Snort ™ Got Source? Our Team About Snort License The Open Source Network Intrusion Detection System hosted by Sourcefire

Snort Training From the masters of snort Looking for Snort training? How about learning from the masters, Sourcefire? Sourcefire is offering two training classes for Snort users, a two day class on Building and Operating Snort and a two day class on Snort Rules. Resources » News   Get the latest news about our favorite pig » Documentation   Information on how to setup the pig » Downloads   Get the pig, and all addons that make the pig easier to use » Mailing lists   Discussions about snort. » User Groups   Like minded pig lovers getting together to discuss snort. » Rules   All the information about rules you could ever want. Search Ports Rules Documentation

Snort Signature Database By SID By Message GEN:SID 1:1854 Message DDOS Stacheldraht handler->agent niggahbitch Rule alert icmp $EXTERNAL_NET any <> $HOME_NET any (msg:"DDOS Stacheldraht handler->agent niggahbitch"; icmp_id:9015; itype:0; content:"niggahbitch"; reference:url,staff.washington.edu/dittrich/misc/stacheldraht.analysis; classtype:attempted-dos; sid:1854; rev:7;) Summary Varient of Stacheldraht DDOS tool Impact Likely you have a compromised machine and your machine is being used as a ddos zombie. Detailed Information This signature is based on traffic caught in the wild. Stracheldraht is a Distributed denial of service tool normally found on Sun Solaris machines. It is made up of a Client, handler and agent. The clients connects to the handler. Handlers can connect with up to 1000 agents. Communication between the client and the handler is conducted using tcp and the communication between the handler and the agent can be either tcp or icmp_echoreply. This signature detects the a message sent from the handler to the agent. This traffic differs from the traffic described on http://staff.washington.edu/dittrich/misc/stacheldraht.analysis because the packets have an icmp id of 9015 rather than 1000 as noted in the analysis. Affected Systems   Attack Scenarios The agent can be used to mount a distributed denial of service attack. It also means that a machine is compromised. Ease of Attack   False Positives Should not be any. If you think this rule has a false positives, please help fill it out. False Negatives The icmp id along with the keywords may be changed in the source code to hide this traffic from beng detected If you think this rule has a false negatives, please help fill it out. Corrective Action Take the machine off line asap and rebuild with a completely new install. Contributors Original rule writer unknown Original document author unkown Sourcefire Vulnerability Research Team Nigel Houghton <nigel.houghton@sourcefire.com> Ian Macdonald Additional References   Rule References url: staff.washington.edu/dittrich/misc/stacheldraht.analysis

Copyright © 2002, 2003, 2004 Brian Caswell and Marty Roesch. All rights reserved. Sourcefire and Snort are Trademarks or Registered Trademarks of Sourcefire, INC. Patents Pending Last Updated Mon Sep 13 02:07:34 EDT 2004