[Snort-sigs] Bleeding Edge Threats Daily Update

bleeding at ...3254... bleeding at ...3254...
Thu Oct 19 21:00:06 EDT 2006


[***] Results from Oinkmaster started Thu Oct 19 21:00:06 2006 [***]

[+++]          Added rules:          [+++]

 2003123 - BLEEDING-EDGE POLICY SMTP traffic on port 25 (mail from) (bleeding-policy.rules)
 2003124 - BLEEDING-EDGE POLICY SMTP traffic on port 25 (rcpt to) (bleeding-policy.rules)
 2003125 - BLEEDING-EDGE POLICY SSL/TLS traffic on port 25 (01) (bleeding-policy.rules)
 2003127 - BLEEDING-EDGE POLICY SSL/TLS traffic on port 25 (00) (bleeding-policy.rules)
 2003136 - BLEEDING-EDGE POLICY NON-SMTP and NON-SSL/TLS traffic on port 25 (bleeding-policy.rules)
 2003138 - BLEEDING-EDGE TROJAN SpamThru trojan peer exchange (bleeding-virus.rules)
 2003139 - BLEEDING-EDGE TROJAN SpamThru trojan SMTP test successful (bleeding-virus.rules)
 2003140 - BLEEDING-EDGE TROJAN SpamThru trojan update request (bleeding-virus.rules)
 2003141 - BLEEDING-EDGE TROJAN SpamThru trojan AV DLL request (bleeding-virus.rules)
 2003142 - BLEEDING-EDGE TROJAN SpamThru trojan spam template request (bleeding-virus.rules)
 2003143 - BLEEDING-EDGE TROJAN SpamThru trojan spam run report (bleeding-virus.rules)
 2003144 - BLEEDING-EDGE TROJAN SpamThru trojan AV scan report (bleeding-virus.rules)


[///]     Modified active rules:     [///]

 2003121 - BLEEDING-EDGE POLICY docs.google.com Activity (bleeding-policy.rules)
 2003122 - BLEEDING-EDGE POLICY Possible docs.google.com Activity (bleeding-policy.rules)
 2402000 - BLEEDING-EDGE DROP Dshield Block Listed Source (bleeding-dshield.rules)
 2403000 - BLEEDING-EDGE DROP Dshield Block Listed Source - BLOCKING (bleeding-dshield-BLOCK.rules)
 2410000 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 1)  (bleeding-botcc.rules)
 2410001 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 2)  (bleeding-botcc.rules)
 2410002 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 3)  (bleeding-botcc.rules)
 2410003 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 4)  (bleeding-botcc.rules)
 2410004 - BLEEDING-EDGE DROP Known Bot C&C Server Traffic (group 5)  (bleeding-botcc.rules)
 2411000 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 1) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
 2411001 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 2) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
 2411002 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 3) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
 2411003 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 4) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)
 2411004 - BLEEDING-EDGE DROP Known Bot C&C Traffic (group 5) - BLOCKING SOURCE (bleeding-botcc-BLOCK.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to bleeding-policy.rules (1):
        #intention is to catch traffic on port 25 that is NOT smtp or ssl/tls.

     -> Added to bleeding-sid-msg.map (14):
        2003121 || BLEEDING-EDGE POLICY docs.google.com Activity || url,docs.google.com
        2003122 || BLEEDING-EDGE POLICY Possible docs.google.com Activity || url,docs.google.com
        2003123 || BLEEDING-EDGE POLICY SMTP traffic on port 25 (mail from)
        2003124 || BLEEDING-EDGE POLICY SMTP traffic on port 25 (rcpt to)
        2003125 || BLEEDING-EDGE POLICY SSL/TLS traffic on port 25 (01)
        2003127 || BLEEDING-EDGE POLICY SSL/TLS traffic on port 25 (00)
        2003136 || BLEEDING-EDGE POLICY NON-SMTP and NON-SSL/TLS traffic on port 25
        2003138 || BLEEDING-EDGE TROJAN SpamThru trojan peer exchange || url,www.secureworks.com/analysis/spamthru/
        2003139 || BLEEDING-EDGE TROJAN SpamThru trojan SMTP test successful || url,www.secureworks.com/analysis/spamthru/
        2003140 || BLEEDING-EDGE TROJAN SpamThru trojan update request || url,www.secureworks.com/analysis/spamthru/
        2003141 || BLEEDING-EDGE TROJAN SpamThru trojan AV DLL request || url,www.secureworks.com/analysis/spamthru/
        2003142 || BLEEDING-EDGE TROJAN SpamThru trojan spam template request || url,www.secureworks.com/analysis/spamthru/
        2003143 || BLEEDING-EDGE TROJAN SpamThru trojan spam run report || url,www.secureworks.com/analysis/spamthru/
        2003144 || BLEEDING-EDGE TROJAN SpamThru trojan AV scan report || url,www.secureworks.com/analysis/spamthru/

     -> Added to bleeding-virus.rules (1):
        #by Joe Stewart of Lurhq/Secureworks

[---]     Removed non-rule lines:    [---]

     -> Removed from bleeding-sid-msg.map (2):
        2003121 || BLEEDING-EDGE docs.google.com Activity || url,docs.google.com
        2003122 || BLEEDING-EDGE Possible docs.google.com Activity || url,docs.google.com





More information about the Snort-sigs mailing list