alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP .rhosts"; flow:to_server,established; content:".rhosts"; metadata:service ftp; reference:arachnids,328; classtype:suspicious-filename-detect; sid:335; rev:6;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP authorized_keys"; flow:to_server,established; content:"authorized_keys"; metadata:service ftp; classtype:suspicious-filename-detect; sid:1927; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP passwd retrieval attempt"; flow:to_server,established; content:"RETR"; nocase; content:"passwd"; metadata:service ftp; reference:arachnids,213; classtype:suspicious-filename-detect; sid:356; rev:6;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP shadow retrieval attempt"; flow:to_server,established; content:"RETR"; nocase; content:"shadow"; metadata:service ftp; classtype:suspicious-filename-detect; sid:1928; rev:4;)# suspicious login attemptsalert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP ADMw0rm ftp login attempt"; flow:to_server,established; content:"USER"; nocase; content:"w0rm"; distance:1; nocase; pcre:"/^USER\s+w0rm/smi"; metadata:service ftp; reference:arachnids,01; classtype:suspicious-login; sid:144; rev:10;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP adm scan"; flow:to_server,established; content:"PASS ddd@|0A|"; metadata:service ftp; reference:arachnids,332; classtype:suspicious-login; sid:353; rev:7;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP iss scan"; flow:to_server,established; content:"pass -iss@iss"; metadata:service ftp; reference:arachnids,331; classtype:suspicious-login; sid:354; rev:6;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP pass wh00t"; flow:to_server,established; content:"pass wh00t"; nocase; metadata:service ftp; reference:arachnids,324; classtype:suspicious-login; sid:355; rev:6;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP piss scan"; flow:to_server,established; content:"pass -cklaus"; metadata:service ftp; reference:url,www.mines.edu/fs_home/dlarue/cc/baby-doe.html; classtype:suspicious-login; sid:357; rev:7;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP saint scan"; flow:to_server,established; content:"pass -saint"; metadata:service ftp; reference:arachnids,330; classtype:suspicious-login; sid:358; rev:6;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP satan scan"; flow:to_server,established; content:"pass -satan"; metadata:service ftp; reference:arachnids,329; classtype:suspicious-login; sid:359; rev:6;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP USER format string attempt"; flow:to_server,established; content:"USER"; nocase; pcre:"/^USER\s[^\n]*?%[^\n]*?%/smi"; metadata:service ftp; reference:bugtraq,7474; reference:bugtraq,7776; reference:bugtraq,9262; reference:bugtraq,9402; reference:bugtraq,9600; reference:bugtraq,9800; reference:cve,2004-0277; reference:nessus,10041; reference:nessus,11687; classtype:misc-attack; sid:2178; rev:17;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP PASS format string attempt"; flow:to_server,established; content:"PASS"; nocase; pcre:"/^PASS\s[^\n]*?%[^\n]*?%/smi"; metadata:service ftp; reference:bugtraq,7474; reference:bugtraq,9262; reference:bugtraq,9800; reference:cve,2000-0699; reference:nessus,10490; classtype:misc-attack; sid:2179; rev:8;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP MKD format string attempt"; flow:to_server,established; content:"MKD"; nocase; pcre:"/^MKD\s[^\n]*?%[^\n]*?%/smi"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service ftp; reference:bugtraq,9262; classtype:misc-attack; sid:2332; rev:5;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP RENAME format string attempt"; flow:to_server,established; content:"RENAME"; nocase; pcre:"/^RENAME\s[^\n]*?%[^\n]*?%/smi"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service ftp; reference:bugtraq,9262; classtype:misc-attack; sid:2333; rev:4;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP LIST buffer overflow attempt"; flow:to_server,established; content:"LIST"; nocase; isdataat:120,relative; pcre:"/^LIST(?!\n)\s[^\n]{120}/smi"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service ftp; reference:bugtraq,10181; reference:bugtraq,6869; reference:bugtraq,7251; reference:bugtraq,7861; reference:bugtraq,8486; reference:bugtraq,9675; reference:cve,1999-0349; reference:cve,1999-1510; reference:cve,2000-0129; reference:cve,2007-0019; reference:url,www.microsoft.com/technet/security/bulletin/MS99-003.mspx; classtype:misc-attack; sid:2338; rev:20;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP LIST integer overflow attempt"; flow:to_server,established; content:"LIST"; nocase; pcre:"/^LIST\s+\x22-W\s+\d+/smi"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service ftp; reference:bugtraq,8875; reference:cve,2003-0853; reference:cve,2003-0854; reference:nessus,11912; classtype:misc-attack; sid:2272; rev:8;)alert tcp $EXTERNAL_NET any -> $HOME_NET 3535 (msg:"FTP Yak! FTP server default account login attempt"; flow:to_server,established; content:"USER"; nocase; content:"y049575046"; nocase; pcre:"/^USER\s+y049575046/smi"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service ftp; reference:bugtraq,9072; classtype:suspicious-login; sid:2334; rev:5;)alert tcp $EXTERNAL_NET any -> $HOME_NET 3535 (msg:"FTP RMD / attempt"; flow:to_server,established; content:"RMD"; nocase; pcre:"/^RMD\s+\x2f$/smi"; metadata:policy balanced-ips drop, policy security-ips drop, service ftp; reference:bugtraq,9159; classtype:attempted-dos; sid:2335; rev:5;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP invalid MDTM command attempt"; flow:to_server,established; content:"MDTM"; nocase; pcre:"/^MDTM \d+[-+]\D/smi"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service ftp; reference:bugtraq,9751; reference:cve,2001-1021; reference:cve,2004-0330; classtype:attempted-admin; sid:2416; rev:8;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP format string attempt"; flow:to_server,established; content:"%"; pcre:"/\s+.*?%.*?%/smi"; metadata:service ftp; reference:bugtraq,9800; reference:cve,2002-2074; classtype:string-detect; sid:2417; rev:4;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP RETR format string attempt"; flow:to_server,established; content:"RETR"; nocase; pcre:"/^RETR\s[^\n]*?%[^\n]*?%/smi"; metadata:service ftp; reference:bugtraq,9800; reference:cve,2004-1883; classtype:attempted-admin; sid:2574; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP RNFR overflow attempt"; flow:to_server,established; content:"RNFR"; nocase; isdataat:200,relative; pcre:"/^RNFR\s[^\n]{200}/smi"; metadata:service ftp; reference:bugtraq,14339; classtype:attempted-admin; sid:3077; rev:4;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP REST with numeric argument"; flow:to_server,established; content:"REST"; nocase; pcre:"/REST\s+[0-9]+\n/i"; metadata:service ftp; reference:bugtraq,7825; classtype:attempted-recon; sid:3460; rev:3;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP SITE INDEX format string attempt"; flow:to_server,established; content:"SITE"; nocase; content:"INDEX"; distance:0; nocase; pcre:"/^SITE\s+INDEX\s[^\n]*?%[^\n]*?%/smi"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service ftp; reference:bugtraq,1387; reference:cve,2000-0573; classtype:bad-unknown; sid:3523; rev:7;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP PORT bounce attempt"; flow:to_server,established; content:"PORT"; nocase; ftpbounce; pcre:"/^PORT/smi"; metadata:service ftp; reference:bugtraq,126; reference:cve,1999-0017; reference:nessus,10081; classtype:misc-attack; sid:3441; rev:4;)alert tcp $EXTERNAL_NET any -> $HOME_NET 2100 (msg:"FTP ORACLE password buffer overflow attempt"; flow:to_server,established; content:"pass"; nocase; pcre:"/^PASS\s+[^\n]{100}/smi"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service ftp; reference:bugtraq,8375; reference:cve,2003-0727; classtype:attempted-user; sid:3532; rev:5;)alert tcp $EXTERNAL_NET any -> $HOME_NET 2100 (msg:"FTP ORACLE TEST command buffer overflow attempt"; flow:to_server,established; content:"TEST"; nocase; pcre:"/^TEST\s+[^\n]{100,}/smi"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service ftp; reference:bugtraq,8375; reference:cve,2003-0727; classtype:misc-attack; sid:3630; rev:5;)alert tcp $EXTERNAL_NET any -> $HOME_NET 2100 (msg:"FTP ORACLE user name buffer overflow attempt"; flow:to_server,established; content:"user"; nocase; pcre:"/^USER\s+[^\n]{100,}/smi"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service ftp; reference:bugtraq,8375; reference:cve,2003-0727; classtype:attempted-user; sid:3631; rev:5;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP SIZE overflow attempt"; flow:to_server,established; content:"SIZE"; nocase; isdataat:524,relative; pcre:"/^SIZE(?!\n)\s+[\x2F\x5C][^\x2F\x3A\x5C\n][^\n]{526}/smi"; metadata:service ftp; reference:bugtraq,19617; reference:cve,2006-4318; classtype:attempted-admin; sid:8415; rev:2;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP Microsoft NLST * dos attempt"; flow:to_server,established; content:"NLST"; nocase; pcre:"/^NLST\s+[^\n]*\x2a{10}/smi"; metadata:policy balanced-ips drop, policy security-ips drop, service ftp; reference:bugtraq,2717; reference:cve,2001-0334; reference:url,www.microsoft.com/technet/security/bulletin/MS01-026.mspx; classtype:attempted-dos; sid:8481; rev:5;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP PORT overflow attempt"; flow:to_server,established; content:"PORT"; nocase; isdataat:400,relative; pcre:"/^PORT(?!\n)\s[^\n]{400}/smi"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service ftp; reference:bugtraq,18711; reference:cve,2006-2226; classtype:attempted-admin; sid:8480; rev:4;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP HELP overflow attempt"; flow:to_server,established; content:"HELP"; nocase; isdataat:200,relative; pcre:"/^HELP(?!\n)\s[^\n]{200}/smi"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service ftp; reference:bugtraq,2972; reference:cve,2001-0826; classtype:attempted-admin; sid:8479; rev:4;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP WZD-FTPD SITE arbitrary command execution attempt"; flow:established,to_server; content:"SITE"; nocase; pcre:"/^SITE\s*(\w+\s*)+\x7c/smi"; metadata:service ftp; reference:bugtraq,14935; reference:cve,2005-3081; classtype:attempted-admin; sid:8707; rev:2;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP PASV overflow attempt"; flow:to_server,established; content:"PASV"; nocase; isdataat:493,relative; pcre:"/^PASV(?!\n)\s[^\n]{493}/smi"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop, service ftp; reference:url,www.milw0rm.com/exploits/2952; classtype:attempted-admin; sid:9792; rev:4;)alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"FTP Wsftp XMD5 overflow attempt"; flow:to_server,established; content:"XMD5"; nocase; isdataat:200,relative; pcre:"/^XMD5(?!\n)\s[^\n]{200}/smi"; metadata:service ftp; reference:bugtraq,20076; reference:cve,2006-5000; classtype:attempted-admin; sid:10188; rev:2;)# alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"FTP Computer Associates eTrust Secure Content Manager PASV stack overflow attempt"; flow:to_client, established; content:"227"; depth:3; pcre:"/\x28((\d{4,}|[3-9]\d\d|2[6-9]\d|25[7-9]),\d+,\d+,\d+|\d+,(\d{4,}|[3-9]\d\d|2[6-9]\d|25[7-9]),\d+,\d+|\d+,\d+,(\d{4,}|[3-9]\d\d|2[6-9]\d|25[7-9]),\d+|\d+,\d+,\d+(\d{4,}|[3-9]\d\d|2[6-9]\d|25[7-9])),\d+,\d+\x29/"; metadata:policy security-ips drop, service ftp; reference:cve,2008-2541; classtype:attempted-user; sid:13925; rev:2;)