Sourcefire VRT Rules Update

Date: 2011-03-03

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2.9.0.2.

The format of the file is:

sid - Message (rule group, priority)

New rules:
18473 <-> ICMPv6 Echo Reply (icmp-info.rules, Low)
18474 <-> ICMPv6 Echo Request (icmp-info.rules, Low)
18475 <-> WEB_MISC HP Openview OvWebHelp.exe buffer overflow (web-misc.rules, High)
18476 <-> SPECIFIC-THREATS IBM Lotus Notes DOC attachment viewer buffer overflow (specific-threats.rules, High)
18477 <-> SMTP Lotus Notes MIF viewer statement data overflow 2 (specific-threats.rules, High)
18478 <-> WEB-PHP miniBB rss.php premodDir remote file include attempt (web-php.rules, High)
18479 <-> WEB-PHP miniBB rss.php premodDir remote file include attempt (web-php.rules, High)
18480 <-> WEB-MISC HP openview network node manager ovlogin.exe buffer overflow - userid parameter (web-misc.rules, High)
18481 <-> WEB-MISC HP openview network node manager ovlogin.exe buffer overflow - password parameter (web-misc.rules, High)
18482 <-> SPECIFIC-THREATS Microsoft Internet Explorer History.go method double free corruption attempt (specific-threats.rules, High)
18483 <-> WEB-CLIENT Apple iTunes Playlist Overflow Attempt (web-client.rules, High)
18484 <-> WEB-CLIENT Apple iTunes Playlist Overflow Attempt (web-client.rules, High)
18485 <-> SPECIFIC-THREATS Mozilla Firefox JavaScript handler race condition memory corruption attempt (specific-threats.rules, High)
18486 <-> SPECIFIC-THREATS Mozilla Firefox JavaScript handler race condition memory corruption attempt (specific-threats.rules, High)
18487 <-> SPECIFIC-THREATS Ingres Database iidbms heap overflow attempt (specific-threats.rules, High)
18488 <-> WEB-CLIENT Adobe Photoshop Wintab32.dll dll-load exploit attempt (web-client.rules, High)
18489 <-> NETBIOS Adobe Photoshop Wintab32.dll dll-load exploit attempt (netbios.rules, High)
18490 <-> WEB-ACTIVEX Whale Client Components ActiveX clsid access (web-activex.rules, High)
18491 <-> WEB-ACTIVEX Whale Client Components ActiveX ProgID access (web-activex.rules, High)
18492 <-> BLACKLIST DNS request for known malware domain ilo.brenz.pl (blacklist.rules, High)
18493 <-> WEB-PHP generic PHP code obfuscation attempt (web-php.rules, High)

Updated rules:
 532 <-> DELETED NETBIOS SMB ADMIN$ share access (deleted.rules, Low)
 533 <-> DELETED NETBIOS SMB C$ share access (deleted.rules, Low)
 536 <-> DELETED NETBIOS SMB D$ share access (deleted.rules, Low)
1991 <-> CHAT MSN login attempt (chat.rules, High)
2467 <-> DELETED NETBIOS SMB D$ unicode share access (deleted.rules, Low)
2468 <-> DELETED NETBIOS SMB-DS D$ share access (deleted.rules, Low)
2469 <-> DELETED NETBIOS SMB-DS D$ unicode share access (deleted.rules, Low)
2470 <-> DELETED NETBIOS SMB C$ unicode share access (deleted.rules, Low)
2471 <-> DELETED NETBIOS SMB-DS C$ share access (deleted.rules, Low)
2472 <-> DELETED NETBIOS SMB-DS C$ unicode share access (deleted.rules, Low)
2473 <-> DELETED NETBIOS SMB ADMIN$ unicode share access (deleted.rules, Low)
2475 <-> DELETED NETBIOS SMB-DS ADMIN$ unicode share access (deleted.rules, Low)
2494 <-> DELETED NETBIOS DCEPRC ORPCThis request flood attempt (deleted.rules, Medium)
2495 <-> DELETED NETBIOS SMB DCEPRC ORPCThis request flood attempt (deleted.rules, Medium)
2496 <-> DELETED NETBIOS SMB-DS DCEPRC ORPCThis request flood attempt (deleted.rules, Medium)
2523 <-> DOS BGP spoofed connection reset attempt (dos.rules, Medium)
2973 <-> DELETED NETBIOS SMB D$ unicode andx share access (deleted.rules, Low)
2974 <-> DELETED NETBIOS SMB-DS D$ andx share access (deleted.rules, Low)
2975 <-> DELETED NETBIOS SMB-DS D$ unicode andx share access (deleted.rules, Low)
2976 <-> DELETED NETBIOS SMB C$ andx share access (deleted.rules, Low)
2977 <-> DELETED NETBIOS SMB C$ unicode andx share access (deleted.rules, Low)
2978 <-> DELETED NETBIOS SMB-DS C$ andx share access (deleted.rules, Low)
2979 <-> DELETED NETBIOS SMB-DS C$ unicode andx share access (deleted.rules, Low)
2980 <-> DELETED NETBIOS SMB ADMIN$ andx share access (deleted.rules, Low)
2981 <-> DELETED NETBIOS SMB ADMIN$ unicode andx share access (deleted.rules, Low)
2982 <-> DELETED NETBIOS SMB-DS ADMIN$ andx share access (deleted.rules, Low)
2983 <-> DELETED NETBIOS SMB-DS ADMIN$ unicode andx share access (deleted.rules, Low)
3527 <-> EXPLOIT Solaris LPD overflow attempt (exploit.rules, High)
4645 <-> IMAP search format string attempt (imap.rules, High)
5321 <-> DELETED VIRUS Possible Sober virus set one NTP time check attempt (deleted.rules, Medium)
5322 <-> DELETED VIRUS Possible Sober virus set two NTP time check attempt (deleted.rules, Medium)
5323 <-> DELETED VIRUS Possible Sober virus set three NTP time check attempt (deleted.rules, Medium)
5742 <-> SPYWARE-PUT Keylogger activitylogger runtime detection (spyware-put.rules, Medium)
5744 <-> SPYWARE-PUT Hijacker actualnames runtime detection - online.php request (spyware-put.rules, Low)
5749 <-> SPYWARE-PUT Trackware alexa runtime detection (spyware-put.rules, Medium)
5750 <-> SPYWARE-PUT Adware dogpile runtime detection (spyware-put.rules, Low)
5760 <-> SPYWARE-PUT Hijacker marketscore runtime detection (spyware-put.rules, Low)
5764 <-> SPYWARE-PUT Hijacker begin2search runtime detection - fcgi query (spyware-put.rules, Low)
5765 <-> SPYWARE-PUT Hijacker begin2search runtime detection - ico query (spyware-put.rules, Low)
5767 <-> SPYWARE-PUT Hijacker begin2search runtime detection - download unauthorized code (spyware-put.rules, Low)
5773 <-> SPYWARE-PUT Adware forbes runtime detection (spyware-put.rules, Low)
5774 <-> SPYWARE-PUT Hijacker freescratch runtime detection - get card (spyware-put.rules, Low)
5775 <-> SPYWARE-PUT Hijacker freescratch runtime detection - scratch card (spyware-put.rules, Low)
5776 <-> SPYWARE-PUT Trickler grokster runtime detection (spyware-put.rules, Low)
5794 <-> SPYWARE-PUT Hijacker coolwebsearch.aboutblank variant runtime detection (spyware-put.rules, Low)
5796 <-> SPYWARE-PUT Adware keenvalue runtime detection (spyware-put.rules, Low)
5801 <-> SPYWARE-PUT Trackware myway speedbar / mywebsearch toolbar runtime detection - track activity 1 (spyware-put.rules, Medium)
5802 <-> SPYWARE-PUT Trackware myway speedbar / mywebsearch toolbar runtime detection - track activity 2 (spyware-put.rules, Medium)
5803 <-> SPYWARE-PUT Trackware myway speedbar / mywebsearch toolbar runtime detection - collect information (spyware-put.rules, Medium)
5804 <-> DELETED SPYWARE-PUT Trackware myway speedbar / mywebsearch toolbar runtime detection - ads (deleted.rules, Medium)
5805 <-> SPYWARE-PUT Trackware myway speedbar runtime detection - switch engines (spyware-put.rules, Medium)
5806 <-> DELETED SPYWARE-PUT Hijacker searchmiracle-elitebar runtime detection (deleted.rules, Low)
5807 <-> SPYWARE-PUT Hijacker shopathomeselect runtime detection (spyware-put.rules, Low)
5824 <-> SPYWARE-PUT Dialer stripplayer runtime detection (spyware-put.rules, Low)
5825 <-> SPYWARE-PUT Adware broadcasturban tuner runtime detection - start tuner (spyware-put.rules, Low)
5828 <-> SPYWARE-PUT Adware broadcasturban tuner runtime detection - connect to station (spyware-put.rules, Low)
5829 <-> SPYWARE-PUT Trickler clipgenie runtime detection (spyware-put.rules, Low)
5830 <-> DELETED SPYWARE-PUT Hijacker comet systems runtime detection - track activity (deleted.rules, Low)
5831 <-> DELETED SPYWARE-PUT Hijacker comet systems runtime detection - update requests (deleted.rules, Low)
5832 <-> DELETED SPYWARE-PUT Hijacker comet systems runtime search detection - search request 1 (deleted.rules, Low)
5835 <-> SPYWARE-PUT Adware gamespy_arcade runtime detection (spyware-put.rules, Low)
5836 <-> SPYWARE-PUT Trickler nictech.bm2 runtime detection (spyware-put.rules, Low)
5837 <-> SPYWARE-PUT Trackware ucmore runtime detection - track activity (spyware-put.rules, Medium)
5838 <-> SPYWARE-PUT Trackware ucmore runtime detection - get sponsor/ad links (spyware-put.rules, Medium)
5841 <-> SPYWARE-PUT Trickler minibug runtime detection - retrieve weather information (spyware-put.rules, Low)
5842 <-> SPYWARE-PUT Trickler minibug runtime detection - ads (spyware-put.rules, Low)
5846 <-> SPYWARE-PUT Trickler VX2/DLmax/BestOffers/Aurora runtime detection (spyware-put.rules, Low)
5852 <-> SPYWARE-PUT Adware warez_p2p runtime detection - cache.dat request (spyware-put.rules, Low)
5853 <-> SPYWARE-PUT Adware warez_p2p runtime detection - download ads (spyware-put.rules, Low)
5856 <-> DELETED SPYWARE-PUT Hijacker funbuddyicons runtime detection - funwebproducts user-agent string (deleted.rules, Low)
5858 <-> SPYWARE-PUT Adware praizetoolbar runtime detection (spyware-put.rules, Low)
5865 <-> SPYWARE-PUT Adware zapspot runtime detection - pop up ads (spyware-put.rules, Low)
5866 <-> SPYWARE-PUT Hijacker couponbar runtime detection - download new coupon offers and links (spyware-put.rules, Low)
5867 <-> SPYWARE-PUT Hijacker couponbar runtime detection - get updates to toolbar buttons (spyware-put.rules, Low)
5871 <-> SPYWARE-PUT Trickler VX2/ABetterInternet transponder thinstaller runtime detection - post information (spyware-put.rules, Low)
5879 <-> DELETED SPYWARE-PUT Adware trustyfiles v2.4.0.4 runtime detection - update notification (deleted.rules, Low)
5881 <-> SPYWARE-PUT Keylogger spyagent runtime detect - ftp delivery (spyware-put.rules, Medium)
5889 <-> SPYWARE-PUT Hijacker shopnav runtime detection - collect information (spyware-put.rules, Low)
5890 <-> SPYWARE-PUT Hijacker shopnav runtime detection - self-update request 1 (spyware-put.rules, Low)
5891 <-> SPYWARE-PUT Hijacker shopnav runtime detection - self-update request 2 (spyware-put.rules, Low)
5896 <-> SPYWARE-PUT Hacker-Tool timbuktu pro runtime detection - tcp port 407 (spyware-put.rules, Low)
5897 <-> SPYWARE-PUT Hacker-Tool timbuktu pro runtime detection - udp port 407 (spyware-put.rules, Low)
5899 <-> SPYWARE-PUT Trackware adtools-screenmate runtime detection - generate desktop alert (spyware-put.rules, Medium)
5903 <-> SPYWARE-PUT Adware download accelerator plus runtime detection - get ads (spyware-put.rules, Low)
5910 <-> DELETED SPYWARE-PUT Trackware casalemedia runtime detection (deleted.rules, Medium)
5912 <-> DELETED SPYWARE-PUT Hijacker webcrawler runtime detection (deleted.rules, Low)
5914 <-> SPYWARE-PUT Hijacker locatorstoolbar runtime detection - configuration download (spyware-put.rules, Low)
5915 <-> SPYWARE-PUT Hijacker locatorstoolbar runtime detection - autosearch hijack (spyware-put.rules, Low)
5916 <-> SPYWARE-PUT Hijacker locatorstoolbar runtime detection - sidebar search (spyware-put.rules, Low)
5917 <-> SPYWARE-PUT Hijacker locatorstoolbar runtime detection - toolbar search (spyware-put.rules, Low)
5918 <-> SPYWARE-PUT Hijacker painter runtime detection - ping 'alive' signal (spyware-put.rules, Low)
5921 <-> SPYWARE-PUT Trackware fftoolbar toolbar runtime detection - send user url request (spyware-put.rules, Medium)
5922 <-> SPYWARE-PUT Trackware fftoolbar toolbar runtime detection - display advertisement news (spyware-put.rules, Medium)
5925 <-> SPYWARE-PUT Adware active shopper runtime detection - check (spyware-put.rules, Low)
5926 <-> SPYWARE-PUT Adware active shopper runtime detection - collect information (spyware-put.rules, Low)
5927 <-> SPYWARE-PUT Adware cashbar runtime detection - .smx requests (spyware-put.rules, Low)
5928 <-> SPYWARE-PUT Adware cashbar runtime detection - ads request (spyware-put.rules, Low)
5929 <-> SPYWARE-PUT Adware cashbar runtime detection - pop-up ad 1 (spyware-put.rules, Low)
5930 <-> SPYWARE-PUT Adware cashbar runtime detection - pop-up ad 2 (spyware-put.rules, Low)
5931 <-> DELETED SPYWARE-PUT Adware cashbar runtime detection - stats track 1 (deleted.rules, Low)
5932 <-> SPYWARE-PUT Adware cashbar runtime detection - stats track (spyware-put.rules, Low)
5939 <-> SPYWARE-PUT Trackware supreme toolbar runtime detection - get cfg (spyware-put.rules, Medium)
5940 <-> SPYWARE-PUT Trackware supreme toolbar runtime detection - search request (spyware-put.rules, Medium)
5942 <-> SPYWARE-PUT Trackware supreme toolbar runtime detection - pass information to its controlling server (spyware-put.rules, Medium)
5943 <-> SPYWARE-PUT Trackware supreme toolbar runtime detection - third party information collection (spyware-put.rules, Medium)
5944 <-> SPYWARE-PUT Adware free access bar runtime detection 1 (spyware-put.rules, Low)
5945 <-> SPYWARE-PUT Adware weirdontheweb runtime detection - track.cgi request (spyware-put.rules, Low)
5946 <-> SPYWARE-PUT Adware weirdontheweb runtime detection - monitor user web activity (spyware-put.rules, Low)
5949 <-> SPYWARE-PUT Trackware iggsey toolbar detection - simpleticker.htm request (spyware-put.rules, Medium)
5950 <-> SPYWARE-PUT Trackware iggsey toolbar detection - pass information to server (spyware-put.rules, Medium)
5951 <-> SPYWARE-PUT Trackware iggsey toolbar detection - search request (spyware-put.rules, Medium)
5954 <-> SPYWARE-PUT Trackware browserpal runtime detection - post user info to server (spyware-put.rules, Medium)
5961 <-> SPYWARE-PUT Hijacker searchfast detection - news ticker (spyware-put.rules, Low)
5966 <-> SPYWARE-PUT trackware searchinweb detection - search request (spyware-put.rules, Medium)
5970 <-> SPYWARE-PUT hijacker smart finder detection - keys update (spyware-put.rules, Low)
5971 <-> SPYWARE-PUT hijacker smart finder detection - track hits (spyware-put.rules, Low)
5973 <-> SPYWARE-PUT hijacker smart finder detection - search engines hijack (spyware-put.rules, Low)
5974 <-> SPYWARE-PUT hijacker smart finder detection - pop-up ads (spyware-put.rules, Low)
5975 <-> SPYWARE-PUT hijacker topfive searchassistant detection - search request (spyware-put.rules, Low)
5976 <-> SPYWARE-PUT hijacker topfive searchassistant detection - side search (spyware-put.rules, Low)
5977 <-> SPYWARE-PUT hijacker topfive searchassistant detection - post user information to server (spyware-put.rules, Low)
5978 <-> SPYWARE-PUT hijacker topfive searchassistant detection - update (spyware-put.rules, Low)
5979 <-> SPYWARE-PUT Trackware anwb toolbar runtime detection - track user ip address (spyware-put.rules, Medium)
5980 <-> SPYWARE-PUT Trackware anwb toolbar runtime detection - display advertisement (spyware-put.rules, Medium)
5981 <-> SPYWARE-PUT Hijacker seeqtoolbar runtime detection - autosearch hijack or search in toolbar (spyware-put.rules, Low)
5982 <-> SPYWARE-PUT Hijacker seeqtoolbar runtime detection - email login page (spyware-put.rules, Low)
5983 <-> SPYWARE-PUT Adware powerstrip runtime detection (spyware-put.rules, Low)
5986 <-> SPYWARE-PUT Trickler teomasearchbar runtime detection (spyware-put.rules, Low)
5987 <-> SPYWARE-PUT Hijacker wishbone runtime detection (spyware-put.rules, Low)
5988 <-> SPYWARE-PUT Trackware windupdates-mediagateway runtime detection - post data (spyware-put.rules, Medium)
5989 <-> SPYWARE-PUT Adware broadcastpc runtime detection - get config (spyware-put.rules, Low)
5990 <-> SPYWARE-PUT Adware broadcastpc runtime detection - get up-to-date movie/tv/ad information (spyware-put.rules, Low)
5992 <-> SPYWARE-PUT Hijacker getmirar runtime detection - get keyword-related content (spyware-put.rules, Low)
5993 <-> SPYWARE-PUT Hijacker getmirar runtime detection - track activity (spyware-put.rules, Low)
5994 <-> SPYWARE-PUT Hijacker getmirar runtime detection - click related button (spyware-put.rules, Low)
5995 <-> SPYWARE-PUT Adware offeragent runtime detection - information checking (spyware-put.rules, Low)
5996 <-> SPYWARE-PUT Adware offeragent runtime detection - ads request (spyware-put.rules, Low)
6107 <-> BACKDOOR backage 3.1 runtime detection (backdoor.rules, High)
6122 <-> BACKDOOR millenium v1.0 runtime detection (backdoor.rules, High)
6127 <-> BACKDOOR dkangel runtime detection - udp client-to-server (backdoor.rules, High)
6128 <-> BACKDOOR dkangel runtime detection - icmp echo reply client-to-server (backdoor.rules, High)
6146 <-> BACKDOOR mantis runtime detection - sent notify option client-to-server 2 (backdoor.rules, High)
6174 <-> BACKDOOR cookie monster 0.24 runtime detection - file explorer (backdoor.rules, High)
6176 <-> BACKDOOR guptachar 2.0 runtime detection (backdoor.rules, High)
6189 <-> SPYWARE-PUT Trackware try2find detection (spyware-put.rules, Medium)
6191 <-> SPYWARE-PUT Trackware onetoolbar runtime detection (spyware-put.rules, Medium)
6192 <-> SPYWARE-PUT Adware seekmo runtime detection - reporting keyword (spyware-put.rules, Low)
6196 <-> SPYWARE-PUT Hijacker smart shopper runtime detection - services requests (spyware-put.rules, Low)
6197 <-> SPYWARE-PUT Hijacker smart shopper runtime detection - track/upgrade/report activities (spyware-put.rules, Low)
6198 <-> SPYWARE-PUT Trackware squaretrade side bar runtime detection - collect user information (spyware-put.rules, Medium)
6199 <-> SPYWARE-PUT Hijacker smart search runtime detection - hijack/ads (spyware-put.rules, Low)
6200 <-> SPYWARE-PUT Hijacker smart search runtime detection - get settings (spyware-put.rules, Low)
6203 <-> SPYWARE-PUT Trickler farmmext runtime detection - drk.syn request (spyware-put.rules, Low)
6206 <-> SPYWARE-PUT Hacker-Tool sin stealer 1.1 runtime detection (spyware-put.rules, Low)
6207 <-> SPYWARE-PUT Keylogger winsession runtime detection - smtp (spyware-put.rules, Medium)
6208 <-> SPYWARE-PUT Keylogger winsession runtime detection - ftp (spyware-put.rules, Medium)
6209 <-> SPYWARE-PUT Adware deskwizz/zquest runtime detection - get config information / ad banner (spyware-put.rules, Low)
6212 <-> SPYWARE-PUT Adware commonname runtime detection (spyware-put.rules, Low)
6213 <-> SPYWARE-PUT Hijacker 7fasst runtime detection - auto requests (spyware-put.rules, Low)
6219 <-> SPYWARE-PUT Adware bonzibuddy runtime detection (spyware-put.rules, Low)
6220 <-> SPYWARE-PUT Keylogger boss everyware runtime detection (spyware-put.rules, Medium)
6222 <-> SPYWARE-PUT Adware delfin media viewer runtime detection - contact server (spyware-put.rules, Low)
6223 <-> SPYWARE-PUT Adware delfin media viewer runtime detection - retrieve schedule (spyware-put.rules, Low)
6225 <-> DELETED SPYWARE-PUT Adware exact.bargainbuddy runtime detection - ads - getsize request (deleted.rules, Low)
6228 <-> DELETED SPYWARE-PUT Adware exact.bargainbuddy runtime detection - disclaimer text (deleted.rules, Low)
6229 <-> DELETED SPYWARE-PUT Adware exact.bargainbuddy runtime detection - adp ads (deleted.rules, Low)
6232 <-> SPYWARE-PUT Adware mirar runtime detection - thumbnail (spyware-put.rules, Low)
6233 <-> SPYWARE-PUT Adware mirar runtime detection - delayed (spyware-put.rules, Low)
6237 <-> SPYWARE-PUT Adware lop runtime detection - check update request (spyware-put.rules, Low)
6239 <-> SPYWARE-PUT Adware lop runtime detection - collect info request 2 (spyware-put.rules, Low)
6241 <-> SPYWARE-PUT Adware lop runtime detection - ie autosearch hijack (spyware-put.rules, Low)
6250 <-> SPYWARE-PUT Adware hotbar runtime detection - hotbar user-agent (spyware-put.rules, Low)
6251 <-> SPYWARE-PUT Adware hotbar runtime detection - hostie user-agent (spyware-put.rules, Low)
6252 <-> SPYWARE-PUT Trackware quicksearch toolbar runtime detection - search request (spyware-put.rules, Medium)
6254 <-> SPYWARE-PUT Trackware quicksearch toolbar runtime detection - redirect (spyware-put.rules, Medium)
6270 <-> SPYWARE-PUT Hijacker topicks runtime detection (spyware-put.rules, Low)
6275 <-> SPYWARE-PUT Hijacker incredifind runtime detection - cookie (spyware-put.rules, Low)
6281 <-> SPYWARE-PUT Hijacker yoursitebar runtime detection (spyware-put.rules, Low)
6282 <-> SPYWARE-PUT Hijacker customtoolbar runtime detection (spyware-put.rules, Low)
6290 <-> BACKDOOR netspy runtime detection - command pattern server-to-client (backdoor.rules, High)
6321 <-> BACKDOOR ptakks2.1 runtime detection - keepalive acknowledgement (backdoor.rules, High)
6322 <-> BACKDOOR ptakks2.1 runtime detection - command pattern (backdoor.rules, High)
6324 <-> BACKDOOR 3xBackdoor runtime detection (backdoor.rules, High)
6336 <-> BACKDOOR buttman v0.9p runtime detection - remote control (backdoor.rules, High)
6341 <-> SPYWARE-PUT Hijacker spediabar user-agent string detected (spyware-put.rules, Low)
6342 <-> SPYWARE-PUT Hijacker spediabar runtime detection - info check (spyware-put.rules, Low)
6343 <-> SPYWARE-PUT Adware targetsaver runtime detection (spyware-put.rules, Low)
6358 <-> SPYWARE-PUT Hijacker need2find search query detection (spyware-put.rules, Low)
6359 <-> SPYWARE-PUT Adware altnet runtime detection - initial retrieval (spyware-put.rules, Low)
6360 <-> SPYWARE-PUT Adware altnet runtime detection - update (spyware-put.rules, Low)
6361 <-> SPYWARE-PUT Adware altnet runtime detection - status report (spyware-put.rules, Low)
6363 <-> SPYWARE-PUT adware surfaccuracy runtime detection (spyware-put.rules, Low)
6364 <-> SPYWARE-PUT Hijacker imeshbar runtime detection (spyware-put.rules, Low)
6365 <-> SPYWARE-PUT Other-Technologies sony rootkit runtime detection (spyware-put.rules, Low)
6372 <-> SPYWARE-PUT Trickler spyblocs eblocs detection - get wsliveup.dat (spyware-put.rules, Low)
6373 <-> SPYWARE-PUT Trickler spyblocs eblocs detection - stbarpat.dat (spyware-put.rules, Low)
6374 <-> SPYWARE-PUT Trickler spyblocs eblocs detection - get spyblpat.dat/spyblini.ini (spyware-put.rules, Low)
6377 <-> SPYWARE-PUT Hijacker girafa toolbar - browser hijack (spyware-put.rules, Low)
6384 <-> SPYWARE-PUT Keylogger stealthwatcher 2000 runtime detection - agent discover broadcast (spyware-put.rules, Medium)
6385 <-> SPYWARE-PUT Keylogger stealthwatcher 2000 runtime detection - agent status monitoring (spyware-put.rules, Medium)
6386 <-> SPYWARE-PUT Keylogger stealthwatcher 2000 runtime detection - agent up notification (spyware-put.rules, Medium)
6398 <-> BACKDOOR http rat runtime detection - http (backdoor.rules, High)
6408 <-> POLICY webshots desktop traffic (policy.rules, Low)
6467 <-> CHAT jabber traffic detected (chat.rules, High)
6477 <-> SPYWARE-PUT Hacker-Tool beee runtime detection - smtp (spyware-put.rules, Low)
6478 <-> SPYWARE-PUT Trackware searchingall toolbar runtime detection - send user url request (spyware-put.rules, Medium)
6480 <-> SPYWARE-PUT Hijacker cws.cameup runtime detection - home page (spyware-put.rules, Low)
6481 <-> SPYWARE-PUT Hijacker cws.cameup runtime detection - search (spyware-put.rules, Low)
6482 <-> SPYWARE-PUT Hijacker makemesearch toolbar runtime detection - get info (spyware-put.rules, Low)
6483 <-> SPYWARE-PUT Hijacker makemesearch toolbar runtime detection - home page hijacker (spyware-put.rules, Low)
6484 <-> SPYWARE-PUT Hijacker makemesearch toolbar runtime detection - search (spyware-put.rules, Low)
6487 <-> SPYWARE-PUT Adware searchnugget toolbar runtime detection - check updates (spyware-put.rules, Low)
6488 <-> SPYWARE-PUT Adware searchnugget toolbar runtime detection - redirect mistyped urls (spyware-put.rules, Low)
6489 <-> SPYWARE-PUT Hijacker analyze IE runtime detection - default page hijacker (spyware-put.rules, Low)
6490 <-> SPYWARE-PUT Dialer yeaknet runtime detection - home page hijacker (spyware-put.rules, Low)
6494 <-> SPYWARE-PUT Adware yourenhancement runtime detection (spyware-put.rules, Low)
6496 <-> SPYWARE-PUT Adware adpowerzone runtime detection (spyware-put.rules, Low)
7033 <-> POLICY GoToMyPC local service running (policy.rules, High)
7034 <-> POLICY GoToMyPC remote control attempt (policy.rules, High)
7050 <-> SPYWARE-PUT Hijacker freecruise toolbar runtime detection (spyware-put.rules, Low)
7055 <-> SPYWARE-PUT Hijacker vip01 biz runtime detection - adv (spyware-put.rules, Low)
7068 <-> BACKDOOR delta source 0.5 beta runtime detection - ping (backdoor.rules, High)
7069 <-> BACKDOOR delta source 0.5 beta runtime detection - pc info (backdoor.rules, High)
7074 <-> BACKDOOR w32.dumaru.gen@mm runtime detection - cmd (backdoor.rules, High)
7100 <-> DELETED BACKDOOR mass connect 1.1 runtime detection - http (deleted.rules, High)
7118 <-> BACKDOOR y3k 1.2 runtime detection - user-agent string detected (backdoor.rules, High)
7138 <-> SPYWARE-PUT Other-Technologies clicktrojan runtime detection - version check (spyware-put.rules, Low)
7139 <-> SPYWARE-PUT Other-Technologies clicktrojan runtime detection - fake search query (spyware-put.rules, Low)
7140 <-> SPYWARE-PUT Adware pay-per-click runtime detection - configuration (spyware-put.rules, Low)
7141 <-> SPYWARE-PUT Adware pay-per-click runtime detection - update (spyware-put.rules, Low)
7142 <-> SPYWARE-PUT Adware ares flash downloader 2.04 runtime detection (spyware-put.rules, Low)
7143 <-> SPYWARE-PUT Adware digink.com runtime detection (spyware-put.rules, Low)
7144 <-> SPYWARE-PUT Hijacker cool search runtime detection (spyware-put.rules, Low)
7154 <-> SPYWARE-PUT Keylogger active keylogger home runtime detection (spyware-put.rules, Medium)
7169 <-> SPYWARE-PUT Keylogger ab system spy runtime detection - information exchange (spyware-put.rules, Medium)
7174 <-> DELETED SPYWARE-PUT Keylogger ab system spy runtime detection - info update (deleted.rules, Medium)
7177 <-> SPYWARE-PUT Keylogger ab system spy runtime detection - info send through email (spyware-put.rules, Medium)
7180 <-> SPYWARE-PUT Keylogger desktop detective 2000 runtime detection - init connection (spyware-put.rules, Medium)
7182 <-> DELETED SPYWARE-PUT Keylogger desktop detective 2000 runtime detection - info request (deleted.rules, Medium)
7185 <-> SPYWARE-PUT Keylogger 007 spy software runtime detection - ftp (spyware-put.rules, Medium)
7190 <-> SPYWARE-PUT Adware trustyfiles v3.1.0.1 runtime detection - host retrieval (spyware-put.rules, Low)
7191 <-> SPYWARE-PUT Adware trustyfiles v3.1.0.1 runtime detection - url retrieval (spyware-put.rules, Low)
7192 <-> SPYWARE-PUT Adware trustyfiles v3.1.0.1 runtime detection - sponsor selection (spyware-put.rules, Low)
7193 <-> SPYWARE-PUT Adware trustyfiles v3.1.0.1 runtime detection - startup access (spyware-put.rules, Low)
7194 <-> SPYWARE-PUT Hijacker shopprreports runtime detection - services requests (spyware-put.rules, Low)
7195 <-> SPYWARE-PUT Hijacker shopprreports runtime detection - track/upgrade/report activities (spyware-put.rules, Low)
7504 <-> SPYWARE-PUT Keylogger actualspy runtime detection - ftp-data (spyware-put.rules, Medium)
7505 <-> SPYWARE-PUT Keylogger actualspy runtime detection - smtp (spyware-put.rules, Medium)
7511 <-> SPYWARE-PUT Trickler edonkey2000 runtime detection - get ads page (spyware-put.rules, Low)
7514 <-> SPYWARE-PUT Keylogger watchdog runtime detection - send out info to server periodically (spyware-put.rules, Medium)
7515 <-> SPYWARE-PUT Keylogger watchdog runtime detection - remote monitoring (spyware-put.rules, Medium)
7516 <-> SPYWARE-PUT Trickler hmtoolbar runtime detection (spyware-put.rules, Low)
7518 <-> SPYWARE-PUT Trackware earthlink toolbar runtime detection - get up-to-date news info (spyware-put.rules, Medium)
7519 <-> DELETED SPYWARE-PUT Trackware earthlink toolbar runtime detection - track activity (deleted.rules, Medium)
7522 <-> SPYWARE-PUT Trackware earthlink toolbar runtime detection - search toolbar request 2 (spyware-put.rules, Medium)
7523 <-> SPYWARE-PUT Trackware earthlink toolbar runtime detection - click news button links (spyware-put.rules, Medium)
7524 <-> SPYWARE-PUT Hijacker moneybar runtime detection - cgispy counter (spyware-put.rules, Low)
7525 <-> SPYWARE-PUT Trackware hotblox toolbar runtime detection - barad.asp request (spyware-put.rules, Medium)
7526 <-> SPYWARE-PUT Trackware hotblox toolbar runtime detection - stat counter (spyware-put.rules, Medium)
7527 <-> SPYWARE-PUT Trackware hotblox toolbar runtime detection - toolbar find function (spyware-put.rules, Medium)
7529 <-> SPYWARE-PUT Snoopware halflife jacker runtime detection (spyware-put.rules, Medium)
7531 <-> SPYWARE-PUT Trickler mediaseek.pl client runtime detection - login (spyware-put.rules, Low)
7532 <-> SPYWARE-PUT Adware piolet runtime detection - user-agent (spyware-put.rules, Low)
7533 <-> SPYWARE-PUT Adware piolet runtime detection - ads request (spyware-put.rules, Low)
7534 <-> SPYWARE-PUT Hijacker clearsearch variant runtime detection - ie hijacking (spyware-put.rules, Low)
7535 <-> SPYWARE-PUT Hijacker clearsearch variant runtime detection - pass information (spyware-put.rules, Low)
7537 <-> SPYWARE-PUT Trackware arrow search runtime detection (spyware-put.rules, Medium)
7539 <-> SPYWARE-PUT Keylogger eye spy pro 1.0 runtime detection (spyware-put.rules, Medium)
7547 <-> SPYWARE-PUT Keylogger activity monitor 3.8 runtime detection - agent status monitoring (spyware-put.rules, Medium)
7548 <-> SPYWARE-PUT Keylogger activity monitor 3.8 runtime detection - agent up notification (spyware-put.rules, Medium)
7549 <-> SPYWARE-PUT Keylogger activity monitor 3.8 runtime detection (spyware-put.rules, Medium)
7550 <-> SPYWARE-PUT Adware adroar runtime detection (spyware-put.rules, Low)
7551 <-> SPYWARE-PUT Keylogger ardamax keylogger runtime detection - smtp (spyware-put.rules, Medium)
7552 <-> SPYWARE-PUT Keylogger ardamax keylogger runtime detection - ftp (spyware-put.rules, Medium)
7557 <-> SPYWARE-PUT Trackware purityscan runtime detection - start up (spyware-put.rules, Medium)
7558 <-> SPYWARE-PUT Trackware purityscan runtime detection - installation notify (spyware-put.rules, Medium)
7559 <-> SPYWARE-PUT Trackware purityscan runtime detection - track user activity and status (spyware-put.rules, Medium)
7562 <-> SPYWARE-PUT Adware morpheus runtime detection - ad 1 (spyware-put.rules, Low)
7563 <-> SPYWARE-PUT Adware morpheus runtime detection - ad 2 (spyware-put.rules, Low)
7567 <-> SPYWARE-PUT Trackware funwebproducts mywebsearchtoolbar-funtools runtime detection (spyware-put.rules, Medium)
7569 <-> SPYWARE-PUT Adware lordofsearch runtime detection (spyware-put.rules, Low)
7570 <-> SPYWARE-PUT Hijacker linkspider search bar runtime detection - ads (spyware-put.rules, Low)
7571 <-> SPYWARE-PUT Hijacker linkspider search bar runtime detection - toolbar search (spyware-put.rules, Low)
7572 <-> SPYWARE-PUT Trickler album galaxy runtime detection - startup data (spyware-put.rules, Low)
7573 <-> SPYWARE-PUT Trickler album galaxy runtime detection - p2p gnutella (spyware-put.rules, Low)
7575 <-> SPYWARE-PUT Hijacker starware toolbar runtime detection - weather request (spyware-put.rules, Low)
7576 <-> SPYWARE-PUT Hijacker starware toolbar runtime detection - hijack ie browser (spyware-put.rules, Low)
7581 <-> SPYWARE-PUT Hijacker flashbar runtime detection - user-agent (spyware-put.rules, Low)
7582 <-> SPYWARE-PUT Trickler pcast runtime detection - update checking (spyware-put.rules, Low)
7587 <-> SPYWARE-PUT Trickler urlblaze runtime detection - software information request (spyware-put.rules, Low)
7589 <-> SPYWARE-PUT Trickler urlblaze runtime detection - irc notification (spyware-put.rules, Low)
7593 <-> SPYWARE-PUT Trackware trellian toolbarbrowser runtime detection (spyware-put.rules, Medium)
7594 <-> SPYWARE-PUT Adware comedy planet runtime detection - ads (spyware-put.rules, Low)
7597 <-> SPYWARE-PUT Keylogger spy lantern keylogger runtime detection (spyware-put.rules, Medium)
7603 <-> SPYWARE-PUT Snoopware big brother v3.5.1 runtime detection - connect to receiver (spyware-put.rules, Medium)
7613 <-> DELETED BACKDOOR flux 1.0 runtime detection - successful initial connection (deleted.rules, High)
7615 <-> DELETED BACKDOOR flux 1.0 runtime detection - keep alive (deleted.rules, High)
7624 <-> BACKDOOR remote control 1.7 runtime detection - data communication (backdoor.rules, High)
7642 <-> BACKDOOR am remote client runtime detection - server-to-client (backdoor.rules, High)
7646 <-> BACKDOOR snipernet 2.1 runtime detection (backdoor.rules, High)
7647 <-> BACKDOOR minicom lite runtime detection - udp (backdoor.rules, High)
7649 <-> BACKDOOR minicom lite runtime detection - server-to-client (backdoor.rules, High)
7655 <-> DELETED BACKDOOR small uploader 1.01 runtime detection - remote shell (deleted.rules, High)
7669 <-> BACKDOOR screen control 1.0 runtime detection - capture on port 2213 (backdoor.rules, High)
7691 <-> BACKDOOR evade runtime detection - file manager (backdoor.rules, High)
7706 <-> BACKDOOR omniquad instant remote control runtime detection - initial connection (backdoor.rules, High)
7711 <-> BACKDOOR amitis runtime command detection attacker to victim (backdoor.rules, High)
7712 <-> BACKDOOR amitis runtime detection victim to attacker (backdoor.rules, High)
7727 <-> BACKDOOR reversable ver1.0 runtime detection - execute command (backdoor.rules, High)
7732 <-> BACKDOOR outbreak_0.2.7 runtime detection - ring client-to-server (backdoor.rules, High)
7739 <-> BACKDOOR alexmessomalex runtime detection - grab (backdoor.rules, High)
7758 <-> BACKDOOR glacier runtime detection - initial connection and directory browse (backdoor.rules, High)
7759 <-> BACKDOOR glacier runtime detection - screen capture (backdoor.rules, High)
7760 <-> BACKDOOR netthief runtime detection (backdoor.rules, High)
7801 <-> BACKDOOR portal of doom runtime detection - udp cts (backdoor.rules, High)
7802 <-> BACKDOOR portal of doom runtime detection - udp stc (backdoor.rules, High)
7822 <-> BACKDOOR xbkdr runtime detection (backdoor.rules, High)
7827 <-> SPYWARE-PUT Adware whenu runtime detection - search request 1 (spyware-put.rules, Low)
7828 <-> SPYWARE-PUT Adware whenu runtime detection - search request 2 (spyware-put.rules, Low)
7829 <-> SPYWARE-PUT Adware gator user-agent detected (spyware-put.rules, Low)
7832 <-> SPYWARE-PUT Hijacker navexcel helper runtime detection - active/update (spyware-put.rules, Low)
7835 <-> SPYWARE-PUT Hacker-Tool nettracker runtime detection - report browsing (spyware-put.rules, Low)
7837 <-> SPYWARE-PUT Keylogger spyoutside runtime detection - email delivery (spyware-put.rules, Medium)
7839 <-> SPYWARE-PUT Hijacker rx toolbar runtime detection (spyware-put.rules, Low)
7848 <-> SPYWARE-PUT Hijacker netguide runtime detection (spyware-put.rules, Low)
7856 <-> SPYWARE-PUT Trackware winsysba-a runtime detection - track surfing activity (spyware-put.rules, Medium)
7861 <-> POLICY Google Desktop activity (policy.rules, High)
8071 <-> SPYWARE-PUT Hijacker findthewebsiteyouneed runtime detection - search hijack (spyware-put.rules, Low)
8072 <-> SPYWARE-PUT Hijacker findthewebsiteyouneed runtime detection - surf monitor (spyware-put.rules, Low)
8073 <-> SPYWARE-PUT Adware zango toolbar runtime detection (spyware-put.rules, Low)
8358 <-> SPYWARE-PUT Hijacker yok supersearch runtime detection - addressbar keyword search hijack (spyware-put.rules, Low)
8359 <-> SPYWARE-PUT Hijacker yok supersearch runtime detection - target website display (spyware-put.rules, Low)
8360 <-> SPYWARE-PUT Hijacker yok supersearch runtime detection - search info collect (spyware-put.rules, Low)
8464 <-> SPYWARE-PUT Adware henbang runtime detection (spyware-put.rules, Low)
8467 <-> SPYWARE-PUT Keylogger netobserve runtime detection - remote login response (spyware-put.rules, Medium)
8468 <-> SPYWARE-PUT Hijacker accoona runtime detection - collect info (spyware-put.rules, Low)
8477 <-> DELETED BACKDOOR superspy 2.0 beta runtime detection - file management (deleted.rules, High)
8542 <-> SPYWARE-PUT Trackware deluxecommunications runtime detection - collect info (spyware-put.rules, Medium)
8544 <-> SPYWARE-PUT Keylogger nicespy runtime detection - smtp (spyware-put.rules, Medium)
8545 <-> SPYWARE-PUT Adware roogoo runtime detection - surfing monitor (spyware-put.rules, Low)
8549 <-> BACKDOOR zxshell runtime detection - setting information retrieve (backdoor.rules, High)
9327 <-> SPECIFIC-THREATS netsky.af smtp propagation detection (specific-threats.rules, High)
9329 <-> SPECIFIC-THREATS yarner.b smtp propagation detection (specific-threats.rules, High)
9330 <-> SPECIFIC-THREATS mydoom.e smtp propagation detection (specific-threats.rules, High)
9331 <-> SPECIFIC-THREATS mydoom.m smtp propagation detection (specific-threats.rules, High)
9332 <-> SPECIFIC-THREATS mimail.a smtp propagation detection (specific-threats.rules, High)
9333 <-> SPECIFIC-THREATS mimail.e smtp propagation detection (specific-threats.rules, High)
9336 <-> SPECIFIC-THREATS netsky.t smtp propagation detection (specific-threats.rules, High)
9337 <-> SPECIFIC-THREATS netsky.x smtp propagation detection (specific-threats.rules, High)
9338 <-> SPECIFIC-THREATS mydoom.i smtp propagation detection (specific-threats.rules, High)
9339 <-> SPECIFIC-THREATS klez.g web propagation detection (specific-threats.rules, High)
9340 <-> SPECIFIC-THREATS klez.i web propagation detection (specific-threats.rules, High)
9342 <-> SPECIFIC-THREATS paroc.a smtp propagation detection (specific-threats.rules, High)
9345 <-> SPECIFIC-THREATS kipis.a smtp propagation detection (specific-threats.rules, High)
9351 <-> SPECIFIC-THREATS lovgate.a netshare propagation detection (specific-threats.rules, High)
9352 <-> SPECIFIC-THREATS lovgate.a smtp propagation detection (specific-threats.rules, High)
9354 <-> SPECIFIC-THREATS deborm.y netshare propagation detection (specific-threats.rules, High)
9355 <-> SPECIFIC-THREATS deborm.u netshare propagation detection (specific-threats.rules, High)
9361 <-> SPECIFIC-THREATS mimail.l smtp propagation detection (specific-threats.rules, High)
9365 <-> SPECIFIC-THREATS cult.c smtp propagation detection (specific-threats.rules, High)
9366 <-> SPECIFIC-THREATS mimail.s smtp propagation detection (specific-threats.rules, High)
9372 <-> SPECIFIC-THREATS blebla.a smtp propagation detection (specific-threats.rules, High)
9373 <-> SPECIFIC-THREATS clepa smtp propagation detection (specific-threats.rules, High)
9374 <-> SPECIFIC-THREATS creepy.b smtp propagation detection (specific-threats.rules, High)
9375 <-> SPECIFIC-THREATS duksten.c smtp propagation detection (specific-threats.rules, High)
9377 <-> SPECIFIC-THREATS mydoom.g smtp propagation detection (specific-threats.rules, High)
9380 <-> SPECIFIC-THREATS jitux msn messenger propagation detection (specific-threats.rules, High)
9383 <-> SPECIFIC-THREATS netsky.y smtp propagation detection (specific-threats.rules, High)
9386 <-> SPECIFIC-THREATS bagle.f smtp propagation detection (specific-threats.rules, High)
9387 <-> SPECIFIC-THREATS klez.j web propagation detection (specific-threats.rules, High)
9389 <-> SPECIFIC-THREATS bagle.i smtp propagation detection (specific-threats.rules, High)
9390 <-> SPECIFIC-THREATS deborm.d netshare propagation detection (specific-threats.rules, High)
9392 <-> SPECIFIC-THREATS bagle.j smtp propagation detection (specific-threats.rules, High)
9393 <-> SPECIFIC-THREATS bagle.k smtp propagation detection (specific-threats.rules, High)
9397 <-> SPECIFIC-THREATS neysid smtp propagation detection (specific-threats.rules, High)
9400 <-> SPECIFIC-THREATS abotus smtp propagation detection (specific-threats.rules, High)
9403 <-> SPECIFIC-THREATS netsky.aa smtp propagation detection (specific-threats.rules, High)
9404 <-> SPECIFIC-THREATS netsky.ac smtp propagation detection (specific-threats.rules, High)
9405 <-> SPECIFIC-THREATS netsky.af smtp propagation detection (specific-threats.rules, High)
9407 <-> SPECIFIC-THREATS lovgate.b netshare propagation detection (specific-threats.rules, High)
9408 <-> SPECIFIC-THREATS lacrow smtp propagation detection (specific-threats.rules, High)
9413 <-> SPECIFIC-THREATS ganda smtp propagation detection (specific-threats.rules, High)
9417 <-> SPECIFIC-THREATS bagle.a smtp propagation detection (specific-threats.rules, High)
9418 <-> BOTNET-CNC bagle.a http notification detection (botnet-cnc.rules, High)
9425 <-> SPECIFIC-THREATS netsky attachment (specific-threats.rules, High)
9622 <-> DOS Spiffit UDP denial of service attempt (dos.rules, Medium)
9644 <-> SPYWARE-PUT Adware imnames runtime detection (spyware-put.rules, Low)
9648 <-> SPYWARE-PUT Keylogger emailspypro runtime detection (spyware-put.rules, Medium)
9650 <-> SPYWARE-PUT Keylogger ghost Keylogger runtime detection (spyware-put.rules, Medium)
9652 <-> SPYWARE-PUT Hijacker oemji bar runtime detection (spyware-put.rules, Low)
9655 <-> BACKDOOR apofis 1.0 runtime detection - remote controlling (backdoor.rules, High)
9657 <-> BACKDOOR bersek 1.0 runtime detection - init connection (backdoor.rules, High)
9663 <-> BACKDOOR bersek 1.0 runtime detection - start remote shell (backdoor.rules, High)
9667 <-> BACKDOOR superra runtime detection - issue remote control command (backdoor.rules, High)
9827 <-> SPYWARE-PUT Keylogger paq keylog runtime detection - smtp (spyware-put.rules, Medium)
9829 <-> SPYWARE-PUT Trackware relevantknowledge runtime detection (spyware-put.rules, Medium)
9830 <-> SPYWARE-PUT Keylogger supreme spy runtime detection (spyware-put.rules, Medium)
9839 <-> BACKDOOR sun shadow 1.70 runtime detection - keep alive (backdoor.rules, High)
10088 <-> SPYWARE-PUT Keylogger beyond Keylogger runtime detection - log sent by smtp (spyware-put.rules, Medium)
10091 <-> SPYWARE-PUT Hacker-Tool spylply.a runtime detection (spyware-put.rules, Low)
10092 <-> SPYWARE-PUT Trackware russian searchbar runtime detection (spyware-put.rules, Medium)
10094 <-> SPYWARE-PUT Adware borlan runtime detection (spyware-put.rules, Low)
10095 <-> SPYWARE-PUT Trackware bydou runtime detection (spyware-put.rules, Medium)
10096 <-> SPYWARE-PUT Keylogger win32.remotekeylog.b runtime detection - keylog (spyware-put.rules, Medium)
10107 <-> BACKDOOR icmp cmd 1.0 runtime detection - pslist (backdoor.rules, High)
10108 <-> BACKDOOR icmp cmd 1.0 runtime detection - pskill (backdoor.rules, High)
10113 <-> BOTNET-CNC Trojan Peacomm command and control propagation detected (botnet-cnc.rules, High)
10114 <-> BOTNET-CNC Trojan Peacomm command and control propagation detected (botnet-cnc.rules, High)
10123 <-> SPECIFIC-THREATS PA168 chipset based IP phone default password attempt (specific-threats.rules, High)
10124 <-> SPECIFIC-THREATS PA168 chipset based IP phone authentication bypass (specific-threats.rules, High)
10164 <-> SPYWARE-PUT Adware adclicker-ej runtime detection (spyware-put.rules, Low)
10166 <-> SPYWARE-PUT Trackware baigoo runtime detection (spyware-put.rules, Medium)
10168 <-> BACKDOOR one runtime detection (backdoor.rules, High)
10169 <-> BACKDOOR matrix 1.03 by mtronic runtime detection - init connection (backdoor.rules, High)
10179 <-> SPYWARE-PUT Trackware bysoo runtime detection (spyware-put.rules, Medium)
10180 <-> SPYWARE-PUT Adware eqiso runtime detection (spyware-put.rules, Low)
10181 <-> SPYWARE-PUT Keylogger systemsleuth runtime detection (spyware-put.rules, Medium)
10182 <-> SPYWARE-PUT Adware newweb runtime detection (spyware-put.rules, Low)
10183 <-> SPYWARE-PUT Keylogger activity Keylogger runtime detection (spyware-put.rules, Medium)
10184 <-> BACKDOOR wow 23 runtime detection (backdoor.rules, High)
10185 <-> BACKDOOR x-door runtime detection (backdoor.rules, High)
10407 <-> EXPLOIT RealNetworks Helix Server LoadTestPassword buffer overflow attempt (exploit.rules, High)
10438 <-> SPYWARE-PUT Hijacker bazookabar runtime detection (spyware-put.rules, Low)
10440 <-> SPYWARE-PUT Keylogger pc black box runtime detection (spyware-put.rules, Medium)
10441 <-> SPYWARE-PUT Hacker-Tool statwin runtime detection (spyware-put.rules, Low)
10443 <-> BACKDOOR acidbattery 1.0 runtime detection - sniff info (backdoor.rules, High)
10446 <-> BACKDOOR acidbattery 1.0 runtime detection - get server info (backdoor.rules, High)
10447 <-> BACKDOOR 51d 1b runtime detection - icq notification (backdoor.rules, High)
10451 <-> BACKDOOR only 1 rat runtime detection - control command (backdoor.rules, High)
10452 <-> BACKDOOR only 1 rat runtime detection - icmp request (backdoor.rules, High)
11306 <-> SPYWARE-PUT Snoopware childwebguardian runtime detection - udp broadcast (spyware-put.rules, Medium)
11307 <-> SPYWARE-PUT Keylogger computer monitor Keylogger runtime detection (spyware-put.rules, Medium)
11311 <-> SPYWARE-PUT Keylogger pcsentinelsoftware Keylogger runtime detection - upload infor (spyware-put.rules, Medium)
11312 <-> SPYWARE-PUT Trackware uplink runtime detection (spyware-put.rules, Medium)
11315 <-> DELETED BACKDOOR ykw v375 runtime detection (deleted.rules, High)
11317 <-> BACKDOOR abremote pro 3.1 runtime detection - init connection (backdoor.rules, High)
11817 <-> WEB-CGI WhatsUpGold configuration access (web-cgi.rules, Medium)
11948 <-> SPYWARE-PUT Hijacker snap toolbar runtime detection - cookie (spyware-put.rules, Low)
11950 <-> BACKDOOR killav_gj (backdoor.rules, High)
11951 <-> BACKDOOR winshadow runtime detection - init connection request (backdoor.rules, High)
11952 <-> BACKDOOR winshadow runtime detection - udp response (backdoor.rules, High)
11954 <-> BACKDOOR supervisor plus runtime detection (backdoor.rules, High)
12002 <-> VOIP-SIP BYE flood (voip.rules, Medium)
12003 <-> VOIP-SIP CANCEL flood (voip.rules, Medium)
12004 <-> VOIP-SIP INVITE message invalid Content-Length size of zero (voip.rules, Medium)
12052 <-> BACKDOOR the[x] 1.2 runtime detection - execute command (backdoor.rules, High)
12073 <-> VOIP-SIP inbound 100 Trying message (voip.rules, Low)
12074 <-> VOIP-SIP outbound 100 Trying message (voip.rules, Low)
12121 <-> SPYWARE-PUT Adware pprich runtime detection - udp info sent out (spyware-put.rules, Low)
12122 <-> SPYWARE-PUT Trackware spynova runtime detection (spyware-put.rules, Medium)
12126 <-> SPYWARE-PUT Trackware lookster toolbar runtime detection - collect user information (spyware-put.rules, Medium)
12127 <-> SPYWARE-PUT Trackware lookster toolbar runtime detection - ads (spyware-put.rules, Medium)
12132 <-> SPYWARE-PUT Keylogger remotekeylog.b runtime detection - keylogging (spyware-put.rules, Medium)
12134 <-> SPYWARE-PUT Keylogger remotekeylog.b runtime detection - open url (spyware-put.rules, Medium)
12137 <-> SPYWARE-PUT Keylogger Keylogger king home 2.3 runtime detection (spyware-put.rules, Medium)
12138 <-> SPYWARE-PUT Adware zamingo runtime detection (spyware-put.rules, Low)
12149 <-> BACKDOOR back orifice 2006 - v1.1.5 runtime detection - init connection (backdoor.rules, High)
12151 <-> BACKDOOR cafeini 1.0 runtime detection (backdoor.rules, High)
12159 <-> BACKDOOR optix pro v1.32 runtime detection - keylogging (backdoor.rules, High)
12162 <-> BACKDOOR optix pro v1.32 runtime detection - screen capturing (backdoor.rules, High)
12224 <-> SPYWARE-PUT Adware enbrowser snackman runtime detection (spyware-put.rules, Low)
12228 <-> SPYWARE-PUT Trackware snap ultrasearch/desktop toolbar runtime detection - cookie (spyware-put.rules, Medium)
12291 <-> SPYWARE-PUT Trackware vmn toolbar runtime detection (spyware-put.rules, Medium)
12294 <-> SPYWARE-PUT Hijacker 3search runtime detection - counter (spyware-put.rules, Low)
12295 <-> SPYWARE-PUT Hijacker 3search runtime detection - hijacking (spyware-put.rules, Low)
12365 <-> SPYWARE-PUT Hijacker proventactics 3.5 runtime detection - redirect searches (spyware-put.rules, Low)
12366 <-> SPYWARE-PUT Hijacker proventactics 3.5 runtime detection - toolbar search function (spyware-put.rules, Low)
12367 <-> SPYWARE-PUT Hijacker imesh mediabar runtime detection - hijack ie searches (spyware-put.rules, Low)
12368 <-> SPYWARE-PUT Hijacker imesh mediabar runtime detection - hijack ie side search (spyware-put.rules, Low)
12369 <-> SPYWARE-PUT Hijacker imesh mediabar runtime detection - collect user information (spyware-put.rules, Low)
12371 <-> SPYWARE-PUT Hijacker sbu hotbar 4.8.4 runtime detection - user-agent string (spyware-put.rules, Low)
12378 <-> BACKDOOR shark 2.3.2 runtime detection (backdoor.rules, High)
12481 <-> SPYWARE-PUT Hijacker 411web toolbar runtime detection (spyware-put.rules, Low)
12482 <-> SPYWARE-PUT Trickler pseudorat 0.1b runtime detection (spyware-put.rules, Low)
12485 <-> SPYWARE-PUT Adware instant buzz runtime detection - random text ads (spyware-put.rules, Low)
12486 <-> SPYWARE-PUT Hijacker soso toolbar runtime detection - get weather information (spyware-put.rules, Low)
12487 <-> SPYWARE-PUT Hijacker soso toolbar runtime detection - hijack ie auto searches / soso toolbar searches requests (spyware-put.rules, Low)
12661 <-> BACKDOOR troll.a runtime detection (backdoor.rules, High)
12674 <-> SPYWARE-PUT Trackware searchmiracle elitebar runtime detection - track activity (spyware-put.rules, Medium)
12679 <-> SPYWARE-PUT Trackware myway speedbar / mywebsearch toolbar user-agent detection (spyware-put.rules, Medium)
12693 <-> SPYWARE-PUT Hijacker personalweb runtime detection (spyware-put.rules, Low)
12697 <-> SPYWARE-PUT Trackware browser accelerator runtime detection - pass user information to server (spyware-put.rules, Medium)
12698 <-> SPYWARE-PUT Keylogger net vizo 5.2 runtime detection (spyware-put.rules, Medium)
12700 <-> BACKDOOR poison ivy 2.3.0 runtime detection - init connection (backdoor.rules, High)
12702 <-> DELETED BACKDOOR poison ivy 2.3.0 runtime detection - server connection (deleted.rules, High)
12720 <-> SPYWARE-PUT Adware pestbot runtime detection - update (spyware-put.rules, Low)
12721 <-> SPYWARE-PUT Adware pestbot runtime detection - purchase (spyware-put.rules, Low)
12727 <-> BACKDOOR bandook 1.35 runtime detection (backdoor.rules, High)
12759 <-> SPYWARE-PUT Keylogger/RAT digi watcher 2.32 runtime detection (spyware-put.rules, Medium)
12761 <-> SPYWARE-PUT Keylogger powered Keylogger 2.2 runtime detection (spyware-put.rules, Medium)
12791 <-> SPYWARE-PUT Adware gophoria toolbar runtime detection (spyware-put.rules, Low)
12793 <-> SPYWARE-PUT Keylogger spy lantern Keylogger pro 6.0 runtime detection (spyware-put.rules, Medium)
12794 <-> SPYWARE-PUT Hijacker gralicwrap runtime detection - search frauddb process (spyware-put.rules, Low)
12795 <-> SPYWARE-PUT Hijacker gralicwrap runtime detection - display frauddb information (spyware-put.rules, Low)
13242 <-> SPYWARE-PUT Adware netpumper 1.26 runtime detection (spyware-put.rules, Low)
13282 <-> SPYWARE-PUT Adware jily ie toolbar runtime detection (spyware-put.rules, Low)
13285 <-> SPYWARE-PUT Hijacker phazebar runtime detection (spyware-put.rules, Low)
13341 <-> SPYWARE-PUT Hijacker search4top runtime detection - popup ads (spyware-put.rules, Low)
13343 <-> SPYWARE-PUT Adware 2005-search loader runtime detection (spyware-put.rules, Low)
13489 <-> SPYWARE-PUT Hijacker people pal toolbar runtime detection - traffic for searching (spyware-put.rules, Low)
13497 <-> SPYWARE-PUT Hijacker ez-tracks toolbar runtime detection - tracking traffic (spyware-put.rules, Low)
13499 <-> SPYWARE-PUT Hijacker hbtbar runtime detection - search traffic 2 (spyware-put.rules, Low)
13503 <-> SPYWARE-PUT Hijacker dealio toolbar runtime detection user-agent detected (spyware-put.rules, Low)
13507 <-> BACKDOOR evilotus 1.3.2 runtime detection - init connection (backdoor.rules, High)
13509 <-> BACKDOOR xploit 1.4.5 pc runtime detection (backdoor.rules, High)
13558 <-> SPYWARE-PUT Hijacker kword interkey runtime detection - log user info (spyware-put.rules, Low)
13568 <-> SPYWARE-PUT Keylogger sys keylog 1.3 advanced runtime detection (spyware-put.rules, Medium)
13648 <-> SPYWARE-PUT Hijacker mysearch bar 2.0.2.28 runtime detection (spyware-put.rules, Low)
13651 <-> SPYWARE-PUT Keylogger family cyber alert runtime detection - smtp traffic for recorded activities (spyware-put.rules, Medium)
13652 <-> SPYWARE-PUT Keylogger all in one Keylogger runtime detection (spyware-put.rules, Medium)
13653 <-> SPYWARE-PUT Adware cashfiesta adbar runtime detection - updates traffic (spyware-put.rules, Low)
13655 <-> BACKDOOR nuclear rat 2.1 runtime detection - init connection (backdoor.rules, High)
13810 <-> SPYWARE-PUT Trickler Adware.Win32.Ejik runtime detection - udp payload (spyware-put.rules, Low)
13812 <-> SPYWARE-PUT Keylogger refog Keylogger runtime detection (spyware-put.rules, Medium)
13813 <-> SPYWARE-PUT Trickler mm.exe runtime detection (spyware-put.rules, Low)
13849 <-> SPYWARE-PUT Hijacker rcse 4.4 runtime detection - hijack ie browser (spyware-put.rules, Low)
13852 <-> SPYWARE-PUT Hijacker bitroll 5.0 runtime detection (spyware-put.rules, Low)
13855 <-> SPYWARE-PUT Trackware speed runner runtime detection (spyware-put.rules, Medium)
13856 <-> BACKDOOR wintrim.z runtime detection (backdoor.rules, High)
13867 <-> SPYWARE-PUT Trackware adclicker-fc.gen.a runtime detection (spyware-put.rules, Medium)
13876 <-> BACKDOOR zlob.acc runtime detection (backdoor.rules, High)
13940 <-> SPYWARE-PUT Hijacker win32.bho.bgf runtime detection (spyware-put.rules, Low)
13941 <-> BACKDOOR trojan agent.nac runtime detection - click fraud (backdoor.rules, High)
13942 <-> BACKDOOR trojan agent.nac runtime detection - call home (backdoor.rules, High)
14055 <-> SPYWARE-PUT Hijacker rediff toolbar runtime detection - hijack ie auto search (spyware-put.rules, Low)
14057 <-> SPYWARE-PUT Trackware murzilka2 runtime detection (spyware-put.rules, Medium)
14065 <-> SPYWARE-PUT Keylogger emptybase j runtime detection (spyware-put.rules, Medium)
14066 <-> SPYWARE-PUT Adware winsecuredisc runtime detection (spyware-put.rules, Low)
14085 <-> BACKDOOR infostealer.banker.c runtime detection - collect user info (backdoor.rules, High)
14086 <-> BACKDOOR Adware.Win32.Agent.BM runtime detection 1 (backdoor.rules, High)
14087 <-> BACKDOOR Adware.Win32.Agent.BM runtime detection 2 (backdoor.rules, High)
15071 <-> SCADA Modbus exception returned (scada.rules, Low)
15072 <-> SCADA Modbus invalid protocol version (scada.rules, Low)
15073 <-> SCADA Modbus oversized payload (scada.rules, Low)
15074 <-> SCADA Modbus user-defined function code - 65 to 72 (scada.rules, Low)
15075 <-> SCADA Modbus user-defined function code - 100 to 110 (scada.rules, Low)
15076 <-> SCADA Modbus write multiple coils - too many outputs (scada.rules, Low)
15077 <-> SCADA Modbus read multiple coils - too many inputs (scada.rules, Low)
15292 <-> CHAT QQ protocol detected - version 2006 (chat.rules, High)
15293 <-> CHAT QQ protocol detected - version 2008 (chat.rules, High)
15423 <-> BOTNET-CNC Clampi virus communication detected (botnet-cnc.rules, High)
15425 <-> WEB-PHP phpBB mod tag board sql injection attempt (web-php.rules, High)
15486 <-> DELETED BACKDOOR Kraken command and control server search attempt (deleted.rules, High)
15577 <-> CHAT MSN Messenger web client activity (chat.rules, High)
15578 <-> SPECIFIC-THREATS Slowloris http DoS tool (specific-threats.rules, Medium)
15712 <-> SCADA DNP3 declared length too small (scada.rules, Low)
15713 <-> SCADA DNP3 device trouble (scada.rules, Low)
15714 <-> SCADA DNP3 corrupt configuration (scada.rules, Low)
15715 <-> SCADA DNP3 event buffer overflow error (scada.rules, Low)
15716 <-> SCADA DNP3 parameter error (scada.rules, Low)
15717 <-> SCADA DNP3 unknown object error (scada.rules, Low)
15718 <-> SCADA DNP3 unsupported function code error (scada.rules, Low)
15719 <-> SCADA DNP3 link service not supported (scada.rules, Low)
15720 <-> SCADA DNP3 reserved source address (scada.rules, Low)
15721 <-> SCADA DNP3 reserved destination address (scada.rules, Low)
16058 <-> SPECIFIC-THREATS Samba WINS Server Name Registration handling stack buffer overflow attempt (specific-threats.rules, High)
16092 <-> BACKDOOR win32.delf.jwh runtime detection (backdoor.rules, High)
16095 <-> BACKDOOR td.exe runtime detection - getfile (backdoor.rules, High)
16096 <-> BACKDOOR td.exe runtime detection - download (backdoor.rules, High)
16105 <-> BACKDOOR trojan.zlob runtime detection - topqualityads (backdoor.rules, High)
16116 <-> SPYWARE-PUT Trackware rightonadz.biz adrotator runtime detection - pass user info to remote server (spyware-put.rules, Medium)
16117 <-> SPYWARE-PUT Trackware rightonadz.biz adrotator runtime detection - ads (spyware-put.rules, Medium)
16121 <-> SPYWARE-PUT Hijacker weatherstudio runtime detection (spyware-put.rules, Low)
16271 <-> BACKDOOR srat 1.6 runtime detection (backdoor.rules, High)
17410 <-> WEB-MISC Generic HyperLink buffer overflow attempt (web-misc.rules, High)
17531 <-> SPECIFIC-THREATS Apple Quicktime MOV file JVTCompEncodeFrame heap overflow attempt (specific-threats.rules, High)
17537 <-> SPECIFIC-THREATS Microsoft Excel unspecified memory corruption attempt (specific-threats.rules, High)
17538 <-> SPECIFIC-THREATS Microsoft Excel unspecified memory corruption attempt (specific-threats.rules, High)
17539 <-> SPECIFIC-THREATS Microsoft Excel unspecified memory corruption attempt (specific-threats.rules, High)
18462 <-> SPECIFIC-THREATS Microsoft Windows 2003 browser election remote heap overflow attempt (specific-threats.rules, High)