Rule:--Sid:1855--Summary:This event is generated when activity indicating the presence of avariant of the Stacheldraht DDOS tool is detected.--Impact:Distributed Denial of Service (DDoS) is possible.--Detailed Information:Stracheldraht is a Distributed denial of service tool normally found onSun Solaris machines. It is made up of a Client, handler and agent. Theclients connects to the handler. Handlers can connect with up to 1000agents. Communication between the client and the handler is conductedusing tcp and the communication between the handler and the agent can beeither tcp or icmp_echoreply. This rule detects the a message sent fromthe agent to the handler. This message is used to tell the handler thatthe machine is still alive and able to take requests. The handler willthen reply with the string "ficken". This traffic differs from thetraffic described onhttp://staff.washington.edu/dittrich/misc/stacheldraht.analysis because thepackets have an icmp id of 6666 rather than 666 as noted in the analysis.--Affected Systems:	Sun Solaris --Attack Scenarios:The agent can be used to mount a distributed denial of service attack. Italso indicates that a machine is compromised.--Ease of Attack:Simple.--False Positives:None known.--False Negatives:The icmp id along with the keywords may be changed in thesource code which would then evade this rule.--Corrective Action:Disconnect power from the machine and perform forensic analysis on thehard drives.--Contributors:Snort documentation contributed by Ian MacdonaldSourcefire Vulnerability Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>--Additional References:--