[Snort-sigs] [Emerging-Sigs] New rule offered for detecting Zimbra conf/localconfig.xml attempt

Will Metcalf william.metcalf at ...2420...
Thu Jan 16 17:21:04 EST 2014


Might be useful for proxied environments? Will get this into QA thanks.

Regards,

Will


On Wed, Jan 15, 2014 at 3:01 PM, rmkml <rmkml at ...174...> wrote:

> Hi,
>
> I'm offer a new rule for detecting Zimbra conf/localconfig.xml attempt.
>
> Warn: Zimbra run over HTTPS (no pb with etplc).
>
> alert tcp any any -> any $HTTPS_PORTS (msg:"WEB-MISC Zimbra
> conf/localconfig.xml attempt"; flow:to_server,established;
> content:"conf/localconfig.xml"; nocase; http_uri;
> reference:cve,2013-7091; reference:bugtraq,64149; reference:osvdb,100747;
> reference:exploitdb,30472; reference:cxsecurity,WLB-2013120097;
> classtype:web-application-attack; sid:1; rev:1; )
>
> Please check all variables before use.
>
> Discovered during my new project http://etplc.org
>
> All comments are welcome.
>
> Regards
> @Rmkml
> _______________________________________________
> Emerging-sigs mailing list
> Emerging-sigs at ...3694...
> https://lists.emergingthreats.net/mailman/listinfo/emerging-sigs
>
> Support Emerging Threats! Subscribe to Emerging Threats Pro
> http://www.emergingthreats.net
> The ONLY place to get complete premium rulesets for all versions of
> Suricata and Snort 2.4.0 through Current!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20140116/efed73f2/attachment.html>


More information about the Snort-sigs mailing list