Ruleset Update Summary - 2026/09/07 - v11280

Ruleset Updates
1

Summary:

0 new OPEN, 0 new PRO (0 + 0)

Modified inactive rules:

  • 2000026 - ET ADWARE_PUP Gator Agent Traffic (adware_pup.rules)
  • 2000514 - ET ADWARE_PUP IE homepage hijacking (adware_pup.rules)
  • 2000519 - ET ADWARE_PUP shell browser vulnerability W9x/XP (adware_pup.rules)
  • 2000520 - ET ADWARE_PUP shell browser vulnerability NT/2K (adware_pup.rules)
  • 2000587 - ET ADWARE_PUP SpywareLabs VirtualBouncer Seeking Instructions (adware_pup.rules)
  • 2000588 - ET ADWARE_PUP TopMoxie Reporting Data to External Host (adware_pup.rules)
  • 2001046 - ET MALWARE UPX compressed file download possible malware (malware.rules)
  • 2001047 - ET ADWARE_PUP UPX encrypted file download possible malware (adware_pup.rules)
  • 2001346 - ET INAPPROPRIATE Kiddy Porn preteen (inappropriate.rules)
  • 2001347 - ET INAPPROPRIATE Kiddy Porn pre-teen (inappropriate.rules)
  • 2001348 - ET INAPPROPRIATE Kiddy Porn early teen (inappropriate.rules)
  • 2001349 - ET INAPPROPRIATE free XXX (inappropriate.rules)
  • 2001350 - ET INAPPROPRIATE hardcore anal (inappropriate.rules)
  • 2001351 - ET INAPPROPRIATE masturbation (inappropriate.rules)
  • 2001352 - ET INAPPROPRIATE ejaculation (inappropriate.rules)
  • 2001353 - ET INAPPROPRIATE BDSM (inappropriate.rules)
  • 2001386 - ET INAPPROPRIATE Kiddy Porn pthc (inappropriate.rules)
  • 2001387 - ET INAPPROPRIATE Kiddy Porn zeps (inappropriate.rules)
  • 2001388 - ET INAPPROPRIATE Kiddy Porn r@ygold (inappropriate.rules)
  • 2001389 - ET INAPPROPRIATE Kiddy Porn childlover (inappropriate.rules)
  • 2001392 - ET INAPPROPRIATE Sextracker Tracking Code Detected (1) (inappropriate.rules)
  • 2001393 - ET INAPPROPRIATE Sextracker Tracking Code Detected (2) (inappropriate.rules)
  • 2001452 - ET ADWARE_PUP Bundleware Spyware CHM Download (adware_pup.rules)
  • 2001454 - ET ADWARE_PUP Couponage Configure (adware_pup.rules)
  • 2001479 - ET ADWARE_PUP Coolsearch Spyware Install (adware_pup.rules)
  • 2001541 - ET ADWARE_PUP Xpire.info Install Report (adware_pup.rules)
  • 2001586 - ET ADWARE_PUP MarketScore.com Spyware Proxied Traffic (mitmproxy agent) (adware_pup.rules)
  • 2001744 - ET ADWARE_PUP Searchmiracle.com Spyware Install (install) (adware_pup.rules)
  • 2002003 - ET ADWARE_PUP 180solutions Spyware Install (adware_pup.rules)
  • 2002031 - ET MALWARE IRC Potential bot update/download via http command (malware.rules)
  • 2002683 - ET WORM shell bot perl code download (worm.rules)
  • 2002684 - ET WORM Shell Bot Code Download (worm.rules)
  • 2002844 - ET WEB_SERVER WebDAV search overflow (web_server.rules)
  • 2003154 - ET ADWARE_PUP Bestcount.net Spyware Data Upload (adware_pup.rules)
  • 2003217 - ET ADWARE_PUP 180solutions (Zango) Spyware Installer Config 2 (adware_pup.rules)
  • 2003251 - ET ADWARE_PUP SpySheriff Intial Phone Home (adware_pup.rules)
  • 2003431 - ET MALWARE Unnamed Generic.Malware http get (malware.rules)
  • 2003536 - ET ATTACK_RESPONSE r57 phpshell source being uploaded (attack_response.rules)
  • 2003541 - ET ADWARE_PUP Bravesentry.com Fake Antispyware Updating (adware_pup.rules)
  • 2003578 - ET ADWARE_PUP Baidu.com Spyware Bar Pulling Data (adware_pup.rules)
  • 2003937 - ET MALWARE Bandook iwebho/BBB-phish trojan leaking user data (malware.rules)
  • 2007571 - ET POLICY Remote Desktop Connection via non RDP Port (policy.rules)
  • 2007650 - ET MALWARE Mac Trojan HTTP Checkin (accept-language violation) (malware.rules)
  • 2007653 - ET ATTACK_RESPONSE RFI Scanner detected (attack_response.rules)
  • 2007654 - ET ATTACK_RESPONSE C99 Modified phpshell detected (attack_response.rules)
  • 2007655 - ET ATTACK_RESPONSE lila.jpg phpshell detected (attack_response.rules)
  • 2007656 - ET ATTACK_RESPONSE ALBANIA id.php detected (attack_response.rules)
  • 2007657 - ET ATTACK_RESPONSE Mic22 id.php detected (attack_response.rules)
  • 2007744 - ET ADWARE_PUP Guard-Center.com Fake AntiVirus Post-Install Checkin (adware_pup.rules)
  • 2007752 - ET MALWARE Saturn Proxy Checkin Response (malware.rules)
  • 2007776 - ET MALWARE Krunchy/BZub HTTP POST Update (malware.rules)
  • 2007820 - ET ADWARE_PUP Rabio Spyware/Adware Initial Registration (adware_pup.rules)
  • 2007870 - ET ADWARE_PUP Vombanetworks.com Spyware Installer Checkin (adware_pup.rules)
  • 2007898 - ET MALWARE Sohanad Checkin via HTTP (malware.rules)
  • 2007914 - ET WORM SDBot HTTP Checkin (worm.rules)
  • 2007987 - ET MALWARE Dropper.Win32.VB.on Keylog/System Info Report via HTTP (malware.rules)
  • 2008139 - ET MALWARE RhiFrem Trojan Activity - cmd (malware.rules)
  • 2008140 - ET MALWARE RhiFrem Trojan Activity - log (malware.rules)
  • 2008149 - ET ADWARE_PUP 360safe.com related Fake Security Product Update (KillerSet) (adware_pup.rules)
  • 2008155 - ET MALWARE Trats.a Post-Infection Checkin (malware.rules)
  • 2008206 - ET MALWARE Client Visiting Possibly Compromised Site (HaCKeD By BeLa & BodyguarD) (malware.rules)
  • 2008263 - ET MALWARE DNS Changer HTTP Post Checkin (malware.rules)
  • 2008375 - ET ADWARE_PUP Gooochi Related Spyware Ad pull (adware_pup.rules)
  • 2008380 - ET RETIRED PoisonIvy Key Exchange with CnC Init (retired.rules)
  • 2008381 - ET RETIRED PoisonIvy Key Exchange with CnC Response (retired.rules)
  • 2008425 - ET ADWARE_PUP Advert-network.com Related Spyware Checking for Updates (adware_pup.rules)
  • 2008434 - ET MALWARE Coreflood/AFcore Trojan Infection (malware.rules)
  • 2008443 - ET MALWARE Coreflood/AFcore Trojan Infection (2) (malware.rules)
  • 2008660 - ET MALWARE Torpig Infection Reporting (malware.rules)
  • 2008757 - ET ADWARE_PUP Zenosearch Malware Checkin HTTP POST (adware_pup.rules)
  • 2008863 - ET MALWARE Virtumonde Variant Reporting to Controller via HTTP (3) (malware.rules)
  • 2008940 - ET MALWARE DNSChanger.AT or related Infection Checkin Post (malware.rules)
  • 2008946 - ET MALWARE UpackbyDwing binary in HTTP Download Possibly Hostile (malware.rules)
  • 2008947 - ET MALWARE UpackbyDwing binary in HTTP (2) Possibly Hostile (malware.rules)
  • 2009094 - ET MALWARE Password Stealer (PSW.Win32.Magania Family) GET (malware.rules)
  • 2009213 - ET MALWARE Zbot/Zeus Dropper Infection - /loads.php (malware.rules)
  • 2009297 - ET MALWARE Boaxxe HTTP POST Checkin (malware.rules)
  • 2009300 - ET MALWARE Small.zon checkin (malware.rules)
  • 2009303 - ET INFO Commonly Abused File Sharing Service Domain HTTP request (mediafire .com) (info.rules)
  • 2009388 - ET MALWARE Bredolab Downloader Response Binaries from Controller (malware.rules)
  • 2009449 - ET MALWARE Trash Family - HTTP POST (malware.rules)
  • 2009553 - ET MALWARE FAKE/ROGUE AV Encoded data= HTTP POST (malware.rules)
  • 2009694 - ET MALWARE Navipromo related update (malware.rules)
  • 2010163 - ET MALWARE Glacial Dracon C&C Communication (malware.rules)
  • 2010164 - ET MALWARE Daonol C&C Communication (malware.rules)
  • 2010344 - ET RETIRED Chorns/PoisonIvy related Backdoor Initial Connection (retired.rules)
  • 2010345 - ET RETIRED Chorns/PoisonIvy related Backdoor Keep Alive (retired.rules)
  • 2010838 - ET MALWARE WScript/VBScript XMLHTTP downloader likely malicious get?src= (malware.rules)
  • 2010875 - ET MALWARE Blackenergy Bot Checkin to C&C (2) (malware.rules)
  • 2011103 - ET EXPLOIT_KIT Exploit kit download payload likely Hiloti Gozi FakeAV etc (exploit_kit.rules)
  • 2011104 - ET EXPLOIT_KIT Exploit kit attack activity likely hostile (exploit_kit.rules)
  • 2011576 - ET MALWARE nte Binary Download Attempt (multiple malware variants served) (malware.rules)
  • 2011991 - ET MALWARE FAKEAV Gemini systempack exe download (malware.rules)
  • 2012140 - ET MOBILE_MALWARE Android Trojan Command and Control Communication (mobile_malware.rules)
  • 2012189 - ET WEB_SPECIFIC_APPS phpscripte24 Vor und Ruckwarts Auktions System Blind SQL Injection Attempt (web_specific_apps.rules)
  • 2012208 - ET MALWARE FAKEAV CryptMEN pack.exe Payload Download (malware.rules)
  • 2012221 - ET MALWARE Malware Related msndown (malware.rules)
  • 2012227 - ET MALWARE FAKEAV Gemini softupdate*.exe download (malware.rules)
  • 2012228 - ET ADWARE_PUP Suspicious Russian Content-Language Ru Which May Be Malware Related (adware_pup.rules)
  • 2012229 - ET ADWARE_PUP Suspicious Chinese Content-Language zh-cn Which May be Malware Related (adware_pup.rules)
  • 2012248 - ET MALWARE MUROFET/Licat Trojan Checkin Forum (malware.rules)
  • 2012284 - ET MALWARE SpyEye Post_Express_Label ftpgrabber check-in (malware.rules)
  • 2012318 - ET MALWARE FAKEAV download (AntiSpyWareSetup.exe) (malware.rules)
  • 2012453 - ET MOBILE_MALWARE Android Trojan DroidDream Command and Control Communication (mobile_malware.rules)
  • 2012494 - ET MALWARE FakeAV InstallInternetDefender Download (malware.rules)
  • 2012507 - ET MALWARE Monkif CnC response in fake JPEG (malware.rules)
  • 2012511 - ET WEB_CLIENT Opera Window.Open document.cloneNode Null Pointer Deference Attempt (web_client.rules)
  • 2012512 - ET MALWARE Hiloti loader installed successfully response (malware.rules)
  • 2012517 - ET MALWARE Win32/Rimecud.B Activity (malware.rules)
  • 2012518 - ET EXPLOIT RetroGuard Obfuscated JAR likely part of hostile exploit kit (exploit.rules)
  • 2012527 - ET CURRENT_EVENTS Download of PDF File From Russian Content-Language Website (current_events.rules)
  • 2012528 - ET CURRENT_EVENTS Download of PDF File From Chinese Content-Language Website (current_events.rules)
  • 2012529 - ET CURRENT_EVENTS WindowsLive Imposter Site WindowsLive.png (current_events.rules)
  • 2012530 - ET WEB_CLIENT WindowsLive Imposter Site Landing Page (web_client.rules)
  • 2012573 - ET WEB_SPECIFIC_APPS RecordPress header.php Cross Site Scripting Attempt (web_specific_apps.rules)
  • 2012574 - ET WEB_SPECIFIC_APPS RecordPress header.php rp-menu.php Cross Site Scripting Attempt (web_specific_apps.rules)
  • 2012610 - ET EXPLOIT Java Exploit io.exe download served (exploit.rules)
  • 2012614 - ET WEB_SERVER Internal WebServer Compromised By Lizamoon Mass SQL-Injection Attacks (web_server.rules)
  • 2012622 - ET CURRENT_EVENTS Adobe Flash Unicode SWF File Embedded in Office File Caution - Could be Hostile (current_events.rules)
  • 2012624 - ET CURRENT_EVENTS Lizamoon Related Compromised site served to local client (current_events.rules)
  • 2012631 - ET MALWARE Chinese Bootkit Checkin (malware.rules)
  • 2012646 - ET MALWARE Malicious JAR olig (malware.rules)
  • 2012696 - ET MALWARE FakeAV InstallInternetProtection Download (malware.rules)
  • 2012707 - ET MALWARE Win32/Injector.DKUN Variant Response (malware.rules)
  • 2012714 - ET MALWARE FakeAV BestAntivirus2011 Download (malware.rules)
  • 2012736 - ET MALWARE Trojan-GameThief.Win32.OnLineGames.bnye Checkin (malware.rules)
  • 2012756 - ET WEB_CLIENT Windows Help and Support Center XSS Attempt (web_client.rules)
  • 2012834 - ET WEB_SPECIFIC_APPS ChillyCMS mod Parameter Blind SQL Injection Attempt (web_specific_apps.rules)
  • 2012862 - ET MOBILE_MALWARE SslCrypt Server Communication (mobile_malware.rules)
  • 2012884 - ET EXPLOIT Java Exploit Attempt applet via file URI param (exploit.rules)
  • 2012908 - ET MALWARE Backdoor Win32/Begman.A Checkin (malware.rules)
  • 2012941 - ET EXPLOIT_KIT Phoenix Exploit Kit Newplayer.pdf (exploit_kit.rules)
  • 2012960 - ET MALWARE Trojan.Vaklik.kku Checkin Request (malware.rules)
  • 2012961 - ET MALWARE Trojan.Vaklik.kku Checkin Response (malware.rules)
  • 2013010 - ET WEB_CLIENT Request to malicious info.php drive-by landing (web_client.rules)
  • 2013034 - ET MALWARE WebToolbar.Win32.WhenU.r Reporting (malware.rules)
  • 2013044 - ET MOBILE_MALWARE Android.Plankton/Tonclank Control Server Responding With JAR Download URL (mobile_malware.rules)
  • 2013061 - ET WEB_CLIENT Sidename.js Injected Script Served by Local WebServer (web_client.rules)
  • 2013063 - ET MOBILE_MALWARE DroidKungFu Checkin 3 (mobile_malware.rules)
  • 2013066 - ET EXPLOIT Java Exploit Attempt applet via file URI setAttribute (exploit.rules)
  • 2013071 - ET MALWARE Dropper.MSIL.Agent.ate Checkin (malware.rules)
  • 2013094 - ET CURRENT_EVENTS Phoenix/Fiesta URI Requested Contains /? and hex (current_events.rules)
  • 2013135 - ET MALWARE FakeAV FakeAlert.Rena.n Checkin Flowbit set (malware.rules)
  • 2013136 - ET MALWARE FakeAV FakeAlertRena.n Checkin Response from Server (malware.rules)
  • 2013142 - ET MOBILE_MALWARE SymbOS/Yxes Jump.jsp CnC Checkin Message (mobile_malware.rules)
  • 2013154 - ET MALWARE Backdoor.Win32.Gbod.dv Checkin (malware.rules)
  • 2013176 - ET EXPLOIT_KIT EgyPack Exploit Kit Post-Infection Request (exploit_kit.rules)
  • 2013187 - ET MALWARE Backdoor Win32/IRCbot.FJ Cnc connection dns lookup (malware.rules)
  • 2013192 - ET WEB_CLIENT cssminibar.js Injected Script Served by Local WebServer (web_client.rules)
  • 2013194 - ET MOBILE_MALWARE Android.CruseWin XML Configuration File Sent From CnC Server (mobile_malware.rules)
  • 2013197 - ET MALWARE Win32.Genome Download.php HTTP Request (malware.rules)
  • 2013199 - ET MALWARE Trojan/Hacktool.Sniffer Successful Install Message (malware.rules)
  • 2013244 - ET WEB_CLIENT Known Injected Credit Card Fraud Malvertisement Script (web_client.rules)
  • 2013266 - ET MOBILE_MALWARE SymbOS/SymGam Receiving SMS Message Template from CnC Server (mobile_malware.rules)
  • 2013314 - ET MALWARE Phoenix Landing Page Obfuscated Javascript 2 (malware.rules)
  • 2013317 - ET MOBILE_MALWARE Android.AdSms XML File From CnC Server (mobile_malware.rules)
  • 2013318 - ET MALWARE Google Warning Infected Local User (malware.rules)
  • 2013321 - ET WEB_CLIENT Internet Explorer toStaticHTML HTML Sanitizing Information Disclosure Attempt (web_client.rules)
  • 2013364 - ET MALWARE windows_security_update Fake AV download (malware.rules)
  • 2013380 - ET WEB_CLIENT Malicious 1px iframe related to Mass Wordpress Injections (web_client.rules)
  • 2013383 - ET MALWARE Fakealert.Rena CnC Checkin 1 (malware.rules)
  • 2013385 - ET MALWARE Accept-encode HTTP header with UA indicating infected host (malware.rules)
  • 2013389 - ET ADWARE_PUP Adware/CommonName Reporting (adware_pup.rules)
  • 2013397 - ET MALWARE W32/Pandex Trojan Dropper Initial Checkin (malware.rules)
  • 2013413 - ET MALWARE FakeAV Landing Page Checking firewall status (malware.rules)
  • 2013419 - ET MALWARE FakeAV FakeAlert.Rena or similar Checkin Flowbit Set 2 (malware.rules)
  • 2013420 - ET MALWARE FakeAV FakeAlertRena.n Checkin NO Response from Server (malware.rules)
  • 2013440 - ET MALWARE W32/DirtJumper CnC Server Providing DDOS Targets (malware.rules)
  • 2013448 - ET ADWARE_PUP SurfSideKick Activity (iinfo) (adware_pup.rules)
  • 2013456 - ET MALWARE Win32/VB.HV Checkin (malware.rules)
  • 2013489 - ET MALWARE Best Pack Exploit Pack Binary Load Request (malware.rules)
  • 2013511 - ET MALWARE Win32/CazinoSilver Checkin (malware.rules)
  • 2013516 - ET MALWARE TR/Spy.Gen checkin via dns ANY query (malware.rules)
  • 2013537 - ET MALWARE BKDR_BTMINE.MNR BitCoin Miner Retrieving New IP Addresses From Server (malware.rules)
  • 2013658 - ET ADWARE_PUP Zugo Toolbar Spyware/Adware download request (adware_pup.rules)
  • 2013671 - ET MALWARE Win32.Riberow.A (touch) (malware.rules)
  • 2013686 - ET MALWARE ZeroAccess/Max++ Rootkit C&C Activity 2 (malware.rules)
  • 2013701 - ET MALWARE Agent-TMF Checkin (malware.rules)
  • 2013720 - ET MALWARE Win32/Wapomi.AD Variant Checkin (malware.rules)
  • 2013740 - ET MALWARE Zeus/Aeausuc P2P Variant Retrieving Peers List (malware.rules)
  • 2013767 - ET MALWARE W32/Einstein CnC Checkin (malware.rules)
  • 2013770 - ET MALWARE USPS Spam/Trojan Executable Download (malware.rules)
  • 2013775 - ET EXPLOIT_KIT Saturn Exploit Kit binary download request (exploit_kit.rules)
  • 2013777 - ET EXPLOIT_KIT Saturn Exploit Kit probable Java MIDI exploit request (exploit_kit.rules)
  • 2013781 - ET MALWARE Win32.Scar.dvov Searchstar.co.kr related Checkin (malware.rules)
  • 2013783 - ET MALWARE W32.Duqu UA and Filename Requested (malware.rules)
  • 2013955 - ET EXPLOIT_KIT Jupiter Exploit Kit Landing Page with Malicious Java Applets (exploit_kit.rules)
  • 2013976 - ET MALWARE Zeus POST Request to CnC - URL agnostic (malware.rules)
  • 2013978 - ET WEB_CLIENT Lilupophilupop Injected Script Being Served to Client (web_client.rules)
  • 2013979 - ET WEB_CLIENT Lilupophilupop Injected Script Being Served from Local Server (web_client.rules)
  • 2013998 - ET MALWARE W32/Jorik DDOS Instructions From CnC Server (malware.rules)
  • 2014003 - ET MALWARE VBKrypt.dytr Checkin (malware.rules)
  • 2014014 - ET MALWARE Zeus Checkin Header Pattern (malware.rules)
  • 2014024 - ET EXPLOIT_KIT Probable Scalaxy exploit kit secondary request (exploit_kit.rules)
  • 2014025 - ET EXPLOIT_KIT Probable Scalaxy exploit kit Java or PDF exploit request (exploit_kit.rules)
  • 2014027 - ET EXPLOIT Obfuscated Base64 in Javascript probably Scalaxy exploit kit (exploit.rules)
  • 2014038 - ET WEB_CLIENT MALVERTISING OpenX BrowserDetect.init Download (web_client.rules)
  • 2016429 - ET MALWARE Shady Rat/HTran style HTTP Header Pattern Request UHCa and Google MSIE UA (malware.rules)
  • 2800846 - ETPRO MALWARE Worm.Win32.Faketube Activity (update request) (malware.rules)
  • 2800875 - ETPRO MALWARE Trojan.Win32.Nopor.A GET Config (malware.rules)
  • 2800943 - ETPRO MALWARE Trojan.Win32.Konad.A Activity (malware.rules)
  • 2800952 - ETPRO ADWARE_PUP Adware.Win32.Favoclick UA Activity (adware_pup.rules)
  • 2801173 - ETPRO MALWARE Trojan.Win32.VB.njz Checkin (malware.rules)
  • 2801224 - ETPRO WORM Worm.Win32.Soglueda.A Checkin (worm.rules)
  • 2801274 - ETPRO ADWARE_PUP Gabpath.com Toolbar Tracker Recover (adware_pup.rules)
  • 2801313 - ETPRO WEB_CLIENT Microsoft Internet Explorer MHTML Cross Site Scripting (CVE-2011-0096) (web_client.rules)
  • 2801314 - ETPRO WEB_CLIENT Microsoft Internet Explorer MHTML Cross Site Scripting src (CVE-2011-0096) (web_client.rules)
  • 2801338 - ETPRO ADWARE_PUP RogueSoftware.Win32.McAVG2011 Checkin (adware_pup.rules)
  • 2801341 - ETPRO MALWARE Trojan.Win32.PassStealer.ird Checkin (malware.rules)
  • 2801354 - ETPRO MALWARE Trojan.Win32.Cryect.A Checkin on port 443 (malware.rules)
  • 2801366 - ETPRO ADWARE_PUP Trojan.Win32.Biter.g Checkin (adware_pup.rules)
  • 2801367 - ETPRO MALWARE Backdoor.Win32.Talsab.B Checkin Request (malware.rules)
  • 2801403 - ETPRO ADWARE_PUP Trymedia Related Executable Download (adware_pup.rules)
  • 2801422 - ETPRO MALWARE Trojan.Win32.OddJob.A Checkin 1 (malware.rules)
  • 2801423 - ETPRO MALWARE Trojan.Win32.OddJob.A Checkin 2 (malware.rules)
  • 2801426 - ETPRO MALWARE Trojan.Win32.KeyLogger.mww Checkin (malware.rules)
  • 2801428 - ETPRO MALWARE Trojan.Win32.Banker.U Checkin (malware.rules)
  • 2801474 - ETPRO NETBIOS Microsoft Address Book msoeres32.dll Insecure Library Loading - SMB-DS Unicode (netbios.rules)
  • 2801475 - ETPRO NETBIOS Microsoft Address Book msoeres32.dll Insecure Library Loading - SMB-DS ASCII (netbios.rules)
  • 2801476 - ETPRO NETBIOS Microsoft Address Book msoeres32.dll Insecure Library Loading - SMB Unicode (netbios.rules)
  • 2801477 - ETPRO NETBIOS Microsoft Address Book msoeres32.dll Insecure Library Loading - SMB ASCII (netbios.rules)
  • 2801478 - ETPRO WEB_CLIENT Microsoft Address Book Insecure msoeres32.dll Library Loading (web_client.rules)
  • 2801484 - ETPRO WEB_CLIENT Microsoft Address Book wab32res.dll Insecure Library Loading (web_client.rules)
  • 2801486 - ETPRO NETBIOS Microsoft Windows Backup Manager fveapi.dll Insecure Library Loading - SMB-DS Unicode (netbios.rules)
  • 2801606 - ETPRO ADWARE_PUP Bonuscash/Comame Trojan Checkin (adware_pup.rules)
  • 2801609 - ETPRO WEB_SPECIFIC_APPS Z-Vote Plugin for WordPress SQL Injection Attempt zvote.php topic UNION SELECT (web_specific_apps.rules)
  • 2801610 - ETPRO WEB_SPECIFIC_APPS Z-Vote Plugin for WordPress SQL Injection Attempt zvote.php topic INSERT (web_specific_apps.rules)
  • 2801611 - ETPRO WEB_SPECIFIC_APPS Z-Vote Plugin for WordPress SQL Injection Attempt zvote.php topic DELETE (web_specific_apps.rules)
  • 2801612 - ETPRO WEB_SPECIFIC_APPS Z-Vote Plugin for WordPress SQL Injection Attempt zvote.php topic ASCII (web_specific_apps.rules)
  • 2801613 - ETPRO WEB_SPECIFIC_APPS Z-Vote Plugin for WordPress SQL Injection Attempt zvote.php topic UPDATE (web_specific_apps.rules)
  • 2801629 - ETPRO EXPLOIT Adobe Flash File Embedded in XLS FILE Caution - Could be Exploit (exploit.rules)
  • 2801984 - ETPRO MALWARE Known Redirect Cookie set to Exploit Pack 2 (malware.rules)
  • 2802004 - ETPRO MALWARE Backdoor.Win32.Gootkit.A HTTP Checkin (malware.rules)
  • 2802013 - ETPRO MALWARE Trojan.Win32.Banker.qmd Activity - SET (malware.rules)
  • 2802014 - ETPRO MALWARE Trojan.Win32.Banker.qmd Runtime Detection (malware.rules)
  • 2802019 - ETPRO MALWARE Virus Hunter FakeAV Checkin (malware.rules)
  • 2802022 - ETPRO WEB_CLIENT Excel File Malformed Label recType BIFF5 record (web_client.rules)
  • 2802056 - ETPRO MALWARE backdoor.Win32.Knockwxp.A Checkin (malware.rules)
  • 2802057 - ETPRO MALWARE Backdoor.Win32.Knockwxp.A Checkin (malware.rules)
  • 2802072 - ETPRO MALWARE Trojan.Win32.Carberp.C Checkin (malware.rules)
  • 2802076 - ETPRO MALWARE Trojan.Win32.KLCCs.A Checkin (malware.rules)
  • 2802080 - ETPRO MALWARE Trojan.Win32.Funcoes.A Checkin (malware.rules)
  • 2802098 - ETPRO MALWARE Trojan.MSIL.Qhost.ajb Activity (malware.rules)
  • 2802110 - ETPRO MALWARE Trojan.Win32.Banker.bgcp Checkin (malware.rules)
  • 2802112 - ETPRO MALWARE Worm.Win32.Autorun.BPT Checkin (malware.rules)
  • 2802194 - ETPRO MALWARE Win32.Kifloo Checkin (malware.rules)
  • 2802197 - ETPRO MALWARE Trojan.Win32.Banker.bkvd Checkin flowbit set (malware.rules)
  • 2802198 - ETPRO MALWARE Trojan.Win32.Banker.bkvd (sending info) (malware.rules)
  • 2802830 - ETPRO MALWARE Win32.Banksun.A Checkin (malware.rules)
  • 2802861 - ETPRO MALWARE Trojan.Win32.Dalgan.A Activity (malware.rules)
  • 2802875 - ETPRO WEB_CLIENT Adobe flash malformed Table Record offset field exploit attempt 2 (web_client.rules)
  • 2802877 - ETPRO WEB_CLIENT Adobe flash malformed Table Record offset field exploit attempt 4 (web_client.rules)
  • 2802885 - ETPRO MALWARE Trojan.Win32.Dcbavict.A Checkin 1 (malware.rules)
  • 2802917 - ETPRO MALWARE Trojan.Win32.Osmakudan.A Sending info (malware.rules)
  • 2802960 - ETPRO MALWARE Win32.SpyEye.cuk Checkin flowbit SET (malware.rules)
  • 2802961 - ETPRO MALWARE Win32.SpyEye.cuk Checkin (malware.rules)
  • 2802987 - ETPRO WEB_CLIENT Microsoft Excel Insufficient Record Validation (web_client.rules)
  • 2802991 - ETPRO WEB_CLIENT Microsoft Excel corrupted SerAuxTrend BIFF Record (web_client.rules)
  • 2802993 - ETPRO WEB_CLIENT Microsoft Excel Excel Improper Record Parsing Vulnerability Flowbit SET (web_client.rules)
  • 2802994 - ETPRO WEB_CLIENT Microsoft Excel Improper Record Parsing Vulnerability Attack (web_client.rules)
  • 2803000 - ETPRO WEB_CLIENT Adobe Reader language.engtesselate.ln overflow (CVE-2011-2095) (web_client.rules)
  • 2803027 - ETPRO WEB_CLIENT Microsoft Excel Malformed Selection (type 0x1D) BIFF record (web_client.rules)
  • 2803039 - ETPRO MALWARE Trojan.Win32.Micstus.A Checkin (malware.rules)
  • 2803054 - ETPRO NETBIOS Microsoft Windows OLE Automation Remote Code Execution SET (netbios.rules)
  • 2803055 - ETPRO NETBIOS Microsoft Windows OLE Automation Remote Code Execution (netbios.rules)
  • 2803073 - ETPRO WEB_SERVER Oracle Web Server Expect Header Cross-Site Scripting (web_server.rules)
  • 2803075 - ETPRO MALWARE Trojan.Win32.Clemag.A Checkin (malware.rules)
  • 2803098 - ETPRO MALWARE Win32.Rorpian.A Checkin 1 (malware.rules)
  • 2803099 - ETPRO MALWARE Win32.Rorpian.A Checkin 2 (malware.rules)
  • 2803101 - ETPRO EXPLOIT Potential Hostile Flash File Exploit Exploit Specific Trigger SWF (exploit.rules)
  • 2803102 - ETPRO EXPLOIT Potential Hostile Flash File Exploit Specific ActionScript3 REST Flags Set (exploit.rules)
  • 2803103 - ETPRO EXPLOIT Exploit Specific Potential Adobe Flash ActiveX Request (exploit.rules)
  • 2803131 - ETPRO MALWARE Dropper.Haed.co Checkin (malware.rules)
  • 2803151 - ETPRO MALWARE TDSS.aifh/Alureon Checkin (malware.rules)
  • 2803171 - ETPRO MALWARE Tnega.WQD Checkin (malware.rules)
  • 2803210 - ETPRO MALWARE Trojan.Win32.Orsam Receiving CnC Config (malware.rules)
  • 2803215 - ETPRO MALWARE Win32.Agent.cer Checkin (malware.rules)
  • 2803224 - ETPRO CHAT mig33 Client Keep Alive (chat.rules)
  • 2803225 - ETPRO CHAT mig33 Server Login Challenge (chat.rules)
  • 2803226 - ETPRO CHAT mig33 Server Keep Alive (chat.rules)
  • 2803238 - ETPRO MALWARE Trojan.Win32.Agent.dhy Checkin (malware.rules)
  • 2803251 - ETPRO ADWARE_PUP Ticno Multibar Checkin (adware_pup.rules)
  • 2803260 - ETPRO MALWARE Filecodi.net Related Trojan Checkin (malware.rules)
  • 2803270 - ETPRO MALWARE Common Downloader Header Pattern UHCa (malware.rules)
  • 2803271 - ETPRO EXPLOIT Oracle GlassFish Server Malformed Username Cross Site Scripting (exploit.rules)
  • 2803272 - ETPRO MALWARE W32/Koobface.hcy Checkin (malware.rules)
  • 2803274 - ETPRO MALWARE Common Downloader Header Pattern UH (malware.rules)
  • 2803289 - ETPRO WEB_CLIENT Oracle Java Runtime Environment Insecure File Loading (hotspotrc) - SET (web_client.rules)
  • 2803304 - ETPRO MALWARE Common Downloader Header Pattern HCa (malware.rules)
  • 2803305 - ETPRO MALWARE Common Downloader Header Pattern H (malware.rules)
  • 2803306 - ETPRO MALWARE Common Downloader Header Pattern Specific Mozilla 5 HAUC (malware.rules)
  • 2803307 - ETPRO MALWARE Common Downloader Header Pattern General HAUC (malware.rules)
  • 2803336 - ETPRO MALWARE Downloader Autoit.C.gen Checkin (malware.rules)
  • 2803340 - ETPRO MALWARE Common Downloader Header Pattern AAeUHCnCk (malware.rules)
  • 2803353 - ETPRO MALWARE Backdoor.Win32.Murcy.A Checkin (malware.rules)
  • 2803354 - ETPRO MALWARE Backdoor.Win32.Sogu.A Checkin (malware.rules)
  • 2803372 - ETPRO WEB_CLIENT Microsoft Internet Explorer cross domain attempt (web_client.rules)
  • 2803463 - ETPRO MALWARE Common Downloader Header Pattern CtHAU (Mozilla 3.0 Indy Library) (malware.rules)
  • 2803489 - ETPRO MALWARE Downloader.JNXM Checkin (malware.rules)
  • 2803494 - ETPRO MALWARE Common Downloader POST Header Pattern POST ACtHUCo data= (malware.rules)
  • 2803546 - ETPRO MALWARE Trojan.Win32.Fucobha.A Checkin 1 (malware.rules)
  • 2803548 - ETPRO MALWARE Win32/Bedobot.A Checkin (malware.rules)
  • 2803554 - ETPRO MALWARE Win32/Fosniw.B Dropper Checkin (malware.rules)
  • 2803604 - ETPRO MALWARE Trojan.Win32.Agent.dcir Checkin Response (malware.rules)
  • 2803617 - ETPRO MALWARE Trojan.Win32.Buzus.hond Checkin 2 - SET (malware.rules)
  • 2803618 - ETPRO MALWARE Trojan.Win32.Buzus.hond Checkin 2 (malware.rules)
  • 2803624 - ETPRO MALWARE Backdoor.Win32.Doschald.A Checkin Response (malware.rules)
  • 2803646 - ETPRO WEB_SERVER Microsoft SharePoint Remote File Disclosure Access (web_server.rules)
  • 2803657 - ETPRO WEB_CLIENT Microsoft Excel SHRFMLA Biff Record Vulnerability Attempt (web_client.rules)
  • 2803681 - ETPRO MALWARE Trojan.Win32.Syswrt.dvd Checkin 1 (malware.rules)
  • 2803705 - ETPRO MALWARE Trojan.Win32.ToriaSpy.A Checkin (malware.rules)
  • 2803730 - ETPRO WEB_SERVER Microsoft SharePoint XML Handling Remote File Disclosure (Published Exploit) (web_server.rules)
  • 2803742 - ETPRO MALWARE Trojan.Win32.Payazol.B Checkin (malware.rules)
  • 2803754 - ETPRO MALWARE Trojan.Win32.Banker.slrj Checkin 1 (malware.rules)
  • 2803773 - ETPRO MALWARE Trojan.Win32.Scar.dycw Checkin (malware.rules)
  • 2803782 - ETPRO MALWARE Trojan-Spy.W32/Banker.JGT Checkin (malware.rules)
  • 2803794 - ETPRO MALWARE Trojan.Win32.OddJob.A Checkin 3 (malware.rules)
  • 2803795 - ETPRO MALWARE Worm.Win32.Ackantta.B via SMTP flowbit set 1 (malware.rules)
  • 2803797 - ETPRO MALWARE Worm.Win32.Ackantta.B via SMTP flowbit set 2 (malware.rules)
  • 2803799 - ETPRO MALWARE Worm.Win32.Ackantta.B via SMTP flowbit set 3 (malware.rules)
  • 2803808 - ETPRO MALWARE Worm.Win32/Chiviper.A Checkin (malware.rules)
  • 2803815 - ETPRO MALWARE Aldi Bot command StartHTTP from CnC server INBOUND (malware.rules)
  • 2803816 - ETPRO MALWARE Aldi Bot command StartTCP from CnC server INBOUND (malware.rules)
  • 2803817 - ETPRO MALWARE Aldi Bot command StopHTTPDDoS from CnC server INBOUND (malware.rules)
  • 2803818 - ETPRO MALWARE Aldi Bot command StopTCPDDoS from CnC server INBOUND (malware.rules)
  • 2803819 - ETPRO MALWARE Aldi Bot command StopDDoS from CnC server INBOUND (malware.rules)
  • 2803820 - ETPRO MALWARE Aldi Bot command DownloadEx from CnC server INBOUND (malware.rules)
  • 2803822 - ETPRO MALWARE Aldi Bot command StealData from CnC server INBOUND (malware.rules)
  • 2803854 - ETPRO WEB_CLIENT Microsoft Internet Explorer remote code execution via marquee element (CVE-2011-2001) (web_client.rules)
  • 2803859 - ETPRO MALWARE Backdoor.Win32.Wuca Checkin (malware.rules)
  • 2803881 - ETPRO MALWARE Worm.AutoIt/Renocide.gen!C Checkin (malware.rules)
  • 2803907 - ETPRO MOBILE_MALWARE LeNa Android Malware Checkin (mobile_malware.rules)
  • 2803908 - ETPRO MOBILE_MALWARE LeNa Android CnC Command (StartDown) (mobile_malware.rules)
  • 2803909 - ETPRO MOBILE_MALWARE LeNa Android CnC Command (DownOk) (mobile_malware.rules)
  • 2803910 - ETPRO MOBILE_MALWARE LeNa Android CnC Command (INSTOK) (mobile_malware.rules)
  • 2803911 - ETPRO MOBILE_MALWARE LeNa Android CnC Command (RUNOK) (mobile_malware.rules)
  • 2803937 - ETPRO MALWARE Scar.evje/Fraudtool.AvSoft DDoS Bot Checkin 1 (malware.rules)
  • 2803938 - ETPRO MALWARE Scar.evje/Fraudtool.AvSoft DDoS Bot Checkin 2 (malware.rules)
  • 2803953 - ETPRO MALWARE Variant.Graftor.2543 requesting .jppg file (malware.rules)
  • 2803962 - ETPRO MALWARE TrojanDownloader.Win32/VB.PX Checkin (malware.rules)
  • 2803982 - ETPRO MALWARE Win32/Scar.G Checkin (malware.rules)
  • 2803985 - ETPRO MALWARE TrojanDownloader.Win32/Pluzoks.A Checkin (malware.rules)
  • 2804010 - ETPRO MALWARE Backdoor.Win32/Hanove.A Checkin (malware.rules)
  • 2804014 - ETPRO MALWARE Trojan.Win32/Malat Checkin (malware.rules)
  • 2804029 - ETPRO MALWARE Win32/Mafod!rts Checkin (malware.rules)
  • 2804041 - ETPRO MALWARE PSW.Banker6.KTO Checkin - SET (malware.rules)
  • 2804042 - ETPRO MALWARE PSW.Banker6.KTO Checkin (malware.rules)
  • 2804055 - ETPRO MALWARE Tapaoux Secondary Checkin (malware.rules)
  • 2804070 - ETPRO MALWARE Trojan-Banker.Win32.Banbra.amvh Checkin (malware.rules)
  • 2804083 - ETPRO WEB_CLIENT Flash authoring tool Flex XSS attempt (web_client.rules)
  • 2804093 - ETPRO ADWARE_PUP FakeAlert!grb Install (adware_pup.rules)
  • 2804094 - ETPRO ADWARE_PUP AdWare.Win32.SideTab.n Install (adware_pup.rules)
  • 2804108 - ETPRO MALWARE SHeur4.JEK Checkin (malware.rules)
  • 2804128 - ETPRO MALWARE Win32/Delf.H Checkin (malware.rules)
  • 2804142 - ETPRO MALWARE Win32/Paramis.A Checkin (malware.rules)
  • 2804184 - ETPRO MALWARE Win32/Bividon.A Checkin (malware.rules)
  • 2804222 - ETPRO MALWARE Win32/Scar.L Checkin (malware.rules)
  • 2804224 - ETPRO MALWARE Trojan.Heur.DP.NGX@aelsfkk Checkin (malware.rules)
  • 2804225 - ETPRO MALWARE Win32/FtpSteal.gen!A Checkin (malware.rules)
  • 2804237 - ETPRO MALWARE Win32/Zerok.A Checkin (malware.rules)