Sourcefire VRT Rules Update

Date: 2011-02-08

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2.8.6.1.

The format of the file is:

sid - Message (rule group, priority)

New rules:
18336 <-> BLACKLIST USER-AGENT known malicious user-agent string gbot/2.3 (blacklist.rules, High)
18337 <-> BLACKLIST USER-AGENT known malicious user-agent string iamx/3.11 (blacklist.rules, High)
18338 <-> BLACKLIST USER-AGENT known malicious user-agent string NSISDL/1.2 (blacklist.rules, High)
18339 <-> BLACKLIST USER-AGENT known malicious user-agent string NSIS_Inetc (blacklist.rules, High)
18340 <-> BLACKLIST USER-AGENT known malicious user-agent string ClickAdsByIE 0.7.5 (blacklist.rules, High)
18341 <-> BLACKLIST USER-AGENT known malicious user-agent string UtilMind HTTPGet (blacklist.rules, High)
18342 <-> BLACKLIST USER-AGENT known malicious user-agent string NSIS_DOWNLOAD (blacklist.rules, High)
18343 <-> BLACKLIST USER-AGENT known malicious user-agent string WSEnrichment (blacklist.rules, High)
18344 <-> BLACKLIST USER-AGENT known malicious user-agent string FSD (blacklist.rules, High)
18345 <-> BLACKLIST USER-AGENT known malicious user-agent string Macrovision_DM_2.4.15 (blacklist.rules, High)
18346 <-> BLACKLIST USER-AGENT known malicious user-agent string GPRecover (blacklist.rules, High)
18347 <-> BLACKLIST USER-AGENT known malicious user-agent string AutoIt (blacklist.rules, High)
18348 <-> BLACKLIST USER-AGENT known malicious user-agent string Opera/9.80 Pesto/2.2.15 (blacklist.rules, High)
18349 <-> BLACKLIST USER-AGENT known malicious user-agent string Flipopia (blacklist.rules, High)
18350 <-> BLACKLIST USER-AGENT known malicious user-agent string GabPath (blacklist.rules, High)
18351 <-> BLACKLIST USER-AGENT known malicious user-agent string GPUpdater (blacklist.rules, High)
18352 <-> BLACKLIST USER-AGENT known malicious user-agent string PinballCorp-BSAI/VER_STR_COMMA (blacklist.rules, High)
18353 <-> BLACKLIST USER-AGENT known malicious user-agent string SelectRebates (blacklist.rules, High)
18354 <-> BLACKLIST USER-AGENT known malicious user-agent string opera/8.11 (blacklist.rules, High)
18355 <-> BLACKLIST USER-AGENT known malicious user-agent string Se2011 (blacklist.rules, High)
18356 <-> BLACKLIST USER-AGENT known malicious user-agent string random (blacklist.rules, High)
18357 <-> BLACKLIST USER-AGENT known malicious user-agent string Setup Factory (blacklist.rules, High)
18358 <-> BLACKLIST USER-AGENT known malicious user-agent string NSIS_INETLOAD (blacklist.rules, High)
18359 <-> BLACKLIST USER-AGENT known malicious user-agent string Shareaza (blacklist.rules, High)
18360 <-> BLACKLIST USER-AGENT known malicious user-agent string Oncues (blacklist.rules, High)
18361 <-> BLACKLIST USER-AGENT known malicious user-agent string Downloader1.1 (blacklist.rules, High)
18362 <-> BLACKLIST USER-AGENT known malicious user-agent string Search Toolbar 1.1 (blacklist.rules, High)
18363 <-> BLACKLIST USER-AGENT known malicious user-agent string GPRecover (blacklist.rules, High)
18364 <-> BLACKLIST USER-AGENT known malicious user-agent string msndown (blacklist.rules, High)
18365 <-> BLACKLIST USER-AGENT known malicious user-agent string Agentcc (blacklist.rules, High)
18366 <-> BLACKLIST USER-AGENT known malicious user-agent string OCInstaller (blacklist.rules, High)
18367 <-> BLACKLIST USER-AGENT known malicious user-agent string FPRecover (blacklist.rules, High)
18368 <-> BLACKLIST USER-AGENT known malicious user-agent string Our_Agent (blacklist.rules, High)
18369 <-> BLACKLIST USER-AGENT known malicious user-agent string iexp-get (blacklist.rules, High)
18370 <-> BLACKLIST USER-AGENT known malicious user-agent string Mozilla Windows MSIE (blacklist.rules, High)
18371 <-> BLACKLIST USER-AGENT known malicious user-agent string QvodDown (blacklist.rules, High)
18372 <-> BLACKLIST USER-AGENT known malicious user-agent string StubInstaller (blacklist.rules, High)
18373 <-> BLACKLIST USER-AGENT known malicious user-agent string Installer (blacklist.rules, High)
18374 <-> BLACKLIST USER-AGENT known malicious user-agent string MSDN SurfBear (blacklist.rules, High)
18375 <-> BLACKLIST USER-AGENT known malicious user-agent string HTTP Wininet (blacklist.rules, High)
18376 <-> BLACKLIST USER-AGENT known malicious user-agent string Trololo (blacklist.rules, High)
18377 <-> BLACKLIST USER-AGENT known malicious user-agent string malware (blacklist.rules, High)
18378 <-> BLACKLIST USER-AGENT known malicious user-agent string AutoHotkey (blacklist.rules, High)
18379 <-> BLACKLIST USER-AGENT known malicious user-agent string AskInstallChecker (blacklist.rules, High)
18380 <-> BLACKLIST USER-AGENT known malicious user-agent string FPUpdater (blacklist.rules, High)
18381 <-> BLACKLIST USER-AGENT known malicious user-agent string Travel Update (blacklist.rules, High)
18382 <-> BLACKLIST USER-AGENT known malicious user-agent string WMUpdate (blacklist.rules, High)
18383 <-> BLACKLIST USER-AGENT known malicious user-agent string GPInstaller (blacklist.rules, High)
18384 <-> BLACKLIST USER-AGENT known malicious user-agent string Install Stub (blacklist.rules, High)
18385 <-> BLACKLIST USER-AGENT known malicious user-agent string HTTPCSDCENTER (blacklist.rules, High)
18386 <-> BLACKLIST USER-AGENT known malicious user-agent string AHTTPConnection (blacklist.rules, High)
18387 <-> BLACKLIST USER-AGENT known malicious user-agent string dwplayer (blacklist.rules, High)
18388 <-> BLACKLIST USER-AGENT known malicious user-agent string RookIE/1.0 (blacklist.rules, High)
18389 <-> BLACKLIST USER-AGENT known malicious user-agent string 3653Client (blacklist.rules, High)
18390 <-> BLACKLIST USER-AGENT known malicious user-agent string Delphi 5.x (blacklist.rules, High)
18391 <-> BLACKLIST USER-AGENT known malicious user-agent string MyLove (blacklist.rules, High)
18392 <-> BLACKLIST USER-AGENT known malicious user-agent string qixi (blacklist.rules, High)
18393 <-> BLACKLIST USER-AGENT known malicious user-agent string vyre32 (blacklist.rules, High)
18394 <-> BLACKLIST USER-AGENT known malicious user-agent string OCRecover (blacklist.rules, High)
18395 <-> BLACKLIST USER-AGENT known malicious user-agent string Duckling/1.0 (blacklist.rules, High)
18396 <-> WEB-CLIENT Windows Hypervisor denial of service vfd download attempt (web-client.rules, High)
18397 <-> MISC HP DDMI Agent spoofing - command execution (misc.rules, High)

Updated rules:
3535 <-> WEB-CLIENT GIF transfer (web-client.rules, Low)
3551 <-> WEB-CLIENT .hta download attempt (web-client.rules, Low)
3633 <-> WEB-CLIENT bitmap transfer (web-client.rules, Low)
4194 <-> WEB-CLIENT multipacket CBO CBL CBM file transfer start (web-client.rules, Low)
4678 <-> WEB-CLIENT quicktime movie file transfer (web-client.rules, Low)
5740 <-> WEB-CLIENT Microsoft HTML help workshop file .hhp download attempt (web-client.rules, Low)
5741 <-> WEB-CLIENT Microsoft HTML help workshop buffer overflow attempt (web-client.rules, High)
6688 <-> WEB-CLIENT PNG file transfer (web-client.rules, Low)
9845 <-> WEB-CLIENT M3U File Download Detected (web-client.rules, Low)
13465 <-> WEB-CLIENT Microsoft Works file download request (web-client.rules, Low)
13515 <-> WEB-CLIENT Quicktime user agent (web-client.rules, Low)
13584 <-> WEB-CLIENT csv file download request (web-client.rules, Low)
13801 <-> WEB-CLIENT RTF file download (web-client.rules, Low)
13911 <-> WEB-CLIENT Microsoft search file download attempt (web-client.rules, Low)
13982 <-> WEB-CLIENT Microsoft Powerpoint file download attempt (web-client.rules, Low)
13983 <-> WEB-CLIENT Microsoft Office eps file download (web-client.rules, Low)
14017 <-> WEB-CLIENT MPEG Layer 3 playlist file request (web-client.rules, Low)
14018 <-> WEB-CLIENT PLS multimedia playlist file request (web-client.rules, Low)
14086 <-> BACKDOOR Adware.Win32.Agent.BM runtime detection 1 (backdoor.rules, High)
14087 <-> BACKDOOR Adware.Win32.Agent.BM runtime detection 2 (backdoor.rules, High)
15123 <-> WEB-CLIENT Rich Text Format file request (web-client.rules, Low)
15184 <-> CHAT MSN messenger http link transmission attempt (chat.rules, High)
15294 <-> WEB-CLIENT Microsoft Visio file download request (web-client.rules, Low)
15426 <-> WEB-CLIENT MAKI file request (web-client.rules, Low)
15463 <-> WEB-CLIENT Microsoft Excel file request (web-client.rules, Low)
15464 <-> WEB-CLIENT Microsoft Excel file request (web-client.rules, Low)
15471 <-> WEB-CLIENT asp file upload (web-client.rules, Low)
15516 <-> WEB-CLIENT AVI multimedia file request (web-client.rules, Low)
15586 <-> WEB-CLIENT Powerpoint file download request (web-client.rules, Low)
15587 <-> WEB-CLIENT Word file download request (web-client.rules, Low)
15865 <-> WEB-CLIENT MP4 file request (web-client.rules, Low)
15921 <-> WEB-CLIENT Microsoft media format file download request (web-client.rules, Low)
15922 <-> WEB-CLIENT mp3 file download request (web-client.rules, Low)
15945 <-> WEB-CLIENT RSS file download request (web-client.rules, Low)
16143 <-> WEB-CLIENT Microsoft asf file download (web-client.rules, Low)
16219 <-> WEB-CLIENT Adobe Director file format transfer (web-client.rules, Low)
16425 <-> WEB-CLIENT request for Portable Executable binary file (web-client.rules, Low)
16473 <-> WEB-CLIENT Microsoft Windows Movie Maker project file download request (web-client.rules, Low)
16474 <-> WEB-CLIENT Microsoft Compound File Binary v3 file download (web-client.rules, Low)
16475 <-> WEB-CLIENT Microsoft Compound File Binary v4 file download (web-client.rules, Low)
16476 <-> WEB-CLIENT Microsoft .MSProducer file download request (web-client.rules, Low)
16477 <-> WEB-CLIENT Microsoft .MSProducerZ file download request (web-client.rules, Low)
16478 <-> WEB-CLIENT Microsoft .MSProducerBF file download request (web-client.rules, Low)
16691 <-> WEB-CLIENT PLF playlist file download request (web-client.rules, Low)
17116 <-> WEB-CLIENT asx file download request (web-client.rules, Low)
17229 <-> WEB-CLIENT Tiff file download - little-endian (web-client.rules, Low)
17230 <-> WEB-CLIENT Tiff file download - big-endian (web-client.rules, Low)
17241 <-> WEB-CLIENT Microsoft wmv file download request (web-client.rules, Low)
17259 <-> WEB-CLIENT .mov file request (web-client.rules, Low)
17314 <-> WEB-CLIENT OLE Document file download (web-client.rules, Low)
17359 <-> WEB-CLIENT xbm image file download request (web-client.rules, Low)
17366 <-> WEB-CLIENT Microsoft Help Workshop HPJ OPTIONS section buffer overflow attempt (web-client.rules, High)
17394 <-> WEB-CLIENT GIF file download request (web-client.rules, Low)
17426 <-> WEB-CLIENT RAT file download request (web-client.rules, Low)
17491 <-> SPECIFIC-THREATS Microsoft Word mso.dll LsCreateLine memory corruption attempt (specific-threats.rules, High)
17547 <-> WEB-CLIENT Apple Quicktime SMIL transfer (web-client.rules, Low)
17552 <-> WEB-CLIENT Adobe Pagemaker file request (web-client.rules, Low)
17600 <-> WEB-CLIENT .xul document retrieval (web-client.rules, Low)
17751 <-> WEB-CLIENT OpenType Font file download request (web-client.rules, Low)
17809 <-> WEB-CLIENT quicktime movie file transfer (web-client.rules, Low)
18196 <-> WEB-CLIENT Microsoft Internet Explorer CSS importer use-after-free attempt (web-client.rules, High)
18240 <-> WEB-CLIENT Microsoft Internet Explorer CSS importer use-after-free attempt (web-client.rules, High)
18243 <-> SPECIFIC-THREATS Microsoft Windows 7 IIS7.5 FTPSVC buffer overflow attempt (specific-threats.rules, High)
18265 <-> WEB-CLIENT Microsoft Office thumbnail bitmap invalid biClrUsed attempt (web-client.rules, High)
18335 <-> WEB-CLIENT Microsoft MHTML XSS attempt (web-client.rules, High)