시그니처 리스트, Signature List
번호날짜ID시그니처 (Total Ruleset: 27,111개)
10,2612015/01/20 2012929  ET ACTIVEX Cisco AnyConnect VPN Secure Mobility Client Arbitrary Program Execution Attempt; [1
10,2602015/01/20 2012928  ET DELETED DYNAMIC_DNS HTTP Request to a *.dyndns-*.com domain;  
10,2592015/01/20 2012927  ET DELETED DYNAMIC_DNS HTTP Request to a *.dyndns.* domain;  
10,2582015/01/20 2012926  ET WEB_SERVER Apache APR apr_fnmatch Stack Overflow Denial of Service; [1,2
10,2572015/01/20 2012925  ET SHELLCODE Javascript Split String Unicode Heap Spray Attempt;  
10,2562015/01/20 2012924  ET MOBILE_MALWARE Android/Smspacem CnC Communication Attempt; [1
10,2552015/01/20 2012923  ET TROJAN Possible TDSS Base64 Encoded Command 3;  
10,2542015/01/20 2012922  ET TROJAN Possible TDSS Base64 Encoded Command 2;  
10,2532015/01/20 2012921  ET TROJAN Possible TDSS Base64 Encoded Command 1;  
10,2522015/01/20 2012919  ET WEB_SPECIFIC_APPS Nagios Expand Parameter XSS Attempt;  
10,2512015/01/20 2012918  ET TROJAN Possible TDSS Trojan GET with xxxx_ string;  
10,2502015/01/20 2012917  ET POLICY URL Contains pword Parameter;  
10,2492015/01/20 2012916  ET POLICY URL Contains passphrase Parameter;  
10,2482015/01/20 2012915  ET POLICY URL Contains pw Parameter;  
10,2472015/01/20 2012914  ET POLICY URL Contains pwd Parameter;  
10,2462015/01/20 2012913  ET POLICY URL Contains pass Parameter;  
10,2452015/01/20 2012912  ET POLICY URL Contains passwd Parameter;  
10,2442015/01/20 2012911  ET POLICY URL Contains password Parameter;  
10,2432015/01/20 2012910  ET DELETED CPL Trojan Downloader Request;  
10,2422015/01/20 2012909  ET USER_AGENTS Suspicious User-Agent Fragment (WORKED);  
10,2412015/01/20 2012908  ET TROJAN Backdoor Win32/Begman.A Checkin; [1,2,3,4
10,2402015/01/20 2012907  ET WEB_CLIENT Download of PDF With Compressed Flash Content; [1,2
10,2392015/01/20 2012906  ET WEB_CLIENT Download of PDF With Uncompressed Flash Content flowbit set; [1,2
10,2382015/01/20 2012905  ET ACTIVEX Magneto ICMP ActiveX ICMPSendEchoRequest Remote Code Execution Attempt; [1
10,2372015/01/20 2012904  ET MOBILE_MALWARE SymbOS/SuperFairy.D Bookmarked Connection to Server; [1
10,2362015/01/20 2012903  ET DNS DNS Query for a Suspicious *.qc.cx domain;  
10,2352015/01/20 2012902  ET DNS DNS Query for a Suspicious *.be.ma domain;  
10,2342015/01/20 2012901  ET DNS DNS Query for a Suspicious *.noc.su domain;  
10,2332015/01/20 2012900  ET DNS DNS Query for a Suspicious *.ae.am domain;  
10,2322015/01/20 2012899  ET POLICY HTTP Request to a *.qc.cx domain;  
10,2312015/01/20 2012898  ET POLICY HTTP Request to a *.be.ma domain;  
10,2302015/01/20 2012897  ET POLICY HTTP Request to a *.noc.su domain;  
10,2292015/01/20 2012896  ET POLICY HTTP Request to a *.ae.am domain;  
10,2282015/01/20 2012895  ET TROJAN Dropper.Win32.Agent.ahju Checkin; [1,2
10,2272015/01/20 2012894  ET TROJAN Dropper.Win32.Agent.bpxo Checkin; [1,2
10,2262015/01/20 2012893  ET USER_AGENTS Known Skunkx DDOS Bot User-Agent Cyberdog; [1
10,2252015/01/20 2012892  ET TROJAN JKDDOS Bot CnC Phone Home Message; [1,2
10,2242015/01/20 2012891  ET POLICY Http Client Body contains pword= in cleartext;  
10,2232015/01/20 2012890  ET POLICY Http Client Body contains passphrase= in cleartext;  
10,2222015/01/20 2012889  ET POLICY Http Client Body contains pw= in cleartext;  
10,2212015/01/20 2012888  ET POLICY Http Client Body contains pwd= in cleartext;  
10,2202015/01/20 2012887  ET POLICY Http Client Body contains pass= in cleartext;  
10,2192015/01/20 2012886  ET POLICY Http Client Body contains passwd= in cleartext;  
10,2182015/01/20 2012885  ET POLICY Http Client Body contains password= in cleartext;  
10,2172015/01/20 2012884  ET CURRENT_EVENTS Java Exploit Attempt applet via file URI param; [1
10,2162015/01/20 2012883  ET DELETED MALVERTISING Malicious Advertizing URL in.cgi;  
10,2152015/01/20 2012882  ET TROJAN Backdoor.Win32.Poison.AU checkin; [1
10,2142015/01/20 2012881  ET WEB_SPECIFIC_APPS e107 permLink Parameter Remote File inclusion Attempt; [1
10,2132015/01/20 2012880  ET WEB_SPECIFIC_APPS e107 trackback_url Parameter Remote File inclusion Attempt; [1
10,2122015/01/20 2012879  ET WEB_SPECIFIC_APPS e107 imgp Parameter Remote File inclusion Attempt; [1
< 331  332  333  334  335  336  337  338  339  340 >
GigaVPN & GigaIPS is based MikroTik, Suricata and EmergingThreats.
Copyright ⓒ 2010 . All Rights Reserved.