severity Major, updated_at 2022_03_09;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp cat_id DELETE"; flow:established,to_server; http.uri; content:"/ad.asp?"; nocase; content:"cat_id="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007051; classtype:web-application-attack; sid:2007051; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert udp $HOME_NET any -> $EXTERNAL_NET 53 (msg:"ET MALWARE Lookup of Algorithm Generated Zeus CnC Domain (DGA)"; byte_test:1,!&,0xF8,2; content:"|02|ru|00|"; pcre:"/(?:([a-z0-9])(?!\1)){33,}\x02ru\x00\x00/"; classtype:command-and-control; sid:2014363; rev:8; metadata:created_at 2012_03_13, former_category MALWARE, updated_at 2022_03_09;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp cat_id ASCII"; flow:established,to_server; http.uri; content:"/ad.asp?"; nocase; content:"cat_id="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007052; classtype:web-application-attack; sid:2007052; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp-pkt any any -> [$HOME_NET,$HTTP_SERVERS] 445 (msg:"ET MALWARE HermeticWizard - WMI Spreader - File Copy via SMB1 (NT Create AndX Request)"; flow:established,to_server; content:"SMB"; depth:8; content:"|a2|"; within:1; content:"|27 00 00 5c 00 63 00|"; distance:0; pcre:"/^(?:[A-F0-9]\x00){12}/R"; content:"|2e 00|d|00|l|00|l|00|"; within:8; fast_pattern; reference:url,www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/; reference:md5,517d2b385b846d6ea13b75b8adceb061; classtype:trojan-activity; sid:2035423; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2022_03_10, deployment Internal, deployment Datacenter, former_category MALWARE, malware_family HermeticWizard, signature_severity Major, updated_at 2022_03_10;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp cat_id UPDATE"; flow:established,to_server; http.uri; content:"/ad.asp?"; nocase; content:"cat_id="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007053; classtype:web-application-attack; sid:2007053; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Oracle Access Manager RCE Attempt (CVE-2021-35587)"; flow:established,to_server; http.request_line; content:"POST /oam/server/opensso/sessionservice HTTP/1.1"; fast_pattern; http.request_body; content:"svcid"; content:"|5b|CDATA"; content:"requester|3d|"; distance:0; nocase; reference:cve,2021-35587; classtype:attempted-admin; sid:2035429; rev:2; metadata:attack_target Server, created_at 2022_03_10, cve CVE_2021_35587, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, tag Exploit, updated_at 2022_03_10;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp sub_id SELECT"; flow:established,to_server; http.uri; content:"/ad.asp?"; nocase; content:"sub_id="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007054; classtype:web-application-attack; sid:2007054; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Android.BankBot.11270 (DNS Lookup)"; dns_query; content:"xireycicin.xyz"; isdataat:!1,relative; reference:md5,c9ddaa4d670c262bf2621b8299ccf84e; classtype:domain-c2; sid:2035430; rev:2; metadata:created_at 2022_03_10, former_category MOBILE_MALWARE, updated_at 2022_03_10;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp sub_id UNION SELECT"; flow:established,to_server; http.uri; content:"/ad.asp?"; nocase; content:"sub_id="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007055; classtype:web-application-attack; sid:2007055; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.BankBot.11270 (TLS SNI)"; flow:established,to_server; tls_sni; content:"xireycicin.xyz"; isdataat:!1,relative; nocase; reference:md5,c9ddaa4d670c262bf2621b8299ccf84e; classtype:domain-c2; sid:2035431; rev:2; metadata:created_at 2022_03_10, former_category MOBILE_MALWARE, updated_at 2022_03_10;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp sub_id INSERT"; flow:established,to_server; http.uri; content:"/ad.asp?"; nocase; content:"sub_id="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007056; classtype:web-application-attack; sid:2007056; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MuddyWater APT Related Activity (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:!".asp"; content:!".htm"; content:!".php"; http.header; content:"|0d 0a|CharSet|3a 20|UTF-8|0d 0a|"; fast_pattern; http.request_body; content:"c="; startswith; http.header_names; content:!"Referer"; reference:md5,69ff29b86ab5444197aeb0cf5eba0967; reference:url,blog.talosintelligence.com/2022/03/iranian-supergroup-muddywater.html; classtype:trojan-activity; sid:2035425; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_03_10, deployment Perimeter, former_category MALWARE, malware_family MuddyWater, malware_family TA450, signature_severity Major, updated_at 2022_03_10;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp sub_id DELETE"; flow:established,to_server; http.uri; content:"/ad.asp?"; nocase; content:"sub_id="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007057; classtype:web-application-attack; sid:2007057; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MuddyWater APT Related Activity (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/protocol/function.php?page="; fast_pattern; startswith; http.header; content:!"Referer"; http.host; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/"; reference:url,blog.talosintelligence.com/2022/03/iranian-supergroup-muddywater.html; classtype:trojan-activity; sid:2035426; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_10, deployment Perimeter, former_category MALWARE, malware_family MuddyWater, malware_family TA453, signature_severity Major, updated_at 2022_03_10;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp sub_id ASCII"; flow:established,to_server; http.uri; content:"/ad.asp?"; nocase; content:"sub_id="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007058; classtype:web-application-attack; sid:2007058; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android/TrojanDropper.Agent.GWO Checkin"; flow:to_server,established; http.method; content:"POST"; http.user_agent; content:"okhttp/"; http.header_names; content:!"Referer|3a 20|"; http.request_body; content:"{|22|logType|22 3a|"; depth:11; content:",|22|msg|22 3a 22|{|5c 22|auth|5c 22 3a|"; fast_pattern; content:"|5c 22|appVersionName|5c 22|"; reference:md5,dcfa846ca56e14e720d4a743ac5c9f0f; classtype:command-and-control; sid:2035432; rev:2; metadata:created_at 2022_03_10, former_category MOBILE_MALWARE, updated_at 2022_03_10;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- ad.asp sub_id UPDATE"; flow:established,to_server; http.uri; content:"/ad.asp?"; nocase; content:"sub_id="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007049; classtype:web-application-attack; sid:2007049; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert smb any any -> [$HOME_NET,$HTTP_SERVERS] 445 (msg:"ET MALWARE HermeticWizard - File Copy via SMB"; flow:established,to_server; content:"Wizard|2e|dll|00|DllInstall|00|DllRegisterServer|00|DllUnregisterServer"; fast_pattern; reference:url,www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/; reference:md5,517d2b385b846d6ea13b75b8adceb061; classtype:trojan-activity; sid:2035424; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2022_03_10, deployment Internal, deployment Datacenter, former_category MALWARE, malware_family HermeticWizard, updated_at 2022_03_10;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dircat.asp cid SELECT"; flow:established,to_server; http.uri; content:"/dircat.asp?"; nocase; content:"cid="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007030; classtype:web-application-attack; sid:2007030; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp-pkt any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET MALWARE HermeticWizard - SMB Spreader - Remote Process Creation"; flow:established,to_server; content:"|05 00 00|"; content:"cmd|20 2f|c|20|start|20|regsvr32|20 2f|s|20 2f|i"; distance:0; fast_pattern; content:"|5c|c"; within:8; pcre:"/^[A-F0-9]{12}/R"; content:"|2e|dat|20 26 20|start|20|cmd|20 2f|c|20 22|ping|20|localhost|20 2d|n|20|7|20 26 20|wevtutil|20|cl|20|System|22|"; within:62; reference:url,www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/; reference:md5,517d2b385b846d6ea13b75b8adceb061; classtype:trojan-activity; sid:2035427; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2022_03_10, deployment Internal, deployment Datacenter, former_category MALWARE, malware_family HermeticWizard, signature_severity Major, updated_at 2022_03_10;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dircat.asp cid UNION SELECT"; flow:established,to_server; http.uri; content:"/dircat.asp?"; nocase; content:"cid="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007031; classtype:web-application-attack; sid:2007031; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp-pkt any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET MALWARE HermeticWizard - WMI Spreader - Remote Process Creation M2"; flow:established,to_server; content:"|05 00 00|"; content:"|5c 00|c|00|m|00|d|00 2e 00|e|00|x|00|e|00 20 00 2f 00|c|00 20 00|s|00|t|00|a|00|r|00|t|00 20|"; distance:0; fast_pattern; content:"r|00|e|00|g|00|s|00|v|00|r|00|3|00|2|00 2e 00|e|00|x|00|e|00 20 00 2f 00|s|00 20 00 2f 00|i|00 20 00|C|00 3a 00 5c 00|W|00|i|00|n|00|d|00|o|00|w|00|s|00 5c 00|c|00|"; distance:0; pcre:"/^(?:[A-F0-9]\x00){12}/R"; content:"|2e 00|d|00|l|00|l"; within:7; reference:url,www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/; reference:md5,517d2b385b846d6ea13b75b8adceb061; classtype:trojan-activity; sid:2035428; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2022_03_10, deployment Internal, deployment Datacenter, former_category MALWARE, malware_family HermeticWizard, signature_severity Major, updated_at 2022_03_10;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dircat.asp cid INSERT"; flow:established,to_server; http.uri; content:"/dircat.asp?"; nocase; content:"cid="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007032; classtype:web-application-attack; sid:2007032; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET COINMINER CoinMiner Known Malicious Stratum Authline (2022-03-11 1)"; flow:established,to_server; content:"|22|id|22 3A|"; content:"|22|method|22 3a|"; pcre:"/(?:\x22mining\.authorize\x22\x2c|\x22login\x22\x2c)/R"; content:"|22|params|22|"; within:50; pcre:"/(?:\x22login\x22\x3a\x22x\.0929c\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2282ZEhnLaX3ggrz5HbJJyinFjt8JyLomMnXYctMHJZCg368RrSyjQgN3TgrfbjqjUVdBPTP5VgEBkBYEWnTVHUgtjPweS5gc\x22\x2c\x22pass\x22\x3a\x22\x22|\x22login\x22\x3a\x224GdoN7NCTi8a5gZug7PrwZNKjvHFmKeV11L6pNJPgj5QNEHsN6eeX3DaAQFwZ1ufD4LYCZKArktt113W7QjWvQ7CW864Ah1Quz41mP4MJy\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2249GB8ucxW13fM78PMN2X3ZDYunniTj3pfdoyjztCkjDZQLSxRuZARgKEsfMDtoGGuiGGxWqeh6uez8mxYsPfm8TEGFq48Ce\x22\x2c\x22pass\x22\x3a\x22SynopsisX\x22|\x22login\x22\x3a\x22tyrenke\x22\x2c\x22pass\x22\x3a\x22tyrenke\x22)/R"; reference:md5,5c8ccae9c6841583a026c8276992045f; reference:url,www.btcguild.com/new_protocol.php; reference:url,research.zscaler.com/2013/12/bitcoin-mining-operation-seen-across.html; reference:url,mining.bitcoin.cz/stratum-mining; classtype:coin-mining; sid:2035435; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_11, deployment Perimeter, former_category COINMINER, signature_severity Major, tag Coinminer, updated_at 2022_03_11, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dircat.asp cid DELETE"; flow:established,to_server; http.uri; content:"/dircat.asp?"; nocase; content:"cid="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007033; classtype:web-application-attack; sid:2007033; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET COINMINER CoinMiner Known Malicious Stratum Authline (2022-03-11 2)"; flow:established,to_server; content:"|22|id|22 3A|"; content:"|22|method|22 3a|"; pcre:"/(?:\x22mining\.authorize\x22\x2c|\x22login\x22\x2c)/R"; content:"|22|params|22|"; within:50; pcre:"/(?:\x22login\x22\x3a\x226243128\x22\x2c\x22pass\x22\x3a\x22myminer\x22|\x22login\x22\x3a\x226249832\x22\x2c\x22pass\x22\x3a\x22viristotal\x22|\x22login\x22\x3a\x226250474\x22\x2c\x22pass\x22\x3a\x22Minecraft\x22|\x22login\x22\x3a\x2244z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db\x22\x2c\x22pass\x22\x3a\x22bomba3\x22|\x22login\x22\x3a\x2247WpQT7o5YMPeUjZ2AYqo2HNu9SnfQ3Le5MywXMgCuBS1DHqMTQFNY7MCsWkr466gQNC5G182ZCCDiKs69mwdvr4EjvhT5c\x22\x2c\x22pass\x22\x3a\x22Krutish\x22)/R"; reference:md5,63c361252b50f6099ef962a554501257; reference:url,www.btcguild.com/new_protocol.php; reference:url,research.zscaler.com/2013/12/bitcoin-mining-operation-seen-across.html; reference:url,mining.bitcoin.cz/stratum-mining; classtype:coin-mining; sid:2035436; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_11, deployment Perimeter, former_category COINMINER, signature_severity Major, tag Coinminer, updated_at 2022_03_11, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1496, mitre_technique_name Resource_Hijacking;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dircat.asp cid ASCII"; flow:established,to_server; http.uri; content:"/dircat.asp?"; nocase; content:"cid="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007034; classtype:web-application-attack; sid:2007034; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Android/SharkBot Related Domain in DNS Lookup"; dns.query; content:"statscodicefiscale.xyz"; nocase; bsize:22; reference:md5,1f32aa3ad68eac774cfcaeb0cd84de4d; reference:md5,acaed4c74eb9f0c85c603d4077a95697; reference:url,research.nccgroup.com/2022/03/03/sharkbot-a-new-generation-android-banking-trojan-being-distributed-on-google-play-store/; classtype:domain-c2; sid:2035439; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_11, deployment Perimeter, former_category MOBILE_MALWARE, signature_severity Major, updated_at 2022_03_11;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dircat.asp cid UPDATE"; flow:established,to_server; http.uri; content:"/dircat.asp?"; nocase; content:"cid="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007035; classtype:web-application-attack; sid:2007035; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp-pkt any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET MALWARE HermeticWizard - SMB Spreader - File Copy via SMB1 (NT Create AndX Request)"; flow:established,to_server; content:"SMB"; depth:8; content:"|a2|"; within:1; content:"|12 00 63|"; distance:0; pcre:"/^[A-F0-9]{12}/R"; content:"|2e|dat|00|"; within:5; fast_pattern; reference:url,www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/; reference:md5,517d2b385b846d6ea13b75b8adceb061; classtype:trojan-activity; sid:2035437; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_11, deployment Internal, deployment Datacenter, former_category MALWARE, malware_family HermeticWizard, performance_impact Moderate, signature_severity Major, updated_at 2022_03_11;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dirSub.asp sid SELECT"; flow:established,to_server; http.uri; content:"/dirSub.asp?"; nocase; content:"sid="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007036; classtype:web-application-attack; sid:2007036; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.t (DNS Lookup)"; dns_query; content:"panel.anuka1.a2hosted.com"; isdataat:!1,relative; reference:md5,2f8f1f7565872f8cbce615f5dbe03d7d; classtype:domain-c2; sid:2035433; rev:2; metadata:created_at 2022_03_11, former_category MOBILE_MALWARE, updated_at 2022_03_11;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dirSub.asp sid UNION SELECT"; flow:established,to_server; http.uri; content:"/dirSub.asp?"; nocase; content:"sid="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007037; classtype:web-application-attack; sid:2007037; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Trojan-Banker.AndroidOS.Anubis.t (TLS SNI)"; flow:established,to_server; tls_sni; content:"panel.anuka1.a2hosted.com"; isdataat:!1,relative; nocase; reference:md5,451d41b60db0fc16f16c8cef92a8a97d; classtype:command-and-control; sid:2035434; rev:2; metadata:created_at 2022_03_11, former_category MOBILE_MALWARE, updated_at 2022_03_11;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dirSub.asp sid INSERT"; flow:established,to_server; http.uri; content:"/dirSub.asp?"; nocase; content:"sid="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007038; classtype:web-application-attack; sid:2007038; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE APT41 KEYPLUG Related Domain in DNS Lookup"; dns.query; content:"afdentry.workstation.eu.org"; nocase; bsize:27; reference:url,www.mandiant.com/resources/apt41-us-state-governments; classtype:domain-c2; sid:2035440; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_11, deployment Perimeter, signature_severity Major, updated_at 2022_03_11;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dirSub.asp sid DELETE"; flow:established,to_server; http.uri; content:"/dirSub.asp?"; nocase; content:"sid="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007039; classtype:web-application-attack; sid:2007039; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Successful Cobalt Strike Shellcode Download (x32)"; flow:established,to_client; http.stat_code; content:"200"; http.response_body; content:"|fc e8 89 00 00 00 60 89 e5 31 d2 64 8b 52 30 8b 52 0c 8b|"; startswith; fast_pattern; reference:md5,a133c9d87aa58e8cb1a6c0f413bf5dbd; reference:url,github.com/giMini/PowerMemory/blob/master/PowerProcess/Inject-ShellCodeInProcess.ps1; reference:url,cisa.gov/uscert/ncas/alerts/aa21-265a; classtype:trojan-activity; sid:2035441; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_11, deployment Perimeter, former_category MALWARE, malware_family Cobalt_Strike, signature_severity Major, updated_at 2022_03_11;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dirSub.asp sid ASCII"; flow:established,to_server; http.uri; content:"/dirSub.asp?"; nocase; content:"sid="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007040; classtype:web-application-attack; sid:2007040; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Successful Cobalt Strike Shellcode Download (x64) M1"; flow:established,to_client; http.stat_code; content:"200"; http.response_body; content:"|fc 48 83 e4 f0 eb 33 5d 8b 45 00 48 83 c5 04 8b|"; startswith; fast_pattern; reference:md5,a133c9d87aa58e8cb1a6c0f413bf5dbd; reference:url,github.com/giMini/PowerMemory/blob/master/PowerProcess/Inject-ShellCodeInProcess.ps1; reference:url,cisa.gov/uscert/ncas/alerts/aa21-265a; classtype:trojan-activity; sid:2035442; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_11, deployment Perimeter, former_category MALWARE, malware_family Cobalt_Strike, signature_severity Major, updated_at 2022_03_11;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eClassifieds SQL Injection Attempt -- dirSub.asp sid UPDATE"; flow:established,to_server; http.uri; content:"/dirSub.asp?"; nocase; content:"sid="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6208; reference:url,www.securityfocus.com/bid/21192; reference:url,doc.emergingthreats.net/2007041; classtype:web-application-attack; sid:2007041; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Successful Cobalt Strike Shellcode Download (x64) M2"; flow:established,to_client; http.stat_code; content:"200"; http.response_body; content:"|fc 48 83 e4 f0 e8 c0 00 00 00 41 51 41 50|"; startswith; fast_pattern; reference:md5,a133c9d87aa58e8cb1a6c0f413bf5dbd; reference:url,github.com/giMini/PowerMemory/blob/master/PowerProcess/Inject-ShellCodeInProcess.ps1; reference:url,cisa.gov/uscert/ncas/alerts/aa21-265a; classtype:trojan-activity; sid:2035443; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_11, deployment Perimeter, former_category MALWARE, malware_family Cobalt_Strike, signature_severity Major, updated_at 2022_03_11;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dircat.asp cid SELECT"; flow:established,to_server; http.uri; content:"/dircat.asp?"; nocase; content:"cid="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007076; classtype:web-application-attack; sid:2007076; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Remcos RAT Checkin 781"; flow:established,to_server; content:"|b1 1a 8f 90 16 1e ff 80 76 38 01|"; startswith; fast_pattern; content:"|31 28|"; distance:2; within:2; threshold:type limit, seconds 30, count 1, track by_src; classtype:command-and-control; sid:2035438; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_11, deployment Perimeter, former_category MALWARE, malware_family Remcos, performance_impact Low, signature_severity Major, tag RAT, updated_at 2022_03_11;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dircat.asp cid UNION SELECT"; flow:established,to_server; http.uri; content:"/dircat.asp?"; nocase; content:"cid="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007077; classtype:web-application-attack; sid:2007077; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE SSL Cert Associated with Lazarus Downloader (JEUSD)"; flow:established,to_client; tls.cert_subject; content:"CN=celasllc.com"; bsize:15; fast_pattern; reference:md5,5509ee41b79c5d82e96038993f0bf3fa; reference:url,blogs.360.cn/blog/apt-c-26/; reference:url,crt.sh/?id=492527550; classtype:trojan-activity; sid:2025990; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2018_08_15, deployment Perimeter, former_category MALWARE, malware_family JEUSD, performance_impact Low, signature_severity Major, tag Lazarus, updated_at 2022_03_13;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dircat.asp cid INSERT"; flow:established,to_server; http.uri; content:"/dircat.asp?"; nocase; content:"cid="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007078; classtype:web-application-attack; sid:2007078; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Suspicious Self Signed SSL Certificate to 'My Company Ltd'"; flow:established,to_client; tls.cert_issuer; content:"My Company Ltd"; classtype:bad-unknown; sid:2013703; rev:4; metadata:attack_target Client_Endpoint, created_at 2011_09_28, deployment Perimeter, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_13;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dircat.asp cid DELETE"; flow:established,to_server; http.uri; content:"/dircat.asp?"; nocase; content:"cid="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007079; classtype:web-application-attack; sid:2007079; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Malware C2)"; flow:established,to_client; tls.cert_subject; content:"CN=4b7gf8bngf877"; bsize:16; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022919; rev:3; metadata:attack_target Client_and_Server, created_at 2016_06_27, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_13, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dircat.asp cid ASCII"; flow:established,to_server; http.uri; content:"/dircat.asp?"; nocase; content:"cid="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007080; classtype:web-application-attack; sid:2007080; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Malware C2)"; flow:established,to_client; tls.cert_subject; content:"CN=WIN-K462BJ3GEEC"; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022948; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2016_07_05, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_13, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dircat.asp cid UPDATE"; flow:established,to_server; http.uri; content:"/dircat.asp?"; nocase; content:"cid="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007081; classtype:web-application-attack; sid:2007081; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Fingerprint Blacklist Malicious SSL Certificate Detected (Gootkit C2)"; flow:established,to_client; tls.cert_serial; content:"00:CF:DD:B8:9F:9D:14:26:AD"; tls.cert_subject; content:"CN=localhost.localdomain"; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2023572; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2016_12_01, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_13, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dirSub.asp sid SELECT"; flow:established,to_server; http.uri; content:"/dirSub.asp?"; nocase; content:"sid="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007082; classtype:web-application-attack; sid:2007082; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dyre CnC)"; flow:established,to_client; tls.cert_serial; content:"00:86:C5:19:74:50:39:69:7A"; tls.cert_issuer; content:"O=Internet Widgits Pty Ltd"; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2020372; rev:4; metadata:attack_target Client_and_Server, created_at 2015_02_06, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_13, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dirSub.asp sid UNION SELECT"; flow:established,to_server; http.uri; content:"/dirSub.asp?"; nocase; content:"sid="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007083; classtype:web-application-attack; sid:2007083; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TorrentLocker CnC)"; flow:established,to_client; tls.cert_subject; content:"C=US, ST=Denial, L=Springfield, O=Dis,"; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021938; rev:3; metadata:attack_target Client_and_Server, created_at 2015_10_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_13, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dirSub.asp sid INSERT"; flow:established,to_server; http.uri; content:"/dirSub.asp?"; nocase; content:"sid="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007084; classtype:web-application-attack; sid:2007084; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gozi MITM)"; flow:established,to_client; tls.cert_subject; content:"CN=sni237731.cloudflaressl.com"; fast_pattern; classtype:domain-c2; sid:2023490; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2016_11_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_13, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dirSub.asp sid DELETE"; flow:established,to_server; http.uri; content:"/dirSub.asp?"; nocase; content:"sid="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007085; classtype:web-application-attack; sid:2007085; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Vawtrak CnC)"; flow:established,to_client; tls.cert_subject; content:"C="; pcre:"/^(?P[a-z])(?P=letter)\,/R"; content:"L=Default City"; content:"O=Default Company Ltd"; fast_pattern; content:!"CN="; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2023496; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2016_11_10, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_13, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dirSub.asp sid ASCII"; flow:established,to_server; http.uri; content:"/dirSub.asp?"; nocase; content:"sid="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007086; classtype:web-application-attack; sid:2007086; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Downloader CnC)"; flow:established,to_client; tls.cert_subject; content:"=certs_division@sslslf.info"; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022100; rev:3; metadata:attack_target Client_and_Server, created_at 2015_11_17, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_13, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- dirSub.asp sid UPDATE"; flow:established,to_server; http.uri; content:"/dirSub.asp?"; nocase; content:"sid="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007087; classtype:web-application-attack; sid:2007087; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Downloader CnC)"; flow:established,to_client; tls.cert_subject; content:"CN=www.hot-sex-tube.com"; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022101; rev:3; metadata:attack_target Client_and_Server, created_at 2015_11_17, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_13, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- types.asp TYPE_ID SELECT"; flow:established,to_server; http.uri; content:"/types.asp?"; nocase; content:"TYPE_ID="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007088; classtype:web-application-attack; sid:2007088; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Downloader CnC)"; flow:established,to_client; tls.cert_subject; content:"O=International Security Depart"; content:"CN=www.mgid.org"; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022102; rev:3; metadata:attack_target Client_and_Server, created_at 2015_11_17, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_13, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- types.asp TYPE_ID UNION SELECT"; flow:established,to_server; http.uri; content:"/types.asp?"; nocase; content:"TYPE_ID="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007089; classtype:web-application-attack; sid:2007089; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL Certificate Detected (Sinkhole)"; flow:established,to_client; tls.cert_serial; content:"00:99:60:FE:ED:86:B8:81:83"; tls.cert_subject; content:"O=Sinkhole.Ru"; fast_pattern; content:"CN=*"; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022907; rev:3; metadata:attack_target Client_and_Server, created_at 2016_06_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_14, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- types.asp TYPE_ID INSERT"; flow:established,to_server; http.uri; content:"/types.asp?"; nocase; content:"TYPE_ID="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007090; classtype:web-application-attack; sid:2007090; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL Certificate Detected (Sinkhole)"; flow:established,to_client; tls.cert_subject; content:"O=Sinkhole Party"; fast_pattern; content:"CN=sinkhole"; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022908; rev:3; metadata:attack_target Client_and_Server, created_at 2016_06_21, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_14, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- types.asp TYPE_ID DELETE"; flow:established,to_server; http.uri; content:"/types.asp?"; nocase; content:"TYPE_ID="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007091; classtype:web-application-attack; sid:2007091; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Vawtrak CnC)"; flow:established,to_client; tls.cert_subject; content:"CN=jmfbrtbsmth.com"; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2023161; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2016_09_06, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_14, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- types.asp TYPE_ID ASCII"; flow:established,to_server; http.uri; content:"/types.asp?"; nocase; content:"TYPE_ID="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007092; classtype:web-application-attack; sid:2007092; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (TrickBot CnC)"; flow:established,to_client; tls.cert_serial; content:"00:AC:80:A0:72:11:64:DF:3F"; tls.cert_subject; content:"CN=localhost.localdomain"; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2023727; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2017_01_11, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_14, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- types.asp TYPE_ID UPDATE"; flow:established,to_server; http.uri; content:"/types.asp?"; nocase; content:"TYPE_ID="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007093; classtype:web-application-attack; sid:2007093; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Bancos/DarkTequila CnC)"; flow:established,to_client; tls.cert_subject; content:"O=Agency Protocols Management of Internet"; content:"CN=bestylish.com"; fast_pattern; reference:md5,ecda8c6613fb458102fcb6f70b1cd594; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022209; rev:4; metadata:attack_target Client_and_Server, created_at 2015_12_02, deployment Perimeter, former_category MALWARE, malware_family Bancos, malware_family DarkTequila, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, tag Banking_Trojan, updated_at 2022_03_14, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- homeDetail.asp AD_ID SELECT"; flow:established,to_server; http.uri; content:"/homeDetail.asp?"; nocase; content:"AD_ID="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007094; classtype:web-application-attack; sid:2007094; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Successful Generic Phish 2022-03-11"; flow:established,to_client; flowbits:isset,ET.genericphish; http.stat_code; content:"302"; http.server; content:"nginx/1.19.1"; bsize:12; http.location; content:"load.php?id="; startswith; fast_pattern; classtype:credential-theft; sid:2035447; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_14, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2022_03_14, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- homeDetail.asp AD_ID UNION SELECT"; flow:established,to_server; http.uri; content:"/homeDetail.asp?"; nocase; content:"AD_ID="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007095; classtype:web-application-attack; sid:2007095; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Bancos/DarkTequila CnC)"; flow:established,to_client; tls.cert_subject; content:"O=Agency Protocols Management of Internet"; content:"=info@apmi.com"; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022211; rev:4; metadata:attack_target Client_and_Server, created_at 2015_12_02, deployment Perimeter, former_category MALWARE, malware_family Bancos, malware_family DarkTequila, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, tag Banking_Trojan, updated_at 2022_03_14, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- homeDetail.asp AD_ID INSERT"; flow:established,to_server; http.uri; content:"/homeDetail.asp?"; nocase; content:"AD_ID="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007096; classtype:web-application-attack; sid:2007096; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gootkit MITM)"; flow:established,to_client; tls.cert_subject; content:"CN=server.domain.com"; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022229; rev:4; metadata:attack_target Client_and_Server, created_at 2015_12_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_14, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- homeDetail.asp AD_ID DELETE"; flow:established,to_server; http.uri; content:"/homeDetail.asp?"; nocase; content:"AD_ID="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007097; classtype:web-application-attack; sid:2007097; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gamaredon APT Related Maldoc Activity (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".cmod"; endswith; fast_pattern; http.user_agent; content:"|3b 20|ms-office|3b 20|"; http.header; content:!"Referer"; reference:md5,833cd8302870af5a50b3a09af0420297; reference:url,twitter.com/500mk500/status/1502545185510731777; classtype:trojan-activity; sid:2035448; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_14, deployment Perimeter, former_category MALWARE, malware_family Gamaredon, signature_severity Major, updated_at 2022_03_14;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- homeDetail.asp AD_ID ASCII"; flow:established,to_server; http.uri; content:"/homeDetail.asp?"; nocase; content:"AD_ID="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007098; classtype:web-application-attack; sid:2007098; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gamaredon APT Related Maldoc Activity (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".ndf"; endswith; fast_pattern; http.user_agent; content:"|3b 20|ms-office|3b 20|"; http.header; content:!"Referer"; reference:md5,eecaecd170ef3d7a5976d435f6d03ef8; reference:url,twitter.com/500mk500/status/1502545185510731777; classtype:trojan-activity; sid:2035449; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_14, deployment Perimeter, former_category MALWARE, malware_family Gamaredon, signature_severity Major, updated_at 2022_04_18;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- homeDetail.asp AD_ID UPDATE"; flow:established,to_server; http.uri; content:"/homeDetail.asp?"; nocase; content:"AD_ID="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007099; classtype:web-application-attack; sid:2007099; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gootkit CnC)"; flow:established,to_client; tls.cert_subject; content:"CN=google.com"; content:"@google.com"; fast_pattern; tls.cert_issuer; content:"CN=google.com"; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022234; rev:4; metadata:attack_target Client_and_Server, created_at 2015_12_08, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_14, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp cat SELECT"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"cat="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007100; classtype:web-application-attack; sid:2007100; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Zeus CnC)"; flow:established,to_client; tls.cert_subject; content:"CN=Wureuzisen"; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022684; rev:3; metadata:attack_target Client_and_Server, created_at 2016_03_30, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_14, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp cat UNION SELECT"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"cat="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007101; classtype:web-application-attack; sid:2007101; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)"; flow:established,to_client; tls.cert_subject; content:!"ST="; content:!"L="; content:"C=CH"; fast_pattern; pcre:"/O=(?!GoDaddy)[A-Z][a-z]+\s[A-Z][a-z]+\s(?:NL|Pty|Inc|Corp|Ltd)\.?,.+CN=[a-z]{5,}\.[a-z]{2,3}(?:$|,)/R"; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022279; rev:3; metadata:attack_target Client_and_Server, created_at 2015_12_18, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_14, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp cat INSERT"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"cat="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007102; classtype:web-application-attack; sid:2007102; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Quakbot CnC)"; flow:established,to_client; tls.cert_subject; content:"C=US, ST=NY, L=NY"; fast_pattern; content:"CN="; distance:0; content:"=admin@"; distance:0; pcre:"/[eE]mail(?:Address)?=admin@/"; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022534; rev:3; metadata:attack_target Client_and_Server, created_at 2016_02_17, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_14, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp cat DELETE"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"cat="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007103; classtype:web-application-attack; sid:2007103; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET USER_AGENTS Suspicious User-Agent (ItIsMe)"; flow:to_server,established; http.user_agent; content:"ItIsMe"; depth:6; fast_pattern; reference:url,resources.cylera.com/new-evidence-linking-kwampirs-malware-to-shamoon-apts; classtype:trojan-activity; sid:2035445; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_03_14, deployment Perimeter, former_category USER_AGENTS, performance_impact Low, signature_severity Informational, updated_at 2022_03_14;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp cat ASCII"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"cat="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007104; classtype:web-application-attack; sid:2007104; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex CnC)"; flow:established,to_client; tls.cert_subject; content:"OU=obama team"; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2021513; rev:4; metadata:attack_target Client_and_Server, created_at 2015_07_23, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_14, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp cat UPDATE"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"cat="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007105; classtype:web-application-attack; sid:2007105; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Netgear R6260 Mini_httpd Buffer Overflow Attempt - Possible RCE (CVE-2021-34979)"; flow:established,to_server; http.header; content:"SOAPAction|3a 20|"; content:"urn:NETGEAR-ROUTER:service:"; within:30; fast_pattern; content:!"|0d 0a|"; within:131; pcre:"/^SOAPAction\x3a\x20\x22?urn\x3aNETGEAR-ROUTER\x3aservice\x3a.{128,}(?!:\d#)/Hm"; http.request_body; content:"|3c 3f|xml"; startswith; reference:url,nstarke.github.io/netgear/nday/2022/03/13/reverse-engineering-a-netgear-nday.html; reference:cve,2021-34979; classtype:trojan-activity; sid:2035446; rev:1; metadata:attack_target Networking_Equipment, created_at 2022_03_14, cve CVE_2021_34979, deployment Perimeter, deployment Internal, former_category EXPLOIT, signature_severity Major, updated_at 2022_03_14;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp compare SELECT"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"compare="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007106; classtype:web-application-attack; sid:2007106; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gamaredon APT Related Maldoc Activity (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri.raw; content:"/%D0"; startswith; content:"-%D0%9F"; distance:0; fast_pattern; content:".dot"; endswith; http.user_agent; content:"|3b 20|ms-office|3b 20|"; http.header; content:!"Referer"; reference:md5,91c27abec8fda1410e2fae396f592e93; reference:md5,8d1ce6280d2f66ff3e4fe1644bf24247; reference:url,twitter.com/500mk500/status/1502545185510731777; classtype:trojan-activity; sid:2035450; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_14, deployment Perimeter, former_category MALWARE, malware_family Gamaredon, signature_severity Major, updated_at 2022_03_14;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp compare UNION SELECT"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"compare="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007107; classtype:web-application-attack; sid:2007107; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET USER_AGENTS Suspicious User-Agent (HTTP-Test-Program)"; flow:to_server,established; http.user_agent; content:"HTTP-Test-Program"; bsize:17; startswith; reference:md5,6e69e15ae55aee85ace66bb99e6ba885; classtype:bad-unknown; sid:2035452; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_14, deployment Perimeter, former_category USER_AGENTS, signature_severity Minor, updated_at 2022_03_14;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp compare INSERT"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"compare="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007108; classtype:web-application-attack; sid:2007108; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Ping Identity Landing Page 2022-03-14"; flow:established,to_client; http.stat_code; content:"200"; file.data; content:""; content:""; content:""; content:"Log in"; content:"|24 2e|ajax"; content:"type|20 3a 20 27|POST|27 2c|"; content:"url|20 3a 20 27|files|2f|action|2e|php|3f|type|3d|login|27 2c|"; content:"data|20 3a 20 24 28 27 23|loginForm|27 29 2e|serialize|28 29 2c|"; content:"location|2e|href|20 3d 20 22|Loading|2e|php|22|"; content:"Ping Identity Corporation"; reference:md5,391dd3f15f5520a3bbfc654dbb3a4ac6; classtype:credential-theft; sid:2035454; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_14, deployment Perimeter, former_category PHISHING, signature_severity Major, updated_at 2022_03_14;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp compare DELETE"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"compare="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007109; classtype:web-application-attack; sid:2007109; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Ghostwriter/UNC1151 Related Domain in DNS Lookup (tvasahi .online)"; dns.query; content:"tvasahi.online"; nocase; bsize:14; reference:url,ti.qianxin.com/blog/articles/Analysis-of-ti.qianxin.com/blog/articles/Analysis-of-attack-activities-of-suspected-aptorganization-unc1151-against-ukraine-and-other-countries/; classtype:domain-c2; sid:2035451; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_14, deployment Perimeter, former_category MALWARE, malware_family Ghostwriter, signature_severity Major, updated_at 2022_03_14;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp compare ASCII"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"compare="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007110; classtype:web-application-attack; sid:2007110; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE APT29 Cache_DLL SSL Cert"; flow:established,to_client; tls.cert_subject; content:"CN=private.directinvesting.com"; fast_pattern; reference:md5,8f154d23ac2071d7f179959aaba37ad5; reference:url,www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity; classtype:targeted-activity; sid:2023931; rev:3; metadata:created_at 2017_02_16, former_category MALWARE, malware_family APT29_Cache_DLL, updated_at 2022_03_15;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp compare UPDATE"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"compare="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007111; classtype:web-application-attack; sid:2007111; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Tor2Web .onion Proxy Service SSL Cert (1)"; flow:established,to_client; tls.cert_subject; content:"CN=*.tor2web."; nocase; fast_pattern; reference:url,uscyberlabs.com/blog/2013/04/30/tor-exploit-pak/; classtype:trojan-activity; sid:2016806; rev:6; metadata:attack_target Client_Endpoint, created_at 2013_05_02, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_15;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp clear SELECT"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"clear="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007112; classtype:web-application-attack; sid:2007112; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET POLICY Logmein.com/Join.me SSL Remote Control Access"; flow:established,to_client; tls.cert_subject; content:"O=LogMeIn, Inc."; nocase; fast_pattern; pcre:"/CN=(?:[^\r\n\,]+?[\.-])?app\d/"; classtype:policy-violation; sid:2014756; rev:6; metadata:attack_target Client_Endpoint, created_at 2010_10_31, deployment Perimeter, former_category POLICY, performance_impact Low, signature_severity Informational, updated_at 2022_03_15;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp clear UNION SELECT"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"clear="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007113; classtype:web-application-attack; sid:2007113; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Possible Upatre Downloader SSL certificate"; flow:established,from_server; tls.certs; content:"|2a 86 48 86 f7 0d 01 09 01|"; fast_pattern; pcre:"/^.{2}(?P([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.).+?\x2a\x86\x48\x86\xf7\x0d\x01\x09\x01.{2}(?P=fake_email)/Rs"; reference:url,blogs.technet.com/b/mmpc/archive/2013/10/31/upatre-emerging-up-d-at-er-in-the-wild.aspx; classtype:trojan-activity; sid:2017816; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2013_12_06, deployment Perimeter, malware_family Upatre, signature_severity Critical, tag SSL_Malicious_Cert, tag Exploit_Kit, tag Downloader, tag Upatre, updated_at 2022_03_15;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp clear INSERT"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"clear="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007114; classtype:web-application-attack; sid:2007114; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/44Caliber Stealer Discord Activity (POST)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/webhooks/943188844625428520/64LwO5Gsh0pUZCcm80BNwTcVPihRnEmr1rZOPj02k6T5sRc5Lq4sdaB2KyttNgJHeX3T"; fast_pattern; bsize:101; http.host; content:"discord.com"; endswith; reference:md5,0238e5a4b41c4dcff77e8b01e88bed22; reference:url,twitter.com/c3rb3ru5d3d53c/status/1503449439868014592; classtype:trojan-activity; sid:2035471; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_15, deployment Perimeter, deployment SSLDecrypt, former_category MALWARE, signature_severity Major, updated_at 2022_04_18;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp clear DELETE"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"clear="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007115; classtype:web-application-attack; sid:2007115; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Ghostwriter/UNC1151 Related Domain in DNS Lookup"; dns.query; content:"multilogin.online"; nocase; bsize:17; reference:url,ti.qianxin.com/blog/articles/Analysis-of-ti.qianxin.com/blog/articles/Analysis-of-attack-activities-of-suspected-aptorganization-unc1151-against-ukraine-and-other-countries/; classtype:domain-c2; sid:2035457; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_15, deployment Perimeter, signature_severity Major, updated_at 2022_03_15;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp clear ASCII"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"clear="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007116; classtype:web-application-attack; sid:2007116; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ATTACK_RESPONSE Microsoft Powershell Banner Outbound"; flow:established; content:"Windows PowerShell"; content:"Copyright |28|C|29|"; distance:0; content:"Microsoft Corp"; distance:0; classtype:successful-admin; sid:2020084; rev:2; metadata:created_at 2015_01_05, updated_at 2022_03_15;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp clear UPDATE"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"clear="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007117; classtype:web-application-attack; sid:2007117; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET INFO Tor Proxy Domain in DNS Lookup (onion .pet)"; dns.query; dotprefix; content:".onion.pet"; nocase; endswith; classtype:domain-c2; sid:2035461; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_15, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_03_15;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp adID SELECT"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"adID="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007118; classtype:web-application-attack; sid:2007118; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Linux/B1txor20 Backdoor Related Domain in DNS Lookup"; dns.query; dotprefix; content:".webserv.systems"; nocase; endswith; reference:url,blog.netlab.360.com/b1txor20-use-of-dns-tunneling_cn/; classtype:command-and-control; sid:2035458; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_15, deployment Perimeter, signature_severity Major, updated_at 2022_03_15;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp adID UNION SELECT"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"adID="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007119; classtype:web-application-attack; sid:2007119; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MSIL/TrojanDownloader.Agent.KUO CnC Activity M1"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"/tst/ins_cont.php"; startswith; bsize:17; fast_pattern; http.host; pcre:"/^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/W"; http.header_names; content:!"Referer"; http.user_agent; content:"Mozilla/4.0"; bsize:11; reference:md5,f6cb005907be5516394525da16d427c7; reference:url,seguranca-informatica.pt/brazilian-trojan-impacting-portuguese-users-and-using-the-same-capabilities-seen-in-other-latin-american-threats; classtype:trojan-activity; sid:2035459; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_15, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_03_15;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp adID INSERT"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"adID="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007120; classtype:web-application-attack; sid:2007120; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed Discord Domain (discord .com in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:"discord.com"; endswith; reference:md5,03f93498e1006ffa3a1f9fcb6170525a; classtype:misc-activity; sid:2035463; rev:1; metadata:created_at 2022_03_15, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp adID DELETE"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"adID="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007121; classtype:web-application-attack; sid:2007121; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed Discord Domain (discordapp .com in TLS SNI)"; flow:established,to_server; tls.sni; dotprefix; content:"discordapp.com"; endswith; reference:md5,03f93498e1006ffa3a1f9fcb6170525a; classtype:misc-activity; sid:2035464; rev:1; metadata:created_at 2022_03_15, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp adID ASCII"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"adID="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007122; classtype:web-application-attack; sid:2007122; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Webdor.NAC Variant CnC Activity"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".html?m="; content:"&c="; distance:0; content:"&v="; distance:0; content:"&myID="; content:"/"; within:255; content:"/"; within:10; http.user_agent; content:"Catalyst"; bsize:8; fast_pattern; reference:md5,1e2a28d5f4f03420df7a6766e0e4277c; classtype:trojan-activity; sid:2035456; rev:1; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_15, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_03_15;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- compareHomes.asp adID UPDATE"; flow:established,to_server; http.uri; content:"/compareHomes.asp?"; nocase; content:"adID="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007123; classtype:web-application-attack; sid:2007123; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed Discord Domain in DNS Lookup (discord .com)"; dns.query; dotprefix; content:"discord.com"; endswith; reference:md5,03f93498e1006ffa3a1f9fcb6170525a; classtype:misc-activity; sid:2035465; rev:1; metadata:created_at 2022_03_15, updated_at 2022_03_15;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp aminprice SELECT"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"aminprice="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007124; classtype:web-application-attack; sid:2007124; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE MSIL/TrojanDownloader.Agent.KUO CnC Activity M2"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/dwn.php"; endswith; fast_pattern; http.host; pcre:"/^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$/W"; http.header; content:"DNT: 1"; http.header_names; content:!"Referer"; content:"|0d 0a|Host|0d 0a|DNT|0d 0a|Connection|0d 0a 0d 0a|"; http.user_agent; content:"Mozilla/5.0 (Windows NT 6.1|3b 20|Trident/7.0|3b 20|rv:11.0) like Gecko"; bsize:61; reference:md5,f6cb005907be5516394525da16d427c7; reference:url,seguranca-informatica.pt/brazilian-trojan-impacting-portuguese-users-and-using-the-same-capabilities-seen-in-other-latin-american-threats; classtype:trojan-activity; sid:2035460; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_15, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_03_15;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp amaxprice INSERT"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"amaxprice="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007132; classtype:web-application-attack; sid:2007132; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)"; dns.query; dotprefix; content:"discordapp.com"; endswith; reference:md5,03f93498e1006ffa3a1f9fcb6170525a; classtype:misc-activity; sid:2035466; rev:1; metadata:created_at 2022_03_15, updated_at 2022_03_15;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp aminprice DELETE"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"aminprice="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007127; classtype:web-application-attack; sid:2007127; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT TP-LINK TL-WR840N RCE Inbound (CVE-2022-25064)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cgi?2&2"; fast_pattern; http.request_body; content:"|0d 0a|X_TP_FirewallEnabled"; content:"|0d 0a|X_TP_ExternalIPv6Address="; distance:0; pcre:"/^(?:\x3b|\x0a|\x26|\x60|\x7C|\x24)/R"; reference:cve,2022-25064; classtype:attempted-admin; sid:2035455; rev:1; metadata:created_at 2022_03_15, cve CVE_2022_25064, former_category EXPLOIT, updated_at 2022_03_15;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp aminprice ASCII"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"aminprice="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007128; classtype:web-application-attack; sid:2007128; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET MALWARE HermeticWizard - WMI Spreader - Remote Process Creation M1"; flow:established,to_server; content:"|05 00 00|"; content:"W|00|i|00|n|00|3|00|2|00|_|00|P|00|r|00|o|00|c|00|e|00|s|00|s|00|"; distance:0; content:"C|00|r|00|e|00|a|00|t|00|e|00|"; within:200; content:"regsvr32|2e|exe|20 2f|s|20 2f|i|20|"; distance:0; fast_pattern; content:"|5c|c"; within:500; pcre:"/^[A-F0-9]{12}/R"; content:"|2e|dll|00|"; within:5; reference:url,www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine/; reference:md5,517d2b385b846d6ea13b75b8adceb061; classtype:trojan-activity; sid:2035418; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_and_Server, created_at 2022_03_09, deployment Internal, deployment Datacenter, former_category MALWARE, malware_family HermeticWizard, signature_severity Major, updated_at 2022_03_15;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp aminprice UPDATE"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"aminprice="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007129; classtype:web-application-attack; sid:2007129; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert tls [195.22.26.192/26,195.22.28.192/27,195.38.137.100,195.22.4.21,195.157.15.100,212.61.180.100] 443 -> $HOME_NET any (msg:"ET MALWARE AnubisNetworks Sinkhole SSL Cert lolcat - specific IPs"; flow:established,to_client; tls.cert_subject; content:"CN=lolcat"; fast_pattern; flowbits:isnotset,ET.invalid.cab; classtype:trojan-activity; sid:2019628; rev:6; metadata:attack_target Client_Endpoint, created_at 2014_11_03, deployment Perimeter, former_category MALWARE, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp amaxprice SELECT"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"amaxprice="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007130; classtype:web-application-attack; sid:2007130; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"ET POLICY Remote Desktop AeroAdmin handshake"; flow:established,to_server; content:"|e1 00 00 00 00|"; depth:5; content:"|0d 00 00 d8 00 00 00 4d 49 47 64 4d 41|"; distance:1; within:13; fast_pattern; threshold: type limit, track by_src, count 1, seconds 30; reference:md5,5003c00cdd28d6d1461e9a6a76c544a6; classtype:policy-violation; sid:2035467; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_16, deployment Perimeter, former_category POLICY, performance_impact Low, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp amaxprice UNION SELECT"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"amaxprice="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007131; classtype:web-application-attack; sid:2007131; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING SUSPICIOUS OVH Shared Host SSL Certificate (Observed In Use by Some Trojans)"; flow:established,to_client; tls.cert_subject; content:"CN=ssl"; content:".ovh.net"; within:10; fast_pattern; pcre:"/CN=ssl\d{1,2}.ovh.net(?:$|,)/"; reference:url,help.ovh.co.uk/SslOnHosting; reference:md5,63079a2471fc18323f355ec28f36303c; reference:md5,20b1c30ef1f5dae656529b277e5b73fb; classtype:bad-unknown; sid:2018364; rev:3; metadata:attack_target Client_Endpoint, created_at 2014_04_05, deployment Perimeter, former_category POLICY, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp amaxprice DELETE"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"amaxprice="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007133; classtype:web-application-attack; sid:2007133; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE rat-test CnC Response"; flow:established,to_client; dsize:8; content:"d|00|o|00|n|00|e|00|"; nocase; flowbits:isset,ET.tcpraw.png; reference:md5,a271e5179f0a98a295736bd7a41a39fc; reference:url,twitter.com/James_inthe_box/status/1501604645759709186; classtype:trojan-activity; sid:2035477; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_03_16, deployment Perimeter, former_category MALWARE, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp amaxprice ASCII"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"amaxprice="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007134; classtype:web-application-attack; sid:2007134; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp-pkt $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/PlugX Related Activity"; flow:established,to_server; dsize:6; content:"feiji."; fast_pattern; reference:url,twitter.com/0xrb/status/1503983616321552384; reference:md5,ff82ecc7bee903f3eb2e168855598d37; reference:md5,ae0bd618eedec0b1ba9f149333d08837; classtype:trojan-activity; sid:2035473; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_16, deployment Perimeter, former_category MALWARE, malware_family PlugX, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp amaxprice UPDATE"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"amaxprice="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007135; classtype:web-application-attack; sid:2007135; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING ZIP file exfiltration over raw TCP"; flow:established,to_server; stream_size:server,<,5; dsize:>11; content:"PK|03 04|"; fast_pattern; startswith; byte_test:1,<=,20,0,relative; content:"|00 00 00|"; distance: 1; within:3; reference:url,users.cs.jmu.edu/buchhofp/forensics/formats/pkzip.html; classtype:misc-activity; sid:2035478; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_03_16, deployment Perimeter, former_category HUNTING, performance_impact Moderate, signature_severity Informational, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp abedrooms SELECT"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"abedrooms="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007136; classtype:web-application-attack; sid:2007136; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING RAR file exfiltration over raw TCP"; flow:established,to_server; stream_size:server,<,5; dsize:>11; content:"Rar|21 1a 07 00|"; fast_pattern; startswith; content:"|73|"; distance:2; content:"|00 00|"; distance:4; reference:url,forensicswiki.xyz/page/RAR; classtype:misc-activity; sid:2035479; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_03_16, deployment Perimeter, former_category HUNTING, performance_impact Moderate, signature_severity Informational, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp abedrooms UNION SELECT"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"abedrooms="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007137; classtype:web-application-attack; sid:2007137; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING PNG image exfiltration over raw TCP"; flow:established,to_server; stream_size:server,<,160; dsize:>11; content:"|89|PNG|0d 0a 1a 0a 00 00 00 0d|IHDR|00 00|"; startswith; flowbits:set,ET.tcpraw.png; reference:md5,a271e5179f0a98a295736bd7a41a39fc; classtype:misc-activity; sid:2035476; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_03_16, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp abedrooms INSERT"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"abedrooms="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007138; classtype:web-application-attack; sid:2007138; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO imPcRemote Download"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/downloads/impcremote"; depth:21; http.host; content:"impcremote.com"; bsize:14; reference:md5,3d72ee8e1e59b143fa496fa63ca33994; classtype:attempted-admin; sid:2035475; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_03_16, deployment Perimeter, former_category INFO, signature_severity Informational, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp abedrooms DELETE"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"abedrooms="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007139; classtype:web-application-attack; sid:2007139; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING RAR file download over raw TCP"; flow:established,to_client; stream_size:client,<,5; dsize:>11; content:"Rar|21 1a 07 00|"; fast_pattern; startswith; content:"|73|"; distance:2; content:"|00 00|"; distance:4; reference:url,forensicswiki.xyz/page/RAR; classtype:misc-activity; sid:2035481; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_16, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp abedrooms ASCII"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"abedrooms="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007140; classtype:web-application-attack; sid:2007140; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING ZIP file download over raw TCP"; flow:established,to_client; stream_size:client,<,5; dsize:>11; content:"PK|03 04|"; fast_pattern; startswith; byte_test:1,<=,20,0,relative; reference:url,users.cs.jmu.edu/buchhofp/forensics/formats/pkzip.html; classtype:misc-activity; sid:2035482; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_16, deployment Perimeter, former_category HUNTING, signature_severity Informational, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthrallweb eHomes SQL Injection Attempt -- result.asp abedrooms UPDATE"; flow:established,to_server; http.uri; content:"/result.asp?"; nocase; content:"abedrooms="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6204; reference:url,www.securityfocus.com/bid/21193; reference:url,doc.emergingthreats.net/2007141; classtype:web-application-attack; sid:2007141; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp-pkt $HOME_NET any -> $EXTERNAL_NET [!80,!443,!25,!22,!110] (msg:"ET MALWARE SideCopy APT MargulasRAT Related Activity"; flow:established,to_server; dsize:19; content:"|31 36 00 2b 9c 02 0d 6e 46 11 42 7e e5 8f 99 94 1d fe 24|"; fast_pattern; reference:md5,b361a415cb5fe33f54957b1aa58fffd6; reference:md5,ae29fbacb0a0aba4b8f82924551fae4d; classtype:trojan-activity; sid:2035474; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_16, deployment Perimeter, former_category MALWARE, malware_family SideCopy, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_owned.php cat SELECT"; flow:established,to_server; http.uri; content:"/show_owned.php?"; nocase; content:"cat="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0484; reference:url,www.securityfocus.com/bid/22180; reference:url,doc.emergingthreats.net/2005256; classtype:web-application-attack; sid:2005256; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed TA471/UNC2589 Go Downloader User-Agent (-hobot-)"; flow:established,to_server; http.user_agent; content:"-hobot-"; bsize:7; reference:md5,15c525b74b7251cfa1f7c471975f3f95; reference:url,cert.gov.ua/article/37704; classtype:trojan-activity; sid:2035468; rev:1; metadata:created_at 2022_03_16, former_category MALWARE, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_owned.php cat UNION SELECT"; flow:established,to_server; http.uri; content:"/show_owned.php?"; nocase; content:"cat="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0484; reference:url,www.securityfocus.com/bid/22180; reference:url,doc.emergingthreats.net/2005257; classtype:web-application-attack; sid:2005257; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert dns $HOME_NET any -> any any (msg:"ET MALWARE Observed Cobalt Strike CnC Domain in DNS Lookup (nirsoft .me)"; dns.query; content:"nirsoft.me"; nocase; bsize:10; reference:url,cert.gov.ua/article/37704; reference:md5,aa5e8268e741346c76ebfd1f27941a14; classtype:domain-c2; sid:2035469; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_16, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_owned.php cat INSERT"; flow:established,to_server; http.uri; content:"/show_owned.php?"; nocase; content:"cat="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2007-0484; reference:url,www.securityfocus.com/bid/22180; reference:url,doc.emergingthreats.net/2005258; classtype:web-application-attack; sid:2005258; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Observed Cobalt Stike CnC  Domain (nirsoft .me in TLS SNI)"; flow:established,to_server; tls.sni; content:"nirsoft.me"; bsize:10; fast_pattern; reference:md5,aa5e8268e741346c76ebfd1f27941a14; reference:url,cert.gov.ua/article/37704; classtype:domain-c2; sid:2035470; rev:1; metadata:attack_target Client_Endpoint, created_at 2022_03_16, deployment Perimeter, performance_impact Low, signature_severity Major, updated_at 2022_03_16;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_owned.php cat DELETE"; flow:established,to_server; http.uri; content:"/show_owned.php?"; nocase; content:"cat="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0484; reference:url,www.securityfocus.com/bid/22180; reference:url,doc.emergingthreats.net/2005259; classtype:web-application-attack; sid:2005259; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ELF/lizkebab CnC Activity (Server Banner)"; flow:established,from_server; content:"***|0d 0a|*|20 20 20 20 20 20 20 20|WELCOME TO THE BALL PIT|20 20 20 20 20 20 20 20|*|0d 0a|"; fast_pattern; content:"*|20 20 20 20 20|Now with|20|"; distance:0; reference:url,blog.malwaremustdie.org/2015/11/mmd-0044-2015-source-code-disclosure.html; classtype:command-and-control; sid:2022214; rev:2; metadata:created_at 2015_12_03, former_category MALWARE, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_owned.php cat ASCII"; flow:established,to_server; http.uri; content:"/show_owned.php?"; nocase; content:"cat="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0484; reference:url,www.securityfocus.com/bid/22180; reference:url,doc.emergingthreats.net/2005260; classtype:web-application-attack; sid:2005260; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Raiffeisen Bank Phishing Landing - Title over non SSL"; flow:established,to_client; file_data; content:"Raiffeisen ELBA-internet"; fast_pattern; nocase; classtype:social-engineering; sid:2024770; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_09_27, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2022_03_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_owned.php cat UPDATE"; flow:established,to_server; http.uri; content:"/show_owned.php?"; nocase; content:"cat="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-0484; reference:url,www.securityfocus.com/bid/22180; reference:url,doc.emergingthreats.net/2005261; classtype:web-application-attack; sid:2005261; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Fiesta EK Landing Oct 09 2013"; flow:established,from_server; file_data; content:"|27|urn|3a|schemas-microsoft-com|3a|vml|27|"; content:"=String.fromCharCode|3b|"; fast_pattern; content:"return parseInt"; content:"return |27 27|"; classtype:exploit-kit; sid:2017577; rev:5; metadata:created_at 2013_10_11, former_category CURRENT_EVENTS, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_joined.php cat SELECT"; flow:established,to_server; http.uri; content:"/show_joined.php?"; nocase; content:"cat="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0484; reference:url,www.securityfocus.com/bid/22180; reference:url,doc.emergingthreats.net/2005262; classtype:web-application-attack; sid:2005262; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET MALWARE Win32.Genome.boescz Checkin"; flow:to_server,established; content:"|0d 0a|Subject|3a 20|TenInfect"; fast_pattern; content:"|0d 0a 0d 0a|TenInfect"; distance:0; reference:md5,313535d09865f3629423cd0e9b2903b2; reference:url,www.virustotal.com/en/file/75c454bbcfc06375ad1e8b45d4167d7830083202f06c6309146e9a4870cddfba/analysis/; classtype:command-and-control; sid:2018033; rev:4; metadata:created_at 2014_01_29, former_category MALWARE, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_joined.php cat UNION SELECT"; flow:established,to_server; http.uri; content:"/show_joined.php?"; nocase; content:"cat="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0484; reference:url,www.securityfocus.com/bid/22180; reference:url,doc.emergingthreats.net/2005263; classtype:web-application-attack; sid:2005263; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Lets Encrypt Free SSL Cert Observed in Tech Support Scams M9"; flow:established,from_server; content:"|55 04 0a|"; content:"|0d|Let|27|s Encrypt"; distance:1; within:14; content:"|55 04 03|"; distance:0; content:"|14|sip.discoveredzp.bid"; distance:1; within:21; fast_pattern; reference:url,blog.sucuri.net/2017/02/javascript-injections-leads-to-tech-support-scam.html; reference:url,letsencrypt.org/about/; classtype:social-engineering; sid:2024132; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_03_31, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_joined.php cat INSERT"; flow:established,to_server; http.uri; content:"/show_joined.php?"; nocase; content:"cat="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2007-0484; reference:url,www.securityfocus.com/bid/22180; reference:url,doc.emergingthreats.net/2005264; classtype:web-application-attack; sid:2005264; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Win32/Zemot Fake Search Page"; flow:established,from_server; file_data; content:"background|3a 20|url(btn_search.png|29 2f 2a|tpa=http"; fast_pattern; reference:md5,38cad3170f85c4f9903574941bd282a8; classtype:trojan-activity; sid:2021107; rev:3; metadata:created_at 2015_05_15, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_joined.php cat DELETE"; flow:established,to_server; http.uri; content:"/show_joined.php?"; nocase; content:"cat="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0484; reference:url,www.securityfocus.com/bid/22180; reference:url,doc.emergingthreats.net/2005265; classtype:web-application-attack; sid:2005265; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET [25,26,587,2525] (msg:"ET MALWARE Predator Pain Sending Data over SMTP"; flow:established,to_server; content:"Subject|3a 20|Predator Pain v"; fast_pattern; reference:md5,e774a7e6ca28487db649458f48230199; reference:url,stopmalvertising.com/malware-reports/analysis-of-the-predator-pain-keylogger.html; classtype:trojan-activity; sid:2018688; rev:4; metadata:created_at 2014_07_17, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_joined.php cat ASCII"; flow:established,to_server; http.uri; content:"/show_joined.php?"; nocase; content:"cat="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0484; reference:url,www.securityfocus.com/bid/22180; reference:url,doc.emergingthreats.net/2005266; classtype:web-application-attack; sid:2005266; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE .HTM being served from WP 1-flash-gallery Upload DIR (likely malicious)"; flow:established,to_server; content:"/wp-content/uploads/fgallery/"; fast_pattern; nocase; http_uri; content:".htm"; nocase; distance:0; http_uri; classtype:bad-unknown; sid:2015517; rev:4; metadata:created_at 2012_07_24, former_category CURRENT_EVENTS, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthusiast SQL Injection Attempt -- show_joined.php cat UPDATE"; flow:established,to_server; http.uri; content:"/show_joined.php?"; nocase; content:"cat="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-0484; reference:url,www.securityfocus.com/bid/22180; reference:url,doc.emergingthreats.net/2005267; classtype:web-application-attack; sid:2005267; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert ftp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET FTP Outbound Java Anonymous FTP Login"; flow:to_server,established; content:"USER anonymous|0d 0a|PASS Java1."; fast_pattern; pcre:"/^\d\.\d(_\d+)?\@\r\n/R"; flowbits:set,ET.Java.FTP.Logon; classtype:misc-activity; sid:2016687; rev:4; metadata:created_at 2013_03_29, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthusiast path parameter Local File Inclusion"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/show_joined.php?"; nocase; content:"path="; nocase; pcre:"/(\.\.\/){1,}/"; reference:url,secunia.com/advisories/32628/; reference:url,bugreport.ir/index_57.htm; reference:url,doc.emergingthreats.net/2008832; classtype:web-application-attack; sid:2008832; rev:7; metadata:affected_product Web_Server_Applications, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Local_File_Inclusion, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK (Known Evil Keitaro TDS)"; flow:established,from_server; flowbits:isset,ET.Keitaro; content:"302"; http_stat_code; content:"LOCATION|3a 20|http"; http_header; content:"Expires|3a 20|Thu, 21 Jul 1977 07|3a|30|3a|00 GMT|0d 0a|"; http_header; fast_pattern; classtype:exploit-kit; sid:2022465; rev:5; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_01_28, deployment Perimeter, signature_severity Major, tag Redirector, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Enthusiast path parameter Remote File Inclusion"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/show_joined.php?"; nocase; content:"path="; nocase; pcre:"/path=\s*(ftps?|https?|php)\:\//i"; reference:url,secunia.com/advisories/32628/; reference:url,bugreport.ir/index_57.htm; reference:url,doc.emergingthreats.net/2008833; classtype:web-application-attack; sid:2008833; rev:7; metadata:created_at 2010_07_30, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Google Drive Phishing Landing M1 July 24 2015"; flow:to_client,established; file_data; content:"Document Shared"; nocase; fast_pattern; content:"name=|22|GENERATOR|22 22|>"; nocase; distance:0; content:"name=|22|HOSTING|22 22|>"; nocase; distance:0; content:"Login with your email"; nocase; distance:0; content:"Choose your email provider"; nocase; distance:0; classtype:social-engineering; sid:2021535; rev:4; metadata:created_at 2015_07_27, former_category CURRENT_EVENTS, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Eric GUILLAUME uploader&downloader SQL Injection Attempt -- administre2.php id_user SELECT"; flow:established,to_server; http.uri; content:"/administration/administre2.php?"; nocase; content:"id_user="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6716; reference:url,www.milw0rm.com/exploits/2945; reference:url,doc.emergingthreats.net/2006219; classtype:web-application-attack; sid:2006219; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Chase Phishing Landing - Title over non SSL"; flow:established,to_client; file_data; content:"Chase Online - Identification"; fast_pattern; nocase; classtype:social-engineering; sid:2025674; rev:4; metadata:created_at 2015_12_01, former_category CURRENT_EVENTS, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Eric GUILLAUME uploader&downloader SQL Injection Attempt -- administre2.php id_user UNION SELECT"; flow:established,to_server; http.uri; content:"/administration/administre2.php?"; nocase; content:"id_user="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6716; reference:url,www.milw0rm.com/exploits/2945; reference:url,doc.emergingthreats.net/2006220; classtype:web-application-attack; sid:2006220; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Fake Virus Phone Scam Landing Oct 19 M4"; flow:established,to_server; content:"GET"; http_method; content:"WINDOWS HEALTH IS CRITICAL"; http_uri; fast_pattern; classtype:social-engineering; sid:2021966; rev:4; metadata:created_at 2015_10_19, former_category WEB_CLIENT, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Eric GUILLAUME uploader&downloader SQL Injection Attempt -- administre2.php id_user INSERT"; flow:established,to_server; http.uri; content:"/administration/administre2.php?"; nocase; content:"id_user="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6716; reference:url,www.milw0rm.com/exploits/2945; reference:url,doc.emergingthreats.net/2006221; classtype:web-application-attack; sid:2006221; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Sweet Orange Landing Page Oct 25 2013"; flow:established,from_server; file_data; content:"domestic transit area.
"; fast_pattern; content:"display"; nocase; pcre:"/^[\r\n\s]*?\x3a[\r\n\s]*?none/Ri"; content:"]*?\>/R"; content:!""; nocase; within:500; flowbits:set,et.exploitkitlanding; classtype:exploit-kit; sid:2017634; rev:8; metadata:created_at 2013_10_25, former_category EXPLOIT_KIT, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Eric GUILLAUME uploader&downloader SQL Injection Attempt -- administre2.php id_user ASCII"; flow:established,to_server; http.uri; content:"/administration/administre2.php?"; nocase; content:"id_user="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6716; reference:url,www.milw0rm.com/exploits/2945; reference:url,doc.emergingthreats.net/2006223; classtype:web-application-attack; sid:2006223; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Apple Store Phish Landing 2015-07-30"; flow:to_client,established; file_data; content:"Sign in - Apple Store"; nocase; fast_pattern; content:"function isemail|28|email|29|"; nocase; content:"Double-check that you typed a valid Apple ID."; nocase; content:"Double-check that you have typed the right password."; nocase; classtype:social-engineering; sid:2031715; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2015_07_30, deployment Perimeter, former_category PHISHING, signature_severity Minor, tag Phishing, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Eric GUILLAUME uploader&downloader SQL Injection Attempt -- administre2.php id_user UPDATE"; flow:established,to_server; http.uri; content:"/administration/administre2.php?"; nocase; content:"id_user="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6716; reference:url,www.milw0rm.com/exploits/2945; reference:url,doc.emergingthreats.net/2006224; classtype:web-application-attack; sid:2006224; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Internet Explorer Memory Corruption Vulnerability (CVE-2015-2444)"; flow:from_server,established; file_data; content:"|3c 66 6f 72 6d 3e 3c 73 74 79 6c 65 3e 66 6f 72 6d 7b 2d 6d 73 2d 62 65 68 61 76 69 6f 72 3a 75 72 6c 28 22 63 22 29 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 66 6f 72 6d 3e|"; nocase; fast_pattern; reference:cve,2015-2444; classtype:attempted-user; sid:2021713; rev:4; metadata:created_at 2015_08_25, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Eric GUILLAUME uploader&downloader SQL Injection Attempt -- administre2.php id_user DELETE"; flow:established,to_server; http.uri; content:"/administration/administre2.php?"; nocase; content:"id_user="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6716; reference:url,www.milw0rm.com/exploits/2945; reference:url,doc.emergingthreats.net/2006222; classtype:web-application-attack; sid:2006222; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Evil Redirect Compromised WP Feb 01 2016"; flow:established,from_server; file_data; content:"|5c 22 5d 5d 2e 6a 6f 69 6e 28 5c 22 5c 22 29 3b 22 29 29 3b 2f 2a|"; fast_pattern; pcre:"/^\s*[a-f0-9]{32}\s*\x2a\x2f/R"; reference:url,blog.sucuri.net/2016/02/massive-admedia-iframe-javascript-infection.html; classtype:trojan-activity; sid:2022481; rev:5; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_02_02, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag Redirector, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS E-SMARTCART SQL Injection Attempt -- productdetail.asp product_id SELECT"; flow:established,to_server; http.uri; content:"/productdetail.asp?"; nocase; content:"product_id="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0092; reference:url,www.milw0rm.com/exploits/3074; reference:url,doc.emergingthreats.net/2005877; classtype:web-application-attack; sid:2005877; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Ultimate HAckerz Team User-Agent (Made by UltimateHackerzTeam) - Likely Trojan Report"; flow:established,to_server; content:"User-Agent|3a| Mozilla/4.0 (compatible|3b| MSIE 6.0|3b| Windows NT 5.1|3b| SV1|3b| Made by UltimateHackerzTeam)"; http_header; fast_pattern; reference:url,doc.emergingthreats.net/2010346; classtype:trojan-activity; sid:2010346; rev:7; metadata:created_at 2010_07_30, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS E-SMARTCART SQL Injection Attempt -- productdetail.asp product_id UNION SELECT"; flow:established,to_server; http.uri; content:"/productdetail.asp?"; nocase; content:"product_id="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0092; reference:url,www.milw0rm.com/exploits/3074; reference:url,doc.emergingthreats.net/2005878; classtype:web-application-attack; sid:2005878; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Old/Rare PDF Generator Acrobat Distiller 6.0.1 (Windows)"; flow:from_server,established; flowbits:isset,ET.pdf.in.http; file_data; content:"Acrobat Distiller 6.0.1 (Windows)"; fast_pattern; reference:url,carnal0wnage.attackresearch.com/2013/03/apt-pdfs-and-metadata-extraction.html; classtype:not-suspicious; sid:2016650; rev:3; metadata:created_at 2013_03_22, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS E-SMARTCART SQL Injection Attempt -- productdetail.asp product_id INSERT"; flow:established,to_server; http.uri; content:"/productdetail.asp?"; nocase; content:"product_id="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2007-0092; reference:url,www.milw0rm.com/exploits/3074; reference:url,doc.emergingthreats.net/2005879; classtype:web-application-attack; sid:2005879; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert smb any any -> $HOME_NET any (msg:"ET EXPLOIT Possible Successful ETERNALROMANCE MS17-010 - Windows Executable Observed"; flow:to_server,established; flowbits:isset,ETPRO.ETERNALROMANCE; content:"|FF|SMB|26 00 00 00 00|"; offset:4; depth:9; content:"|4d 5a|"; distance:0; content:"This program cannot be run"; nocase; distance:0; fast_pattern; classtype:trojan-activity; sid:2024207; rev:3; metadata:attack_target SMB_Server, created_at 2017_04_17, deployment Internal, former_category EXPLOIT, signature_severity Critical, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS E-SMARTCART SQL Injection Attempt -- productdetail.asp product_id DELETE"; flow:established,to_server; http.uri; content:"/productdetail.asp?"; nocase; content:"product_id="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0092; reference:url,www.milw0rm.com/exploits/3074; reference:url,doc.emergingthreats.net/2005880; classtype:web-application-attack; sid:2005880; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Wire Transfer Phishing Landing 2015-11-19"; flow:established,from_server; file_data; content:"Foreign Transfer"; nocase; fast_pattern; content:"view Online TT Copy"; nocase; distance:0; content:"Online TT(CURRENCY"; nocase; distance:0; content:"Email Address"; nocase; distance:0; content:"Secure access"; nocase; distance:0; classtype:social-engineering; sid:2031700; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_11_19, deployment Perimeter, former_category PHISHING, signature_severity Major, tag Phishing, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS E-SMARTCART SQL Injection Attempt -- productdetail.asp product_id ASCII"; flow:established,to_server; http.uri; content:"/productdetail.asp?"; nocase; content:"product_id="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0092; reference:url,www.milw0rm.com/exploits/3074; reference:url,doc.emergingthreats.net/2005881; classtype:web-application-attack; sid:2005881; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DoS.Linux/Elknot.G Checkin"; flow:established,to_server; dsize:401; content:!"|00 00|"; depth:2; content:"|00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|Linux|20|"; offset:2; depth:21; fast_pattern; pcre:"/^\d/R"; reference:md5,917a2a3d8c30282acbe7b1ff121a4336; classtype:command-and-control; sid:2018808; rev:2; metadata:created_at 2014_07_30, former_category MALWARE, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS E-SMARTCART SQL Injection Attempt -- productdetail.asp product_id UPDATE"; flow:established,to_server; http.uri; content:"/productdetail.asp?"; nocase; content:"product_id="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-0092; reference:url,www.milw0rm.com/exploits/3074; reference:url,doc.emergingthreats.net/2005882; classtype:web-application-attack; sid:2005882; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE BleedingLife EK Payload Delivered"; flow:from_server,established; flowbits:isset,ET.BleedingLife.Payload; content:"200"; http_stat_code; content:"Content-Disposition|3a 20|attachment|3b 20|filename="; http_header; fast_pattern; content:"Content-Type|3a 20|application/"; http_header; file_data; content:"MZ"; within:2; byte_jump:4,58,relative,little; content:"PE|00 00|"; distance:-64; within:4; classtype:exploit-kit; sid:2023291; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2016_09_23, deployment Perimeter, former_category MALWARE, malware_family Exploit_Kit, malware_family BleedingLife, signature_severity Major, tag BleedingLifeEK, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EvimGibi Pro Resim Galerisi kat_id parameter SQL Injection"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/resim.asp?"; nocase; content:"islem=altkat"; nocase; content:"kat_id="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:url,secunia.com/advisories/33199/; reference:url,packetstorm.linuxsecurity.com/0812-exploits/evimgibi-sql.txt; reference:url,doc.emergingthreats.net/2008998; classtype:web-application-attack; sid:2008998; rev:8; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Google Drive Phishing Landing Sept 3"; flow:established,from_server; file_data; content:"<title>Google Drive"; fast_pattern; content:"For security reasons"; distance:0; content:"access shared files and folders"; distance:0; content:"select your email provider below"; distance:0; content:"-- Select your email provider --"; distance:0; content:"G Mail"; distance:0; content:"Others"; distance:0; content:"Email:"; distance:0; content:"Password:"; distance:0; classtype:social-engineering; sid:2025004; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_09_09, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag Phishing, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS e-Vision CMS SQL Injection Attempt -- style.php template SELECT"; flow:established,to_server; http.uri; content:"/style.php?"; nocase; content:"template="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-3214; reference:url,www.milw0rm.com/exploits/4054; reference:url,doc.emergingthreats.net/2005336; classtype:web-application-attack; sid:2005336; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing June 11 2015 M3"; flow:established,to_client; file_data; content:"VIRUS WARNING!"; nocase; fast_pattern; content:"myFunction|28 29|"; nocase; distance:0; content:"gp-msg.mp3"; nocase; distance:0; classtype:social-engineering; sid:2021258; rev:4; metadata:created_at 2015_06_11, former_category WEB_CLIENT, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS e-Vision CMS SQL Injection Attempt -- style.php template UNION SELECT"; flow:established,to_server; http.uri; content:"/style.php?"; nocase; content:"template="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-3214; reference:url,www.milw0rm.com/exploits/4054; reference:url,doc.emergingthreats.net/2005337; classtype:web-application-attack; sid:2005337; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Google Drive Phishing Landing Nov 6 2015 M1"; flow:established,from_server; file_data; content:"Google Docs"; nocase; distance:0; fast_pattern; content:"input[type=email]"; nocase; distance:0; content:"input[type=number]"; nocase; distance:0; content:"input[type=password]"; nocase; distance:0; content:"input[type=tel]"; nocase; distance:0; content:"signin-card #Email"; nocase; distance:0; content:"signin-card #Pass"; nocase; distance:0; classtype:social-engineering; sid:2025681; rev:4; metadata:attack_target Client_Endpoint, created_at 2015_11_06, deployment Perimeter, former_category CURRENT_EVENTS, signature_severity Major, tag Phishing, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS e-Vision CMS SQL Injection Attempt -- style.php template INSERT"; flow:established,to_server; http.uri; content:"/style.php?"; nocase; content:"template="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2007-3214; reference:url,www.milw0rm.com/exploits/4054; reference:url,doc.emergingthreats.net/2005338; classtype:web-application-attack; sid:2005338; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Karagany.Downloader CnC Beacon"; flow:established,to_server; urilen:6; content:".htm"; http_uri; content:"Mozilla/5.0 (compatible|3B| MSIE 9.0|3B| Windows NT 6.0|3B| Trident/5.0)"; fast_pattern; http_user_agent; pcre:"/^\x2F[a-z]{1}\x2Ehtm$/U"; threshold: type limit, track by_src, seconds 60, count 1; reference:url,malwaremustdie.blogspot.co.uk/2013/01/once-upon-time-with-cool-exploit-kit.html; reference:url,www.fortiguard.com/latest/av/4057936; reference:md5,92899c20da4d9db5627af89998aadc58; classtype:command-and-control; sid:2016211; rev:6; metadata:attack_target Client_Endpoint, created_at 2013_01_15, deployment Perimeter, former_category MALWARE, signature_severity Major, tag c2, updated_at 2022_03_17, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS e-Vision CMS SQL Injection Attempt -- style.php template DELETE"; flow:established,to_server; http.uri; content:"/style.php?"; nocase; content:"template="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-3214; reference:url,www.milw0rm.com/exploits/4054; reference:url,doc.emergingthreats.net/2005339; classtype:web-application-attack; sid:2005339; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible FortDisco POP3 Site list download"; flow:established,to_server; content:"GET"; http_method; content:"User-Agent|3a 20|PrototypeB|0d 0a|"; http_header; fast_pattern; content:!"Accept|3a 20|"; http_header; content:!"Referer|3a 20|"; http_header; reference:md5,538a4cedad8791e27088666a4a6bf9c5; reference:md5,87c21bc9c804cefba6bb4148dbe4c4de; reference:url,www.abuse.ch/?p=5813; classtype:trojan-activity; sid:2017546; rev:4; metadata:created_at 2013_09_30, former_category CURRENT_EVENTS, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS e-Vision CMS SQL Injection Attempt -- style.php template ASCII"; flow:established,to_server; http.uri; content:"/style.php?"; nocase; content:"template="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-3214; reference:url,www.milw0rm.com/exploits/4054; reference:url,doc.emergingthreats.net/2005340; classtype:web-application-attack; sid:2005340; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Apple Account Phishing Landing 2015-11-18"; flow:established,from_server; file_data; content:"Verify Apple ID"; nocase; fast_pattern; content:"Please input a valid Email"; nocase; distance:0; content:"Your password is required"; nocase; distance:0; content:"Please sign in to verify"; nocase; distance:0; content:"iCloud Account"; nocase; distance:0; content:"Account Verification"; nocase; distance:0; classtype:social-engineering; sid:2031740; rev:4; metadata:attack_target Client_Endpoint, created_at 2015_11_18, deployment Perimeter, former_category PHISHING, signature_severity Major, tag Phishing, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS e-Vision CMS SQL Injection Attempt -- style.php template UPDATE"; flow:established,to_server; http.uri; content:"/style.php?"; nocase; content:"template="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-3214; reference:url,www.milw0rm.com/exploits/4054; reference:url,doc.emergingthreats.net/2005341; classtype:web-application-attack; sid:2005341; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Successful Horde Webmail Phish 2015-08-21"; flow:established,to_client; file_data; content:"<title>|2e 2e 3a 3a|Account Details"; fast_pattern; content:"Successfully Submitted|3a 3a 2e 2e|"; distance:1; content:"Your request has been received"; distance:0; content:"and will be processed shortly."; distance:1; classtype:credential-theft; sid:2031726; rev:6; metadata:attack_target Client_Endpoint, created_at 2015_08_21, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2022_03_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno SELECT"; flow:established,to_server; http.uri; content:"/products.asp?"; nocase; content:"partno="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6207; reference:url,www.securityfocus.com/bid/21323; reference:url,doc.emergingthreats.net/2007060; classtype:web-application-attack; sid:2007060; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT CottonCastle/Niteris EK POST Beacon April 29 2015"; flow:established,to_server; content:"POST"; http_method; content:"0/"; http_uri; content:"Content-Type|3a 20|application/x-www-form-urlencoded|0d 0a|"; http_header; fast_pattern; content:"%"; http_client_body; pcre:"/^\/[a-z]+\/[a-z]+\//U"; pcre:"/^-?\d+=(?:[a-zA-Z0-9]|%[A-F0-9]{2}){2}(?P(?:[a-zA-Z0-9]|%[A-F0-9]{2}))(?:[a-zA-Z0-9]|%[A-F0-9]{2}){6}(?P(?:[a-zA-Z0-9]|%[A-F0-9]{2}))(?:[a-zA-Z0-9]|%[A-F0-9]{2}){2}(?P=var2)(?:[a-zA-Z0-9]|%[A-F0-9]{2}){4}(?P=var1)/P"; classtype:exploit-kit; sid:2021038; rev:5; metadata:attack_target Client_Endpoint, created_at 2015_04_30, deployment Perimeter, former_category EXPLOIT_KIT, signature_severity Major, tag c2, updated_at 2022_03_17, mitre_tactic_id TA0011, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno UNION SELECT"; flow:established,to_server; http.uri; content:"/products.asp?"; nocase; content:"partno="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6207; reference:url,www.securityfocus.com/bid/21323; reference:url,doc.emergingthreats.net/2007061; classtype:web-application-attack; sid:2007061; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Bladabindi/njrat CnC Command Response (Remote Cam)"; flow:to_server,established; content:"USB Video Device[endof]"; depth:23; fast_pattern; dsize:>0; reference:url,threatgeek.com/2013/07/njrat-detection-rules-using-yara-.html; classtype:command-and-control; sid:2017425; rev:3; metadata:created_at 2013_09_05, former_category MALWARE, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno INSERT"; flow:established,to_server; http.uri; content:"/products.asp?"; nocase; content:"partno="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6207; reference:url,www.securityfocus.com/bid/21323; reference:url,doc.emergingthreats.net/2007062; classtype:web-application-attack; sid:2007062; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Datamaikon Checkin"; flow:to_server,established; content:"/index.dat?"; http_uri; content:"Mozilla/4.0 (compatible|3B| MSIE 6.0|3B| Win32)|0D 0A|Host|3a| "; fast_pattern; http_header; pcre:"/\/index.dat\?\d{5,9}$/U"; classtype:command-and-control; sid:2014466; rev:5; metadata:created_at 2012_04_04, former_category MALWARE, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno DELETE"; flow:established,to_server; http.uri; content:"/products.asp?"; nocase; content:"partno="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6207; reference:url,www.securityfocus.com/bid/21323; reference:url,doc.emergingthreats.net/2007063; classtype:web-application-attack; sid:2007063; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Generic Phishing Landing Jul 28 2015"; flow:established,to_client; file_data; content:"function ValidateFormOther()"; fast_pattern; classtype:social-engineering; sid:2021537; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2015_07_28, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2022_03_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno ASCII"; flow:established,to_server; http.uri; content:"/products.asp?"; nocase; content:"partno="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6207; reference:url,www.securityfocus.com/bid/21323; reference:url,doc.emergingthreats.net/2007064; classtype:web-application-attack; sid:2007064; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE WORM_VOBFUS Checkin Generic 2"; flow:established,to_server; content:"Mozilla/4.0 (compatible|3b| MSIE 7.0|3b| Windows NT 5.1|3b| SV1)|0d 0a|"; fast_pattern; content:!"|0d 0a|Accept|3a|"; content:!"|0d 0a|Referer|3a|"; content:"GET "; depth:4; pcre:"/^\/[A-Za-z]{2,}\/\?[a-z]\sHTTP\/1\.[0-1]\r\nUser-Agent\x3a Mozilla\/4\.0 \x28compatible\x3b MSIE 7\.0\x3b Windows NT 5\.1\x3b SV1\x29\r\nHost\x3a\x20[^\r\n]+?(?:\x3a(443|8080|900[0-9]))?\r\n(?:Connection\x3a\x20Keep-Alive\r\n)?\r\n$/R"; reference:md5,f127ed76dc5e48f69a1070f314488ce2; reference:url,blog.trendmicro.com/trendlabs-security-intelligence/watch-out-for-worm_vobfus/; reference:url,blog.dynamoo.com/2012/11/vobfus-sites-to-block.html; classtype:command-and-control; sid:2017784; rev:5; metadata:created_at 2013_11_27, former_category MALWARE, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Evolve shopping cart SQL Injection Attempt -- products.asp partno UPDATE"; flow:established,to_server; http.uri; content:"/products.asp?"; nocase; content:"partno="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6207; reference:url,www.securityfocus.com/bid/21323; reference:url,doc.emergingthreats.net/2007065; classtype:web-application-attack; sid:2007065; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET WEB_CLIENT Tech Support Phone Scam Landing Aug 10 M1"; flow:to_server,established; content:"GET"; http_method; content:"/please-fix-immediately-"; nocase; fast_pattern; http_uri; content:"/index.html"; nocase; distance:0; http_uri; pcre:"/[A-Za-z0-9]{10,20}_14[0-9]{8,}\/index\.html$/Ui"; classtype:social-engineering; sid:2023037; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_08_10, deployment Perimeter, former_category WEB_CLIENT, performance_impact Low, signature_severity Major, tag Phishing, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ExBB threadstop.php exbb Parameter Local File Inclusion"; flow:to_server,established; content:"../"; http.method; content:"GET"; http.uri; content:"/threadstop/threadstop.php?"; nocase; content:"exbb[default_lang]="; nocase; reference:bugtraq,28686; reference:url,milw0rm.com/exploits/5405; reference:url,doc.emergingthreats.net/2009428; classtype:web-application-attack; sid:2009428; rev:7; metadata:affected_product Web_Server_Applications, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Local_File_Inclusion, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Tech Support Phone Scam Landing M4 Jun 3"; flow:from_server,established; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"System Official"; nocase; fast_pattern; content:"function stopNavigate"; nocase; distance:0; content:"<audio autoplay="; nocase; content:"autoplay"; nocase; distance:1; classtype:social-engineering; sid:2022853; rev:4; metadata:created_at 2016_06_03, former_category WEB_CLIENT, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ExoPHPDesk SQL Injection Attempt -- faq.php id SELECT"; flow:established,to_server; http.uri; content:"/faq.php?"; nocase; content:"id="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0676; reference:url,www.milw0rm.com/exploits/3234; reference:url,doc.emergingthreats.net/2005081; classtype:web-application-attack; sid:2005081; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Successful Apple Phish Feb 09 2017"; flow:to_server,established; content:"POST"; http_method; content:"login="; depth:6; nocase; http_client_body; content:"&pass="; nocase; distance:0; http_client_body; content:"&submit=Sign+In&curl_version="; nocase; distance:0; http_client_body; fast_pattern; classtype:credential-theft; sid:2023888; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_02_09, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2022_03_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ExoPHPDesk SQL Injection Attempt -- faq.php id UNION SELECT"; flow:established,to_server; http.uri; content:"/faq.php?"; nocase; content:"id="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0676; reference:url,www.milw0rm.com/exploits/3234; reference:url,doc.emergingthreats.net/2005082; classtype:web-application-attack; sid:2005082; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Spartan EK Secondary Flash Exploit DL"; flow:established,from_server; content:"|43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 69 6e 6c 69 6e 65 3b 20 66 69 6c 65 6e 61 6d 65 3d 0d 0a|"; fast_pattern; http_header; file_data; content:"|3c 74 6f 70 70 69 6e 67 73 3e|"; reference:url,www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=854; classtype:exploit-kit; sid:2021762; rev:3; metadata:created_at 2015_09_12, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ExoPHPDesk SQL Injection Attempt -- faq.php id INSERT"; flow:established,to_server; http.uri; content:"/faq.php?"; nocase; content:"id="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2007-0676; reference:url,www.milw0rm.com/exploits/3234; reference:url,doc.emergingthreats.net/2005083; classtype:web-application-attack; sid:2005083; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Horde Webmail Phishing Landing 2015-08-21"; flow:established,to_client; file_data; content:"<title>Mail |3a 3a 20|Welcome to Admin Portal"; content:"Kindly update your information"; fast_pattern; distance:0; content:"Email Address"; distance:0; content:"Confirm Password"; distance:0; classtype:social-engineering; sid:2031725; rev:4; metadata:created_at 2015_08_21, former_category PHISHING, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ExoPHPDesk SQL Injection Attempt -- faq.php id DELETE"; flow:established,to_server; http.uri; content:"/faq.php?"; nocase; content:"id="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0676; reference:url,www.milw0rm.com/exploits/3234; reference:url,doc.emergingthreats.net/2005084; classtype:web-application-attack; sid:2005084; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Successful Generic AES Phish M1 Oct 24 2017"; flow:established,from_server; flowbits:isset,ET.genericphish; file_data; content:"hea2p"; distance:0; nocase; content:"0123456789ABCDEFGHIJKLMNOPQRSTUVXYZabcdefghijklmnopqrstuvxyz"; fast_pattern; distance:0; content:"hea2t"; distance:0; nocase; content:"Aes"; nocase; distance:0; pcre:"/^\s*?\.\s*?Ctr\s*?\.\s*?decrypt/Rsi"; classtype:credential-theft; sid:2024997; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_10_24, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2022_03_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ExoPHPDesk SQL Injection Attempt -- faq.php id ASCII"; flow:established,to_server; http.uri; content:"/faq.php?"; nocase; content:"id="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0676; reference:url,www.milw0rm.com/exploits/3234; reference:url,doc.emergingthreats.net/2005085; classtype:web-application-attack; sid:2005085; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Fake Webmail Account Phishing Landing 2015-09-10"; flow:established,to_client; file_data; content:"Verify Your Account"; fast_pattern; content:"ACCOUNT UPGRADE"; distance:0; content:"VERIFY YOUR WEBMAIL ACCOUNT"; distance:0; content:"Domain|5c|Username"; distance:0; content:"Department|3a|"; distance:0; content:"inconveniences"; distance:0; classtype:social-engineering; sid:2031696; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_09_10, deployment Perimeter, former_category PHISHING, signature_severity Major, tag Phishing, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS ExoPHPDesk SQL Injection Attempt -- faq.php id UPDATE"; flow:established,to_server; http.uri; content:"/faq.php?"; nocase; content:"id="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-0676; reference:url,www.milw0rm.com/exploits/3234; reference:url,doc.emergingthreats.net/2005086; classtype:web-application-attack; sid:2005086; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing June 26 2015 M4"; flow:established,to_client; file_data; content:"div class=|22|what-to-do|22|"; content:"div class=|22|more-about-the-virus|22|"; fast_pattern; distance:0; content:"div class=|22|service|22|"; distance:0; content:"div class=|22|windows-logo|22|"; distance:0; classtype:social-engineering; sid:2021365; rev:4; metadata:created_at 2015_06_29, former_category WEB_CLIENT, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Experts answer.php question_id parameter SQL Injection"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/answer.php?"; nocase; content:"question_id="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,2008-5267; reference:url,milw0rm.com/exploits/5776; reference:bugtraq,29642; reference:url,doc.emergingthreats.net/2008931; classtype:web-application-attack; sid:2008931; rev:7; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DRIVEBY Nuclear EK Landing Feb 03 2015 M2"; flow:established,from_server; content:"Server|3a 20|nginx"; http_header; file_data; content:"|0d 0a|"; fast_pattern; content:" id="; pcre:"/^\s*?[\x22\x27][A-Za-z]{3,10}[\x22\x27]/R"; content:" title="; content:!"<"; within:100; pcre:"/^\s*?[\x22\x27](?=[A-Z]{0,19}[a-z]{1,19}[A-Z])[a-zA-Z]{14,20}[\x22\x27][^<>]*?>(?=[A-Za-z]{0,99}\d)[A-Za-z0-9\x20]{100}/R"; classtype:exploit-kit; sid:2020354; rev:9; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Any, attack_target Client_Endpoint, created_at 2015_02_04, deployment Perimeter, malware_family Nuclear, signature_severity Critical, tag DriveBy, tag Exploit_Kit, tag Nuclear, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex SELECT"; flow:established,to_server; http.uri; content:"/articles.asp?"; nocase; content:"ex="; nocase; content:"SELECT"; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6274; reference:url,www.securityfocus.com/bid/21296; reference:url,doc.emergingthreats.net/2006813; classtype:web-application-attack; sid:2006813; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"ET HUNTING SUSPICIOUS Possible automated connectivity check (www.bing.com)"; flow:established,to_server; dsize:38; content:"GET / HTTP/1."; content:"|0d 0a|Host|3a 20|www.bing.com|0d 0a 0d 0a|"; distance:1; within:24; fast_pattern; threshold: type limit, count 1, seconds 300, track by_src; classtype:bad-unknown; sid:2018432; rev:2; metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2014_04_30, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, tag Web_Client_Attacks, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex UNION SELECT"; flow:established,to_server; http.uri; content:"/articles.asp?"; nocase; content:"ex="; nocase; content:"UNION"; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6274; reference:url,www.securityfocus.com/bid/21296; reference:url,doc.emergingthreats.net/2006814; classtype:web-application-attack; sid:2006814; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT CottonCastle/Niteris EK SWF Exploit April 30 2015"; flow:established,from_server; content:"Content-Type|3a| application/x-shockwave-flash|0d 0a|"; http_header; fast_pattern; file_data; content:"CWS"; within:3; flowbits:isset,ET.CottonCasle.Exploit; classtype:exploit-kit; sid:2021044; rev:3; metadata:created_at 2015_05_01, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex INSERT"; flow:established,to_server; http.uri; content:"/articles.asp?"; nocase; content:"ex="; nocase; content:"INSERT"; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6274; reference:url,www.securityfocus.com/bid/21296; reference:url,doc.emergingthreats.net/2006815; classtype:web-application-attack; sid:2006815; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dridex Post Checkin Activity 2"; flow:established,to_server; urilen:20<>100; content:!"Referer|3a|"; http_header; content:"|20|HTTP/1.1|0d 0a|Host|3a 20|"; pcre:"/^Host\x3a\x20(?=[a-z0-9]{0,19}[A-Z])(?=[A-Z0-9]{0,19}[a-z])[a-zA-Z0-9]{4,20}\.[a-z]{2,3}/H"; content:"|0d 0a|Connection|3a 20|Close|0d 0a|User-Agent|3a 20|Mozilla/"; http_header; within:41; fast_pattern; reference:md5,b9de687cdae55d3c9fcfe6fc8bcdd28f; classtype:command-and-control; sid:2020302; rev:7; metadata:created_at 2015_01_23, former_category MALWARE, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex DELETE"; flow:established,to_server; http.uri; content:"/articles.asp?"; nocase; content:"ex="; nocase; content:"DELETE"; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6274; reference:url,www.securityfocus.com/bid/21296; reference:url,doc.emergingthreats.net/2006816; classtype:web-application-attack; sid:2006816; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING AES Crypto Observed in Javascript - Possible Phishing Landing"; flow:established,from_server; file_data; content:"hea2p"; distance:0; nocase; content:"0123456789ABCDEFGHIJKLMNOPQRSTUVXYZabcdefghijklmnopqrstuvxyz"; fast_pattern; distance:0; content:"hea2t"; distance:0; nocase; content:"Aes"; nocase; distance:0; pcre:"/^\s*?\.\s*?Ctr\s*?\.\s*?decrypt/Rsi"; classtype:social-engineering; sid:2025656; rev:4; metadata:attack_target Client_Endpoint, created_at 2015_10_22, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2022_03_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex ASCII"; flow:established,to_server; http.uri; content:"/articles.asp?"; nocase; content:"ex="; nocase; content:"ASCII"; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6274; reference:url,www.securityfocus.com/bid/21296; reference:url,doc.emergingthreats.net/2006817; classtype:web-application-attack; sid:2006817; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET WEB_CLIENT Upatre IE Redirector Receiving Payload Jan 9 2015"; flow:established,from_server; content:"Content-Disposition|3a 20|attachment|3b 20|"; http_header; content:".zip|20 3b 0d 0a|"; distance:0; http_header; content:"Content-Type|3a 20|$ctype|0d 0a|"; http_header; fast_pattern; file_data; content:"PK|03 04|"; within:4; classtype:trojan-activity; sid:2020160; rev:6; metadata:created_at 2015_01_09, former_category CURRENT_EVENTS, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Expinion.net iNews SQL Injection Attempt -- articles.asp ex UPDATE"; flow:established,to_server; http.uri; content:"/articles.asp?"; nocase; content:"ex="; nocase; content:"UPDATE"; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6274; reference:url,www.securityfocus.com/bid/21296; reference:url,doc.emergingthreats.net/2006818; classtype:web-application-attack; sid:2006818; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Windows net start Microsoft Windows DOS prompt command exit OUTBOUND"; flow:established,to_server; content:"These Windows services are started|3a 0d|"; fast_pattern; content:"The command completed successfully|2e|"; distance:0; reference:md5,a22af4fc7fe011069704a15296634ca6; classtype:trojan-activity; sid:2019001; rev:2; metadata:created_at 2014_08_26, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EzHRS HR Assist SQL Injection Attempt -- vdateUsr.asp SELECT"; flow:established,to_server; http.uri; content:"/vdateUsr.asp?"; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6525; reference:url,www.secunia.com/advisories/23304; reference:url,doc.emergingthreats.net/2006339; classtype:web-application-attack; sid:2006339; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Mailbox Renewal Phish Landing 2015-08-14"; flow:to_client,established; file_data; content:"Mailbox Added services"; nocase; fast_pattern; content:"autorised email address"; nocase; distance:0; content:"complete this autorization"; nocase; distance:0; classtype:social-engineering; sid:2031722; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2015_08_14, deployment Perimeter, former_category PHISHING, signature_severity Minor, tag Phishing, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EzHRS HR Assist SQL Injection Attempt -- vdateUsr.asp UNION SELECT"; flow:established,to_server; http.uri; content:"/vdateUsr.asp?"; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6525; reference:url,www.secunia.com/advisories/23304; reference:url,doc.emergingthreats.net/2006340; classtype:web-application-attack; sid:2006340; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Nuclear EK Landing Jan 14 2014"; flow:established,from_server; file_data; content:"|3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 2f 2a|"; within:24; fast_pattern; content:"|24 2c|"; distance:0; pcre:"/^\s*?(?P[^\x29]+)\x29[^\n]*?=\s*?(?P=var1)\s*?\x7c{2}\s*?\d+?\s*?\x2c/R"; classtype:exploit-kit; sid:2020180; rev:4; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2015_01_14, deployment Perimeter, malware_family Nuclear, signature_severity Critical, tag Exploit_Kit, tag Nuclear, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EzHRS HR Assist SQL Injection Attempt -- vdateUsr.asp INSERT"; flow:established,to_server; http.uri; content:"/vdateUsr.asp?"; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6525; reference:url,www.secunia.com/advisories/23304; reference:url,doc.emergingthreats.net/2006341; classtype:web-application-attack; sid:2006341; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Injected iframe leading to Redkit Jan 02 2013"; flow:established,from_server; file_data; content:"iframe name="; pcre:"/^[\r\n\s]*[\w]+[\r\n\s]+/R"; content:"scrolling=auto frameborder=no align=center height=2 width=2 src=http|3a|//"; within:71; fast_pattern; pcre:"/^[^\r\n\s>]+\/[a-z]{4,5}\.html\>\<\/iframe\>/R"; classtype:exploit-kit; sid:2016144; rev:4; metadata:created_at 2013_01_03, former_category CURRENT_EVENTS, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EzHRS HR Assist SQL Injection Attempt -- vdateUsr.asp DELETE"; flow:established,to_server; http.uri; content:"/vdateUsr.asp?"; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6525; reference:url,www.secunia.com/advisories/23304; reference:url,doc.emergingthreats.net/2006342; classtype:web-application-attack; sid:2006342; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Lets Encrypt Free SSL Cert Observed in Tech Support Scams M2"; flow:established,from_server; content:"|55 04 0a|"; content:"|0d|Let|27|s Encrypt"; distance:1; within:14; content:"|55 04 03|"; distance:0; content:"|15|wine.industrialzz.top"; distance:1; within:22; fast_pattern; reference:url,blog.sucuri.net/2017/02/javascript-injections-leads-to-tech-support-scam.html; reference:url,letsencrypt.org/about/; classtype:social-engineering; sid:2024125; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_03_31, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EzHRS HR Assist SQL Injection Attempt -- vdateUsr.asp ASCII"; flow:established,to_server; http.uri; content:"/vdateUsr.asp?"; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6525; reference:url,www.secunia.com/advisories/23304; reference:url,doc.emergingthreats.net/2006343; classtype:web-application-attack; sid:2006343; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT CoolEK/BHEK/Impact EK Java7 Exploit Class Request (3)"; flow:established,to_server; content:"/java/lang/ClassCustomizer.class"; http_uri; fast_pattern; content:"Java/1.7"; http_user_agent; classtype:exploit-kit; sid:2016493; rev:12; metadata:created_at 2013_02_22, former_category EXPLOIT_KIT, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS EzHRS HR Assist SQL Injection Attempt -- vdateUsr.asp UPDATE"; flow:established,to_server; http.uri; content:"/vdateUsr.asp?"; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6525; reference:url,www.secunia.com/advisories/23304; reference:url,doc.emergingthreats.net/2006344; classtype:web-application-attack; sid:2006344; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert tcp $HOME_NET any -> $EXTERNAL_NET [25,587] (msg:"ET MALWARE Limitless Logger Sending Data over SMTP"; flow:to_server,established; content:"Subject|3a 20|Limitless Logger|20 3a 20 3a|"; nocase; fast_pattern; reference:md5,243dda18666ae2a64685e51d82c5ad69; classtype:trojan-activity; sid:2018015; rev:3; metadata:created_at 2014_01_28, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid SELECT"; flow:established,to_server; http.uri; content:"/boxx/ShowAppendix.asp?"; nocase; content:"iid="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0266; reference:url,www.securityfocus.com/archive/1/archive/1/456699/100/0/threaded; reference:url,doc.emergingthreats.net/2005615; classtype:web-application-attack; sid:2005615; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Phishing Fake Document Loading Error 2015-10-01"; flow:to_client,established; file_data; content:"//configure destination URL"; nocase; content:"Verifying Login, Please wait"; nocase; fast_pattern; distance:0; content:"Loading"; nocase; distance:0; content:"and collaborate documents"; nocase; distance:0; content:"Initializing"; distance:0; classtype:social-engineering; sid:2031697; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_10_01, deployment Perimeter, former_category PHISHING, signature_severity Major, tag Phishing, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid UNION SELECT"; flow:established,to_server; http.uri; content:"/boxx/ShowAppendix.asp?"; nocase; content:"iid="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0266; reference:url,www.securityfocus.com/archive/1/archive/1/456699/100/0/threaded; reference:url,doc.emergingthreats.net/2005616; classtype:web-application-attack; sid:2005616; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Job314 EK Landing Nov 10 2014"; flow:established,to_client; file_data; content:"embedSWF(|22|index.swf?action=swf|22|"; fast_pattern; content:"src=|22|index.js?action=swfobject|22|"; classtype:exploit-kit; sid:2019689; rev:4; metadata:created_at 2014_11_11, former_category CURRENT_EVENTS, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid INSERT"; flow:established,to_server; http.uri; content:"/boxx/ShowAppendix.asp?"; nocase; content:"iid="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2007-0266; reference:url,www.securityfocus.com/archive/1/archive/1/456699/100/0/threaded; reference:url,doc.emergingthreats.net/2005617; classtype:web-application-attack; sid:2005617; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Jul 02"; flow:established,from_server; file_data; content:"|2e 73 70 6c 69 74 28 22 22 29 2e 72 65 76 65 72 73 65 28 29 2e 6a 6f 69 6e 28 22 22 29 2e 73 70 6c 69 74 28 22 22 29 2e 72 65 76 65 72 73 65 28 29 2e 6a 6f 69 6e 28 22 22 29 5d 2e 62 6f 72 64 65 72 20 3d 20 22 6e 6f 6e 65 22 3b|"; fast_pattern; content:" +="; pcre:"/^\s+\d{1,2}\x3b\s+else\s+(?P[a-z]+)\s+\-=\s+\d{1,2}\x3b\s+return\s+[a-z]+\.charAt\x28(?P=var)\/\d{1,2}\x29\x7d/R"; classtype:exploit-kit; sid:2021374; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2015_07_02, deployment Perimeter, signature_severity Major, tag Redirector, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid DELETE"; flow:established,to_server; http.uri; content:"/boxx/ShowAppendix.asp?"; nocase; content:"iid="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0266; reference:url,www.securityfocus.com/archive/1/archive/1/456699/100/0/threaded; reference:url,doc.emergingthreats.net/2005618; classtype:web-application-attack; sid:2005618; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Stoberox.B"; flow:established,to_server; content:"POST"; http_method; content:".php"; content:"Host|3a|"; http_header; depth:5; content:"Connection|3a 20|Close|0d 0a|"; http_header; content:"Accept-Encoding|3a 20|none|0d 0a|"; http_header; fast_pattern; content:!"Referer"; http_header; pcre:"/^[a-zA-Z0-9\+\/]+={0,2}$/P"; reference:md5,6ca1690720b3726bc76ef0e7310c9ee7; classtype:trojan-activity; sid:2018300; rev:4; metadata:created_at 2014_03_20, former_category MALWARE, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid ASCII"; flow:established,to_server; http.uri; content:"/boxx/ShowAppendix.asp?"; nocase; content:"iid="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0266; reference:url,www.securityfocus.com/archive/1/archive/1/456699/100/0/threaded; reference:url,doc.emergingthreats.net/2005619; classtype:web-application-attack; sid:2005619; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Lets Encrypt Free SSL Cert Observed in Tech Support Scams M3"; flow:established,from_server; content:"|55 04 0a|"; content:"|0d|Let|27|s Encrypt"; distance:1; within:14; content:"|55 04 03|"; distance:0; content:"|14|one.industrialzz.top"; distance:1; within:21; fast_pattern; reference:url,blog.sucuri.net/2017/02/javascript-injections-leads-to-tech-support-scam.html; reference:url,letsencrypt.org/about/; classtype:social-engineering; sid:2024126; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2017_03_31, deployment Perimeter, former_category WEB_CLIENT, signature_severity Major, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Ezboxx Portal System Beta SQL Injection Attempt -- ShowAppendix.asp iid UPDATE"; flow:established,to_server; http.uri; content:"/boxx/ShowAppendix.asp?"; nocase; content:"iid="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-0266; reference:url,www.securityfocus.com/archive/1/archive/1/456699/100/0/threaded; reference:url,doc.emergingthreats.net/2005620; classtype:web-application-attack; sid:2005620; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MOBILE_MALWARE Android.Stealthgenie Checkin"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/SGCommand.aspx?sgcommand="; fast_pattern; content:"&uid="; distance:0; content:"&sid="; distance:0; content:"&value="; distance:0; http.header_names; content:!"Referer|0d 0a|"; content:!"Accept-"; http.user_agent; content:"|20|Android|20|"; reference:md5,06947ce839a904d6abcb272ff46e7de1; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2014-111416-1306-99&tabid=2; reference:url,engadget.com/2014/09/30/crackdown-on-spying-apps-leads-to-stealthgenie-ceos-arrest/; classtype:trojan-activity; sid:2019805; rev:5; metadata:affected_product Android, attack_target Mobile_Client, created_at 2014_11_25, deployment Perimeter, former_category MOBILE_MALWARE, tag Android, updated_at 2022_03_17, mitre_tactic_id TA0037, mitre_tactic_name Command_And_Control, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS F3Site2009 LFI Exploit Attempt (poll.php)"; flow:established,to_server; http.uri; content:"/mod/poll.php?"; nocase; content:"GLOBALS[nlang]="; nocase; pcre:"/(\?|&)GLOBALS\[nlang\]=[^\x26\x3B\x2f\x5c]*[\x2f\x5c]/i"; reference:url,packetstormsecurity.org/0912-exploits/f3site2009-lfi.txt; reference:url,doc.emergingthreats.net/2010543; classtype:web-application-attack; sid:2010543; rev:6; metadata:created_at 2010_07_30, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Virus Phone Scam Landing Oct 30"; flow:established,from_server; file_data; content:"*** Security Error Code"; fast_pattern; content:"Suspicious Connection Was Trying"; nocase; distance:0; content:"Your Accounts May be Suspended"; nocase; distance:0; classtype:social-engineering; sid:2022011; rev:4; metadata:created_at 2015_10_31, former_category WEB_CLIENT, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS F3Site2009 LFI Exploit Attempt (new.php)"; flow:established,to_server; http.uri; content:"/mod/new.php?"; nocase; content:"GLOBALS[nlang]="; nocase; pcre:"/(\?|&)GLOBALS\[nlang\]=[^\x26\x3B\x2f\x5c]*[\x2f\x5c]/i"; reference:url,packetstormsecurity.org/0912-exploits/f3site2009-lfi.txt; reference:url,doc.emergingthreats.net/2010544; classtype:web-application-attack; sid:2010544; rev:6; metadata:created_at 2010_07_30, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake Virus Phone Scam Landing Jan 13 M3"; flow:to_client,established; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"getURLParameter"; nocase; content:"PhoneNumber"; nocase; distance:0; content:"AlertMessage"; content:"Windows Certified Support"; fast_pattern; nocase; distance:0; content:"myFunction"; nocase; distance:0; content:"needToConfirm"; nocase; distance:0; content:"msg1.mp3"; nocase; distance:0; classtype:social-engineering; sid:2022366; rev:4; metadata:created_at 2016_01_14, former_category WEB_CLIENT, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS F5 Data Manager DiagLogListActionBody.do Local File Inclusion Attempt"; flow:to_server,established; content:"../"; depth:200; http.method; content:"GET"; http.uri; content:"/acopia/manager/DiagLogListActionBody.do?"; nocase; content:"logFile="; nocase; reference:url,secunia.com/advisories/38113/; reference:url,doc.emergingthreats.net/2010800; classtype:web-application-attack; sid:2010800; rev:6; metadata:affected_product Web_Server_Applications, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Local_File_Inclusion, updated_at 2020_09_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Agent2.fher Related User-Agent (Microsoft Internet Updater)"; flow:established,to_server; content:"User-Agent|3a| Microsoft|20|Internet|20|Updater|0d 0a|"; http_header; fast_pattern; reference:md5,2c832d51e4e72dc3939c224cc282152c; classtype:trojan-activity; sid:2015528; rev:5; metadata:created_at 2012_07_26, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS F5 Data Manager DiagCaptureFileListActionBody.do Local File Inclusion Attempt"; flow:to_server,established; content:"../"; depth:200; http.method; content:"GET"; http.uri; content:"/acopia/manager/DiagCaptureFileListActionBody.do?"; nocase; content:"captureFile="; nocase; reference:url,secunia.com/advisories/38113/; reference:url,doc.emergingthreats.net/2010801; classtype:web-application-attack; sid:2010801; rev:6; metadata:affected_product Web_Server_Applications, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Local_File_Inclusion, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Possible Generic Phishing Landing Jul 28 2015"; flow:established,to_client; file_data; content:"function ValidateFormHotmail()"; fast_pattern; classtype:social-engineering; sid:2021538; rev:4; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2015_07_28, deployment Perimeter, former_category PHISHING, signature_severity Critical, tag Phishing, updated_at 2022_03_17, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS F5 Data Manager ViewSatReport.do Local File Inclusion Attempt"; flow:to_server,established; content:"../"; depth:200; http.method; content:"GET"; http.uri; content:"/acopia/sat/ViewSatReport.do?"; nocase; content:"fileName="; nocase; reference:url,secunia.com/advisories/38113/; reference:url,doc.emergingthreats.net/2010802; classtype:web-application-attack; sid:2010802; rev:6; metadata:affected_product Web_Server_Applications, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Local_File_Inclusion, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Java Exploit Campaign SetAttribute Java Applet"; flow:established,to_client; file_data; content:"document.createElement(|22|applet|22|)|3B|"; fast_pattern; distance:0; nocase; content:".setAttribute(|22|code"; distance:0; nocase; content:".class|22 29 3B|"; nocase; within:50; content:".setAttribute(|22|archive"; nocase; distance:0; content:"document.createElement|22|param"; nocase; distance:0; reference:url,ondailybasis.com/blog/?p=1593; classtype:trojan-activity; sid:2015883; rev:3; metadata:created_at 2012_11_14, former_category CURRENT_EVENTS, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS F5 Data Manager DiagCaptureFileListActionBody.do capture parameter LFI Attempt"; flow:to_server,established; content:"../"; depth:200; http.method; content:"GET"; http.uri; content:"/acopia/manager/DiagCaptureFileListActionBody.do?"; nocase; content:"capture="; nocase; reference:url,secunia.com/advisories/38113/; reference:url,doc.emergingthreats.net/2010803; classtype:web-application-attack; sid:2010803; rev:6; metadata:created_at 2010_07_30, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Phishing Fake Mailbox Quota Increase Messages 2016-05-25"; flow:to_client,established; file_data; content:"//configure destination URL"; nocase; content:"Upgrading your mailbox"; nocase; fast_pattern; distance:0; content:"Upgrade Successful"; nocase; distance:0; content:"added to your mail quota"; nocase; distance:0; content:"//Do not edit below this line"; distance:0; nocase; classtype:social-engineering; sid:2031989; rev:4; metadata:attack_target Client_Endpoint, created_at 2016_05_25, deployment Perimeter, former_category PHISHING, signature_severity Major, tag Phishing, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS F5 Data Manager ViewInventoryErrorReport.do Local File Inclusion Attempt"; flow:to_server,established; content:"../"; depth:200; http.method; content:"GET"; http.uri; content:"/acopia/sat/ViewInventoryErrorReport.do?"; nocase; content:"fileName="; nocase; reference:url,secunia.com/advisories/38113/; reference:url,doc.emergingthreats.net/2010804; classtype:web-application-attack; sid:2010804; rev:6; metadata:affected_product Web_Server_Applications, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Local_File_Inclusion, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Evil Redirector Leading to EK Nov 15 2016"; flow:established,from_server; file_data; content:"<iframe src=|22|http|3a 2f 2f|"; pcre:"/^[a-z0-9_-]+\.(?=[0-9_-]*[A-Z])[A-Z0-9_-]+\.[^\x22]+\x22\s/R"; content:"|77 69 64 74 68 3d 22 31 22 20 68 65 69 67 68 74 3d 22 31 22 20 73 74 79 6c 65 3d 22 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6c 65 66 74 3a 2d 31 70 78 3b 22 3e 3c 2f 69 66 72 61 6d 65 3e|"; within:67; fast_pattern; classtype:exploit-kit; sid:2023513; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_11_15, deployment Perimeter, performance_impact Low, signature_severity Major, tag Redirector, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Mxmania File Upload Manager (FUM) SQL Injection Attempt -- detail.asp ID SELECT"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"ID="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6813; reference:url,www.milw0rm.com/exploits/2997; reference:url,doc.emergingthreats.net/2006123; classtype:web-application-attack; sid:2006123; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Tech Support Phone Scam Landing Aug 12 M1"; flow:established,from_server; content:"200"; http_stat_code; content:"Content-Type|3a 20|text/html"; http_header; file_data; content:"script is so you can get fields our of the URL"; fast_pattern; nocase; content:"//Flag we have not run the script"; nocase; distance:0; content:"//The page that we will load on a second pop"; nocase; distance:0; content:"//figure out what to use for default number"; nocase; distance:0; classtype:social-engineering; sid:2023051; rev:3; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2016_08_12, deployment Perimeter, former_category WEB_CLIENT, performance_impact Low, signature_severity Major, tag Phishing, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Mxmania File Upload Manager (FUM) SQL Injection Attempt -- detail.asp ID UNION SELECT"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"ID="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6813; reference:url,www.milw0rm.com/exploits/2997; reference:url,doc.emergingthreats.net/2006124; classtype:web-application-attack; sid:2006124; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT CottonCastle/Niteris EK Receiving Payload May 7 2015"; flow:established,from_server; content:"Content-Type|3a 20|application/postscript|0d 0a|"; http_header; fast_pattern; content:"Cache-Control|3a 20|no-cache,no-store,max-age=0,must-revalidate|0d 0a|"; http_header; content:"Content-Disposition|3a 20|inline|3b| filename="; http_header; pcre:"/^[a-z]{10}\.[a-z]{3}\r?$/RHm"; classtype:exploit-kit; sid:2021064; rev:4; metadata:created_at 2015_05_07, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Mxmania File Upload Manager (FUM) SQL Injection Attempt -- detail.asp ID INSERT"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"ID="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6813; reference:url,www.milw0rm.com/exploits/2997; reference:url,doc.emergingthreats.net/2006125; classtype:web-application-attack; sid:2006125; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Andromeda Download"; flow:from_server,established; flowbits:isset,ET.andromeda; content:"200"; http_stat_code; content:"Server|3a 20|nginx"; http_header; content:"Content-Description|3a 20|File Transfer|0d 0a|"; http_header; content:"Content-Disposition|3a 20|attachment|3b 20|filename="; http_header; content:"Content-Transfer-Encoding|3a| binary|0d 0a|"; fast_pattern; pcre:"/filename=[a-f0-9]{32}v\.(?:docm|zip)\x0d\x0a/Hmi"; classtype:trojan-activity; sid:2022573; rev:3; metadata:created_at 2016_02_29, former_category MALWARE, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Mxmania File Upload Manager (FUM) SQL Injection Attempt -- detail.asp ID DELETE"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"ID="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6813; reference:url,www.milw0rm.com/exploits/2997; reference:url,doc.emergingthreats.net/2006126; classtype:web-application-attack; sid:2006126; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT CoolEK/BHEK/Impact EK Java7 Exploit Class Request (1)"; flow:established,to_server; content:"/java/lang/ClassBeanInfo.class"; http_uri; fast_pattern; content:"Java/1.7"; http_user_agent; classtype:exploit-kit; sid:2016490; rev:13; metadata:created_at 2013_02_22, former_category EXPLOIT_KIT, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Mxmania File Upload Manager (FUM) SQL Injection Attempt -- detail.asp ID ASCII"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"ID="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6813; reference:url,www.milw0rm.com/exploits/2997; reference:url,doc.emergingthreats.net/2006127; classtype:web-application-attack; sid:2006127; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Gootkit CnC)"; flow:established,from_server; content:"|55 04 03|"; content:"|25|www.signliquideducationdaughter.final"; distance:1; within:38; fast_pattern; reference:url,sslbl.abuse.ch; classtype:domain-c2; sid:2022247; rev:3; metadata:attack_target Client_and_Server, created_at 2015_12_14, deployment Perimeter, former_category MALWARE, performance_impact Low, signature_severity Major, tag SSL_Malicious_Cert, updated_at 2022_03_17, mitre_tactic_id TA0042, mitre_tactic_name Resource_Development, mitre_technique_id T1587, mitre_technique_name Develop_Capabilities;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Mxmania File Upload Manager (FUM) SQL Injection Attempt -- detail.asp ID UPDATE"; flow:established,to_server; http.uri; content:"/detail.asp?"; nocase; content:"ID="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6813; reference:url,www.milw0rm.com/exploits/2997; reference:url,doc.emergingthreats.net/2006128; classtype:web-application-attack; sid:2006128; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Possible Sakura Jar Download"; flow:established,to_client; content:"Content-Type|3a| application/x-java-archive|0d 0a|"; http_header; fast_pattern; pcre:"/Last-Modified\x3a Mon, (?!(?:0[29]|16|23|30))\d{2} Jul 2001/H"; classtype:exploit-kit; sid:2016721; rev:5; metadata:created_at 2013_04_04, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Falcon Series One sitemap.xml.php dir Parameter Local File Inclusion"; flow:to_server,established; content:"../"; http.method; content:"GET"; http.uri; content:"/sitemap.xml.php?"; nocase; content:"dir[classes]="; nocase; reference:url,secunia.com/advisories/28047; reference:url,milw0rm.com/exploits/4712; reference:url,doc.emergingthreats.net/2009507; classtype:web-application-attack; sid:2009507; rev:7; metadata:affected_product Web_Server_Applications, attack_target Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag Local_File_Inclusion, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Metro Document Phishing Landing 2015-11-17"; flow:established,from_server; file_data; content:"invited to download DATASHEET"; nocase; content:"<title>Metro Download Online"; fast_pattern; nocase; content:"simplest and secure way"; nocase; distance:0; content:"view your documents and files"; nocase; distance:0; content:"View Document"; nocase; distance:0; content:"Confirm email address to download"; nocase; distance:0; classtype:social-engineering; sid:2031699; rev:3; metadata:attack_target Client_Endpoint, created_at 2015_11_17, deployment Perimeter, former_category PHISHING, signature_severity Major, tag Phishing, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Fantastic News SQL Injection Attempt -- news.php id SELECT"; flow:established,to_server; http.uri; content:"/news.php?"; nocase; content:"id="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6542; reference:url,www.milw0rm.com/exploits/2906; reference:url,doc.emergingthreats.net/2006327; classtype:web-application-attack; sid:2006327; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Possible Evil Redirector Leading to EK June 10 2015"; flow:established,from_server; file_data; content:"60*60*24*7*1000|29 3b| document.cookie=|22|PHP_SESSION_PHP="; fast_pattern; pcre:"/^\d+\x3b/R"; classtype:exploit-kit; sid:2021338; rev:12; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2015_06_25, deployment Perimeter, signature_severity Major, tag Redirector, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Fantastic News SQL Injection Attempt -- news.php id UNION SELECT"; flow:established,to_server; http.uri; content:"/news.php?"; nocase; content:"id="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6542; reference:url,www.milw0rm.com/exploits/2906; reference:url,doc.emergingthreats.net/2006328; classtype:web-application-attack; sid:2006328; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING DHL Phish Landing Page 2015-10-17"; flow:established,to_client; file_data; content:"<TITLE> DHL|7c 20|Trackinng"; nocase; fast_pattern; content:"Mozilla/5.0 (Windows NT 6.3|3b 20|WOW64|3b 20|rv|3a|32.0)"; nocase; distance:0; content:"fnSubmitOnEnter"; nocase; distance:0; classtype:social-engineering; sid:2031728; rev:4; metadata:created_at 2015_09_16, former_category PHISHING, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Fantastic News SQL Injection Attempt -- news.php id INSERT"; flow:established,to_server; http.uri; content:"/news.php?"; nocase; content:"id="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6542; reference:url,www.milw0rm.com/exploits/2906; reference:url,doc.emergingthreats.net/2006329; classtype:web-application-attack; sid:2006329; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT DRIVEBY Nuclear EK Landing Feb 01 2015 M2"; flow:established,from_server; content:"Server|3a 20|nginx"; http_header; content:"X-Powered-By|3a|"; http_header; file_data; content:" id=|22|"; pcre:"/^[A-Za-z]{3,5}/R"; content:"|22| style=|22|display|3a|none|22| title="; within:29; fast_pattern; pcre:"/^\s*?\x22[a-zA-Z0-9]{7}l[a-zA-Z0-9]\x22\s*?>(?:(?!<\/).){500}/Rs"; classtype:exploit-kit; sid:2020342; rev:5; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, affected_product Any, attack_target Client_Endpoint, created_at 2015_02_01, deployment Perimeter, malware_family Nuclear, signature_severity Critical, tag DriveBy, tag Exploit_Kit, tag Nuclear, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Fantastic News SQL Injection Attempt -- news.php id DELETE"; flow:established,to_server; http.uri; content:"/news.php?"; nocase; content:"id="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6542; reference:url,www.milw0rm.com/exploits/2906; reference:url,doc.emergingthreats.net/2006330; classtype:web-application-attack; sid:2006330; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-alert smtp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Perfect Keylogger Install Email Report"; flow:established,to_server; content:"Subject|3a| Perfect Keylogger was installed successfully|3a|"; fast_pattern; reference:url,doc.emergingthreats.net/2008893; classtype:trojan-activity; sid:2008893; rev:10; metadata:created_at 2010_07_30, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Fantastic News SQL Injection Attempt -- news.php id ASCII"; flow:established,to_server; http.uri; content:"/news.php?"; nocase; content:"id="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6542; reference:url,www.milw0rm.com/exploits/2906; reference:url,doc.emergingthreats.net/2006331; classtype:web-application-attack; sid:2006331; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert tcp any any -> any 445 (msg:"ET MALWARE Possible KAPTOXA SMB Naming Format"; flow:to_server,established; content:"SMB|A2|"; content:"|5c 00|W|00|I|00|N|00|D|00|O|00|W|00|S|00 5c 00|t|00|w|00|a|00|i|00|n|00|_|00|3|00|2|00 5c|"; distance:0; fast_pattern; pcre:"/^(?:(?!\x00\x00\x00).)*?_\x00(?:(?!\x00\x00).)*?_\x00(?:(?!\x00\x00).)*?_\x00(?:(?!\x00\x00).)*?\x2e\x00t\x00x\x00t/Rsi"; flowbits:set,ET.kaptoxa; reference:url,securityintelligence.com/target-data-breach-kaptoxa-pos-malware/; classtype:trojan-activity; sid:2018058; rev:2; metadata:created_at 2014_02_04, former_category MALWARE, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Fantastic News SQL Injection Attempt -- news.php id UPDATE"; flow:established,to_server; http.uri; content:"/news.php?"; nocase; content:"id="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2006-6542; reference:url,www.milw0rm.com/exploits/2906; reference:url,doc.emergingthreats.net/2006332; classtype:web-application-attack; sid:2006332; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT CoolEK/BHEK/Impact EK Java7 Exploit Class Request (3)"; flow:established,to_server; content:"/java/lang/ObjectCustomizer.class"; http_uri; fast_pattern; content:"Java/1.7"; http_user_agent; classtype:exploit-kit; sid:2016492; rev:13; metadata:created_at 2013_02_22, former_category EXPLOIT_KIT, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Fatwiki datumscalc.php Remote File Inclusion Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/datumscalc.php?"; nocase; content:"kal_class_path="; nocase; pcre:"/kal_class_path=\s*(ftps?|https?|php)\:\//i"; reference:url,exploit-db.com/exploits/11188; reference:url,doc.emergingthreats.net/2011096; classtype:web-application-attack; sid:2011096; rev:6; metadata:created_at 2010_07_30, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Archie EK Landing Nov 10 2014"; flow:established,to_client; file_data; content:"xmlhttp.open(|22|POST|22|, |22|/foo|22|, false)|3b|"; fast_pattern; content:"xmlhttp.send(sendstr)|3b|"; distance:0; classtype:exploit-kit; sid:2019690; rev:4; metadata:created_at 2014_11_11, former_category CURRENT_EVENTS, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Fatwiki monatsblatt.php Remote File Inclusion Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/monatsblatt.php?"; nocase; content:"kal_class_path="; nocase; pcre:"/kal_class_path=\s*(ftps?|https?|php)\:\//i"; reference:url,exploit-db.com/exploits/11188; reference:url,doc.emergingthreats.net/2011097; classtype:web-application-attack; sid:2011097; rev:6; metadata:created_at 2010_07_30, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT HiMan EK Secondary Landing"; flow:from_server,established; file_data; content:""; fast_pattern; content:"|3a|stroke"; nocase; classtype:exploit-kit; sid:2017852; rev:3; metadata:created_at 2013_12_13, former_category CURRENT_EVENTS, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS FipsSHOP SQL Injection Attempt -- index.asp cat SELECT"; flow:established,to_server; http.uri; content:"/index.asp?"; nocase; content:"cat="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2006-6243; reference:url,www.securityfocus.com/bid/21289; reference:url,doc.emergingthreats.net/2006898; classtype:web-application-attack; sid:2006898; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_CLIENT Fake AV Phone Scam Landing June 8 2015 M2"; flow:established,to_client; file_data; content:"Norton Firewall Warning"; fast_pattern; nocase; content:"function myFunction|28 29|"; nocase; distance:0; content:"Windows has blocked access to the Internet."; nocase; distance:0; classtype:social-engineering; sid:2021207; rev:4; metadata:created_at 2015_06_09, former_category WEB_CLIENT, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS FipsSHOP SQL Injection Attempt -- index.asp cat UNION SELECT"; flow:established,to_server; http.uri; content:"/index.asp?"; nocase; content:"cat="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2006-6243; reference:url,www.securityfocus.com/bid/21289; reference:url,doc.emergingthreats.net/2006899; classtype:web-application-attack; sid:2006899; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Possible Sweet Orange redirection Nov 4 2014"; flow:established,from_server; file_data; content:"var main_request_data_content"; within:29; fast_pattern; pcre:"/^\s*?=\s*?[\x22\x27](?!687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f/Ri"; flowbits:set,et.exploitkitlanding; reference:url,malware-traffic-analysis.net/2014/10/27/index2.html; classtype:exploit-kit; sid:2019642; rev:3; metadata:created_at 2014_11_04, former_category EXPLOIT_KIT, updated_at 2022_03_17;)
+alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS FipsSHOP SQL Injection Attempt -- index.asp cat INSERT"; flow:established,to_server; http.uri; content:"/index.asp?"; nocase; content:"cat="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2006-6243; reference:url,www.securityfocus.com/bid/21289; reference:url,doc.emergingthreats.net/2006900; classtype:web-application-attack; sid:2006900; rev:10; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11;)
 
-#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT_KIT Malicious Iframe Leading to EK"; flow:established,from_server; file_data; content:"document.write((|22|