Snort mailing list archives

Re: Proposed Signature - "COMMUNITY SPECIFIC-THREATS High Probability Blackhole Landing with catch qq"

From: Matt Olney <molney () sourcefire com>
Date: Thu, 1 Mar 2012 09:45:47 -0500

Nathan, Got an email entitled:

Fwd: Your Flight N 91-17249698
It had an attached html file with the following html (recognize it? :))

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "
http://www.w3.org/TR/html4/loose.dtd";>
<html>
 <head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  *<title>Please wait untill the page loads...</title>*
 </head>
 <body>
<h1>Please Wait... Loading... </h1><br>
 </body>`

<script>if(window['doc'+'ume'+'nt'])aa=/\w/.exec(1).index+[];aaa='0';try{new
locat*ion();}catch(qqq){ss*=String;if(aa

Etc...

Good rule :)

Matt

On Wed, Feb 29, 2012 at 4:35 PM, Community Signatures
<lists () packetmail net>wrote:

On 02/29/12 15:19, Matt Olney wrote:

Since you're associating with an exploit kit, rather than an active
trojan, and given that exploits are typically aimed at user
applications, I'd use classtype:attempted-user;


Understood, on the ET side we tend to use trojan-activity because the
point of the exploit kit is to install a trojan/malware.  I always
viewed attempted-user as privilege escalation.  I may just leave
classtype off and let VRT apply this and the metadata as they feel fit.

Because it is a file, and you're not using any http_inspect buffers,
we'd use $FILE_DATA_PORTS in case it is delivered via mail (saw one like
that yesterday).


Thanks Matt, can you elaborate more on this as I've not seen this
behavior before, where Blackhole is delivered via mail.  I have seen
mailing campaigns that include a link which, upon landing, is Blackhole.
 I don't disagree with your changes over $HTTP_PORTS but I have not seen
this behavior especially with SMTPDs

Again, primarily cosmetic changes, and does nothing, in this simple
case, to modify the functionality of the rule.


Thank you for taking the time to explain the changes and current
convention.

Thanks,
Nathan

------------------------------------------------------------------------------
Virtualization & Cloud Management Using Capacity Planning
Cloud computing makes use of virtualization - but cloud computing 
also focuses on allowing computing to be delivered as a service.
http://www.accelacomm.com/jaw/sfnl/114/51521223/

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!

Current thread:

Proposed Signature - "COMMUNITY SPECIFIC-THREATS High Probability Blackhole Landing with catch qq" Community Proposed (Feb 29)
- Re: Proposed Signature - "COMMUNITY SPECIFIC-THREATS High Probability Blackhole Landing with catch qq" Matt Olney (Feb 29)
  - Re: Proposed Signature - "COMMUNITY SPECIFIC-THREATS High Probability Blackhole Landing with catch qq" Community Signatures (Feb 29)
    - Re: Proposed Signature - "COMMUNITY SPECIFIC-THREATS High Probability Blackhole Landing with catch qq" Joel Esler (Feb 29)
    - Re: Proposed Signature - "COMMUNITY SPECIFIC-THREATS High Probability Blackhole Landing with catch qq" Matt Olney (Mar 01)