s'il vous plait j'ai une question
 je veux télécharger les rules de snort2.9.11.1 mais ce site n'est pas accessible
 www.snort.org/pub-bin/oinkmaster.cgi/bc301e54be4a7cdc50f1499905d836ed7e5f9a75/snortrules-snapshot-2.9.tar.gz

2018-06-04 19:24 GMT+02:00 <snort-sigs-request@lists.snort.org>:
Send Snort-sigs mailing list submissions to
        snort-sigs@lists.snort.org

To subscribe or unsubscribe via the World Wide Web, visit
        https://lists.snort.org/mailman/listinfo/snort-sigs
or, via email, send a message with subject or body 'help' to
        snort-sigs-request@lists.snort.org

You can reach the person managing the list at
        snort-sigs-owner@lists.snort.org

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Snort-sigs digest..."

Today's Topics:

   1. Win.Trojan.Danabot (Y M)
   2. Win.Trojan.Nocturnal (Y M)


---------- Message transféré ----------
From: Y M <snort@outlook.com>
To: snort-sigs <snort-sigs@lists.snort.org>
Cc: 
Bcc: 
Date: Mon, 4 Jun 2018 17:22:53 +0000
Subject: [Snort-sigs] Win.Trojan.Danabot
Hi,

Pcap is available for this one.

# --------------------
# Date: 2018-06-01
# Title: DanaBot - A new banking Trojan surfaces Down Under
# Tests: pcap

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Danabot loader outbound connection"; flow:to_server,established; content:"GET"; http_method; content:"/index.php?a="; fast_pattern:only; http_uri; content:"&b="; http_uri; content:"&c="; http_uri; content:"&d="; http_uri; content:"&e="; http_uri; content:!"Referer"; http_header;metadata:ruleset community, service http; reference:url,www.proofpoint.com/us/threat-insight/post/danabot-new-banking-trojan-surfaces-down-under-0; classtype:trojan-activity; sid:8000098; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Danabot outbound connection"; flow:to_server,established; content:"GET"; http_method; content:"/index.php?m="; fast_pattern:only; http_uri; content:"&a="; http_uri;  content:"&b="; http_uri; content:"&c="; http_uri; content:"&d="; http_uri; content:"&e="; http_uri; content:!"Referer"; http_header;metadata:ruleset community, service http; reference:url,www.proofpoint.com/us/threat-insight/post/danabot-new-banking-trojan-surfaces-down-under-0; classtype:trojan-activity; sid:8000099; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"MALWARE-CNC Win.Trojan.Danabot outbound connection"; flow:to_server,established; dsize:<120; content:"|01|"; offset:8; content:"|3D|"; distance:15; content:"29058CCE9C17E1759747C6B67EC1A5A9|FF FF FF FF|"; distance:57; isdataat:!1,relative; metadata:ruleset community, service http; reference:url,www.proofpoint.com/us/threat-insight/post/danabot-new-banking-trojan-surfaces-down-under-0; classtype:trojan-activity; sid:8000100; rev:1;)


Thanks.
YM


---------- Message transféré ----------
From: Y M <snort@outlook.com>
To: snort-sigs <snort-sigs@lists.snort.org>
Cc: 
Bcc: 
Date: Mon, 4 Jun 2018 17:24:35 +0000
Subject: [Snort-sigs] Win.Trojan.Nocturnal
Hi,

Unfortunately, I don't have pcaps for these.

# --------------------
# Date: 2018-06-01
# Title: Thief in the night: New Nocturnal Stealer grabs data on the cheap
# Tests: syntax only

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Nocturnal outbound connection"; flow:to_server,established; content:"POST"; http_method; content:"Content-Disposition: form-data|3B| name=|22|hwid|22|"; fast_pattern:only; http_client_body; content:"Content-Disposition: form-data|3B| name=|22|os|22|"; http_client_body; content:"Content-Disposition: form-data|3B| name=|22|platform|22|"; http_client_body; content:"Content-Disposition: form-data|3B| name=|22|profile|22|"; http_client_body; content:"Content-Disposition: form-data|3B| name=|22|user|22|"; http_client_body; content:"Content-Disposition: form-data|3B| name=|22|pcount|22|"; http_client_body; content:"Content-Disposition: form-data|3B| name=|22|cccount|22|"; http_client_body; metadata:ruleset community, service http; reference:url,www.proofpoint.com/us/threat-insight/post/thief-night-new-nocturnal-stealer-grabs-data-cheap; classtype:trojan-activity; sid:8000096; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"MALWARE-CNC known malicious user-agent - Win.Trojan.Nocturnal"; flow:to_server,established; content:"User-Agent: Nocturnal/"; fast_pattern:only; http_header; metadata:ruleset community, service http; reference:url,www.proofpoint.com/us/threat-insight/post/thief-night-new-nocturnal-stealer-grabs-data-cheap; classtype:trojan-activity; sid:8000097; rev:1;)


Thanks.
YM

_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.snort.org
https://lists.snort.org/mailman/listinfo/snort-sigs
http://www.snort.org

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Please visit http://blog.snort.org for the latest news about Snort!