[Snort-sigs] Snort-sigs Digest, Vol 13, Issue 3

Alex McDonnell amcdonnell at sourcefire.com
Tue Jun 5 11:21:02 EDT 2018


Essaye de cette page: https://www.snort.org/downloads/#rule-downloads.

Si tu n'est n'est pas abonné utilise
https://www.snort.org/downloads/registered/snortrules-snapshot-29111.tar.gz
si tu est enregistré.

Alexandre

On Tue, Jun 5, 2018 at 11:03 AM, oumaima el jaouhari via Snort-sigs <
snort-sigs at lists.snort.org> wrote:

> s'il vous plait j'ai une question
>  je veux télécharger les rules de snort2.9.11.1 mais ce site n'est pas
> accessible
>  www.snort.org/pub-bin/oinkmaster.cgi/bc301e54be4a7cdc50f1499905d836
> ed7e5f9a75/snortrules-snapshot-2.9.tar.gz
>
> 2018-06-04 19:24 GMT+02:00 <snort-sigs-request at lists.snort.org>:
>
>> Send Snort-sigs mailing list submissions to
>>         snort-sigs at lists.snort.org
>>
>> To subscribe or unsubscribe via the World Wide Web, visit
>>         https://lists.snort.org/mailman/listinfo/snort-sigs
>> or, via email, send a message with subject or body 'help' to
>>         snort-sigs-request at lists.snort.org
>>
>> You can reach the person managing the list at
>>         snort-sigs-owner at lists.snort.org
>>
>> When replying, please edit your Subject line so it is more specific
>> than "Re: Contents of Snort-sigs digest..."
>>
>> Today's Topics:
>>
>>    1. Win.Trojan.Danabot (Y M)
>>    2. Win.Trojan.Nocturnal (Y M)
>>
>>
>> ---------- Message transféré ----------
>> From: Y M <snort at outlook.com>
>> To: snort-sigs <snort-sigs at lists.snort.org>
>> Cc:
>> Bcc:
>> Date: Mon, 4 Jun 2018 17:22:53 +0000
>> Subject: [Snort-sigs] Win.Trojan.Danabot
>> Hi,
>>
>> Pcap is available for this one.
>>
>> # --------------------
>> # Date: 2018-06-01
>> # Title: DanaBot - A new banking Trojan surfaces Down Under
>> # Tests: pcap
>> # Reference: https://www.proofpoint.com/us/threat-insight/post/danabot-ne
>> w-banking-trojan-surfaces-down-under-0, https://www.virustotal.com/#/f
>> ile/e59fdd99c210415e5097d9703bad950d38f448b3f98bb35f0bdc83ac
>> 2a41a60b/behavior, https://www.virustotal.com/#/f
>> ile/6ece271a0088c88ed29f4b78eab00d0e7800da63757b79b6e6c3838f
>> 39aa7b69/behavior
>>
>> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC
>> Win.Trojan.Danabot loader outbound connection"; flow:to_server,established;
>> content:"GET"; http_method; content:"/index.php?a="; fast_pattern:only;
>> http_uri; content:"&b="; http_uri; content:"&c="; http_uri; content:"&d=";
>> http_uri; content:"&e="; http_uri; content:!"Referer";
>> http_header;metadata:ruleset community, service http; reference:url,
>> www.proofpoint.com/us/threat-insight/post/dana
>> bot-new-banking-trojan-surfaces-down-under-0; classtype:trojan-activity;
>> sid:8000098; rev:1;)
>>
>> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC
>> Win.Trojan.Danabot outbound connection"; flow:to_server,established;
>> content:"GET"; http_method; content:"/index.php?m="; fast_pattern:only;
>> http_uri; content:"&a="; http_uri;  content:"&b="; http_uri; content:"&c=";
>> http_uri; content:"&d="; http_uri; content:"&e="; http_uri;
>> content:!"Referer"; http_header;metadata:ruleset community, service http;
>> reference:url,www.proofpoint.com/us/threat-insight/post/dana
>> bot-new-banking-trojan-surfaces-down-under-0; classtype:trojan-activity;
>> sid:8000099; rev:1;)
>>
>> alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC
>> Win.Trojan.Danabot outbound connection"; flow:to_server,established;
>> dsize:<120; content:"|01|"; offset:8; content:"|3D|"; distance:15;
>> content:"29058CCE9C17E1759747C6B67EC1A5A9|FF FF FF FF|"; distance:57;
>> isdataat:!1,relative; metadata:ruleset community, service http;
>> reference:url,www.proofpoint.com/us/threat-insight/post/dana
>> bot-new-banking-trojan-surfaces-down-under-0; classtype:trojan-activity;
>> sid:8000100; rev:1;)
>>
>> Thanks.
>> YM
>>
>>
>> ---------- Message transféré ----------
>> From: Y M <snort at outlook.com>
>> To: snort-sigs <snort-sigs at lists.snort.org>
>> Cc:
>> Bcc:
>> Date: Mon, 4 Jun 2018 17:24:35 +0000
>> Subject: [Snort-sigs] Win.Trojan.Nocturnal
>> Hi,
>>
>> Unfortunately, I don't have pcaps for these.
>>
>> # --------------------
>> # Date: 2018-06-01
>> # Title: Thief in the night: New Nocturnal Stealer grabs data on the cheap
>> # Tests: syntax only
>> # Reference: https://www.proofpoint.com/us/threat-insight/post/thief-nigh
>> t-new-nocturnal-stealer-grabs-data-cheap, https://www.virustotal.com/#/f
>> ile/ae7e5a7b34dc216e9da384fcf9868ab2c1a1d731f583f893b2d2d400
>> 9da15a4e/detection
>>
>> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC
>> Win.Trojan.Nocturnal outbound connection"; flow:to_server,established;
>> content:"POST"; http_method; content:"Content-Disposition: form-data|3B|
>> name=|22|hwid|22|"; fast_pattern:only; http_client_body;
>> content:"Content-Disposition: form-data|3B| name=|22|os|22|";
>> http_client_body; content:"Content-Disposition: form-data|3B|
>> name=|22|platform|22|"; http_client_body; content:"Content-Disposition:
>> form-data|3B| name=|22|profile|22|"; http_client_body;
>> content:"Content-Disposition: form-data|3B| name=|22|user|22|";
>> http_client_body; content:"Content-Disposition: form-data|3B|
>> name=|22|pcount|22|"; http_client_body; content:"Content-Disposition:
>> form-data|3B| name=|22|cccount|22|"; http_client_body; metadata:ruleset
>> community, service http; reference:url,www.proofpoint.c
>> om/us/threat-insight/post/thief-night-new-nocturnal-stealer-
>> grabs-data-cheap; classtype:trojan-activity; sid:8000096; rev:1;)
>>
>> alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC
>> known malicious user-agent - Win.Trojan.Nocturnal";
>> flow:to_server,established; content:"User-Agent: Nocturnal/";
>> fast_pattern:only; http_header; metadata:ruleset community, service http;
>> reference:url,www.proofpoint.com/us/threat-insight/post/thie
>> f-night-new-nocturnal-stealer-grabs-data-cheap;
>> classtype:trojan-activity; sid:8000097; rev:1;)
>>
>> Thanks.
>> YM
>>
>> _______________________________________________
>> Snort-sigs mailing list
>> Snort-sigs at lists.snort.org
>> https://lists.snort.org/mailman/listinfo/snort-sigs
>> http://www.snort.org
>>
>> Please follow these rules: https://snort.org/faq/what-is-
>> the-mailing-list-etiquette
>>
>> Please visit http://blog.snort.org for the latest news about Snort!
>>
>>
>
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs at lists.snort.org
> https://lists.snort.org/mailman/listinfo/snort-sigs
>
> Please visit http://blog.snort.org for the latest news about Snort!
>
> Please follow these rules: https://snort.org/faq/what-is-
> the-mailing-list-etiquette
>
> Visit the Snort.org to subscribe to the official Snort ruleset, make sure
> to stay up to date to catch the most <a href="
> https://snort.org/downloads/#rule-downloads">emerging threats</a>!
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-sigs/attachments/20180605/91a90a51/attachment-0001.html>


More information about the Snort-sigs mailing list