#
# $Id: emerging.rules $
# Emerging Threats rules. 
#
# SID's are 2000000+ to avoid conflicts
#
# More information available at www.emergingthreats.net
#
# Please submit any custom rules or ideas to threats@emergingthreats.net or the emerging-sigs mailing list
#
#*************************************************************
#  Copyright (c) 2003-2009, Emerging Threats
#  All rights reserved.
#  
#  Redistribution and use in source and binary forms, with or without modification, are permitted provided that the 
#  following conditions are met:
#  
#  * Redistributions of source code must retain the above copyright notice, this list of conditions and the following 
#    disclaimer.
#  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the 
#    following disclaimer in the documentation and/or other materials provided with the distribution.
#  * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived 
#    from this software without specific prior written permission.
#  
#  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES, 
#  INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 
#  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 
#  SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 
#  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 
#  WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE 
#  USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
#
#
#by Veererendra
# 10/11/2008 Activation Key Malware - Trojan horse
alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET CURRENT_EVENTS Recovery KEYS for your account Trojan Email Trojan Inbound"; flow:established,to_server; content:"|0d 0a|Subject\: Recovery KEYS for your account"; nocase; content:"The_Keys.zip"; nocase; classtype:trojan-activity; reference:url,www.sophos.com/blogs/gc/g/2008/11/04/spammed-out-personal-account-keys-contain-trojan-horse/; reference:url,www.sophos.com/blogs/gc/g/2008/11/06/activation-key-malware-morphs-its-disguise/; sid:2008773; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET CURRENT_EVENTS Recovery KEYS for your account Trojan Email Trojan Inbound (2)"; flow:established,to_server; content:"|0d 0a|Subject\: Recovery KEYS for your account"; nocase; content:"new_activation_keys.zip"; nocase; classtype:trojan-activity; reference:url,www.sophos.com/blogs/gc/g/2008/11/04/spammed-out-personal-account-keys-contain-trojan-horse/; reference:url,www.sophos.com/blogs/gc/g/2008/11/06/activation-key-malware-morphs-its-disguise/; sid:2008774; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET CURRENT_EVENTS Recovery KEYS for your account Trojan Email Trojan Inbound (2)"; flow:established,to_server; content:"|0d 0a|Subject\: Recovery KEYS for your account"; nocase; content:"active_key.zip"; nocase; classtype:trojan-activity; reference:url,www.sophos.com/blogs/gc/g/2008/11/04/spammed-out-personal-account-keys-contain-trojan-horse/; reference:url,www.sophos.com/blogs/gc/g/2008/11/06/activation-key-malware-morphs-its-disguise/; sid:2008775; rev:1;)

#by Veerendra GG
# To be removed about sep 15 if the attacks have passed
alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET CURRENT_EVENTS Airmail Express Malware-Laden Email Inbound"; flow:established,to_server; content:"|0d 0a|Subject\: Airmail Tracking number #"; pcre:"/ number #\d{6,}\.zip/i"; classtype:trojan-activity; reference:url,www.sophos.com/blogs/gc/g/2008/09/01/email-with-the-subject-airmail; reference:url,www.news.portalit.net/fullnews_airmail-express-delivers-fresh-trojan_1506.html; sid:2008539; rev:1;)

#by Jack pepper
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Internal User may have Visited an ASPROX Infected Site"; flow:established,from_server; content:"<script "; nocase; content:"src=http\://"; within:10; nocase; content:".js>"; within:40; nocase; pcre:"/script *src=http\:\/\/.*\/(ngg|js|b|fgg|1|a|f)\.js/i"; classtype:trojan-activity; sid:2008508; rev:4;)

#matt jonkman
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Asprox Cookie SQL Injection Attempt"; flow:established,to_server; content:"POST "; depth:5; content:"|0d 0a|Cookie\: start=S end=Z%3BDECLARE"; within:100; reference:url,isc.sans.org/diary.html?n&storyid=5092; classtype:web-application-attack; sid:2008599; rev:1;)

#by Kevin Ross
alert tcp $HOME_NET any -> 67.15.94.80 $HTTP_PORTS (msg:"ET CURRENT_EVENTS Possible Downadup/Conficker-A Worm Activity"; flow:to_server,established; uricontent:"/GeoIP.dat.gz"; classtype:trojan-activity; reference:url,www.microsoft.com/security/portal/Entry.aspx?Name=Worm%3aWin32%2fConficker.A; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_a.shtml; sid:2008802; rev:2;)
alert tcp $HOME_NET any -> [75.126.138.202,72.249.118.38,208.78.69.70,204.13.249.70,208.78.68.70] $HTTP_PORTS (msg:"ET CURRENT_EVENTS Possible Downadup/Conficker-A Infection Checking Geographical Location"; flow:to_server; classtype:trojan-activity; reference:url,www.microsoft.com/security/portal/Entry.aspx?Name=Worm%3aWin32%2fConficker.A; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_a.shtml; threshold:type both, count 5, seconds 60, track by_src; sid:2008803; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Downadup/Conficker-A Worm Download Attempt From Dates 25/11-01/12 2008"; flow:to_server,established; uricontent:"/search?q="; uricontent:"&aq=7"; classtype:trojan-activity; reference:url,www.microsoft.com/security/portal/Entry.aspx?Name=Worm%3aWin32%2fConficker.A; reference:url,www.f-secure.com/v-descs/worm_w32_downadup_a.shtml; sid:2008804; rev:4;)

#by many very smart people
# This may be a high load sig. Take time and seriously consider 
# that your dns_servers var is set as narrowly as possible
alert udp any 53 -> $DNS_SERVERS any (msg:"ET CURRENT_EVENTS Excessive DNS Responses with 1 or more RR's (100+ in 10 seconds) - possible Cache Poisoning Attempt"; byte_test:2,>,0,6; byte_test:2,>,0,10; threshold: type both, track by_src, count 100, seconds 10; classtype:bad-unknown; sid:2008446; rev:8;)

#this will catch large numbers of nxdomain replies, a sign that someone may be trying to poison you
#alert udp any 53 -> $HOME_NET any (msg:"ET CURRENT_EVENTS Excessive NXDOMAIN responses - Possible DNS Poisoning Attempt Backscatter"; byte_test:1,&,128,2; byte_test:1,&,1,3; byte_test:1,&,2,3; threshold: type both, track by_src, count 100, seconds 10; classtype:bad-unknown; sid:2008470; rev:2;)
#by Greg Martin at Econet
alert udp any 53 -> $HOME_NET any (msg:"ET CURRENT_EVENTS DNS Query Responses with 3 RR's set (50+ in 2 seconds) - possible NS RR Cache Poisoning Attempt"; content: "|85 00 00 01 00 01 00 01|"; offset: 2; within: 8; threshold: type both, track by_src,count 50, seconds 2; classtype:bad-unknown; reference:url,infosec20.blogspot.com/2008/07/kaminsky-dns-cache-poisoning-poc.html; sid:2008447; rev:4;)
alert udp any 53 -> $HOME_NET any (msg:"ET CURRENT_EVENTS DNS Query Responses with 3 RR's set (50+ in 2 seconds) - possible A RR Cache Poisoning Attempt"; content: "|81 80 00 01 00 01 00 01|"; offset: 2; within: 8; threshold: type both, track by_src, count 50, seconds 2; classtype:bad-unknown; reference:url,infosec20.blogspot.com/2008/07/kaminsky-dns-cache-poisoning-poc.html; sid:2008475; rev:1;)

#by Jack Pepper. Should be removed in a week or so
alert udp $HOME_NET any -> $DNS_SERVERS 53 (msg:"ET CURRENT_EVENTS Danmec Infected machine Looking up CnC Server"; content:"|04|www0|08|douhunqn|02|cn"; nocase; classtype:trojan-activity; sid:2008530; rev:2;)

#by Will Metcalf
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Malware (e-card.exe)"; flow:to_server,established; content:"GET "; depth:4; uricontent:"/e-card.exe"; nocase;classtype:trojan-activity; reference:url,garwarner.blogspot.com/2008/08/e-cards-run-wild-where-are-anti-virus.html; sid:2008528; rev:1;)

#by Veerendra at secpod.org
# 16/09/2008 Nuclear Email Malware Attack
alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET CURRENT_EVENTS Nuclear Email Malware Inbound - Likely Trojan"; flow:established,to_server; content:"|0d 0a|Subject\: Reply\: A report on radiation contamination of Canada"; nocase; content:"victims.zip"; nocase; classtype:trojan-activity; reference:url,www.sophos.com/blogs/gc/g/2008/09/11/nuclear-email; reference:url,www.computerweekly.com/Articles/2008/09/12/232290/london-nuclear-explosion-in-malware-spam-campaign.htm; sid:2008554; rev:1;)

# 16/09/2008 Internet Trojan
alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET CURRENT_EVENTS Your internet access is going to get suspended Email Inbound - Likely Trojan"; flow:established,to_server; content:"|0d 0a|Subject\: Your internet access"; nocase; content:"suspended"; nocase; pcre:"/[\w\d]+activities.zip/i"; classtype:trojan-activity; reference:url,www.sophos.com/blogs/gc/g/2008/09/12/your-internet-access; reference:url,blog.mxlab.be/2008/09/11/your-internet-access-is-going-to-get-suspended-virus/; reference:url,blog.threatfire.com/2008/09/your-internet-access-is-going-to-get.html; reference:url,forum.bitdefender.com/index.php?showtopic=7861; sid:2008555; rev:1;)

#by Chandan, for the recent worm spreading
# 08/08/2008 New Facebook Malware
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Likely Facebook Malware Download (picture_dl.exe)"; flow:to_server,established; content:"GET "; depth:5; uricontent:"/picture_dl.exe"; nocase; classtype:trojan-activity;reference:url,www.sophos.com/security/blog/2008/08/1632.html; sid:2008498; rev:1;)

#by matt jonkman
# fake email for MS Updates results in a trojan that uses this fake UA
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Trojan resulting from Fake MS Updates Email Login to CnC"; flow:established,to_server; content:" HTTP/1.0|0d 0a|User-Agent\: Mozilla/4.0 (compatible\; MSIE 6.0\; Windows XP 2600.xpsp.9786-27197)|0d 0a|"; classtype:trojan-activity; reference:url,isc.sans.org/diary.html?storyid=5159; sid:2008646; rev:2;)

#by Kevin Ross
alert tcp $HOME_NET any -> $EXTERNAL_NET 7777 (msg:"ET CURRENT_EVENTS Possible Malicious Flash Update"; flow:to_server,established; uricontent:"/dt"; classtype:trojan-activity; reference:url,isc.sans.org/diary.html?storyid=5437; sid:2008845; rev:2;)

#by Chandan at secpod
# 15/09/2008 Malware Word doc
alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"ET CURRENT_EVENTS Malware Word doc Email - Fordo Trojan Likely"; flow:established,to_server; content:"|0d 0a|Subject\: Rechnung"; pcre:"/Rechnung\.(zip|doc)/i"; classtype:trojan-activity; reference:url,www.virustotal.com/analisis/0fc3a70eff0b9ec447794acbda2402e7; reference:url,isc.sans.org/diary.html?storyid=5029; sid:2008552; rev:1;)

#by Philipp Bescht
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Likely Trojan-Downloader.Win32.Homles.br (/17PHolmes.cmt)"; flow:established,to_server; uricontent:"/17PHolmes.cmt"; classtype:trojan-activity; sid:2008394; rev:1;)

#by Joshua Gimer
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible XML 0-day for Internet Explorer Exploitation Attempt"; flow:established,from_server; content:"document.write('<XML ID=I>"; nocase; classtype:web-application-attack; reference:url,isc.sans.org/diary.html?storyid=5458; sid:2008876; rev:3;)

#by matt jonkman, re sllwrnm2.cn/a1/ss.htm
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Possible XML 0-day for Internet Explorer Exploitation Attempt (obfuscation 1)"; flow:established,from_server; content:"|7c|XML|7c 7c|if|7c|SPAN|7c|navigator|7c|CDATA|7c|http|7c|com|7c|w2k3|7c|appVersion|7c|version|7c|nt|7c 7c|X|7c|MSIE|7c|wxp|7c|114|7c|HTML|7c|DATAFLD|7c|DATASRC|7c|DATAFORMATAS|7c|ID|7c|while|7c|2003|7c|"; classtype:web-application-attack; reference:url,isc.sans.org/diary.html?storyid=5458; sid:2008877; rev:2;)


#by Daniel Clemens
alert ip $HOME_NET any -> [85.131.154.44,85.131.154.45] any (msg:"ET CURRENT_EVENTS Communication with known iamleet.be Botnet CnC Server"; threshold:type limit, track by_src, seconds 3600, count 1; classtype:trojan-activity; sid:2008286; rev:1;)

#by Daniel Clemens
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS KernelBot/MS08-067 related Trojan Checkin"; flow:established,to_server; content:"GET "; depth:4; uricontent:"/kernel/zz.htm?"; uricontent:"Ver="; classtype:trojan-activity; sid:2008737; rev:3;)

#by David Wharton
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Suspicious Accept-Language HTTP Header, zh-cn, likely Kernelbot Trojan Related"; flow:established,to_server; content:"|0d 0a|Accept-Language|3A| zh|2D|cn"; flowbits:set,ET.ms08067_header; flowbits:noalert; classtype:not-suspicious; sid:2008738; rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS MS08-067 Worm Traffic Outbound"; flowbits:isset,ET.ms08067_header; flow:established,to_server; content:"If-None-Match|3A| |22|60794|2D|12b3|2D|e4169440|22|"; nocase; classtype:trojan-activity; sid:2008739; rev:2;)

#research by Daniel Clemens and mcafee
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Win32.Kernelbot Second Stage Infection Download"; flow:established,to_server;content:"GET "; depth:4;  uricontent:"/kernel/zz.htm?"; uricontent:"Ver="; classtype:trojan-activity; sid:2008799; rev:1;)

alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"ET CURRENT_EVENTS MSSQL sp_replwritetovarbin - potential memory overwrite case 1"; flow:to_server,established; content:"s|00|p|00|_|00|r|00|e|00|p|00|l|00|w|00|r|00|i|00|t|00|e|00|t|00|o|00|v|00|a|00|r|00|b|00|i|00|n"; nocase; classtype:attempted-user; reference:url,archives.neohapsis.com/archives/fulldisclosure/2008-12/0239.html; sid:2008909; rev:1;)
alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"ET CURRENT_EVENTS MSSQL sp_replwritetovarbin - potential memory overwrite case 2"; flow:to_server,established; content:"sp_replwritetovarbin"; nocase; classtype:attempted-user; reference:url,archives.neohapsis.com/archives/fulldisclosure/2008-12/0239.html; sid:2008910; rev:1;)

#by Chandan at Secpod
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any ( msg:"ET CURRENT_EVENTS Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download (1)"; flow:to_client,established; content:"clsid"; nocase; content:"F0E42D50-368C-11D0-AD81-00A0C90DC8D9"; nocase; pcre:"/(SnapshotPath|CompressedPath|PrintSnapshot)/i"; pcre:"/(exe|bat|com|dll|ini)/i"; reference:bugtraq,30114; reference:url,downloads.securityfocus.com/vulnerabilities/exploits/30114.html;reference:url,pstgroup.blogspot.com/2008/07/exploitmicrosoft-office-snapshot-viewer.html; classtype:web-application-attack; sid:2008407; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any ( msg:"ET CURRENT_EVENTS Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download (2)"; flow:to_client,established; content:"clsid"; nocase; content:"F0E42D60-368C-11D0-AD81-00A0C90DC8D9"; nocase; pcre:"/(SnapshotPath|CompressedPath|PrintSnapshot)/i"; pcre:"/(exe|bat|com|dll|ini)/i"; reference:bugtraq,30114; reference:url,downloads.securityfocus.com/vulnerabilities/exploits/30114.html;reference:url,pstgroup.blogspot.com/2008/07/exploitmicrosoft-office-snapshot-viewer.html; classtype:web-application-attack; sid:2008408; rev:1;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any ( msg:"ET CURRENT_EVENTS Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download (3)"; flow:to_client,established; content:"clsid"; nocase; content:"F2175210-368C-11D0-AD81-00A0C90DC8D9"; nocase; pcre:"/(SnapshotPath|CompressedPath|PrintSnapshot)/i"; pcre:"/(exe|bat|com|dll|ini)/i"; reference:bugtraq,30114; reference:url,downloads.securityfocus.com/vulnerabilities/exploits/30114.html;reference:url,pstgroup.blogspot.com/2008/07/exploitmicrosoft-office-snapshot-viewer.html; classtype:web-application-attack; sid:2008409; rev:1;)

#new mac dns changer trojan. Not a lot of detail yet, but this will catch the UA
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Mac DNS Changer Trojan UA Detected"; flow:established,to_server; uricontent:"cgi-bin/generator.pl"; content:"|0d 0a|User-Agent\: "; content:"\;typeofrun\;7777\;"; distance:3; within:30; classtype:trojan-activity; sid:2008796; rev:1;)

#by matt jonkman, re http://www.incidents.org/diary.html?storyid=4405
#  Mass File Injection attacks
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Client Visiting Possibly Compromised Site (HaCKeD By BeLa & BodyguarD)"; flow:established,from_server; content:"HaCKeD By BeLa & BodyguarD"; content:".js"; reference:url,www.incidents.org/diary.html?storyid=4405; classtype:web-application-attack; sid:2008206; rev:1;)
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Possible File Injection Compromise (HaCKeD By BeLa & BodyguarD)"; flow:established,to_server; content:"HaCKeD By BeLa & BodyguarD"; reference:url,www.incidents.org/diary.html?storyid=4405; classtype:web-application-attack; sid:2008207; rev:1;)

#many sources
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS CVE-2008-2992 Adobe Reader PDF Exploit Related Malware Checkin"; flow:established,to_server; uricontent:"/get.php?src="; content:"|0d 0a|User-Agent\: Mozilla/4.0 (compatible\; Win32\; WinHttp.WinHttpRequest.5)"; classtype:trojan-activity; sid:2008741; rev:1;)

#by kevin ross
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET CURRENT_EVENTS Unknown Roundcube Vulnerability Scan"; flow:to_server,established; content:"GET /roundcube//bin/msgimport HTTP/1.1"; content:"Toata dragostea mea pentru diavola"; classtype:attempted-recon; offset:30; reference:url,isc.sans.org/diary.html?storyid=5599; sid:2008960; rev:1;)

# New variant by Frank Knobbe
# GET /roundcube/bin/msgimport   /rc/bin/msgimport   /bin/msgimport    /mail/bin/msgimport    /webmail/bin/msgimport
# and GET /nonexistenshit
# Just using /bin/msgimport for simplicity
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET CURRENT_EVENTS Unknown Roundcube Vulnerability Scan Variant 2"; flow:to_server,established; uricontent:"/bin/msgimport"; nocase; classtype:attempted-recon; reference:url,isc.sans.org/diary.html?storyid=5599; sid:2008990; rev:1;)
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET CURRENT_EVENTS Unknown Roundcube Vulnerability Scan Variant 2 Error Check"; flow:to_server,established; uricontent:"/nonexistenshit"; nocase; classtype:attempted-recon; reference:url,isc.sans.org/diary.html?storyid=5599; sid:2008991; rev:1;)

#by Michael Sconzo of ERCOT
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Iframe in Purported Image Download (jpeg) - Likely SQL Injection Attacks Related"; flow:established,from_server; content:"|0d 0a|content-type\: "; nocase; content:" image/jpeg"; nocase; distance:0; within:30; content:"<iframe"; nocase; distance:0; pcre:"/content-type\:\s+image\/jpeg/im"; pcre:"/<iframe.*?src.*?>.*?</iframe>/im"; classtype:web-application-attack; sid:2008313; rev:2;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Iframe in Purported Image Download (gif) - Likely SQL Injection Attacks Related"; flow:established,from_server; content:"|0d 0a|content-type\: "; nocase; content:" image/gif"; nocase; distance:0; within:30; content:"<iframe"; nocase; distance:0; pcre:"/content-type\:\s+image\/gif/im"; pcre:"/<iframe.*?src.*?>.*?</iframe>/im"; classtype:web-application-attack; sid:2008314; rev:2;)
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET CURRENT_EVENTS Iframe in Purported Image Download (png) - Likely SQL Injection Attacks Related"; flow:established,from_server; content:"|0d 0a|content-type\: "; nocase; content:" image/png"; nocase; distance:0; within:30; content:"<iframe"; nocase; distance:0; pcre:"/content-type\:\s+image\/png/im"; pcre:"/<iframe.*?src.*?>.*?</iframe>/im"; classtype:web-application-attack; sid:2008315; rev:2;)

#Greg Martin
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS ASPROX Infected Site - ngg.js Request"; flow:established,to_server; uricontent:"/ngg.js"; classtype:trojan-activity; reference:url,infosec20.blogspot.com/; sid:2008373; rev:1;)

#by Jack Pepper
alert tcp $HOME_NET $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible ASPROX Hostile JS Being Served by a Local Webserver (/ngg.js)"; flow:established,from_server; content:"<script src=http\://"; nocase; content:"/ngg.js>"; within:50; classtype:trojan-activity; sid:2008387; rev:2;)
alert tcp $HOME_NET $HTTP_PORTS -> $EXTERNAL_NET any (msg:"ET CURRENT_EVENTS Possible ASPROX Hostile JS Being Served by a Local Webserver (/b.js)"; flow:established,from_server; content:"<script src=http\://"; nocase; content:"/b.js>"; within:50; classtype:trojan-activity; sid:2008388; rev:2;)

#by jeremy at sudosecure
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Possible Storm Worm EXE Request (postcard.exe)"; flow:established,to_server; content:"GET "; depth:4; uricontent:"/postcard.exe"; nocase; classtype:trojan-activity; reference:url,www.sudosecure.net/archives/146; reference:url,www.us-cert.gov/current/index.html#new_storm_worm_varient_spreading; reference:url,www.us-cert.gov/current/archive/2008/07/29/archive.html#new_storm_worm_activity_spreading; reference:url,www.sophos.com/security/blog/2008/07/1599.html; sid:2008077; rev:16;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Possible Storm Worm EXE Request (bof)"; flow:established,to_server; content:"GET "; depth:4; uricontent:"/load.php|3F|bof"; nocase; classtype:trojan-activity; reference:url,www.sudosecure.net/archives/119; sid:2008235; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Possible Storm Worm EXE Request (Trojan Downloader User Agent)"; flow:established,to_server; content:"|0d 0a|User-Agent\: Mozilla/4.0 (compatible\; MSIE 6.0\; Windows NT 5.1\; SV1921)|0d 0a|"; classtype:trojan-activity; reference:url,www.sudosecure.net/archives/67; sid:2008193; rev:1;)

#by Victor Julien
# Just testing to see if it works well. lots of bad stuff use this uri and an IP
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Suspicious Download (drv32.data)"; flow:established,to_server; content:"GET "; offset:0; depth:4; uricontent:"/drv32.data"; content:"|0d 0a|Host|3a|"; classtype:trojan-activity; sid:2008014; rev:2;)

#putting this in current events to see how badly it falses. 
# Looking for a simple thing, but the pws's use this pretty reliably, and hopefully it's not too common in the real world
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS TROJAN PWS-OnlineGames or variant Checkin"; flow:established,to_server; content:"GET "; depth:4; uricontent:"/help.rar"; classtype:trojan-activity; reference:url,www.threatexpert.com/reports.aspx?find=help.rar; sid:2008948; rev:1;)

#by Pedro Marinho, re 58816f781154bda381fdcb1e3fab7bdd
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Unnamed - kuaiche.com related"; flow:established,to_server; content:"GET "; depth:4; uricontent:"/config/fgun_install_"; content:"|0d 0a|User-Agent\: NSI SDL/1.2 (Mozilla)|0d 0a|"; classtype:trojan-activity; sid:2008359; rev:2;)

#different trojan, by marcus at unsober
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET TROJAN Unknown Keylogger checkin"; flow:established; content:"GET"; depth:4; uricontent:"?mail="; uricontent:"subject=Keylogger"; uricontent:"&body="; content:"|0d 0a|User-Agent\: Mozilla/4.0 (compatible\; MSIE 6.0\; Windows NT 5.1\; SV1)"; nocase; classtype:trojan-activity; sid:2008368; rev:1;)


#Another unknown, needs a name. Sig by Pedro Marinho
alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET TROJAN Unknown Initial Checkin"; flow:established,to_server; dsize:<5; content:"id="; depth:3; flowbits:noalert; flowbits:set,ET.unknid; classtype:trojan-activity; sid:2008496; rev:1;) 
alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET TROJAN Unknown Checkin"; flowbits:isset,ET.unknid; flow:established,to_server; dsize:100<>200; content:"&idate="; content:"&os="; content:"&wmid="; content:"&msg="; classtype:trojan-activity; sid:2008497; rev:1;)


# Unknown handshake over SMTP discovered by Thierry Chich and reported on mail list. Added by Frank Knobbe 2008-09-17.
alert tcp $HOME_NET any -> $EXTERNAL_NET 25 (msg:"ET Suspicious SMTP handshake outbound"; flow:established,to_server; content:"001 RUTHERE"; depth:11; classtype:unknown; sid:2008562; rev:1;)
alert tcp $EXTERNAL_NET 25 -> $HOME_NET any (msg:"ET Suspicious SMTP handshake reply"; flow:established,from_server; content:"701 IMHERE"; depth:10; classtype:unknown; sid:2008563; rev:1;)

#by Victor Julien
alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET CURRENT_EVENTS Unknown Keepalive out"; flow:established,to_server; dsize:5; content:"|17 24 1B 00 00|"; flowbits:isnotset,ET.teamviewerkeepaliveout; flowbits:set,ET.unknownkeepaliveup; flowbits:noalert; classtype:unknown; sid:2008779; rev:3;)
alert tcp $EXTERNAL_NET 1024: -> $HOME_NET any (msg:"ET CURRENT_EVENTS Unknown Keepalive in"; flow:established,to_client; dsize:5; content:"|17 24 1B 00 00|"; flowbits:isnotset,ET.teamviewerkeepaliveout; flowbits:isset,ET.unknownkeepaliveup; classtype:unknown; sid:2008780; rev:3;)

#by matt jonkman
alert udp $HOME_NET any -> $DNS_SERVERS 53 (msg:"ET CURRENT_EVENTS Infected System Looking up chr.santa-inbox.com CnC Server"; content:"|03|chr|0b|santa-inbox|03|com"; nocase; classtype:trojan-activity; sid:2008531; rev:1;)