Which may be found at http://www.grotto-group.com/~gulfie/projects... maybe
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules Fri Dec 2 00:47:16 2005 | |
|---|---|
| Filename : line | Rules |
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 1 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 2 | # $Id: bleeding-game.rules,v 1.287 2005/11/30 00:14:20 bhartstein Exp $
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 3 | # Bleeding Snort game rules.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 4 | # These are rules not stable, mature, or applicable enough to be part of the snort.org official sets.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 5 | # Someday some may be, at which time they'll be removed from this list and be available via Snort.org
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 6 | # This is for the bleeding edge junkies. Use at your own risk!!!
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 7 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 8 | # SID's are 2000000+ to avoid conflicts
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 9 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 10 | # Only basic testing has been done. At this point all we guarantee is that they won't crash a recent snort release.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 11 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 12 | # More information available at www.bleedingsnort.com
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 13 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 14 | # Please submit any custom rules or ideas to bleeding@bleedingsnort.com or the snort-sigs mailing list
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 15 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 16 | #*************************************************************
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 17 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 18 | # Copyright (c) 2005, Bleedingsnort.com
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 19 | # All rights reserved.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 20 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 21 | # Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 22 | # following conditions are met:
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 23 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 24 | # * Redistributions of source code must retain the above copyright notice, this list of conditions and the following
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 25 | # disclaimer.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 26 | # * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 27 | # following disclaimer in the documentation and/or other materials provided with the distribution.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 28 | # * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 29 | # from this software without specific prior written permission.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 30 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 31 | # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 32 | # INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 33 | # DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 34 | # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 35 | # SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 36 | # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 37 | # USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 38 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 39 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 40 | #All by Ron Bowes. Many thanks Ron
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 41 | alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"BLEEDING-EDGE GAMES Battle.net Starcraft login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"RATS"; offset:12; depth:12; classtype: policy-violation; sid:2002101; rev:2;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 42 | alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"BLEEDING-EDGE GAMES Battle.net Brood War login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"PXES"; offset:12; depth:12; classtype: policy-violation; sid:2002102; rev:2;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 43 | alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"BLEEDING-EDGE GAMES Battle.net Diablo login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"LTRD"; offset:12; depth:12; classtype: policy-violation; sid:2002103; rev:2;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 44 | alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"BLEEDING-EDGE GAMES Battle.net Diablo 2 login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"VD2D"; offset:12; depth:12; classtype: policy-violation; sid:2002104; rev:2;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 45 | alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"BLEEDING-EDGE GAMES Battle.net Diablo 2 Lord of Destruction login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"PX2D"; offset:12; depth:12; classtype: policy-violation; sid:2002105; rev:2;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 46 | alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"BLEEDING-EDGE GAMES Battle.net Warcraft 2 login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"NB2W"; offset:12; depth:12; classtype: policy-violation; sid:2002106; rev:2;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 47 | alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"BLEEDING-EDGE GAMES Battle.net Warcraft 3 login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"3RAW"; offset:12; depth:12; classtype: policy-violation; sid:2002107; rev:2;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 48 | alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"BLEEDING-EDGE GAMES Battle.net Warcraft 3\: The Frozen throne login"; flow:established,to_server; content:"|FF 50|"; depth:2; content:"PX3W"; offset:12; depth:12; classtype: policy-violation; sid:2002108; rev:2;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 49 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 50 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net old game version"; flow:established,from_server; content:"|FF 51|"; depth:2; content:"|00 01 00 00|"; offset:4; depth:4; classtype: policy-violation; sid:2002109; rev:2;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 51 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net invalid version"; flow:established,from_server; content:"|FF 51 08 00 01 01 00 00|"; classtype: policy-violation; sid:2002110; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 52 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 53 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net invalid cdkey"; flow:established,from_server; content:"|FF 51 09 00 00 02 00 00|"; classtype: policy-violation; sid:2002111; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 54 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net cdkey in use"; flow:established,from_server; content:"|FF 51|"; depth:2; content:"|01 02 00 00|"; offset:4; depth:4; classtype: policy-violation; sid:2002112; rev:2;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 55 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net banned key"; flow:established,from_server; content:"|FF 51 09 00 02 02 00 00|"; classtype: policy-violation; sid:2002113; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 56 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 57 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net wrong product"; flow:established,from_server; content:"|FF 51 09 00 03 02 00 00|"; classtype: policy-violation; sid:2002114; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 58 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net failed account login (OLS)\: wrong password"; flow:established,from_server; content:"|FF 3A 08 00 02 00 00 00|"; classtype: policy-violation; sid:2002115; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 59 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net failed account login (NLS)\: wrong password"; flow:established,from_server; content:"|FF 54 1C 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; classtype: policy-violation; sid:2002116; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 60 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 61 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net connection reset (possible IP-Ban)"; flags:R,12; classtype: policy-violation; sid:2002117; rev:2;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 62 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 63 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net user in channel"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|01 00 00 00|"; offset:4; depth:4; classtype: policy-violation; sid:2002118; rev:2;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 64 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net user joined channel"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|02 00 00 00|"; offset:4; depth:4; classtype: policy-violation; sid:2002140; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 65 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net user left channel"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|03 00 00 00|"; offset:4; depth:4; classtype: policy-violation; sid:2002141; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 66 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net received whisper message"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|04 00 00 00|"; offset:4; depth:4; classtype: policy-violation; sid:2002142; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 67 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net received server broadcast"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|06 00 00 00|"; offset:4; depth:4; classtype: policy-violation; sid:2002143; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 68 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net joined channel"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|07 00 00 00|"; offset:4; depth:4; classtype: policy-violation; sid:2002144; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 69 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net user had a flags update"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|09 00 00 00|"; offset:4; depth:4; classtype: policy-violation; sid:2002145; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 70 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net sent a whisper"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|0a 00 00 00|"; offset:4; depth:4; classtype: policy-violation; sid:2002146; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 71 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net channel full"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|0d 00 00 00|"; offset:4; depth:4; classtype: policy-violation; sid:2002147; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 72 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net channel doesn't exist"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|0e 00 00 00|"; offset:4; depth:4; classtype: policy-violation; sid:2002148; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 73 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net channel is restricted"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|0f 00 00 00|"; offset:4; depth:4; classtype: policy-violation; sid:2002149; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 74 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net informational message"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|12 00 00 00|"; offset:4; depth:4; classtype: policy-violation; sid:2002150; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 75 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net error message"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|13 00 00 00|"; offset:4; depth:4; classtype: policy-violation; sid:2002151; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 76 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net 'emote' message"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|17 00 00 00|"; offset:4; depth:4; classtype: policy-violation; sid:2002152; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 77 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 78 | alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"BLEEDING-EDGE GAMES Battle.net outgoing chat message"; flow:established,to_server; content:"|FF 0E|"; depth:2; classtype: policy-violation; sid:2002119; rev:2;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 79 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 80 | # World of Warcraft rules, though written by Ron, are thanks to information from Justin (UserLoser)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 81 | alert tcp $HOME_NET any -> $EXTERNAL_NET 3724 (msg:"BLEEDING-EDGE GAMES World of Warcraft connection"; flow:established,to_server; content:"|00 02|"; depth:2; content:"WoW|00|"; distance:2; within:4; classtype: policy-violation; sid:2002138; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 82 | alert tcp $EXTERNAL_NET 3724 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES World of Warcraft failed logon"; flow:established,from_server; content:"|01 0A|"; depth:2; classtype: policy-violation; sid:2002139; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 83 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 84 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 85 | # Guild wars rues, again written by Ron, are thanks to information from Ian (Romi)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 86 | alert tcp $HOME_NET any -> $EXTERNAL_NET 6112 (msg:"BLEEDING-EDGE GAMES Guild Wars connection"; flow:established,to_server; content:"|01 00 00 00 00 F1 00 10 00 01 00 00 00 00 00 00 00 00 00 00 00|"; classtype: policy-violation; sid:2002154; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 87 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 88 | alert tcp $EXTERNAL_NET 6112 -> $HOME_NET any (msg:"BLEEDING-EDGE GAMES Battle.net incoming chat message"; flow:established,from_server; content:"|FF 0F|"; depth:2; content:"|05 00 00 00|"; offset:4; depth:4; classtype: policy-violation; sid:2002170; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 89 | #By Ron Iago
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 90 | alert udp $HOME_NET any -> $EXTERNAL_NET 27005 (msg:"BLEEDING-EDGE GAMES Steam connection"; content:"getchallengesteam"; classtype:policy-violation; sid:2002155; rev:1;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-game.rules : 91 |
|