RE: [Snort-users] Adware/Malware Rules List

permalink · #1 (**permalink**) 02-29-2004

This is a multi-part message in MIME format.

------=_NextPart_000_0011_01C3FED8.55ABF670
Content-Type: text/plain;
charset="US-ASCII"
Content-Transfer-Encoding: 7bit

I came here looking for exactly this. That's a start....problem is
there are SO MANY of these stupid things! I'd like to alert on Gator
and all the rest of 'em so we can keep our machines clean.

Here are a couple that I have set up...not many but maybe it will help
get things rolling:
alert tcp any any -> $HOME_NET 8080 (msg:"Gator updates";
content:"Host\: updateserver.gator.com"; flags: PA;)
alert tcp any any -> $HOME_NET 8080 (msg:"Installshield updates";
content:"Host\: updates.installshield.com"; flags: PA;)
alert tcp any any -> $HOME_NET 8080 (msg:"Comet Systems update";
content:"Host\: update.cc.cometsystems.com"; flags: PA;)

Here's a link to a rather old posting (Jan 2002) related to this issue.
There's a pretty good sized list here but many of them have probably
changed:
http://groups.google.com/groups?q=snort+adware+rules
<http://groups.google.com/groups?q=sn...n&lr=&ie=UTF-8
&oe=UTF-8&selm=BbK18.8737%24gf1.49194%40news-server.bigpond.net.au&rnum=
6>
&hl=en&lr=&ie=UTF-8&oe=UTF-8&selm=BbK18.8737%24gf1.49194%40news-server.b
igpond.net.au&rnum=6

Here's another related site:
http://www.doxdesk.com/parasite/

-----Original Message-----

From: snort-users-admin@lists.sourceforge.net
[mailto:snort-users-admin@lists.sourceforge.net] On Behalf Of Darden,
Patrick S.
Sent: Friday, February 27, 2004 11:05 AM
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] Adware/Malware Rules List

I had a large number of requests for my ruleset for Ad/Malware, so I
have placed it on the web at:

https://www.armc.org/malware/

It ain't nothing special, but it works for us. If you have any
additions, please email me so we can
make this ruleset grow into something useful.

Thanks,
--Patrick Darden
--Internetworking Manager

------=_NextPart_000_0011_01C3FED8.55ABF670
Content-Type: text/html;
charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<TITLE>Message</TITLE>

<META content=3D"MSHTML 6.00.2800.1400" name=3DGENERATOR></HEAD>
<BODY>
<DIV><SPAN class=3D889180220-29022004><FONT face=3DArial color=3D#0000ff =
size=3D2>I came=20
here looking for exactly this.  That's a start....problem is there =
are SO=20
MANY of these stupid things!  I'd like to alert on Gator and all =
the rest=20
of 'em so we can keep our machines clean.</FONT></SPAN></DIV>
<DIV><SPAN class=3D889180220-29022004><FONT face=3DArial color=3D#0000ff =

size=3D2></FONT></SPAN> </DIV>
<DIV><SPAN class=3D889180220-29022004><FONT face=3DArial color=3D#0000ff =
size=3D2>Here=20
are a couple that I have set up...not many but maybe it will help get =
things=20
rolling:</FONT></SPAN></DIV>
<DIV><SPAN class=3D889180220-29022004><FONT face=3DArial color=3D#0000ff =
size=3D2>alert=20
tcp any any -> $HOME_NET 8080 (msg:"Gator updates"; content:"Host\:=20
updateserver.gator.com"; flags: PA;)<BR>alert tcp any any -> =
$HOME_NET 8080=20
(msg:"Installshield updates"; content:"Host\: =
updates.installshield.com"; flags:=20
PA;)<BR>alert tcp any any -> $HOME_NET 8080 (msg:"Comet Systems =
update";=20
content:"Host\: update.cc.cometsystems.com"; flags: =
PA;)<BR></FONT></SPAN></DIV>
<DIV><SPAN class=3D889180220-29022004><FONT face=3DArial color=3D#0000ff =

size=3D2></FONT></SPAN> </DIV>
<DIV><SPAN class=3D889180220-29022004><FONT face=3DArial color=3D#0000ff =
size=3D2>Here's=20
a link to a rather old posting (Jan 2002) related to this issue.  =
There's a=20
pretty good sized list here but many of them have probably=20
changed:</FONT></SPAN></DIV>
<DIV><SPAN class=3D889180220-29022004><FONT face=3DArial color=3D#0000ff =
size=3D2><A=20
href=3D"http://groups.google.com/groups?q=3Dsnort+adware+rules&hl=3De=
n&lr=3D&ie=3DUTF-8&oe=3DUTF-8&selm=3DBbK18.8737%24gf1.491=
94%40news-server.bigpond.net.au&rnum=3D6">http://groups.google.com/gr=
oups?q=3Dsnort+adware+rules&hl=3Den&lr=3D& amp;ie=3DUTF-8&oe=3D=
UTF-8&selm=3DBbK18.8737%24gf1.49194%40news-server.bigpond.net.au&=
rnum=3D6</A></FONT></SPAN></DIV>
<DIV><SPAN class=3D889180220-29022004><FONT face=3DArial color=3D#0000ff =

size=3D2></FONT></SPAN> </DIV>
<DIV><SPAN class=3D889180220-29022004><FONT face=3DArial color=3D#0000ff =
size=3D2>Here's=20
another related site:</FONT></SPAN></DIV>
<DIV><SPAN class=3D889180220-29022004><FONT face=3DArial color=3D#0000ff =
size=3D2><A=20
href=3D"http://www.doxdesk.com/parasite/">http://www.doxdesk.com/parasite=
/</A></FONT></SPAN></DIV>
<DIV><SPAN class=3D889180220-29022004><FONT face=3DArial color=3D#0000ff =

size=3D2></FONT></SPAN> </DIV>
<BLOCKQUOTE dir=3Dltr style=3D"MARGIN-RIGHT: 0px">
<DIV></DIV>
<DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr =
align=3Dleft><FONT=20
face=3DTahoma size=3D2>-----Original Message-----<SPAN=20
class=3D889180220-29022004><FONT face=3DArial=20
color=3D#0000ff> </FONT></SPAN></FONT></DIV>
<DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr =
align=3Dleft><FONT=20
face=3DTahoma size=3D2><SPAN=20
class=3D889180220-29022004> </SPAN><BR><B>From:</B>=20
snort-users-admin@lists.sourceforge.net=20
[mailto:snort-users-admin@lists.sourceforge.net] <B>On Behalf Of =
</B>Darden,=20
Patrick S.<BR><B>Sent:</B> Friday, February 27, 2004 11:05 =
AM<BR><B>To:</B>=20
snort-users@lists.sourceforge.net<BR><B>Subject:</B> [Snort-users]=20
Adware/Malware Rules List<BR><BR></DIV></FONT>
<DIV><SPAN class=3D437270316-27022004><FONT face=3DArial =
color=3D#0000ff size=3D2>I=20
had a large number of requests for my ruleset for Ad/Malware, so I =
have placed=20
it on the web at:</FONT></SPAN></DIV>
<DIV><SPAN class=3D437270316-27022004><FONT face=3DArial =
color=3D#0000ff=20
size=3D2></FONT></SPAN> </DIV>
<DIV><SPAN class=3D437270316-27022004><FONT face=3DArial =
color=3D#0000ff size=3D2><A=20
=
href=3D"https://www.armc.org/malware/">https://www.armc.org/malware/</A><=
/FONT></SPAN></DIV>
<DIV><SPAN class=3D437270316-27022004><FONT face=3DArial =
color=3D#0000ff=20
size=3D2></FONT></SPAN> </DIV>
<DIV><SPAN class=3D437270316-27022004><FONT face=3DArial =
color=3D#0000ff size=3D2>It=20
ain't nothing special, but it works for us.  If you have any =
additions,=20
please email me so we can </FONT></SPAN></DIV>
<DIV><SPAN class=3D437270316-27022004><FONT face=3DArial =
color=3D#0000ff size=3D2>make=20
this ruleset grow into something useful.</FONT></SPAN></DIV>
<DIV><SPAN class=3D437270316-27022004><FONT face=3DArial =
color=3D#0000ff=20
size=3D2></FONT></SPAN> </DIV>
<DIV><SPAN class=3D437270316-27022004><FONT face=3DArial =
color=3D#0000ff=20
size=3D2>Thanks,</FONT></SPAN></DIV>
<DIV><SPAN class=3D437270316-27022004><FONT face=3DArial =
color=3D#0000ff=20
size=3D2>--Patrick Darden</FONT></SPAN></DIV>
<DIV><SPAN class=3D437270316-27022004><FONT face=3DArial =
color=3D#0000ff=20
size=3D2>--Internetworking =
Manager</FONT></SPAN></DIV></BLOCKQUOTE></BODY></HTML>

------=_NextPart_000_0011_01C3FED8.55ABF670--

-------------------------------------------------------
SF.Net is sponsored by: Speed Start Your Linux Apps Now.
Build and deploy apps & Web services for Linux with
a free DVD software kit from IBM. Click Now!
http://ads.osdn.com/?ad_id=1356&alloc_id=3438&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode