github.com/rvaralda/deis@v1.4.1/router/firewall/scanner.rules (about) 1 2 ########################################################################## 3 # 4 # doxi_rulesets - rules fo nginx+naxsi 5 # desc : SCAN 6 # file : scanner.rules 7 # created : 2014-09-28 - 12:29 8 # by : nginx-goodies 9 # download : https://bitbucket.org/lazy_dogtown/doxi-rules 10 # 11 ########################################################################### 12 13 # 14 # sid: 42000395 | date: 2014-09-25 - 17:03 15 # 16 # https://gist.github.com/anonymous/929d622f3b36b00c0be1 17 # https://www.virustotal.com/en/file/73b0d95541c84965fa42c3e257bb349957b3be626dec9d55efcc6ebcba6fa489/analysis/1411634118/ 18 # 19 MainRule "str:thanks-rob" "msg:Bash0day - Scan-Attempt" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8" id:42000395 ; 20 21 22 # 23 # sid: 42000394 | date: 2014-09-25 - 10:27 24 # 25 # http://blog.erratasec.com/2014/09/bash-shellshock-scan-of-internet.html 26 # 27 MainRule "str:shellshock-scan" "msg:Shellshock-Masscan by Erratasec" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8" id:42000394 ; 28 29 30 # 31 # sid: 42000390 | date: 2014-09-23 - 20:50 32 # 33 # https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play 34 # 35 MainRule "str:/gatedesc.xml" "msg:UPNP-Scan" "mz:URL" "s:$UWA:8" id:42000390 ; 36 37 38 # 39 # sid: 42000389 | date: 2014-09-23 - 20:49 40 # 41 # http://en.wikipedia.org/wiki/Proxy_auto-config 42 # 43 MainRule "str:wpad.dat" "msg:Open Proxy-Autoconfig-Scan" "mz:URL" "s:$UWA:8" id:42000389 ; 44 45 46 # 47 # sid: 42000388 | date: 2014-09-23 - 20:49 48 # 49 # http://en.wikipedia.org/wiki/Proxy_auto-config 50 # https://isc.sans.edu/forums/diary/Web+Scan+looking+for+infowhitelistpac/18675 51 # 52 MainRule "str:proxy.pac" "msg:Open Proxy-Autoconfig-Scan" "mz:URL" "s:$UWA:8" id:42000388 ; 53 54 55 # 56 # sid: 42000387 | date: 2014-09-23 - 20:49 57 # 58 # https://isc.sans.edu/forums/diary/Web+Scan+looking+for+infowhitelistpac/18675 59 # 60 MainRule "str:/whitelist.pac" "msg:Open Proxy-Autoconfig-Scan" "mz:URL" "s:$UWA:8" id:42000387 ; 61 62 63 # 64 # sid: 42000366 | date: 2014-04-24 - 09:57 65 # 66 # 67 # 68 MainRule "str:openvas" "msg:OpenVAS - Scanner" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000366 ; 69 70 71 # 72 # sid: 42000365 | date: 2014-04-24 - 09:54 73 # 74 # 75 # 76 MainRule "str:sitelock" "msg:SiteLock Vulnerability Scanner" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000365 ; 77 78 79 # 80 # sid: 42000364 | date: 2014-04-24 - 09:54 81 # 82 # 83 # 84 MainRule "str:sucuri" "msg:Sucuri Vulnerability Scaner" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000364 ; 85 86 87 # 88 # sid: 42000363 | date: 2014-04-24 - 09:52 89 # 90 # http://www.botopedia.org/index.php?option=com_k2&view=item&id=350:scanalert-bot 91 # 92 MainRule "str:scanalert" "msg:ScanAlert Vulnerability Scaner" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000363 ; 93 94 95 # 96 # sid: 42000362 | date: 2014-04-24 - 09:46 97 # 98 # 99 # 100 MainRule "str:.bash" "msg:Bash-Profile et al Scan" "mz:URL" "s:$UWA:8" id:42000362 ; 101 102 103 # 104 # sid: 42000361 | date: 2014-04-19 - 17:19 105 # 106 # 107 # 108 MainRule "str:java/" "msg:JAVA-UA, possible Scanner" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000361 ; 109 110 111 # 112 # sid: 42000339 | date: 2014-04-07 - 16:28 113 # 114 # 115 # 116 MainRule "str:/wp-content/themes/" "msg:WP-Content Themes-Scan" "mz:URL" "s:$UWA:8" id:42000339 ; 117 118 119 # 120 # sid: 42000338 | date: 2013-12-03 - 00:06 121 # 122 # http://www.reddit.com/r/netsec/comments/1rrftk/optimizepress_wordpress_theme_0day_found_actively/ 123 # http://www.osirt.com/2013/11/wordpress-optimizepress-hack-file-upload-vulnerability/ 124 # 125 MainRule "str:/wp-content/uploads/optpress/" "msg:WP-OptimizePress - Scan" "mz:URL" "s:$UWA:8" id:42000338 ; 126 127 128 # 129 # sid: 42000336 | date: 2013-11-27 - 22:19 130 # 131 # http://www.exploit-db.com/exploits/29859/ 132 # 133 MainRule "str:/login.rol" "msg:Apache Roller-Scan" "mz:URL" "s:$UWA:8" id:42000336 ; 134 135 136 # 137 # sid: 42000328 | date: 2013-10-21 - 09:05 138 # 139 # 140 # 141 MainRule "str:/ip_checkhost.cgi" "msg:GestioIP Remote Code Execution - Scan" "mz:URL" "s:$UWA:8" id:42000328 ; 142 143 144 # 145 # sid: 42000326 | date: 2014-03-19 - 01:52 146 # 147 # https://github.com/robertdavidgraham/masscan 148 # http://blog.erratasec.com/search/label/masscan 149 # http://blog.erratasec.com/2013/09/masscan-entire-internet-in-3-minutes.html 150 # 151 MainRule "str:masscan/" "msg:MASSCAN - UA Detected" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000326 ; 152 153 154 # 155 # sid: 42000323 | date: 2013-10-12 - 00:21 156 # 157 # http://www.vbulletin.org/forum/showthread.php?p=2443431 158 # 159 MainRule "str:/core/install/" "msg:vBulletinBoard-Scan " "mz:URL" "s:$UWA:8" id:42000323 ; 160 161 162 # 163 # sid: 42000319 | date: 2013-10-04 - 21:26 164 # 165 # http://localhost.re/p/whmcs-527-vulnerability 166 # 167 MainRule "str:/register.php" "msg:Possible WHMCS - Scan" "mz:URL" "s:$UWA:8" id:42000319 ; 168 169 170 # 171 # sid: 42000317 | date: 2013-09-27 - 16:11 172 # 173 # http://pastebin.com/NP64hTQr 174 # http://blog.initiative-s.de/2013/09/kompromitierte-wordpress-blogs-werden-fuer-ddos-attacken-genutzt/ 175 # 176 MainRule "str:wordpress/" "msg:Wordpress-UA, probably Botnet-Attack" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000317 ; 177 178 179 # 180 # sid: 42000316 | date: 2013-09-20 - 21:07 181 # 182 # http://isc.sans.edu/diary/Arrays+in+requests%2C+PHP+and+DedeCMS/16625 183 # 184 MainRule "str:winhttprequest" "msg:WinHttpRequest - UA" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000316 ; 185 186 187 188 # 189 # sid: 42000312 | date: 2013-09-04 - 20:44 190 # 191 # 192 # 193 MainRule "str:havij" "msg:Havij-SQL_scanner" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000312 ; 194 195 196 # 197 # sid: 42000311 | date: 2013-09-04 - 20:41 198 # 199 # http://superuser.com/questions/146133/what-is-apache-synapse 200 # 201 MainRule "str:synapse" "msg:poss. malicious Scanner using Fake UA Apache/Synapse" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000311 ; 202 203 204 # 205 # sid: 42000310 | date: 2013-08-23 - 21:56 206 # 207 # et: from the list aug 23 2013 208 # 209 MainRule "str:http://http://" "msg:Abnormal double http:// in HTTP header," "mz:HEADERS" "s:$UWA:8" id:42000310 ; 210 211 212 # 213 # sid: 42000309 | date: 2013-08-22 - 15:46 214 # 215 # 216 # 217 MainRule "rx:^/http" "msg:Misformed Proxy-Scan" "mz:URL" "s:$UWA:8" id:42000309 ; 218 219 220 # 221 # sid: 42000307 | date: 2013-08-13 - 23:30 222 # 223 # inspired by http://ceriksen.com/2013/01/12/wordpress-floating-social-media-link-plugins-remote-file-inclusion/ 224 # 225 MainRule "str:/wp-content/plugins/" "msg:WP-Contents/Plugins Access" "mz:URL" "s:$UWA:8" id:42000307 ; 226 227 228 # 229 # sid: 42000306 | date: 2013-08-11 - 10:37 230 # 231 # http://stateofsecurity.com/?p=467 232 # 233 MainRule "str:/soapcaller.bs" "msg:Morfeus - F*cking-Scanner " "mz:URL" "s:$UWA:8" id:42000306 ; 234 235 236 # 237 # sid: 42000305 | date: 2013-08-09 - 09:03 238 # 239 # http://www.sourcesec.com/Lab/dlink_hnap_captcha.pdf 240 # 241 MainRule "str:/hnap1/" "msg:Possible HNAP-Exploit-Attempt" "mz:URL" "s:$UWA:8" id:42000305 ; 242 243 244 # 245 # sid: 42000304 | date: 2013-08-05 - 15:33 246 # 247 # http://www.botsvsbrowsers.com/details/515320/index.html 248 # http://www.spambotsecurity.com/forum/viewtopic.php?f=9&t=814 249 # 250 MainRule "str:windows-live-social-object-extractor-engine" "msg:Spambot Windows-Live-Social-Object-Extractor-Engine" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000304 ; 251 252 253 # 254 # sid: 42000300 | date: 2013-08-04 - 22:38 255 # 256 # 257 # 258 MainRule "str:exec%20master%2e%2esp%5fconfigure" "msg:SQLNinja Attempt To Recreate xp_cmdshell Using sp_configure" "mz:URL|BODY|ARGS" "s:$UWA:8" id:42000300 ; 259 260 261 # 262 # sid: 42000273 | date: 2013-07-12 - 13:05 263 # 264 # et: https://lists.emergingthreats.net/pipermail/emerging-sigs/2013-July/022356.html 265 # 266 MainRule "str:/arachni" "msg:Arachni Web Scan (URL)" "mz:URL" "s:$ATTACK:8" id:42000273 ; 267 268 269 # 270 # sid: 42000272 | date: 2013-07-12 - 12:55 271 # 272 # et: 2014869 273 # 274 MainRule "str:arachni" "msg:Arachni Scanner Web Scan (UA)" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8" id:42000272 ; 275 276 277 # 278 # sid: 42000266 | date: 2013-06-10 - 13:50 279 # 280 # 281 # 282 MainRule "str:.idea/workspace.xml" "msg:IDE - workspace.xml - Scan" "mz:URL" "s:$UWA:8" id:42000266 ; 283 284 285 # 286 # sid: 42000258 | date: 2013-02-23 - 11:25 287 # 288 # et 2015703 289 # 290 MainRule "str:brutus/" "msg:Brutus - Scanner" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000258 ; 291 292 293 # 294 # sid: 42000256 | date: 2013-02-23 - 11:11 295 # 296 # et 2002667 297 # 298 MainRule "str:/sumthin" "msg:Sumthin Scan" "mz:URL" "s:$UWA:8" id:42000256 ; 299 300 301 # 302 # sid: 42000255 | date: 2013-02-23 - 11:10 303 # 304 # et 2010720 305 # 306 MainRule "str:/thisdoesnotexist" "msg:PHP Scan Precursor" "mz:URL" "s:$ATTACK:8" id:42000255 ; 307 308 309 # 310 # sid: 42000251 | date: 2013-02-23 - 11:02 311 # 312 # et: 2009029 313 # 314 MainRule "str:nv32ts" "msg:SQL-Injection-Scanner NV32ts" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8" id:42000251 ; 315 316 317 # 318 # sid: 42000249 | date: 2013-02-23 - 10:31 319 # 320 # et 2003616 321 # 322 MainRule "str:datacha0s" "msg:Webserver-Scanner DataCha0s" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8" id:42000249 ; 323 324 325 # 326 # sid: 42000248 | date: 2013-02-23 - 10:26 327 # 328 # et: 2011174 329 # 330 MainRule "str:czxt2s" "msg:SQL-Injection Scanner CZxt2s" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8" id:42000248 ; 331 332 333 334 335 # 336 # sid: 42000241 | date: 2013-02-08 - 12:21 337 # 338 # 339 # 340 MainRule "str:/mysqldumper " "msg:MysqlDumper - Scanner " "mz:URL" "s:$UWA:8" id:42000241 ; 341 342 343 # 344 # sid: 42000240 | date: 2013-01-27 - 16:24 345 # 346 # 347 # 348 MainRule "str:apachebench" "msg:AB - ApacheBenchmark-Tool detected" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:4" id:42000240 ; 349 350 351 # 352 # sid: 42000238 | date: 2013-01-19 - 17:56 353 # 354 # 355 # 356 MainRule "str:sqlspider" "msg:NMAP SQLSpider-Scan" "mz:URL|ARGS|$HEADERS_VAR:User-Agent" "s:$ATTACK:8" id:42000238 ; 357 358 359 # 360 # sid: 42000227 | date: 2013-01-03 - 20:32 361 # 362 # 363 # 364 MainRule "str:zmeu" "msg:Scanner ZmEu exploit scanner" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000227 ; 365 366 367 # 368 # sid: 42000226 | date: 2013-01-03 - 20:32 369 # 370 # 371 # 372 MainRule "str:mozilla/4.0 (compatible; msie 6.0; windows nt 5.0; myie2" "msg:Scanner WITOOL SQL Injection Scan" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000226 ; 373 374 375 # 376 # sid: 42000225 | date: 2013-01-03 - 20:30 377 # 378 # 379 # 380 MainRule "str:/actsensepostnottherenonotive" "msg:Wikto Backend Data Miner Scan" "mz:URL" "s:$UWA:8" id:42000225 ; 381 382 383 # 384 # sid: 42000224 | date: 2013-01-03 - 20:30 385 # 386 # 387 # 388 MainRule "str:/.adsensepostnottherenonobook" "msg:Scanner Wikto Scan" "mz:URL" "s:$UWA:8" id:42000224 ; 389 390 391 # 392 # sid: 42000223 | date: 2013-01-03 - 20:29 393 # 394 # 395 # 396 MainRule "str:webshag" "msg:Scanner WebShag Web Application Scan" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000223 ; 397 398 399 # 400 # sid: 42000222 | date: 2013-01-03 - 20:29 401 # 402 # 403 # 404 MainRule "str:webcollage" "msg:Open-Proxy ScannerBot (webcollage-UA) " "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000222 ; 405 406 407 # 408 # sid: 42000221 | date: 2013-01-03 - 20:28 409 # 410 # 411 # 412 MainRule "str:python-httplib" "msg:Scanner Python-httplib" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:4" id:42000221 ; 413 414 415 # 416 # sid: 42000220 | date: 2013-01-03 - 20:28 417 # 418 # 419 # 420 MainRule "str:whcc/" "msg:Scanner WebHack Control Center" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000220 ; 421 422 423 # 424 # sid: 42000218 | date: 2013-01-03 - 20:26 425 # 426 # 427 # 428 MainRule "str:/<invalid>hello.html" "msg:Scanner WafWoof Web Application Firewall Detection Scan" "mz:URL" "s:$UWA:8" id:42000218 ; 429 430 431 # 432 # sid: 42000217 | date: 2013-01-03 - 20:24 433 # 434 # 435 # 436 MainRule "str:/manager/html/upload" "msg:Tomcat upload from external source" "mz:URL" "s:$UWA:8" id:42000217 ; 437 438 439 # 440 # sid: 42000209 | date: 2013-01-03 - 20:00 441 # 442 # 443 # 444 MainRule "str:dragostea" "msg:Scanner Toata Scanner User-Agent Detected" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000209 ; 445 446 447 # 448 # sid: 42000208 | date: 2013-01-03 - 19:57 449 # 450 # 451 # 452 MainRule "str:sundayddr" "msg:Scanner Sipvicious" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000208 ; 453 454 455 # 456 # sid: 42000207 | date: 2013-01-03 - 19:56 457 # 458 # 459 # 460 MainRule "str:friendly-scanner" "msg:Scanner Sipvicious User-Agent Detected" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000207 ; 461 462 463 # 464 # sid: 42000206 | date: 2013-01-03 - 19:56 465 # 466 # 467 # 468 MainRule "str:sql power injector" "msg:Scanner SQL Power Injector SQL Injection" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000206 ; 469 470 471 # 472 # sid: 42000205 | date: 2013-01-03 - 19:55 473 # 474 # 475 # 476 MainRule "str:uil2pn" "msg:Scanner SQL Injection Attempt (Agent uil2pn)" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000205 ; 477 478 479 # 480 # sid: 42000204 | date: 2013-01-03 - 19:54 481 # 482 # 483 # 484 MainRule "str:pavuk" "msg:Scanner Pavuk - Website Mirroring Tool for Off-line Analysis" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:4" id:42000204 ; 485 486 487 # 488 # sid: 42000203 | date: 2013-01-03 - 19:53 489 # 490 # 491 # 492 MainRule "str:paros/" "msg:Scanner Paros Proxy Scanner" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000203 ; 493 494 495 # 496 # sid: 42000202 | date: 2013-01-03 - 19:34 497 # 498 # 499 # 500 MainRule "str:/netsparker" "msg:Netsparker-Scan in Progress" "mz:URL" "s:$UWA:8" id:42000202 ; 501 502 503 # 504 # sid: 42000201 | date: 2013-01-03 - 19:34 505 # 506 # 507 # 508 MainRule "str:netsparker" "msg:Scanner Netsparker" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000201 ; 509 510 511 # 512 # sid: 42000200 | date: 2013-01-03 - 19:33 513 # 514 # 515 # 516 MainRule "str:mysqloit" "msg:Scanner Mysqloit - Mysql Injection Takover Tool" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000200 ; 517 518 519 # 520 # sid: 42000199 | date: 2013-01-03 - 19:32 521 # 522 # 523 # 524 MainRule "str:prog.customcrawler" "msg:Scanner Mini MySqlatOr SQL Injection" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000199 ; 525 526 527 # 528 # sid: 42000198 | date: 2013-01-03 - 19:31 529 # 530 # 531 # 532 MainRule "str:network-services-auditor" "msg:Scanner IBM NSA User Agent" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000198 ; 533 534 535 # 536 # sid: 42000197 | date: 2013-01-03 - 19:30 537 # 538 # 539 # 540 MainRule "str:/etc/passwd?format=" "msg:Scanner Httprecon Web Server Fingerprint Scan" "mz:URL" "s:$UWA:8" id:42000197 ; 541 542 543 # 544 # sid: 42000196 | date: 2013-01-03 - 19:28 545 # 546 # 547 # 548 MainRule "str:mozilla/5.0 (compatible; grendel-scan" "msg:Scanner Grendel Web Scan" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000196 ; 549 550 551 # 552 # sid: 42000194 | date: 2013-01-03 - 19:26 553 # 554 # 555 # 556 MainRule "str:dav.pm" "msg:Scanner DavTest WebDav Vulnerability Scanner" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000194 ; 557 558 559 # 560 # sid: 42000193 | date: 2013-01-03 - 19:18 561 # 562 # 563 # 564 MainRule "str:crimscanner" "msg:Scanner crimscanner" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000193 ; 565 566 567 # 568 # sid: 42000192 | date: 2013-01-03 - 19:18 569 # 570 # 571 # 572 MainRule "str:cisco-torch" "msg:Scanner Cisco-torch" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000192 ; 573 574 575 # 576 # sid: 42000191 | date: 2013-01-03 - 19:14 577 # 578 # 579 # 580 MainRule "str:bsqlbf" "msg:Scanner bsqlbf Brute Force SQL Injection" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000191 ; 581 582 583 # 584 # sid: 42000190 | date: 2013-01-03 - 19:09 585 # 586 # 587 # 588 MainRule "str:autogetcolumn" "msg:Scanner AutoGetColumn" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000190 ; 589 590 591 # 592 # sid: 42000189 | date: 2013-01-03 - 19:07 593 # 594 # 595 # 596 MainRule "str:/appscan_fingerprint" "msg:Scanner Watchfire AppScan Web App Vulnerability Scanner" "mz:URL" "s:$UWA:8" id:42000189 ; 597 598 599 # 600 # sid: 42000188 | date: 2014-04-24 - 09:41 601 # 602 # 603 # 604 MainRule "str:/acunetix" "msg:Acunetix-Scanner detected" "mz:URL" "s:$UWA:8" id:42000188 ; 605 606 607 # 608 # sid: 42000187 | date: 2013-01-03 - 18:47 609 # 610 # 611 # 612 MainRule "str:absinthe" "msg:Scanner Absinthe" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000187 ; 613 614 615 # 616 # sid: 42000186 | date: 2013-01-03 - 18:04 617 # 618 # 619 # 620 MainRule "str:\." "msg:Scanner / Broken UserAgent " "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000186 ; 621 622 623 # 624 # sid: 42000185 | date: 2013-01-03 - 18:02 625 # 626 # 627 # 628 MainRule "str:t34mh4k" "msg:Scanner t34mh4k" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000185 ; 629 630 631 # 632 # sid: 42000184 | date: 2013-01-03 - 18:01 633 # 634 # 635 # 636 MainRule "str:searchbot admin@google" "msg:Scanner Fake GoogleBot" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000184 ; 637 638 639 # 640 # sid: 42000183 | date: 2013-01-03 - 18:00 641 # 642 # 643 # 644 MainRule "str:neuralbot" "msg:Scanner neuralbot" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000183 ; 645 646 647 # 648 # sid: 42000182 | date: 2013-01-03 - 17:57 649 # 650 # 651 # 652 MainRule "str:gameboy" "msg:Scanner gameboy" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000182 ; 653 654 655 # 656 # sid: 42000181 | date: 2013-01-03 - 17:56 657 # 658 # 659 # 660 MainRule "str:webster pro" "msg:Scanner webster pro" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000181 ; 661 662 663 # 664 # sid: 42000180 | date: 2013-01-03 - 17:56 665 # 666 # 667 # 668 MainRule "str:picscout" "msg:Scanner picscout" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000180 ; 669 670 671 # 672 # sid: 42000179 | date: 2013-01-03 - 17:47 673 # 674 # 675 # 676 MainRule "str:digimarc webreader" "msg:Scanner digimarc webreader" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000179 ; 677 678 679 # 680 # sid: 42000178 | date: 2013-01-03 - 17:45 681 # 682 # 683 # 684 MainRule "str:w3af" "msg:Scanner w3af" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000178 ; 685 686 687 # 688 # sid: 42000177 | date: 2013-01-03 - 17:45 689 # 690 # 691 # 692 MainRule "str:n-stealth" "msg:Scanner n-stealth" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000177 ; 693 694 695 # 696 # sid: 42000176 | date: 2013-01-03 - 17:44 697 # 698 # 699 # 700 MainRule "str:chinaclaw" "msg:Scanner chinaclaw" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000176 ; 701 702 703 # 704 # sid: 42000175 | date: 2013-01-03 - 17:44 705 # 706 # 707 # 708 MainRule "str:wordpress hash grabber" "msg:Scanner wordpress hash grabber" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000175 ; 709 710 711 # 712 # sid: 42000174 | date: 2013-01-03 - 17:43 713 # 714 # 715 # 716 MainRule "str:http_get_vars" "msg:PHP-Injetion on UA" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8" id:42000174 ; 717 718 719 # 720 # sid: 42000173 | date: 2013-01-03 - 17:43 721 # 722 # 723 # 724 MainRule "str:mozilla/5.0 sf" "msg:Scanner SkipFish" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000173 ; 725 726 727 # 728 # sid: 42000172 | date: 2013-01-03 - 17:41 729 # 730 # 731 # 732 MainRule "str:linux mozilla" "msg:Scanner XSSS (probably)" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000172 ; 733 734 735 # 736 # sid: 42000171 | date: 2013-01-03 - 17:39 737 # 738 # 739 # 740 MainRule "str:whisker" "msg:Scanner whisker" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000171 ; 741 742 743 # 744 # sid: 42000170 | date: 2013-01-03 - 17:37 745 # 746 # 747 # 748 MainRule "str:sqlmap" "msg:Scanner sqlmap" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000170 ; 749 750 751 # 752 # sid: 42000169 | date: 2013-01-03 - 17:36 753 # 754 # 755 # 756 MainRule "str:nmap" "msg:Scanner Nmap" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000169 ; 757 758 759 # 760 # sid: 42000167 | date: 2014-04-24 - 09:42 761 # 762 # http://www.webhostingtalk.com/showthread.php?t=627447 763 # 764 MainRule "str:acunetix" "msg:Scanner Acunetix detected" "mz:$HEADERS_VAR:User-Agent|$HEADERS_VAR:Acunetix-Product" "s:$UWA:8" id:42000167 ; 765 766 767 # 768 # sid: 42000166 | date: 2013-01-03 - 17:30 769 # 770 # 771 # 772 MainRule "str:planetwork" "msg:Scanner planetwork" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000166 ; 773 774 775 # 776 # sid: 42000165 | date: 2013-01-03 - 17:30 777 # 778 # 779 # 780 MainRule "str:kmccrew" "msg:Scanner kmccrew" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000165 ; 781 782 783 # 784 # sid: 42000164 | date: 2013-01-03 - 17:30 785 # 786 # 787 # 788 MainRule "str:casper" "msg:Scanner casper" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000164 ; 789 790 791 # 792 # sid: 42000163 | date: 2013-01-03 - 17:29 793 # 794 # 795 # 796 MainRule "str:twengabot" "msg:Scanner twengabot" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000163 ; 797 798 799 # 800 # sid: 42000162 | date: 2013-01-03 - 17:29 801 # 802 # 803 # 804 MainRule "str:autoemailspider" "msg:Scanner autoemailspider" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000162 ; 805 806 807 # 808 # sid: 42000161 | date: 2013-01-03 - 17:27 809 # 810 # 811 # 812 MainRule "str:siphon" "msg:Scanner siphon" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000161 ; 813 814 815 # 816 # sid: 42000160 | date: 2013-01-03 - 17:26 817 # 818 # 819 # 820 MainRule "str:core-project/" "msg:Scanner core-project" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000160 ; 821 822 823 # 824 # sid: 42000159 | date: 2013-01-03 - 17:25 825 # 826 # 827 # 828 MainRule "str:webmole" "msg:Scanner webmole" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000159 ; 829 830 831 # 832 # sid: 42000158 | date: 2013-01-03 - 17:24 833 # 834 # 835 # 836 MainRule "str:webinspect" "msg:Scanner webinspect" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000158 ; 837 838 839 # 840 # sid: 42000157 | date: 2013-01-03 - 17:24 841 # 842 # 843 # 844 MainRule "str:s.t.a.l.k.e.r" "msg:Scanner s.t.a.l.k.e.r" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000157 ; 845 846 847 # 848 # sid: 42000156 | date: 2013-01-03 - 17:24 849 # 850 # 851 # 852 MainRule "str:safexplorer" "msg:Scanner safexplorer" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000156 ; 853 854 855 # 856 # sid: 42000155 | date: 2013-01-03 - 17:23 857 # 858 # 859 # 860 MainRule "str:poe-component-client" "msg:Scanner poe-component-client" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000155 ; 861 862 863 # 864 # sid: 42000154 | date: 2013-01-03 - 17:23 865 # 866 # 867 # 868 MainRule "str:pmafind" "msg:Scanner pmafind" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000154 ; 869 870 871 # 872 # sid: 42000153 | date: 2013-01-03 - 17:23 873 # 874 # 875 # 876 MainRule "str:n-stealth" "msg:Scanner n-stealth" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000153 ; 877 878 879 # 880 # sid: 42000152 | date: 2013-01-03 - 17:23 881 # 882 # 883 # 884 MainRule "str:nsauditor" "msg:Scanner nsauditor" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000152 ; 885 886 887 # 888 # sid: 42000151 | date: 2013-01-03 - 17:22 889 # 890 # 891 # 892 MainRule "str:whatweb" "msg:Scanner whatweb" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000151 ; 893 894 895 # 896 # sid: 42000150 | date: 2013-01-03 - 17:21 897 # 898 # 899 # 900 MainRule "str:.nasl" "msg:Scanner .nasl" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000150 ; 901 902 903 # 904 # sid: 42000149 | date: 2013-01-03 - 17:21 905 # 906 # 907 # 908 MainRule "str:nameofagent" "msg:Scanner nameofagent" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000149 ; 909 910 911 # 912 # sid: 42000148 | date: 2013-01-03 - 17:21 913 # 914 # 915 # 916 MainRule "str:murzillo" "msg:Scanner murzillo" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000148 ; 917 918 919 # 920 # sid: 42000147 | date: 2013-01-03 - 17:20 921 # 922 # 923 # 924 MainRule "str:mosiac" "msg:Scanner mosiac" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000147 ; 925 926 927 # 928 # sid: 42000146 | date: 2013-01-03 - 17:20 929 # 930 # 931 # 932 MainRule "str:morzilla" "msg:Scanner morzilla" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000146 ; 933 934 935 # 936 # sid: 42000145 | date: 2013-01-03 - 17:19 937 # 938 # 939 # 940 MainRule "str:morfeus" "msg:Scanner morfeus" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000145 ; 941 942 943 # 944 # sid: 42000144 | date: 2013-01-03 - 17:19 945 # 946 # 947 # 948 MainRule "str:jaascois" "msg:Scanner jaascois" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000144 ; 949 950 951 # 952 # sid: 42000143 | date: 2013-01-03 - 17:19 953 # 954 # 955 # 956 MainRule "str:internet-exprorer" "msg:Scanner internet-exprorer" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000143 ; 957 958 959 # 960 # sid: 42000142 | date: 2013-01-03 - 17:13 961 # 962 # 963 # 964 MainRule "str:gameboy" "msg:Scanner gameboy" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000142 ; 965 966 967 # 968 # sid: 42000141 | date: 2013-01-03 - 17:12 969 # 970 # 971 # 972 MainRule "str:fantombrowser" "msg:Scanner fantombrowser" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000141 ; 973 974 975 # 976 # sid: 42000140 | date: 2013-01-03 - 17:12 977 # 978 # 979 # 980 MainRule "str:extractor" "msg:Scanner extractor" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000140 ; 981 982 983 # 984 # sid: 42000139 | date: 2013-01-03 - 17:12 985 # 986 # 987 # 988 MainRule "str:exploit" "msg:Scanner exploit" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000139 ; 989 990 991 # 992 # sid: 42000138 | date: 2013-01-03 - 17:11 993 # 994 # 995 # 996 MainRule "str:datacha0s" "msg:Scanner datacha0s" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000138 ; 997 998 999 # 1000 # sid: 42000137 | date: 2013-01-03 - 17:02 1001 # 1002 # 1003 # 1004 MainRule "str:copyrightcheck" "msg:Scanner copyrightcheck" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000137 ; 1005 1006 1007 # 1008 # sid: 42000136 | date: 2013-01-03 - 17:01 1009 # 1010 # 1011 # 1012 MainRule "str:copyguard" "msg:Scanner copyguard" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000136 ; 1013 1014 1015 # 1016 # sid: 42000135 | date: 2013-01-03 - 17:01 1017 # 1018 # 1019 # 1020 MainRule "str:cherrypicker" "msg:Scanner cherrypickernice" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000135 ; 1021 1022 1023 # 1024 # sid: 42000134 | date: 2013-01-03 - 17:00 1025 # 1026 # 1027 # 1028 MainRule "str:cgichk" "msg:Scanner cgichk" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000134 ; 1029 1030 1031 # 1032 # sid: 42000133 | date: 2013-01-03 - 17:00 1033 # 1034 # 1035 # 1036 MainRule "str:bwh3_user_agent" "msg:Scanner bwh3_user_agent" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000133 ; 1037 1038 1039 # 1040 # sid: 42000132 | date: 2013-01-03 - 17:00 1041 # 1042 # 1043 # 1044 MainRule "str:blackwidow" "msg:Scanner blackwidow" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000132 ; 1045 1046 1047 # 1048 # sid: 42000131 | date: 2013-01-03 - 16:59 1049 # 1050 # 1051 # 1052 MainRule "str:bilbo" "msg:Scanner bilbo" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000131 ; 1053 1054 1055 # 1056 # sid: 42000130 | date: 2013-01-03 - 16:59 1057 # 1058 # 1059 # 1060 MainRule "str:backdoor" "msg:Scanner backdoor" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000130 ; 1061 1062 1063 # 1064 # sid: 42000129 | date: 2013-01-03 - 16:59 1065 # 1066 # 1067 # 1068 MainRule "str:atomic_email_hunter" "msg:Scanner atomic_email_hunter" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000129 ; 1069 1070 1071 # 1072 # sid: 42000128 | date: 2013-01-03 - 16:58 1073 # 1074 # 1075 # 1076 MainRule "str:nessus" "msg:Nessus-Scanner detected" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000128 ; 1077 1078 1079 # 1080 # sid: 42000127 | date: 2013-01-03 - 16:57 1081 # 1082 # 1083 # 1084 MainRule "str:amiga-aweb/3.4" "msg:Scanner Amiga-Aweb" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000127 ; 1085 1086 1087 # 1088 # sid: 42000122 | date: 2012-12-21 - 13:59 1089 # 1090 # http://markmaunder.com/2011/08/01/zero-day-vulnerability-in-many-wordpress-themes/ 1091 # http://packetstormsecurity.org/files/view/105240/timthumb-exec.txt 1092 # 1093 MainRule "str:/timthumb.php" "msg:WP Timthumb - Access " "mz:URL" "s:$ATTACK:8" id:42000122 ; 1094 1095 1096 1097 1098 # 1099 # sid: 42000076 | date: 2012-10-20 - 11:26 1100 # 1101 # VTI_BIN is a sharepoint-thingie 1102 # 1103 MainRule "str:/_vti_bin/" "msg:VTI_BIN - Access " "mz:URL" "s:$UWA:8" id:42000076 ; 1104 1105 1106 # 1107 # sid: 42000073 | date: 2012-10-20 - 10:33 1108 # 1109 # 1110 # 1111 MainRule "str:urllib/" "msg:Python-urllib UA, possible Scanner" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:4" id:42000073 ; 1112 1113 1114 # 1115 # sid: 42000051 | date: 2012-10-11 - 16:04 1116 # 1117 # 1118 # 1119 MainRule "str:nikto" "msg:Nikto-Scanner UA detected" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8,$UWA:8" id:42000051 ; 1120 1121 1122 # 1123 # sid: 42000046 | date: 2012-10-11 - 15:13 1124 # 1125 # original request: /w00tw00t.at.ISC.SANS.DFind 1126 # http://serverfault.com/questions/125607/dealing-with-http-w00tw00t-attacks 1127 # 1128 MainRule "str:/w00tw00t" "msg:DFind w00tw00t GET-Requests" "mz:URL" "s:$ATTACK:8,$UWA:8" id:42000046 ; 1129 1130 1131 # 1132 # sid: 42000045 | date: 2012-10-11 - 15:09 1133 # 1134 # emerging sid:2009158 1135 # 1136 MainRule "str:webshag" "msg:WebShag Web Application Scan Detected" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8,$UWA:8" id:42000045 ; 1137 1138 1139 # 1140 # sid: 42000044 | date: 2012-10-11 - 14:59 1141 # 1142 # emerging sid:2008617 1143 # 1144 MainRule "str:/.adsensepostnottherenonobook" "msg:Wikto Scan" "mz:URL" "s:$ATTACK:8,$UWA:8" id:42000044 ; 1145 1146 1147 # 1148 # sid: 42000043 | date: 2012-10-11 - 14:59 1149 # 1150 # emerging sid:2010960 1151 # 1152 MainRule "str:whatweb/" "msg:WhatWeb Web Application Fingerprint Scanner Default User-Agent Detected" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:4,$UWA:4" id:42000043 ; 1153 1154 1155 # 1156 # sid: 42000042 | date: 2012-10-11 - 14:58 1157 # 1158 # emerging sid:2010768 1159 # 1160 MainRule "str: webcollage/" "msg:Open-Proxy ScannerBot (webcollage-UA)" "mz:$HEADERS_VAR:User-Agent" "s:$UWA:8" id:42000042 ; 1161 1162 1163 # 1164 # sid: 42000040 | date: 2012-10-11 - 14:55 1165 # 1166 # emerging sid:2009159 1167 # 1168 MainRule "str:toata dragostea" "msg:Toata Scanner User-Agent Detected" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8,$UWA:8" id:42000040 ; 1169 1170 1171 # 1172 # sid: 42000038 | date: 2012-10-11 - 14:53 1173 # 1174 # emerging sid:2010508 1175 # 1176 MainRule "str:springenwerk" "msg:Springenwerk XSS Scanner User-Agent Detected" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8,$UWA:8" id:42000038 ; 1177 1178 1179 # 1180 # sid: 42000037 | date: 2012-10-11 - 14:52 1181 # 1182 # emerging sid:2010953 1183 # 1184 MainRule "str:mozilla/5.0 sf" "msg:kipfish Web Application Scan Detected" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8,$UWA:8" id:42000037 ; 1185 1186 1187 # 1188 # sid: 42000036 | date: 2012-10-11 - 14:47 1189 # 1190 # DirBuster 1191 # 1192 MainRule "str:dirbuster" "msg:DirBuster Web App Scan in Progress" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8,$UWA:8" id:42000036 ; 1193 1194 1195 # 1196 # sid: 42000035 | date: 2012-10-11 - 14:45 1197 # 1198 # emerging sid:2009154 1199 # 1200 MainRule "str:autogetcolumn" "msg:Automated Injection Tool User-Agent (AutoGetColumn)" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:4,$SQL:4,$UWA:4" id:42000035 ; 1201 1202 1203 # 1204 # sid: 42000034 | date: 2012-10-11 - 14:42 1205 # 1206 # emerging 1207 # 1208 MainRule "str:absinthe" "msg:Absinthe SQL Injection Tool HTTP Header Detected" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:4,$SQL:4" id:42000034 ; 1209 1210 1211 # 1212 # sid: 42000031 | date: 2012-10-11 - 14:35 1213 # 1214 # emerging sid:2013115 1215 # 1216 MainRule "str:/muieblackcat" "msg:Muieblackcat scanner" "mz:URL" "s:$ATTACK:8" id:42000031 ; 1217 1218 1219 # 1220 # sid: 42000019 | date: 2012-10-11 - 12:59 1221 # 1222 # emerging sid:2009288 1223 # 1224 MainRule "str:revolt" "msg:Attack Tool Revolt Scanner" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8,$UWA:8" id:42000019 ; 1225 1226 1227 # 1228 # sid: 42000014 | date: 2012-10-11 - 12:44 1229 # 1230 # emerging sid:2011286 1231 # eromang.zataz.com/2010/07/13/byroenet-casper-bot-search-e107-rce-scanner/ 1232 # 1233 MainRule "str:mama" "msg:Bot Search RFI Scan (Casper-Like MaMa Cyber/ebes)" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8" id:42000014 ; 1234 1235 1236 # 1237 # sid: 42000013 | date: 2012-10-11 - 12:42 1238 # 1239 # emerging sid:2011285 1240 # eromang.zataz.com/2010/07/13/byroenet-casper-bot-search-e107-rce-scanner/ 1241 # 1242 MainRule "str:jcomers bot" "msg:Bot Search RFI Scan (Casper-Like, Jcomers Bot scan)" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8" id:42000013 ; 1243 1244 1245 # 1246 # sid: 42000012 | date: 2012-10-11 - 12:39 1247 # 1248 # emerging sid:2011244 1249 # eromang.zataz.com/2010/07/13/byroenet-casper-bot-search-e107-rce-scanner/ 1250 # 1251 MainRule "str:mozilla/4.76 [ru] (x11; u; sunos 5.7 sun4u)" "msg:Bot Search RFI Scan (ByroeNet/Casper-Like sun4u)" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8" id:42000012 ; 1252 1253 1254 # 1255 # sid: 42000011 | date: 2012-10-11 - 12:37 1256 # 1257 # emerging sid:2011243# eromang.zataz.com/2010/07/13/byroenet-casper-bot-search-e107-rce-scanner/ 1258 # 1259 MainRule "str:planetwork" "msg:Bot Search RFI Scan (ByroeNet/Casper-Like, planetwork" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8" id:42000011 ; 1260 1261 1262 # 1263 # sid: 42000010 | date: 2012-10-11 - 12:36 1264 # 1265 # emerging sid:2011175# eromang.zataz.com/2010/07/13/byroenet-casper-bot-search-e107-rce-scanner/ 1266 # 1267 MainRule "str:casper bot" "msg:Casper Bot Search RFI Scan" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8" id:42000010 ; 1268 1269 1270 # 1271 # sid: 42000009 | date: 2012-10-11 - 12:34 1272 # 1273 # emerging sid:2009799 1274 # 1275 MainRule "str:m fucking scanner" "msg:PHP Attack Tool Morfeus F Scanner - M" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8" id:42000009 ; 1276 1277 1278 # 1279 # sid: 42000008 | date: 2012-10-11 - 12:33 1280 # 1281 # emerging sid:2003466 1282 # 1283 MainRule "str:morpheus" "msg:PHP Attack Tool Morfeus F Scanner" "mz:$HEADERS_VAR:User-Agent" "s:$ATTACK:8" id:42000008 ; 1284 1285