🚀 go-pugleaf

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Filbert wrote:

| Filbert wrote:
|
|>Jan Reilink wrote:
|>
|>
|>>-----BEGIN PGP SIGNED MESSAGE-----
|>>Hash: SHA1
|>>
|>>Tijd om je IIS servers (extra) in de gaten te houden:
|>>
|
| alvast enkele snort rules:
|
| alert ip any any -> any any (msg:"BLEEDING-EDGE Unknown IIS Worm Code in
| Transit"; content:"217.107.218.147"; classtype:trojan-activity;
| sid:2000311; rev:1;)
| alert ip any any -> any any (msg:"BLEEDING-EDGE Unknown IIS Worm Code in
| Transit"; content:"function gc099"; classtype:trojan-activity;
sid:2000312;
| rev:1;)
|
| alert tcp any any -> any any (msg:"Possible Unknown IIS Exploint
InTransit";
| content:"mms\://"; nocase; content:"ADODB.Stream"; nocase;classtype:
| trojan-activity; sid:9900014; rev:1;)
| alert tcp any any -> any any (msg:"Possible Unknown IIS Exploint
InTransit";
| content:"%6D"; nocase; content:"%53%74%72%65%61%6D";
| nocase;content:"%41%44%4F%44%42%2E"; nocase; classtype:
| trojan-activity;sid:9900015; rev:1;)
|
|

Dit is toch afdoende (ben nog niet zo'n Snort held):
:/etc/snort/rules# tail web-iis.rules
[...]
alert ip any any -> any any (msg:"BLEEDING-EDGE Unknown IIS Worm Code in
Transit"; content:"217.107.218.147"; classtype:trojan-activity;
sid:2000311; rev:1;)
alert ip any any -> any any (msg:"BLEEDING-EDGE Unknown IIS Worm Code in
Transit"; content:"function gc099"; classtype:trojan-activity;
sid:2000312; rev:1;)
alert tcp any any -> any any (msg:"Possible Unknown IIS Exploint
InTransit"; content:"mms\://"; nocase; content:"ADODB.Stream";
nocase;classtype: trojan-activity; sid:9900014; rev:1;)
alert tcp any any -> any any (msg:"Possible Unknown IIS Exploint
InTransit"; content:"%6D"; nocase; content:"%53%74%72%65%61%6D";
nocase;content:"%41%44%4F%44%42%2E"; nocase; classtype:
trojan-activity;sid:9900015; rev:1;)

en dan snort ff herstarten ofcourse ;)

- --
Met vriendelijke groet / Best regards,
Jan Reilink, VEVIDA Nederland BV

Postbus 329, 9700 AH GRONINGEN, +31(0)50 - 5492234
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (MingW32)
Comment: Using GnuPG with Netscape - http://enigmail.mozdev.org

iD8DBQFA2/JyyExGSa/qny0RAlGrAJ9JlOX/VIC0rK674hwiSbu1QK/eZACcDy/V
NfPY8Lt/25rom1EdQ0OWrZM=
=/PMw
-----END PGP SIGNATURE-----