alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_oadestroy vulnerable function attempt"; flow:established,to_server; content:"xp_oadestroy"; nocase; reference:url,support.microsoft.com/kb/280380; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8507; rev:2;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_SetSQLSecurity unicode vulnerable function attempt"; flow:established,to_server; content:"x|00|p|00|_|00|S|00|e|00|t|00|S|00|Q|00|L|00|S|00|e|00|c|00|u|00|r|00|i|00|t|00|y|00|"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,2043; reference:cve,2000-1086; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8526; rev:5;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"SQL sp_oacreate unicode vulnerable function attempt"; flow:established,to_server; content:"s|00|p|00|_|00|o|00|a|00|c|00|r|00|e|00|a|00|t|00|e|00|"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:url,support.microsoft.com/kb/280380; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8498; rev:4;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_oamethod vulnerable function attempt"; flow:established,to_server; content:"xp_oamethod"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:url,support.microsoft.com/kb/280380; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8512; rev:4;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_sqlinventory vulnerable function attempt"; flow:established,to_server; content:"xp_sqlinventory"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:url,support.microsoft.com/kb/280380; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8536; rev:4;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"SQL xp_displayparamstmt unicode vulnerable function attempt"; flow:established,to_server; content:"x|00|p|00|_|00|d|00|i|00|s|00|p|00|l|00|a|00|y|00|p|00|a|00|r|00|a|00|m|00|s|00|t|00|m|00|t|00|"; nocase; reference:bugtraq,2030; reference:cve,2000-1081; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8500; rev:3;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_showcolv unicode vulnerable function attempt"; flow:established,to_server; content:"x|00|p|00|_|00|s|00|h|00|o|00|w|00|c|00|o|00|l|00|v|00|"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,2038; reference:cve,2000-1083; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8529; rev:5;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"SQL xp_peekqueue unicode vulnerable function attempt"; flow:established,to_server; content:"x|00|p|00|_|00|p|00|e|00|e|00|k|00|q|00|u|00|e|00|u|00|e|00|"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,2041; reference:cve,2000-1085; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8518; rev:5;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_printstatements unicode vulnerable function attempt"; flow:established,to_server; content:"x|00|p|00|_|00|p|00|r|00|i|00|n|00|t|00|s|00|t|00|a|00|t|00|e|00|m|00|e|00|n|00|t|00|s|00|"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,2041; reference:cve,2000-1086; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8520; rev:5;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_displayparamstmt vulnerable function attempt"; flow:established,to_server; content:"xp_displayparamstmt"; nocase; reference:bugtraq,2030; reference:cve,2000-1081; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8501; rev:3;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"SQL xp_enumresultset unicode vulnerable function attempt"; flow:established,to_server; content:"x|00|p|00|_|00|e|00|n|00|u|00|m|00|r|00|e|00|s|00|u|00|l|00|t|00|s|00|e|00|t|00|"; nocase; reference:bugtraq,2031; reference:cve,2000-1082; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8503; rev:3;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_oasetproperty vulnerable function attempt"; flow:established,to_server; content:"xp_oasetproperty"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:url,support.microsoft.com/kb/280380; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8516; rev:4;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_displayparamstmt unicode vulnerable function attempt"; flow:established,to_server; content:"x|00|p|00|_|00|d|00|i|00|s|00|p|00|l|00|a|00|y|00|p|00|a|00|r|00|a|00|m|00|s|00|t|00|m|00|t|00|"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,2030; reference:cve,2000-1081; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8499; rev:5;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_oasetproperty unicode vulnerable function attempt"; flow:established,to_server; content:"x|00|p|00|_|00|o|00|a|00|s|00|e|00|t|00|p|00|r|00|o|00|p|00|e|00|r|00|t|00|y|00|"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:url,support.microsoft.com/kb/280380; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8514; rev:4;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_updatecolvbm unicode vulnerable function attempt"; flow:established,to_server; content:"x|00|p|00|_|00|u|00|p|00|d|00|a|00|t|00|e|00|c|00|o|00|l|00|v|00|b|00|m|00|"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,2039; reference:cve,2000-1084; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8538; rev:5;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"SQL xp_oadestroy unicode vulnerable function attempt"; flow:established,to_server; content:"x|00|p|00|_|00|o|00|a|00|d|00|e|00|s|00|t|00|r|00|o|00|y|00|"; nocase; reference:url,support.microsoft.com/kb/280380; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8506; rev:2;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL sp_oacreate vulnerable function attempt"; flow:established,to_server; content:"sp_oacreate"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:url,support.microsoft.com/kb/280380; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8497; rev:4;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"SQL xp_oamethod unicode vulnerable function attempt"; flow:established,to_server; content:"x|00|p|00|_|00|o|00|a|00|m|00|e|00|t|00|h|00|o|00|d|00|"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:url,support.microsoft.com/kb/280380; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8513; rev:4;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_sqlagent_monitor vulnerable function attempt"; flow:established,to_server; content:"xp_sqlagent_monitor"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:url,support.microsoft.com/kb/280380; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8533; rev:4;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_showcolv vulnerable function attempt"; flow:established,to_server; content:"xp_showcolv"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,2038; reference:cve,2000-1083; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8531; rev:5;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_proxiedmetadata unicode vulnerable function attempt"; flow:established,to_server; content:"x|00|p|00|_|00|p|00|r|00|o|00|x|00|i|00|e|00|d|00|m|00|e|00|t|00|a|00|d|00|a|00|t|00|a|00|"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,2024; reference:cve,1999-0287; reference:cve,2000-1087; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8523; rev:5;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_oagetproperty unicode vulnerable function attempt"; flow:established,to_server; content:"x|00|p|00|_|00|o|00|a|00|g|00|e|00|t|00|p|00|r|00|o|00|p|00|e|00|r|00|t|00|y|00|"; nocase; reference:url,support.microsoft.com/kb/280380; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8508; rev:2;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_oamethod unicode vulnerable function attempt"; flow:established,to_server; content:"x|00|p|00|_|00|o|00|a|00|m|00|e|00|t|00|h|00|o|00|d|00|"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:url,support.microsoft.com/kb/280380; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8511; rev:4;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 139 (msg:"SQL xp_SetSQLSecurity unicode vulnerable function attempt"; flow:established,to_server; content:"x|00|p|00|_|00|S|00|e|00|t|00|S|00|Q|00|L|00|S|00|e|00|c|00|u|00|r|00|i|00|t|00|y|00|"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,2043; reference:cve,2000-1086; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8527; rev:5;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_sqlinventory unicode vulnerable function attempt"; flow:established,to_server; content:"x|00|p|00|_|00|s|00|q|00|l|00|i|00|n|00|v|00|e|00|n|00|t|00|o|00|r|00|y|00|"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:url,support.microsoft.com/kb/280380; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8535; rev:4;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433 (msg:"SQL xp_proxiedmetadata vulnerable function attempt"; flow:established,to_server; content:"xp_proxiedmetadata"; nocase; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,2024; reference:cve,1999-0287; reference:cve,2000-1087; reference:url,www.microsoft.com/technet/security/bulletin/ms00-092.mspx; classtype:attempted-admin; sid:8525; rev:5;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 1433:1500 (msg:"SQL Microsoft SQL Server 2000 Server hello buffer overflow attempt"; flow:to_server,established; dsize:>511; content:"|12 01|"; depth:2; content:!"|00|"; within:512; distance:35; reference:bugtraq,5411; reference:cve,2002-1123; reference:url,www.microsoft.com/technet/security/Bulletin/MS02-056.mspx; classtype:attempted-admin; sid:11264; rev:5;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21064 (msg:"SQL Ingres Database uuid_from_char buffer overflow attempt"; flow:to_server,established; content:"uuid_from_char"; nocase; pcre:"/uuid_from_char\s*\(\s*(\x22|\x27)[^\1]{37}/smi"; reference:bugtraq,24585; reference:cve,2007-3338; reference:url,supportconnectw.ca.com/public/ca_common_docs/ingresvuln_letter.asp; reference:url,www.ngssoftware.com/advisories/high-risk-vulnerability-in-ingres-stack-overflow; classtype:attempted-admin; sid:12027; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 3050 (msg:"SQL Firebird SQL Fbserver buffer overflow attempt"; flow:to_server,established; content:"|00 00 00 01|"; depth:4; byte_jump:4,12,big,relative; byte_test:2,>,10,1,big,relative; reference:cve,2007-3181; classtype:attempted-user; sid:12009; rev:2;)alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 7210 (msg:"SQL SAP MaxDB shell command injection attempt"; flow:established,to_server; content:"exec_sdbinfo"; nocase; pcre:"/exec_sdbinfo\s+[\x26\x3b\x7c\x3e\x3c]/i"; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,27206; reference:cve,2008-0244; classtype:attempted-admin; sid:13356; rev:1;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"SQL generic sql insert injection atttempt"; flow:established,to_server; content:"insert"; nocase; pcre:"/insert[^\n]*into/i"; metadata:policy security-ips drop, service http; reference:url,www.securiteam.com/securityreviews/5DP0N1P76E.html; classtype:web-application-attack; sid:13513; rev:1;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"SQL generic sql exec injection attempt"; flow:established,to_server; content:"exec"; nocase; pcre:"/exec[^\n]*master/i"; metadata:policy security-ips drop, service http; reference:url,www.securiteam.com/securityreviews/5DP0N1P76E.html; classtype:web-application-attack; sid:13512; rev:1;)alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"SQL generic sql update injection attempt"; flow:established,to_server; content:"update"; nocase; pcre:"/update[^\n]*set/i"; metadata:policy security-ips drop, service http; reference:url,www.securiteam.com/securityreviews/5DP0N1P76E.html; classtype:web-application-attack; sid:13514; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 3306 (msg:"SQL MySQL yaSSL SSL Hello Message Buffer Overflow attempt"; flow:to_server,established; content:"|16 03 01|"; depth:3; content:"|01|"; distance:2; content:"|03 01|"; distance:3; byte_jump:1,32,relative; byte_test:2,>,64,0,relative; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,27140; reference:cve,2008-0226; reference:url,bugs.mysql.com/bug.php?id=33814; classtype:attempted-admin; sid:13593; rev:1;)# alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"SQL oversized cast statement - possible sql injection obfuscation"; flow:established,to_server; content:"CAST|28|"; nocase; isdataat:250,relative; content:!"|29|"; within:250; metadata:policy security-ips drop, service http; reference:url,isc.sans.org/diary.html?storyid=3823; classtype:web-application-attack; sid:13791; rev:1;)alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"SQL SQL server MTF file download"; flow:to_client,established; content:"TAPE"; content:"|00 12|"; within:2; distance:82; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:cve,2008-0085; reference:url,blogs.technet.com/swi/archive/2008/07/08/ms08-040-how-to-spot-potentially-dangerous-mtf-files-crossing-network-boundary.aspx; reference:url,www.microsoft.com/technet/security/bulletin/ms08-040.mspx; classtype:misc-activity; sid:13896; rev:2;)