Ruleset Update Summary - 2026/09/07 - v11278

Ruleset Updates
1

Summary:

0 new OPEN, 0 new PRO (0 + 0)

Modified inactive rules:

  • 2000006 - ET DOS Cisco Router HTTP DoS (dos.rules)
  • 2000011 - ET DOS Catalyst memory leak attack (dos.rules)
  • 2000025 - ET ADWARE_PUP Gator Cookie (adware_pup.rules)
  • 2000032 - ET NETBIOS LSA exploit (netbios.rules)
  • 2000366 - ET ADWARE_PUP Binet (download complete) (adware_pup.rules)
  • 2000367 - ET ADWARE_PUP Binet (set_pix) (adware_pup.rules)
  • 2000371 - ET ADWARE_PUP Binet (randreco.exe) (adware_pup.rules)
  • 2000559 - ET WEB_SERVER THCIISLame IIS SSL Exploit Attempt (web_server.rules)
  • 2000574 - ET ADWARE_PUP Bargain Buddy (adware_pup.rules)
  • 2000580 - ET ADWARE_PUP Shop At Home Select.com Install Attempt (adware_pup.rules)
  • 2000582 - ET ADWARE_PUP F1Organizer Reporting (adware_pup.rules)
  • 2000583 - ET ADWARE_PUP Mindset Interactive Install (1) (adware_pup.rules)
  • 2000584 - ET ADWARE_PUP Mindset Interactive Install (2) (adware_pup.rules)
  • 2000585 - ET ADWARE_PUP F1Organizer Install Attempt (adware_pup.rules)
  • 2000589 - ET ADWARE_PUP TopMoxie Retrieving Data (downloads) (adware_pup.rules)
  • 2000590 - ET ADWARE_PUP TopMoxie Retrieving Data (common) (adware_pup.rules)
  • 2000593 - ET ADWARE_PUP Binet Ad Retrieval (adware_pup.rules)
  • 2000597 - ET ADWARE_PUP Gator New Code Download (adware_pup.rules)
  • 2000599 - ET ADWARE_PUP Fun Web Products Install (adware_pup.rules)
  • 2000600 - ET ADWARE_PUP MyWebSearch Toolbar Receiving Configuration (adware_pup.rules)
  • 2000601 - ET ADWARE_PUP Salongas Infection (adware_pup.rules)
  • 2000902 - ET ADWARE_PUP MarketScore.com Spyware Configuration Access (adware_pup.rules)
  • 2000903 - ET ADWARE_PUP Avres Agent Receiving Instructions (adware_pup.rules)
  • 2000908 - ET ADWARE_PUP WhenUClick.com App and Search Bar Install (1) (adware_pup.rules)
  • 2000909 - ET ADWARE_PUP WhenUClick.com App and Search Bar Install (2) (adware_pup.rules)
  • 2000910 - ET ADWARE_PUP WhenUClick.com Clock Sync App Checkin (adware_pup.rules)
  • 2000911 - ET ADWARE_PUP WhenUClick.com Weather App Checkin (adware_pup.rules)
  • 2000912 - ET ADWARE_PUP WhenUClick.com Clock Sync App Checkin (1) (adware_pup.rules)
  • 2000913 - ET ADWARE_PUP WhenUClick.com Clock Sync App Checkin (2) (adware_pup.rules)
  • 2000914 - ET ADWARE_PUP WhenUClick.com Weather App Checkin (1) (adware_pup.rules)
  • 2000931 - ET ADWARE_PUP Comet Systems Spyware Traffic (adware_pup.rules)
  • 2001013 - ET ADWARE_PUP Fun Web Products SmileyCentral (adware_pup.rules)
  • 2001055 - ET MISC HP Web JetAdmin ExecuteFile admin access (misc.rules)
  • 2001066 - ET MALWARE IE Ilookup Trojan (malware.rules)
  • 2001225 - ET ADWARE_PUP Statblaster Receiving New configuration (update) (adware_pup.rules)
  • 2001453 - ET ADWARE_PUP Couponage Download (adware_pup.rules)
  • 2001456 - ET ADWARE_PUP ContextPanel Reporting (adware_pup.rules)
  • 2001460 - ET ADWARE_PUP Sexmaniack Install Tracking (adware_pup.rules)
  • 2001463 - ET ADWARE_PUP Xpire.info Multiple Spyware Installs (2) (adware_pup.rules)
  • 2001464 - ET ADWARE_PUP Xpire.info Multiple Spyware Installs (3) (adware_pup.rules)
  • 2001489 - ET ADWARE_PUP Spygalaxy.ws Spyware Checkin (adware_pup.rules)
  • 2001491 - ET ADWARE_PUP Xpire.info Spyware Checkin (adware_pup.rules)
  • 2001501 - ET ADWARE_PUP Clickspring.net Spyware Reporting (adware_pup.rules)
  • 2001503 - ET ADWARE_PUP Medialoads.com Spyware Config (adware_pup.rules)
  • 2001507 - ET ADWARE_PUP Medialoads.com Spyware Identifying Country of Origin (adware_pup.rules)
  • 2001509 - ET ADWARE_PUP Medialoads.com Spyware Reporting (register.cgi) (adware_pup.rules)
  • 2001520 - ET ADWARE_PUP Spywaremover Activity (adware_pup.rules)
  • 2001522 - ET ADWARE_PUP SpywareLabs Application Install (adware_pup.rules)
  • 2001526 - ET ADWARE_PUP Virtumonde Spyware Code Download bkinst.exe (adware_pup.rules)
  • 2001537 - ET ADWARE_PUP Spyspotter.com Access (adware_pup.rules)
  • 2001563 - ET ADWARE_PUP MarketScore.com Spyware SSL Access (adware_pup.rules)
  • 2001570 - ET ADWARE_PUP Spyware Stormer Reporting Data (adware_pup.rules)
  • 2001628 - ET ATTACK_RESPONSE Outbound PHP Connection (attack_response.rules)
  • 2001650 - ET ADWARE_PUP Search Scout Related Spyware (content) (adware_pup.rules)
  • 2001653 - ET ADWARE_PUP Search Scout Related Spyware (results) (adware_pup.rules)
  • 2001656 - ET ADWARE_PUP GlobalPhon.com Dialer (adware_pup.rules)
  • 2001658 - ET ADWARE_PUP Comet Systems Spyware Reporting (adware_pup.rules)
  • 2001659 - ET ADWARE_PUP GlobalPhon.com Dialer (no_pop) (adware_pup.rules)
  • 2001660 - ET ADWARE_PUP GlobalPhon.com Dialer (add_ocx) (adware_pup.rules)
  • 2001666 - ET ADWARE_PUP Metarewards Spyware Activity (adware_pup.rules)
  • 2001678 - ET ADWARE_PUP Webhancer Agent Activity (adware_pup.rules)
  • 2001683 - ET ADWARE_PUP Windows executable sent when remote host claims to send an image (adware_pup.rules)
  • 2001701 - ET ADWARE_PUP Windupdates.com Spyware Loggin Data (adware_pup.rules)
  • 2001794 - ET ADWARE_PUP Incredisearch.com Spyware Activity (adware_pup.rules)
  • 2001795 - ET DOS Excessive SMTP MAIL-FROM DDoS (dos.rules)
  • 2001947 - ET ADWARE_PUP Zenotecnico Adware (adware_pup.rules)
  • 2002032 - ET MALWARE IRC Potential DDoS command 1 (malware.rules)
  • 2002064 - ET NETBIOS ms05-011 exploit (netbios.rules)
  • 2002158 - ET WEB_SERVER XML-RPC for PHP Remote Code Injection (web_server.rules)
  • 2002169 - ET ADWARE_PUP iWon Spyware (iWonSearchAssistant) (adware_pup.rules)
  • 2002186 - ET NETBIOS SMB-DS Microsoft Windows 2000 Plug and Play Vulnerability (netbios.rules)
  • 2002201 - ET NETBIOS SMB-DS DCERPC PnP QueryResConfList exploit attempt (netbios.rules)
  • 2002203 - ET NETBIOS SMB DCERPC PnP QueryResConfList exploit attempt (netbios.rules)
  • 2002365 - ET WEB_SERVER HP OpenView Network Node Manager Remote Command Execution Attempt (web_server.rules)
  • 2002736 - ET ADWARE_PUP Trafficsector.com Spyware Install (adware_pup.rules)
  • 2002740 - ET ADWARE_PUP adservs.com Spyware (adware_pup.rules)
  • 2002766 - ET ADWARE_PUP Corpsespyware.net BlackList - pcpeek (adware_pup.rules)
  • 2002767 - ET ADWARE_PUP Corpsespyware.net Distribution - bos.biz (adware_pup.rules)
  • 2002769 - ET ADWARE_PUP Corpsespyware.net Distribution - studiolacase (adware_pup.rules)
  • 2002775 - ET MALWARE Goldun Reporting User Activity (malware.rules)
  • 2002776 - ET MALWARE SickleBot Reporting User Activity (malware.rules)
  • 2002780 - ET MALWARE Goldun Reporting User Activity 2 (malware.rules)
  • 2002781 - ET MALWARE w32agent.dsi Posting Info (malware.rules)
  • 2002782 - ET MALWARE w32agent.dsi Domain Update (malware.rules)
  • 2002805 - ET ADWARE_PUP Spyaxe Spyware DB Version Check (adware_pup.rules)
  • 2002806 - ET ADWARE_PUP Spyaxe Spyware Checkin (adware_pup.rules)
  • 2002836 - ET ADWARE_PUP MyWebSearch Toolbar Traffic (bar config download) (adware_pup.rules)
  • 2002850 - ET FTP USER login flowbit (ftp.rules)
  • 2002859 - ET MALWARE PassSickle Reporting User Activity (malware.rules)
  • 2002933 - ET ADWARE_PUP CWS Spy-Sheriff.com Infeced Buy Page Request (adware_pup.rules)
  • 2002961 - ET MALWARE Tibs Checkin 2 (malware.rules)
  • 2002975 - ET MALWARE Backdoor.Hupigon INFECTION - Reporting Host Type (malware.rules)
  • 2003031 - ET CHAT Known SSL traffic on port 5222 (Jabber) being excluded from SSL Alerts (chat.rules)
  • 2003032 - ET CHAT Known SSL traffic on port 5223 (Jabber) being excluded from SSL Alerts (chat.rules)
  • 2003058 - ET ADWARE_PUP 180solutions (Zango) Spyware Installer Download (adware_pup.rules)
  • 2003116 - ET MALWARE - Trojan.Proxy.PPAgent.t (updateb) (malware.rules)
  • 2003132 - ET MALWARE BOT - potential DDoS command (2) (malware.rules)
  • 2003157 - ET MALWARE Agobot-SDBot Commands (malware.rules)
  • 2003183 - ET MALWARE Prg Trojan Server Reply (malware.rules)
  • 2003202 - ET ADWARE_PUP Thespyguard.com Spyware Update Check (adware_pup.rules)
  • 2003203 - ET ADWARE_PUP Hitvirus Fake AV Install (adware_pup.rules)
  • 2003204 - ET ADWARE_PUP Thespyguard.com Spyware Updating (adware_pup.rules)
  • 2003208 - ET MALWARE IRC pBot PHP Bot Commands (malware.rules)
  • 2003211 - ET ADWARE_PUP Best-targeted-traffic.com Spyware Ping (adware_pup.rules)
  • 2003218 - ET ADWARE_PUP Conduit Connect Toolbar Message Download(Many report to be benign) (adware_pup.rules)
  • 2003221 - ET ADWARE_PUP MySearchNow.com Spyware (adware_pup.rules)
  • 2003222 - ET ADWARE_PUP MyWebSearch Toolbar Receiving Config 2 (adware_pup.rules)
  • 2003253 - ET ADWARE_PUP MarketScore Spyware Uploading Data (adware_pup.rules)
  • 2003302 - ET MALWARE psyBNC IRC Server Connection (malware.rules)
  • 2003304 - ET ADWARE_PUP Effectivebrands.com Spyware Checkin (adware_pup.rules)
  • 2003341 - ET ADWARE_PUP Baidu.com Spyware Bar Pulling Content (adware_pup.rules)
  • 2003360 - ET ADWARE_PUP Effectivebrands.com Spyware Checkin 2 (adware_pup.rules)
  • 2003389 - ET ADWARE_PUP WhenUClick.com Application Version Check (adware_pup.rules)
  • 2003416 - ET ADWARE_PUP Epilot.com Spyware Reporting Clicks (adware_pup.rules)
  • 2003435 - ET MALWARE Stormy Variant HTTP Request (malware.rules)
  • 2003436 - ET MALWARE Warezov/Stration Communicating with Controller 2 (malware.rules)
  • 2003533 - ET ADWARE_PUP Sytes.net Related Spyware Reporting (adware_pup.rules)
  • 2003543 - ET ADWARE_PUP Winfixmaster.com Fake Anti-Spyware Install (adware_pup.rules)
  • 2003549 - ET MALWARE Bandook v1.2 Initial Connection and Report (malware.rules)
  • 2003551 - ET MALWARE Bandook v1.2 Kill Process Command (malware.rules)
  • 2003552 - ET MALWARE Bandook v1.2 Reporting Socks Proxy Active (malware.rules)
  • 2003553 - ET MALWARE Bandook v1.2 Reporting Socks Proxy Off (malware.rules)
  • 2003554 - ET MALWARE Bandook v1.2 Client Ping Reply (malware.rules)
  • 2003563 - ET MALWARE Bandook v1.35 Start Socks5 Proxy Command Send (malware.rules)
  • 2003606 - ET ADWARE_PUP Alexa Spyware Reporting URL Visited (adware_pup.rules)
  • 2003611 - ET ADWARE_PUP Malwarealarm.com Fake AV/AntiSpyware Updating (adware_pup.rules)
  • 2003612 - ET ADWARE_PUP Malwarealarm.com Fake AV/AntiSpyware Download (adware_pup.rules)
  • 2003619 - ET ADWARE_PUP Alexa Spyware Redirecting User (adware_pup.rules)
  • 2006398 - ET MALWARE Socks666 Checkin Packet (malware.rules)
  • 2006399 - ET MALWARE Socks666 Checkin Success Packet (malware.rules)
  • 2006406 - ET MALWARE Proxy.Win32.Agent.mx (2) (malware.rules)
  • 2006448 - ET MALWARE Win32.Agent.ajx Trojan Reporting to Server (malware.rules)
  • 2006911 - ET MALWARE perlb0t/w0rmb0t Response 2 (malware.rules)
  • 2007142 - ET MALWARE Virtumonde Variant Reporting to Controller via HTTP (malware.rules)
  • 2007285 - ET MALWARE Virtumonde Variant Reporting to Controller via HTTP (2) (malware.rules)
  • 2007573 - ET MALWARE Vundo.dam http Update (malware.rules)
  • 2007601 - ET ADWARE_PUP Advertisementserver.com Spyware Initial Checkin (adware_pup.rules)
  • 2007602 - ET ADWARE_PUP Advertisementserver.com Spyware Checkin (adware_pup.rules)
  • 2007608 - ET MALWARE Win32.Agent.bea C&C connection (malware.rules)
  • 2007652 - ET ATTACK_RESPONSE c99shell phpshell detected (attack_response.rules)
  • 2007686 - ET MALWARE E-Jihad 3.0 DDoS HTTP Activity OUTBOUND (malware.rules)
  • 2007687 - ET MALWARE E-Jihad 3.0 DDoS HTTP Activity INBOUND (malware.rules)
  • 2007692 - ET MALWARE Basine Trojan Checkin (malware.rules)
  • 2007698 - ET MALWARE Vanquish Trojan HTTP Checkin (malware.rules)
  • 2007715 - ET ATTACK_RESPONSE Off-Port FTP Without Banners - user (attack_response.rules)
  • 2007717 - ET ATTACK_RESPONSE Off-Port FTP Without Banners - pass (attack_response.rules)
  • 2007723 - ET ATTACK_RESPONSE Off-Port FTP Without Banners - retr (attack_response.rules)
  • 2007751 - ET MALWARE Saturn Proxy Initial Outbound Checkin (404.txt) (malware.rules)
  • 2007769 - ET MALWARE Zhelatin Update Detected (malware.rules)
  • 2007803 - ET MALWARE Win32.Inject.ql Checkin Post (malware.rules)
  • 2007855 - ET ADWARE_PUP OneStepSearch Host Activity (adware_pup.rules)
  • 2007901 - ET MALWARE Banker.OPX HTTP Checkin (malware.rules)
  • 2007911 - ET MALWARE Delf Download via HTTP (malware.rules)
  • 2007919 - ET MALWARE Dropper-497 Yumato Reply from server (malware.rules)
  • 2007980 - ET MALWARE Backdoor.Win32.VB.brg C&C Kill Command Send (malware.rules)
  • 2007989 - ET MALWARE Vundo HTTP Pre-Install Checkin (malware.rules)
  • 2007990 - ET MALWARE Vundo HTTP Post-Install Checkin (malware.rules)
  • 2007995 - ET ADWARE_PUP Vaccine-program.co.kr Related Spyware Checkin (adware_pup.rules)
  • 2008004 - ET MALWARE Win32.Agent.cyt (Or variant) HTTP POST Checkin (2) (malware.rules)
  • 2008030 - ET MALWARE Turkojan C&C nxt Command Response (nxt) (malware.rules)
  • 2008032 - ET MALWARE Dorf/Win32.Inject.adt C&C Communication Inbound (malware.rules)
  • 2008082 - ET MALWARE Vundo HTTP Post-Install Checkin (2) (malware.rules)
  • 2008177 - ET MALWARE Ceckno Reporting to Controller (malware.rules)
  • 2008178 - ET MALWARE Ceckno Keepalive from Controller (malware.rules)
  • 2008180 - ET ADWARE_PUP V-Clean.com Fake AV Checkin (adware_pup.rules)
  • 2008195 - ET MALWARE Dropper mdodo.com Related Trojan (malware.rules)
  • 2008196 - ET MALWARE Dropper 6dzone.com Related Trojan (malware.rules)
  • 2008197 - ET ADWARE_PUP Winxdefender.com Fake AV Package Post Install Checkin (adware_pup.rules)
  • 2008220 - ET MALWARE Looked.P/Gamania/Delf #109/! Style CnC Checkin Response from Server (malware.rules)
  • 2008221 - ET MALWARE Asprox-style Message ID (malware.rules)
  • 2008222 - ET MALWARE Asprox phishing email detected (malware.rules)
  • 2008236 - ET MALWARE Fake.Googlebar or Softcash.org Related Post-Infection Checkin (malware.rules)
  • 2008250 - ET MALWARE Winspywareprotect.com Fake AV/Anti-Spyware Install Checkin (malware.rules)
  • 2008267 - ET MALWARE Banker.JU Related HTTP Post-infection Checkin (malware.rules)
  • 2008280 - ET MALWARE 3alupKo/Win32.Socks.n Related Checkin URL (malware.rules)
  • 2008283 - ET MALWARE Banload HTTP Checkin Detected (quem=) (malware.rules)
  • 2008291 - ET MALWARE Win32.Onlinegames.ajok CnC Packet to Server (malware.rules)
  • 2008292 - ET MALWARE Win32.Onlinegames.ajok CnC Packet from Server (malware.rules)
  • 2008319 - ET MALWARE Win32.Small.wpx or Related Downloader Posting Data (malware.rules)
  • 2008320 - ET MALWARE Banload Gadu-Gadu CnC Message Detected (malware.rules)
  • 2008324 - ET MALWARE Zalupko/Koceg/Mandaph manda.php Checkin (malware.rules)
  • 2008335 - ET MALWARE Beizhu/Womble/Vipdataend Controller Keepalive (malware.rules)
  • 2008353 - ET MALWARE CoreFlooder.Q C&C Checkin (malware.rules)
  • 2008386 - ET MALWARE Zlob HTTP Checkin (malware.rules)
  • 2008393 - ET MALWARE 3alupKo/Win32.Socks.n Related Checkin URL (2) (malware.rules)
  • 2008396 - ET MALWARE Zlob Initial Check-in Version 2 (confirm.php?sid=) (malware.rules)
  • 2008431 - ET MALWARE PWS.Gamania Checkin (malware.rules)
  • 2008442 - ET MALWARE Rootkit.Win32.Clbd.cz Checkin (malware.rules)
  • 2008471 - ET MALWARE HotLan.C Spambot C&C download command (malware.rules)
  • 2008474 - ET ADWARE_PUP Adware.Look2Me Activity (adware_pup.rules)
  • 2008482 - ET MALWARE thespybot.com installation download detected (malware.rules)
  • 2008515 - ET MALWARE Hupigon.AZG Checkin (malware.rules)
  • 2008522 - ET MALWARE Stpage Checkin (nomodem) (malware.rules)
  • 2008547 - ET MALWARE PECompact2 Packed Binary - Sometimes Hostile (malware.rules)
  • 2008601 - ET MALWARE Visual Shock Keylogger Reporting to Controller (malware.rules)
  • 2008675 - ET MALWARE Backdoor.Win32.Assasin.20.C Control Session Start (malware.rules)
  • 2008676 - ET MALWARE Backdoor.Win32.Assasin.20.C Control Session Server Reply (malware.rules)
  • 2008677 - ET MALWARE Backdoor.Win32.Assasin.20.C Control Channel Client Reply (malware.rules)
  • 2008742 - ET ADWARE_PUP Admoke/Adload.AFB!tr.dldr Checkin (adware_pup.rules)
  • 2008760 - ET MALWARE Insidebar.co.kr Related Infection Checkin (malware.rules)
  • 2008806 - ET MALWARE DNS Changer.bnm/Downloader.bnm CnC Channel Start Response (malware.rules)
  • 2008861 - ET TELNET External Telnet Login Prompt from Cisco Device (telnet.rules)
  • 2008909 - ET SQL MSSQL sp_replwritetovarbin - potential memory overwrite case 1 (sql.rules)
  • 2008911 - ET MALWARE Spyguarder.com Fake AV Install Report (malware.rules)
  • 2008915 - ET ADWARE_PUP MySideSearch.com Spyware Install (adware_pup.rules)
  • 2008949 - ET MALWARE Win32.Small.yml or Related HTTP Checkin (malware.rules)
  • 2008952 - ET MALWARE Win32.Small.yml or Related HTTP Command (malware.rules)
  • 2008976 - ET MALWARE Vundo Variant reporting to Controller via HTTP (1) (malware.rules)
  • 2008977 - ET MALWARE Vundo Variant reporting to Controller via HTTP (2) (malware.rules)
  • 2008984 - ET MALWARE Trojan-GameThief.Win32.OnLineGames infection report (malware.rules)
  • 2009025 - ET MALWARE Vipdataend C&C Traffic Checkin variant 2 (malware.rules)
  • 2009026 - ET MALWARE Vipdataend C&C Traffic - Status OK (variant 2) (malware.rules)
  • 2009079 - ET MALWARE Delfsnif/Buzus.fte Remote Response (malware.rules)
  • 2009091 - ET ADWARE_PUP Adware/Spyware Trymedia.com EXE download (adware_pup.rules)
  • 2009096 - ET MALWARE Tigger.a/Syzor Control Checkin (malware.rules)
  • 2009128 - ET MALWARE Bifrose Connect to Controller (PING PONG) (malware.rules)
  • 2009204 - ET MALWARE Crypt.CFI.Gen Checkin (malware.rules)
  • 2009234 - ET ADWARE_PUP Adware-Mirar Reporting (BAR) (adware_pup.rules)
  • 2009238 - ET MALWARE PcClient Backdoor Checkin Packet 1 (malware.rules)
  • 2009239 - ET MALWARE PcClient Backdoor Checkin (malware.rules)
  • 2009287 - ET MALWARE CoreFlooder C&C Checkin (2) (malware.rules)
  • 2009347 - ET MALWARE Tigger.a/Syzor Checkin (malware.rules)
  • 2009360 - ET MALWARE Bredolab Check In (malware.rules)
  • 2009407 - ET MALWARE Koobface BLACKLABEL (malware.rules)
  • 2009443 - ET MALWARE NoBo Downloader Dropper GET (malware.rules)
  • 2009457 - ET MALWARE Virut Counter/Check-in (malware.rules)
  • 2009517 - ET MALWARE Qhosts Trojan Check-in (malware.rules)
  • 2009518 - ET MALWARE s4t4n1c Trojan Check-in (malware.rules)
  • 2009532 - ET MALWARE BackDoor-EGB Check-in (malware.rules)
  • 2009533 - ET MALWARE Keylogger Pro Update Check (malware.rules)
  • 2009539 - ET MALWARE Downloader Infostealer - GET Checkin (malware.rules)
  • 2009540 - ET MALWARE PCFlashbang.com Spyware Checkin (PCFlashBangA) (malware.rules)
  • 2009558 - ET ATTACK_RESPONSE Metasploit Meterpreter File Download Detected (attack_response.rules)
  • 2009559 - ET ATTACK_RESPONSE Metasploit Meterpreter Process List (ps) Command Detected (attack_response.rules)
  • 2009560 - ET ATTACK_RESPONSE Metasploit Meterpreter Getuid Command Detected (attack_response.rules)
  • 2009561 - ET ATTACK_RESPONSE Metasploit Meterpreter Process Migration Detected (attack_response.rules)
  • 2009562 - ET ATTACK_RESPONSE Metasploit Meterpreter ipconfig Command Detected (attack_response.rules)
  • 2009563 - ET ATTACK_RESPONSE Metasploit Meterpreter Sysinfo Command Detected (attack_response.rules)
  • 2009564 - ET ATTACK_RESPONSE Metasploit Meterpreter Route Command Detected (attack_response.rules)
  • 2009565 - ET ATTACK_RESPONSE Metasploit Meterpreter Kill Process Command Detected (attack_response.rules)
  • 2009566 - ET ATTACK_RESPONSE Metasploit Meterpreter Print Working Directory Command Detected (attack_response.rules)
  • 2009567 - ET ATTACK_RESPONSE Metasploit Meterpreter View Current Process ID Command Detected (attack_response.rules)
  • 2009568 - ET ATTACK_RESPONSE Metasploit Meterpreter Execute Command Detected (attack_response.rules)
  • 2009569 - ET ATTACK_RESPONSE Metasploit Meterpreter System Reboot/Shutdown Detected (attack_response.rules)
  • 2009570 - ET ATTACK_RESPONSE Metasploit Meterpreter System Get Idle Time Command Detected (attack_response.rules)
  • 2009571 - ET ATTACK_RESPONSE Metasploit Meterpreter Make Directory Command Detected (attack_response.rules)
  • 2009572 - ET ATTACK_RESPONSE Metasploit Meterpreter Remove Directory Command Detected (attack_response.rules)
  • 2009573 - ET ATTACK_RESPONSE Metasploit Meterpreter Change Directory Command Detected (attack_response.rules)
  • 2009574 - ET ATTACK_RESPONSE Metasploit Meterpreter List (ls) Command Detected (attack_response.rules)
  • 2009575 - ET ATTACK_RESPONSE Metasploit Meterpreter rev2self Command Detected (attack_response.rules)
  • 2009576 - ET ATTACK_RESPONSE Metasploit Meterpreter Enabling/Disabling of Keyboard Detected (attack_response.rules)
  • 2009577 - ET ATTACK_RESPONSE Metasploit Meterpreter Enabling/Disabling of Mouse Detected (attack_response.rules)
  • 2009578 - ET ATTACK_RESPONSE Metasploit Meterpreter File/Memory Interaction Detected (attack_response.rules)
  • 2009580 - ET ATTACK_RESPONSE Metasploit Meterpreter File Upload Detected (attack_response.rules)
  • 2009676 - ET ATTACK_RESPONSE Ipconfig Response Detected (attack_response.rules)
  • 2009811 - ET MALWARE KillAV/Dropper/Mdrop/Hupigon - HTTP GET (malware.rules)
  • 2009812 - ET MALWARE AVKiller with Backdoor checkin (malware.rules)
  • 2009829 - ET MALWARE Virut/Virutas/Virtob/QQHelper Dropper Family - HTTP GET (malware.rules)
  • 2010100 - ET MALWARE Palevo/BFBot/Mariposa client join attempt (malware.rules)
  • 2010101 - ET MALWARE Palevo/BFBot/Mariposa server join acknowledgement (malware.rules)
  • 2010152 - ET MALWARE Koobface C&C availability check successful (malware.rules)
  • 2010201 - ET MALWARE Silon Encrypted Data POST to C&C (malware.rules)
  • 2010240 - ET MALWARE WindowsEnterpriseSuite FakeAV check-in HEAD (malware.rules)
  • 2010246 - ET MALWARE WindowsEnterpriseSuite FakeAV Reporting via POST initial check-in (malware.rules)
  • 2010268 - ET MALWARE W32.SillyFDC Checkin (malware.rules)
  • 2010647 - ET MALWARE Lethic Spambot CnC Initial Connect Bot Response (malware.rules)
  • 2010648 - ET MALWARE Lethic Spambot CnC Connect Command (malware.rules)
  • 2010649 - ET MALWARE Lethic Spambot CnC Connect Command (port 25 specifically) (malware.rules)
  • 2010973 - ET MALWARE Vobfus/Changeup/Chinky Download Command (malware.rules)
  • 2011012 - ET SNMP Attempted TCP Access Attempt to Cisco IOS 12.1 Hidden Read/Write Community String ILMI (snmp.rules)
  • 2011291 - ET WEB_SERVER Asprox Spambot SQL-Injection Atempt (web_server.rules)
  • 2011294 - ET MALWARE Trojan.Win32.FraudPack.aweo (malware.rules)
  • 2011349 - ET EXPLOIT_KIT DRIVEBY SEO Exploit Kit request for Java exploit (exploit_kit.rules)
  • 2011350 - ET EXPLOIT_KIT DRIVEBY SEO Exploit Kit request for Java and PDF exploits (exploit_kit.rules)
  • 2011357 - ET MALWARE FakeAV SetupSecure Download Attempt SetupSecure (malware.rules)
  • 2011370 - ET MALWARE Stupid Stealer C&C Communication (1) (malware.rules)
  • 2011371 - ET MALWARE Stupid Stealer C&C Communication (2) (malware.rules)
  • 2011395 - ET MALWARE wisp backdoor detected reporting (malware.rules)
  • 2011397 - ET MALWARE FakeYak or Related Infection Checkin 2 (malware.rules)
  • 2011398 - ET MALWARE Yoyo-DDoS Bot Execute DDoS Command From CnC Server (malware.rules)
  • 2011399 - ET MALWARE Yoyo-DDoS Bot Download and Launch Executable Message From CnC Server (malware.rules)
  • 2011400 - ET MALWARE Yoyo-DDoS Bot Execute SYN Flood Command Message From CnC Server (malware.rules)
  • 2011403 - ET MALWARE Yoyo-DDoS Bot HTTP Flood Attack Outbound (malware.rules)
  • 2011470 - ET MALWARE Daurso FTP Credential Theft Reported (malware.rules)
  • 2011471 - ET MALWARE Daurso Checkin (malware.rules)
  • 2011490 - ET MALWARE Downloader.Win32.Zlob.bgs Checkin(1) (malware.rules)
  • 2011491 - ET MALWARE Downloader.Win32.Zlob.bgs Checkin(2) (malware.rules)
  • 2011544 - ET MALWARE JAR Download From Crimepack Exploit Kit (malware.rules)
  • 2011592 - ET MALWARE Yoyo-DDoS Bot Download and Launch Executable Message From CnC Server (malware.rules)
  • 2011812 - ET EXPLOIT_KIT SEO Exploit Kit - Landing Page (exploit_kit.rules)
  • 2011970 - ET CURRENT_EVENTS SWF served from /tmp/ (current_events.rules)
  • 2011988 - ET EXPLOIT_KIT Phoenix-style Exploit Kit Java Request with semicolon in URI (exploit_kit.rules)
  • 2012048 - ET DOS Outbound Low Orbit Ion Cannon LOIC Tool Internal User May Be Participating in DDOS (dos.rules)
  • 2012049 - ET DOS Inbound Low Orbit Ion Cannon LOIC DDOS Tool desu string (dos.rules)
  • 2012050 - ET DOS Outbound Low Orbit Ion Cannon LOIC Tool Internal User May Be Participating in DDOS desu string (dos.rules)
  • 2012865 - ET MALWARE Vinself Backdoor Checkin (malware.rules)
  • 2800004 - ETPRO SMTP Microsoft Outlook Express MHTML URL Processing Vulnerability (smtp.rules)
  • 2800008 - ETPRO WEB_SERVER PHP memory_limit Exploit Attempt (web_server.rules)
  • 2800058 - ETPRO TELNET Microsoft Telnet Client Information Disclosure (telnet.rules)
  • 2800062 - ETPRO SMTP Microsoft Exchange Server iCal Properties Handling Denial of Service (smtp.rules)
  • 2800195 - ETPRO SQL Oracle Database SYS.LT.FINDRICSET SQL Injection (sql.rules)
  • 2800270 - ETPRO SQL SAP MaxDB Remote Arbitrary Commands Execution (sql.rules)
  • 2800345 - ETPRO ADWARE_PUP BugsPrey (Init Connection) (adware_pup.rules)
  • 2800346 - ETPRO ADWARE_PUP BugsPrey (Init Connection Reply) (adware_pup.rules)
  • 2800361 - ETPRO MALWARE aSpy v2.12 (malware.rules)
  • 2800374 - ETPRO NETBIOS Microsoft Windows Internet Printing Service Request (netbios.rules)
  • 2800383 - ETPRO ADWARE_PUP LOST DOOR 3.0 (init connection) (adware_pup.rules)
  • 2800387 - ETPRO MALWARE SynRat 2.1 Pro (init connection) (malware.rules)
  • 2800388 - ETPRO MALWARE SynRat 2.1 Pro (malware.rules)
  • 2800401 - ETPRO NETBIOS Samba Root File System Access Security Bypass 1 (netbios.rules)
  • 2800402 - ETPRO NETBIOS Samba Root File System Access Security Bypass 2 (netbios.rules)
  • 2800428 - ETPRO FTP ProFTPD Server Username Handling SQL Injection (ftp.rules)
  • 2800430 - ETPRO SQL MySQL XML Functions Scalar XPath Denial of Service (sql.rules)
  • 2800431 - ETPRO SQL MySQL XML Functions Scalar XPath Denial of Service (sql.rules)
  • 2800494 - ETPRO NETBIOS Microsoft Windows SMB Negotiate Request Remote Code Execution 1 (netbios.rules)
  • 2800495 - ETPRO NETBIOS Microsoft Windows SMB Negotiate Request Remote Code Execution 2 (netbios.rules)
  • 2800518 - ETPRO NETBIOS Microsoft Windows SMBv2 Infinite Loop Denial of Service (netbios.rules)
  • 2800519 - ETPRO NETBIOS Microsoft Windows SMBv2 Infinite Loop Denial of Service (netbios.rules)
  • 2800568 - ETPRO WEB_SERVER HP Performance Manager Apache Tomcat Policy Bypass (web_server.rules)
  • 2800576 - ETPRO WEB_SERVER Apache Struts2 ParametersInterceptor Remote Command Execution 1 (web_server.rules)
  • 2800577 - ETPRO WEB_SERVER Apache Struts2 ParametersInterceptor Remote Command Execution 2 (web_server.rules)
  • 2800587 - ETPRO SQL Oracle WebLogic Server Node Manager Command Execution (sql.rules)
  • 2800599 - ETPRO MALWARE Win32.Conficker.C Activity (FTP download) (malware.rules)
  • 2800808 - ETPRO MALWARE Backdoor.Win32.VBKrypt.dxe Checkin (malware.rules)
  • 2800809 - ETPRO MALWARE Backdoor.Win32.VBKrypt.dxe Bong (malware.rules)
  • 2800810 - ETPRO MALWARE Trojan.Win32.Chif.A Checkin (malware.rules)
  • 2800815 - ETPRO MALWARE Trojan.Win32.Slagent Checkin (malware.rules)
  • 2800817 - ETPRO MALWARE Win32.Banker.QO Checkin (malware.rules)
  • 2800819 - ETPRO WORM Worm.Win32.Carrier.ih (infection) (worm.rules)
  • 2800822 - ETPRO MALWARE Backdoor.Win32.Mexbank.A Checkin Set (malware.rules)
  • 2800824 - ETPRO MALWARE Backdoor.Win32.Mexbank.A Response (malware.rules)
  • 2800949 - ETPRO ADWARE_PUP RogueSoftware.Win32.Winwebsec Activity (adware_pup.rules)
  • 2800950 - ETPRO MALWARE Backdoor.Win32.Loopas Initial checkin (malware.rules)
  • 2800951 - ETPRO MALWARE Backdoor.Win32.Loopas Activity (malware.rules)
  • 2800964 - ETPRO MALWARE Banker/Banbra.fxe Checkin (malware.rules)
  • 2800977 - ETPRO SMTP Exim string_format Remote Code Execution Attempt (smtp.rules)
  • 2800979 - ETPRO SMTP Exim string_format Remote Code Execution (smtp.rules)
  • 2801015 - ETPRO SCADA CONTROL MICROSYSTEMS (Event 20) Function Not Available Error (scada.rules)
  • 2801042 - ETPRO SCADA GE Event Log Display Detected (scada.rules)
  • 2801105 - ETPRO SCADA PROSOFT (Event 15) Station Number Error (scada.rules)
  • 2801106 - ETPRO SCADA PROSOFT (Event 21) Point Not Available (scada.rules)
  • 2801128 - ETPRO SCADA SCHWEITZER SEL2032-Date Command Detected (scada.rules)
  • 2801131 - ETPRO SCADA SCHWEITZER SEL2032-Potential Login Attempt (scada.rules)
  • 2801132 - ETPRO SCADA SCHWEITZER SEL2032-Level 1 Successful Login (scada.rules)
  • 2801133 - ETPRO SCADA SCHWEITZER SEL2032-Level 2 Successful Login (scada.rules)