Rule:--Sid:243--Summary:This event is generated when the mstream DDoS tool is used.--Impact:Severe. This indicates a host may have been compromised and mstream may have been installed.  --Detailed Information:The mstream DDoS uses a tiered structure of compromised hosts to coordinate and participate in a distributed denial of service attack.There are "handler" hosts that are used to coordinate the attacks and "agent" hosts that launch the attack. An agent will attempt to contact its known handlers using a UDP packet to destination port 6838 with a string of "newserver" in the payload.--Affected Systems:Any mstream compromised host.--Attack Scenarios:After a host becomes a mstream agent, it will attempt to communicate with its known handlers.--Ease of Attack:Simple. mstream code is freely available.--False Positives:None Known.--False Negatives:There may be ports other than 6838 used for agent-to-handler communications.--Corrective Action:Perform proper forensic analysis on the suspected compromised host to discover the means of compromise.Rebuild a confirmed compromised host.Use a packet filtering firewall to block inappropriate traffic to the network to prevent hosts from being compromised.--Contributors:Original rule writer unknownSourcefire Research TeamJudy Novak <judy.novak@sourcefire.com>--Additional References:NAI:http://vil.nai.com/vil/content/v_98662.htmSecurityFocus:http://www.securityfocus.com/archive/82/58040CERT:http://www.cert.org/incident_notes/IN-2000-05.htmlCVE:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0138--