[Snort-sigs] Emerging Threats Daily Signature Changes

emerging at ...3335... emerging at ...3335...
Sat Jan 26 17:00:08 EST 2008


[***] Results from Oinkmaster started Sat Jan 26 17:00:08 2008 [***]

[+++]          Added rules:          [+++]

 2007788 - ET MALWARE Theinstalls.com Initial Checkin (bleeding-malware.rules)
 2007798 - ET MALWARE Theinstalls.com Trojan Download (bleeding-malware.rules)


[///]     Modified active rules:     [///]

 2001349 - ET INAPPROPRIATE free XXX (bleeding-inappropriate.rules)
 2001350 - ET INAPPROPRIATE hardcore anal (bleeding-inappropriate.rules)
 2001392 - ET INAPPROPRIATE Sextracker Tracking Code Detected (1) (bleeding-inappropriate.rules)
 2001393 - ET INAPPROPRIATE Sextracker Tracking Code Detected (2) (bleeding-inappropriate.rules)
 2002101 - ET GAMES Battle.net Starcraft login (bleeding-game.rules)
 2002102 - ET GAMES Battle.net Brood War login (bleeding-game.rules)
 2002103 - ET GAMES Battle.net Diablo login (bleeding-game.rules)
 2002104 - ET GAMES Battle.net Diablo 2 login (bleeding-game.rules)
 2002105 - ET GAMES Battle.net Diablo 2 Lord of Destruction login (bleeding-game.rules)
 2002106 - ET GAMES Battle.net Warcraft 2 login (bleeding-game.rules)
 2002107 - ET GAMES Battle.net Warcraft 3 login (bleeding-game.rules)
 2002108 - ET GAMES Battle.net Warcraft 3\: The Frozen throne login (bleeding-game.rules)
 2002109 - ET GAMES Battle.net old game version (bleeding-game.rules)
 2002110 - ET GAMES Battle.net invalid version (bleeding-game.rules)
 2002111 - ET GAMES Battle.net invalid cdkey (bleeding-game.rules)
 2002112 - ET GAMES Battle.net cdkey in use (bleeding-game.rules)
 2002113 - ET GAMES Battle.net banned key (bleeding-game.rules)
 2002114 - ET GAMES Battle.net wrong product (bleeding-game.rules)
 2002115 - ET GAMES Battle.net failed account login (OLS)\: wrong password (bleeding-game.rules)
 2002116 - ET GAMES Battle.net failed account login (NLS)\: wrong password (bleeding-game.rules)
 2002117 - ET GAMES Battle.net connection reset (possible IP-Ban) (bleeding-game.rules)
 2002118 - ET GAMES Battle.net user in channel (bleeding-game.rules)
 2002119 - ET GAMES Battle.net outgoing chat message (bleeding-game.rules)
 2002138 - ET GAMES World of Warcraft connection (bleeding-game.rules)
 2002139 - ET GAMES World of Warcraft failed logon (bleeding-game.rules)
 2002140 - ET GAMES Battle.net user joined channel (bleeding-game.rules)
 2002141 - ET GAMES Battle.net user left channel (bleeding-game.rules)
 2002142 - ET GAMES Battle.net received whisper message (bleeding-game.rules)
 2002143 - ET GAMES Battle.net received server broadcast (bleeding-game.rules)
 2002144 - ET GAMES Battle.net joined channel (bleeding-game.rules)
 2002145 - ET GAMES Battle.net user had a flags update (bleeding-game.rules)
 2002146 - ET GAMES Battle.net sent a whisper (bleeding-game.rules)
 2002147 - ET GAMES Battle.net channel full (bleeding-game.rules)
 2002148 - ET GAMES Battle.net channel doesn't exist (bleeding-game.rules)
 2002149 - ET GAMES Battle.net channel is restricted (bleeding-game.rules)
 2002150 - ET GAMES Battle.net informational message (bleeding-game.rules)
 2002151 - ET GAMES Battle.net error message (bleeding-game.rules)
 2002152 - ET GAMES Battle.net 'emote' message (bleeding-game.rules)
 2002154 - ET GAMES Guild Wars connection (bleeding-game.rules)
 2002155 - ET GAMES Steam connection (bleeding-game.rules)
 2002170 - ET GAMES Battle.net incoming chat message (bleeding-game.rules)
 2002855 - ET GAMES Blizzard Downloader (bleeding-game.rules)
 2003089 - ET GAMES STEAM Connection (v2) (bleeding-game.rules)


[///]    Modified inactive rules:    [///]

 2001346 - ET INAPPROPRIATE Kiddy Porn preteen (bleeding-inappropriate.rules)
 2001347 - ET INAPPROPRIATE Kiddy Porn pre-teen (bleeding-inappropriate.rules)
 2001348 - ET INAPPROPRIATE Kiddy Porn early teen (bleeding-inappropriate.rules)
 2001351 - ET INAPPROPRIATE masturbation (bleeding-inappropriate.rules)
 2001352 - ET INAPPROPRIATE ejaculation (bleeding-inappropriate.rules)
 2001353 - ET INAPPROPRIATE BDSM (bleeding-inappropriate.rules)
 2001386 - ET INAPPROPRIATE Kiddy Porn pthc (bleeding-inappropriate.rules)
 2001387 - ET INAPPROPRIATE Kiddy Porn zeps (bleeding-inappropriate.rules)
 2001388 - ET INAPPROPRIATE Kiddy Porn r at ...2850... (bleeding-inappropriate.rules)
 2001389 - ET INAPPROPRIATE Kiddy Porn childlover (bleeding-inappropriate.rules)
 2001608 - ET INAPPROPRIATE Likely Porn (bleeding-inappropriate.rules)
 2002925 - ET INAPPROPRIATE Google Image Search, Safe Mode Off (bleeding-inappropriate.rules)


[+++]      Added non-rule lines:     [+++]

     -> Added to bleeding-malware.rules (1):
        #horrendous multi-install service at theinstalls.com

     -> Added to bleeding-sid-msg.map (57):
        2001346 || ET INAPPROPRIATE Kiddy Porn preteen
        2001347 || ET INAPPROPRIATE Kiddy Porn pre-teen
        2001348 || ET INAPPROPRIATE Kiddy Porn early teen
        2001349 || ET INAPPROPRIATE free XXX
        2001350 || ET INAPPROPRIATE hardcore anal
        2001351 || ET INAPPROPRIATE masturbation
        2001352 || ET INAPPROPRIATE ejaculation
        2001353 || ET INAPPROPRIATE BDSM
        2001386 || ET INAPPROPRIATE Kiddy Porn pthc
        2001387 || ET INAPPROPRIATE Kiddy Porn zeps
        2001388 || ET INAPPROPRIATE Kiddy Porn r at ...2850...
        2001389 || ET INAPPROPRIATE Kiddy Porn childlover
        2001392 || ET INAPPROPRIATE Sextracker Tracking Code Detected (1)
        2001393 || ET INAPPROPRIATE Sextracker Tracking Code Detected (2)
        2001608 || ET INAPPROPRIATE Likely Porn
        2002101 || ET GAMES Battle.net Starcraft login
        2002102 || ET GAMES Battle.net Brood War login
        2002103 || ET GAMES Battle.net Diablo login
        2002104 || ET GAMES Battle.net Diablo 2 login
        2002105 || ET GAMES Battle.net Diablo 2 Lord of Destruction login
        2002106 || ET GAMES Battle.net Warcraft 2 login
        2002107 || ET GAMES Battle.net Warcraft 3 login
        2002108 || ET GAMES Battle.net Warcraft 3\: The Frozen throne login
        2002109 || ET GAMES Battle.net old game version
        2002110 || ET GAMES Battle.net invalid version
        2002111 || ET GAMES Battle.net invalid cdkey
        2002112 || ET GAMES Battle.net cdkey in use
        2002113 || ET GAMES Battle.net banned key
        2002114 || ET GAMES Battle.net wrong product
        2002115 || ET GAMES Battle.net failed account login (OLS)\: wrong password
        2002116 || ET GAMES Battle.net failed account login (NLS)\: wrong password
        2002117 || ET GAMES Battle.net connection reset (possible IP-Ban)
        2002118 || ET GAMES Battle.net user in channel
        2002119 || ET GAMES Battle.net outgoing chat message
        2002138 || ET GAMES World of Warcraft connection
        2002139 || ET GAMES World of Warcraft failed logon
        2002140 || ET GAMES Battle.net user joined channel
        2002141 || ET GAMES Battle.net user left channel
        2002142 || ET GAMES Battle.net received whisper message
        2002143 || ET GAMES Battle.net received server broadcast
        2002144 || ET GAMES Battle.net joined channel
        2002145 || ET GAMES Battle.net user had a flags update
        2002146 || ET GAMES Battle.net sent a whisper
        2002147 || ET GAMES Battle.net channel full
        2002148 || ET GAMES Battle.net channel doesn't exist
        2002149 || ET GAMES Battle.net channel is restricted
        2002150 || ET GAMES Battle.net informational message
        2002151 || ET GAMES Battle.net error message
        2002152 || ET GAMES Battle.net 'emote' message
        2002154 || ET GAMES Guild Wars connection
        2002155 || ET GAMES Steam connection
        2002170 || ET GAMES Battle.net incoming chat message
        2002855 || ET GAMES Blizzard Downloader || url,www.worldofwarcraft.com/info/faq/blizzarddownloader.html
        2002925 || ET INAPPROPRIATE Google Image Search, Safe Mode Off
        2003089 || ET GAMES STEAM Connection (v2)
        2007788 || ET MALWARE Theinstalls.com Initial Checkin || url,www.theinstalls.com
        2007798 || ET MALWARE Theinstalls.com Trojan Download || url,www.theinstalls.com

     -> Added to bleeding-sid-msg.map.txt (57):
        2001346 || ET INAPPROPRIATE Kiddy Porn preteen
        2001347 || ET INAPPROPRIATE Kiddy Porn pre-teen
        2001348 || ET INAPPROPRIATE Kiddy Porn early teen
        2001349 || ET INAPPROPRIATE free XXX
        2001350 || ET INAPPROPRIATE hardcore anal
        2001351 || ET INAPPROPRIATE masturbation
        2001352 || ET INAPPROPRIATE ejaculation
        2001353 || ET INAPPROPRIATE BDSM
        2001386 || ET INAPPROPRIATE Kiddy Porn pthc
        2001387 || ET INAPPROPRIATE Kiddy Porn zeps
        2001388 || ET INAPPROPRIATE Kiddy Porn r at ...2850...
        2001389 || ET INAPPROPRIATE Kiddy Porn childlover
        2001392 || ET INAPPROPRIATE Sextracker Tracking Code Detected (1)
        2001393 || ET INAPPROPRIATE Sextracker Tracking Code Detected (2)
        2001608 || ET INAPPROPRIATE Likely Porn
        2002101 || ET GAMES Battle.net Starcraft login
        2002102 || ET GAMES Battle.net Brood War login
        2002103 || ET GAMES Battle.net Diablo login
        2002104 || ET GAMES Battle.net Diablo 2 login
        2002105 || ET GAMES Battle.net Diablo 2 Lord of Destruction login
        2002106 || ET GAMES Battle.net Warcraft 2 login
        2002107 || ET GAMES Battle.net Warcraft 3 login
        2002108 || ET GAMES Battle.net Warcraft 3\: The Frozen throne login
        2002109 || ET GAMES Battle.net old game version
        2002110 || ET GAMES Battle.net invalid version
        2002111 || ET GAMES Battle.net invalid cdkey
        2002112 || ET GAMES Battle.net cdkey in use
        2002113 || ET GAMES Battle.net banned key
        2002114 || ET GAMES Battle.net wrong product
        2002115 || ET GAMES Battle.net failed account login (OLS)\: wrong password
        2002116 || ET GAMES Battle.net failed account login (NLS)\: wrong password
        2002117 || ET GAMES Battle.net connection reset (possible IP-Ban)
        2002118 || ET GAMES Battle.net user in channel
        2002119 || ET GAMES Battle.net outgoing chat message
        2002138 || ET GAMES World of Warcraft connection
        2002139 || ET GAMES World of Warcraft failed logon
        2002140 || ET GAMES Battle.net user joined channel
        2002141 || ET GAMES Battle.net user left channel
        2002142 || ET GAMES Battle.net received whisper message
        2002143 || ET GAMES Battle.net received server broadcast
        2002144 || ET GAMES Battle.net joined channel
        2002145 || ET GAMES Battle.net user had a flags update
        2002146 || ET GAMES Battle.net sent a whisper
        2002147 || ET GAMES Battle.net channel full
        2002148 || ET GAMES Battle.net channel doesn't exist
        2002149 || ET GAMES Battle.net channel is restricted
        2002150 || ET GAMES Battle.net informational message
        2002151 || ET GAMES Battle.net error message
        2002152 || ET GAMES Battle.net 'emote' message
        2002154 || ET GAMES Guild Wars connection
        2002155 || ET GAMES Steam connection
        2002170 || ET GAMES Battle.net incoming chat message
        2002855 || ET GAMES Blizzard Downloader || url,www.worldofwarcraft.com/info/faq/blizzarddownloader.html
        2002925 || ET INAPPROPRIATE Google Image Search, Safe Mode Off
        2003089 || ET GAMES STEAM Connection (v2)
        2007788 || ET MALWARE Theinstalls.com Initial Checkin || url,www.theinstalls.com
        2007798 || ET MALWARE Theinstalls.com Trojan Download || url,www.theinstalls.com

[---]     Removed non-rule lines:    [---]

     -> Removed from bleeding-sid-msg.map (57):
        2001346 || BLEEDING-EDGE INAPPROPRIATE Kiddy Porn preteen
        2001347 || BLEEDING-EDGE INAPPROPRIATE Kiddy Porn pre-teen
        2001348 || BLEEDING-EDGE INAPPROPRIATE Kiddy Porn early teen
        2001349 || BLEEDING-EDGE INAPPROPRIATE free XXX
        2001350 || BLEEDING-EDGE INAPPROPRIATE hardcore anal
        2001351 || BLEEDING-EDGE INAPPROPRIATE masturbation
        2001352 || BLEEDING-EDGE INAPPROPRIATE ejaculation
        2001353 || BLEEDING-EDGE INAPPROPRIATE BDSM
        2001386 || BLEEDING-EDGE INAPPROPRIATE Kiddy Porn pthc
        2001387 || BLEEDING-EDGE INAPPROPRIATE Kiddy Porn zeps
        2001388 || BLEEDING-EDGE INAPPROPRIATE Kiddy Porn r at ...2850...
        2001389 || BLEEDING-EDGE INAPPROPRIATE Kiddy Porn childlover
        2001392 || BLEEDING-EDGE INAPPROPRIATE Sextracker Tracking Code Detected (1)
        2001393 || BLEEDING-EDGE INAPPROPRIATE Sextracker Tracking Code Detected (2)
        2001608 || BLEEDING-EDGE INAPPROPRIATE Likely Porn
        2002101 || BLEEDING-EDGE GAMES Battle.net Starcraft login
        2002102 || BLEEDING-EDGE GAMES Battle.net Brood War login
        2002103 || BLEEDING-EDGE GAMES Battle.net Diablo login
        2002104 || BLEEDING-EDGE GAMES Battle.net Diablo 2 login
        2002105 || BLEEDING-EDGE GAMES Battle.net Diablo 2 Lord of Destruction login
        2002106 || BLEEDING-EDGE GAMES Battle.net Warcraft 2 login
        2002107 || BLEEDING-EDGE GAMES Battle.net Warcraft 3 login
        2002108 || BLEEDING-EDGE GAMES Battle.net Warcraft 3\: The Frozen throne login
        2002109 || BLEEDING-EDGE GAMES Battle.net old game version
        2002110 || BLEEDING-EDGE GAMES Battle.net invalid version
        2002111 || BLEEDING-EDGE GAMES Battle.net invalid cdkey
        2002112 || BLEEDING-EDGE GAMES Battle.net cdkey in use
        2002113 || BLEEDING-EDGE GAMES Battle.net banned key
        2002114 || BLEEDING-EDGE GAMES Battle.net wrong product
        2002115 || BLEEDING-EDGE GAMES Battle.net failed account login (OLS)\: wrong password
        2002116 || BLEEDING-EDGE GAMES Battle.net failed account login (NLS)\: wrong password
        2002117 || BLEEDING-EDGE GAMES Battle.net connection reset (possible IP-Ban)
        2002118 || BLEEDING-EDGE GAMES Battle.net user in channel
        2002119 || BLEEDING-EDGE GAMES Battle.net outgoing chat message
        2002138 || BLEEDING-EDGE GAMES World of Warcraft connection
        2002139 || BLEEDING-EDGE GAMES World of Warcraft failed logon
        2002140 || BLEEDING-EDGE GAMES Battle.net user joined channel
        2002141 || BLEEDING-EDGE GAMES Battle.net user left channel
        2002142 || BLEEDING-EDGE GAMES Battle.net received whisper message
        2002143 || BLEEDING-EDGE GAMES Battle.net received server broadcast
        2002144 || BLEEDING-EDGE GAMES Battle.net joined channel
        2002145 || BLEEDING-EDGE GAMES Battle.net user had a flags update
        2002146 || BLEEDING-EDGE GAMES Battle.net sent a whisper
        2002147 || BLEEDING-EDGE GAMES Battle.net channel full
        2002148 || BLEEDING-EDGE GAMES Battle.net channel doesn't exist
        2002149 || BLEEDING-EDGE GAMES Battle.net channel is restricted
        2002150 || BLEEDING-EDGE GAMES Battle.net informational message
        2002151 || BLEEDING-EDGE GAMES Battle.net error message
        2002152 || BLEEDING-EDGE GAMES Battle.net 'emote' message
        2002154 || BLEEDING-EDGE GAMES Guild Wars connection
        2002155 || BLEEDING-EDGE GAMES Steam connection
        2002170 || BLEEDING-EDGE GAMES Battle.net incoming chat message
        2002855 || BLEEDING-EDGE GAMES Blizzard Downloader || url,www.worldofwarcraft.com/info/faq/blizzarddownloader.html
        2002925 || BLEEDING-EDGE INAPPROPRIATE Google Image Search, Safe Mode Off
        2003089 || BLEEDING-EDGE GAMES STEAM Connection (v2)
        2404017 || ET DROP Known Bot C&C Server Traffic (group 18)  || url,www.shadowserver.org
        2405017 || ET DROP Known Bot C&C Traffic (group 18) - BLOCKING SOURCE || url,www.shadowserver.org

     -> Removed from bleeding-sid-msg.map.txt (57):
        2001346 || BLEEDING-EDGE INAPPROPRIATE Kiddy Porn preteen
        2001347 || BLEEDING-EDGE INAPPROPRIATE Kiddy Porn pre-teen
        2001348 || BLEEDING-EDGE INAPPROPRIATE Kiddy Porn early teen
        2001349 || BLEEDING-EDGE INAPPROPRIATE free XXX
        2001350 || BLEEDING-EDGE INAPPROPRIATE hardcore anal
        2001351 || BLEEDING-EDGE INAPPROPRIATE masturbation
        2001352 || BLEEDING-EDGE INAPPROPRIATE ejaculation
        2001353 || BLEEDING-EDGE INAPPROPRIATE BDSM
        2001386 || BLEEDING-EDGE INAPPROPRIATE Kiddy Porn pthc
        2001387 || BLEEDING-EDGE INAPPROPRIATE Kiddy Porn zeps
        2001388 || BLEEDING-EDGE INAPPROPRIATE Kiddy Porn r at ...2850...
        2001389 || BLEEDING-EDGE INAPPROPRIATE Kiddy Porn childlover
        2001392 || BLEEDING-EDGE INAPPROPRIATE Sextracker Tracking Code Detected (1)
        2001393 || BLEEDING-EDGE INAPPROPRIATE Sextracker Tracking Code Detected (2)
        2001608 || BLEEDING-EDGE INAPPROPRIATE Likely Porn
        2002101 || BLEEDING-EDGE GAMES Battle.net Starcraft login
        2002102 || BLEEDING-EDGE GAMES Battle.net Brood War login
        2002103 || BLEEDING-EDGE GAMES Battle.net Diablo login
        2002104 || BLEEDING-EDGE GAMES Battle.net Diablo 2 login
        2002105 || BLEEDING-EDGE GAMES Battle.net Diablo 2 Lord of Destruction login
        2002106 || BLEEDING-EDGE GAMES Battle.net Warcraft 2 login
        2002107 || BLEEDING-EDGE GAMES Battle.net Warcraft 3 login
        2002108 || BLEEDING-EDGE GAMES Battle.net Warcraft 3\: The Frozen throne login
        2002109 || BLEEDING-EDGE GAMES Battle.net old game version
        2002110 || BLEEDING-EDGE GAMES Battle.net invalid version
        2002111 || BLEEDING-EDGE GAMES Battle.net invalid cdkey
        2002112 || BLEEDING-EDGE GAMES Battle.net cdkey in use
        2002113 || BLEEDING-EDGE GAMES Battle.net banned key
        2002114 || BLEEDING-EDGE GAMES Battle.net wrong product
        2002115 || BLEEDING-EDGE GAMES Battle.net failed account login (OLS)\: wrong password
        2002116 || BLEEDING-EDGE GAMES Battle.net failed account login (NLS)\: wrong password
        2002117 || BLEEDING-EDGE GAMES Battle.net connection reset (possible IP-Ban)
        2002118 || BLEEDING-EDGE GAMES Battle.net user in channel
        2002119 || BLEEDING-EDGE GAMES Battle.net outgoing chat message
        2002138 || BLEEDING-EDGE GAMES World of Warcraft connection
        2002139 || BLEEDING-EDGE GAMES World of Warcraft failed logon
        2002140 || BLEEDING-EDGE GAMES Battle.net user joined channel
        2002141 || BLEEDING-EDGE GAMES Battle.net user left channel
        2002142 || BLEEDING-EDGE GAMES Battle.net received whisper message
        2002143 || BLEEDING-EDGE GAMES Battle.net received server broadcast
        2002144 || BLEEDING-EDGE GAMES Battle.net joined channel
        2002145 || BLEEDING-EDGE GAMES Battle.net user had a flags update
        2002146 || BLEEDING-EDGE GAMES Battle.net sent a whisper
        2002147 || BLEEDING-EDGE GAMES Battle.net channel full
        2002148 || BLEEDING-EDGE GAMES Battle.net channel doesn't exist
        2002149 || BLEEDING-EDGE GAMES Battle.net channel is restricted
        2002150 || BLEEDING-EDGE GAMES Battle.net informational message
        2002151 || BLEEDING-EDGE GAMES Battle.net error message
        2002152 || BLEEDING-EDGE GAMES Battle.net 'emote' message
        2002154 || BLEEDING-EDGE GAMES Guild Wars connection
        2002155 || BLEEDING-EDGE GAMES Steam connection
        2002170 || BLEEDING-EDGE GAMES Battle.net incoming chat message
        2002855 || BLEEDING-EDGE GAMES Blizzard Downloader || url,www.worldofwarcraft.com/info/faq/blizzarddownloader.html
        2002925 || BLEEDING-EDGE INAPPROPRIATE Google Image Search, Safe Mode Off
        2003089 || BLEEDING-EDGE GAMES STEAM Connection (v2)
        2404017 || ET DROP Known Bot C&C Server Traffic (group 18)  || url,www.shadowserver.org
        2405017 || ET DROP Known Bot C&C Traffic (group 18) - BLOCKING SOURCE || url,www.shadowserver.org





More information about the Snort-sigs mailing list