Bleeding: sigs/Attic

File	Rev.	Age	Author	Last log entry
ATTACK_31337_Rootshell (in the Attic)	1.2	3 years	jonkman	Moved to new ruleset, not changed
ATTACK_RESPONSE_Hidden_FTP_File_Activity (in the Attic)	1.6	3 years	jonkman	Moved to new ruleset, not changed
ATTACK_RESPONSE_Non-Standard_IRC (in the Attic)	1.10	3 years	jonkman	Moved to new ruleset, not changed
ATTACK_RESPONSE_Outbound_PHP_Fopen (in the Attic)	1.2	3 years	jonkman	Moved to new ruleset, not changed
ATTACK_RESPONSE_User_Attack_OK (in the Attic)	1.2	3 years	jonkman	Disregard
ATTACK_RESPONSE_Zone-h_Defacement (in the Attic)	1.4	3 years	jonkman	Moved to new ruleset, not changed
ATTACK_SSH_Brute_Force (in the Attic)	1.7	3 years	jonkman	Name change
CVS_Heap_Overflow_Exploit (in the Attic)	1.8	3 years	jonkman	Name change
DOS_Apache_Squ1rt (in the Attic)	1.2	3 years	jonkman	Moved to DOS ruleset. No changes
DOS_Cisco_514_UDP_DoS (in the Attic)	1.5	3 years	jonkman	Moved to DOS ruleset. No changes
DOS_Cisco_Catalyst_memory_leak_attack (in the Attic)	1.5	3 years	jonkman	Moved to DOS ruleset. No changes
DOS_Cisco_Router_HTTP_DOS (in the Attic)	1.8	3 years	jonkman	Moved to DOS ruleset. No changes
DOS_IE (in the Attic)	1.4	3 years	jonkman	Moved to DOS ruleset. No changes
DOS_MS04-030 (in the Attic)	1.2	3 years	jonkman	Moved to DOS ruleset. No changes
DOS_MSSQL_DOS (in the Attic)	1.2	3 years	jonkman	Moved to DOS ruleset. No changes
DOS_MS_SMS (in the Attic)	1.5	3 years	jonkman	Moved to DOS ruleset. No changes
DOS_SSL_Bomb_Attempt (in the Attic)	1.5	3 years	jonkman	Moved to DOS ruleset. No changes
EXPLOIT_AIM_Away_BO (in the Attic)	1.5	3 years	jonkman	No longer relevant
EXPLOIT_Adobe_Acrobat_BO (in the Attic)	1.10	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_CVS_HEAP_Overflow (in the Attic)	1.3	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_Cisco_%u_Evasion (in the Attic)	1.7	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_Cisco_Catalyst_3500_Arbitrary_Command_Attempt (in the Attic)	1.7	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_Cisco_Catalyst_SSH_Protocol_Mismatch (in the Attic)	1.5	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_Cisco_HTTP_Server_DoS (in the Attic)	1.7	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_Cisco_IOS_HTTP_DOS (in the Attic)	1.7	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_Cisco_Telnet_Buffer_Overflow (in the Attic)	1.5	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_GenXE_CSS (in the Attic)	1.4	3 years	jonkman	No longer relevant
EXPLOIT_General_IE_Spyware_Installs (in the Attic)	1.5	3 years	jonkman	Moved to Malware
EXPLOIT_Half_Life_Server_BO (in the Attic)	1.2	3 years	jonkman	Joseph is working up new ones
EXPLOIT_Hotmail_CSS (in the Attic)	1.3	3 years	jonkman	No longer relevant
EXPLOIT_Hotmail_Link_CSS (in the Attic)	1.8	3 years	jonkman	Joseph is working up new ones
EXPLOIT_IE_Ject-Scob_Worm (in the Attic)	1.4	3 years	jonkman	Moving to Stable-Side, it's usefulness has passed
EXPLOIT_IE_Process_Injection (in the Attic)	1.2	3 years	jonkman	Added to EXPLOIT_IE_Vulnerabilities
EXPLOIT_IE_Vulnerabilities (in the Attic)	1.25	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_IIS_ADS_Source_Code_Exposure (in the Attic)	1.7	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_IIS_THCOWNZIIS_443 (in the Attic)	1.5	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_Invalid_TCP_Fragments (in the Attic)	1.2	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_LSASRV_DLL_RPC_Exploit_win2k (in the Attic)	1.9	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_LSASRV_DLL_RPC_Exploit_winXP (in the Attic)	1.7	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_LibPNG (in the Attic)	1.8	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_LibPNG_BO (in the Attic)	1.2	3 years	jonkman	Combined with existing libpng rules
EXPLOIT_MIRC_Overflow (in the Attic)	1.6	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_MS04-032 (in the Attic)	1.5	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_MSSQL_Injection (in the Attic)	1.7	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_MSSQL_Ping (in the Attic)	1.5	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_MSTask (in the Attic)	1.2	3 years	jonkman	Lots of falses
EXPLOIT_MS_Asycpict.dll (in the Attic)	1.5	3 years	jonkman	Cleanup
EXPLOIT_Microsoft_MHTML_URL_Redirection_Attempt (in the Attic)	1.5	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_Misc_CSS (in the Attic)	1.5	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_Mozilla-Firefox (in the Attic)	1.3	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_NETBIOS_ASN1_Overflow (in the Attic)	1.2	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_PHP_Injection (in the Attic)	1.3	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_PHP_Nuke_SQL_Injection (in the Attic)	1.8	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_PhpBB (in the Attic)	1.14	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_Pwdump3e_Hash_Retrieval (in the Attic)	1.10	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_Russion_Ebay_Bank_Scam (in the Attic)	1.5	3 years	jonkman	Long past
EXPLOIT_Sasser_LSA (in the Attic)	1.3	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_Serv-U_Ftp (in the Attic)	1.7	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_ShixxNote (in the Attic)	1.2	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_Squid_NTLM_Overflow (in the Attic)	1.5	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_Sun_Java_VM (in the Attic)	1.2	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_WIN32_XPAT_Overflow (in the Attic)	1.3	3 years	jonkman	Replaced by sid 2927 on snort.org
EXPLOIT_WINS_Replication_BO (in the Attic)	1.3	3 years	jonkman	Replaced by snort.org rule
EXPLOIT_Win_GDI_JPG (in the Attic)	1.2	3 years	jonkman	Removed, sids 2705, 2706, 2707 in the snort.org rulesets cover this nicely.
EXPLOIT_Winhelp32 (in the Attic)	1.7	3 years	jonkman	Moved to WEB or EXPLOIT ruleset. No rule changes
EXPLOIT_Witty (in the Attic)	1.2	3 years	fknobbe	For historical purposes only... that means up into the Attic :)
HOTMAIL_Mail_Rules (in the Attic)	1.9	3 years	jonkman	Name changes
ISC_RESEARCH_UDP_Frags (in the Attic)	1.2	3 years	jonkman	Mystery was solved. http://isc.sans.org/diary.php?date=2004-12-13
LSA_Exploit_Sasser (in the Attic)	1.5	3 years	jonkman	Name changes
MALWARE_180Solutions (in the Attic)	1.2	3 years	jonkman	Moved to Malware ruleset
MALWARE_2020search (in the Attic)	1.10	3 years	jonkman	Moved to Malware ruleset
MALWARE_Adtrak.net_Access (in the Attic)	1.3	3 years	jonkman	Moved to Malware ruleset
MALWARE_Altnet_Peerpoint_Manager_Traffic (in the Attic)	1.8	3 years	jonkman	Moved to Malware ruleset
MALWARE_Amex.Isprime.com (in the Attic)	1.4	3 years	jonkman	Moved to Malware ruleset
MALWARE_As_Yet_Unidentified (in the Attic)	1.3	3 years	jonkman	Moved to Malware ruleset
MALWARE_Avres (in the Attic)	1.3	3 years	jonkman	Moved to Malware ruleset
MALWARE_Bargain_Buddy (in the Attic)	1.3	3 years	jonkman	Moved to Malware ruleset
MALWARE_Betterinternet (in the Attic)	1.12	3 years	jonkman	Moved to Malware ruleset
MALWARE_Comet_Cursor_Spyware (in the Attic)	1.6	3 years	jonkman	Moved to Malware ruleset
MALWARE_EUniverse (in the Attic)	1.3	3 years	jonkman	Moved to Malware ruleset
MALWARE_F1Organizer.com (in the Attic)	1.3	3 years	jonkman	Moved to Malware ruleset
MALWARE_FlashPoint (in the Attic)	1.6	3 years	jonkman	Moved to Malware ruleset
MALWARE_Fun_Web_Products (in the Attic)	1.3	3 years	jonkman	Moved to Malware ruleset
MALWARE_Gator (in the Attic)	1.4	3 years	jonkman	Merged into Gator
MALWARE_Gator_Agent (in the Attic)	1.10	3 years	jonkman	Moved to Malware ruleset
MALWARE_Hotbar (in the Attic)	1.5	3 years	jonkman	Moved to Malware ruleset
MALWARE_ISearchTech.com (in the Attic)	1.2	3 years	jonkman	Moved to Malware ruleset
MALWARE_JoltID (in the Attic)	1.4	3 years	jonkman	Moved to Malware ruleset
MALWARE_Keenvalue (in the Attic)	1.6	3 years	jonkman	Moved to Malware ruleset
MALWARE_MarketScore (in the Attic)	1.4	3 years	jonkman	Moved to Malware ruleset
MALWARE_Mindsetinteractive (in the Attic)	1.4	3 years	jonkman	Moved to Malware ruleset
MALWARE_My_Web_Toolbar (in the Attic)	1.3	3 years	jonkman	Moved to Malware ruleset
MALWARE_Popuptraffic.com_Reporting (in the Attic)	1.3	3 years	jonkman	Moved to Malware ruleset
MALWARE_Rcprograms (in the Attic)	1.8	3 years	jonkman	Moved to Malware ruleset
MALWARE_Salongas (in the Attic)	1.3	3 years	jonkman	Moved to Malware ruleset
MALWARE_ShopAtHomeSelect (in the Attic)	1.3	3 years	jonkman	Moved to Malware ruleset
MALWARE_Spywarelabs_VirtualBouncer (in the Attic)	1.3	3 years	jonkman	Moved to Malware ruleset
MALWARE_TopMoxie (in the Attic)	1.3	3 years	jonkman	Moved to Malware ruleset
MALWARE_TopText_ILookup (in the Attic)	1.6	3 years	jonkman	Moved to Malware ruleset
MALWARE_Twaintec (in the Attic)	1.5	3 years	jonkman	Moved to Malware ruleset
MALWARE_Unknown (in the Attic)	1.3	3 years	jonkman	Identified
MALWARE_Virtumonde (in the Attic)	1.3	3 years	jonkman	Moved to Malware ruleset
MALWARE_WhenUSearch.com (in the Attic)	1.3	3 years	jonkman	Moved to Malware ruleset
MALWARE_Yesadvertising_Banking_Spyware (in the Attic)	1.7	3 years	jonkman	Moved to Malware ruleset
MDAC-Content-Type_Overflow_Attempt (in the Attic)	1.2	4 years	jonkman	*** empty log message ***
MSSQL_Injection (in the Attic)	1.10	3 years	jonkman	Name changes
MSSQL_ping (in the Attic)	1.5	3 years	jonkman	Name changes
MS_MHTML_URK_Redirection (in the Attic)	1.2	3 years	jonkman	Duplicated, removed
NETBIOS_ASN.1_Library_Buffer_Overflow_Attempt (in the Attic)	1.5	3 years	jonkman	Name changes
P2P_Ares (in the Attic)	1.2	3 years	jonkman	Moved to Individual ruleset
P2P_Bittorrent_Traffic (in the Attic)	1.11	3 years	jonkman	Moved to Individual ruleset
P2P_Edonkey_Traffic (in the Attic)	1.11	3 years	jonkman	Moved to Individual ruleset
P2P_Iroffer_IRC_Bot (in the Attic)	1.6	3 years	jonkman	Moved to Individual ruleset
P2P_Morpheus (in the Attic)	1.3	3 years	jonkman	Moved to Individual ruleset
P2P_Overnet_Traffic (in the Attic)	1.3	3 years	jonkman	Moved to Individual ruleset
P2P_Phatbot_Control_Connection (in the Attic)	1.5	3 years	jonkman	Moved to Individual ruleset
P2P_Phatbot_Infection (in the Attic)	1.5	3 years	jonkman	Moved to Individual ruleset
P2P_Soulseek (in the Attic)	1.4	3 years	jonkman	Moved to Individual ruleset
POLICY_AOL_Webmail (in the Attic)	1.2	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_Binary_Downloads (in the Attic)	1.10	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_Cisco_Config_Change (in the Attic)	1.4	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_DNS_Responses (in the Attic)	1.5	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_Dameware (in the Attic)	1.2	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_GotoMyPC (in the Attic)	1.4	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_HOTMAIL_Mail_Use (in the Attic)	1.2	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_HP_Web_Jetadmin_Executefile_Access (in the Attic)	1.2	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_HTTP_Tunneling_via_Proxy (in the Attic)	1.11	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_IM_Use (in the Attic)	1.6	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_IRC (in the Attic)	1.2	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_Kitco_Ticker (in the Attic)	1.3	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_Non-Standard_SSH_Port (in the Attic)	1.3	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_RDP_Connections (in the Attic)	1.2	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_SSN_in_the_Clear (in the Attic)	1.4	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_Telnet_Access (in the Attic)	1.5	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_Unauthorized_SMTP (in the Attic)	1.6	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_Weatherbug (in the Attic)	1.6	3 years	jonkman	Moved to POLICY ruleset, no changes
POLICY_Yahoo_Mail_Use (in the Attic)	1.7	3 years	jonkman	Just moving things around. Disbabled one too sensitive rule
SCAN_Behavioral (in the Attic)	1.2	3 years	jonkman	Moved to CUSTOM
SCAN_F5_BIG-IP_Probe (in the Attic)	1.4	3 years	jonkman	Moved to SCAN ruleset. No rule changes
SCAN_IPTools (in the Attic)	1.5	3 years	jonkman	Moved to SCAN ruleset. No rule changes
SCAN_NMAP (in the Attic)	1.7	3 years	jonkman	Moved to SCAN ruleset. No rule changes
SCAN_SSH_Brute_Force (in the Attic)	1.2	3 years	jonkman	Moved to SCAN ruleset. No rule changes
SCAN_SSL_Brute_or_Crawl (in the Attic)	1.5	3 years	jonkman	Moved to SCAN ruleset. No rule changes
SPYWARE_siae3123 (in the Attic)	1.14	3 years	jonkman	Name changes
SUSPICIOUS_Encrypted_Web_Content (in the Attic)	1.7	3 years	jonkman	Just organizing
TELNET-access (in the Attic)	1.2	4 years	jonkman	Renames bleesing.conf to bleeding.rules. Thanks Frank.
THCIISLame_exploitation_attempt (in the Attic)	1.5	3 years	jonkman	Redundant
TROJAN_AKAK (in the Attic)	1.2	3 years	jonkman	Moved to VIRUS
UNKNOWN_ISC_Reported_Activity (in the Attic)	1.4	3 years	jonkman	The threat seems to be gone
VIRUS_Bagle.AI (in the Attic)	1.3	3 years	jonkman	Forking to VIRUS ruleset. This went there...
VIRUS_Evaman_Worm (in the Attic)	1.8	3 years	jonkman	Forking to VIRUS ruleset. This went there...
VIRUS_ILookup_Trojan (in the Attic)	1.5	3 years	jonkman	Forking to VIRUS ruleset. This went there...
VIRUS_Psyme_Trojan_Download (in the Attic)	1.6	3 years	jonkman	Forking to VIRUS ruleset. This went there...
VIRUS_Sasser_FTP_Traffic (in the Attic)	1.6	3 years	jonkman	Forking to VIRUS ruleset. This went there...
VIRUS_Sasser_Transfer_up.exe (in the Attic)	1.7	3 years	jonkman	Forking to VIRUS ruleset. This went there...
VIRUS_Suspicious_File_Extension (in the Attic)	1.8	3 years	jonkman	Forking to VIRUS ruleset. This went there...
VIRUS_Unknown_IIS_Worm (in the Attic)	1.11	3 years	jonkman	Comsolidated into EXPLOIT_IE_Ject-Scob_Worm
VIRUS_Zafi (in the Attic)	1.5	3 years	jonkman	Forking to VIRUS ruleset. This went there...
WEB-IIS_Canonicalization_Bypass (in the Attic)	1.12	3 years	jonkman	Moved to WEB Ruleset
WEB-IIS_MDAC_Content-Type_overflow_attempt (in the Attic)	1.6	3 years	jonkman	Moved to WEB Ruleset
WEB-MISC_CrossSite_Scripting (in the Attic)	1.5	3 years	jonkman	Replaced by newer rules
WEB-MISC_Encrypted_Web_Content (in the Attic)	1.3	3 years	jonkman	Moved to WEB Ruleset
WEB-PHP_EasyDynamicPages_Exploit (in the Attic)	1.3	3 years	jonkman	Moved to WEB Ruleset
WEB_LINK_Method (in the Attic)	1.2	3 years	jonkman	Moved to WEB Ruleset
WEB_Zedus_Traversal (in the Attic)	1.5	3 years	jonkman	Moved to WEB Ruleset
WORM_ATAK (in the Attic)	1.2	3 years	jonkman	Forking to VIRUS ruleset. This went there...
WORM_Bagle_Variants (in the Attic)	1.8	3 years	jonkman	Forking to VIRUS ruleset. This went there...
WORM_CIA (in the Attic)	1.6	3 years	jonkman	Forking to VIRUS ruleset. This went there...
WORM_MyDoom.P (in the Attic)	1.2	3 years	jonkman	Forking to VIRUS ruleset. This went there...
WORM_MyDoom.S (in the Attic)	1.3	3 years	jonkman	Forking to VIRUS ruleset. This went there...
WORM_RBOT (in the Attic)	1.4	3 years	jonkman	Forking to VIRUS ruleset. This went there...
WORM_Sasser (in the Attic)	1.3	3 years	jonkman	Forking to VIRUS ruleset. This went there...
WORM_Small.AR (in the Attic)	1.2	3 years	jonkman	Forking to VIRUS ruleset. This went there...
WORM_Zincite (in the Attic)	1.9	3 years	jonkman	Forking to VIRUS ruleset. This went there...
YAHOO_Mail_Rules (in the Attic)	1.14	3 years	jonkman	name changes
bleeding-sid-msg.map (in the Attic)	1.2	4 years	jonkman	Moved sid-msg
bleeding.conf (in the Attic)	1.6	4 years	jonkman	Renames bleesing.conf to bleeding.rules. Thanks Frank.
bleeding.rules (in the Attic)	1.784	2 years	jonkman	No longer required
current_events (in the Attic)	1.24	2 years	jonkman	Moved to CURRENT_EVENTS
gg (in the Attic)	1.2	3 years	jonkman	Testing
play (in the Attic)	1.2	4 years	jonkman	Renames bleesing.conf to bleeding.rules. Thanks Frank.
test (in the Attic)	1.2	20 months	jonkman	Test done

Show files using tag:	Select Branch MAIN INITIAL_IMPORT_VENDOR_TAG Bleeding start INITIAL_IMPORT_RELEASE_TAG HEAD

Download tarball

---

CVS Admin Powered by ViewCVS 1.0-dev

ViewCVS and CVS Help