#--------------------------------------------------
#   http://www.snort.org     Snort 1.7.0 Ruleset
#      Current Database Updated -- 03/15/2001
#  Contact:  Jim Forster - jforster@rapidnet.com
#--------------------------------------------------
# NOTE:This ruleset only works for 1.7.0 and later
#--------------------------------------------------
###################################################
# This file contains a sample snort configuration. 
# You can take the following steps to create your 
# own custom configuration:
#
#  1) Set the network variables for your network
#  2) Configure preprocessors
#  3) Configure output plugins
#  4) Customize your rule set
#
###################################################
# Step #1: Set the network variables:
#
# You must change the following variables to reflect
# your local network. The variable is currently 
# setup for an RFC 1918 address space.
#
# You can specify it explicitly as: 
# var HOME_NET 10.1.1.0/24
# or use global variable $<intname>_ADDRESS which
# will be always initialized to IP address and 
# netmask of the network interface which you run
# snort at.
#
# You can specify lists of IP addresses for HOME_NET
# by separating the IPs with commas like this:
#
# [10.1.1.0/24,192.168.1.0/24]
#
# MAKE SURE YOU DON'T PLACE ANY SPACES IN YOUR LIST!
#
#
#var HOME_NET $eth0_ADDRESS

var HOME_NET 10.1.1.0/24

# Set up the external network addresses as well.  
# A good start may be "any"...

var EXTERNAL_NET !$HOME_NET

# Set up your SMTP servers, or simply configure them 
# to HOME_NET 

var SMTP $HOME_NET

# Set up your web servers, or simply configure them 
# to HOME_NET
var HTTP_SERVERS $HOME_NET
 
# Set up your SQL servers, or simply configure them
# to HOME_NET
var SQL_SERVERS $HOME_NET

# Define the addresses of DNS servers and other hosts 
# if you want to ignore portscan false alarms from them...

#var DNS_SERVERS [192.168.1.1/32,10.1.1.1/32]

###################################################
# Step #2: Configure preprocessors
#
# General configuration for preprocessors is of 
# the form
# preprocessor <name_of_processor>: <configuration_options>

# minfrag: detect small fragments
# -------------------------------
# minfrag takes the minimum fragment size (in bytes)
# threshold as its argument. Fragmented packets at of
# below this size will cause an alert to be generated.
# The functionality of this preprocessor is largely
# superceded by the defrag plugin below.

#preprocessor minfrag: 128

# defrag: defragmentation support
# -------------------------------
# IP defragmentation support from Dragos Ruiu. There
# are no configuration options at this time.

preprocessor defrag

# stream: TCP stream reassembly
# -----------------------------
# TCP stream reassembly preprocessor from Chris Cramer.  
# This preprocessor should always go after the defrag 
# preprocessor, but before http_decode. The example 
# below monitors ports 23 and 80, has a timeout after
# 10 seconds, and will send reassembled packets of max
# payload 16384 bytes through the detection engine. See
# README.tcpstream for more information and configuration
# options. Uncomment the following line and configure 
# appropriately to enable this preprocessor.
#
# NOTE: This code should still be considered BETA!
# It seems to be stable, but there are still some
# issues that remain to be resolved, so make sure you
# keep an eye on your Snort sensor if you enable this plugin

# preprocessor stream: timeout 10, ports 21 23 80, maxbytes 16384

# http_decode: normalize HTTP requests
# ------------------------------------
# http_decode normalizes HTTP requests from remote 
# machines by converting any %XX character 
# substitutions to their ASCII equivalent. This is
# very useful for doing things like defeating hostile
# attackers trying to stealth themselves from IDSs by
# mixing these substitutions in with the request. 
# Specify the port numbers you want it to analyze as arguments.

preprocessor http_decode: 80 8080

# portscan: detect a variety of portscans
# ---------------------------------------
# portscan preprocessor by Patrick Mullen <p_mullen@linuxrc.net>
# This preprocessor detects UDP packets or TCP SYN packets going to
# four different ports in less than three seconds. "Stealth" TCP
# packets are always detected, regardless of these settings.

preprocessor portscan: $HOME_NET 4 3 portscan.log

# Use portscan-ignorehosts to ignore TCP SYN and UDP "scans" from
# specific networks or hosts to reduce false alerts. It is typical
# to see many false alerts from DNS servers so you may want to
# add your DNS servers here. You can all multiple hosts/networks
# in a whitespace-delimited list.
#
#preprocessor portscan-ignorehosts: $DNS_SERVERS

# Spade: the Statistical Packet Anomaly Detection Engine
#-------------------------------------------------------
#
# READ the README.Spade file before using this plugin!
#
# See http://www.silicondefense.com/spice/ for more info
#
# Spade is a Snort plugin to report unusual, possibly 
# suspicious, packets. Spade will review the packets 
# received by Snort, find those of interest (TCP SYNs 
# into your homenets, if any), and report those packets
# that it believes are anomalous along with an anomaly 
# score.  To enable spp_anomsensor, you must have a
# line of this form in your snort configuration file:
#
# preprocessor spade: <anom-report-thresh> <state-file>
# <log-file> <prob-mode> <checkpoint-freq>
#
# DO NOT ENABLE THIS PLUGIN UNLESS YOU HAVE READ THE 
# README.Spade FILE THAT COMES IN THIS DISTRIBUTION AND
# ARE COGENT OF THE PERFORMANCE IMPACT THAT THIS MODULE
# MAY HAVE UPON YOUR NORMAL SNORT CONFIGURATION!
#
# set this to a directory Spade can read and write to
# store its files
#
# var SPADEDIR .
#
# preprocessor spade: -1 $SPADEDIR/spade.rcv $SPADEDIR/log.txt 3 50000
#
# put a list of the networks you are interested in Spade observing packets
# going to here
#
# preprocessor spade-homenet: 0.0.0.0/0
#
# this causes Spade to adjust the reporting threshold automatically
# the first argument is the target rate of alerts for normal circumstances
# (0.01 = 1% or you can give it an hourly rate) after the first hour (or
# however long the period is set to in the second argument), the reporting
# threshold given above is ignored you can comment this out to have the
# threshold be static, or try one of the other adapt methods below
# preprocessor spade-adapt3: 0.01 60 168
#
# other possible Spade config lines:
# adapt method #1
#preprocessor spade-adapt: 20 2 0.5
# adapt method #2
#preprocessor spade-adapt2: 0.01 15 4 24 7
# offline threshold learning
#preprocessor spade-threshlearn: 200 24
# periodically report on the anom scores and count of packets seen
#preprocessor spade-survey:  $SPADEDIR/survey.txt 60
# print out known stats about packet feature
#preprocessor spade-stats: entropy uncondprob condprob


####################################################################
# Step #3: Configure output plugins
#
# Uncomment and configure the output plugins you decide to use.
# General configuration for output plugins is of the form:
#
# output <name_of_plugin>: <configuration_options>
#
# Note that you can optionally define new rule types and 
# associate one or more output plugins specifically to that type.
#
# This example will create a type that will log to just tcpdump.
# ruletype suspicious
# {
#   type log
#   output log_tcpdump: suspicious.log
# }
#
# This example will create a rule type that will log to syslog
# and a mysql database.
# ruletype redalert
# {
#   type alert
#   output alert_syslog: LOG_AUTH LOG_ALERT
#   output database: log, mysql, user=snort dbname=snort host=localhost
# }

# alert_syslog: log alerts to syslog
# ----------------------------------
# Use one or more syslog facilities as arguments
#
# output alert_syslog: LOG_AUTH LOG_ALERT

# log_tcpdump: log packets in binary tcpdump format
# -------------------------------------------------
# The only argument is the output file name.
#
# output log_tcpdump: snort.log

# database: log to a variety of databases
# ---------------------------------------
# See the README.database file for more information about configuring
# and using this plugin.
#
# output database: log, mysql, user=snort dbname=snort host=localhost
# output database: log, postgresql, user=snort dbname=snort
# output database: log, unixodbc, user=snort dbname=snort

# xml: xml logging
# ----------------
# See the README.xml file for more information about configuring
# and using this plugin.
#
# output xml: log, file=/var/log/snortxml


####################################################################
# Step #4: Customize your rule set
#
# Up to date snort rules are available at the following web sites:
#   http://www.snort.org
#   http://www.whitehats.com
#
# The snort web site has documentation about how to 
# write your own custom snort rules.
#
# The rules included with this distribution generate alerts based on
# on suspicious activity. Depending on your network environment, your
# security policies, and what you consider to be suspicious, some of
# these rules may either generate false positives ore may be detecting
# activity you consider to be acceptable; therefore, you are
# encouraged to comment out rules that are not applicable in your
# environment.
#
# Note that using all of the rules at the same time may lead to
# serious packet loss on slower machines. YMMV, use with caution,
# standard disclaimers apply. :)
#
# The following individuals contributed many of rules in this
# distribution.
#
# Credits:
#   Max Vision <vision@whitehats.com> - www.whitehats.com
#   Ron Gula <rgula@securitywizards.com> of Network Security Wizards
#   Martin Markgraf <martin@mail.du.gtn.com>
#   CyberPsychotic <fygrave@tigerteam.net>
#   Nick Rogness <nick@rapidnet.com>
#   Jim Forster <jforster@rapidnet.com>
#   Scott McIntyre <scott@whoi.edu>
#   Tom Vandepoel <Tom.Vandepoel@ubizen.com>
#   Brian Caswell <bmc@mitre.org>
#
#===============================================
# Include all relevant rulesets here 
# by default virus, policy and info are disabled
#===============================================
# Be sure you have created a local.rules file
# for your includes/ignores, etc.
#===============================================
include local.rules
include exploit.rules
include scan.rules
include finger.rules
include ftp.rules
include telnet.rules
include smtp.rules
include rpc.rules
include rservices.rules
include backdoor.rules
include dos.rules
include ddos.rules
include dns.rules
include netbios.rules
include sql.rules
include web-cgi.rules
include web-coldfusion.rules
include web-frontpage.rules
include web-misc.rules
include web-iis.rules
include icmp.rules
include misc.rules
#include policy.rules
#include info.rules
#include virus.rules

# BACKDOOR RULES
# Updated 03/15/2001
# ------------------

alert tcp $EXTERNAL_NET 27374 -> $HOME_NET any (msg: "BACKDOOR SIG - SubSseven 22"; flags: A+; content: "|0d0a5b52504c5d3030320d0a|"; reference:arachnids,485;) 
alert tcp $EXTERNAL_NET 1024: -> $HOME_NET 2589 (msg: "BACKDOOR - Dagger_1.4.0_client_connect"; flags: A+; content: "|0b 00 00 00 07 00 00 00|Connect"; depth: 16; reference:arachnids,483;) 
alert tcp $HOME_NET 2589 -> $EXTERNAL_NET 1024: (msg: "BACKDOOR - Dagger_1.4.0"; flags: A+; content: "|3200000006000000|Drives|2400|"; depth: 16; reference:arachnids,484;) 
alert tcp $EXTERNAL_NET 80 -> $HOME_NET 1054 (msg:"BACKDOOR ACKcmdC trojan scan"; seq: 101058054; ack: 101058054; flags: A;reference:arachnids,445;) 
alert tcp $EXTERNAL_NET 16959 -> any any (msg:"BACKDOOR subseven DEFCON8 2.1 access"; content: "PWD"; content:"acidphreak"; nocase; flags: A+;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 7597 (msg:"BACKDOOR QAZ Worm Client Login access"; flags: A+; content:"|71 61 7a 77 73 78 2e 68 73 71|";) 
alert udp $EXTERNAL_NET 4120 -> $HOME_NET any (msg:"BACKDOOR DeepThroat access"; content: "--Ahhhhhhhhhh"; reference:arachnids,405;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 31337 (msg:"BACKDOOR BackOrifice access"; content: "|ce63 d1d2 16e7 13cf 39a5 a586|";  reference:arachnids,399;) 
alert tcp $HOME_NET 80 -> $EXTERNAL_NET any (msg:"BACKDOOR BackOrifice access"; flags: A+; content: "server|3a| BO|2f|"; reference:arachnids,400;) 
alert tcp $HOME_NET 12345,12346 -> $EXTERNAL_NET any (msg:"BACKDOOR netbus active"; flags: A+; content: "NetBus";  reference:arachnids,401;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 12345,12346 (msg:"BACKDOOR netbus getinfo"; flags: A+; content: "GetInfo|0d|"; reference:arachnids,403;) 
alert tcp $HOME_NET 146 -> $EXTERNAL_NET 1024: (msg:"BACKDOOR Infector.1.x"; content: "WHATISIT"; flags: A+; reference:arachnids,315;) 
alert tcp $HOME_NET 666 -> $EXTERNAL_NET 1024: (msg:"BACKDOOR SatansBackdoor.2.0.Beta"; content: "Remote|3A| You are connected to me."; flags:A+;  reference:arachnids,316;) 
alert tcp $HOME_NET 6789 -> $EXTERNAL_NET any (msg:"BACKDOOR Doly 2.0 access"; content: "|57 74 7a 75 70 20 55 73 65|"; flags: A+; depth: 32;  reference:arachnids,312;) 
alert tcp $HOME_NET 146 -> $EXTERNAL_NET 1000:1300 (msg:"BACKDOOR Infector 1.6 Server to Client"; content:"|57 48 41 54 49 53 49 54|"; flags:A+;) 
alert tcp $EXTERNAL_NET 1000:1300 -> $HOME_NET 146 (msg:"BACKDOOR Infector 1.6 Client to Server Connection Request"; content:"|46 43 20|"; flags:A+;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 FTP Status Client Request"; content:"09"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 System Info Client Request"; content:"13"; reference:arachnids,106;) 
alert udp $HOME_NET 2140 -> $EXTERNAL_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 System Info From Server"; content:"Comp Name"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Drive Info Client Request"; content:"130";  reference:arachnids,106;) 
alert udp $HOME_NET 2140 -> $EXTERNAL_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 Drive Info From Server"; content:"C - ";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Server Status Client Request"; content:"10"; reference:arachnids,106;) 
alert udp $HOME_NET 2140 -> $EXTERNAL_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 Server Status From Server"; content:"Host"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 E-Mail Info Client Request"; content:"12";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 ICQ Alert ON Client Request"; content: "40";  reference:arachnids,106;) 
alert udp $HOME_NET 2140 -> $EXTERNAL_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 E-Mail Info From Server"; content:"Retreaving";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Server FTP Port Change Client Request"; content:"21"; reference:arachnids,106;) 
alert udp $HOME_NET 2140 -> $EXTERNAL_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 Server FTP Port Change From Server"; content:"FTP Server changed to"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Cached Passwords Client Request"; content:"16"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 RAS Passwords Client Request"; content:"17";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Server Password Change Client Request"; content:"91"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Server Password Remove Client Request"; content:"92"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 System Info Client Request"; content:"13"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 3150 (msg:"BACKDOOR DeepThroat 3.1 Server Rehash Client Request"; content:"shutd0wnM0therF***eR"; reference:arachnids,106;) 
alert tcp $HOME_NET 5401:5402 -> $EXTERNAL_NET any (msg:"BACKDOOR BackConstruction 2.1 Connection"; flags: A+; content:"c|3A|\\";) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 ICQ Alert OFF Client Request"; content:"88";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Rehash Client Request"; content:"911";  reference:arachnids,106;) 
alert tcp $HOME_NET 31785 -> $EXTERNAL_NET any (msg:"BACKDOOR HackAttack 1.20 Connect"; flags: A+; content:"host";) 
alert tcp $HOME_NET 21 <- $EXTERNAL_NET any (msg:"BACKDOOR ADMw0rm ftp retrieval";flags: A+; content:"USERw0rm|0D0A|"; reference:arachnids,01;) 
alert tcp $EXTERNAL_NET !80 -> $HOME_NET 21554 (msg:"BACKDOOR GirlFriendaccess"; flags: A+; content:"Girl"; reference:arachnids,98;) 
alert tcp $HOME_NET 30100 -> $EXTERNAL_NET any (msg:"BACKDOOR NetSphere access"; flags: A+; content:"NetSphere"; reference:arachnids,76;) 
alert tcp $HOME_NET 6969 -> $EXTERNAL_NET any (msg:"BACKDOOR GateCrasher"; flags: A+; content:"GateCrasher";reference:arachnids,99;) 
alert udp $HOME_NET 2140 -> $EXTERNAL_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 Keylogger Active on Network"; content:"KeyLogger Is Enabled On port";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 3150 (msg:"BACKDOOR DeepThroat 3.1 Client Sending Data to Server on Network"; content:"|00 23|"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 3150 -> $HOME_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 Server Active on Network"; content:"|00 23|"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Client Sending Data to Server on Network";  reference:arachnids,106;) 
alert tcp $HOME_NET 666 -> $EXTERNAL_NET any (msg:"BACKDOOR BackConstruction 2.1 Server FTP Open Reply"; flags: A+; content:"FTP Port open";) 
alert tcp $HOME_NET 23476 -> $EXTERNAL_NET any (msg:"BACKDOOR DonaldDick 1.53 Traffic"; flags: A+; content:"pINg";) 
alert udp $HOME_NET 3150 -> $EXTERNAL_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 Wrong Password"; content:"Wrong Password"; reference:arachnids,106;) 
alert tcp $HOME_NET 30100:30102 -> $EXTERNAL_NET any (msg:"BACKDOOR NetSphere 1.31.337 access"; flags: A+; content:"NetSphere";  reference:arachnids,76;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Show Picture Client Request"; content:"22"; reference:arachnids,106;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 666 (msg:"BACKDOOR BackConstruction 2.1 Client FTP Open Request"; flags: A+; content:"FTPON";) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Visible Window List Client Request"; content:"37"; reference:arachnids,106;) 
alert tcp $HOME_NET any -> $EXTERNAL_NET 5032 (msg:"BACKDOOR NetMetro File List"; flags: A+; content:"|2D 2D|";  reference:arachnids,79;) 
alert tcp $EXTERNAL_NET 5031 -> $HOME_NET !53:80 (msg:"BACKDOOR NetMetro Incoming Traffic"; flags: A+;  reference:arachnids,79;) 
alert udp $EXTERNAL_NET 3344 -> $HOME_NET 3345 (msg:"BACKDOOR Matrix 2.0 Client connect"; content:"activate"; reference:arachnids,83;) 
alert udp $EXTERNAL_NET 3345 -> $HOME_NET 3344 (msg:"BACKDOOR Matrix 2.0 Server access"; content:"logged in";  reference:arachnids,83;) 
alert tcp $HOME_NET 5714 -> $EXTERNAL_NET any (msg:"BACKDOOR WinCrash 1.0 Server Active" ; flags:SA; content:"|B4 B4|";  reference:arachnids,36;) 
alert udp $EXTERNAL_NET 2140 -> $HOME_NET 60000 (msg:"BACKDOOR DeepThroat 3.1 Server Active on Network"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Keylogger on Server ON"; content:"KeyLogger Is Enabled On port"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Send Text to Window Client Request"; content:"63"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Hide/Show Clock Client Request"; content:"32";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Hide/Show Desktop Client Request"; content:"33";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Swap Mouse Buttons Client Request"; content:"34"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Enable/Disable CTRL-ALT-DEL Client Request"; content:"110";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Freeze Mouse Client Request"; content:"35";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Show Dialog Box Client Request"; content:"70" reference:arachnids,106;;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Show Replyable Dialog Box Client Request"; content:"71"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Hide/Show Start Button Client Request"; content:"31";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Resolution Change Client Request"; content:"125"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Hide/Show Start Button Client Request"; content:"04";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Keylogger on Server OFF"; content:"KeyLogger Shut Down";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Send to URL Client Request"; content:"12"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 FTP Server Port Client Request"; content:"21";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Process List Client request"; content:"64";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Close Port Scan Client Request"; content:"121"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Registry Add Client Request"; content:"89"; reference:arachnids,106;) 
alert icmp 255.255.255.0/24 any -> $HOME_NET any (msg:"BACKDOOR SIGNATURE - Q ICMP"; itype: 0; dsize: >1; reference:arachnids,202;) 
alert tcp 255.255.255.0/24 any -> $HOME_NET any (msg:"BACKDOOR Q access"; flags:A+; dsize: >1;  reference:arachnids,203;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"BACKDOOR CDK"; content: "ypi0ca"; nocase; flags: A+; depth: 15;  reference:arachnids,263;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Monitor on/off Client Request"; content:"07";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Delete File Client Request"; content:"41"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Kill Window Client Request"; content:"38";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Disable Window Client Request"; content:"23";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Enable Window Client Request"; content:"24";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Change Window Title Client Request"; content:"60"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Hide Window Client Request"; content:"26";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Show Window Client Request"; content:"25"; reference:arachnids,106;) 
alert tcp $HOME_NET 555 -> $EXTERNAL_NET any (msg:"BACKDOOR PhaseZero Server Active on Network"; flags: A+; content:"phAse";) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Server Response"; content:"Ahhhh My Mouth Is Open"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Hide/Show Systray Client Request"; content:"30";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Change Wallpaper Client Request"; content:"20"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 All Window List Client Request"; content:"370"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Play Sound Client Request"; content:"36"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Run Program Normal Client Request"; content:"14"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Run Program Hidden Client Request"; content:"15";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Get NET File Client Request"; content:"100";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Find File Client Request"; content:"117";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Find File Client Request"; content:"118";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 HUP Modem Client Request"; content:"199";  reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 CD ROM Open Client Request"; content:"02"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 CD ROM Close Client Request"; content:"03"; reference:arachnids,106;) 
alert udp $EXTERNAL_NET 60000 -> $HOME_NET 2140 (msg:"BACKDOOR DeepThroat 3.1 Create Directory Client Request"; content:"39"; reference:arachnids,106;) 


# DDOS RULES
# Updated: 03/15/2001
# -------------------

alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DDOS TFN Probe"; id: 678; itype: 8; content: "1234";reference:arachnids,443;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DDOS tfn2k icmp possible communication"; itype: 0; icmp_id: 0; content: "AAAAAAAAAA"; reference:arachnids,425;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 31335 (msg:"DDOS Trin00:DaemontoMaster(PONGdetected)"; content:"PONG";reference:arachnids,187;) 
alert icmp 3.3.3.3/32 any -> $EXTERNAL_NET any (msg:"DDOS Stacheldraht server-spoof"; itype: 0; icmp_id: 666; reference:arachnids,193;) 
alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"DDOS Stacheldraht server-response-gag"; content: "|73 69 63 6B 65 6E|"; itype: 0; icmp_id: 669; reference:arachnids,195;) 
alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"DDOS Stacheldraht server-response"; content: "|66 69 63 6B 65 6E|"; itype: 0; icmp_id: 667; reference:arachnids,191;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DDOS Stacheldraht client-spoofworks"; content: "|73 70 6F 6F 66 77 6F 72 6B 73|"; itype: 0; icmp_id: 1000; reference:arachnids,192;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DDOS TFN client command BE"; itype: 0; icmp_id: 456; icmp_seq: 0; reference:arachnids,184;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DDOS Stacheldraht client-check"; content: "|73 6B 69 6C 6C 7A|"; itype: 0; icmp_id: 666; reference:arachnids,190;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 20432 (msg:"DDOS shaft client to handler"; flags: A+; reference:arachnids,254;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 31335 (msg:"DDOS Trin00:DaemontoMaster(messagedetected)"; content:"l44";reference:arachnids,186;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 31335 (msg:"DDOS Trin00:DaemontoMaster(*HELLO*detected)"; content:"*HELLO*"; reference:arachnids,185;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 27665 (msg:"DDOS Trin00:Attacker to Master default startup password";flags: A+; content:"betaalmostdone"; reference:arachnids,197;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 27665 (msg:"DDOS Trin00 Attacker to Master default password";flags: A+; content:"gOrave";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 27665 (msg:"DDOS Trin00 Attacker to Master default mdie password";flags: A+; content:"killme";) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DDOS Stacheldraht client-check-gag"; content: "|67 65 73 75 6E 64 68 65 69 74 21|"; itype: 0; icmp_id: 668; reference:arachnids,194;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 27444 (msg:"DDOS Trin00:MastertoDaemon(defaultpassdetected!)"; content:"l44adsl"; reference:arachnids,197;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DDOS TFN server response"; content: "|73 68 65 6C 6C 20 62 6F 75 6E 64 20 74 6F 20 70 6F 72 74|"; itype: 0; icmp_id: 123; icmp_seq: 0; reference:arachnids,182;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 18753 (msg:"DDOS shaft handler to agent"; content: "alive tijgu";  reference:arachnids,255;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 20433 (msg:"DDOS shaft agent to handler"; content: "alive"; reference:arachnids,256;) 
alert tcp $HOME_NET :1024 -> $EXTERNAL_NET any (msg:"DDOS shaft synflood outgoing"; flags: S; seq: 674711609; reference:arachnids,253;) 
alert tcp $EXTERNAL_NET :1024 -> $HOME_NET any (msg:"DDOS shaft synflood incoming"; flags: S; seq: 674711609; reference:arachnids,252;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 6838 (msg:"DDOS mstream agent to handler"; content: "newserver"; ) 
alert udp $EXTERNAL_NET any -> $HOME_NET 10498 (msg:"DDOS mstream handler to agent"; content: "stream/"; reference:cve,CAN-2000-0138;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 10498 (msg:"DDOS mstream handler ping to agent" ; content: "ping"; reference:cve,CAN-2000-0138;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 10498 (msg:"DDOS mstream agent pong to handler" ; content: "pong";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 12754 (msg:"DDOS mstream client to handler"; content: ">"; flags: A+; reference:cve,CAN-2000-0138;) 
alert tcp $HOME_NET 12754 -> $EXTERNAL_NET any (msg:"DDOS mstream handler to client"; content: ">"; flags: A+;reference:cve,CAN-2000-0138;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 15104 (msg:"DDOS mstream client to handler"; flags: S; reference:arachnids,111; reference:cve,CAN-2000-0138;) 
alert tcp $HOME_NET 15104 -> $EXTERNAL_NET any (msg:"DDOS mstream handler to client"; content: ">"; flags: A+; reference:cve,CAN-2000-0138;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DDOS - TFN client command LE"; itype: 0; icmp_id: 51201; icmp_seq: 0; reference:arachnids,183;) 


# DNS RULES
# Updated: 03/15/2001
# -------------------

alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named iquery attempt"; content: "|0980 0000 0001 0000 0000|"; offset: 2; depth: 16; reference:arachnids,277; reference:cve,CVE-1999-009; reference:bugtraq,134;) 
alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"DNS SPOOF query response PTR with TTL: 1 min. and no authority"; content:"|85800001000100000000|"; content:"|c00c000c00010000003c000f|";) 
alert udp $EXTERNAL_NET 53 -> $HOME_NET any (msg:"DNS SPOOF query response with ttl: 1 min. and no authority"; content:"|81800001000100000000|"; content:"|c00c000100010000003c0004|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS zone transfer"; content: "|FC|"; flags: A+; offset: 13; reference:arachnids,212;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS named version attempt"; content: "|07|version|04|bind"; nocase; offset: 12; depth: 26; reference:arachnids,278;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT named 8.2->8.2.1";flags: A+; content:"../../../../../../../../../"; reference:cve,CVE-1999-0833;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT named overflow";flags: A+; content:"thisissometempspaceforthesockinaddrinyeahyeahiknowthisislamebutanywaywhocareshorizongotitworkingsoalliscool"; reference:cve,CVE-1999-0833;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT named exploit"; flags: A+; content:"ADMROCKS"; reference:cve,CVE-1999-0833;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT named";flags: A+; content:"|CD80 E8D7 FFFF FF|/bin/sh";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT x86 linux";flags: A+; content:"|31c0 b03f 31db b3ff 31c9 cd80 31c0|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT x86 linux generic";flags: A+; content:"|cd80 e8d7 ffff ff|/bin/sh";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT x86 linux";flags: A+; content:"|31 c0 b0 02 cd 80 85 c0 75 4c eb 4c 5e b0|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT x86 linux ADMv2";flags: A+; content:"|89f7 29c7 89f3 89f9 89f2 ac3c fe|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT x86 freebsd";flags: A+; content:"|eb6e 5ec6 069a 31c9 894e 01c6 4605|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS EXPLOIT sparc";flags: A+; content:"|90 1a c0 0f  90 02 20 08 92 02 20 0f d0 23 bf f8|";) 


# DOS RULES
# Updated: 03/15/2001
# -------------------

alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DOS ath"; content:"+++ath"; nocase; itype: 8; reference:arachnids,264;) 
alert tcp $EXTERNAL_NET any <> any any (msg:"DOS NAPTHA"; flags:S; seq: 6060842; id: 413; reference:url,razor.bindview.com/publish/advisories/adv_NAPTHA.html;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 7070 (msg:"DOS Real Audio Server"; flags: A+; content: "|fff4 fffd 06|";reference:arachnids,411;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 7070,8080 (msg:"DOS Real Server template.html"; flags: A+; content:"/viewsource/template.html?"; nocase;reference:bugtraq,1288;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"DOS Bay/Nortel Nautica Marlin"; dsize:0; reference:bugtraq,1009;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DOS ath0"; content: "+++ath0"; nocase; itype: 8; reference:arachnids,264;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 9 (msg:"DOS Ascend Route"; content: "|4e 41 4d 45 4e 41 4d 45|"; offset: 25; depth: 50; reference:cve,CVE-1999-0060; reference:arachnids,262;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 617 (msg:"DOS arkiea backup"; flags: A+; dsize: >1445; reference:arachnids,261;) 


# EXPLOIT RULES
# Updated: 03/15/2001
# -------------------

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT solaris NOOP"; content:"|801c 4011 801c 4011 801c 4011 801c 4011|"; flags:PA; reference:arachnids,353;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"EXPLOIT - Named tsig infoleak"; content: "|AB CD 09 80 00 00 00 01 00 00 00 00 00 00 01 00 01 20 20 20 20 02 61|"; reference:arachnids,482;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 515 (msg:"EXPLOIT LPRng overflow"; flags: A+; content: "/43 07 89 5B 08 8D 4B 08 89 43 0C B0 0B CD 80 31 C0 FE C0 CD 80 E8 94 FF FF FF 2F 62 69 6E 2F 73 68 0A/"; reference:bugtraq,1712;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 515 (msg:"EXPLOIT redhat 7.0 lprd overflow"; flags: A+; content:"|58 58 58 58 25 2E 31 37 32 75 25 33 30 30 24 6E|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT linux shellcode"; flags: A+; content: "|90 90 90 e8 c0 ff ff ff|/bin/sh"; reference:arachnids,342;) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT x86 setuid 0"; content: "|b017 cd80|";reference:arachnids,436;) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT x86 setgid 0"; content: "|b0b5 cd80|";reference:arachnids,437;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT hpux noop";flags: A+; content:"|0b39 0280 0b39 0280 0b39 0280 0b39 0280|";reference:arachnids,359;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT sparc NOOP";flags: A+; content:"|13c0 1ca6 13c0 1ca6 13c0 1ca6 13c0 1ca6|"; reference:arachnids,345;) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT x86 NOPS"; content: "|90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90|";reference:arachnids,362;) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT sparc NOOP"; content:"|a61c c013 a61c c013 a61c c013 a61c c013|"; reference:arachnids,355;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT x86 stealth noop";  flags:A+; content: "|eb 02 eb 02 eb 02|"; reference:arachnids,291;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"EXPLOIT x86 linux imapd overflow";flags: A+; content:"|eb34 5e8d 1E89 5e0b 31d2 8956 07|";reference:bugtraq,130; reference:cve,CVE-1999-0005;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"EXPLOIT x86 linux imapd overflow";flags: A+; content:"|eb35 5E80 4601 3080 4602 3080 4603 30|";reference:bugtraq,130; reference:cve,CVE-1999-0005;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"EXPLOIT x86 linux imapd overflow";flags: A+; content:"|eb38 5e89f389d880460120804602|"; reference:bugtraq,130; reference:cve,CVE-1999-0005;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"EXPLOIT x86 windows MailMax overflow";flags: A+; content:"|eb45 eb20 5bfc 33c9 b182 8bf3 802b|"; reference:cve,CVE-1999-0404;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 2766 (msg:"EXPLOIT nlps x86 solaris overflow";flags: A+; content:"|eb23 5e33 c088 46fa 8946 f589 36|";) 
alert udp $EXTERNAL_NET any -> $HOME_NET 518 (msg:"EXPLOIT ntalkd x86 linux overflow"; content:"|0103 0000 0000 0001 0002 02e8|";) 
alert udp $EXTERNAL_NET any -> $HOME_NET 635 (msg:"EXPLOIT x86 linux mountd overflow"; content:"|eb56 5E56 5656 31d2 8856 0b88 561e|"; reference:cve,CVE-1999-0002;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 635 (msg:"EXPLOIT x86 linux mountd overflow"; content:"|5eb0 0289 06fe c889 4604 b006 8946|"; reference:cve,CVE-1999-0002;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 6373 (msg:"EXPLOIT sco calserver overflow";flags: A+; content:"|eb7f 5d55 fe4d 98fe 4d9b|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"EXPLOIT pop3 x86 linux overflow";flags: A+; content:"|d840 cd80 e8d9 ffff ff|/bin/sh";) 
alert udp $EXTERNAL_NET any -> $HOME_NET 635 (msg:"EXPLOITx86 linux mountd overflow"; content:"|eb40 5E31 c040 8946 0489 c340 8906|";reference:cve,CVE-1999-0002;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"EXPLOIT x86 linux imapd overflow";flags: A+; content:"|eb58 5E31 db83 c308 83c3 0288 5e26|"; reference:bugtraq,130; reference:cve, CVE-1999-0005;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"EXPLOIT x86 linux imapd overflow";flags: A+; content:"|89d8 40cd 80e8 c8ff ffff|/";reference:bugtraq,130; reference:cve,CVE-1999-0005;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"EXPLOIT imap overflow";flags: A+; content:"|E8 C0FF FFFF|/bin/sh";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"EXPLOIT x86 linux samba overflow";flags: A+; content:"|eb2f 5feb 4a5e 89fb 893e 89f2|"; reference:cve,CVE-1999-0811; reference:cve,CVE-1999-0182;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 67 (msg:"EXPLOIT bootp x86 bsd overflow"; content:"|6563 686f 206e 6574 726a 7320 7374 7265|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"EXPLOIT pop3 x86 sco overflow";flags: A+; content:"|560e 31c0 b03b 8d7e 1289 f989 f9|";) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT hpux noop"; content:"|0821 0280 0821 0280 0821 0280 08210 0280|"; reference:arachnids,349;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"EXPLOIT pop3 x86 bsd overflow";flags: A+; content:"|5e0 e31c 0b03 b8d7 e0e8 9fa 89f9|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"EXPLOIT pop3 x86 bsd overflow";flags: A+; content:"|685d 5eff d5ff d4ff f58b f590 6631|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 109 (msg:"EXPLOIT pop2 x86 linux overflow";flags: A+; content:"|eb2c 5b89 d980 c106 39d9 7c07 800 1|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 109 (msg:"EXPLOIT pop2 x86 linux overflow";flags: A+; content:"|ffff ff2f 4249 4e2f 5348 00|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT IRC client overflow";flags: A+; content:"|eb 4b 5b 53 32 e4 83 c3 0b 4b 88 23 b8 50 77|"; reference:cve,CVE-1999-0672; reference:bugtraq,573;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT NextFTP client overflow";flags: A+; content:"|b420 b421 8bcc 83e9 048b 1933 c966 b910|"; reference:cve,CVE-1999-0671;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 110 (msg:"EXPLOIT qpopper overflow";flags: A+; content:"|E8 D9FF FFFF|/bin/sh";) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT sparc NOOP"; content:"|13c0 1ca6 13c0 1ca6 13c0 1ca6 13c0 1ca6|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT x86 NOOP"; content: "|90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90|"; flags: A+; reference:arachnids,181;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT x86 setgid 0"; content: "|b0b5 cd80|"; flags: A+; reference:arachnids,284;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT x86 setuid 0"; content: "|b017 cd80|"; flags: A+; reference:arachnids,283;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT sparc setuid 0"; content: "|82102017 91d02008|"; flags: A+;reference:arachnids,282;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 119 (msg:"EXPLOIT NNTP Cassandra Overflow"; flags: A+; content: "AUTHINFO USER"; nocase; dsize: >512; depth: 16; reference:arachnids,274;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"EXPLOIT sniffit overflow"; flags: A+; content: "from|3A 90 90 90 90 90 90 90 90 90 90 90|"; nocase; dsize: >512; reference:arachnids,273;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 9090 (msg:"EXPLOIT VQServer admin"; flags: A+; content:"GET / HTTP/1.1"; nocase; reference:bugtraq,1610;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 8080 (msg:"EXPLOIT delegate proxy overflow"; content: "whois|3a|//"; nocase; flags: A+; dsize: >1000; reference:arachnids,267;) 
alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"EXPLOIT netscape 4.7 unsucessful overflow"; content: "|33 C9 B1 10 3F E9 06 51 3C FA 47 33 C0 50 F7 D0 50|"; flags: A+; reference:arachnids,214;) 
alert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"EXPLOIT netscape 4.7 client overflow"; content: "|33 C9 B1 10 3F E9 06 51 3C FA 47 33 C0 50 F7 D0 50|"; flags: A+; reference:arachnids,215;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT digital unix noop"; flags: A+; content:"|47 ff  04 1f 47 ff  04 1f 47 ff  04 1f 47 ff 04 1f|"; reference:arachnids,361;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT sparc NOOP"; flags: A+; content:"|a61c c013 a61c c013 a61c c013 a61c c013|"; reference:arachnids,355;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 67 (msg:"EXPLOIT bootp x86 linux overflow"; content:"|4139 30c0 a801 012f 6269 6e2f 7368 00|"; reference:cve,CVE-1999-0799; reference:cve,CAN-1999-0798; reference:CAN-1999-0389;) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT solaris NOOP"; content:"|801c 4011 801c 4011 801c 4011 801c 4011|"; reference:arachnids,344;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT SGI noop";flags: A+; content:"|240f 1234 240f 1234 240f 1234 240f 1234|";) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT SGI noop"; content:"|240f 1234 240f 1234 240f 1234 240f 1234|"; reference:arachnids,357;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT SGI noop";flags: A+; content:"|03e0 f825 03e0 f825 03e0 f825 03e0 f825|"; reference:arachnids,356;) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT hpux noop"; content:"|0b39 0280 0b39 0280 0b39 0280 0b39 0280|"; reference:arachnids,350;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT hpux noop";flags: A+; content:"|0821 0280 0821 0280 0821 0280 0821 0280|"; reference:arachnids,358;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 143 (msg:"EXPLOIT imap x86 linux overflow";flags: A+; content:"|e8c0 ffff ff|/bin/sh"; reference:arachnids,147; reference:cve,CVE-1999-004;) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT digital unix noop"; content:"|47 ff 04 1f 47 ff 04 1f 47 ff 04 1f 47 ff 04 1f|"; reference:arachnids,352;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT aix noop";flags: A+; content:"|4fff fb82 4fff fb82 4fff fb82 4fff fb82|";) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT aix noop"; content:"|4fff fb82 4fff fb82 4fff fb82 4fff fb82|";) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT linux shellcode"; content:"|90 90 90 e8 c0 ff ff ff|/bin/sh";  reference:arachnids,343;) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"EXPLOIT x86 NOOP"; content:"|9090 9090 9090 9090 9090 9090 9090 9090|"; reference:arachnids,181;) 


# FINGER RULES
# Updated: 03/15/2001
# -------------------

alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER backdoor";flags: A+; content:"cmd_rootsh";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER account enumeration";flags: A+; content:"a b c d e f"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER search attempt";flags: A+; content:"search";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER root";flags: A+; content:"root";reference:arachnids,376;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER null"; flags: A+; content:"|00|";reference:arachnids,377;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER probe0 attempt";flags: A+; content:"0";reference:arachnids,378;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER pipew attempt";flags: A+; content:"/W|3b|";reference:arachnids,379;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER pipe attempt"; flags: A+; content:"|7c|";reference:arachnids,380;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER bomb attempt";flags: A+; content:"@@";reference:arachnids,382;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER cybercop redirection"; flags: A+; content: "|40 6C 6F 63 61 6C 68 6F 73 74 0A|"; dsize: 11; depth: 11; reference:arachnids,11;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER redirection"; content: "@"; flags: A+; reference:arachnids,251;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER cybercop query"; content: "|0A 20 20 20 20 20|"; flags: A+; depth: 10; reference:arachnids,132; reference:cve,CVE-1999-0612;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER 0@host";flags: A+; content:"|300A|";reference:arachnids,131;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 79 (msg:"FINGER .@host";flags: A+; content:"|2E0A|";reference:arachnids,130; reference:cve,CVE-1999-0612;) 


# FTP RULES
# Updated: 03/15/2001
# -------------------

alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT wu-ftpd 2.6.0 tf8"; flags: A+; content: "|31C0 31DB 31C9 B046 CD80 31C0 31DB 43 89D941 B03F CD80|"; reference:arachnids,458;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP serv-u directory transversal"; flags: A+; content: ".%20."; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT format string"; flags: A+; content: "SITE EXEC |25 30 32 30 64 7C 25 2E 66 25 2E 66 7C 0A|"; depth: 32; nocase; reference:arachnids,453;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT solaris 2.8 format string"; flags: A+; content: "|901BC00F 82102017 91D02008|";reference:arachnids,451;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT openbsd ftpd"; flags: A+; content: " |90 31 C0 99 52 52 B017 CD80 68 CC 73 68|";reference:arachnids,446;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT wu-ftpd 2.6.0"; flags: A+; content: "|2e2e3131|venglin@";reference:arachnids,440;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP .forward"; content: ".forward"; flags: A+;reference:arachnids,319;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP pass wh00t"; content: "pass wh00t"; nocase; flags: A+; reference:arachnids,324;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP site exec"; content: "site exec"; nocase; flags: A+; reference:arachnids,317;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP CWD ~root"; content: "cwd ~root"; nocase; flags: A+;reference:arachnids,318;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT wu-ftpd 2.6.0 linux overflow"; content: "|31c031db 31c9b046 cd80 31c031db|"; flags: A+; reference:arachnids,287;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT x86 linux overflow";flags: A+; content:"|83 ec 04 5e 83 c6 70 83 c6 28 d5 e0 c0|";reference:bugtraq, 113; reference:cve, CVE-1999-0368;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP passwd attempt";flags: A+; content:"passwd";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT overflow";flags: A+; content:"|5858 5858 582F|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT aix overflow";flags: A+;dsize:>1300; content:"CEL "; reference:arachnids,257;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT overflow";flags: A+; content:"|5057 440A 2F69|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT x86 linux overflow";flags: A+; content:"|31c0 31db b017 cd80 31c0 b017 cd80|"; reference:bugtraq,113; reference:cve,CVE-1999-0368;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT x86 linux overflow";flags: A+; content:"MKD AAAAAA";reference:bugtraq,113; reference:cve,CVE-1999-0368;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT x86 linux overflow";flags: A+; content:"|31db 89d8 b017 cd80 eb2c|"; reference:bugtraq,113; reference:cve,CVE-1999-0368;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP .rhosts";flags: A+; content:".rhosts"; reference:arachnids,328;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP adm scan"; flags: A+; content:"PASS ddd@|0a|"; reference:arachnids,332;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP iss scan";flags: A+; content:"pass -iss@iss"; reference:arachnids,331;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP piss scan";flags: A+; content:"pass -cklaus";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP saint scan";flags: A+; content:"pass -saint"; reference:arachnids,330;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP tar parameters";flags: A+; content:"RETR--use-compress-program"; reference:arachnids,134; reference:cve,CVE-1999-0202;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP passwd attempt"; content:"passwd"; flags: A+;  reference:arachnids,213;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT wu-ftpd 2.6.0 site exec overflow"; content: "SITE EXEC %p"; nocase; flags: A+; depth: 16; reference:arachnids,285;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT wu-ftpd 2.6.0 site exec overflow"; content: "|66 25 2E 66 25 2E 66 25 2E 66 25 2E 66 25 2E|"; flags: A+; depth: 32; reference:arachnids,286;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP EXPLOIT wu-ftpd 2.6.0 bsd"; content: "|31c0 50 50 50 b07e cd80 31db 31c0|"; flags: A+; depth: 32; reference:arachnids,228;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP satan scan";flags: A+; content:"pass -satan"; reference:arachnids,329;) 


# ICMP RULES
# Updated: 03/15/2001
# -------------------

alert icmp any any -> any any (msg:"ICMP Source Quench"; itype: 4; icode: 0;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Nemesis v1.1 Echo"; dsize: 20; itype: 8; icmp_id: 0; icmp_seq: 0; content: "|0000000000000000000000000000000000000000|"; reference:arachnids,449;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Nmap2.36BETA or HPING2 Echo ";itype:8;dsize:0; reference:arachnids,162;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Nemesis v1.1 Echo"; content:"|0000000000000000000000000000000000000000|"; itype: 8; icmp_id: 0; icmp_seq: 0; dsize: 20;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP superscan echo from windows"; content:"|0000000000000000|"; itype: 8; dsize:8;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP  sing echo from Sun Solaris"; itype: 8; dsize: 8;) 
alert icmp any any <> any any (msg:"ICMP Broadscan Smurf Scanner"; itype: 8; icmp_id: 0; icmp_seq: 0; dsize:4; ) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP icmpenum v1.1.1"; id: 666; dsize: 0; itype: 8; icmp_id: 666 ; icmp_seq: 0; reference:arachnids,450;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING NMAP"; dsize: 0; itype: 8; reference:arachnids,162;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP L3retriever Ping"; content: "ABCDEFGHIJKLMNOPQRSTUVWABCDEFGHI"; itype: 8; icode: 0; depth: 32; reference:arachnids,311;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP webtrends scanner ping"; content: "|00 00 00 00 45 45 45 45 45 45 45 45 45 45 45 45|"; itype: 8; icode: 0; reference:arachnids,307;) 
alert icmp $EXTERNAL_NET any -> $EXTERNAL_NET any (msg:"ICMP traceroute ipopts"; ipopts: rr; itype: 0; reference:arachnids,238;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP Sniffer Pro/NetXRay network scan"; content:"|43696e636f204e6574776f726b2c20496e632e|"; itype: 8; depth: 32;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP traceroute ";ttl:1;itype:8; reference:arachnids,118;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP ISS Pinger"; content:"|495353504e475251|";itype:8;depth:32; reference:arachnids,158;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP redirect net";itype:5;icode:0; reference:arachnids,199; reference:cve,CVE-1999-0265;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP redirect host";itype:5;icode:1; reference:arachnids,135; reference:cve,CVE-1999-0265;) 


# INFO RULES
# Updated: 03/15/2001
# -------------------

alert tcp $HTTP_SERVERS 80 -> $EXTERNAL_NET any (msg:"INFO - Web Cmd completed"; content:"Command completed"; nocase;) 
alert tcp $HTTP_SERVERS 80 -> $EXTERNAL_NET any (msg:"INFO - Web File Copied ok"; content:"1 file(s) copied"; nocase;) 
alert tcp $HTTP_SERVERS 80 -> $EXTERNAL_NET any (msg:"INFO - Web Dir listing"; content:"Directory Listing of"; nocase;) 
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"INFO - psyBNC access"; flags: A+; content:"Welcome!psyBNC@lam3rz.de";) 
alert tcp $HTTP_SERVERS 80 -> $EXTERNAL_NET any (msg:"INFO - Web Command Error"; content:"Bad command or filename"; nocase;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING BSDtype"; itype: 8; content:"|08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17|"; depth: 32; reference:arachnids, 152;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Windows"; content: "|61 62 63 64 65 66 67 68 69 6A 6B 6C 6D 6E 6F 70|"; itype: 8; depth: 16; reference:arachnids,169;) 
alert icmp any any -> any any (msg:"ICMP Router Advertisment"; itype: 9; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Host Precedence Violation)"; itype: 3; icode: 14;) 
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Precedence Cutoff in effect)"; itype: 3; icode: 15;) 
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Undefined Code!)"; itype: 3;) 
alert icmp any any -> any any (msg:"ICMP Source Quench (Undefined Code!)"; itype: 4;) 
alert icmp any any -> any any (msg:"ICMP Redirect (for TOS and Network)"; itype: 5; icode: 2;) 
alert icmp any any -> any any (msg:"ICMP Redirect (Undefined Code!)"; itype: 5;) 
alert icmp any any -> any any (msg:"ICMP Alternate Host Address (Undefined Code!)"; itype: 6;) 
alert icmp any any -> any any (msg:"ICMP Unassigned! (Type 7)"; itype: 7; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Unassigned! (Type 7) (Undefined Code!)"; itype: 7;) 
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Communication Administratively Prohibited)"; itype: 3; icode: 13;) 
alert icmp any any -> any any (msg:"ICMP Echo Request (Undefined Code!)"; itype: 8;) 
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Source Host Isolated)"; itype: 3; icode: 8;) 
alert icmp any any -> any any (msg:"ICMP Router Selection"; itype: 10; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Router Selection (Undefined Code!)"; itype: 10;) 
alert icmp any any -> any any (msg:"ICMP Time-To-Live Exceeded in Transit"; itype: 11; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Fragment Reassembly Time Exceeded"; itype: 11; icode: 1;) 
alert icmp any any -> any any (msg:"ICMP Echo Request"; itype: 8; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Port Unreachable)"; itype: 3; icode: 3;) 
alert icmp any any -> any any (msg:"ICMP Echo Reply"; itype: 0; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Echo Reply (Undefined Code!)"; itype: 0;) 
alert icmp any any -> any any (msg:"ICMP Unassigned! (Type 1)"; itype: 1; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Unassigned! (Tupe 1) (Undefined Code)"; itype: 1;) 
alert icmp any any -> any any (msg:"ICMP Unassigned! (Type 2)"; itype: 2; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Unassigned! (Type 2) (Undefined Code); itype: 2;) 
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Network Unreachable)"; itype: 3; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Communication with Destination Host is Administratively Prohibited)"; itype: 3; icode: 10;) 
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Protocol Unreachable)"; itype: 3; icode: 2;) 
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Host Unreachable for Type of Service)"; itype: 3; icode: 12;) 
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Fragmentation Needed and DF bit was set)"; itype: 3; icode:4;) 
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Source Route Failed)"; itype: 3; icode: 5;) 
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Destination Network Unknown)"; itype: 3; icode: 6;) 
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Destination Host Unknown)"; itype: 3; icode: 7;) 
alert icmp any any -> any any (msg:"ICMP Alternate Host Address"; itype: 6; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Communication with Destination Network is Administratively Prohibited)"; itype: 3; icode: 9;) 
alert icmp any any -> any any (msg:"ICMP Time Exceeded (Undefined Code!)"; itype: 11;) 
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Network Unreachable for Type of Service)"; itype: 3; icode:11;) 
alert icmp any any -> any any (msg:"ICMP Destination Unreachable (Host Unreachable)"; itype: 3; icode: 1;) 
alert icmp any any -> any any (msg:"ICMP Mobile Registration Reply (Undefined Code!)"; itype: 36;) 
alert icmp any any -> any any (msg:"ICMP Datagram Conversion Error (Undefined Code!)"; itype: 31;) 
alert icmp any any -> any any (msg:"ICMP Mobile Host Redirect"; itype: 32; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Mobile Host Redirect (Undefined Code!)"; itype: 32;) 
alert icmp any any -> any any (msg:"ICMP IPV6 Where-Are-You"; itype: 33; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP IPV6 Where-Are-You (Undefined Code!)"; itype: 33;) 
alert icmp any any -> any any (msg:"ICMP IPV6 I-Am-Here"; itype: 34; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP IPV6 I-Am-Here (Undefined Code!"; itype: 34;) 
alert icmp any any -> any any (msg:"ICMP Mobile Registration Request"; itype: 35; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Datagram Conversion Error"; itype: 31; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Mobile Registration Reply"; itype: 36; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP SKIP"; itype: 39; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Parameter Problem Code 0 (unspecified Error)"; itype: 12; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP SKIP (Undefined Code!"; itype: 39;) 
alert icmp any any -> any any (msg:"ICMP Redirect (for TOS and Host)"; itype: 5; icode: 3;) 
alert icmp any any -> any any (msg:"ICMP Photuris Code 1 (Unknown Security Parameters Index)"; itype: 40; icode: 1;) 
alert icmp any any -> any any (msg:"ICMP Photuris Code 2 (Valid Security Parameters, But Authentication Failed)"; itype: 40; icode: 2;) 
alert icmp any any -> any any (msg:"ICMP Photuris Code 3 (Valid Security Parameters, But Decryption Failed)"; itype: 40; icode: 3;) 
alert icmp any any -> any any (msg:"ICMP Photuris (Undefined Code!)"; itype: 40;) 
alert icmp any any -> any any (msg:"ICMP Unknown Type";) 
alert icmp any any -> any any (msg:"ICMP Mobile Registration Request (Undefined Code!"; itype: 35;) 
alert icmp any any -> any any (msg:"ICMP Information Request"; itype: 15; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Photuris Code 0 (Reserved)"; itype: 40; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Parameter Problem Code 1 (Missing a Requiered Option)"; itype: 12; icode: 1;) 
alert icmp any any -> any any (msg:"ICMP Traceroute (Undefined Code!"; itype: 30;) 
alert icmp any any -> any any (msg:"ICMP Parameter Problem (Undefined Code!)"; itype: 12;) 
alert icmp any any -> any any (msg:"ICMP Timestamp Request"; itype: 13; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Timestamp Request (Undefined Code!)"; itype: 13;) 
alert icmp any any -> any any (msg:"ICMP Parameter Problem Code 2 (Bad Length)"; itype: 12; icode: 2;) 
alert icmp any any -> any any (msg:"ICMP Timestamp Reply (Undefined Code!)"; itype: 14;) 
alert icmp any any -> any any (msg:"ICMP Information Request (Undefined Code!)"; itype: 15;) 
alert icmp any any -> any any (msg:"ICMP Address Mask Reply (Undefined Code!)"; itype: 18;) 
alert icmp any any -> any any (msg:"ICMP Information Reply (Undefined Code!)"; itype: 16;) 
alert icmp any any -> any any (msg:"ICMP Traceroute"; itype: 30; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Address Mask Request"; itype: 17; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Reserved for Security (Type 19) (Undefined Code!)"; itype: 19;) 
alert icmp any any -> any any (msg:"ICMP Address Mask Request (Undefined Code!)"; itype: 17;) 
alert icmp any any -> any any (msg:"ICMP Address Mask Reply"; itype: 18; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Information Reply"; itype: 16; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Reserved for Security (Type 19)"; itype: 19; icode: 0;) 
alert icmp any any -> any any (msg:"ICMP Timestamp Reply"; itype: 14; icode: 0;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP SING Echo from LINUX/*BSD"; id: 13170; dsize: 8; itype: 8;  reference:arachnids,447;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP SING Echo from Sun Solaris"; dsize: 8; itype: 8; reference:arachnids,448;) 
alert tcp $EXTERNAL_NET 80 -> $HOME_NET any (msg:"INFO Connection Closed MSG from Port 80"; content:"Connection closed by foreign host"; nocase;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP SING Echo from LINUX/*BSD"; id:13170;  itype: 8; dsize: 8;) 
alert tcp $HOME_NET 23 -> $EXTERNAL_NET any (msg:"TELNET Bad Login"; flags: A+; content: "530 Login ";) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING - BayRS Router"; itype: 8; content: "0102030405060708090a0b0c0d0e0f"; depth: 32; reference:arachnids,444;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"INFO PING speedera"; content: "|3839 3a3b 3c3d 3e3f|"; depth: 100; itype: 8; ) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING BayRS Router"; itype: 8; content: "|0102030405060708090a0b0c0d0e0f|"; depth: 32; reference:arachnids,438;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING from Flowpoint2200 or Network Management Software"; itype: 8; content: "|0102030405060708090a0b0c0d0e0f10|"; depth: 32;reference:arachnids,156;) 
alert tcp any any -> any any (msg:"INFO id check returned root"; content: "uid=0(root)";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"INFO FTP No Password"; content: "pass |0d|"; nocase; flags: A+; reference:arachnids,322;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"INFO battle-mail traffic"; content:"BattleMail"; flags:A+;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Network Toolbox 3 Windows"; content:"|3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d|";itype:8;depth:32; reference:arachnids,161;) 
alert tcp $HOME_NET 21 -> $EXTERNAL_NET any (msg:"FTP Bad login"; content:"Login failed."; nocase; flags:A+;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP IRDP router advertisement";itype:9; reference:arachnids,173;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP IRDP router selection";itype:10; reference:arachnids,174;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING BeOS4.x"; content:"|00000000000000000000000008090a0b|";itype:8;depth:32; reference:arachnids,151;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Cisco Type.x"; content:"|abcdabcdabcdabcdabcdabcdabcdabcd|";itype:8;depth:32; reference:arachnids,153;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING CyberKit 2.2 Windows"; content:"|aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa|";itype:8;depth:32; reference:arachnids,154;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Delphi-Piette Windows"; content:"|50696e67696e672066726f6d2044656c|";itype:8;depth:32; reference:arachnids,155;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Microsoft Windows"; content:"|303132333435363738396162636465666768696a6b6c6d6e6f70|"; itype:8;depth:32; reference:arachnids,159;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING *NIX"; content:"|101112131415161718191a1b1c1d1e1f|";itype:8;depth:32;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Pinger Windows"; content:"|44617461000000000000000000000000|";itype:8;depth:32; reference:arachnids,163;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Ping-O-MeterWindows"; content:"|4f4d 6574 6572 4f62 6573 6541 726d 6164|";itype:8;depth:32; reference:arachnids,164;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING Seer Windows"; content:"|88042020202020202020202020202020|";itype:8;depth:32; reference:arachnids,166;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP TJPingPro1.1Build 2 Windows"; content:"|544a 5069 6e67 5072 6f20 6279 204a 696d|";itype:8;depth:32; reference:arachnids,167;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING WhatsupGold Windows"; content:"|5768 6174 7355 7020 2d20 4120 4e65 7477|";itype:8;depth:32; reference:arachnids,168;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"ICMP PING IP NetMonitor Macintosh"; content:"|a9205375737461696e61626c6520536f|";itype:8;depth:32; reference:arachnids,157;) 


# MISC RULES
# Updated: 03/15/2001
# -------------------

alert tcp $EXTERNAL_NET 53 -> $HOME_NET :1024 (msg:"MISC source port 53 to <1024"; flags:S; reference:arachnids,07;) 
alert udp $EXTERNAL_NET 53 -> $HOME_NET :1024 (msg:"MISC source port 53 to <1024";) 
alert tcp $EXTERNAL_NET 20 -> $HOME_NET :1024 (msg:"MISC Source Port 20 to <1024"; flags:S; reference:arachnids,06;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"MISC linux rootkit 2 attempt";flags: A+; content:"wh00t!";) 
alert udp $EXTERNAL_NET any -> $HOME_NET 177 (msg:"MISC xdmcp query"; content: "|00 01 00 03 00 01 00|";reference:arachnids,476;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 70 (msg:"MISC gopher proxy"; content: "ftp|3a|"; content: "@/"; depth:4; flags: A+; nocase; reference:arachnids,409;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"MISC linux rootkit attempt lrkr0x";flags: A+; content:"lrkr0x";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"MISC linux rootkit attempt";flags: A+; content:"d13hh["; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"MISC sm4ck backdoor attempt";flags: A+; content:"hax0r";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"MISC backdoor r00t attempt";flags: A+; content:"r00t";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"BACKDOOR w00w00 attempt";flags: A+; content:"w00w00";) 
alert tcp $HOME_NET any -> $EXTERNAL_NET 27374 (msg:"MISC ramen worm outgoing"; flags: A+; content: "GET "; depth: 8; nocase;reference:arachnids,461;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"MISC backdoor probe";flags: A+; content:"backdoor"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 27374 (msg:"MISC ramen worm incoming"; flags: A+; content: "GET "; depth: 8; nocase;reference:arachnids,460;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"MISC OutOfBox account attempt";flags: A+; content:"OutOfBox";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"MISC solaris 2.5 backdoor attempt";flags: A+; content:"friday";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"MISC backdoor rewt attempt";flags: A+; content:"rewt";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"MISC linux rootkit attempt";flags: A+; content:"satori";) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC Large UDP Packet"; dsize: >4000; reference:arachnids,247;) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC source route lssr"; ipopts: lsrr ;reference:arachnids,418;) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC source route lssre"; ipopts: lsrre ;reference:arachnids,420;) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC source route ssrr"; ipopts: ssrr ;reference:arachnids,422;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC source route lssre";ipopts:lsrre; reference:arachnids,117;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 9001 (msg:"MISC HP Printer display"; flags: A+; content: "@PJL RDYMSG DISPLAY = "; depth: 32;reference:arachnids,302;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"MISC PCCS mysql database admin tool"; flags: A+; content: "pccsmysqladm/incs/dbconnect.inc"; nocase; depth: 36;reference:arachnids,300;) 
alert tcp $HOME_NET 5631 -> $EXTERNAL_NET any (msg:"MISC Invalid PCAnywhere Login"; content:"Invalid login"; offset:5; depth:13; flags:A+;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"TFTP rootdirectory"; content:"|0001|/"; reference:arachnids,138; reference:cve,CVE-1999-0183;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC source route lssr";ipopts:lsrr; reference:arachnids,116;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC source route lssre"; ipopts: lsrre ;reference:arachnids,421;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC traceroute";ttl:1; reference:arachnids,3;) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC traceroute";ttl:1; reference:arachnids,115;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"MISC - SNMP NT UserList"; content:"|2b 06 10 40 14 d1 02 19|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC source route lssr"; ipopts: lsrr ;reference:arachnids,419;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"TFTP parent directory"; content:".."; reference:arachnids,137; reference:cve,CVE-1999-0183;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 69 (msg:"MISC TFTP Write"; content:"|00 02|"; depth:2; reference:cve,CVE-1999-0183; reference:arachnids,148;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC source route ssrr"; ipopts: ssrr ;reference:arachnids,423;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 1417 (msg:"MISC Insecure TIMBUKTU Password"; content: "|05 00 3E|"; flags: A+; depth: 16; reference:arachnids,229;) 
alert tcp $HOME_NET 5632 -> $EXTERNAL_NET any (msg:"MISC PCAnywhere Failed Login";flags: A+; content:"Invalid login"; depth: 16; reference:arachnids,240;) 
alert tcp $HOME_NET 7161 -> $EXTERNAL_NET any (msg:"MISC Cisco Catalyst Remote Access"; flags:SA; reference:arachnids,129; reference:cve,CVE-1999-0430;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC Large ICMP Packet"; dsize: >800; reference:arachnids,246;) 
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"MISC source route ssrr";ipopts: ssrr;  reference:arachnids,424;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 5631 (msg:"MISC PCAnywhere Attempted Administrator Login";flags: A+; content:"ADMINISTRATOR";) 


# NETBIOS RULES
# Updated: 03/15/2001
# -------------------

alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS DOS RFPoison"; flags: A+; content: "|5C 00 5C 00 2A 00 53 00 4D 00 42 00 53 00 45 00 52 00 56 00 45 00 52 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00|";reference:arachnids,454;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS RFParalyze Attempt"; flags: A+; content:"BEAVIS"; content:"yep yep";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS NT NULL session"; flags: A+; content: "|00 00 00 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 4E 00 54 00 20 00 31 00 33 00 38 00 31|"; reference:arachnids,204;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IPC$access";flags: A+; content:"|5c00|I|00|P|00|C|00|$|000000|IPC|00|"; reference:arachnids,334;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB IPC$access";flags: A+; content:"\\IPC$|00 41 3a 00|"; reference:arachnids,335;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB D$access";flags: A+; content:"\\D$|00 41 3a 00|"; reference:arachnids,336;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CD...";flags: A+; content:"\\...|00 00 00|"; reference:arachnids,337;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB CD..";flags: A+; content:"\\..|2f 00 00 00|"; reference:arachnids,338;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB C$ access"; flags: A+; content: "|5c|C$|00 41 3a 00|";reference:arachnids,339;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS SMB ADMIN$access";flags: A+; content:"\\ADMIN$|00 41 3a 00|"; reference:arachnids,340;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"NETBIOS Samba clientaccess";flags: A+; content:"|00|Unix|00|Samba"; reference:arachnids,341;) 


# POLICY RULES
# Updated: 03/15/2001
# -------------------

alert tcp any 1863 <> any any (msg:"INFO MSN IM Chat data";flags: A+; content:"|746578742F706C61696E|"; depth:100;) 
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"INFO - ICQ Access"; flags: A+; content: "User-Agent\:ICQ";) 
alert tcp $HOME_NET any -> $EXTERNAL_NET 6666:6669,7000 (msg:"INFO Possible IRC Access"; flags: A+; content: "NICK ";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP STOR 1MB possible warez site"; flags: A+; content:"STOR 1MB"; nocase; depth: 8;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP RETR 1MB possible warez site"; flags: A+; content:"RETR 1MB"; nocase; depth: 8;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP CWD / - possible warez site"; flags: A+; content:"CWD / "; nocase; depth: 6;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP CWD  - possible warez site"; flags: A+; content:"CWD  "; nocase; depth: 5;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP MKD  - possible warez site"; flags: A+; content:"MKD  "; nocase; depth: 5;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP MKD . - possible warez site"; flags: A+; content:"MKD ."; nocase; depth: 5;) 
alert tcp $HOME_NET !80 -> $EXTERNAL_NET 8888 (msg:"INFO napster login"; flags: A+; content:"/00 0200/"; offset: 1; depth: 3; ) 
alert tcp $HOME_NET !80 -> $EXTERNAL_NET 8888 (msg:"INFO napster new user login"; flags: A+; content: "/00 0600/"; offset: 1; depth: 3; ) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 8888 (msg:"INFO napster download attempt"; flags: A+; content: "/00 cb00/"; offset: 1; depth: 3; ) 
alert tcp $EXTERNAL_NET 8888 -> $HOME_NET any (msg:"INFO napster upload request"; flags: A+; content: "/00 5f02/"; offset: 1; depth: 3; ) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"INFO FTP anonymous FTP"; content:"anonymous"; nocase; flags:A+;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP MKD  / - possible warez site"; flags: A+; content:"MKD / "; nocase; depth: 6;) 
alert tcp $HOME_NET 23 -> $EXTERNAL_NET any (msg:"INFO wingate telnet active"; content:"WinGate>"; flags: A+; reference:arachnids,366; reference:cve,CAN-1999-0657;) 
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"INFO Outbound GNUTella Connect request"; content: "GNUTELLA CONNECT"; nocase; depth: 40;) 
alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"INFO Inbound GNUTella Connect accept"; content: "GNUTELLA OK"; nocase; depth: 40;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"INFO Outbound GNUTella Connect accept"; content: "GNUTELLA OK"; nocase; depth: 40;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"INFO Inbound GNUTella Connect request"; content: "GNUTELLA CONNECT"; nocase; depth: 40;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"INFO VNC Active on Network"; flags: A+; content:"RFB 003.003";) 
alert tcp $HOME_NET any <> $EXTERNAL_NET 6699 (msg:"INFO Napster Client Data"; flags: A+; content:".mp3"; nocase;) 
alert tcp $HOME_NET any <> $EXTERNAL_NET 7777 (msg:"INFO Napster Client Data"; flags: A+; content:".mp3"; nocase;) 
alert tcp $HOME_NET any <> $EXTERNAL_NET 6666 (msg:"INFO Napster Client Data"; flags: A+; content:".mp3"; nocase;) 
alert tcp $HOME_NET any <> $EXTERNAL_NET 5555 (msg:"INFO Napster Client Data"; flags: A+; content:".mp3"; nocase;) 
alert tcp $HOME_NET any <> $EXTERNAL_NET 8875 (msg:"INFO Napster Server Login"; flags: A+; content:"anon@napster.com";) 
alert udp $EXTERNAL_NET any -> $HOME_NET 5632 (msg:"MISC PCAnywhere Startup"; content:"ST"; depth: 2; reference:arachnids,239;) 


# RPC RULES
# Updated: 03/15/2001
# -------------------

alert tcp $EXTERNAL_NET any -> $HOME_NET 111,32771 (msg:"RPC portmap listing"; flags: A+; rpc: 100000,*,*;reference:arachnids,429;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request rstatd"; content: "|01 86 A0 00 00|"; reference:arachnids,10;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RPC EXPLOIT statdx"; flags: A+; content: "/bin|c74604|/sh";reference:arachnids,442;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request ttdbserv"; content:"|01 86 F3 00 00|";offset:40;depth:8; reference:arachnids,24;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request amountd"; content:"|01 87 03 00 00|";offset:40;depth:8; reference:arachnids,19;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request bootparam"; content:"|01 86 BA 00 00|";offset:40;depth:8; reference:arachnids,16;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request cmsd"; content:"|01 86 E4 00 00|";offset:40;depth:8; reference:arachnids,17;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request mountd"; content:"|01 86 A5 00 00|";offset:40;depth:8; reference:arachnids,13;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request nisd"; content:"|01 87 cc 00 00|";offset:40;depth:8; reference:arachnids,21;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request pcnfsd"; content:"|02 49 f1 00 00|";offset:40;depth:8; reference:arachnids,22;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request rexd";content:"|01 86 B1 00 00|";offset:40;depth:8; reference:arachnids,23;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request rusers"; content:"|01 86 A2 00 00|";offset:40;depth:8; reference:arachnids,133;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request sadmind"; content:"|01 87 88 00 00|";offset:40;depth:8; reference:arachnids,20;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request admind"; content:"|01 86 F7 00 00|";offset:40;depth:8; reference:arachnids,18;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request status"; content:"|01 86 B8 00 00|";offset:40;depth:8; reference:arachnids,15;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request yppasswd"; content:"|01 86 A9 00 00|";offset:40;depth:8; reference:arachnids,14;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request ypserv"; content:"|01 86 A4 00 00|";offset:40;depth:8; reference:arachnids,12;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request ypupdated"; content:"|01 86 BC 00 00|";offset:40;depth:8; reference:arachnids,125;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 32770: (msg:"RPC rstatd query"; content:"|00 00 00 00 00 00 00 02 00 01 86 A1|";offset:5; reference:arachnids,9;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 634:1400 (msg:"RPC AMD Overflow"; flags: A+; content: "|80 00 04 2C 4C 15 75 5B 00 00 00 00 00 00 00 02|";depth: 32; reference:arachnids,217;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 32771:34000 (msg:"RPC DOS ttdbserv solaris"; flags: A+; content: "|00 01 86 F3 00 00 00 01 00 00 00 0F 00 00 00 01|";offset: 16; depth: 32; reference:arachnids,241; reference:cve,CVE-1999-0003;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 32771:34000 (msg:"RPC EXPLOIT ttdbserv Solaris overflow"; flags: A+; dsize: >999; content: "|00 01 86 F3 00 00 00 01 00 00 00 0F 00 00 00 01|"; reference:cve,CVE-1999-0003; reference:arachnids,242;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 32771: (msg:"RPC NFS Showmount"; flags: A+; content: "|00 01 86 A5 00 00 00 01 00 00 00 05 00 00 00 01|"; offset: 16; depth: 32; reference:arachnids,26;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC Info Query"; content:"|00 01 86 A0 00 00 00 02 00 00 00 04|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 32771:34000 (msg:"RPC EXPLOIT ttdbserv solaris overflow"; content: "|C0 22 3F FC A2 02 20 09 C0 2C 7F FF E2 22 3F F4|"; flags: A+; dsize: >999; reference:arachnids,242;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 111 (msg:"RPC portmap request selection_svc"; content:"|01 86 AF 00 00|";offset:40;depth:8; reference:arachnids,25;) 


# RSERVICES RULES
# Updated: 03/15/2001
# -------------------

alert tcp $EXTERNAL_NET any -> $HOME_NET 514 (msg:"RSERVICES rlogin root"; flags: A+; content: "root|00|root|00|";reference:arachnids,391;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 514 (msg:"RSERVICES rlogin bin"; flags: A+; content: "bin|00|bin|00|"; reference:arachnids,390;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 514 (msg:"RSERVICES rlogin echo++"; flags: A+; content: "echo |22|+ +|22|"; reference:arachnids,388;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"RSERVICES rsh login failure";flags: A+; content: "|01|rlogind|3a| Permission denied.";reference:arachnids,392;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 514 (msg:"RSERVICES rlogin failure"; flags: A+; content: "|01|rlogind|3a| Permission denied.";reference:arachnids,394;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 514 (msg:"RSERVICES rlogin bin";flags: A+; content:"bin|00|bin|00|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 513 (msg:"RSERVICES rsh login failure";flags: A+; content:"login incorrect"; reference:arachnids,393;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 513 (msg:"RSERVICES rlogin failure";flags: A+; content:"|01|rlogind|3a| Permission denied.";) 
alert udp $EXTERNAL_NET any -> $HOME_NET 32770: (msg:"RPC rusers query"; content:"|0000000000000002000186A2|";offset:5; reference:cve,CVE-1999-0626; reference:arachnids,136;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 513 (msg:"RSERVICES rsh bin";flags: A+; content:"bin|00|bin|00|"; reference:arachnids,384;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 513 (msg:"RSERVICES rsh echo++";flags: A+; content:"echo |22| + + |22|"; reference:arachnids,385;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 513 (msg:"RSERVICES rsh froot";flags: A+; content:"-froot|00|"; reference:arachnids,386;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 513 (msg:"RSERVICES rsh login failure";flags: A+; content:"|01|rlogind|3a| Permission denied.";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 513 (msg:"RSERVICES rsh root";flags: A+; content:"root|00|root|00|"; reference:arachnids,389;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 514 (msg:"RSERVICES rlogin froot";flags: A+; content:"-froot|00|"; reference:arachnids,387;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 514 (msg:"RSERVICES rlogin root";flags: A+; content:"root|00|root|00|";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 513 (msg:"RSERVICES rsh LinuxNIS";flags: A+; content:"|3a3a 3a3a 3a3a 3a3a 003a 3a3a 3a3a 3a3a 3a|";) 


# SCAN RULES
# Updated: 03/15/2001
# -------------------

alert tcp $EXTERNAL_NET any -> $HOME_NET 1080,8080 (msg:"SCAN Proxy attempt";flags:S;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 3128 (msg:"INFO - Possible Squid Scan"; flags:S;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg: "SCAN Queso Fingerprint attempt"; ttl: >225; flags: S12; reference:arachnids,29;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 32771 (msg: "SCAN - portmap listing 32771"; flags: A+; rpc: 100000,*,*; reference:arachnids,429;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"SCAN - wayboard request - allows reading of arbitrary files as http service"; content:"way-board"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"SCAN - palscgi request - allows reading of arbitrary files as http service"; content:"pals-cgi"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"SCAN - commerce request - allows reading of arbitrary files as http service"; content:"commerce.cgi"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"SCAN - sendtemp request - allows reading of arbitrary files as http service"; content:"sendtemp.pl"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"SCAN - webspirs request - allows reading of arbitrary files as http service"; content:"webspirs.cgi"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"SCAN - tstisapi request - allows arbitrary commands as http service"; content:"tstisapi.dll"; nocase;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"SCAN - Named probe authors"; content: "|07|authors|04|bind"; depth: 26; offset: 12; nocase; reference:arachnids,480;) 
alert tcp $HOME_NET 31337 -> $EXTERNAL_NET 80 (msg:"SCAN synscan microsoft"; id: 39426; flags: SF;reference:arachnids,459;) 
alert tcp $EXTERNAL_NET 31790 -> $HOME_NET 31789 (msg:"SCAN trojan hack-a-tack probe"; content: "A"; depth: 1;  reference:arachnids,314; flags:A+;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"SCAN ssh-research-scanner"; flags: FPA; content:"/00 00 00 60 00 00 00 00 00 00 00 00 01 00 00 00/";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN synscan portscan"; id: 39426; flags: SF;reference:arachnids,441;) 
alert tcp $EXTERNAL_NET 10101 -> $HOME_NET any (msg:"SCAN myscan"; ttl: >220; ack: 0; flags: S;reference:arachnids,439;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 49 (msg:"SCAN XTACACS logout"; content: "|8007 0000 0700 0004 0000 0000 00|";reference:arachnids,408;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP cybercop scan ehlo";flags: A+; content:"ehlo cybercop|0a|quit|0a|"; reference:arachnids,372;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP cybercop scan expn";flags: A+; content:"expn cybercop"; reference:arachnids,371;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 7 (msg:"SCAN cybercop udp bomb"; content:"cybercop"; reference:arachnids,363;) 
alert udp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN Webtrends Scanner UDP Probe"; content: "|0A 68 65 6C 70 0A 71 75 69 74 0A|";reference:arachnids,308;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 113 (msg:"SCAN ident version"; flags: A+; content: "VERSION|0A|"; depth: 16;reference:arachnids,303;) 
alert udp $EXTERNAL_NET any -> $HOME_NET 10080:10081 (msg:"SCAN Amanda client version"; content:"Amanda"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"SCAN cybercop os probe"; flags: SF12; dsize: 0; reference:arachnids,146;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN cybercop os probe"; content: "AAAAAAAAAAAAAAAA"; flags: PA12; depth: 16; reference:arachnids,149;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN SYN FIN";flags:SF; reference:arachnids,198;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN cybercop os probe"; content: "AAAAAAAAAAAAAAAA"; flags: SFU12; ack: 0; depth: 16; reference:arachnids,150;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN nmap fingerprint attempt";flags:SFPU; reference:arachnids,05;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN NULL";flags:0; seq:0; ack:0; reference:arachnids,4;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN XMAS";flags:SRAFPU; reference:arachnids,144;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN nmap TCP";flags:A;ack:0; reference:arachnids,28;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN FIN"; flags: F; reference:arachnids,27;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"SCAN IP Eye SYN Scan"; flags: S; seq: 1958810375; reference:arachnids,236;) 


# SMTP RULES
# Updated: 03/15/2001
# -------------------

alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP expn root";flags: A+; content:"expn root"; nocase; reference:arachnids,21;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP expn decode";flags: A+; content:"expn decode"; nocase; reference:arachnids,32;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP sendmail 8.4.1 exploit";flags: A+; content:"rcpt to|3a207c| sed '1,/^$/d'|7c|"; nocase;reference:arachnids,120;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP sendmail 5.5.5 exploit";flags: A+; content:"mail from|3a20227c|"; nocase; reference:arachnids,119;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP sendmail 5.6.5 exploit";flags: A+; content:"MAIL FROM|3a207c|/usr/ucb/tail"; nocase; reference:arachnids,122;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP vrfy decode";flags: A+; content:"vrfy decode"; nocase; reference:arachnids,373;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP sendmail 5.6.4 exploit";flags: A+; content:"rcpt to|3a| decode"; nocase; reference:arachnids,121;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP exchange mime DOS"; flags: A+; content:"|63 68 61 72 73 65 74 20 3D 20 22 22|";) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP majordomo ifs";flags: A+; content:"eply-to|3a| a~.`/bin/"; reference:cve,CVE-1999-0208; reference:arachnids,143;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP sendmail 8.6.9c exploit";flags: A+; content:"|0a|Croot|0d0a|Mprog"; reference:arachnids,141; reference:cve,CVE-1999-0204;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP sendmail 5.5.8 overflow"; flags: A+; content: "|7c 73 65 64 20 2d 65 20 27 31 2c 2f 5e 24 2f 27|";  reference:arachnids,171; reference:cve,CVE-1999-0095;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP EXPLOIT x86 windows CSMMail overflow";flags: A+; content:"|eb53 eb20 5bfc 33c9 b182 8bf3 802b|"; reference:cve,CVE-2000-0042;) 
alert tcp $HOME_NET 25 -> $EXTERNAL_NET any (msg:"SMTP relaying denied"; flags: A+; content: "5.7.1"; depth:70;  reference:arachnids,249;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP chameleon overflow"; content: "HELP "; nocase; flags: A+; dsize: >500; depth: 5;  reference:arachnids,266; reference:cve,CAN-1999-0261;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP sendmail 8.6.9 exploit";flags: A+; content:"|0a|Croot|0a|Mprog";reference:arachnids,142; reference:cve,CVE-1999-0204;) 
alert tcp $EXTERNAL_NET 113 -> $SMTP 25 (msg:"SMTP sendmail 8.6.9 exploit";flags: A+; content:"|0a|D/"; reference:arachnids,140; reference:cve,CVE-1999-0204;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP sendmail 8.6.9 exploit";flags: A+; content:"|0a|C|3a|daemon|0a|R"; reference:cve,CVE-1999-0204; reference:arachnids,139;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP sendmail 8.6.10 exploit";flags: A+; content:"Croot|09090909090909|Mprog,P=/bin"; reference:arachnids,124;) 
alert tcp $EXTERNAL_NET any -> $SMTP 25 (msg:"SMTP sendmail 8.6.10 exploit"; flags: A+; content:"Croot|0d0a|Mprog, P=/bin/"; reference:arachnids,123;) 


# SQL RULES
# Updated: 03/15/2001
# -------------------

alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg: "MS-SQL sp_start_job - program execution"; content: "s|00|p|00|_|00|s|00|t|00|a|00|r|00|t|00|_|00|j|00|o|00|"; nocase; flags: AP; offset: 8;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg: "MS-SQL - xp_displayparamstmt possible buffer overflow"; content: "x|00|p|00|_|00|d|00|i|00|s|00|p|00|l|00|a|00|y|00|p|00|a|00|r|00|a|00|m|00|s|00|t|00|m|00|t"; nocase; flags: AP; offset: 8;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg: "MS-SQL - xp_setsqlsecurity possible buffer overflow"; content: "x|00|p|00|_|00|s|00|e|00|t|00|s|00|q|00|l|00|s|00|e|00|c|00|u|00|r|00|i|00|t|00|y"; nocase; flags: AP; offset: 8;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg: "MS-SQL sp_start_job - program execution"; content: "s|00|p|00|_|00|s|00|t|00|a|00|r|00|t|00|_|00|j|00|o|00|"; nocase; flags: AP; offset: 32; depth: 32;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg: "MS-SQL PIPES sp_password - password change"; content: "s|00|p|00|_|00|p|00|a|00|s|00|s|00|w|00|o|00|r|00|d|00|"; nocase; flags: AP; offset: 32; depth: 32;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg: "MS-SQL PIPES sp_delete_alert - log file deletion"; content: "s|00|p|00|_|00|d|00|e|00|l|00|e|00|t|00|e|00|_|00|a|00|l|00|e|00|"; nocase; flags: AP; offset: 32; depth: 32;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg: "MS-SQL PIPES sp_adduser - database user creation"; content: "s|00|p|00|_|00|a|00|d|00|d|00|u|00|s|00|e|00|r|00|"; nocase; flags: AP; offset: 32; depth: 32;) 
alert tcp $SQL_SERVERS 139 -> $EXTERNAL_NET any (msg: "MS-SQL sa logon failed"; content: "Login failed for user |27|sa|27|"; flags: AP; offset:83;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg: "MS-SQL PIPES xp_cmdshell - program execution"; content: "x|00|p|00|_|00|c|00|m|00|d|00|s|00|h|00|e|00|l|00|l|00|"; nocase; flags: AP; offset: 32; offset: 32;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg: "MS-SQL - xp_enumresultset possible buffer overflow"; content: "x|00|p|00|_|00|e|00|n|00|u|00|m|00|r|00|e|00|s|00|u|00|l|00|t|00|s|00|e|00|t"; nocase; flags: AP; offset: 8;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg: "MS-SQL sp_password - password change"; content: "s|00|p|00|_|00|p|00|a|00|s|00|s|00|w|00|o|00|r|00|d|00|"; nocase; flags: AP; offset: 8;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg: "MS-SQL sp_delete_alert - log file deletion"; content: "s|00|p|00|_|00|d|00|e|00|l|00|e|00|t|00|e|00|_|00|a|00|l|00|e|00|"; nocase; flags: AP; offset: 8;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg: "MS-SQL sp_adduser - database user creation"; content: "s|00|p|00|_|00|a|00|d|00|d|00|u|00|s|00|e|00|r|00|"; nocase; flags: AP; offset: 8;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg: "MS-SQL xp_reg* - registry access"; content: "x|00|p|00|_|00|r|00|e|00|g|00|"; nocase; flags: AP; offset: 8;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg: "MS-SQL xp_cmdshell - program execution"; content: "x|00|p|00|_|00|c|00|m|00|d|00|s|00|h|00|e|00|l|00|l|00|"; nocase; flags: AP; offset: 8;) 
alert tcp $SQL_SERVERS 1433 -> $EXTERNAL_NET any (msg: "MS-SQL sa logon failed"; content: "Login failed for user |27|sa|27|"; flags: AP; offset:16;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg: "MS-SQL PIPES xp_reg* - registry access"; content: "x|00|p|00|_|00|r|00|e|00|g|00|"; nocase; flags: AP; offset: 32; depth: 32;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg: "MS-SQL - xp_printstatements possible buffer overflow"; content: "x|00|p|00|_|00|p|00|r|00|i|00|n|00|t|00|s|00|t|00|a|00|t|00|e|00|m|00|e|00|n|00|t|00|s"; nocase; flags: AP; offset: 32;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139,1433 (msg: "MS-SQL Buffer overflow shellcode ACTIVE ATTACK"; content: "|3920d0009201c200520055003920ec00|"; flags: AP;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139,1433 (msg: "MS-SQL Buffer overflow shellcode ACTIVE ATTACK"; content: "|4800250078007700900090009000900090003300c000500068002e00|"; flags: AP;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg: "MS-SQL - xp_sprintf possible buffer overflow"; content: "x|00|p|00|_|00|s|00|p|00|r|00|i|00|n|00|t|00|f"; nocase; flags: AP; offset: 32;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg: "MS-SQL - xp_showcolv possible buffer overflow"; content: "x|00|p|00|_|00|s|00|h|00|o|00|w|00|c|00|o|00|l|00|v"; nocase; flags: AP; offset: 32;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg: "MS-SQL - xp_peekqueue possible buffer overflow"; content: "x|00|p|00|_|00|p|00|e|00|e|00|k|00|q|00|u|00|e|00|u|00|e"; nocase; flags: AP; offset: 32;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg: "MS-SQL - xp_proxiedmetadata possible buffer overflow"; content: "x|00|p|00|_|00|p|00|r|00|o|00|x|00|i|00|e|00|d|00|m|00|e|00|t|00|a|00|d|00|a|00|t|00|a"; nocase; flags: AP; offset: 32;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg: "MS-SQL - xp_printstatements possible buffer overflow"; content: "x|00|p|00|_|00|p|00|r|00|i|00|n|00|t|00|s|00|t|00|a|00|t|00|e|00|m|00|e|00|n|00|t|00|s"; nocase; flags: AP; offset: 8;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg: "MS-SQL - xp_updatecolvbm possible buffer overflow"; content: "x|00|p|00|_|00|u|00|p|00|d|00|a|00|t|00|e|00|c|00|o|00|l|00|v|00|b|00|m"; nocase; flags: AP; offset: 32;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg: "MS-SQL - xp_updatecolvbm possible buffer overflow"; content: "x|00|p|00|_|00|u|00|p|00|d|00|a|00|t|00|e|00|c|00|o|00|l|00|v|00|b|00|m"; nocase; flags: AP; offset: 8;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg: "MS-SQL - xp_displayparamstmt possible buffer overflow"; content: "x|00|p|00|_|00|d|00|i|00|s|00|p|00|l|00|a|00|y|00|p|00|a|00|r|00|a|00|m|00|s|00|t|00|m|00|t"; nocase; flags: AP; offset: 32;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg: "MS-SQL - xp_setsqlsecurity possible buffer overflow"; content: "x|00|p|00|_|00|s|00|e|00|t|00|s|00|q|00|l|00|s|00|e|00|c|00|u|00|r|00|i|00|t|00|y"; nocase; flags: AP; offset: 32;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg: "MS-SQL - xp_sprintf possible buffer overflow"; content: "x|00|p|00|_|00|s|00|p|00|r|00|i|00|n|00|t|00|f"; nocase; flags: AP; offset: 8;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg: "MS-SQL - xp_showcolv possible buffer overflow"; content: "x|00|p|00|_|00|s|00|h|00|o|00|w|00|c|00|o|00|l|00|v"; nocase; flags: AP; offset: 8;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg: "MS-SQL - xp_peekqueue possible buffer overflow"; content: "x|00|p|00|_|00|p|00|e|00|e|00|k|00|q|00|u|00|e|00|u|00|e"; nocase; flags: AP; offset: 8;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg: "MS-SQL - xp_proxiedmetadata possible buffer overflow"; content: "x|00|p|00|_|00|p|00|r|00|o|00|x|00|i|00|e|00|d|00|m|00|e|00|t|00|a|00|d|00|a|00|t|00|a"; nocase; flags: AP; offset: 8;) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS any (msg: "x86 NOOP - unicode BUFFER OVERFLOW ATTACK"; content: "|90009000900090009000|";) 
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg: "MS-SQL - xp_enumresultset possible buffer overflow"; content: "x|00|p|00|_|00|e|00|n|00|u|00|m|00|r|00|e|00|s|00|u|00|l|00|t|00|s|00|e|00|t"; nocase; flags: AP; offset: 32;) 


# TELNET RULES
# Updated: 03/15/2001
# -------------------

alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"TELNET EZsetup account attempt";flags: A+; content:"OutOfBox";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"TELNET 4Dgifts SGI account attempt";flags: A+; content:"4Dgifts";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"TELNET HideSource backdoor attempt";flags: A+; content:"wank";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"TELNET HidePak backdoor attempt";flags: A+; content:"StoogR";) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"TELNET resolv_host_conf";flags: A+; content:"resolv_host_conf"; reference:arachnids,369;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"TELNET livingston DOS";flags: A+; content:"|fff3 fff3 fff3 fff3 fff3|"; reference:arachnids,370;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"TELNET ld_library_path";flags: A+; content:"ld_library_path"; reference:arachnids,367;) 
alert tcp $HOME_NET 23 -> $EXTERNAL_NET any (msg:"TELNET not on console"; flags: A+; content:"not on system console"; nocase; reference:arachnids,365;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"TELNET SGI telnetd format bug"; flags: A+; content: "_RLD"; content: "/bin/sh";reference:arachnids,304;) 
alert tcp $HOME_NET 23 -> $EXTERNAL_NET any (msg:"TELNET - Attempted SU from wrong group"; content: "|74 6F 20 73 75 20 72 6F 6F 74 2E|"; flags: A+;) 
alert tcp $HOME_NET 23 -> $EXTERNAL_NET any (msg:"TELNET login incorrect"; content:"Login incorrect"; flags: A+; reference:arachnids,127;) 
alert tcp $HOME_NET 23 -> $EXTERNAL_NET any (msg:"TELNET access";flags: A+; content:"|FF FD 18 FF FD 1F FF FD 23 FF FD 27 FF FD 24|"; reference:arachnids,08; reference:cve,CAN-1999-0619;) 


# VIRUS RULES
# Updated: 03/15/2001
# -------------------

alert tcp any 110 -> any any (msg:"Virus - SnowWhite Trojan Incoming"; content:"Suddlently";) 
alert tcp any 110 -> any any (msg:"Virus - Possible pif Worm"; content: ".pif"; nocase;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NAVIDAD Worm"; content: "NAVIDAD.EXE"; nocase;) 
alert tcp any 110 -> any any (msg:"Virus - Possible MyRomeo Worm"; content: "myromeo.exe"; nocase;) 
alert tcp any 110 -> any any (msg:"Virus - Possible MyRomeo Worm"; content: "myjuliet.chm"; nocase;) 
alert tcp any 110 -> any any (msg:"Virus - Possible MyRomeo Worm"; content: "ble bla"; nocase;) 
alert tcp any 110 -> any any (msg:"Virus - Possible MyRomeo Worm"; content: "I Love You";) 
alert tcp any 110 -> any any (msg:"Virus - Possible MyRomeo Worm"; content: "Sorry... Hey you !";) 
alert tcp any 110 -> any any (msg:"Virus - Possible MyRomeo Worm"; content: "my picture from shake-beer";) 
alert tcp any 110 -> any any (msg:"Virus - Possible scr Worm"; content: ".scr"; nocase;) 
alert tcp any 110 -> any any (msg:"Virus - Possible shs Worm"; content: ".shs"; nocase;) 
alert tcp any 110 -> any any (msg:"Virus - LURHQ-01 - Virus - Possible QAZ Worm"; content: "|71 61 7a 77 73 78 2e 68 73 71|";) 
alert tcp any any -> any 139 (msg:"Virus - LURHQ-02 - Virus - Possible QAZ Worm Infection"; flags:A; content: "|71 61 7a 77 73 78 2e 68 73 71|";) 
alert tcp any 110 -> any any (msg:"Virus - Possible Matrix worm"; content: "Software provide by [MATRiX]"; nocase; ) 
alert tcp any 110 -> any any (msg:"Virus - Possible MyRomeo Worm"; content: "Matrix has you...";) 
alert tcp any any -> any 25 (msg:"Virus - Successful eurocalculator execution"; flags:PA; content: "funguscrack@hotmail.com"; nocase;) 
alert tcp any 110 -> any any (msg:"Virus - Possible eurocalculator.exe file"; content: "filename="; content:"eurocalculator.exe"; nocase;) 
alert tcp any any -> any 110 (msg:"Virus - Possible Pikachu Pokemon Virus"; flags:PA; content:"Pikachu Pokemon"; reference:MCAFEE,98696;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Triplesix Worm"; content: "filename=\"666TEST.VBS\""; nocase; reference:MCAFEE,10389;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Tune.vbs"; content: "filename=\"tune.vbs""; nocase; reference:MCAFEE,10497;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NAIL Worm"; content:"|4D 61 72 6B 65 74 20 73 68 61 72 65 20 74 69 70 6F 66 66|"; reference:MCAFEE,10109;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NAIL Worm"; content: "|6E 61 6D 65 20 3D 22 57 57 49 49 49 21|"; reference:MCAFEE,10109;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NAIL Worm"; content:"|4E 65 77 20 44 65 76 65 6C 6F 70 6D 65 6E 74 73|"; reference:MCAFEE,10109;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NAIL Worm"; content:"|47 6F 6F 64 20 54 69 6D 65 73|"; reference:MCAFEE,10109;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Papa Worm"; content:"filename=\"XPASS.XLS\""; nocase; reference:MCAFEE,10145;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Freelink Worm"; content:"|4C 49 4E 4B 53 2E 56 42 53|"; reference:MCAFEE,10225;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Simbiosis Worm"; content: "filename=\"SETUP.EXE\""; nocase;) 
alert tcp any 110 -> any any (msg:"Virus - Possible BADASS Worm"; content: "|6E 61 6D 65 20 3D 22 42 41 44 41 53 53 2E 45 58 45 22|"; reference:MCAFEE,10388;) 
alert tcp any 110 -> any any (msg:"Virus - Possible ExploreZip.B Worm"; content: "|6E 61 6D 65 20 3D 22 46 69 6C 65 5F 7A 69 70 70 61 74 69 2E 65 78 65 22|"; reference:MCAFEE,10471;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Video Worm"; content: "filename=\"VIDEO.EXE\""; nocase;) 
alert tcp any 110 -> any any (msg:"Virus - Possible wscript.KakWorm"; content: "filename=\"KAK.HTA""; nocase; reference:MCAFEE,10509;) 
alert tcp any 110 -> any any (msg:"Virus - Virus - Possible Suppl Worm"; content:"filename=\"Suppl.doc\""; nocase; reference:MCAFEE,10361;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - theobbq.exe"; content: "filename=\"THEOBBQ.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Word Macro - VALE"; content: "filename=\"MONEY.DOC""; nocase; reference:MCAFEE,10502;) 
alert tcp any 110 -> any any (msg:"Virus - Possible IROK Worm"; content:"filename=\"irok.exe\""; nocase; reference:MCAFEE,98552;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Fix2001 Worm"; content:"filename=\"Fix2001.exe\""; nocase; reference:MCAFEE,10355;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Y2K Zelu Trojan"; content: "filename=\"Y2K.EXE""; nocase; reference:MCAFEE,10505;) 
alert tcp any 110 -> any any (msg:"Virus - Possible The_Fly Trojan"; content: "filename=\"THE_FLY.CHM""; nocase; reference:MCAFEE,10478;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Word Macro - VALE"; content: "filename=\"DINHEIRO.DOC""; nocase; reference:MCAFEE,10502;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Passion Worm"; content: "filename=\"ICQ_GREETINGS.EXE\""; nocase; reference:MCAFEE,10467;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - cooler3.exe"; content: "filename=\"COOLER3.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - party.exe"; content: "filename=\"PARTY.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - hog.exe"; content: "filename=\"HOG.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - goal1.exe"; content: "filename=\"GOAL1.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - pirate.exe"; content: "filename=\"PIRATE.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - video.exe"; content: "filename=\"VIDEO.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - baby.exe"; content: "filename=\"BABY.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - cooler1.exe"; content: "filename=\"COOLER1.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - boss.exe"; content: "filename=\"BOSS.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - g-zilla.exe"; content: "filename=\"G-ZILLA.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible ToadieE-mail Trojan"; content:"filename=\"Toadie.exe\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible PrettyPark Trojan"; content:"\\CoolProgs\\";offset:300;depth:750; reference:MCAFEE,10175;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Happy99 Virus"; content:"X-Spanska\:Yes"; reference:MCAFEE,10144;) 
alert tcp any 110 -> any any (msg:"Virus - Possible CheckThis Trojan"; content:"|6E 61 6D 65 20 3D 22 6C 69 6E 6B 73 2E 76 62 73 22|";) 
alert tcp any 110 -> any any (msg:"Virus - Possible Bubbleboy Worm"; content:"BubbleBoy is back!"; reference:MCAFEE,10418;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - copier.exe"; content: "filename=\"COPIER.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible MyPics Worm"; content: "|6E 61 6D 65 20 3D 22 70 69 63 73 34 79 6F 75 2E 65 78 65 22|"; reference:MCAFEE,10467;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Babylonia - X-MAS.exe"; content: "|6E 61 6D 65 20 3D 22 58 2D 4D 41 53 2E 45 58 45 22|"; reference:MCAFEE,10461;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - gadget.exe"; content: "filename=\"GADGET.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - irnglant.exe"; content: "filename=\"IRNGLANT.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - casper.exe"; content: "filename=\"CASPER.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - fborfw.exe"; content: "filename=\"FBORFW.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - saddam.exe"; content: "filename=\"SADDAM.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - bboy.exe"; content: "filename=\"BBOY.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - monica.exe"; content: "filename=\"MONICA.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - goal.exe"; content: "filename=\"GOAL.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - panther.exe"; content: "filename=\"PANTHER.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - chestburst.exe"; content: "filename=\"CHESTBURST.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - farter.exe"; content: "filename=\"FARTER.EXE\""; nocase; reference:MCAFEE,1054;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Common Sense Worm"; content: "|6E 61 6D 65 20 3D 22 54 48 45 5F 46 4C 59 2E 43 48 4D 22|";) 
alert tcp any 110 -> any any (msg:"Virus - Possible NewApt.Worm - cupid2.exe"; content: "filename=\"CUPID2.EXE\""; nocase; reference:MCAFEE,10540;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Resume Worm"; content: "filename=\"RESUME1.DOC\""; nocase; reference:MCAFEE,98661;) 
alert tcp any 110 -> any any (msg:"Virus - Mail .VBS"; content:"multipart"; content:"name="; content:".vbs"; nocase;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Resume Worm"; content: "filename=\"Explorer.doc\""; nocase; reference:MCAFEE,98661;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Worm -  txt.vbs file"; content: "filename="; content:".txt.vbs"; nocase;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Worm - xls.vbs file"; content: "filename="; content:".xls.vbs"; nocase;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Worm - jpg.vbs file"; content: "filename="; content:".jpg.vbs"; nocase;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Worm -  gif.vbs file"; content: "filename="; content:".gif.vbs"; nocase;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Timofonica Worm"; content: "filename=\"TIMOFONICA.TXT.vbs\""; nocase; reference:MCAFEE,98674;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Resume Worm"; content: "filename=\"NORMAL.DOT\""; nocase; reference:MCAFEE,98661;) 
alert tcp any 110 -> any any (msg:"Virus - Possible Worm - doc.vbs file"; content: "filename="; content:".doc.vbs"; nocase;) 
alert tcp any 110 -> any any (msg:"Virus - Possbile Zipped Files Trojan"; content:"|6E 61 6D 65 20 3D 22 5A 69 70 70 65 64 5F 46 69 6C 65 73 2E 45 58 45 22|"; reference:MCAFEE,10450;) 

# WEB-CGI RULES
# Updated: 03/15/2001
# -------------------

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI webspeed access"; flags: A+; content: "/wsisa.dll/WService="; nocase; content: "WSMadmin"; nocase;reference:arachnids,467;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI yabb access"; flags: A+; content: "/YaBB.pl"; content: "../";reference:arachnids,462;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI wwwboard passwd access"; flags: A+; content: "/wwwboard/passwd.txt"; nocase;reference:arachnids,463;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI webdriver access"; flags: A+; content: "/webdriver"; nocase;reference:arachnids,473;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI whoisraw access"; flags: A+; content: "/whois_raw.cgi?"; content: "|0a|";reference:arachnids,466;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI websitepro path access"; flags: A+; content: " /HTTP/1."; nocase;reference:arachnids,468;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI wrap access"; flags: A+; content: "/cgi-bin/wrap?"; content: "../";reference:arachnids,464;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI webplus version access"; flags: A+; content: "/webplus?about "; nocase;reference:arachnids,470;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI webplus directory trasversal"; flags: A+; content: "/webplus?script"; nocase; content: "../";reference:arachnids,471;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI webgais access"; flags: A+; content: "/webgais"; nocase;reference:arachnids,472;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI websendmail access"; flags: A+; content: "/websendmail"; nocase;reference:arachnids,469;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI windmail access"; flags: A+; content: "/windmail.exe?"; nocase; content: "-n";reference:arachnids,465;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI dcforum.cgi access"; flags: A+; content:"/dcforum.cgi"; flags:a+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI mmstdod.cgi access"; content:"/mmstdod.cgi"; nocase; flags:a+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI anaconda directory transversal attempt"; flags: A+; content:"/apexec.pl"; content:"template=../"; nocase; reference:cve,CVE-2000-0975; reference:bugtraq,2388;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI imagemap overflow attempt"; dsize: >1000; flags: A; content: "/imagemap.exe?"; depth: 32; nocase; reference:arachnids,412;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI infosearch fname"; flags: A+; content: "fname=|";reference:arachnids,290;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI cvsweb.cgi access"; flags: A+; content:"/cvsweb.cgi"; nocase; reference:cve,CVE-2000-0670; reference:bugtraq,1469;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI php access";flags: A+; content:"php.cgi?/"; offset: 5; depth: 32; nocase; reference:arachnids,232;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI glimpse access";flags: A+; content:"/glimpse"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI htmlscript access";flags: A+; content:"/htmlscript"; nocase; reference:cve,CVE-1999-0264;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI info2www access";flags: A+; content:"/info2www"; nocase; reference:cve,CVE-1999-0266;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI maillist.pl access";flags: A+; content:"/maillist.pl"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC nph-test-cgi access";flags: A+; content:"/nph-test-cgi"; nocase; reference:arachnids,224; reference:cve,CVE-1999-0045;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI NPH-publish access";flags: A+; content:"/nph-publish"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI websendmail access";flags: A+; content:"/websendmail"; nocase; reference:cve,CVE-1999-0196;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI perl.exe access";flags: A+; content:"/perl.exe"; nocase; reference:arachnids,219;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI rguest.exe access";flags: A+; content:"/rguest.exe"; nocase; reference:cve,CAN-1999-0467;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI rwwwshell.pl  access";flags: A+; content:"/rwwwshell.pl"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI test-cgi access"; flags: A+; content:"/test-cgi"; nocase; reference:cve,CVE-1999-0070; reference:arachnids,218;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI testcounter.pl access";flags: A+; content:"/textcounter.pl"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI uploader.exe access";flags: A+; content:"/uploader.exe"; nocase;reference:cve,CVE-1999-0177;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI webgais access";flags: A+; content:"/webgais"; nocase; reference:cve,CVE-1999-0176;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI finger access"; flags: A+; content:"/cgi-bin/finger"; nocase; reference:arachnids,221; reference:cve,CVE-1999-0612;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI perlshop.cgi access";flags: A+; content:"/perlshop.cgi"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI pfdisplay.cgi access";flags: A+; content:"/pfdisplay.cgi"; nocase; reference:cve,CVE-1999-0270;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI aglimpse access";flags: A+; content:"/aglimpse"; nocase; reference:cve,CVE-1999-0147;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI anform2 access";flags: A+; content:"/AnForm2"; nocase; reference:cve,CVE-1999-0066; reference:arachnids,225;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI args.bat access";flags: A+; content:"/args.bat"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI AT-admin.cgi access";flags: A+; content:"/AT-admin.cgi"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI bnbform.cgi access";flags: A+; content:"/bnbform.cgi"; nocase; reference:cve,CVE-1999-0937;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI campas access";flags: A+; content:"/campas"; nocase; reference:cve,CVE-1999-0146;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI view-source access";flags: A+; content:"/view-source?../../../../../../../etc/passwd"; nocase;reference:cve,CVE-1999-0174;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI wais.p access";flags: A+; content:"/wais.pl";nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI files.pl access";flags: A+; content:"/files.pl"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI wguest.exe access";flags: A+; content:"/wguest.exe"; nocase; reference:cve,CAN-1999-0467;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI wrap access"; flags: A+; content: "/wrap?/";reference:arachnids,234; reference:cve,CVE-1999-0149;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI classifieds.cgi access";flags: A+; content:"/cgi-bin/classifieds.cgi"; nocase;reference:cve,CVE-1999-0934;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI edit.pl access";flags: A+; content:"/edit.pl"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI environ.cgi access";flags: A+; content:"/environ.cgi"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI faxsurvey access"; flags: A+; content:"/faxsurvey"; nocase; reference:cve,CVE-1999-0262;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI filemail access";flags: A+; content:"/filemail.pl"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI man.sh access";flags: A+; content:"/man.sh"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI snork.bat access";flags: A+; content:"/snork.bat"; nocase; reference:arachnids,220;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI w3-msql access";flags: A+; content:"/w3-msql/"; nocase; reference:cve,CVE-1999-0276; reference:arachnids,210;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI csh access";flags: A+; content:"/csh"; nocase; reference:cve,CAN-1999-0509;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI day5datacopier.cgi access";flags: A+; content:"/day5datacopier.cgi"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI day5datanotifier.cgi access";flags: A+; content:"/day5datanotifier.cgi"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI ksh access";flags: A+; content:"/ksh"; nocase; reference:cve,CAN-1999-0509;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI post-query access";flags: A+; content:"/post-query"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI visadmin.exe access";flags: A+; content:"/visadmin.exe"; nocase; reference:bugtraq,1808; reference:cve,CAN-1999-1970;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI rsh access";flags: A+; content:"/rsh"; nocase; reference:cve,CAN-1999-0509;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI dumpenv.pl access";flags: A+; content:"/dumpenv.pl"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI snorkerz.cmd access";flags: A+; content:"/snorkerz.cmd"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI survey.cgi access";flags: A+; content:"/survey.cgi"; nocase; reference:cve,CVE-1999-0936;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI tsch access";flags: A+; content:"/tcsh"; nocase; reference:cve,CAN-1999-0509;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI scriptalias access"; flags: A+; content: "///"; reference:cve,CVE-1999-0236; reference:arachnids,227;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI w3-msql solaris x86  access"; flags: A+; content: "/bin/shA-cA/usr/openwin"; nocase; reference:cve,CVE-1999-0276; reference:arachnids,211;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI win-c-sample.exe access"; flags: A+; content: "/win-c-sample.exe"; nocase;  reference:arachnids,231; reference:cve,CVE-1999-0178;) 
alert tcp $HTTP_SERVERS 80 -> $EXTERNAL_NET any (msg:"WEB-CGI bugzilla 2.8 exploit "; flags: A+; content: "blaat@blaat.com"; nocase; reference:arachnids,276;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI rksh access";flags: A+; content:"/rksh"; nocase; reference:cve,CAN-1999-0509;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI w2tvars.pm access";flags: A+; content:"/w3tvars.pm"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI admin.pl access";flags: A+; content:"/admin.pl"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI LWGate access";flags: A+; content:"/LWGate"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI archie access";flags: A+; content:"/archie"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI calendar access";flags: A+; content:"/cgi-bin/calendar"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI flexform access";flags: A+; content:"/flexform"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI formmail access";flags: A+; content:"/formmail"; nocase; reference:cve,CVE-1999-0172; reference:arachndis,226;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI bash access";flags: A+; content:"/cgi-bin/bash"; nocase; reference:cve,CAN-1999-0509;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI phf access";flags: A+; content:"/phf";flags: A+; nocase; reference:arachnids,128; reference:cve,CVE-1999-0067; ) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI www-sql access";flags: A+; content:"/www-sql"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI wwwadmin.pl access";flags: A+; content:"/wwwadmin.pl"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI ppdscgi.exe access";flags: A+; content:"/ppdscgi.exe"; nocase; reference:bugtraq,491;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI sendform.cgi access";flags: A+; content:"/sendform.cgi"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI upload.pl access";flags: A+; content:"/upload.pl"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI AnyForm2 access";flags: A+; content:"/AnyForm2"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI MachineInfo access";flags: A+; content:"/MachineInfo"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI bb-hist.sh access";flags: A+; content:"/bb-hist.sh"; nocase; reference:bugtraq,142;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI redirect access";flags: A+; content:"/redirect"; nocase;reference:bugtraq,1179;) 


# WEB-COLDFUSION RULES
# Updated: 03/15/2001
# -------------------

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION cfcache.map access";flags: A+; content:"/cfcache.map"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION exampleapp application.cfm";flags: A+; content:"/cfdocs/exampleapp/email/application.cfm"; nocase;reference:bugtraq,1021;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION application.cfm access";flags: A+; content:"/cfdocs/exampleapp/publish/admin/application.cfm"; nocase;reference:bugtraq,1021;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION getfile.cfm access";flags: A+; content:"/cfdocs/exampleapp/email/getfile.cfm"; nocase;reference:bugtraq,229;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION addcontent.cfm access";flags: A+; content:"/cfdocs/exampleapp/publish/admin/addcontent.cfm"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION administrator access"; content:"/cfide/administrator/index.cfm"; nocase; flags:A+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION datasource username attempt";flags: A+; content:"CF_SETDATASOURCEUSERNAME()"; nocase; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION fileexists.cfm access";flags: A+; content:"/cfdocs/snippets/fileexists.cfm"; nocase; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION exprcalc access";flags: A+; content:"cfdocs/expeval/exprcalc.cfm"; nocase; reference:cve,CVE-1999-0455; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION parks";flags: A+; content:"/cfdocs/examples/parks/detail.cfm"; nocase; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION cfappman access";flags: A+; content:"/cfappman/index.cfm"; nocase; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION beaninfo access";flags: A+; content:"/cfdocs/examples/cvbeans/beaninfo.cfm"; nocase; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION evaluate.cfm access";flags: A+; content:"/cfdocs/snippets/evaluate.cfm"; nocase; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION getodbcdsn access";flags: A+; content:"CFUSION_GETODBCDSN()"; nocase; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION db connections flush attempt";flags: A+; content:"CFUSION_DBCONNECTIONS_FLUSH()"; nocase; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION expeval access";flags: A+; content:"/cfdocs/expeval/"; nocase; reference:bugtraq,550; reference:cve,CAN-1999-0477;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION datasource passwordattempt";flags: A+; content:"CF_SETDATASOURCEPASSWORD()"; nocase; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION datasource attempt";flags: A+; content:"CF_ISCOLDFUSIONDATASOURCE()"; nocase; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION admin encrypt attempt";flags: A+; content:"CFUSION_ENCRYPT()"; nocase; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION displayfile access";flags: A+; content:"/cfdocs/expeval/displayopenedfile.cfm"; nocase; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION getodbcin attempt";flags: A+; content:"CFUSION_GETODBCINI()"; nocase; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION admin decrypt attempt";flags: A+; content:"CFUSION_DECRYPT()"; nocase; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION mainframeset access";flags: A+; content:"/cfdocs/examples/mainframeset.cfm"; nocase; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION set odbc ini attempt";flags: A+; content:"CFUSION_SETODBCINI()"; nocase;reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION settings refresh attempt";flags: A+; content:"CFUSION_SETTINGS_REFRESH()"; nocase;reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION exampleapp access";flags: A+; content:"/cfdocs/exampleapp/"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION verify mai access";flags: A+; content:"CFUSION_VERIFYMAIL()"; nocase; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION snippets attempt attempt"; flags:A+; content:"/cfdocs/snippets/"; nocase; reference:bugtraq,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION cfmlsyntaxcheck.cfm access";flags: A+; content:"/cfdocs/cfmlsyntaxcheck.cfm"; nocase; reference:arachnids,550;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION application.cfm access"; flags: A+; content: "/application.cfm"; nocase; reference:bugtraq,550; reference:arachnids,268; reference:cve,CAN-2000-0189;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION onrequestend.cfm access"; flags: A+; content: "/onrequestend.cfm"; nocase; reference:bugtraq,550; reference:arachnids,269; reference:cve,CAN-2000-0189;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION cfappman access"; content:"/cfappman/index.cfm"; nocase; flags: A+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION startstop DOS access"; content:"/cfide/administrator/startstop.html"; nocase; flags: A+; reference:bugtraq,247;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-COLDFUSION gettempdirectory.cfm access ";flags: A+; content:"/cfdocs/snippets/gettempdirectory.cfm"; nocase; reference:bugtraq,550;) 


# WEB-FRONTPAGE RULES
# Updated: 03/15/2001
# -------------------

alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE _vti_rpc access";flags: A+; content:"/_vti_rpc"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE fpcount.exe access";flags: A+; content:"/fpcount.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE posting"; flags: A+; content:"POST"; content:"/author.dll"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE shtml.dll"; content: "/_vti_bin/shtml.dll"; nocase; flags: A+;reference:arachnids,292;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE contents.htm access";flags: A+; content:"/admcgi/contents.htm"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE orders.htm access";flags: A+; content:"/_private/orders.htm"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE fpsrvadm.exe access";flags: A+; content:"/fpsrvadm.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE fpremadm.exe access";flags: A+; content:"/fpremadm.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE fpadmin.htm access";flags: A+; content:"/admisapi/fpadmin.htm"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE fpadmcgi.exe access";flags: A+; content:"/scripts/Fpadmcgi.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE orders.txt access";flags: A+; content:"/_private/orders.txt"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE form_results access";flags: A+; content:"/_private/form_results.txt"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE registrations.htm access";flags: A+; content:"/_private/registrations.htm"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE cfgwiz.exe access";flags: A+; content:"/cfgqiz.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE authors.pwd access";flags: A+; content:"/authors.pwd"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE author.exe access";flags: A+; content:"/_vti_bin/_vti_aut/author.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE administrators.pwd";flags: A+; content:"/administrators.pwd"; nocase;reference:bugtraq,1205;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE form_results.htm access";flags: A+; content:"/_private/form_results.htm"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE access.cnf access";flags: A+; content:"/_vti_pvt/access.cnf"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE register.txt access";flags: A+; content:"/_private/register.txt"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE registrations.txt access";flags: A+; content:"/_private/registrations.txt"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE service.cnf access";flags: A+; content:"/_vti_pvt/service.cnf"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE service.pwd";flags: A+; content:"/service.pwd"; nocase;reference:bugtraq,1205;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE service.stp access";flags: A+; content:"/_vti_pvt/service.stp"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE services.cnf access";flags: A+; content:"/_vti_pvt/services.cnf"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE shtml.exe";flags: A+; content:"/_vti_bin/shtml.exe"; nocase; reference:cve,CAN-2000-0413; reference:cve,CAN-2000-0709; reference:bugtraq,1608; reference:bugtraq,1174;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE svcacl.cnf access";flags: A+; content:"/_vti_pvt/svcacl.cnf"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE users.pwd access";flags: A+; content:"/users.pwd"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE writeto.cnf access";flags: A+; content:"_vti_pvt/writeto.cnf"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE fourdots request"; flags: A+; content: "|2e 2e 2e 2e 2f|"; nocase; reference:arachnids,248;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE dvwssr.dll access"; flags: A+; content: "/dvwssr.dll"; nocase; reference:cve,CVE-2000-0260; reference:arachnids,271;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-FRONTPAGE register.htm access";flags: A+; content:"/_private/register.htm"; nocase;) 


# WEB-IIS RULES
# Updated: 03/15/2001
# -------------------

alert tcp $EXTERNAL_NET 80 -> $HTTP_SERVERS any (msg:"WEB-IIS global-asa access";flags: A+; content:"global.asa"; nocase;) 
alert tcp $EXTERNAL_NET 80 -> $HTTP_SERVERS any (msg:"WEB-MISC Attempt to execute cmd"; flags: A+; content:"cmd.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS showcode access"; content:"/Sites/Knowledge/Membership/Inspired/ViewCode.asp"; flags: A+; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS JET VBA access";flags: A+; content:"/scripts/samples/ctguestb.idc"; nocase; reference:bugtraq,286; reference:cve,CVE-1999-0874;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS msadc/msadcs.dll access";flags: A+; content:"/msadc/msadcs.dll"; nocase;reference:bugtraq,529;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS JET VBA access";flags: A+; content:"/scripts/samples/details.idc"; nocase; reference:bugtraq,286; reference:cve,CVE-1999-0874;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS site server config access";flags: A+; content:"/adsamples/config/site.csc"; nocase;reference:bugtraq,256;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS jet vba access";flags: A+; content:"/advworks/equipment/catalog_type.asp"; nocase; reference:bugtraq,286; reference:cve,CVE-1999-0874;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS query.asp access";flags: A+; content:"/issamples/query.asp"; nocase; reference:bugtraq,193;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS carbo.dll access";flags: A+; content:".carbo.dll"; content:"icatcommand="; nocase;reference:bugtraq,2126;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS newdsn.exe access";flags: A+; content:"/scripts/tools/newdsn.exe"; nocase;reference:bugtraq,1818;reference:cve,CVE-1999-0191;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS codebrowser access"; content:"/selector/showcode.asp"; flags: A+; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS showcode access"; content:"/Sites/Knowledge/Membership/Inspiredtutorial/ViewCode.asp"; flags: A+; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS showcode access"; content:"/Sites/Samples/Knowledge/Membership/Inspiredtutorial/ViewCode.asp"; flags: A+; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS showcode access"; content:"/Sites/Samples/Knowledge/Push/ViewCode.asp"; flags: A+; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS showcode access"; content:"/Sites/Samples/Knowledge/Search/ViewCode.asp"; flags: A+; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS showcode access"; content:"/SiteServer/Publishing/viewcode.asp"; flags: A+; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS cross-site scripting attempt"; content:"Form_JScript.asp"; nocase; flags:A+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS iisadmpwd attempt";flags: A+; content:"/iisadmpwd/aexp"; nocase; reference:bugtraq,2110; reference:cve,CVE-2000-0303;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS anot.htr access";flags: A+; content:"/iisadmpwd/anot"; nocase; reference:bugtraq,2110; reference:cve,CAN-1999-0407;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS achg.htr access";flags: A+; content:"/iisadmpwd/achg.htr"; nocase;reference:bugtraq,2110;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS directory listing"; content:"/ServerVariables_Jscript.asp"; nocase; flags:A+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS bdir.ht access"; content:"/bdir.htr"; nocase; flags:A+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS viewcode.asp access"; content:"/viewcode.asp"; nocase; flags:a+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS .cnf access"; content:".cnf"; nocase; flags:a+;) 
alert tcp $HTTP_SERVERS 80 -> $EXTERNAL_NET any (msg:"WEB-IIS Unauthorized IP Access Attempt"; flags: A+; content:"403"; content:"Forbidden\:";) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS view source via translate header"; flags: A+; content: "Translate|3a| F"; nocase;reference:arachnids,305;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS del attempt";flags: A+; content:"&del+/s+c|3a|\\*.*"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS codebrowser SDK access";flags: A+; content:"/iissamples/sdk/asp/docs/codebrws.asp"; nocase;reference:bugtraq,167;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS codebrowser Exair access";flags: A+; content:"/iissamples/exair/howitworks/codebrws.asp"; nocase; reference:cve,CVE-1999-0499;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS cmd? acess";flags: A+; content:".cmd?&"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS CGImail.exe access";flags: A+; content:"/scripts/CGImail.exe"; nocase; reference:cve,CAN-2000-0726; reference:bugtraq,1623;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS exec-src access";flags: A+; content:"#filename=*.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS adctest.asp access";flags: A+; content:"/msadc/samples/adctest.asp"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS bdir access";flags: A+; content:"/scripts/iisadmin/bdir.htr"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS .bat? access";flags: A+; content:".bat?&"; nocase; reference:cve,CVE-1999-0233;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS asp-srch attempt";flags: A+; content:"#filename=*.asp"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS asp-dot attempt";flags: A+; content:".asp."; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS .asp$data access";flags: A+; content:".asp|3a3a|$data"; nocase; reference:cve,CVE-1999-0278;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS admin.dll access";flags: A+; content:"/scripts/iisadmin/ism.dll?http/dir"; nocase;reference:bugtraq,189;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS fpcount access";flags: A+; content:"/scripts/fpcount.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS admin access";flags: A+; content:"/scripts/iisadmin"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS scripts-browse";flags: A+; content:"/scripts/|20|"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS _vti_inf access";flags: A+; content:"_vti_inf.html"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS *.idc attempt";flags: A+; content:"*.idc"; nocase; reference:cve,CVE-1999-0874;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS admin-default access";flags: A+; content:"/scripts/iisadmin/default.htm"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS srch.htm access";flags: A+; content:"/samples/isapi/srch.htm"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS  ASP contents view"; flags: A+; content:"%20&CiRestriction=none&CiHiliteType=Full HTTP/1.0";reference:bugtraq,1084;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS ASP contents view"; flags: A+; content:"GET /null.htw?CiWebHitsFile"; reference:bugtraq,1861;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS ism.dll attempt"; flags: A+; content:"%20%20%20%20%20.htr"; nocase;reference:bugtraq,1193;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS index server file sourcecode attempt"; flags: A+; content:"?CiWebHitsFile=/"; content:"&CiRestriction=none&CiHiliteType=Full";) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS webhits access"; content: ".htw"; flags: A+; dsize: >400;reference:arachnids,237;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS encoding access"; flags: A+; content: "|25 31 75|";  reference:arachnids,200;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS fpcount.exe DOS attempt"; flags: A+; content:"/fpcount.exe"; content:"Digits=-"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS getdrvs.exe access";flags: A+; content:"/scripts/tools/getdrvs.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS ..\.. access";flags: A+; content:"|2e2e5c2e2e|"; reference:cve,CAN-1999-0229;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS perl-browse20 attempt";flags: A+; content:"%20.pl"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS srchadm access";flags: A+; content:"/srchadm"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS getdrvrs access";flags: A+; content:"/scripts/tools/getdrvrs.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS showcode.asp access";flags: A+; content:"/selector/showcode.asp"; nocase; reference:cve,CAN-1999-0736;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS search97.vts";flags: A+; content:"/search97.vts";reference:bugtraq,162;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS SAM Attempt";flags: A+; content:"sam._"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS %2E-asp access";flags: A+; content:"%2e.asp"; nocase; reference:cve,CAN-1999-0253;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS perl-browse0a attempt";flags: A+; content:"%0a.pl"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS perl access";flags: A+; content:"/scripts/perl?"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS Overflow-htr access";flags: A+; content:"BBBB.htrHTTP"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS MSProxy access";flags: A+; content:"/scripts/proxy/w3proxy.dll"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS isc$data attempt";flags: A+; content:".idc|3a3a|$data"; nocase;reference:cve,CVE-1999-0874;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS idc-srch attempt";flags: A+; content:"#filename=*.idc"; nocase; reference:cve,CVE-1999-0874;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-IIS uploadn.asp access";flags: A+; content:"/scripts/uploadn.asp"; nocase;) 


# WEB-MISC RULES
# Updated: 03/15/2001
# -------------------

alert tcp $EXTERNAL_NET 80 -> $HTTP_SERVERS any (msg:"WEB-MISC ftp attempt";flags: A+; content:"ftp.exe"; nocase;) 
alert tcp $EXTERNAL_NET 80 -> $HTTP_SERVERS any (msg:"WEB-MISC enumdsn attempt";flags: A+; content:"xp_enumdsn"; nocase;) 
alert tcp $EXTERNAL_NET 80 -> $HTTP_SERVERS any (msg:"WEB-MISC filelist attempt";flags: A+; content:"xp_filelist"; nocase;) 
alert tcp $EXTERNAL_NET 80 -> $HTTP_SERVERS any (msg:"WEB-MISC availablemedia attempt";flags: A+; content:"xp_availablemedia"; nocase;) 
alert tcp $EXTERNAL_NET 80 -> $HTTP_SERVERS any (msg:"WEB-MISC cmdshell attempt";flags: A+; content:"xp_cmdshell"; nocase;) 
alert tcp $EXTERNAL_NET 80 -> $HTTP_SERVERS any (msg:"WEB-MISC nc.exe attempt";flags: A+; content:"nc.exe"; nocase;) 
alert tcp $EXTERNAL_NET 80 -> $HTTP_SERVERS any (msg:"WEB-MISC csh attempt";flags: A+; content:"csh.exe"; nocase;) 
alert tcp $EXTERNAL_NET 80 -> $HTTP_SERVERS any (msg:"WEB-MISC wsh attempt";flags: A+; content:"wsh.exe"; nocase;) 
alert tcp $EXTERNAL_NET 80 -> $HTTP_SERVERS any (msg:"WEB-MISC rcmd attempt";flags: A+; content:"rcmd.exe"; nocase;) 
alert tcp $EXTERNAL_NET 80 -> $HTTP_SERVERS any (msg:"WEB-MISC telnet attempt";flags: A+; content:"telnet.exe"; nocase;) 
alert tcp $EXTERNAL_NET 80 -> $HTTP_SERVERS any (msg:"WEB-MISC net attempt";flags: A+; content:"net.exe"; nocase;) 
alert tcp $EXTERNAL_NET 80 -> $HTTP_SERVERS any (msg:"WEB-MISC tftp attempt";flags: A+; content:"tftp.exe"; nocase;) 
alert tcp $EXTERNAL_NET 80 -> $HTTP_SERVERS any (msg:"WEB-MISC regread attempt";flags: A+; content:"xp_regread"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC webdav search access"; flags: A+; content: "SEARCH "; depth: 8; nocase;reference:arachnids,474;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC .htpasswd access"; flags:A+; content:".htpasswd"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Lotus Domino directory traversal"; content:".nsf/"; nocase; flags:A+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC webhits.exe access";flags: A+; content:"/scripts/samples/search/webhits.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC fpadmcgi.exe access";flags: A+; content:"/scripts/fpadmcgi.exe"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC postinfo.asp access";flags: A+; content:"/scripts/postinfo.asp"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC repost.asp access";flags: A+; content:"/scripts/repost.asp"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC queryhit.htm access";flags: A+; content:"/samples/search/queryhit.htm"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC counter.exe access";flags: A+; content:"/scripts/counter.exe"; nocase; reference:bugtraq,267;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC webdav propfind access"; flags: A+; content: "PROPFIND "; nocase;reference:arachnids,475;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC unify eWave ServletExec upload"; content:"(com.unify.servletexec.UploadServlet"; nocase; flags:a+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC netscape servers suite DOS"; flags: A+; content:"/dsgw/bin/search?context="; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC amazon 1-click cookie theft"; flags: A+; content:"ref%3Cscript%20language%3D%22Javascript"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC unify eWave ServletExec DOS"; flags: A+; content:"/servlet/ServletExec";) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Allaire JRUN DOS attempt"; flags: A+; content:"servlet/......."; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC PHP strings overflow"; flags: A+; content: "|ba49feffff f7d2 b9bfffffff f7d1|";reference:arachnids,431;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC PHP strings overflow"; flags: A+; content: "?STRENGUR ";reference:arachnids,430;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC whisker splice attack"; dsize: <5; flags: A+; content: "|09|";reference:arachnids,415;) 
alert tcp $HOME_NET 80 -> $EXTERNAL_NET any (msg:"WEB-MISC Invalid URL"; content:"Invalid URL"; nocase; flags:A+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC eXtropia webstore directory traversal"; flags: A+; content:"web_store.cgi"; content:"page=../"; reference:bugtraq,1774;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC shopping cart directory traversal"; flags: A+; content:"shop.cgi"; content:"page=../"; reference:bugtraq,1777;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Allaire Pro Web Shell attempt"; flags: A+; content:"authenticate.cgi?PASSWORD"; content:"config.ini";) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC ICQ Webfront HTTP DOS"; flags: A+; content:"??????????";) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Armada Style Master Index directory traversal"; flags: A+; content:"/search.cgi?keys"; content:"catigory=../";) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC moreover shopping cart directory traversal"; flags: A+; content:"/cached_feed.cgi"; content:"../"; reference:bugtraq,1762;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC webstore directory traversal"; content:"/web_store.cgi?page=../.."; flags:A+;) 
alert tcp $HTTP_SERVERS 80 -> $EXTERNAL_NET any (msg:"WEB-MISC 403 Forbidden";flags: A+; content:"HTTP/1.1 403";) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Talentsoft Web+ Source Code view access";flags: A+; content:"/webplus.exe?script=test.wml";reference:bugtraq,1722;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Talentsoft Web+ internal IP Address access";flags: A+; content:"/webplus.exe?about";reference:bugtraq,1720;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Talentsoft Web+ exploit access"; flags: A+; content:"/webplus.cgi?Script=/webplus/webping/webping.wml"; reference:bugtraq,1725;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC SmartWin CyberOffice Shopping Cart access";flags: A+; content:"_private/shopping_cart.mdb"; reference:bugtraq,1734;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC cybercop scan";flags: A+; content:"get /cybercop"; nocase; reference:arachnids,374;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC L3retriever HTTP Probe"; content: "User-Agent|3a| Java1.2.1|0d0a|"; flags: A+;reference:arachnids,310;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Webtrends HTTP probe"; content: "User-Agent|3a| Webtrends Security Analyzer|0d0a|"; flags: A+;reference:arachnids,309;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Nessus 404 probe"; flags: A+; content: "GET /nessus_is_probing_you_"; depth: 32;reference:arachnids,301;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC netscape admin passwd"; flags: A+; content:"/admin-serv/config/admpw"; nocase;reference:bugtraq,1579;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC whisker splice attack"; content: "|20|"; flags: A+; dsize: 1;reference:arachnids,296;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC BigBrother access"; flags: A+; content:"/bb-hostsvc.sh?HOSTSVC"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Poll-it access"; flags: A+; content:"/pollit/Poll_It_SSI_v2.0.cgi?"; nocase;reference:bugtraq,1431;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC ftp.pl access"; flags: A+; content:"/ftp.pl?"; nocase;reference:bugtraq,1471;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC tomcat server snoop access"; flags: A+; content:"/jsp/snp/anything.snp"; nocase; reference:bugtraq,1532;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC ROXEN directory list attempt"; flags: A+; content:"|2F 25 30 30 2F|"; nocase;reference:bugtraq,1510; reference:cve,CVE-2000-0671;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC apache source.asp file access"; flags: A+; content:"/site/eg/source.asp"; nocase;reference:bugtraq,1457; reference:cve, CVE-2000-0628;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC tomcat server exploit access"; flags: A+; content:"/contextAdmin/contextAdmin.html"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC http directory traversal"; flags: A+; content: "..\\";reference:arachnids,298;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC http directory traversal"; flags: A+; content: "../"; reference:arachnids,297;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC prefix-get //";flags: A+; content:"get //"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC ICQ webserver DOS";flags: A+; content:".html/......"; nocase; reference:cve,CVE-1999-0474;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Lotus DelDoc attempt";flags: A+; content:"?DeleteDocument"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Lotus EditDoc attempt";flags: A+; content:"?EditDocument"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC ls%20-l";flags: A+; content:"ls%20-l"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC mlog.phtml access";flags: A+; content:"/mlog.phtml?"; nocase; reference:bugtraq,713; reference:cve,CVE-1999-0346;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC mylog.phtml access";flags: A+; content:"/mylog.phtml?"; nocase; reference:bugtraq,713; reference:cve,CVE-1999-0346;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC O'Reilly args.bat access";flags: A+; content:"/cgi-dos/args.bat"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC /etc/passwd";flags: A+; content:"/etc/passwd"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC PageService access";flags: A+; content:"?PageServices"; nocase; reference:cve,CVE-1999-0269;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Ecommerce check.txt access";flags: A+; content:"/config/check.txt"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC webcart access";flags: A+; content:"/webcart/"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC AuthChangeUr accessl";flags: A+; content:"_AuthChangeUrl?"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC convert.bas access";flags: A+; content:"/scripts/convert.bas"; nocase; reference:cve,CVE-1999-0175;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC cpshost.dll access";flags: A+; content:"/scripts/cpshost.dll"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC .htaccess access";flags: A+; content:".htaccess"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC .wwwacl access";flags: A+; content:"/secure/.wwwacl"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 457 (msg:"WEB-MISC netscape unixware overflow"; content: "|eb 5f 9a ff ff ff ff 07 ff c3 5e 31 c0 89 46 9d|"; flags: A+; reference:arachnids,180;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 80 (msg:"SCAN cybercop os probe"; content: "AAAAAAAAAAAAAAAA"; flags: SFP; ack: 0; depth: 16;reference:arachnids,145;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Phorum admin access"; flags: A+; content:"/admin.php3"; nocase; reference:arachnids,205;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC O'Reilly win-c-sample.exe access";flags: A+; content:"/cgi-shl/win-c-sample.exe"; nocase;reference:cve,CVE-1999-0178;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC cd..";flags: A+; content:"cd.."; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Phorum auth access"; flags: A+; content:"PHP_AUTH_USER=boogieman"; nocase;  reference:arachnids,206;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Cisco Web DOS attempt"; flags: A+; content: "|20 2F 25 25|"; depth: 16; reference:arachnids,275;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC whisker head";flags: A+; content:"HEAD/./";) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC guestbook.cgi access";flags: A+; content:"/cgi-bin/guestbook.cgi"; nocase; reference:cve,CVE-1999-0237; reference:arachnids,228;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC handler access"; flags: A+; content:"/handler"; nocase;  reference:arachnids,235; reference:cve,CVE-1999-0148;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC /....";flags: A+; content:"|2f2e2e2e2e|";) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC ///cgi-bin";flags: A+; content:"///cgi-bin"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC ~root";flags: A+; content:"~root"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Ecommerce import.txt access";flags: A+; content:"/config/import.txt"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC cat%20 access";flags: A+; content:"/cat%20"; nocase; reference:bugtraq,374;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Ecommerce import.txt access";flags: A+; content:"/orders/import.txt"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-CGI bin/// access";flags: A+; content:"/cgi-bin///"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC count.cgi access";flags: A+; content:"/count.cgi"; nocase; reference:cve,CVE-1999-0021;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Domino catalog.ns access";flags: A+; content:"/catalog.nsf"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Domino domcfg.nsf access";flags: A+; content:"/domcfg.nsf"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Domino domlog.nsf access";flags: A+; content:"/domlog.nsf"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Domino log.nsf access";flags: A+; content:"/log.nsf"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Domino names.nsf access";flags: A+; content:"/names.nsf"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Ecommerce checks.txt access";flags: A+; content:"/orders/checks.txt"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC apache DOS attempt";flags: A+; content:"|2f2f2f2f2f2f2f2f|";) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC wrap access"; content:"/cgi-bin/wrap"; nocase; flags: A+; reference:cve,CVE-1999-0149;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC netscape PublishingXpert 2 Exploit"; flags: A+; content:"/PSUser/PSCOErrPage.htm?"; nocase;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC windmail.exe access"; flags:A+; content:"/windmail.exe?-n"; content:"mail"; nocase; reference:cve,CAN-2000-0242; reference:bugtraq,1073;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC webplus access"; content:"webplus?script"; nocase; flags:A+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC netscape dir index wp"; flags: A+; content: "?wp-"; nocase; reference:arachnids,270;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC piranha passwd.php3 access"; flags: A+; content: "/passwd.php3"; reference:arachnids,272;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC cart 32 AdminPwd access"; flags: A+; content:"/c32web.exe/ChangeAdminPassword"; nocase;reference:bugtraq,1153;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC webdist.cgi access"; content:"/cgi-bin/webdist.cgi"; nocase; flags: A+; reference:cve,CVE-1999-0039;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC shopping cart access access"; content:"/quikstore.cfg"; nocase; flags: A+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC novell groupwise gwweb.exe access"; flags: A+; content:"/GWWEB.EXE?HELP="; nocase; reference:bugtraq,879; reference:cve,CAN-1999-1006;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC ws_ftp.ini access"; content:"/ws_ftp.ini"; nocase; flags: A+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC rpm_query access"; flags: A+; content:"/cgi-bin/rmp_query"; nocase; reference:cve,CVE-2000-0192; reference:bugtraq,1036;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC mall log order access"; content:"/mall_log_files/order.log"; nocase; flags: A+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC cfappman access access"; content:"/cfappman/index.cfm"; nocase; flags: A+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC whisker head"; dsize: > 512; flags:A+; content:"|68 65 61 64|"; offset: 0; depth: 4;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC whisker head"; content:"HEAD"; offset: 0; depth: 4; nocase; dsize:>512; flags:A+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC bigconf.cgi access"; content:"/bigconf.cgi"; nocase; flags: A+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC architext_query.pl access"; content:"/ews/architext_query.pl"; nocase; flags: A+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC /cgi-bin/jj attempt"; content:"/cgi-bin/jj"; nocase; flags: A+; reference:cve,CVE-1999-0260;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC wwwboard.pl access"; content:"/cgi-bin/wwwboard.pl"; nocase; flags: A+; reference:cve,CVE-1999-0953;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC order.log access"; content:"/admin_files/order.log"; nocase; flags: A+;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC netscape enterprise server directory view"; flags: A+; content:"?wp-verify-link";nocase;reference:bugtraq,1063;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Phorum read access"; flags: A+; content:"/read.php3"; nocase;  reference:arachnids,208;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Phorum violation access"; flags: A+; content:"/violation.php3"; nocase;  reference:arachnids,209;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 2301 (msg:"WEB-MISC compaq nsight directory traversal"; content: "../";  reference:arachnids,244; reference:cve,CVE-1999-0771;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC get32.exe access"; flags: A+; content: "/get32.exe"; nocase; reference:arachnids,258;;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Annex Terminal DOS attempt"; flags: A+;dsize:>1446; content:"/ping?query"; reference:arachnids,260;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC cgitest.exe attempt"; content: "/cgitest.exe|0d0a|user"; nocase; flags: A+; offset: 4; reference:arachnids,265;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC netscape enterprise server directory view"; flags: A+; content:"?wp-cs-dump";nocase;reference:bugtraq,1063;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC netscape enterprise server directory view"; flags: A+; content:"?wp-ver-info";nocase;reference:bugtraq,1063;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC bizdbsearch access"; flags: A+; content:"/bizdb1-search.cgi"; content:"mail"; nocase;reference:bugtraq,1104;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC netscape enterprise server directory view"; flags: A+; content:"?wp-ver-diff";nocase;reference:bugtraq,1063;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC SalesLogix Eviewer web shutdown acess"; flags: A+; content:"/slxweb.dll/admin?command="; nocase; reference:bugtraq,1089; reference:cve,CAN-2000-0289;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC netscape enterprise server directory view"; flags: A+; content:"?wp-start-ver";nocase;reference:bugtraq,1063;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC netscape enterprise server directory view"; flags: A+; content:"?wp-stop-ver"; nocase;reference:bugtraq,1063;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC netscape enterprise server directory view"; flags: A+; content:"?wp-uncheckout"; nocase;reference:bugtraq,1063;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC netscape enterprise server directory view"; flags: A+; content:"?wp-html-rend"; nocase;reference:bugtraq,1063;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Trend Micro OfficeScan access"; flags: A+; content:"/officescan/cgi/jdkRqNotify.exe?"; nocase; reference:bugtraq,1057;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC oracle web listener batch access"; flags: A+; content:"/ows-bin/&"; nocase; reference:cve,CVE-2000-0169; reference:bugtraq,1053;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Sojourn File access"; flags: A+; content:"/sojourn.cgi?cat="; content:"%00"; nocase;reference:bugtraq,1052;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC SGI InfoSearch fname access"; flags: A+; content:"/infosrch.cgi?"; content:"fname="; nocase;reference:bugtraq,1031;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC Phorum code access"; flags: A+; content:"/code.php3"; nocase;  reference:arachnids,207;) 
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS 80 (msg:"WEB-MISC netscape enterprise server directory view"; flags: A+; content:"?wp-usr-prop";nocase;reference:bugtraq,1063;) 


# X11 RULES
# Updated: 03/15/2001
# -------------------

alert tcp $EXTERNAL_NET any -> $HOME_NET 6000 (msg:"X11 MITcookie"; flags: A+; content: "MIT-MAGIC-COOKIE-1"; reference:arachnids,396;) 
alert tcp $EXTERNAL_NET any -> $HOME_NET 6000 (msg:"X11 xopen"; flags: A+; content: "|6c00 0b00 0000 0000 0000 0000|"; reference:arachnids,395;) 
alert tcp $EXTERNAL_NET 6000:6005 -> $HOME_NET any (msg:"X11 outgoing"; flags: SA; reference:arachnids,126;) 


