Frank Knobbe sent in these signatures today via Bleedingsnort.com.
Note that on the signatures below I have added the "\" continuation character to get better formatting on the Storm Center page.
Signature for the ICMP Banking Trojan:
# By Joe Stewart, Based on valuable work by Tom Fisher
alert icmp any any -> any any (msg:"BLEEDING-EDGE TROJAN ICMP Banking Trojan \
sending encrypted stolen data"; dsize:>64; content:"|08|"; itype:8; icode:0; depth:1; \
byte_test:4,>,64,1,little; byte_test:4,<,1500,1,little; content:"|0000|"; distance:4; within:1495; \
classtype:trojan-activity; reference:url,www.websensesecuritylabs.com/alerts/alert.php?AlertID=570; \
The link to the signatures for ICMP tunnel
For the signatures for MS06-042, please refer to the link on bleedingsnort.com: signatures for MS06-042
Aug 10th 2006
1 decade ago