ISC Twitter/Google Snort Signatures

[John Jacobs <flamdugen () hotmail com>]

Hello FD, first and foremost thank you for the strong effort and excellent signatures.  As such, in an attempt to give 
back to a wonderful community, I humbly submitted the following Snort rules for inclusion into the ET signatures.  A 
brief explanation is provided below:

The first signature is designed to detect Google non-security related announcement articles on the ISC Diary; this 
seems to be a topic of extreme interest for some ISC Handlers despite having little to no security value.  I am unsure 
if this is a result of "Slow News Day" syndrome or another behavorial oddity which manifests at ISC.  This will detect 
on "Google is slow" style articles as well, however, I am sure this signature will require more tweaking as ISC 
encourages handing over more personal data to a 3rd party under the guise of functionality.

The second signature is designed to detect Joel peddling Twitter on the isc.sans.org Diary, as again, this isn't 
security related.  I suspect the Twitter signature may tend to fire more than the Google as Joel tends to get excited 
about "Tweeting" and "Twittering" and this spills over into the ISC Diary anytime he's the "Handler on Duty".

As always, please feel free to make changes to this signatures, especially regarding performance.  I've placed these 
into ET POLICY but they may be more applicable in another classes, perhaps a blocking class. I thank you in advance, 
feel free to modify for PCRE as well.

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY isc.sans.org Access"; flowbits:set,isc_sans; 
flowbits:noalert; flow:established,to_server; content:"|0D 0A|Host|3A 20|isc|2E|sans|2E|org|0D 0A|"; 
reference:url,isc.sans.org/; classtype:policy-violation; sid:2009xxxx; rev:1;)

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET POLICY isc.sans.org SANdlers say Google is slow"; 
flowbits:isset,isc_sans; flow:established,from_server; content:"google"; nocase; content:"slow"; nocase; 
reference:url,isc.sans.org/diary.html?storyid=6388; reference:url,isc.sans.org/diary.html?storyid=5443; 
classtype:policy-annoyance; sid:2009xxxx; rev:1;)

alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET POLICY isc.sans.org Joel Esler Peddling Twitter"; 
flowbits:isset,isc_sans; flow:established,from_server; content:"Joel|20|Esler"; nocase; content:"Twitter"; nocase; 
reference:url,isc.sans.org/diary.html?storyid=6391; reference:url,isc.sans.org/diary.html?storyid=6388; 
classtype:policy-annoyance; sid:2009xxxx; rev:1;)

- John Jacobs

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/