# alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"DELETED NETBIOS SMB-DS mqqm QMDeleteObject WriteAndX unicode little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,dce.mqqm.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"/"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_test:2,&,8,15,relative,little; byte_jump:2,25,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|09 00|"; within:2; distance:19; content:"|01 00 00 00|"; within:4; distance:4; content:"|03 00 00 00|"; within:4; distance:4; byte_test:4,>,512,8,little; reference:cve,2005-0059; reference:url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx; classtype:protocol-command-decode; sid:3615; rev:4;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"DELETED NETBIOS SMB-DS mqqm WriteAndX unicode little endian andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"/"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_test:2,&,8,15,relative,little; byte_jump:2,25,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"0|A0 B3 FD|_|06 D1 11 BB 9B 00 A0 24 EA|U%"; within:16; distance:29; flowbits:set,dce.mqqm.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3580; rev:4;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"DELETED NETBIOS SMB-DS mqqm QMDeleteObject WriteAndX overflow attempt"; flow:established,to_server; flowbits:isset,dce.mqqm.bind; content:"|00|"; depth:1; content:"|FF|SMB/"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; byte_test:2,&,8,15,relative,little; byte_jump:2,25,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 09|"; within:2; distance:19; content:"|01 00 00 00|"; within:4; distance:4; content:"|03 00 00 00|"; within:4; distance:4; byte_test:4,>,256,8; reference:cve,2005-0059; reference:url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx; classtype:protocol-command-decode; sid:3613; rev:4;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"DELETED NETBIOS SMB-DS mqqm WriteAndX bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB/"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; byte_test:2,&,8,15,relative,little; byte_jump:2,25,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"0|A0 B3 FD|_|06 D1 11 BB 9B 00 A0 24 EA|U%"; within:16; distance:29; flowbits:set,dce.mqqm.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3575; rev:4;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"DELETED NETBIOS SMB-DS mqqm QMDeleteObject overflow attempt"; flow:established,to_server; flowbits:isset,dce.mqqm.bind; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 09|"; within:2; distance:19; content:"|01 00 00 00|"; within:4; distance:4; content:"|03 00 00 00|"; within:4; distance:4; byte_test:4,>,256,8; reference:cve,2005-0059; reference:url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx; classtype:protocol-command-decode; sid:3621; rev:4;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"DELETED NETBIOS SMB-DS mqqm WriteAndX unicode andx bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"/"; depth:1; offset:39; byte_jump:2,0,little,relative; byte_test:2,&,8,15,relative,little; byte_jump:2,25,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"0|A0 B3 FD|_|06 D1 11 BB 9B 00 A0 24 EA|U%"; within:16; distance:29; flowbits:set,dce.mqqm.bind; flowbits:noalert; classtype:protocol-command-decode; sid:3578; rev:4;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"DELETED NETBIOS SMB-DS mqqm QMDeleteObject little endian andx overflow attempt"; flow:established,to_server; flowbits:isset,dce.mqqm.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|09 00|"; within:2; distance:19; content:"|01 00 00 00|"; within:4; distance:4; content:"|03 00 00 00|"; within:4; distance:4; byte_test:4,>,256,8,little; reference:cve,2005-0059; reference:url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx; classtype:protocol-command-decode; sid:3619; rev:4;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"DELETED NETBIOS SMB-DS mqqm QMDeleteObject unicode andx overflow attempt"; flow:established,to_server; flowbits:isset,dce.mqqm.bind; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"&|00|"; within:2; distance:29; content:"|5C 00|P|00|I|00|P|00|E|00 5C 00 00 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|00|"; within:1; distance:1; content:"|00 09|"; within:2; distance:19; content:"|01 00 00 00|"; within:4; distance:4; content:"|03 00 00 00|"; within:4; distance:4; byte_test:4,>,512,8; reference:cve,2005-0059; reference:url,www.microsoft.com/technet/security/Bulletin/MS05-017.mspx; classtype:protocol-command-decode; sid:3622; rev:4;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 139 (msg:"DELETED NETBIOS SMB mqqm bind attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB%"; within:5; distance:3; byte_test:1,!&,128,6,relative; pcre:"/^.{27}/R"; content:"&|00|"; within:2; distance:29; content:"|5C|PIPE|5C 00|"; distance:4; nocase; byte_jump:2,-17,relative,from_beginning,little; pcre:"/^.{4}/R"; content:"|05|"; byte_test:1,!&,16,3,relative; content:"|0B|"; within:1; distance:1; content:"0|A0 B3 FD|_|06 D1 11 BB 9B 00 A0 24 EA|U%"; within:16; distance:29; flowbits:set,dce.mqqm.bind; flowbits:noalert; metadata:policy balanced-ips drop, policy security-ips drop, service netbios-ssn; classtype:protocol-command-decode; sid:3567; rev:6;)# alert udp $EXTERNAL_NET any -> $HOME_NET 138 (msg:"DELETED NETBIOS-DG SMB Trans andx mailslot heap overflow attempt"; content:"|11|"; depth:1; content:"|00|"; distance:13; content:"|00|"; distance:0; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|03|"; within:1; distance:27; content:"|01 00 00 00|"; within:4; distance:1; content:"|5C|MAILSLOT|5C|"; within:10; distance:4; pcre:"/^((Messngr|Alerter)\x00|(?!.*\x00))/Ri"; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,18864; reference:cve,2006-1314; reference:cve,2006-3942; reference:url,www.microsoft.com/technet/security/bulletin/MS06-035.mspx; reference:url,www.microsoft.com/technet/security/bulletin/MS06-063.mspx; classtype:protocol-command-decode; sid:7045; rev:7;)# alert udp $EXTERNAL_NET any -> $HOME_NET 138 (msg:"DELETED NETBIOS-DG SMB Trans unicode andx mailslot heap overflow attempt"; content:"|11|"; depth:1; content:"|00|"; distance:13; content:"|00|"; distance:0; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|03|"; within:1; distance:27; content:"|01 00 00 00|"; within:4; distance:1; content:"|5C|MAILSLOT|5C|"; within:10; distance:4; pcre:"/^((Messngr|Alerter)\x00|(?!.*\x00))/Ri"; metadata:policy balanced-ips drop, policy security-ips drop; reference:bugtraq,18864; reference:cve,2006-1314; reference:cve,2006-3942; reference:url,www.microsoft.com/technet/security/bulletin/MS06-035.mspx; reference:url,www.microsoft.com/technet/security/bulletin/MS06-063.mspx; classtype:protocol-command-decode; sid:7046; rev:7;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"DELETED NETBIOS SMB-DS Trans unicode andx mailslot heap overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|03|"; within:1; distance:27; content:"|01 00 00 00|"; within:4; distance:1; content:"|5C|MAILSLOT|5C|"; within:10; distance:4; pcre:"/^((Messngr|Alerter)\x00|(?!.*\x00))/Ri"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop; reference:bugtraq,18864; reference:cve,2006-1314; reference:cve,2006-3942; reference:url,www.microsoft.com/technet/security/bulletin/MS06-035.mspx; reference:url,www.microsoft.com/technet/security/bulletin/MS06-063.mspx; classtype:protocol-command-decode; sid:7044; rev:7;)# alert tcp $EXTERNAL_NET any -> $HOME_NET 445 (msg:"DELETED NETBIOS SMB-DS Trans andx mailslot heap overflow attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"|FF|SMB"; within:4; distance:3; pcre:"/^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)/sR"; byte_test:1,!&,128,6,relative; content:"%"; depth:1; offset:39; byte_jump:2,0,little,relative; content:"|03|"; within:1; distance:27; content:"|01 00 00 00|"; within:4; distance:1; content:"|5C|MAILSLOT|5C|"; within:10; distance:4; pcre:"/^((Messngr|Alerter)\x00|(?!.*\x00))/Ri"; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy security-ips drop; reference:bugtraq,18864; reference:cve,2006-1314; reference:cve,2006-3942; reference:url,www.microsoft.com/technet/security/bulletin/MS06-035.mspx; reference:url,www.microsoft.com/technet/security/bulletin/MS06-063.mspx; classtype:protocol-command-decode; sid:7043; rev:7;)# alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"DELETED SHELLCODE Canvas shellcode basic encoder"; content:"|EB|0^|FC AD 93 AD 8D 1C 18 AD 8D 14 18 87 D1|VZ|01 1E AD E2 FB|V|8B 02|"; classtype:shellcode-detect; sid:10506; rev:3;)# alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"DELETED SHELLCODE Canvas shellcode basic encoder"; content:"|EB|'[|8B F3|3|C9 B1 87 8B FB 8A 13 83 C3 01 80 E2 0F C0 E2 04 8A 03 83 C3|"; classtype:shellcode-detect; sid:10507; rev:3;)# alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"DELETED SHELLCODE Canvas shellcode basic encoder"; content:"U|89 E5 83 EC|P|E8 00 00 00 00|[|89 DC 83 EC| |81 E4 00 FF FF FF 8D 83|^"; classtype:shellcode-detect; sid:10508; rev:3;)# alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"DELETED SHELLCODE Canvas shellcode basic encoder"; content:"SQ|83 EC 14 C7|D|24 FC 00 00 00 00 C7|D|24 F8 01 00 00 00 C7|D|24 F4 02|"; classtype:shellcode-detect; sid:10509; rev:3;)# alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"DELETED SHELLCODE Canvas shellcode basic encoder"; content:"|EB 19|[|8B|3|8B|{|04 01 FE 8B|K|08 01 F1 83 C3 0C 01|3|83 C3 04 E2 F9 EB|"; classtype:shellcode-detect; sid:10510; rev:3;)# alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"DELETED SHELLCODE Canvas shellcode basic encoder"; content:"|EB|AX|8B D8 8B|3|8B|{|04 03 F7 8B|K|08 03 CE|3|C0 B0 08|@@@@|03|"; classtype:shellcode-detect; sid:10511; rev:3;)# alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"DELETED SHELLCODE Canvas shellcode basic encoder"; content:"|82 18|@|01 80 A0|@|01|&|BF FF FF|&|BF FF FF 7F FF FF FF 8A 18|@|01 BE 23|"; classtype:shellcode-detect; sid:10512; rev:3;)# alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"DELETED SHELLCODE Canvas shellcode basic encoder"; content:"|EB|AX|8B D8 8B|3|8B|{|04 03 F7 8B|K|03 CE|3|C0 B0|@@@@|03 D8 8B|"; classtype:shellcode-detect; sid:10513; rev:3;)# alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"DELETED WEB-CLIENT RealPlayer G2 Control ActiveX CLSID access"; flow:established,to_client; content:"CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA"; nocase; pcre:"/<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA/si"; metadata:policy security-ips drop; classtype:attempted-user; sid:7972; rev:4;)