![]() #alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Weatherbug Activity" flow:established,to_server content:"/WeatherWindow/WeatherWindow" nocase http_uri content:"?rnd=" nocase http_uri reference:url,/bin/view/Main/2003420 classtype:trojan-activity sid:2003420 rev:5 ) #alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY Weatherbug Activity" flow: to_server,established content:"|0d 0a|" nocase http_header threshold: type limit, track by_src, count 1, seconds 3600 reference:url,/bin/view/Main/2001267 classtype:misc-activity sid:2001267 rev:18 ) # This Ruleset is EmergingThreats Open optimized for suricata-1.3. # USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ![]() # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE # SERVICES LOSS OF USE, DATA, OR PROFITS OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, # INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES, # from this software without specific prior written permission. # * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived # following disclaimer in the documentation and/or other materials provided with the distribution. # * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the # * Redistributions of source code must retain the above copyright notice, this list of conditions and the following # Redistribution and use in source and binary forms, with or without modification, are permitted provided that the # Copyright (c) 2003-2015, Emerging Threats # Rules with sids 2000000 through 2799999 are from Emerging Threats and are covered under the BSD License # A copy of that license is available at # This distribution may contain rules under two different licenses.
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |