Which may be found at http://www.grotto-group.com/~gulfie/projects... maybe
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules Fri Dec 2 00:57:42 2005 | |
|---|---|
| Filename : line | Rules |
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 1 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 2 | # $Id: bleeding-p2p.rules,v 1.603 2005/11/30 00:14:20 bhartstein Exp $
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 3 | # Bleeding Snort P2P rules.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 4 | # These are rules not stable, mature, or applicable enough to be part of the snort.org official sets.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 5 | # Someday some may be, at which time they'll be removed from this list and be available via Snort.org
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 6 | # This is for the bleeding edge junkies. Use at your own risk!!!
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 7 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 8 | # SID's are 2000000+ to avoid conflicts
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 9 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 10 | # Only basic testing has been done. At this point all we guarantee is that they won't crash a recent snort release.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 11 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 12 | # More information available at www.bleedingsnort.com
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 13 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 14 | # Please submit any custom rules or ideas to bleeding@bleedingsnort.com or the snort-sigs mailing list
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 15 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 16 | #*************************************************************
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 17 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 18 | # Copyright (c) 2005, Bleedingsnort.com
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 19 | # All rights reserved.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 20 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 21 | # Redistribution and use in source and binary forms, with or without modification, are permitted provided that the
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 22 | # following conditions are met:
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 23 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 24 | # * Redistributions of source code must retain the above copyright notice, this list of conditions and the following
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 25 | # disclaimer.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 26 | # * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 27 | # following disclaimer in the documentation and/or other materials provided with the distribution.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 28 | # * Neither the name of the nor the names of its contributors may be used to endorse or promote products derived
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 29 | # from this software without specific prior written permission.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 30 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 31 | # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 32 | # INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 33 | # DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 34 | # SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 35 | # SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 36 | # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 37 | # USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 38 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 39 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 40 | #Submitted by Marcamone
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 41 | alert tcp $HOME_NET any - > $EXTERNAL_NET any (msg: "BLEEDING-EDGE P2P Ares traffic"; flow: established; content:"User-Agent\: Ares"; reference: url,www.aresgalaxy.org; classtype: policy-violation; sid: 2001059; rev:3; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 42 | alert tcp $HOME_NET any - > $EXTERNAL_NET any (msg: "BLEEDING-EDGE P2P Ares GET"; flow: established; content:"ares"; nocase; pcre:"/(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/ares\//i"; reference: url,www.aresgalaxy.org; classtype: policy-violation; sid: 2001060; rev:5; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 43 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 44 | #By Bob Grabowsky
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 45 | alert tcp $HOME_NET any - > $EXTERNAL_NET !5190 (msg: "BLEEDING-EDGE P2P Ares File Upload"; flow: established; content:"|50 55 53 48 20 53 48 41 31 3a|"; reference: url,www.aresgalaxy.org; classtype: policy-violation; sid: 2001756; rev:2; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 46 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 47 | # By Chich Thierry
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 48 | alert tcp $HOME_NET any - > $EXTERNAL_NET any (msg: "BLEEDING-EDGE P2P BitTorrent peer sync"; flow: established; content:"|0000000d0600|"; offset: 0; depth: 6; reference: url,bitconjurer.org/BitTorrent/protocol.html; classtype: policy-violation; sid: 2000334; rev:6; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 49 | alert tcp $HOME_NET any - > $EXTERNAL_NET any (msg: "BLEEDING-EDGE P2P BitTorrent Traffic"; flow: established; content:"|0000400907000000|"; offset: 0; depth: 8; reference: url,bitconjurer.org/BitTorrent/protocol.html; classtype: policy-violation; sid: 2000357; rev:2; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 50 | alert tcp $HOME_NET any - > $EXTERNAL_NET 6969 (msg: "BLEEDING-EDGE P2P BitTorrent Announce"; flow: to_server,established; content:"/announce"; reference: url,bitconjurer.org/BitTorrent/protocol.html; classtype: policy-violation; sid: 2000369; rev:3; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 51 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 52 | # By Chich Thierry
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 53 | alert tcp any any - > any 4660:4799 (msg: "BLEEDING-EDGE P2P ed2k connection to server"; flow: to_server,established; content:"|e3|"; offset: 0; depth: 1; content:"|00000001|"; offset: 2; depth: 4; reference: url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; classtype: policy-violation; sid: 2000330; rev:4; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 54 | alert tcp any any - > any 4660:4799 (msg: "BLEEDING-EDGE P2P ed2k file search"; flow: to_server,established; content:"|e3|"; offset: 0; depth: 1; content:"|00000016|"; offset: 2; depth: 4; reference: url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; classtype: policy-violation; sid: 2000331; rev:4; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 55 | alert tcp any any - > any 4660:4799 (msg: "BLEEDING-EDGE P2P ed2k request part"; flow: to_server,established; content:"|e3|"; offset: 0; depth: 1; content:"|00000047|"; offset: 2; depth: 4; reference: url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; classtype: policy-violation; sid: 2000332; rev:4; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 56 | alert tcp any any - > any 4660:4799 (msg: "BLEEDING-EDGE P2P ed2k file request answer"; flow: to_server,established; content:"|e3|"; offset: 0; depth: 1; content:"|00000059|"; offset: 2; depth: 4; reference: url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; classtype: policy-violation; sid: 2000333; rev:4; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 57 | alert udp $EXTERNAL_NET any - > $HOME_NET any (msg: "BLEEDING-EDGE P2P Kaaza Media desktop p2pnetworking.exe Activity"; content:"|e30cb0|"; offset: 0; depth: 6; threshold: type limit, track by_dst, count 1 , seconds 600; reference: url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; classtype: policy-violation; sid: 2000340; rev:4; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 58 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 59 | #Submitted by Sam Evans
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 60 | alert tcp $HOME_NET any - > $EXTERNAL_NET 4660:4799 (msg: "BLEEDING-EDGE P2P eDonkey File Status"; flow: to_server,established; content:"|e3 14|"; offset: 0; depth: 2; classtype: policy-violation; reference:url,www.edonkey.com; sid: 2001296; rev:4; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 61 | alert tcp $HOME_NET any - > $EXTERNAL_NET 4660:4799 (msg: "BLEEDING-EDGE P2P eDonkey File Status Request"; flow: to_server,established; content:"|e3 11|"; offset: 0; depth: 2; classtype: policy-violation; reference:url,www.edonkey.com; sid: 2001297; rev:5; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 62 | alert udp $HOME_NET any - > $EXTERNAL_NET 4660:4799 (msg: "BLEEDING-EDGE P2P eDonkey Server Status Request"; content:"|e3 96|"; offset: 0; depth: 2; rawbytes;classtype: policy-violation; reference:url,www.edonkey.com; sid: 2001298; rev:3; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 63 | alert udp $HOME_NET 4660:4799 - > $EXTERNAL_NET any (msg: "BLEEDING-EDGE P2P eDonkey Server Status"; content:"|e3 97|"; offset: 0; depth: 2; rawbytes;classtype: policy-violation; reference:url,www.edonkey.com; sid: 2001299; rev:3; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 64 | alert udp $HOME_NET any - > $EXTERNAL_NET 4660:4799 (msg: "BLEEDING-EDGE P2P eDonkey Search"; content:"|e3 0e|"; offset: 0; depth: 2; rawbytes;classtype: policy-violation; reference:url,www.edonkey.com; sid: 2001305; rev:3; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 65 | #alert tcp $HOME_NET any - > $EXTERNAL_NET 4660:4799 (msg: "BLEEDING-EDGE P2P eDonkey Hello Request"; flow: to_server,established; content:"|e3|"; content:"|01|"; offset: 0; depth: 7; classtype: policy-violation; reference:url,www.edonkey.com; sid: 2001300; rev:4; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 66 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 67 | # Submitted by Pedro Quintanilha on 2005-11-07
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 68 | alert tcp $EXTERNAL_NET 443 - > $HOME_NET any (msg:"BLEEDING-EDGE P2P MS Foldershare Login Detected"; flow:established,to_client; content:"|0b|FolderShare|30 81 9f 30|"; nocase; offset: 392; depth: 18; reference:url,www.foldershare.com; classtype:policy-violation; sid:2002673; rev:2;)
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 69 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 70 | #From Cooljay
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 71 | alert tcp $HOME_NET any - > $EXTERNAL_NET any (msg: "BLEEDING-EDGE P2P Gnutella Connect"; flow: established,to_server; content:"GNUTELLA CONNECT/"; nocase; offset: 0; depth: 17; classtype: policy-violation; reference:url,www.gnutella.com; sid: 2001664; rev:3; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 72 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 73 | #Thanks to Kevin Kolk
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 74 | alert tcp $EXTERNAL_NET 6667 - > $HOME_NET any (msg: "BLEEDING-EDGE P2P iroffer IRC Bot help message"; flow: from_server,established; content:"|54 6F 20 72 65 71 75 65 73 74 20 61 20 66 69 6C 65 20 74 79 70 65 3A 20 22 2F 6D 73 67|"; depth: 500; classtype: trojan-activity; reference:url,iroffer.org; sid: 2000338; rev:3; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 75 | alert tcp $EXTERNAL_NET 6667 - > $HOME_NET any (msg: "BLEEDING-EDGE P2P iroffer IRC Bot offered files advertisement"; flow: from_server,established; content:"|54 6F 74 61 6C 20 4F 66 66 65 72 65 64 3A|"; depth: 500; classtype: trojan-activity; reference:url,iroffer.org; sid: 2000339; rev:3; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 76 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 77 | #By Bob Grabowsky
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 78 | alert udp $HOME_NET 1024:65535 - > $EXTERNAL_NET 1024:65535 (msg: "BLEEDING-EDGE P2P kazaa over UDP"; content:"KaZaA"; nocase; threshold: type threshold, track by_src,count 10, seconds 60; classtype: policy-violation; reference:url,www.kazaa.com/us/index.htm; sid: 2001796; rev:3; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 79 | alert tcp $EXTERNAL_NET any - > $HOME_NET any (msg: "BLEEDING-EDGE KazaaClient P2P Traffic"; flow: established; content:"Agent\: KazaaClient"; nocase; classtype: policy-violation; reference:url,www.kazaa.com/us/index.htm; sid: 2001812; rev:3; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 80 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 81 | #By Bob Grabowsky
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 82 | alert tcp $HOME_NET any - > $EXTERNAL_NET any (msg: "BLEEDING-EDGE P2P LimeWire P2P Traffic"; flow: established; content:"User-Agent\: LimeWire"; nocase; classtype: policy-violation; reference:url,www.limewire.com; sid: 2001808; rev:3; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 83 | alert udp $HOME_NET 6346 - > $EXTERNAL_NET 6346:6700 (msg: "BLEEDING-EDGE P2P Limewire P2P UDP Traffic"; content:"|49 50 40 83 53 43 50 41|"; threshold: type threshold, track by_src,count 10, seconds 60; classtype: policy-violation; reference:url,www.limewire.com; sid: 2001809; rev:3; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 84 | alert udp $HOME_NET 6345:6349 - > $EXTERNAL_NET 6345:6349 (msg: "BLEEDING-EDGE P2P UDP traffic -- Likely Limewire"; threshold: type threshold,track by_src,count 40, seconds 300; classtype: policy-violation; reference:url,www.limewire.com; sid: 2001841; rev:4; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 85 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 86 | #Submitted by Matt Jonkman
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 87 | alert tcp $HOME_NET any - > $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE P2P Morpheus Install"; flow: to_server,established; uricontent:"/morpheus/morpheus.exe"; nocase; reference: url,www.morpheus.com; classtype: policy-violation; sid: 2001035; rev:4; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 88 | alert tcp $HOME_NET any - > $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE P2P Morpheus Install ini Download"; flow: to_server,established; uricontent:"/morpheus/morpheus_sm.ini"; nocase; reference: url,www.morpheus.com; classtype: policy-violation; sid: 2001036; rev:4; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 89 | alert tcp $HOME_NET any - > $EXTERNAL_NET $HTTP_PORTS (msg: "BLEEDING-EDGE P2P Morpheus Update Request"; flow: to_server,established; uricontent:"/gwebcache/gcache.asg?hostfile="; nocase; reference: url,www.morpheus.com; classtype: policy-violation; sid: 2001037; rev:4; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 90 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 91 | # By Chich Thierry
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 92 | alert udp any any - > any any (msg: "BLEEDING-EDGE P2P Overnet Server Announce"; content:"|00000203006c6f63|"; offset: 36; content:"|006263703a2f2f|"; distance: 1; classtype: policy-violation; reference:url,www.overnet.com; sid: 2000335; rev:4; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 93 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 94 | #
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 95 | alert tcp any any - > any any (msg: "BLEEDING-EDGE P2P Phatbot Control Connection"; flow: established; content:"Wonk-"; content:"|00|#waste|00|"; within: 15; reference: url,www.lurhq.com/phatbot.html; classtype: trojan-activity; sid: 2000015; rev:3; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 96 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 97 | #Submitted by marcamone
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 98 | alert tcp $HOME_NET any - > 38.115.131.0/24 2234 (msg: "BLEEDING-EDGE P2P Soulseek traffic (1)"; flow: established; classtype: policy-violation; reference:url,www.slsknet.org; sid: 2001185; rev:6; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 99 | alert tcp $HOME_NET any - > 38.115.131.0/24 5534 (msg: "BLEEDING-EDGE P2P Soulseek traffic (2)"; flow: established; classtype: policy-violation; reference:url,www.slsknet.org; sid: 2001186; rev:6; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 100 | alert tcp $EXTERNAL_NET $HTTP_PORTS - > $HOME_NET any (msg: "BLEEDING-EDGE P2P Soulseek"; flow: established; content:"slsknet"; classtype: policy-violation; reference:url,www.slsknet.org; sid: 2001188; rev:5; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 101 |
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 102 | #Submitted by Matt Jonkman
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 103 | alert tcp $EXTERNAL_NET 2234 - > $HOME_NET any (msg: "BLEEDING-EDGE P2P Soulseek Filesearch Results"; flow: from_server,established; content:"|09 00 00 00 78|"; classtype: policy-violation; reference:url,www.slsknet.org; sid: 2001187; rev:4; )
|
| ./snortrules-BLEEDING-2.4/rules/bleeding-p2p.rules : 104 |
|