signature sid-524-a {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 0
  event "BAD-TRAFFIC tcp port 0 traffic"
  }

signature sid-524-b {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 0
  event "BAD-TRAFFIC tcp port 0 traffic"
  }

signature sid-525-a {
  ip-proto == udp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 0
  event "BAD-TRAFFIC udp port 0 traffic"
  }

signature sid-525-b {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 0
  event "BAD-TRAFFIC udp port 0 traffic"
  }

signature sid-526 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  payload-size > 6
  header tcp[13:1] & 255 == 2
  event "BAD-TRAFFIC data in TCP SYN packet"
  }

signature sid-528-a {
  src-ip == 127.0.0.0/8
  event "BAD-TRAFFIC loopback traffic"
  }

signature sid-528-b {
  dst-ip == 127.0.0.0/8
  event "BAD-TRAFFIC loopback traffic"
  }

signature sid-527 {
  same-ip
  event "BAD-TRAFFIC same SRC/DST"
  }

signature sid-523 {
  src-ip != local_nets
  dst-ip == local_nets
  event "BAD-TRAFFIC ip reserved bit set"
  header ip[6:1] & 224 == 128
  }

signature sid-1321 {
  src-ip != local_nets
  dst-ip == local_nets
  event "BAD-TRAFFIC 0 ttl"
  header ip[8:1] == 0
  }

signature sid-1322 {
  src-ip != local_nets
  dst-ip == local_nets
  event "BAD-TRAFFIC bad frag bits"
  header ip[6:1] & 224 == 96
  }

signature sid-1627 {
  src-ip != local_nets
  dst-ip == local_nets
  header ip[9:1] > 134
  event "BAD-TRAFFIC Unassigned/Reserved IP protocol"
  }

signature sid-1431 {
  ip-proto == tcp
  dst-ip == 232.0.0.0/8,233.0.0.0/8,239.0.0.0/8
  event "BAD-TRAFFIC syn to multicast address"
  header tcp[13:1] & 255 == 2
  }

signature sid-2186 {
  header ip[9:1] == 53
  event "BAD-TRAFFIC IP Proto 53 (SWIPE)"
  }

signature sid-2187 {
  header ip[9:1] == 55
  event "BAD-TRAFFIC IP Proto 55 (IP Mobility)"
  }

signature sid-2188 {
  header ip[9:1] == 77
  event "BAD-TRAFFIC IP Proto 77 (Sun ND)"
  }

signature sid-2189 {
  header ip[9:1] == 103
  event "BAD-TRAFFIC IP Proto 103 (PIM)"
  }

signature sid-1324 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 22
  event "EXPLOIT ssh CRC32 overflow /bin/sh"
  tcp-state established,originator
  payload /.*\/bin\/sh/
  }

signature sid-1326 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 22
  event "EXPLOIT ssh CRC32 overflow NOOP"
  tcp-state established,originator
  payload /.*\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90/
  }

signature sid-1327 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 22
  event "EXPLOIT ssh CRC32 overflow"
  tcp-state established,originator
  payload /\x00\x01\x57\x00\x00\x00\x18/
  payload /.{7}\xFF\xFF\xFF\xFF\x00\x00/
  }

signature sid-283 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  src-port == 80
  event "EXPLOIT Netscape 4.7 client overflow"
  tcp-state established,responder
  payload /.*\x33\xC9\xB1\x10\x3F\xE9\x06\x51\x3C\xFA\x47\x33\xC0\x50\xF7\xD0\x50/
  }

signature sid-300 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 2766
  event "EXPLOIT nlps x86 Solaris overflow"
  tcp-state established,originator
  payload /.*\xeb\x23\x5e\x33\xc0\x88\x46\xfa\x89\x46\xf5\x89\x36/
  }

signature sid-301 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 515
  event "EXPLOIT LPRng overflow"
  tcp-state established,originator
  payload /.*\x43\x07\x89\x5B\x08\x8D\x4B\x08\x89\x43\x0C\xB0\x0B\xCD\x80\x31\xC0\xFE\xC0\xCD\x80\xE8\x94\xFF\xFF\xFF\x2F\x62\x69\x6E\x2F\x73\x68\x0A/
  }

signature sid-302 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 515
  event "EXPLOIT Redhat 7.0 lprd overflow"
  tcp-state established,originator
  payload /.*\x58\x58\x58\x58\x25\x2E\x31\x37\x32\x75\x25\x33\x30\x30\x24\x6E/
  }

signature sid-304 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 6373
  event "EXPLOIT SCO calserver overflow"
  tcp-state established,originator
  payload /.*\xeb\x7f\x5d\x55\xfe\x4d\x98\xfe\x4d\x9b/
  }

signature sid-305 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 8080
  payload-size > 1000
  event "EXPLOIT delegate proxy overflow"
  tcp-state established,originator
  payload /.*[wW][hH][oO][iI][sS]\x3a\/\//
  }

signature sid-306 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 9090
  event "EXPLOIT VQServer admin"
  tcp-state established,originator
  payload /.*[gG][eE][tT] \/ [hH][tT][tT][pP]\/1\.1/
  }

signature sid-308 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  src-port == 21
  event "EXPLOIT NextFTP client overflow"
  tcp-state established,responder
  payload /.*\xb4\x20\xb4\x21\x8b\xcc\x83\xe9\x04\x8b\x19\x33\xc9\x66\xb9\x10/
  }

signature sid-309 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  payload-size > 512
  header tcp[13:1] & 255 == 16
  event "EXPLOIT sniffit overflow"
  payload /.*[fF][rR][oO][mM]\x3A\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90/
  }

signature sid-310 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "EXPLOIT x86 windows MailMax overflow"
  tcp-state established,originator
  payload /.*\xeb\x45\xeb\x20\x5b\xfc\x33\xc9\xb1\x82\x8b\xf3\x80\x2b/
  }

signature sid-311 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  dst-port == 80
  event "EXPLOIT Netscape 4.7 unsucessful overflow"
  tcp-state established,originator
  payload /.*\x33\xC9\xB1\x10\x3F\xE9\x06\x51\x3C\xFA\x47\x33\xC0\x50\xF7\xD0\x50/
  }

signature sid-312 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 123
  payload-size > 128
  event "EXPLOIT ntpdx overflow attempt"
  }

signature sid-313 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 518
  event "EXPLOIT ntalkd x86 Linux overflow"
  payload /.*\x01\x03\x00\x00\x00\x00\x00\x01\x00\x02\x02\xe8/
  }

signature sid-315 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 635
  event "EXPLOIT x86 Linux mountd overflow"
  payload /.*\x5e\xb0\x02\x89\x06\xfe\xc8\x89\x46\x04\xb0\x06\x89\x46/
  }

signature sid-316 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 635
  event "EXPLOIT x86 Linux mountd overflow"
  payload /.*\xeb\x56\x5E\x56\x56\x56\x31\xd2\x88\x56\x0b\x88\x56\x1e/
  }

signature sid-317 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 635
  event "EXPLOIT x86 Linux mountd overflow"
  payload /.*\xeb\x40\x5E\x31\xc0\x40\x89\x46\x04\x89\xc3\x40\x89\x06/
  }

signature sid-1240 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 2224
  event "EXPLOIT MDBMS overflow"
  tcp-state established,originator
  payload /.*\x01\x31\xDB\xCD\x80\xE8\x5B\xFF\xFF\xFF/
  }

signature sid-1261 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 4242
  payload-size > 1000
  event "EXPLOIT AIX pdnsd overflow"
  tcp-state established,originator
  payload /.*\x7F\xFF\xFB\x78\x7F\xFF\xFB\x78\x7F\xFF\xFB\x78\x7F\xFF\xFB\x78/
  payload /.*\x40\x8A\xFF\xC8\x40\x82\xFF\xD8\x3B\x36\xFE\x03\x3B\x76\xFE\x02/
  }

signature sid-1323 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 4321
  event "EXPLOIT rwhoisd format string attempt"
  tcp-state established,originator
  payload /.*-soa %p/
  }

signature sid-1398 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 6112
  event "EXPLOIT CDE dtspcd exploit attempt"
  tcp-state established,originator
  payload /.{9}1/
  payload /.{10}<willnevermatch>/
  }

signature sid-1751 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port >= 32772
  dst-port <= 34000
  payload-size > 720
  event "EXPLOIT cachefsd buffer overflow attempt"
  tcp-state established,originator
  payload /.*\x00\x01\x87\x86\x00\x00\x00\x01\x00\x00\x00\x05/
  }

signature sid-1894 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 749
  event "EXPLOIT kadmind buffer overflow attempt"
  tcp-state established,originator
  payload /.*\x00\xC0\x05\x08\x00\xC0\x05\x08\x00\xC0\x05\x08\x00\xC0\x05\x08/
  }

signature sid-1895 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 751
  event "EXPLOIT kadmind buffer overflow attempt"
  tcp-state established,originator
  payload /.*\x00\xC0\x05\x08\x00\xC0\x05\x08\x00\xC0\x05\x08\x00\xC0\x05\x08/
  }

signature sid-1896 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 749
  event "EXPLOIT kadmind buffer overflow attempt"
  tcp-state established,originator
  payload /.*\xff\xff\x4b\x41\x44\x4d\x30\x2e\x30\x41\x00\x00\xfb\x03/
  }

signature sid-1897 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 751
  event "EXPLOIT kadmind buffer overflow attempt"
  tcp-state established,originator
  payload /.*\xff\xff\x4b\x41\x44\x4d\x30\x2e\x30\x41\x00\x00\xfb\x03/
  }

signature sid-1898 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 749
  event "EXPLOIT kadmind buffer overflow attempt"
  tcp-state established,originator
  payload /.*\x2F\x73\x68\x68\x2F\x2F\x62\x69/
  }

signature sid-1899 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 751
  event "EXPLOIT kadmind buffer overflow attempt"
  tcp-state established,originator
  payload /.*\x2F\x73\x68\x68\x2F\x2F\x62\x69/
  }

signature sid-1812 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 22
  event "EXPLOIT gobbles SSH exploit attempt"
  tcp-state established,originator
  payload /.*GOBBLES/
  }

signature sid-1821 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 515
  event "EXPLOIT LPD dvips remote command execution attempt"
  tcp-state established,originator
  payload /.*psfile=\x22\x60/
  }

signature sid-1838 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  src-port == 22
  event "EXPLOIT SSH server banner overflow"
  tcp-state established,responder
  payload /SSH-[^\x0a]{600}/
  }

signature sid-307 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port >= 6666
  dst-port <= 7000
  event "EXPLOIT CHAT IRC topic overflow"
  tcp-state established,responder
  payload /.*\xeb\x4b\x5b\x53\x32\xe4\x83\xc3\x0b\x4b\x88\x23\xb8\x50\x77/
  }

signature sid-1382 {
  ip-proto == tcp
  dst-port >= 6666
  dst-port <= 7000
  event "EXPLOIT CHAT IRC Ettercap parse overflow attempt"
  tcp-state established,originator
  payload /.*[pP][rR][iI][vV][mM][sS][gG] [nN][iI][cC][kK][sS][eE][rR][vV] [iI][dD][eE][nN][tT][iI][fF][yY][^\x0a]{150}/
  }

signature sid-292 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "EXPLOIT x86 Linux samba overflow"
  tcp-state established,originator
  payload /.*\xeb\x2f\x5f\xeb\x4a\x5e\x89\xfb\x89\x3e\x89\xf2/
  }

signature sid-613 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  src-port == 10101
  header tcp[8:4] == 0
  header tcp[13:1] & 255 == 2
  header ip[8:1] > 220
  event "SCAN myscan"
  }

signature sid-616 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 113
  event "SCAN ident version request"
  tcp-state established,originator
  payload /.{0,8}VERSION\x0A/
  }

signature sid-619 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 80
  payload-size == 0
  header tcp[13:1] & 255 == 195
  event "SCAN cybercop os probe"
  }

signature sid-618 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 3128
  event "SCAN Squid Proxy attempt"
  header tcp[13:1] & 255 == 2
  }

signature sid-615 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 1080
  header tcp[13:1] & 255 == 2
  event "SCAN SOCKS Proxy attempt"
  }

signature sid-620 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 8080
  event "SCAN Proxy (8080) attempt"
  header tcp[13:1] & 255 == 2
  }

signature sid-621 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  header tcp[13:1] & 255 == 1
  event "SCAN FIN"
  }

signature sid-622 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  header tcp[13:1] & 255 == 2
  header tcp[4:4] == 1958810375
  event "SCAN ipEye SYN scan"
  }

signature sid-623 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  header tcp[8:4] == 0
  header tcp[13:1] & 255 == 0
  header tcp[4:4] == 0
  event "SCAN NULL"
  }

signature sid-624 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  header tcp[13:1] & 255 == 3
  event "SCAN SYN FIN"
  }

signature sid-625 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  header tcp[13:1] & 255 == 63
  event "SCAN XMAS"
  }

signature sid-1228 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  header tcp[13:1] & 255 == 41
  event "SCAN nmap XMAS"
  }

signature sid-628 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  header tcp[8:4] == 0
  header tcp[13:1] & 255 == 16
  event "SCAN nmap TCP"
  }

signature sid-629 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  header tcp[13:1] & 255 == 43
  event "SCAN nmap fingerprint attempt"
  }

signature sid-630 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  header tcp[13:1] & 255 == 3
  event "SCAN synscan portscan"
  header ip[4:2] == 39426
  }

signature sid-626 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  header tcp[13:1] & 255 == 216
  event "SCAN cybercop os PA12 attempt"
  payload /AAAAAAAAAAAAAAAA/
  }

signature sid-627 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  header tcp[8:4] == 0
  header tcp[13:1] & 255 == 227
  event "SCAN cybercop os SFU12 probe"
  payload /AAAAAAAAAAAAAAAA/
  }

signature sid-634 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port >= 10080
  dst-port <= 10081
  event "SCAN Amanda client version request"
  payload /.*[aA][mM][aA][nN][dD][aA]/
  }

signature sid-635 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 49
  event "SCAN XTACACS logout"
  payload /.*\x80\x07\x00\x00\x07\x00\x00\x04\x00\x00\x00\x00\x00/
  }

signature sid-636 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 7
  event "SCAN cybercop udp bomb"
  payload /.*cybercop/
  }

signature sid-637 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  event "SCAN Webtrends Scanner UDP Probe"
  payload /.*\x0Ahelp\x0Aquite\x0A/
  }

signature sid-1638 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 22
  event "SCAN SSH Version map attempt"
  tcp-state established,originator
  payload /.*[vV][eE][rR][sS][iI][oO][nN]_[mM][aA][pP][pP][eE][rR]/
  }

signature sid-1917 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 1900
  event "SCAN UPnP service discover attempt"
  payload /M-SEARCH /
  payload /.*ssdp:discover/
  }

signature sid-1918 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[1:1] == 0
  header icmp[0:1] == 8
  event "SCAN SolarWinds IP scan attempt"
  payload /.*SolarWinds\.Net/
  }

signature sid-1133 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  header tcp[8:4] == 0
  header tcp[13:1] & 255 == 11
  event "SCAN cybercop os probe"
  payload /AAAAAAAAAAAAAAAA/
  }

signature sid-320 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 79
  event "FINGER cmd_rootsh backdoor attempt"
  tcp-state established,originator
  payload /.*cmd_rootsh/
  }

signature sid-321 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 79
  event "FINGER account enumeration attempt"
  tcp-state established,originator
  payload /.*[aA] [bB] [cC] [dD] [eE] [fF]/
  }

signature sid-322 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 79
  event "FINGER search query"
  tcp-state established,originator
  payload /.*search/
  }

signature sid-323 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 79
  event "FINGER root query"
  tcp-state established,originator
  payload /.*root/
  }

signature sid-324 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 79
  event "FINGER null request"
  tcp-state established,originator
  payload /.*\x00/
  }

signature sid-326 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 79
  event "FINGER remote command ; execution attempt"
  tcp-state established,originator
  payload /.*\x3b/
  }

signature sid-327 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 79
  event "FINGER remote command pipe execution attempt"
  tcp-state established,originator
  payload /.*\x7c/
  }

signature sid-328 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 79
  event "FINGER bomb attempt"
  tcp-state established,originator
  payload /.*@@/
  }

signature sid-330 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 79
  event "FINGER redirection attempt"
  tcp-state established,originator
  payload /.*@/
  }

signature sid-331 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 79
  event "FINGER cybercop query"
  tcp-state established,originator
  payload /.{0,4}\x0A     /
  }

signature sid-332 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 79
  event "FINGER 0 query"
  tcp-state established,originator
  payload /.*0/
  }

signature sid-333 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 79
  event "FINGER . query"
  tcp-state established,originator
  payload /.*\./
  }

signature sid-1541 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 79
  event "FINGER version query"
  tcp-state established,originator
  payload /.*version/
  }

signature sid-337 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP CEL overflow attempt"
  tcp-state established,originator
  payload /.*[cC][eE][lL] [^\x0a]{100}/
  }

signature sid-1919 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP CWD overflow attempt"
  tcp-state established,originator
  payload /.*[cC][wW][dD] [^\x0a]{100}/
  }

signature sid-1621 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP CMD overflow attempt"
  tcp-state established,originator
  payload /.*[cC][mM][dD] [^\x0a]{100}/
  }

signature sid-1379 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP STAT overflow attempt"
  tcp-state established,originator
  payload /.*[sS][tT][aA][tT] [^\x0a]{100}/
  }

signature sid-1562 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP SITE CHOWN overflow attempt"
  tcp-state established,originator
  payload /.*[sS][iI][tT][eE] /
  payload /.* [cC][hH][oO][wW][nN] [^\x0a]{100}/
  }

signature sid-1920 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP SITE NEWER overflow attempt"
  tcp-state established,originator
  payload /.*[sS][iI][tT][eE] /
  payload /.* [nN][eE][wW][eE][rR] [^\x0a]{100}/
  }

signature sid-1888 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP SITE CPWD overflow attempt"
  tcp-state established,originator
  payload /.*[sS][iI][tT][eE] /
  payload /.* [cC][pP][wW][dD] [^\x0a]{100}/
  }

signature sid-1971 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP SITE EXEC format string attempt"
  tcp-state established,originator
  payload /.*[sS][iI][tT][eE].*.{0}.*[eE][xX][eE][cC] .{1}.*%.{1}.*%/
  }

signature sid-1529 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP SITE overflow attempt"
  tcp-state established,originator
  payload /.*[sS][iI][tT][eE] [^\x0a]{100}/
  }

signature sid-1734 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP USER overflow attempt"
  tcp-state established,originator
  payload /.*[uU][sS][eE][rR] [^\x0a]{100}/
  }

signature sid-1972 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP PASS overflow attempt"
  tcp-state established,originator
  payload /.*[pP][aA][sS][sS] [^\x0a]{100}/
  }

signature sid-1942 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP RMDIR overflow attempt"
  tcp-state established,originator
  payload /.*[rR][mM][dD][iI][rR] [^\x0a]{100}/
  }

signature sid-1973 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP MKD overflow attempt"
  tcp-state established,originator
  payload /.*[mM][kK][dD] [^\x0a]{100}/
  }

signature sid-1974 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP REST overflow attempt"
  tcp-state established,originator
  payload /.*[rR][eE][sS][tT] [^\x0a]{100}/
  }

signature sid-1975 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP DELE overflow attempt"
  tcp-state established,originator
  payload /.*[dD][eE][lL][eE] [^\x0a]{100}/
  }

signature sid-1976 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP RMD overflow attempt"
  tcp-state established,originator
  payload /.*[rR][mM][dD] [^\x0a]{100}/
  }

signature sid-1623 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP invalid MODE"
  tcp-state established,originator
  payload /.*[mM][oO][dD][eE] /
  payload /.*<willnevermatch>/
  payload /.*<willnevermatch>/
  payload /.*<willnevermatch>/
  payload /.*<willnevermatch>/
  }

signature sid-1624 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  payload-size == 10
  event "FTP large PWD command"
  tcp-state established,originator
  payload /.*[pP][wW][dD]/
  }

signature sid-1625 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  payload-size == 10
  event "FTP large SYST command"
  tcp-state established,originator
  payload /.*[sS][yY][sS][tT]/
  }

signature sid-2125 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP CWD C:\"
  tcp-state established,originator
  payload /.*[cC][wW][dD].{1}.*C:\\/
  }

signature sid-1921 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP SITE ZIPCHK attempt"
  tcp-state established,originator
  payload /.*[sS][iI][tT][eE] /
  payload /.* [zZ][iI][pP][cC][hH][kK] [^\x0a]{100}/
  }

signature sid-1864 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP SITE NEWER attempt"
  tcp-state established,originator
  payload /.*[sS][iI][tT][eE] /
  payload /.* [nN][eE][wW][eE][rR] /
  }

signature sid-361 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP site exec"
  tcp-state established,originator
  payload /.*[sS][iI][tT][eE] .*.{0}.*[eE][xX][eE][cC] /
  }

signature sid-1777 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP EXPLOIT STAT * dos attempt"
  tcp-state established,originator
  payload /.*[sS][tT][aA][tT].{1}.*\*/
  }

signature sid-1778 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP EXPLOIT STAT ? dos attempt"
  tcp-state established,originator
  payload /.*[sS][tT][aA][tT].{1}.*\?/
  }

signature sid-362 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP tar parameters"
  tcp-state established,originator
  payload /.*\" --[uU][sS][eE]-[cC][oO][mM][pP][rR][eE][sS][sS]-[pP][rR][oO][gG][rR][aA][mM]\" /
  }

signature sid-336 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP CWD ~root attempt"
  tcp-state established,originator
  payload /.*CWD /
  payload /.* ~[rR][oO][oO][tT]/
  }

signature sid-1229 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP CWD ..."
  tcp-state established,originator
  payload /.*CWD /
  payload /.* \.\.\./
  }

signature sid-1672 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP CWD ~<NEWLINE> attempt"
  tcp-state established,originator
  payload /.*CWD /
  payload /.* ~\x0A/
  }

signature sid-1728 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP CWD ~<CR><NEWLINE> attempt"
  tcp-state established,originator
  payload /.*CWD /
  payload /.* ~\x0D\x0A/
  }

signature sid-1779 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP CWD .... attempt"
  tcp-state established,originator
  payload /.*CWD /
  payload /.* \.\.\.\./
  }

signature sid-360 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP serv-u directory transversal"
  tcp-state established,originator
  payload /.*\.%20\./
  }

signature sid-1377 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP wu-ftp bad file completion attempt ["
  tcp-state established,originator
  payload /.*~.{1}.*\[/
  }

signature sid-1378 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP wu-ftp bad file completion attempt {"
  tcp-state established,originator
  payload /.*~.{1}.*\{/
  }

signature sid-1530 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP format string attempt"
  tcp-state established,originator
  payload /.*%[pP]/
  }

signature sid-1622 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP RNFR ././ attempt"
  tcp-state established,originator
  payload /.*[rR][nN][fF][rR] /
  payload /.* \.\/\.\//
  }

signature sid-1748 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  payload-size > 100
  event "FTP command overflow attempt"
  tcp-state established,originator
  }

signature sid-1992 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP LIST directory traversal attempt"
  payload /.*LIST.{1}.*\.\..{1}.*\.\./
  }

signature sid-334 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP .forward"
  tcp-state established,originator
  payload /.*\.forward/
  }

signature sid-335 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP .rhosts"
  tcp-state established,originator
  payload /.*\.rhosts/
  }

signature sid-1927 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP authorized_keys"
  tcp-state established,originator
  payload /.*authorized_keys/
  }

signature sid-356 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP passwd retrieval attempt"
  tcp-state established,originator
  payload /.*[rR][eE][tT][rR]/
  payload /.*passwd/
  }

signature sid-1928 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP shadow retrieval attempt"
  tcp-state established,originator
  payload /.*[rR][eE][tT][rR]/
  payload /.*shadow/
  }

signature sid-144 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP ADMw0rm ftp login attempt"
  tcp-state established,originator
  payload /.*USER w0rm\x0D\x0A/
  }

signature sid-353 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP adm scan"
  tcp-state established,originator
  payload /.*PASS ddd@\x0a/
  }

signature sid-354 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP iss scan"
  tcp-state established,originator
  payload /.*pass -iss@iss/
  }

signature sid-355 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP pass wh00t"
  tcp-state established,originator
  payload /.*[pP][aA][sS][sS] [wW][hH]00[tT]/
  }

signature sid-357 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP piss scan"
  tcp-state established,originator
  payload /.*pass -cklaus/
  }

signature sid-358 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP saint scan"
  tcp-state established,originator
  payload /.*pass -saint/
  }

signature sid-359 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 21
  event "FTP satan scan"
  tcp-state established,originator
  payload /.*pass -satan/
  }

signature sid-1430 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == telnet_servers
  dst-port == 23
  event "TELNET Solaris memory mismanagement exploit attempt"
  tcp-state established,originator
  payload /.*\xA0\x23\xA0\x10\xAE\x23\x80\x10\xEE\x23\xBF\xEC\x82\x05\xE0\xD6\x90\x25\xE0/
  }

signature sid-711 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == telnet_servers
  dst-port == 23
  event "TELNET SGI telnetd format bug"
  tcp-state established,originator
  payload /.*_RLD/
  payload /.*bin\/sh/
  }

signature sid-712 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == telnet_servers
  dst-port == 23
  event "TELNET ld_library_path"
  tcp-state established,originator
  payload /.*ld_library_path/
  }

signature sid-713 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == telnet_servers
  dst-port == 23
  event "TELNET livingston DOS"
  tcp-state established,originator
  payload /.*\xff\xf3\xff\xf3\xff\xf3\xff\xf3\xff\xf3/
  }

signature sid-714 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == telnet_servers
  dst-port == 23
  event "TELNET resolv_host_conf"
  tcp-state established,originator
  payload /.*resolv_host_conf/
  }

signature sid-715 {
  ip-proto == tcp
  src-ip == telnet_servers
  dst-ip != local_nets
  src-port == 23
  event "TELNET Attempted SU from wrong group"
  tcp-state established,responder
  payload /.*[tT][oO] [sS][uU] [rR][oO][oO][tT]/
  }

signature sid-717 {
  ip-proto == tcp
  src-ip == telnet_servers
  dst-ip != local_nets
  src-port == 23
  event "TELNET not on console"
  tcp-state established,responder
  payload /.*[nN][oO][tT] [oO][nN] [sS][yY][sS][tT][eE][mM] [cC][oO][nN][sS][oO][lL][eE]/
  }

signature sid-718 {
  ip-proto == tcp
  src-ip == telnet_servers
  dst-ip != local_nets
  src-port == 23
  event "TELNET login incorrect"
  tcp-state established,responder
  payload /.*Login incorrect/
  }

signature sid-719 {
  ip-proto == tcp
  src-ip == telnet_servers
  dst-ip != local_nets
  src-port == 23
  event "TELNET root login"
  tcp-state established,responder
  payload /.*login: root/
  }

signature sid-1252 {
  ip-proto == tcp
  src-ip == telnet_servers
  dst-ip != local_nets
  src-port == 23
  event "TELNET bsd telnet exploit response"
  tcp-state established,responder
  payload /.*\x0D\x0A\[Yes\]\x0D\x0A\xFF\xFE\x08\xFF\xFD\x26/
  }

signature sid-1253 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == telnet_servers
  dst-port == 23
  payload-size > 200
  event "TELNET bsd exploit client finishing"
  tcp-state established,responder
  payload /.{199}\xFF\xF6\xFF\xF6\xFF\xFB\x08\xFF\xF6/
  }

signature sid-709 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == telnet_servers
  dst-port == 23
  event "TELNET 4Dgifts SGI account attempt"
  tcp-state established,originator
  payload /.*4Dgifts/
  }

signature sid-710 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == telnet_servers
  dst-port == 23
  event "TELNET EZsetup account attempt"
  tcp-state established,originator
  payload /.*OutOfBox/
  }

signature sid-716 {
  ip-proto == tcp
  src-ip == telnet_servers
  dst-ip != local_nets
  src-port == 23
  event "TELNET access"
  tcp-state established,responder
  payload /.*\xFF\xFD\x18\xFF\xFD\x1F\xFF\xFD\x23\xFF\xFD\x27\xFF\xFD\x24/
  }

signature sid-2093 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_test: 4,>,2048,12,relative
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap proxy integer overflow attempt TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0\x00.{3}\x00\x00\x00\x05/
  }

signature sid-2092 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap proxy integer overflow attempt UDP"
  # Not supported: byte_test: 4,>,2048,12,relative
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0\x00.{3}\x00\x00\x00\x05/
  }

signature sid-1922 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  event "RPC portmap proxy attempt TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x05/
  }

signature sid-1923 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  event "RPC portmap proxy attempt UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x05/
  }

signature sid-1280 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  event "RPC portmap listing UDP 111"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x04/
  }

signature sid-598 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  event "RPC portmap listing TCP 111"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x04/
  }

signature sid-1949 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  event "RPC portmap SET attempt TCP 111"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x01/
  }

signature sid-1950 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  event "RPC portmap SET attempt UDP 111"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x01/
  }

signature sid-2014 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  event "RPC portmap UNSET attempt TCP 111"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x02/
  }

signature sid-2015 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  event "RPC portmap UNSET attempt UDP 111"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x02/
  }

signature sid-599 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 32771
  event "RPC portmap listing TCP 32771"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x04/
  }

signature sid-1281 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 32771
  event "RPC portmap listing UDP 32771"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x04/
  }

signature sid-1746 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap cachefsd request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x87\x8B/
  }

signature sid-1747 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap cachefsd request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x87\x8B/
  }

signature sid-1732 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap rwalld request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xA8/
  }

signature sid-1733 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap rwalld request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xA8/
  }

signature sid-575 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap admind request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xF7/
  }

signature sid-1262 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap admind request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xF7/
  }

signature sid-576 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap amountd request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x87\x03/
  }

signature sid-1263 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap amountd request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x87\x03/
  }

signature sid-577 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap bootparam request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xBA/
  }

signature sid-1264 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap bootparam request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xBA/
  }

signature sid-580 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap nisd request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x87\xcc/
  }

signature sid-1267 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap nisd request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x87\xcc/
  }

signature sid-581 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap pcnfsd request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x02\x49\xf1/
  }

signature sid-1268 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap pcnfsd request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x02\x49\xf1/
  }

signature sid-582 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap rexd request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xB1/
  }

signature sid-1269 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap rexd request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xB1/
  }

signature sid-584 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap rusers request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xA2/
  }

signature sid-1271 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap rusers request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xA2/
  }

signature sid-612 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC rusers query UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA2.{4}\x00\x00\x00\x02/
  }

signature sid-586 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap selection_svc request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xAF/
  }

signature sid-1273 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap selection_svc request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xAF/
  }

signature sid-587 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap status request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xB8/
  }

signature sid-2016 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap status request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xB8/
  }

signature sid-593 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap snmpXdmi request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x87\x99/
  }

signature sid-1279 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap snmpXdmi request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x87\x99/
  }

signature sid-569 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_test: 4,>,1024,20,relative
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC snmpXdmi overflow attempt TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x87\x99.{4}\x00\x00\x01\x01/
  }

signature sid-2045 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC snmpXdmi overflow attempt UDP"
  # Not supported: byte_test: 4,>,1024,20,relative
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x87\x99.{4}\x00\x00\x01\x01/
  }

signature sid-2017 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap espd request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x05\xF7\x75/
  }

signature sid-595 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap espd request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x05\xF7\x75/
  }

signature sid-1890 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port >= 1024
  dst-port <= 65535
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC status GHBN format string attack"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xB8.{4}\x00\x00\x00\x02.{0,251}%x %x/
  }

signature sid-1891 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port >= 1024
  dst-port <= 65535
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC status GHBN format string attack"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xB8.{4}\x00\x00\x00\x02.{0,251}%x %x/
  }

signature sid-579 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap mountd request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xA5/
  }

signature sid-1266 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap mountd request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xA5/
  }

signature sid-574 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC mountd TCP export request"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA5.{4}\x00\x00\x00\x05/
  }

signature sid-1924 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC mountd UDP export request"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA5.{4}\x00\x00\x00\x05/
  }

signature sid-1925 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC mountd TCP exportall request"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA5.{4}\x00\x00\x00\x06/
  }

signature sid-1926 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC mountd UDP exportall request"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA5.{4}\x00\x00\x00\x06/
  }

signature sid-1951 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC mountd TCP mount request"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA5.{4}\x00\x00\x00\x01/
  }

signature sid-1952 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC mountd UDP mount request"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA5.{4}\x00\x00\x00\x01/
  }

signature sid-2018 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC mountd TCP dump request"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA5.{4}\x00\x00\x00\x02/
  }

signature sid-2019 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC mountd UDP dump request"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA5.{4}\x00\x00\x00\x02/
  }

signature sid-2020 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC mountd TCP unmount request"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA5.{4}\x00\x00\x00\x03/
  }

signature sid-2021 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC mountd UDP unmount request"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA5.{4}\x00\x00\x00\x03/
  }

signature sid-2022 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC mountd TCP unmountall request"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA5.{4}\x00\x00\x00\x04/
  }

signature sid-2023 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC mountd UDP unmountall request"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA5.{4}\x00\x00\x00\x04/
  }

signature sid-1905 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port >= 500
  dst-port <= 65535
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC AMD UDP amqproc_mount plog overflow attempt"
  # Not supported: byte_test: 4,>,512,0,relative
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x04\x93\xF3.{4}\x00\x00\x00\x07/
  }

signature sid-1906 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port >= 500
  dst-port <= 65535
  # Not supported: byte_test: 4,>,512,0,relative
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC AMD TCP amqproc_mount plog overflow attempt"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x04\x93\xF3.{4}\x00\x00\x00\x07/
  }

signature sid-1953 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port >= 500
  dst-port <= 65535
  event "RPC AMD TCP pid request"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x04\x93\xF3.{4}\x00\x00\x00\x09/
  }

signature sid-1954 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port >= 500
  dst-port <= 65535
  event "RPC AMD UDP pid request"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x04\x93\xF3.{4}\x00\x00\x00\x09/
  }

signature sid-1955 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port >= 500
  dst-port <= 65535
  event "RPC AMD TCP version request"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x04\x93\xF3.{4}\x00\x00\x00\x08/
  }

signature sid-1956 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port >= 500
  dst-port <= 65535
  event "RPC AMD UDP version request"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x04\x93\xF3.{4}\x00\x00\x00\x08/
  }

signature sid-578 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap cmsd request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xE4/
  }

signature sid-1265 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap cmsd request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xE4/
  }

signature sid-1907 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC CMSD UDP CMSD_CREATE buffer overflow attempt"
  # Not supported: byte_test: 4,>,1024,0,relative
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xE4.{4}\x00\x00\x00\x15/
  }

signature sid-1908 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_test: 4,>,1024,0,relative
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC CMSD TCP CMSD_CREATE buffer overflow attempt"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xE4.{4}\x00\x00\x00\x15/
  }

signature sid-2094 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC CMSD UDP CMSD_CREATE array buffer overflow attempt"
  # Not supported: byte_test: 4,>,1024,20,relative
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xE4.{4}\x00\x00\x00\x15/
  }

signature sid-2095 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_test: 4,>,1024,20,relative
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC CMSD TCP CMSD_CREATE array buffer overflow attempt"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xE4.{4}\x00\x00\x00\x15/
  }

signature sid-1909 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_test: 4,>,1000,28,relative
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align,4,0,relative,align
  event "RPC CMSD TCP CMSD_INSERT buffer overflow attempt"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xE4.{4}\x00\x00\x00\x06/
  }

signature sid-1910 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align,4,0,relative,align
  event "RPC CMSD udp CMSD_INSERT buffer overflow attempt"
  # Not supported: byte_test: 4,>,1000,28,relative
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xE4.{4}\x00\x00\x00\x06/
  }

signature sid-1272 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap sadmind request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x87\x88/
  }

signature sid-585 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap sadmind request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x87\x88/
  }

signature sid-1911 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align,4,124,relative,align,4,20,relative,align
  event "RPC sadmind UDP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt"
  # Not supported: byte_test: 4,>,512,4,relative
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x87\x88.{4}\x00\x00\x00\x01/
  }

signature sid-1912 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_test: 4,>,512,4,relative
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align,4,124,relative,align,4,20,relative,align
  event "RPC sadmind TCP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x87\x88.{4}\x00\x00\x00\x01/
  }

signature sid-1957 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC sadmind UDP PING"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x87\x88.{4}\x00\x00\x00\x00/
  }

signature sid-1958 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC sadmind TCP PING"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x87\x88.{4}\x00\x00\x00\x00/
  }

signature sid-583 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap rstatd request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xA1/
  }

signature sid-1270 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap rstatd request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xA1/
  }

signature sid-1913 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC STATD UDP stat mon_name format string exploit attempt"
  # Not supported: byte_test: 4,>,100,0,relative
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xB8.{4}\x00\x00\x00\x01/
  }

signature sid-1914 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_test: 4,>,100,0,relative
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC STATD TCP stat mon_name format string exploit attempt"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xB8.{4}\x00\x00\x00\x01/
  }

signature sid-1915 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC STATD UDP monitor mon_name format string exploit attempt"
  # Not supported: byte_test: 4,>,100,0,relative
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xB8.{4}\x00\x00\x00\x02/
  }

signature sid-1916 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_test: 4,>,100,0,relative
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC STATD TCP monitor mon_name format string exploit attempt"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xB8.{4}\x00\x00\x00\x02/
  }

signature sid-1277 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap ypupdated request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xBC/
  }

signature sid-591 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap ypupdated request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xBC/
  }

signature sid-2088 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC ypupdated arbitrary command attempt UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xBC.{4}\x00\x00\x00\x01.{4}.*\|/
  }

signature sid-2089 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC ypupdated arbitrary command attempt TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xBC.{4}\x00\x00\x00\x01.{4}.*\|/
  }

signature sid-1959 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap NFS request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xA3/
  }

signature sid-1960 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap NFS request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xA3/
  }

signature sid-1961 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap RQUOTA request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xAB/
  }

signature sid-1962 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap RQUOTA request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xAB/
  }

signature sid-1963 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC RQUOTA getquota overflow attempt UDP"
  # Not supported: byte_test: 4,>,128,0,relative
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xAB.{4}\x00\x00\x00\x01/
  }

signature sid-2024 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC RQUOTA getquota overflow attempt TCP"
  # Not supported: byte_test: 4,>,128,0,relative
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xAB.{4}\x00\x00\x00\x01/
  }

signature sid-588 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap ttdbserv request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xF3/
  }

signature sid-1274 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap ttdbserv request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xF3/
  }

signature sid-1964 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC tooltalk UDP overflow attempt"
  # Not supported: byte_test: 4,>,128,0,relative
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xF3.{4}\x00\x00\x00\x07/
  }

signature sid-1965 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_test: 4,>,128,0,relative
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC tooltalk TCP overflow attempt"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xF3.{4}\x00\x00\x00\x07/
  }

signature sid-589 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap yppasswd request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xA9/
  }

signature sid-1275 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap yppasswd request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xA9/
  }

signature sid-2027 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  # Not supported: byte_test: 4,>,64,0,relative
  event "RPC yppasswd old password overflow attempt UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA9.{4}\x00\x00\x00\x01/
  }

signature sid-2028 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_test: 4,>,64,0,relative
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC yppasswd old password overflow attempt TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA9.{4}\x00\x00\x00\x01/
  }

signature sid-2025 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align,4,0,relative,align
  event "RPC yppasswd username overflow attempt UDP"
  # Not supported: byte_test: 4,>,64,0,relative
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA9.{4}\x00\x00\x00\x01/
  }

signature sid-2026 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_test: 4,>,64,0,relative
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align,4,0,relative,align
  event "RPC yppasswd username overflow attempt TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA9.{4}\x00\x00\x00\x01/
  }

signature sid-2029 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align,4,0,relative,align,4,0,relative,align
  # Not supported: byte_test: 4,>,64,0,relative
  event "RPC yppasswd new password overflow attempt UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA9.{4}\x00\x00\x00\x01/
  }

signature sid-2030 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  # Not supported: byte_test: 4,>,64,0,relative
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align,4,0,relative,align,4,0,relative,align
  event "RPC yppasswd new password overflow attempt TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA9.{4}\x00\x00\x00\x01/
  }

signature sid-2031 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC yppasswd user update UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA9.{4}\x00\x00\x00\x01/
  }

signature sid-2032 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC yppasswd user update TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA9.{4}\x00\x00\x00\x01/
  }

signature sid-590 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap ypserv request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xA4/
  }

signature sid-1276 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap ypserv request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xA4/
  }

signature sid-2033 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC ypserv maplist request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA4.{4}\x00\x00\x00\x0B/
  }

signature sid-2034 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC ypserv maplist request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA4.{4}\x00\x00\x00\x0B/
  }

signature sid-2035 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap network-status-monitor request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x03\x0D\x70/
  }

signature sid-2036 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap network-status-monitor request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x03\x0D\x70/
  }

signature sid-2037 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC network-status-monitor mon-callback request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x03\x0D\x70.{4}\x00\x00\x00\x01/
  }

signature sid-2038 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC network-status-monitor mon-callback request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x03\x0D\x70.{4}\x00\x00\x00\x01/
  }

signature sid-2079 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap nlockmgr request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xB5/
  }

signature sid-2080 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap nlockmgr request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x86\xB5/
  }

signature sid-2081 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap rpc.xfsmd request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x05\xF7\x68/
  }

signature sid-2082 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap rpc.xfsmd request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x05\xF7\x68/
  }

signature sid-2083 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC rpc.xfsmd xfs_export attempt UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x05\xF7\x68.{4}\x00\x00\x00\x0D/
  }

signature sid-2084 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  event "RPC rpc.xfsmd xfs_export attempt TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x05\xF7\x68.{4}\x00\x00\x00\x0D/
  }

signature sid-2005 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap kcms_server request UDP"
  payload /.{3}\x00\x00\x00\x00/
  payload /.{11}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x87\x7D/
  }

signature sid-2006 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 111
  # Not supported: byte_jump: 4,4,relative,align,4,4,relative,align
  event "RPC portmap kcms_server request TCP"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x86\xA0.{4}\x00\x00\x00\x03\x00\x01\x87\x7D/
  }

signature sid-2007 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port >= 32771
  dst-port <= 34000
  # Not supported: byte_jump: 4,20,relative,align,4,4,relative,align
  event "RPC kcms_server directory traversal attempt"
  tcp-state established,originator
  payload /.{7}\x00\x00\x00\x00/
  payload /.{15}\x00\x01\x87\x7D.*.{0}.*\/\.\.\//
  }

signature sid-601 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 513
  event "RSERVICES rlogin LinuxNIS"
  tcp-state established,originator
  payload /.*\x3a\x3a\x3a\x3a\x3a\x3a\x3a\x3a\x00\x3a\x3a\x3a\x3a\x3a\x3a\x3a\x3a/
  }

signature sid-602 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 513
  event "RSERVICES rlogin bin"
  tcp-state established,originator
  payload /.*bin\x00bin\x00/
  }

signature sid-603 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 513
  event "RSERVICES rlogin echo++"
  tcp-state established,originator
  payload /.*echo \x22 \+ \+ \x22/
  }

signature sid-604 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 513
  event "RSERVICES rsh froot"
  tcp-state established,originator
  payload /.*-froot\x00/
  }

signature sid-611 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 513
  event "RSERVICES rlogin login failure"
  tcp-state established,responder
  payload /.*\x01rlogind\x3a Permission denied\./
  }

signature sid-605 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 513
  event "RSERVICES rlogin login failure"
  tcp-state established,responder
  payload /.*login incorrect/
  }

signature sid-606 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 513
  event "RSERVICES rlogin root"
  tcp-state established,originator
  payload /.*root\x00root\x00/
  }

signature sid-607 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 514
  event "RSERVICES rsh bin"
  tcp-state established,originator
  payload /.*bin\x00bin\x00/
  }

signature sid-608 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 514
  event "RSERVICES rsh echo + +"
  tcp-state established,originator
  payload /.*echo \x22\+ \+\x22/
  }

signature sid-609 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 514
  event "RSERVICES rsh froot"
  tcp-state established,originator
  payload /.*-froot\x00/
  }

signature sid-610 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 514
  event "RSERVICES rsh root"
  tcp-state established,originator
  payload /.*root\x00root\x00/
  }

signature sid-2113 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 512
  event "RSERVICES rexec username overflow attempt"
  payload /.{8}.*\x00.*.{0}.*\x00.*.{0}.*\x00/
  }

signature sid-2114 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 512
  event "RSERVICES rexec password overflow attempt"
  payload /.*\x00.{33}.*\x00.*.{0}.*\x00/
  }

signature sid-268 {
  src-ip != local_nets
  dst-ip == local_nets
  payload-size == 408
  event "DOS Jolt attack"
  header ip[6:1] & 224 == 32
  }

signature sid-270 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  event "DOS Teardrop attack"
  header ip[6:1] & 224 == 32
  header ip[4:2] == 242
  }

signature sid-271-a {
  ip-proto == udp
  src-port == 7
  dst-port == 19
  event "DOS UDP echo+chargen bomb"
  }

signature sid-271-b {
  ip-proto == udp
  src-port == 19
  dst-port == 7
  event "DOS UDP echo+chargen bomb"
  }

signature sid-272 {
  src-ip != local_nets
  dst-ip == local_nets
  header ip[9:1] == 2
  event "DOS IGMP dos attack"
  header ip[6:1] & 224 == 32
  payload /\x02\x00/
  }

signature sid-273 {
  src-ip != local_nets
  dst-ip == local_nets
  header ip[9:1] == 2
  event "DOS IGMP dos attack"
  header ip[6:1] & 224 == 32
  payload /\x00\x00/
  }

signature sid-274 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 8
  event "DOS ath"
  payload /.*\+\+\+[aA][tT][hH]/
  }

signature sid-275-a {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  header tcp[13:1] & 255 == 2
  header tcp[4:4] == 6060842
  event "DOS NAPTHA"
  header ip[4:2] == 413
  }

signature sid-275-b {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  header tcp[13:1] & 255 == 2
  header tcp[4:4] == 6060842
  event "DOS NAPTHA"
  header ip[4:2] == 413
  }

signature sid-276 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 7070
  event "DOS Real Audio Server"
  tcp-state established,originator
  payload /.*\xff\xf4\xff\xfd\x06/
  }

signature sid-277 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 7070
  event "DOS Real Server template.html"
  tcp-state established,originator
  payload /.*\/[vV][iI][eE][wW][sS][oO][uU][rR][cC][eE]\/[tT][eE][mM][pP][lL][aA][tT][eE]\.[hH][tT][mM][lL]\?/
  }

signature sid-278 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 8080
  event "DOS Real Server template.html"
  tcp-state established,originator
  payload /.*\/[vV][iI][eE][wW][sS][oO][uU][rR][cC][eE]\/[tT][eE][mM][pP][lL][aA][tT][eE]\.[hH][tT][mM][lL]\?/
  }

signature sid-279 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 161
  payload-size == 0
  event "DOS Bay/Nortel Nautica Marlin"
  }

signature sid-281 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 9
  event "DOS Ascend Route"
  payload /.{24}.{0,17}\x4e\x41\x4d\x45\x4e\x41\x4d\x45/
  }

signature sid-282 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 617
  payload-size > 1445
  event "DOS arkiea backup"
  tcp-state established,originator
  }

signature sid-1257 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port >= 135
  dst-port <= 139
  header tcp[13:1] & 255 == 32
  event "DOS Winnuke attack"
  }

signature sid-1408 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 3372
  payload-size > 1023
  event "DOS MSDTC attempt"
  tcp-state established,originator
  }

signature sid-1605 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 6004
  event "DOS iParty DOS attempt"
  tcp-state established,originator
  payload /.*\xFF\xFF\xFF\xFF\xFF\xFF/
  }

signature sid-1641 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port >= 6789
  dst-port <= 6790
  payload-size == 1
  event "DOS DB2 dos attempt"
  tcp-state established,originator
  }

signature sid-1545 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == 80
  payload-size == 1
  event "DOS Cisco attempt"
  tcp-state established,originator
  payload /\x13/
  }

signature sid-221 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 8
  event "DDOS TFN Probe"
  header ip[4:2] == 678
  payload /.*1234/
  }

signature sid-222 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 0
  event "DDOS tfn2k icmp possible communication"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 0
  payload /.*AAAAAAAAAA/
  }

signature sid-223 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 31335
  event "DDOS Trin00:DaemontoMaster(PONGdetected)"
  payload /.*PONG/
  }

signature sid-228 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 0
  header icmp[0:1] == 0,8
  header icmp[6:2] == 0
  event "DDOS TFN client command BE"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 456
  }

signature sid-230 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 20432
  event "DDOS shaft client to handler"
  tcp-state established
  }

signature sid-231 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 31335
  event "DDOS Trin00:DaemontoMaster(messagedetected)"
  payload /.*l44/
  }

signature sid-232 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 31335
  event "DDOS Trin00:DaemontoMaster(*HELLO*detected)"
  payload /.*\*HELLO\*/
  }

signature sid-233 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 27665
  event "DDOS Trin00:Attacker to Master default startup password"
  tcp-state established,originator
  payload /.*betaalmostdone/
  }

signature sid-234 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 27665
  event "DDOS Trin00 Attacker to Master default password"
  tcp-state established,originator
  payload /.*gOrave/
  }

signature sid-235 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 27665
  event "DDOS Trin00 Attacker to Master default mdie password"
  tcp-state established,originator
  payload /.*killme/
  }

signature sid-237 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 27444
  event "DDOS Trin00:MastertoDaemon(defaultpassdetected!)"
  payload /.*l44adsl/
  }

signature sid-238 {
  ip-proto == icmp
  src-ip == local_nets
  dst-ip != local_nets
  header icmp[0:1] == 0
  header icmp[0:1] == 0,8
  header icmp[6:2] == 0
  event "DDOS TFN server response"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 123
  payload /.*shell bound to port/
  }

signature sid-239 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 18753
  event "DDOS shaft handler to agent"
  payload /.*alive tijgu/
  }

signature sid-240 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 20433
  event "DDOS shaft agent to handler"
  payload /.*alive/
  }

signature sid-241-a {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  header tcp[13:1] & 255 == 2
  header tcp[4:4] == 674711609
  event "DDOS shaft synflood"
  }

signature sid-241-b {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  header tcp[13:1] & 255 == 2
  header tcp[4:4] == 674711609
  event "DDOS shaft synflood"
  }

signature sid-243 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 6838
  event "DDOS mstream agent to handler"
  payload /.*newserver/
  }

signature sid-244 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 10498
  event "DDOS mstream handler to agent"
  payload /.*stream\//
  }

signature sid-245 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 10498
  event "\"DDOS mstream handler ping to agent\" "
  payload /.*ping/
  }

signature sid-246 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 10498
  event "\"DDOS mstream agent pong to handler\" "
  payload /.*pong/
  }

signature sid-247 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 12754
  event "DDOS mstream client to handler"
  tcp-state established,originator
  payload /.*>/
  }

signature sid-248 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 12754
  event "DDOS mstream handler to client"
  tcp-state established,responder
  payload /.*>/
  }

signature sid-249 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 15104
  header tcp[13:1] & 255 == 2
  event "DDOS mstream client to handler"
  }

signature sid-250 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 15104
  event "DDOS mstream handler to client"
  tcp-state established,responder
  payload /.*>/
  }

signature sid-251 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 0
  header icmp[0:1] == 0,8
  header icmp[6:2] == 0
  event "DDOS - TFN client command LE"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 51201
  }

signature sid-224 {
  ip-proto == icmp
  src-ip == 3.3.3.3/32
  dst-ip != local_nets
  header icmp[0:1] == 0
  event "DDOS Stacheldraht server spoof"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 666
  }

signature sid-225 {
  ip-proto == icmp
  src-ip == local_nets
  dst-ip != local_nets
  header icmp[0:1] == 0
  event "DDOS Stacheldraht gag server response"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 669
  payload /.*sicken/
  }

signature sid-226 {
  ip-proto == icmp
  src-ip == local_nets
  dst-ip != local_nets
  header icmp[0:1] == 0
  event "DDOS Stacheldraht server response"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 667
  payload /.*ficken/
  }

signature sid-227 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 0
  event "DDOS Stacheldraht client spoofworks"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 1000
  payload /.*spoofworks/
  }

signature sid-236 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 0
  event "DDOS Stacheldraht client check gag"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 668
  payload /.*gesundheit!/
  }

signature sid-229 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 0
  event "DDOS Stacheldraht client check skillz"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 666
  payload /.*skillz/
  }

signature sid-1854-a {
  ip-proto == icmp
  src-ip == local_nets
  dst-ip != local_nets
  header icmp[0:1] == 0
  event "DDOS Stacheldraht handler->agent (niggahbitch)"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 9015
  payload /.*niggahbitch/
  }

signature sid-1854-b {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 0
  event "DDOS Stacheldraht handler->agent (niggahbitch)"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 9015
  payload /.*niggahbitch/
  }

signature sid-1855-a {
  ip-proto == icmp
  src-ip == local_nets
  dst-ip != local_nets
  header icmp[0:1] == 0
  event "DDOS Stacheldraht agent->handler (skillz)"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 6666
  payload /.*skillz/
  }

signature sid-1855-b {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 0
  event "DDOS Stacheldraht agent->handler (skillz)"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 6666
  payload /.*skillz/
  }

signature sid-1856-a {
  ip-proto == icmp
  src-ip == local_nets
  dst-ip != local_nets
  header icmp[0:1] == 0
  event "DDOS Stacheldraht handler->agent (ficken)"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 6667
  payload /.*ficken/
  }

signature sid-1856-b {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 0
  event "DDOS Stacheldraht handler->agent (ficken)"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 6667
  payload /.*ficken/
  }

signature sid-255 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 53
  event "DNS zone transfer TCP"
  tcp-state established,originator
  payload /.{14}.*\x00\x00\xFC/
  }

signature sid-1948 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 53
  event "DNS zone transfer UDP"
  payload /.{13}.*\x00\x00\xFC/
  }

signature sid-1435 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 53
  event "DNS named authors attempt"
  tcp-state established,originator
  payload /.{11}.*\x07[aA][uU][tT][hH][oO][rR][sS]/
  payload /.{11}.*\x04[bB][iI][nN][dD]/
  }

signature sid-256 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 53
  event "DNS named authors attempt"
  payload /.{11}.*\x07[aA][uU][tT][hH][oO][rR][sS]/
  payload /.{11}.*\x04[bB][iI][nN][dD]/
  }

signature sid-257 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 53
  event "DNS named version attempt"
  tcp-state established,originator
  payload /.{11}.*\x07[vV][eE][rR][sS][iI][oO][nN]/
  payload /.{11}.*\x04[bB][iI][nN][dD]/
  }

signature sid-1616 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 53
  event "DNS named version attempt"
  payload /.{11}.*\x07[vV][eE][rR][sS][iI][oO][nN]/
  payload /.{11}.*\x04[bB][iI][nN][dD]/
  }

signature sid-253 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  src-port == 53
  event "DNS SPOOF query response PTR with TTL: 1 min. and no authority"
  payload /.*\x85\x80\x00\x01\x00\x01\x00\x00\x00\x00/
  payload /.*\xc0\x0c\x00\x0c\x00\x01\x00\x00\x00\x3c\x00\x0f/
  }

signature sid-254 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  src-port == 53
  event "DNS SPOOF query response with ttl: 1 min. and no authority"
  payload /.*\x81\x80\x00\x01\x00\x01\x00\x00\x00\x00/
  payload /.*\xc0\x0c\x00\x01\x00\x01\x00\x00\x00\x3c\x00\x04/
  }

signature sid-258 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 53
  event "DNS EXPLOIT named 8.2->8.2.1"
  tcp-state established,originator
  payload /.*\.\.\/\.\.\/\.\.\//
  }

signature sid-303 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 53
  event "DNS EXPLOIT named tsig overflow attempt"
  tcp-state established,originator
  payload /.*\xAB\xCD\x09\x80\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x01\x00\x01\x20\x20\x20\x20\x02\x61/
  }

signature sid-314 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 53
  event "DNS EXPLOIT named tsig overflow attempt"
  payload /.*\x80\x00\x07\x00\x00\x00\x00\x00\x01\x3F\x00\x01\x02/
  }

signature sid-259 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 53
  event "DNS EXPLOIT named overflow (ADM)"
  tcp-state established,originator
  payload /.*thisissometempspaceforthesockinaddrinyeahyeahiknowthisislamebutanywaywhocareshorizongotitworkingsoalliscool/
  }

signature sid-260 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 53
  event "DNS EXPLOIT named overflow (ADMROCKS)"
  tcp-state established,originator
  payload /.*ADMROCKS/
  }

signature sid-261 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 53
  event "DNS EXPLOIT named overflow attempt"
  tcp-state established,originator
  payload /.*\xCD\x80\xE8\xD7\xFF\xFF\xFF\/bin\/sh/
  }

signature sid-262 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 53
  event "DNS EXPLOIT x86 Linux overflow attempt"
  tcp-state established,originator
  payload /.*\x31\xc0\xb0\x3f\x31\xdb\xb3\xff\x31\xc9\xcd\x80\x31\xc0/
  }

signature sid-264 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 53
  event "DNS EXPLOIT x86 Linux overflow attempt"
  tcp-state established,originator
  payload /.*\x31\xc0\xb0\x02\xcd\x80\x85\xc0\x75\x4c\xeb\x4c\x5e\xb0/
  }

signature sid-265 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 53
  event "DNS EXPLOIT x86 Linux overflow attempt (ADMv2)"
  tcp-state established,originator
  payload /.*\x89\xf7\x29\xc7\x89\xf3\x89\xf9\x89\xf2\xac\x3c\xfe/
  }

signature sid-266 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 53
  event "DNS EXPLOIT x86 FreeBSD overflow attempt"
  tcp-state established,originator
  payload /.*\xeb\x6e\x5e\xc6\x06\x9a\x31\xc9\x89\x4e\x01\xc6\x46\x05/
  }

signature sid-267 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 53
  event "DNS EXPLOIT sparc overflow attempt"
  tcp-state established,originator
  payload /.*\x90\x1a\xc0\x0f\x90\x02\x20\x08\x92\x02\x20\x0f\xd0\x23\xbf\xf8/
  }

signature sid-1941 {
  ip-proto == udp
  dst-port == 69
  event "TFTP filename overflow attempt"
  payload /\x00\x01[^\x00]{100}/
  }

signature sid-1289 {
  ip-proto == udp
  dst-port == 69
  event "TFTP GET Admin.dll"
  payload /\x00\x01/
  payload /.{1}.*[aA][dD][mM][iI][nN]\.[dD][lL][lL]/
  }

signature sid-1441 {
  ip-proto == udp
  dst-port == 69
  event "TFTP GET nc.exe"
  payload /\x00\x01/
  payload /.{1}.*[nN][cC]\.[eE][xX][eE]/
  }

signature sid-1442 {
  ip-proto == udp
  dst-port == 69
  event "TFTP GET shadow"
  payload /\x00\x01/
  payload /.{1}.*[sS][hH][aA][dD][oO][wW]/
  }

signature sid-1443 {
  ip-proto == udp
  dst-port == 69
  event "TFTP GET passwd"
  payload /\x00\x01/
  payload /.{1}.*[pP][aA][sS][sS][wW][dD]/
  }

signature sid-519 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 69
  event "TFTP parent directory"
  payload /.{1}.*\.\./
  }

signature sid-520 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 69
  event "TFTP root directory"
  payload /\x00\x01\//
  }

signature sid-518 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 69
  event "TFTP Put"
  payload /\x00\x02/
  }

signature sid-1444 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 69
  event "TFTP Get"
  payload /\x00\x01/
  }

signature sid-803 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI HyperSeek hsx.cgi directory traversal attempt"
  http /.*[\/\\]hsx\.cgi/
  tcp-state established,originator
  payload /.*\.\.\/\.\.\/.{1}.*%00/
  }

signature sid-1607 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI HyperSeek hsx.cgi access"
  http /.*[\/\\]hsx\.cgi/
  tcp-state established,originator
  }

signature sid-804 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI SWSoft ASPSeek Overflow attempt"
  http /.*[\/\\]s\.cgi/
  tcp-state established,originator
  payload /.*[tT][mM][pP][lL]=/
  }

signature sid-805 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI webspeed access"
  http /.*[\/\\]wsisa\.dll[\/\\]WService=/
  tcp-state established,originator
  payload /.*[wW][sS][mM][aA][dD][mM][iI][nN]/
  }

signature sid-806 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI yabb.cgi directory traversal attempt"
  http /.*[\/\\]YaBB\.pl/
  tcp-state established,originator
  payload /.*\.\.\//
  }

signature sid-1637 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI yabb.cgi access"
  http /.*[\/\\]YaBB\.pl/
  tcp-state established,originator
  }

signature sid-807 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI /wwwboard/passwd.txt access"
  http /.*[\/\\]wwwboard[\/\\]passwd\.txt/
  tcp-state established,originator
  }

signature sid-808 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI webdriver access"
  http /.*[\/\\]webdriver/
  tcp-state established,originator
  }

signature sid-809 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI whois_raw.cgi arbitrary command execution attempt"
  http /.*[\/\\]whois_raw\.cgi\?/
  tcp-state established,originator
  payload /.*\x0a/
  }

signature sid-810 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI whois_raw.cgi access"
  http /.*[\/\\]whois_raw\.cgi/
  tcp-state established,originator
  }

signature sid-811 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI websitepro path access"
  tcp-state established,originator
  payload /.* \/[hH][tT][tT][pP]\/1\./
  }

signature sid-812 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI webplus version access"
  http /.*[\/\\]webplus\?about/
  tcp-state established,originator
  }

signature sid-813 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI webplus directory traversal"
  http /.*[\/\\]webplus\?script/
  tcp-state established,originator
  payload /.*\.\.\//
  }

signature sid-815 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI websendmail access"
  http /.*[\/\\]websendmail/
  tcp-state established,originator
  }

signature sid-1571 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI dcforum.cgi directory traversal attempt"
  http /.*[\/\\]dcforum\.cgi/
  tcp-state established,originator
  payload /.*forum=\.\.\/\.\./
  }

signature sid-818 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI dcforum.cgi access"
  http /.*[\/\\]dcforum\.cgi/
  tcp-state established,originator
  }

signature sid-817 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI dcboard.cgi invalid user addition attempt"
  http /.*[\/\\]dcboard\.cgi/
  tcp-state established,originator
  payload /.*command=register/
  payload /.*%7cadmin/
  }

signature sid-1410 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI dcboard.cgi access"
  http /.*[\/\\]dcboard\.cgi/
  tcp-state established,originator
  }

signature sid-819 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI mmstdod.cgi access"
  http /.*[\/\\]mmstdod\.cgi/
  tcp-state established,originator
  }

signature sid-820 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI anaconda directory transversal attempt"
  http /.*[\/\\]apexec\.pl/
  tcp-state established,originator
  payload /.*[tT][eE][mM][pP][lL][aA][tT][eE]=\.\.\//
  }

signature sid-821 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI imagemap.exe overflow attempt"
  http /.*[\/\\]imagemap\.exe\?/
  tcp-state established,originator
  }

signature sid-1700 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI imagemap.exe access"
  http /.*[\/\\]imagemap\.exe/
  tcp-state established,originator
  }

signature sid-823 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI cvsweb.cgi access"
  http /.*[\/\\]cvsweb\.cgi/
  tcp-state established,originator
  }

signature sid-824 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI php.cgi access"
  http /.*[\/\\]php\.cgi/
  tcp-state established,originator
  }

signature sid-825 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI glimpse access"
  http /.*[\/\\]glimpse/
  tcp-state established,originator
  }

signature sid-1608 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI htmlscript attempt"
  http /.*[\/\\]htmlscript\?\.\.[\/\\]\.\./
  tcp-state established,originator
  }

signature sid-826 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI htmlscript access"
  http /.*[\/\\]htmlscript/
  tcp-state established,originator
  }

signature sid-827 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI info2www access"
  http /.*[\/\\]info2www/
  tcp-state established,originator
  }

signature sid-828 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI maillist.pl access"
  http /.*[\/\\]maillist\.pl/
  tcp-state established,originator
  }

signature sid-829 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI nph-test-cgi access"
  http /.*[\/\\]nph-test-cgi/
  tcp-state established,originator
  }

signature sid-1451 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI NPH-publish access"
  http /.*[\/\\]nph-maillist\.pl/
  tcp-state established,originator
  }

signature sid-830 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI NPH-publish access"
  http /.*[\/\\]nph-publish/
  tcp-state established,originator
  }

signature sid-833 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI rguest.exe access"
  http /.*[\/\\]rguest\.exe/
  tcp-state established,originator
  }

signature sid-834 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI rwwwshell.pl access"
  http /.*[\/\\]rwwwshell\.pl/
  tcp-state established,originator
  }

signature sid-1644 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI test-cgi attempt"
  http /.*[\/\\]test-cgi[\/\\]\*\?\*/
  tcp-state established,originator
  }

signature sid-835 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI test-cgi access"
  http /.*[\/\\]test-cgi/
  tcp-state established,originator
  }

signature sid-1645 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI testcgi access"
  http /.*[\/\\]testcgi/
  tcp-state established,originator
  }

signature sid-1646 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI test.cgi access"
  http /.*[\/\\]test\.cgi/
  tcp-state established,originator
  }

signature sid-836 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI textcounter.pl access"
  http /.*[\/\\]textcounter\.pl/
  tcp-state established,originator
  }

signature sid-837 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI uploader.exe access"
  http /.*[\/\\]uploader\.exe/
  tcp-state established,originator
  }

signature sid-838 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI webgais access"
  http /.*[\/\\]webgais/
  tcp-state established,originator
  }

signature sid-839 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI finger access"
  http /.*[\/\\]finger/
  tcp-state established,originator
  }

signature sid-840 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI perlshop.cgi access"
  http /.*[\/\\]perlshop\.cgi/
  tcp-state established,originator
  }

signature sid-841 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI pfdisplay.cgi access"
  http /.*[\/\\]pfdisplay\.cgi/
  tcp-state established,originator
  }

signature sid-842 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI aglimpse access"
  http /.*[\/\\]aglimpse/
  tcp-state established,originator
  }

signature sid-843 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI anform2 access"
  http /.*[\/\\]AnForm2/
  tcp-state established,originator
  }

signature sid-844 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI args.bat access"
  http /.*[\/\\]args\.bat/
  tcp-state established,originator
  }

signature sid-1452 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI args.cmd access"
  http /.*[\/\\]args\.cmd/
  tcp-state established,originator
  }

signature sid-845 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI AT-admin.cgi access"
  http /.*[\/\\]AT-admin\.cgi/
  tcp-state established,originator
  }

signature sid-1453 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI AT-generated.cgi access"
  http /.*[\/\\]AT-generated\.cgi/
  tcp-state established,originator
  }

signature sid-846 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI bnbform.cgi access"
  http /.*[\/\\]bnbform\.cgi/
  tcp-state established,originator
  }

signature sid-847 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI campas access"
  http /.*[\/\\]campas/
  tcp-state established,originator
  }

signature sid-848 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI view-source directory traversal"
  http /.*[\/\\]view-source/
  tcp-state established,originator
  payload /.*\.\.\//
  }

signature sid-849 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI view-source access"
  http /.*[\/\\]view-source/
  tcp-state established,originator
  }

signature sid-850 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI wais.pl access"
  http /.*[\/\\]wais\.pl/
  tcp-state established,originator
  }

signature sid-1454 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI wwwwais access"
  http /.*[\/\\]wwwwais/
  tcp-state established,originator
  }

signature sid-851 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI files.pl access"
  http /.*[\/\\]files\.pl/
  tcp-state established,originator
  }

signature sid-852 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI wguest.exe access"
  http /.*[\/\\]wguest\.exe/
  tcp-state established,originator
  }

signature sid-853 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI wrap access"
  http /.*[\/\\]wrap/
  tcp-state established,originator
  }

signature sid-854 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI classifieds.cgi access"
  http /.*[\/\\]classifieds\.cgi/
  tcp-state established,originator
  }

signature sid-856 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI environ.cgi access"
  http /.*[\/\\]environ\.cgi/
  tcp-state established,originator
  }

signature sid-1647 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI faxsurvey attempt (full path)"
  http /.*[\/\\]faxsurvey\?[\/\\]/
  tcp-state established,originator
  }

signature sid-1609 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI faxsurvey arbitrary file read attempt"
  http /.*[\/\\]faxsurvey\?cat%20/
  tcp-state established,originator
  }

signature sid-857 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI faxsurvey access"
  http /.*[\/\\]faxsurvey/
  tcp-state established,originator
  }

signature sid-858 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI filemail access"
  http /.*[\/\\]filemail\.pl/
  tcp-state established,originator
  }

signature sid-859 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI man.sh access"
  http /.*[\/\\]man\.sh/
  tcp-state established,originator
  }

signature sid-860 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI snork.bat access"
  http /.*[\/\\]snork\.bat/
  tcp-state established,originator
  }

signature sid-861 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI w3-msql access"
  http /.*[\/\\]w3-msql[\/\\]/
  tcp-state established,originator
  }

signature sid-863 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI day5datacopier.cgi access"
  http /.*[\/\\]day5datacopier\.cgi/
  tcp-state established,originator
  }

signature sid-864 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI day5datanotifier.cgi access"
  http /.*[\/\\]day5datanotifier\.cgi/
  tcp-state established,originator
  }

signature sid-866 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI post-query access"
  http /.*[\/\\]post-query/
  tcp-state established,originator
  }

signature sid-867 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI visadmin.exe access"
  http /.*[\/\\]visadmin\.exe/
  tcp-state established,originator
  }

signature sid-869 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI dumpenv.pl access"
  http /.*[\/\\]dumpenv\.pl/
  tcp-state established,originator
  }

signature sid-1536 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI calendar_admin.pl arbitrary command execution attempt"
  http /.*[\/\\]calendar_admin\.pl\?config=\|/
  tcp-state established,originator
  }

signature sid-1537 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI calendar_admin.pl access"
  http /.*[\/\\]calendar_admin\.pl/
  tcp-state established,originator
  }

signature sid-1701 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI calendar-admin.pl access"
  http /.*[\/\\]calendar-admin\.pl/
  tcp-state established,originator
  }

signature sid-1455 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI calender.pl access"
  http /.*[\/\\]calender\.pl/
  tcp-state established,originator
  }

signature sid-882 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI calendar access"
  http /.*[\/\\]calendar/
  tcp-state established,originator
  }

signature sid-1457 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI user_update_admin.pl access"
  http /.*[\/\\]user_update_admin\.pl/
  tcp-state established,originator
  }

signature sid-1458 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI user_update_passwd.pl access"
  http /.*[\/\\]user_update_passwd\.pl/
  tcp-state established,originator
  }

signature sid-870 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI snorkerz.cmd access"
  http /.*[\/\\]snorkerz\.cmd/
  tcp-state established,originator
  }

signature sid-871 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI survey.cgi access"
  http /.*[\/\\]survey\.cgi/
  tcp-state established,originator
  }

signature sid-873 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI scriptalias access"
  http /.*[\/\\][\/\\][\/\\]/
  tcp-state established,originator
  }

signature sid-875 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI win-c-sample.exe access"
  http /.*[\/\\]win-c-sample\.exe/
  tcp-state established,originator
  }

signature sid-878 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI w3tvars.pm access"
  http /.*[\/\\]w3tvars\.pm/
  tcp-state established,originator
  }

signature sid-879 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI admin.pl access"
  http /.*[\/\\]admin\.pl/
  tcp-state established,originator
  }

signature sid-880 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI LWGate access"
  http /.*[\/\\]LWGate/
  tcp-state established,originator
  }

signature sid-881 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI archie access"
  http /.*[\/\\]archie/
  tcp-state established,originator
  }

signature sid-883 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI flexform access"
  http /.*[\/\\]flexform/
  tcp-state established,originator
  }

signature sid-1610 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI formmail arbitrary command execution attempt"
  http /.*[\/\\]formmail/
  tcp-state established,originator
  payload /.*%0[aA]/
  }

signature sid-884 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI formmail access"
  http /.*[\/\\]formmail/
  tcp-state established,originator
  }

signature sid-1762 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI phf arbitrary command execution attempt"
  http /.*[\/\\]phf/
  tcp-state established,originator
  payload /.*[qQ][aA][lL][iI][aA][sS]/
  payload /.*%0a\//
  }

signature sid-886 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI phf access"
  http /.*[\/\\]phf/
  tcp-state established,originator
  }

signature sid-887 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI www-sql access"
  http /.*[\/\\]www-sql/
  tcp-state established,originator
  }

signature sid-888 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI wwwadmin.pl access"
  http /.*[\/\\]wwwadmin\.pl/
  tcp-state established,originator
  }

signature sid-889 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI ppdscgi.exe access"
  http /.*[\/\\]ppdscgi\.exe/
  tcp-state established,originator
  }

signature sid-890 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI sendform.cgi access"
  http /.*[\/\\]sendform\.cgi/
  tcp-state established,originator
  }

signature sid-891 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI upload.pl access"
  http /.*[\/\\]upload\.pl/
  tcp-state established,originator
  }

signature sid-892 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI AnyForm2 access"
  http /.*[\/\\]AnyForm2/
  tcp-state established,originator
  }

signature sid-893 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI MachineInfo access"
  http /.*[\/\\]MachineInfo/
  tcp-state established,originator
  }

signature sid-1531 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI bb-hist.sh attempt"
  http /.*[\/\\]bb-hist\.sh\?HISTFILE=\.\.[\/\\]\.\./
  tcp-state established,originator
  }

signature sid-894 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI bb-hist.sh access"
  http /.*[\/\\]bb-hist\.sh/
  tcp-state established,originator
  }

signature sid-1459 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI bb-histlog.sh access"
  http /.*[\/\\]bb-histlog\.sh/
  tcp-state established,originator
  }

signature sid-1460 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI bb-histsvc.sh access"
  http /.*[\/\\]bb-histsvc\.sh/
  tcp-state established,originator
  }

signature sid-1532 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI bb-hostscv.sh attempt"
  http /.*[\/\\]bb-hostsvc\.sh\?HOSTSVC\?\.\.[\/\\]\.\./
  tcp-state established,originator
  }

signature sid-1533 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI bb-hostscv.sh access"
  http /.*[\/\\]bb-hostsvc\.sh/
  tcp-state established,originator
  }

signature sid-1461 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI bb-rep.sh access"
  http /.*[\/\\]bb-rep\.sh/
  tcp-state established,originator
  }

signature sid-1462 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI bb-replog.sh access"
  http /.*[\/\\]bb-replog\.sh/
  tcp-state established,originator
  }

signature sid-895 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI redirect access"
  http /.*[\/\\]redirect/
  tcp-state established,originator
  }

signature sid-1397 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI wayboard attempt"
  http /.*[\/\\]way-board[\/\\]way-board\.cgi/
  tcp-state established,originator
  payload /.*db=/
  payload /.*\.\.\/\.\./
  }

signature sid-896 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI way-board access"
  http /.*[\/\\]way-board/
  tcp-state established,originator
  }

signature sid-1222 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI pals-cgi arbitrary file access attempt"
  http /.*[\/\\]pals-cgi/
  tcp-state established,originator
  payload /.*[dD][oO][cC][uU][mM][eE][nN][tT][nN][aA][mM][eE]=/
  }

signature sid-897 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI pals-cgi access"
  http /.*[\/\\]pals-cgi/
  tcp-state established,originator
  }

signature sid-1572 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI commerce.cgi arbitrary file access attempt"
  http /.*[\/\\]commerce\.cgi/
  tcp-state established,originator
  payload /.*page=/
  payload /.*\/\.\.\//
  }

signature sid-898 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI commerce.cgi access"
  http /.*[\/\\]commerce\.cgi/
  tcp-state established,originator
  }

signature sid-899 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI Amaya templates sendtemp.pl directory traversal attempt"
  http /.*[\/\\]sendtemp\.pl/
  tcp-state established,originator
  payload /.*[tT][eE][mM][pP][lL]=/
  }

signature sid-1702 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI Amaya templates sendtemp.pl access"
  http /.*[\/\\]sendtemp\.pl/
  tcp-state established,originator
  }

signature sid-900 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI webspirs.cgi directory traversal attempt"
  http /.*[\/\\]webspirs\.cgi/
  tcp-state established,originator
  payload /.*\.\.\/\.\.\//
  }

signature sid-901 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI webspirs.cgi access"
  http /.*[\/\\]webspirs\.cgi/
  tcp-state established,originator
  }

signature sid-902 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI tstisapi.dll access"
  http /.*tstisapi\.dll/
  tcp-state established,originator
  }

signature sid-1308 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI sendmessage.cgi access"
  http /.*[\/\\]sendmessage\.cgi/
  tcp-state established,originator
  }

signature sid-1392 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI lastlines.cgi access"
  http /.*[\/\\]lastlines\.cgi/
  tcp-state established,originator
  }

signature sid-1395 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI zml.cgi attempt"
  http /.*[\/\\]zml\.cgi/
  tcp-state established,originator
  payload /.*file=\.\.\//
  }

signature sid-1396 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI zml.cgi access"
  http /.*[\/\\]zml\.cgi/
  tcp-state established,originator
  }

signature sid-1405 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI AHG search.cgi access"
  http /.*[\/\\]publisher[\/\\]search\.cgi/
  tcp-state established,originator
  payload /.*[tT][eE][mM][pP][lL][aA][tT][eE]=/
  }

signature sid-1534 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI agora.cgi attempt"
  http /.*[\/\\]store[\/\\]agora\.cgi\?cart_id=<SCRIPT>/
  tcp-state established,originator
  }

signature sid-1406 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI agora.cgi access"
  http /.*[\/\\]store[\/\\]agora\.cgi/
  tcp-state established,originator
  }

signature sid-877 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI rksh access"
  http /.*[\/\\]rksh/
  tcp-state established,originator
  }

signature sid-885 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI bash access"
  http /.*[\/\\]bash/
  tcp-state established,originator
  }

signature sid-1648 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI perl.exe command attempt"
  http /.*[\/\\]perl\.exe\?/
  tcp-state established,originator
  }

signature sid-832 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI perl.exe access"
  http /.*[\/\\]perl\.exe/
  tcp-state established,originator
  }

signature sid-1649 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI perl command attempt"
  http /.*[\/\\]perl\?/
  tcp-state established,originator
  }

signature sid-1309 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI zsh access"
  http /.*[\/\\]zsh/
  tcp-state established,originator
  }

signature sid-862 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI csh access"
  http /.*[\/\\]csh/
  tcp-state established,originator
  }

signature sid-872 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI tcsh access"
  http /.*[\/\\]tcsh/
  tcp-state established,originator
  }

signature sid-868 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI rsh access"
  http /.*[\/\\]rsh/
  tcp-state established,originator
  }

signature sid-865 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI ksh access"
  http /.*[\/\\]ksh/
  tcp-state established,originator
  }

signature sid-1703 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI auktion.cgi directory traversal attempt"
  http /.*[\/\\]auktion\.cgi/
  tcp-state established,originator
  payload /.*[mM][eE][nN][uU][eE]=\.\.\/\.\.\//
  }

signature sid-1465 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI auktion.cgi access"
  http /.*[\/\\]auktion\.cgi/
  tcp-state established,originator
  }

signature sid-1573 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI cgiforum.pl attempt"
  http /.*[\/\\]cgiforum\.pl\?thesection=\.\.[\/\\]\.\./
  tcp-state established,originator
  }

signature sid-1466 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI cgiforum.pl access"
  http /.*[\/\\]cgiforum\.pl/
  tcp-state established,originator
  }

signature sid-1574 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI directorypro.cgi attempt"
  http /.*[\/\\]directorypro\.cgi/
  tcp-state established,originator
  payload /.*show=.{1}.*\.\.\/\.\./
  }

signature sid-1467 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI directorypro.cgi access"
  http /.*[\/\\]directorypro\.cgi/
  tcp-state established,originator
  }

signature sid-1468 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI Web Shopper shopper.cgi attempt"
  http /.*[\/\\]shopper\.cgi/
  tcp-state established,originator
  payload /.*[nN][eE][wW][pP][aA][gG][eE]=\.\.\//
  }

signature sid-1469 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI Web Shopper shopper.cgi access"
  http /.*[\/\\]shopper\.cgi/
  tcp-state established,originator
  }

signature sid-1470 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI listrec.pl access"
  http /.*[\/\\]listrec\.pl/
  tcp-state established,originator
  }

signature sid-1471 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI mailnews.cgi access"
  http /.*[\/\\]mailnews\.cgi/
  tcp-state established,originator
  }

signature sid-1879 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI book.cgi arbitrary command execution attempt"
  http /.*[\/\\]book\.cgi/
  tcp-state established,originator
  payload /.*[cC][uU][rR][rR][eE][nN][tT]=\|/
  }

signature sid-1472 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI book.cgi access"
  http /.*[\/\\]book\.cgi/
  tcp-state established,originator
  }

signature sid-1473 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI newsdesk.cgi access"
  http /.*[\/\\]newsdesk\.cgi/
  tcp-state established,originator
  }

signature sid-1704 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI cal_make.pl directory traversal attempt"
  http /.*[\/\\]cal_make\.pl/
  tcp-state established,originator
  payload /.*[pP]0=\.\.\/\.\.\//
  }

signature sid-1474 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI cal_make.pl access"
  http /.*[\/\\]cal_make\.pl/
  tcp-state established,originator
  }

signature sid-1475 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI mailit.pl access"
  http /.*[\/\\]mailit\.pl/
  tcp-state established,originator
  }

signature sid-1476 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI sdbsearch.cgi access"
  http /.*[\/\\]sdbsearch\.cgi/
  tcp-state established,originator
  }

signature sid-1478 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI swc access"
  http /.*[\/\\]swc/
  tcp-state established,originator
  }

signature sid-1479 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI ttawebtop.cgi arbitrary file attempt"
  http /.*[\/\\]ttawebtop\.cgi/
  tcp-state established,originator
  payload /.*[pP][gG]=\.\.\//
  }

signature sid-1480 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI ttawebtop.cgi access"
  http /.*[\/\\]ttawebtop\.cgi/
  tcp-state established,originator
  }

signature sid-1481 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI upload.cgi access"
  http /.*[\/\\]upload\.cgi/
  tcp-state established,originator
  }

signature sid-1482 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI view_source access"
  http /.*[\/\\]view_source/
  tcp-state established,originator
  }

signature sid-1730 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI ustorekeeper.pl directory traversal attempt"
  http /.*[\/\\]ustorekeeper\.pl/
  tcp-state established,originator
  payload /.*[fF][iI][lL][eE]=\.\.\/\.\.\//
  }

signature sid-1483 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI ustorekeeper.pl access"
  http /.*[\/\\]ustorekeeper\.pl/
  tcp-state established,originator
  }

signature sid-1606 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI icat access"
  http /.*[\/\\]icat/
  tcp-state established,originator
  }

signature sid-1617 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI Bugzilla doeditvotes.cgi access"
  http /.*[\/\\]doeditvotes\.cgi/
  tcp-state established,originator
  }

signature sid-1600 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI htsearch arbitrary configuration file attempt"
  http /.*[\/\\]htsearch\?-c/
  tcp-state established,originator
  }

signature sid-1601 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI htsearch arbitrary file read attempt"
  http /.*[\/\\]htsearch\?exclude=`/
  tcp-state established,originator
  }

signature sid-1602 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI htsearch access"
  http /.*[\/\\]htsearch/
  tcp-state established,originator
  }

signature sid-1501 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI a1stats a1disp3.cgi directory traversal attempt"
  http /.*[\/\\]a1disp3\.cgi\?[\/\\]\.\.[\/\\]\.\.[\/\\]/
  tcp-state established,originator
  }

signature sid-1502 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI a1stats a1disp3.cgi access"
  http /.*[\/\\]a1disp3\.cgi/
  tcp-state established,originator
  }

signature sid-1731 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI a1stats access"
  http /.*[\/\\]a1stats[\/\\]/
  tcp-state established,originator
  }

signature sid-1503 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI admentor admin.asp access"
  http /.*[\/\\]admentor[\/\\]admin[\/\\]admin\.asp/
  tcp-state established,originator
  }

signature sid-1505 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI alchemy http server PRN arbitrary command execution attempt"
  http /.*[\/\\]PRN[\/\\]\.\.[\/\\]\.\.[\/\\]/
  tcp-state established,originator
  }

signature sid-1506 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI alchemy http server NUL arbitrary command execution attempt"
  http /.*[\/\\]NUL[\/\\]\.\.[\/\\]\.\.[\/\\]/
  tcp-state established,originator
  }

signature sid-1507 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI alibaba.pl arbitrary command execution attempt"
  http /.*[\/\\]alibaba\.pl\|/
  tcp-state established,originator
  }

signature sid-1508 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI alibaba.pl access"
  http /.*[\/\\]alibaba\.pl/
  tcp-state established,originator
  }

signature sid-1509 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI AltaVista Intranet Search directory traversal attempt"
  http /.*[\/\\]query\?mss=\.\./
  tcp-state established,originator
  }

signature sid-1510 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI test.bat arbitrary command execution attempt"
  http /.*[\/\\]test\.bat\|/
  tcp-state established,originator
  }

signature sid-1511 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI test.bat access"
  http /.*[\/\\]test\.bat/
  tcp-state established,originator
  }

signature sid-1512 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI input.bat arbitrary command execution attempt"
  http /.*[\/\\]input\.bat\|/
  tcp-state established,originator
  }

signature sid-1513 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI input.bat access"
  http /.*[\/\\]input\.bat/
  tcp-state established,originator
  }

signature sid-1514 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI input2.bat arbitrary command execution attempt"
  http /.*[\/\\]input2\.bat\|/
  tcp-state established,originator
  }

signature sid-1515 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI input2.bat access"
  http /.*[\/\\]input2\.bat/
  tcp-state established,originator
  }

signature sid-1516 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI envout.bat arbitrary command execution attempt"
  http /.*[\/\\]envout\.bat\|/
  tcp-state established,originator
  }

signature sid-1517 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI envout.bat access"
  http /.*[\/\\]envout\.bat/
  tcp-state established,originator
  }

signature sid-1705 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI echo.bat arbitrary command execution attempt"
  http /.*[\/\\]echo\.bat/
  tcp-state established,originator
  payload /.*&/
  }

signature sid-1706 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI echo.bat access"
  http /.*[\/\\]echo\.bat/
  tcp-state established,originator
  }

signature sid-1707 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI hello.bat arbitrary command execution attempt"
  http /.*[\/\\]hello\.bat/
  tcp-state established,originator
  payload /.*&/
  }

signature sid-1708 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI hello.bat access"
  http /.*[\/\\]hello\.bat/
  tcp-state established,originator
  }

signature sid-1650 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI tst.bat access"
  http /.*[\/\\]tst\.bat/
  tcp-state established,originator
  }

signature sid-1539 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI /cgi-bin/ls access"
  http /.*[\/\\]cgi-bin[\/\\]ls/
  tcp-state established,originator
  }

signature sid-1542 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI cgimail access"
  http /.*[\/\\]cgimail/
  tcp-state established,originator
  }

signature sid-1543 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI cgiwrap access"
  http /.*[\/\\]cgiwrap/
  tcp-state established,originator
  }

signature sid-1547 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI csSearch.cgi arbitrary command execution attempt"
  http /.*[\/\\]csSearch\.cgi/
  tcp-state established,originator
  payload /.*setup=/
  payload /.*`.{1}.*`/
  }

signature sid-1548 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI csSearch.cgi access"
  http /.*[\/\\]csSearch\.cgi/
  tcp-state established,originator
  }

signature sid-1553 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI /cart/cart.cgi access"
  http /.*[\/\\]cart[\/\\]cart\.cgi/
  tcp-state established,originator
  }

signature sid-1554 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI dbman db.cgi access"
  http /.*[\/\\]dbman[\/\\]db\.cgi/
  tcp-state established,originator
  }

signature sid-1555 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI DCShop access"
  http /.*[\/\\]dcshop/
  tcp-state established,originator
  }

signature sid-1556 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI DCShop orders.txt access"
  http /.*[\/\\]orders[\/\\]orders\.txt/
  tcp-state established,originator
  }

signature sid-1557 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI DCShop auth_user_file.txt access"
  http /.*[\/\\]auth_data[\/\\]auth_user_file\.txt/
  tcp-state established,originator
  }

signature sid-1565 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI eshop.pl arbitrary commane execution attempt"
  http /.*[\/\\]eshop\.pl\?seite=;/
  tcp-state established,originator
  }

signature sid-1566 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI eshop.pl access"
  http /.*[\/\\]eshop\.pl/
  tcp-state established,originator
  }

signature sid-1569 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI loadpage.cgi directory traversal attempt"
  http /.*[\/\\]loadpage\.cgi/
  tcp-state established,originator
  payload /.*[fF][iI][lL][eE]=\.\.\//
  }

signature sid-1570 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI loadpage.cgi access"
  http /.*[\/\\]loadpage\.cgi/
  tcp-state established,originator
  }

signature sid-1590 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI faqmanager.cgi arbitrary file access attempt"
  http /.*[\/\\]faqmanager\.cgi\?toc=/
  http /.*%00/
  tcp-state established,originator
  }

signature sid-1591 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI faqmanager.cgi access"
  http /.*[\/\\]faqmanager\.cgi/
  tcp-state established,originator
  }

signature sid-1592 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI /fcgi-bin/echo.exe access"
  http /.*[\/\\]fcgi-bin[\/\\]echo\.exe/
  tcp-state established,originator
  }

signature sid-1628 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI FormHandler.cgi directory traversal attempt attempt"
  http /.*[\/\\]FormHandler\.cgi/
  tcp-state established,originator
  payload /.*[rR][eE][pP][lL][yY]_[mM][eE][sS][sS][aA][gG][eE]_[aA][tT][tT][aA][cC][hH]=/
  payload /.*\/\.\.\//
  }

signature sid-1593 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI FormHandler.cgi external site redirection attempt"
  http /.*[\/\\]FormHandler\.cgi/
  tcp-state established,originator
  payload /.*[rR][eE][dD][iI][rR][eE][cC][tT]=[hH][tT][tT][pP]/
  }

signature sid-1594 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI FormHandler.cgi access"
  http /.*[\/\\]FormHandler\.cgi/
  tcp-state established,originator
  }

signature sid-1597 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI guestbook.cgi access"
  http /.*[\/\\]guestbook\.cgi/
  tcp-state established,originator
  }

signature sid-1598 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI Home Free search.cgi directory traversal attempt"
  http /.*[\/\\]search\.cgi/
  tcp-state established,originator
  payload /.*[lL][eE][tT][tT][eE][rR]=\.\.\/\.\./
  }

signature sid-1599 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI search.cgi access"
  http /.*[\/\\]search\.cgi/
  tcp-state established,originator
  }

signature sid-1651 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI enivorn.pl access"
  http /.*[\/\\]enivron\.pl/
  tcp-state established,originator
  }

signature sid-1652 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI campus attempt"
  http /.*[\/\\]campus\?%0a/
  tcp-state established,originator
  }

signature sid-1653 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI campus access"
  http /.*[\/\\]campus/
  tcp-state established,originator
  }

signature sid-1654 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI cart32.exe access"
  http /.*[\/\\]cart32\.exe/
  tcp-state established,originator
  }

signature sid-1655 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI pfdispaly.cgi arbitrary command execution attempt"
  http /.*[\/\\]pfdispaly\.cgi\?'/
  tcp-state established,originator
  }

signature sid-1656 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI pfdispaly.cgi access"
  http /.*[\/\\]pfdispaly\.cgi/
  tcp-state established,originator
  }

signature sid-1657 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI pagelog.cgi directory traversal attempt"
  http /.*[\/\\]pagelog\.cgi/
  tcp-state established,originator
  payload /.*[nN][aA][mM][eE]=\.\.\//
  }

signature sid-1658 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI pagelog.cgi access"
  http /.*[\/\\]pagelog\.cgi/
  tcp-state established,originator
  }

signature sid-1709 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI ad.cgi access"
  http /.*[\/\\]ad\.cgi/
  tcp-state established,originator
  }

signature sid-1710 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI bbs_forum.cgi access"
  http /.*[\/\\]bbs_forum\.cgi/
  tcp-state established,originator
  }

signature sid-1711 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI bsguest.cgi access"
  http /.*[\/\\]bsguest\.cgi/
  tcp-state established,originator
  }

signature sid-1712 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI bslist.cgi access"
  http /.*[\/\\]bslist\.cgi/
  tcp-state established,originator
  }

signature sid-1713 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI cgforum.cgi access"
  http /.*[\/\\]cgforum\.cgi/
  tcp-state established,originator
  }

signature sid-1714 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI newdesk access"
  http /.*[\/\\]newdesk/
  tcp-state established,originator
  }

signature sid-1715 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI register.cgi access"
  http /.*[\/\\]register\.cgi/
  tcp-state established,originator
  }

signature sid-1716 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI gbook.cgi access"
  http /.*[\/\\]gbook\.cgi/
  tcp-state established,originator
  }

signature sid-1717 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI simplestguest.cgi access"
  http /.*[\/\\]simplestguest\.cgi/
  tcp-state established,originator
  }

signature sid-1718 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI statusconfig.pl access"
  http /.*[\/\\]statusconfig\.pl/
  tcp-state established,originator
  }

signature sid-1719 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI talkback.cgi directory traversal attempt"
  http /.*[\/\\]talkbalk\.cgi/
  tcp-state established,originator
  payload /.*[aA][rR][tT][iI][cC][lL][eE]=\.\.\/\.\.\//
  }

signature sid-1720 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI talkback.cgi access"
  http /.*[\/\\]talkbalk\.cgi/
  tcp-state established,originator
  }

signature sid-1721 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI adcycle access"
  http /.*[\/\\]adcycle/
  tcp-state established,originator
  }

signature sid-1722 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI MachineInfo access"
  http /.*[\/\\]MachineInfo/
  tcp-state established,originator
  }

signature sid-1723 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI emumail.cgi NULL attempt"
  http /.*[\/\\]emumail\.cgi/
  tcp-state established,originator
  payload /.*[tT][yY][pP][eE]=/
  payload /.*%00/
  }

signature sid-1724 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI emumail.cgi access"
  http /.*[\/\\]emumail\.cgi/
  tcp-state established,originator
  }

signature sid-1642 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI document.d2w access"
  http /.*[\/\\]document\.d2w/
  tcp-state established,originator
  }

signature sid-1643 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI db2www access"
  http /.*[\/\\]db2www/
  tcp-state established,originator
  }

signature sid-1668 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI /cgi-bin/ access"
  http /.*[\/\\]cgi-bin[\/\\]/
  tcp-state established,originator
  payload /.*\/[cC][gG][iI]-[bB][iI][nN]\/ [hH][tT][tT][pP]/
  }

signature sid-1669 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI /cgi-dos/ access"
  http /.*[\/\\]cgi-dos[\/\\]/
  tcp-state established,originator
  payload /.*\/[cC][gG][iI]-[dD][oO][sS]\/ [hH][tT][tT][pP]/
  }

signature sid-1051 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI technote main.cgi file directory traversal attempt"
  http /.*[\/\\]technote[\/\\]main\.cgi/
  tcp-state established,originator
  payload /.*[fF][iI][lL][eE][nN][aA][mM][eE]=/
  payload /.*\.\.\/\.\.\//
  }

signature sid-1052 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI technote print.cgi directory traversal attempt"
  http /.*[\/\\]technote[\/\\]print\.cgi/
  tcp-state established,originator
  payload /.*[bB][oO][aA][rR][dD]=/
  payload /.*\.\.\/\.\.\//
  payload /.*%00/
  }

signature sid-1053 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI ads.cgi command execution attempt"
  http /.*[\/\\]ads\.cgi/
  tcp-state established,originator
  payload /.*[fF][iI][lL][eE]=/
  payload /.*\.\.\/\.\.\//
  payload /.*\|/
  }

signature sid-1088 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI eXtropia webstore directory traversal"
  http /.*[\/\\]web_store\.cgi/
  tcp-state established,originator
  payload /.*page=\.\.\//
  }

signature sid-1611 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI eXtropia webstore access"
  http /.*[\/\\]web_store\.cgi/
  tcp-state established,originator
  }

signature sid-1089 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI shopping cart directory traversal"
  http /.*[\/\\]shop\.cgi/
  tcp-state established,originator
  payload /.*page=\.\.\//
  }

signature sid-1090 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI Allaire Pro Web Shell attempt"
  http /.*[\/\\]authenticate\.cgi\?PASSWORD/
  tcp-state established,originator
  payload /.*config\.ini/
  }

signature sid-1092 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI Armada Style Master Index directory traversal"
  http /.*[\/\\]search\.cgi\?keys/
  tcp-state established,originator
  payload /.*catigory=\.\.\//
  }

signature sid-1093 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI cached_feed.cgi moreover shopping cart directory traversal"
  http /.*[\/\\]cached_feed\.cgi/
  tcp-state established,originator
  payload /.*\.\.\//
  }

signature sid-2051 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI cached_feed.cgi moreover shopping cart access"
  http /.*[\/\\]cached_feed\.cgi/
  tcp-state established,originator
  }

signature sid-1097 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI Talentsoft Web+ exploit attempt"
  http /.*[\/\\]webplus\.cgi\?Script=[\/\\]webplus[\/\\]webping[\/\\]webping\.wml/
  tcp-state established,originator
  }

signature sid-1106 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI Poll-it access"
  http /.*[\/\\]pollit[\/\\]Poll_It_SSI_v2\.0\.cgi/
  tcp-state established,originator
  }

signature sid-1149 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI count.cgi access"
  http /.*[\/\\]count\.cgi/
  tcp-state established,originator
  }

signature sid-1865 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI webdist.cgi arbitrary command attempt"
  http /.*[\/\\]webdist\.cgi/
  tcp-state established,originator
  payload /.*[dD][iI][sS][tT][lL][oO][cC]=;/
  }

signature sid-1163 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI webdist.cgi access"
  http /.*[\/\\]webdist\.cgi/
  tcp-state established,originator
  }

signature sid-1172 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI bigconf.cgi access"
  http /.*[\/\\]bigconf\.cgi/
  tcp-state established,originator
  }

signature sid-1174 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI /cgi-bin/jj access"
  http /.*[\/\\]cgi-bin[\/\\]jj/
  tcp-state established,originator
  }

signature sid-1185 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI bizdbsearch attempt"
  http /.*[\/\\]bizdb1-search\.cgi/
  tcp-state established,originator
  payload /.*[mM][aA][iI][lL]/
  }

signature sid-1535 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI bizdbsearch access"
  http /.*[\/\\]bizdb1-search\.cgi/
  tcp-state established,originator
  }

signature sid-1194 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI sojourn.cgi File attempt"
  http /.*[\/\\]sojourn\.cgi\?cat=/
  tcp-state established,originator
  payload /.*%00/
  }

signature sid-1195 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI sojourn.cgi access"
  http /.*[\/\\]sojourn\.cgi/
  tcp-state established,originator
  }

signature sid-1196 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI SGI InfoSearch fname attempt"
  http /.*[\/\\]infosrch\.cgi\?/
  tcp-state established,originator
  payload /.*[fF][nN][aA][mM][eE]=/
  }

signature sid-1727 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI SGI InfoSearch fname access"
  http /.*[\/\\]infosrch\.cgi/
  tcp-state established,originator
  }

signature sid-1204 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI ax-admin.cgi access"
  http /.*[\/\\]ax-admin\.cgi/
  tcp-state established,originator
  }

signature sid-1205 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI axs.cgi access"
  http /.*[\/\\]axs\.cgi/
  tcp-state established,originator
  }

signature sid-1206 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI cachemgr.cgi access"
  http /.*[\/\\]cachemgr\.cgi/
  tcp-state established,originator
  }

signature sid-1208 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI responder.cgi access"
  http /.*[\/\\]responder\.cgi/
  tcp-state established,originator
  }

signature sid-1211 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI web-map.cgi access"
  http /.*[\/\\]web-map\.cgi/
  tcp-state established,originator
  }

signature sid-1215 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI ministats admin access"
  http /.*[\/\\]ministats[\/\\]admin\.cgi/
  tcp-state established,originator
  }

signature sid-1219 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI dfire.cgi access"
  http /.*[\/\\]dfire\.cgi/
  tcp-state established,originator
  }

signature sid-1305 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI txt2html.cgi directory traversal attempt"
  http /.*[\/\\]txt2html\.cgi/
  tcp-state established,originator
  payload /.*\/\.\.\/\.\.\/\.\.\/\.\.\//
  }

signature sid-1304 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI txt2html.cgi access"
  http /.*[\/\\]txt2html\.cgi/
  tcp-state established,originator
  }

signature sid-1488 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI store.cgi directory traversal attempt"
  http /.*[\/\\]store\.cgi/
  tcp-state established,originator
  payload /.*\.\.\//
  }

signature sid-1307 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI store.cgi access"
  http /.*[\/\\]store\.cgi/
  tcp-state established,originator
  }

signature sid-1494 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI SIX webboard generate.cgi attempt"
  http /.*[\/\\]generate\.cgi/
  tcp-state established,originator
  payload /.*content=\.\.\//
  }

signature sid-1495 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI SIX webboard generate.cgi access"
  http /.*[\/\\]generate\.cgi/
  tcp-state established,originator
  }

signature sid-1496 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI spin_client.cgi access"
  http /.*[\/\\]spin_client\.cgi/
  tcp-state established,originator
  }

signature sid-1787 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI csPassword.cgi access"
  http /.*[\/\\]csPassword\.cgi/
  tcp-state established,originator
  }

signature sid-1788 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI csPassword password.cgi.tmp access"
  http /.*[\/\\]password\.cgi\.tmp/
  tcp-state established,originator
  }

signature sid-1763 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI Nortel Contivity cgiproc DOS attempt"
  http /.*[\/\\]cgiproc\?Nocfile=/
  tcp-state established,originator
  }

signature sid-1764 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI Nortel Contivity cgiproc DOS attempt"
  http /.*[\/\\]cgiproc\?\$/
  tcp-state established,originator
  }

signature sid-1765 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI Nortel Contivity cgiproc access"
  http /.*[\/\\]cgiproc/
  tcp-state established,originator
  }

signature sid-1805 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI Oracle reports CGI access"
  http /.*[\/\\]rwcgi60/
  tcp-state established,originator
  payload /.*setauth=/
  }

signature sid-1822 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI alienform.cgi directory traversal attempt"
  http /.*[\/\\]alienform\.cgi/
  tcp-state established,originator
  payload /.*\.\|\.\/\.\|\./
  }

signature sid-1823 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI AlienForm af.cgi directory traversal attempt"
  http /.*[\/\\]af\.cgi/
  tcp-state established,originator
  payload /.*\.\|\.\/\.\|\./
  }

signature sid-1824 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI alienform.cgi access"
  http /.*[\/\\]alienform\.cgi/
  tcp-state established,originator
  }

signature sid-1825 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI AlienForm af.cgi access"
  http /.*[\/\\]af\.cgi/
  tcp-state established,originator
  }

signature sid-1868 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 8080
  event "WEB-CGI story.pl arbitrary file read attempt"
  http /.*[\/\\]story\.pl/
  tcp-state established,originator
  payload /.*next=\.\.\//
  }

signature sid-1869 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 8080
  event "WEB-CGI story.pl access"
  http /.*[\/\\]story\.pl/
  tcp-state established,originator
  }

signature sid-1870 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI siteUserMod.cgi access"
  http /.*[\/\\]\.cobalt[\/\\]siteUserMod[\/\\]siteUserMod\.cgi/
  tcp-state established,originator
  }

signature sid-1875 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI cgicso access"
  http /.*[\/\\]cgicso/
  tcp-state established,originator
  }

signature sid-1876 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI nph-publish.cgi access"
  http /.*[\/\\]nph-publish\.cgi/
  tcp-state established,originator
  }

signature sid-1877 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI printenv access"
  http /.*[\/\\]printenv/
  tcp-state established,originator
  }

signature sid-1878 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI sdbsearch.cgi access"
  http /.*[\/\\]sdbsearch\.cgi/
  tcp-state established,originator
  }

signature sid-1931 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI rpc-nlog.pl access"
  http /.*[\/\\]rpc-nlog\.pl/
  tcp-state established,originator
  }

signature sid-1932 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI rpc-smb.pl access"
  http /.*[\/\\]rpc-smb\.pl/
  tcp-state established,originator
  }

signature sid-1933 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI cart.cgi access"
  http /.*[\/\\]cart\.cgi/
  tcp-state established,originator
  }

signature sid-1994 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI vpasswd.cgi access"
  http /.*[\/\\]vpasswd\.cgi/
  tcp-state established,originator
  }

signature sid-1995 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI alya.cgi access"
  http /.*[\/\\]alya\.cgi/
  tcp-state established,originator
  }

signature sid-1996 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI viralator.cgi access"
  http /.*[\/\\]viralator\.cgi/
  tcp-state established,originator
  }

signature sid-2001 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI smartsearch.cgi access"
  http /.*[\/\\]smartsearch\.cgi/
  tcp-state established,originator
  }

signature sid-1862 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI mrtg.cgi directory traversal attempt"
  http /.*[\/\\]mrtg\.cgi/
  tcp-state established,originator
  payload /.*cfg=\/\.\.\//
  }

signature sid-2052 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI overflow.cgi access"
  http /.*[\/\\]overflow\.cgi/
  tcp-state established,originator
  }

signature sid-1850 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI way-board.cgi access"
  http /.*[\/\\]way-board\.cgi/
  tcp-state established,originator
  }

signature sid-2053 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI process_bug.cgi access"
  http /.*[\/\\]process_bug\.cgi/
  tcp-state established,originator
  }

signature sid-2054 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI enter_bug.cgi arbitrary command attempt"
  http /.*[\/\\]enter_bug\.cgi/
  tcp-state established,originator
  payload /.*[wW][hH][oO]=.*.{0}.*;/
  }

signature sid-2055 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI enter_bug.cgi access"
  http /.*[\/\\]enter_bug\.cgi/
  tcp-state established,originator
  }

signature sid-2085 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI parse_xml.cgi access"
  http /.*[\/\\]parse_xml\.cgi/
  tcp-state established,originator
  }

signature sid-2086 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == 1220
  event "WEB-CGI streaming server parse_xml.cgi access"
  tcp-state established,originator
  payload /.*\/[pP][aA][rR][sS][eE]_[xX][mM][lL]\.[cC][gG][iI]/
  }

signature sid-2115 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI album.pl access"
  tcp-state established,originator
  payload /.*\/[aA][lL][bB][uU][mM]\.[pP][lL]/
  }

signature sid-2116 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI chipcfg.cgi access"
  http /.*[\/\\]chipcfg\.cgi/
  tcp-state established,originator
  }

signature sid-2127 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI ikonboard.cgi access"
  http /.*[\/\\]ikonboard\.cgi/
  tcp-state established,originator
  }

signature sid-2128 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-CGI swsrv.cgi access"
  http /.*[\/\\]srsrv\.cgi/
  tcp-state established,originator
  }

signature sid-903 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION cfcache.map access"
  http /.*[\/\\]cfcache\.map/
  tcp-state established,originator
  }

signature sid-904 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION exampleapp application.cfm"
  http /.*[\/\\]cfdocs[\/\\]exampleapp[\/\\]email[\/\\]application\.cfm/
  tcp-state established,originator
  }

signature sid-905 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION application.cfm access"
  http /.*[\/\\]cfdocs[\/\\]exampleapp[\/\\]publish[\/\\]admin[\/\\]application\.cfm/
  tcp-state established,originator
  }

signature sid-906 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION getfile.cfm access"
  http /.*[\/\\]cfdocs[\/\\]exampleapp[\/\\]email[\/\\]getfile\.cfm/
  tcp-state established,originator
  }

signature sid-907 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION addcontent.cfm access"
  http /.*[\/\\]cfdocs[\/\\]exampleapp[\/\\]publish[\/\\]admin[\/\\]addcontent\.cfm/
  tcp-state established,originator
  }

signature sid-908 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION administrator access"
  http /.*[\/\\]cfide[\/\\]administrator[\/\\]index\.cfm/
  tcp-state established,originator
  }

signature sid-909 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION datasource username attempt"
  tcp-state established,originator
  payload /.*[cC][fF]_[sS][eE][tT][dD][aA][tT][aA][sS][oO][uU][rR][cC][eE][uU][sS][eE][rR][nN][aA][mM][eE]\(\)/
  }

signature sid-910 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION fileexists.cfm access"
  http /.*[\/\\]cfdocs[\/\\]snippets[\/\\]fileexists\.cfm/
  tcp-state established,originator
  }

signature sid-911 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION exprcalc access"
  http /.*[\/\\]cfdocs[\/\\]expeval[\/\\]exprcalc\.cfm/
  tcp-state established,originator
  }

signature sid-912 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION parks access"
  http /.*[\/\\]cfdocs[\/\\]examples[\/\\]parks[\/\\]detail\.cfm/
  tcp-state established,originator
  }

signature sid-913 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION cfappman access"
  http /.*[\/\\]cfappman[\/\\]index\.cfm/
  tcp-state established,originator
  }

signature sid-914 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION beaninfo access"
  http /.*[\/\\]cfdocs[\/\\]examples[\/\\]cvbeans[\/\\]beaninfo\.cfm/
  tcp-state established,originator
  }

signature sid-915 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION evaluate.cfm access"
  http /.*[\/\\]cfdocs[\/\\]snippets[\/\\]evaluate\.cfm/
  tcp-state established,originator
  }

signature sid-916 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION getodbcdsn access"
  tcp-state established,originator
  payload /.*[cC][fF][uU][sS][iI][oO][nN]_[gG][eE][tT][oO][dD][bB][cC][dD][sS][nN]\(\)/
  }

signature sid-917 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION db connections flush attempt"
  tcp-state established,originator
  payload /.*[cC][fF][uU][sS][iI][oO][nN]_[dD][bB][cC][oO][nN][nN][eE][cC][tT][iI][oO][nN][sS]_[fF][lL][uU][sS][hH]\(\)/
  }

signature sid-918 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION expeval access"
  http /.*[\/\\]cfdocs[\/\\]expeval[\/\\]/
  tcp-state established,originator
  }

signature sid-919 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION datasource passwordattempt"
  tcp-state established,originator
  payload /.*[cC][fF]_[sS][eE][tT][dD][aA][tT][aA][sS][oO][uU][rR][cC][eE][pP][aA][sS][sS][wW][oO][rR][dD]\(\)/
  }

signature sid-920 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION datasource attempt"
  tcp-state established,originator
  payload /.*[cC][fF]_[iI][sS][cC][oO][lL][dD][fF][uU][sS][iI][oO][nN][dD][aA][tT][aA][sS][oO][uU][rR][cC][eE]\(\)/
  }

signature sid-921 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION admin encrypt attempt"
  tcp-state established,originator
  payload /.*[cC][fF][uU][sS][iI][oO][nN]_[eE][nN][cC][rR][yY][pP][tT]\(\)/
  }

signature sid-922 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION displayfile access"
  http /.*[\/\\]cfdocs[\/\\]expeval[\/\\]displayopenedfile\.cfm/
  tcp-state established,originator
  }

signature sid-923 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION getodbcin attempt"
  tcp-state established,originator
  payload /.*[cC][fF][uU][sS][iI][oO][nN]_[gG][eE][tT][oO][dD][bB][cC][iI][nN][iI]\(\)/
  }

signature sid-924 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION admin decrypt attempt"
  tcp-state established,originator
  payload /.*[cC][fF][uU][sS][iI][oO][nN]_[dD][eE][cC][rR][yY][pP][tT]\(\)/
  }

signature sid-925 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION mainframeset access"
  http /.*[\/\\]cfdocs[\/\\]examples[\/\\]mainframeset\.cfm/
  tcp-state established,originator
  }

signature sid-926 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION set odbc ini attempt"
  tcp-state established,originator
  payload /.*[cC][fF][uU][sS][iI][oO][nN]_[sS][eE][tT][oO][dD][bB][cC][iI][nN][iI]\(\)/
  }

signature sid-927 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION settings refresh attempt"
  tcp-state established,originator
  payload /.*[cC][fF][uU][sS][iI][oO][nN]_[sS][eE][tT][tT][iI][nN][gG][sS]_[rR][eE][fF][rR][eE][sS][hH]\(\)/
  }

signature sid-928 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION exampleapp access"
  http /.*[\/\\]cfdocs[\/\\]exampleapp[\/\\]/
  tcp-state established,originator
  }

signature sid-929 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION CFUSION_VERIFYMAIL access"
  tcp-state established,originator
  payload /.*[cC][fF][uU][sS][iI][oO][nN]_[vV][eE][rR][iI][fF][yY][mM][aA][iI][lL]\(\)/
  }

signature sid-930 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION snippets attempt"
  http /.*[\/\\]cfdocs[\/\\]snippets[\/\\]/
  tcp-state established,originator
  }

signature sid-931 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION cfmlsyntaxcheck.cfm access"
  http /.*[\/\\]cfdocs[\/\\]cfmlsyntaxcheck\.cfm/
  tcp-state established,originator
  }

signature sid-932 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION application.cfm access"
  http /.*[\/\\]application\.cfm/
  tcp-state established,originator
  }

signature sid-933 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION onrequestend.cfm access"
  http /.*[\/\\]onrequestend\.cfm/
  tcp-state established,originator
  }

signature sid-935 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION startstop DOS access"
  http /.*[\/\\]cfide[\/\\]administrator[\/\\]startstop\.html/
  tcp-state established,originator
  }

signature sid-936 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION gettempdirectory.cfm access "
  http /.*[\/\\]cfdocs[\/\\]snippets[\/\\]gettempdirectory\.cfm/
  tcp-state established,originator
  }

signature sid-1659 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION sendmail.cfm access"
  http /.*[\/\\]sendmail\.cfm/
  tcp-state established,originator
  }

signature sid-1540 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-COLDFUSION ?Mode=debug attempt"
  http /.*Mode=debug/
  tcp-state established,originator
  }

signature sid-1970 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-IIS MDAC Content-Type overflow attempt"
  http /.*[\/\\]msadcs\.dll/
  tcp-state established,originator
  payload /.*Content-Type:[^\x0A]{50}/
  }

signature sid-1076 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS repost.asp access"
  http /.*[\/\\]scripts[\/\\]repost\.asp/
  tcp-state established,originator
  }

signature sid-1806 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS .htr Transfer-Encoding: chunked"
  http /.*\.htr/
  tcp-state established,originator
  payload /.*[tT][rR][aA][nN][sS][fF][eE][rR]-[eE][nN][cC][oO][dD][iI][nN][gG]:/
  payload /.*[cC][hH][uU][nN][kK][eE][dD]/
  }

signature sid-1618 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS .asp Transfer-Encoding: chunked"
  http /.*\.asp/
  tcp-state established,originator
  payload /.*[tT][rR][aA][nN][sS][fF][eE][rR]-[eE][nN][cC][oO][dD][iI][nN][gG]:/
  payload /.*[cC][hH][uU][nN][kK][eE][dD]/
  }

signature sid-1626 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS /StoreCSVS/InstantOrder.asmx request"
  http /.*[\/\\]StoreCSVS[\/\\]InstantOrder\.asmx/
  tcp-state established,originator
  }

signature sid-1750 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS users.xml access"
  http /.*[\/\\]users\.xml/
  tcp-state established,originator
  }

signature sid-1753 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS as_web.exe access"
  http /.*[\/\\]as_web\.exe/
  tcp-state established,originator
  }

signature sid-1754 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS as_web4.exe access"
  http /.*[\/\\]as_web4\.exe/
  tcp-state established,originator
  }

signature sid-1756 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS NewsPro administration authentication attempt"
  tcp-state established,originator
  payload /.*logged,true/
  }

signature sid-1772 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS pbserver access"
  http /.*[\/\\]pbserver[\/\\]pbserver\.dll/
  tcp-state established,originator
  }

signature sid-1660 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS trace.axd access"
  http /.*[\/\\]trace\.axd/
  tcp-state established,originator
  }

signature sid-1484 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS /isapi/tstisapi.dll access"
  http /.*[\/\\]isapi[\/\\]tstisapi\.dll/
  tcp-state established,originator
  }

signature sid-1485 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS mkilog.exe access"
  http /.*[\/\\]mkilog\.exe/
  tcp-state established,originator
  }

signature sid-1486 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS ctss.idc access"
  http /.*[\/\\]ctss\.idc/
  tcp-state established,originator
  }

signature sid-1487 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS /iisadmpwd/aexp2.htr access"
  http /.*[\/\\]iisadmpwd[\/\\]aexp2\.htr/
  tcp-state established,originator
  }

signature sid-969 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS WebDAV file lock attempt"
  tcp-state established,originator
  payload /LOCK /
  }

signature sid-971 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS ISAPI .printer access"
  http /.*\.printer/
  tcp-state established,originator
  }

signature sid-1243 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS ISAPI .ida attempt"
  http /.*\.ida\?/
  tcp-state established,originator
  }

signature sid-1242 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS ISAPI .ida access"
  http /.*\.ida/
  tcp-state established,originator
  }

signature sid-1244 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS ISAPI .idq attempt"
  http /.*\.idq\?/
  tcp-state established,originator
  }

signature sid-1245 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS ISAPI .idq access"
  http /.*\.idq/
  tcp-state established,originator
  }

signature sid-972 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS %2E-asp access"
  http /.*%2e\.asp/
  tcp-state established,originator
  }

signature sid-973 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS *.idc attempt"
  http /.*[\/\\]\*\.idc/
  tcp-state established,originator
  }

signature sid-974 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS .... access"
  tcp-state established,originator
  payload /.*\x2e\x2e\x5c\x2e\x2e/
  }

signature sid-975 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS .asp::$DATA access"
  http /.*\.asp\x3a\x3a\$DATA/
  tcp-state established,originator
  }

signature sid-976 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS .bat? access"
  http /.*\.bat\?/
  tcp-state established,originator
  }

signature sid-977 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS .cnf access"
  http /.*\.cnf/
  tcp-state established,originator
  }

signature sid-978 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS ASP contents view"
  tcp-state established,originator
  payload /.*%20/
  payload /.*&[cC][iI][rR][eE][sS][tT][rR][iI][cC][tT][iI][oO][nN]=[nN][oO][nN][eE]/
  payload /.*&[cC][iI][hH][iI][lL][iI][tT][eE][tT][yY][pP][eE]=[fF][uU][lL][lL]/
  }

signature sid-979 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS ASP contents view"
  http /.*\.htw\?CiWebHitsFile/
  tcp-state established,originator
  }

signature sid-980 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS CGImail.exe access"
  http /.*[\/\\]scripts[\/\\]CGImail\.exe/
  tcp-state established,originator
  }

signature sid-981 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS unicode directory traversal attempt"
  tcp-state established,originator
  payload /.*\/\.\.%[cC]0%[aA][fF]\.\.\//
  }

signature sid-982 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS unicode directory traversal attempt"
  tcp-state established,originator
  payload /.*\/\.\.%[cC]1%1[cC]\.\.\//
  }

signature sid-983 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS unicode directory traversal attempt"
  tcp-state established,originator
  payload /.*\/\.\.%[cC]1%9[cC]\.\.\//
  }

signature sid-1945 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS unicode directory traversal attempt"
  tcp-state established,originator
  payload /.*\/\.\.%255[cC]\.\./
  }

signature sid-986 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS MSProxy access"
  http /.*[\/\\]scripts[\/\\]proxy[\/\\]w3proxy\.dll/
  tcp-state established,originator
  }

signature sid-1725 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS +.htr code fragment attempt"
  http /.*\+\.htr/
  tcp-state established,originator
  }

signature sid-987 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS .htr access"
  http /.*\.htr/
  tcp-state established,originator
  }

signature sid-988 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS SAM Attempt"
  tcp-state established,originator
  payload /.*[sS][aA][mM]\._/
  }

signature sid-989 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS Unicode2.pl script (File permission canonicalization)"
  http /.*[\/\\]sensepost\.exe/
  tcp-state established,originator
  }

signature sid-990 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS _vti_inf access"
  http /.*_vti_inf\.html/
  tcp-state established,originator
  }

signature sid-991 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS achg.htr access"
  http /.*[\/\\]iisadmpwd[\/\\]achg\.htr/
  tcp-state established,originator
  }

signature sid-994 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS /scripts/iisadmin/default.htm access"
  http /.*[\/\\]scripts[\/\\]iisadmin[\/\\]default\.htm/
  tcp-state established,originator
  }

signature sid-995 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS ism.dll access"
  http /.*[\/\\]scripts[\/\\]iisadmin[\/\\]ism\.dll\?http[\/\\]dir/
  tcp-state established,originator
  }

signature sid-996 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS anot.htr access"
  http /.*[\/\\]iisadmpwd[\/\\]anot/
  tcp-state established,originator
  }

signature sid-997 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS asp-dot attempt"
  http /.*\.asp\./
  tcp-state established,originator
  }

signature sid-998 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS asp-srch attempt"
  http /.*#filename=\*\.asp/
  tcp-state established,originator
  }

signature sid-1000 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS bdir.htr access"
  http /.*[\/\\]bdir\.htr/
  tcp-state established,originator
  }

signature sid-1661 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS cmd32.exe access"
  tcp-state established,originator
  payload /.*[cC][mM][dD]32\.[eE][xX][eE]/
  }

signature sid-1002 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS cmd.exe access"
  tcp-state established,originator
  payload /.*[cC][mM][dD]\.[eE][xX][eE]/
  }

signature sid-1003 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS cmd? access"
  tcp-state established,originator
  payload /.*\.[cC][mM][dD]\?&/
  }

signature sid-1007 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS cross-site scripting attempt"
  http /.*[\/\\]Form_JScript\.asp/
  tcp-state established,originator
  }

signature sid-1380 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS cross-site scripting attempt"
  http /.*[\/\\]Form_VBScript\.asp/
  tcp-state established,originator
  }

signature sid-1008 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS del attempt"
  tcp-state established,originator
  payload /.*&[dD][eE][lL]\+\/[sS]\+[cC]\x3a\\\*\.\*/
  }

signature sid-1009 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS directory listing"
  http /.*[\/\\]ServerVariables_Jscript\.asp/
  tcp-state established,originator
  }

signature sid-1010 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS encoding access"
  tcp-state established,originator
  payload /.*\x25\x31\x75/
  }

signature sid-1011 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS exec-src access"
  tcp-state established,originator
  payload /.*#[fF][iI][lL][eE][nN][aA][mM][eE]=\*\.[eE][xX][eE]/
  }

signature sid-1012 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS fpcount attempt"
  http /.*[\/\\]fpcount\.exe/
  tcp-state established,originator
  payload /.*[dD][iI][gG][iI][tT][sS]=/
  }

signature sid-1013 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS fpcount access"
  http /.*[\/\\]fpcount\.exe/
  tcp-state established,originator
  }

signature sid-1015 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS getdrvs.exe access"
  http /.*[\/\\]scripts[\/\\]tools[\/\\]getdrvs\.exe/
  tcp-state established,originator
  }

signature sid-1016 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS global.asa access"
  http /.*[\/\\]global\.asa/
  tcp-state established,originator
  }

signature sid-1017 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS idc-srch attempt"
  tcp-state established,originator
  payload /.*#[fF][iI][lL][eE][nN][aA][mM][eE]=\*\.[iI][dD][cC]/
  }

signature sid-1018 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS iisadmpwd attempt"
  http /.*[\/\\]iisadmpwd[\/\\]aexp/
  tcp-state established,originator
  }

signature sid-1019 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS index server file source code attempt"
  http /.*\?CiWebHitsFile=[\/\\]/
  tcp-state established,originator
  payload /.*&CiRestriction=none&CiHiliteType=Full/
  }

signature sid-1020 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS isc$data attempt"
  http /.*\.idc\x3a\x3a\$data/
  tcp-state established,originator
  }

signature sid-1021 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS ism.dll attempt"
  http /.*%20%20%20%20%20\.htr/
  tcp-state established,originator
  }

signature sid-1022 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS jet vba access"
  http /.*[\/\\]advworks[\/\\]equipment[\/\\]catalog_type\.asp/
  tcp-state established,originator
  }

signature sid-1023 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS msadcs.dll access"
  http /.*[\/\\]msadcs\.dll/
  tcp-state established,originator
  }

signature sid-1024 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS newdsn.exe access"
  http /.*[\/\\]scripts[\/\\]tools[\/\\]newdsn\.exe/
  tcp-state established,originator
  }

signature sid-1025 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS perl access"
  http /.*[\/\\]scripts[\/\\]perl/
  tcp-state established,originator
  }

signature sid-1026 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS perl-browse0a attempt"
  http /.*%0a\.pl/
  tcp-state established,originator
  }

signature sid-1027 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS perl-browse20 attempt"
  http /.*%20\.pl/
  tcp-state established,originator
  }

signature sid-1029 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS scripts-browse access"
  http /.*[\/\\]scripts[\/\\]\x20/
  tcp-state established,originator
  }

signature sid-1030 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS search97.vts access"
  http /.*[\/\\]search97\.vts/
  tcp-state established,originator
  }

signature sid-1037 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS showcode.asp access"
  http /.*[\/\\]showcode\.asp/
  tcp-state established,originator
  }

signature sid-1038 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS site server config access"
  http /.*[\/\\]adsamples[\/\\]config[\/\\]site\.csc/
  tcp-state established,originator
  }

signature sid-1039 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS srch.htm access"
  http /.*[\/\\]samples[\/\\]isapi[\/\\]srch\.htm/
  tcp-state established,originator
  }

signature sid-1040 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS srchadm access"
  http /.*[\/\\]srchadm/
  tcp-state established,originator
  }

signature sid-1041 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS uploadn.asp access"
  http /.*[\/\\]scripts[\/\\]uploadn\.asp/
  tcp-state established,originator
  }

signature sid-1042 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS view source via translate header"
  tcp-state established,originator
  payload /.*[tT][rR][aA][nN][sS][lL][aA][tT][eE]\x3a [fF]/
  }

signature sid-1043 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS viewcode.asp access"
  http /.*[\/\\]viewcode\.asp/
  tcp-state established,originator
  }

signature sid-1044 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS webhits access"
  http /.*\.htw/
  tcp-state established,originator
  }

signature sid-1726 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS doctodep.btr access"
  http /.*doctodep\.btr/
  tcp-state established,originator
  }

signature sid-1046 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS site/iisamples access"
  http /.*[\/\\]site[\/\\]iisamples/
  tcp-state established,originator
  }

signature sid-1256 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS CodeRed v2 root.exe access"
  http /.*[\/\\]root\.exe/
  tcp-state established,originator
  }

signature sid-1283 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS outlook web dos"
  http /.*[\/\\]exchange[\/\\]LogonFrm\.asp\?/
  tcp-state established,originator
  payload /.*[mM][aA][iI][lL][bB][oO][xX]=/
  payload /.*\x25\x25\x25/
  }

signature sid-1400 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS /scripts/samples/ access"
  http /.*[\/\\]scripts[\/\\]samples[\/\\]/
  tcp-state established,originator
  }

signature sid-1401 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS /msadc/samples/ access"
  http /.*[\/\\]msadc[\/\\]samples[\/\\]/
  tcp-state established,originator
  }

signature sid-1402 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS iissamples access"
  http /.*[\/\\]iissamples[\/\\]/
  tcp-state established,originator
  }

signature sid-970 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS multiple decode attempt"
  http /.*%5c/
  http /.*\.\./
  tcp-state established,originator
  }

signature sid-993 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS iisadmin access"
  http /.*[\/\\]iisadmin/
  tcp-state established,originator
  }

signature sid-1285 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS msdac access"
  http /.*[\/\\]msdac[\/\\]/
  tcp-state established,originator
  }

signature sid-1286 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS _mem_bin access"
  http /.*[\/\\]_mem_bin[\/\\]/
  tcp-state established,originator
  }

signature sid-1595 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS htimage.exe access"
  http /.*[\/\\]htimage\.exe/
  tcp-state established,originator
  }

signature sid-1817 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS MS Site Server default login attempt"
  http /.*[\/\\]SiteServer[\/\\]Admin[\/\\]knowledge[\/\\]persmbr[\/\\]/
  tcp-state established,originator
  payload /.*[aA][uU][tT][hH][oO][rR][iI][zZ][aA][tT][iI][oO][nN]: [bB][aA][sS][iI][cC] [tT][eE][rR][bB][uU][fF]9[bB][bB][mM]9[uU][eE][wW]1[vV][dD][xX][mM]6[tT][gG][rR][hH][cC][fF][bB][hH][cC]3[nN]3[bB]3[jJ][kK][xX][zZ][eE]=/
  }

signature sid-1818 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS MS Site Server admin attempt"
  http /.*[\/\\]Site Server[\/\\]Admin[\/\\]knowledge[\/\\]persmbr[\/\\]/
  tcp-state established,originator
  }

signature sid-1075 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS postinfo.asp access"
  http /.*[\/\\]scripts[\/\\]postinfo\.asp/
  tcp-state established,originator
  }

signature sid-1567 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS /exchange/root.asp attempt"
  http /.*[\/\\]exchange[\/\\]root\.asp\?acs=anon/
  tcp-state established,originator
  }

signature sid-1568 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS /exchange/root.asp access"
  http /.*[\/\\]exchange[\/\\]root\.asp/
  tcp-state established,originator
  }

signature sid-2090 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS WEBDAV exploit attempt"
  tcp-state established,originator
  payload /.*HTTP\/1\.1\x0aContent-type\x3a text\/xml\x0aHOST\x3a.{1}.*Accept\x3a \x2a\/\x2a\x0aTranslate\x3a f\x0aContent-length\x3a5276\x0a\x0a/
  }

signature sid-2091 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS WEBDAV nessus safe scan attempt"
  tcp-state established,originator
  payload /.*SEARCH \/ HTTP\/1\.1\x0d\x0aHost\x3a.{0,251}\x0d\x0a\x0d\x0a/
  }

signature sid-2117 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS Battleaxe Forum login.asp access"
  http /.*myaccount[\/\\]login\.asp/
  tcp-state established,originator
  }

signature sid-2129 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS nsiislog.dll access"
  http /.*[\/\\]nsiislog\.dll/
  tcp-state established,originator
  }

signature sid-2130 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS IISProtect siteadmin.asp access"
  http /.*[\/\\]iisprotect[\/\\]admin[\/\\]SiteAdmin\.asp/
  tcp-state established,originator
  }

signature sid-2157 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS IISProtect globaladmin.asp access"
  http /.*[\/\\]iisprotect[\/\\]admin[\/\\]GlobalAdmin\.asp/
  tcp-state established,originator
  }

signature sid-2131 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS IISProtect access"
  http /.*[\/\\]iisprotect[\/\\]admin[\/\\]/
  tcp-state established,originator
  }

signature sid-2132 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS Synchrologic Email Accelerator userid list access attempt"
  http /.*[\/\\]en[\/\\]admin[\/\\]aggregate\.asp/
  tcp-state established,originator
  }

signature sid-2133 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS MS BizTalk server access"
  http /.*[\/\\]biztalkhttpreceive\.dll/
  tcp-state established,originator
  }

signature sid-2134 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-IIS register.asp access"
  http /.*[\/\\]register\.asp/
  tcp-state established,originator
  }

signature sid-1248 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE rad fp30reg.dll access"
  http /.*[\/\\]fp30reg\.dll/
  tcp-state established,originator
  }

signature sid-1249 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE frontpage rad fp4areg.dll access"
  http /.*[\/\\]fp4areg\.dll/
  tcp-state established,originator
  }

signature sid-937 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE _vti_rpc access"
  http /.*[\/\\]_vti_rpc/
  tcp-state established,originator
  }

signature sid-939 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE posting"
  http /.*[\/\\]author\.dll/
  tcp-state established,originator
  payload /.*[pP][oO][sS][tT]/
  }

signature sid-940 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE shtml.dll access"
  http /.*[\/\\]_vti_bin[\/\\]shtml\.dll/
  tcp-state established,originator
  }

signature sid-941 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE contents.htm access"
  http /.*[\/\\]admcgi[\/\\]contents\.htm/
  tcp-state established,originator
  }

signature sid-942 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE orders.htm access"
  http /.*[\/\\]_private[\/\\]orders\.htm/
  tcp-state established,originator
  }

signature sid-943 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE fpsrvadm.exe access"
  http /.*[\/\\]fpsrvadm\.exe/
  tcp-state established,originator
  }

signature sid-944 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE fpremadm.exe access"
  http /.*[\/\\]fpremadm\.exe/
  tcp-state established,originator
  }

signature sid-945 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE fpadmin.htm access"
  http /.*[\/\\]admisapi[\/\\]fpadmin\.htm/
  tcp-state established,originator
  }

signature sid-946 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE fpadmcgi.exe access"
  http /.*[\/\\]scripts[\/\\]Fpadmcgi\.exe/
  tcp-state established,originator
  }

signature sid-947 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE orders.txt access"
  http /.*[\/\\]_private[\/\\]orders\.txt/
  tcp-state established,originator
  }

signature sid-948 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE form_results access"
  http /.*[\/\\]_private[\/\\]form_results\.txt/
  tcp-state established,originator
  }

signature sid-949 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE registrations.htm access"
  http /.*[\/\\]_private[\/\\]registrations\.htm/
  tcp-state established,originator
  }

signature sid-950 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE cfgwiz.exe access"
  http /.*[\/\\]cfgwiz\.exe/
  tcp-state established,originator
  }

signature sid-951 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE authors.pwd access"
  http /.*[\/\\]authors\.pwd/
  tcp-state established,originator
  }

signature sid-952 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE author.exe access"
  http /.*[\/\\]_vti_bin[\/\\]_vti_aut[\/\\]author\.exe/
  tcp-state established,originator
  }

signature sid-953 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE administrators.pwd access"
  http /.*[\/\\]administrators\.pwd/
  tcp-state established,originator
  }

signature sid-954 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE form_results.htm access"
  http /.*[\/\\]_private[\/\\]form_results\.htm/
  tcp-state established,originator
  }

signature sid-955 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE access.cnf access"
  http /.*[\/\\]_vti_pvt[\/\\]access\.cnf/
  tcp-state established,originator
  }

signature sid-956 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE register.txt access"
  http /.*[\/\\]_private[\/\\]register\.txt/
  tcp-state established,originator
  }

signature sid-957 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE registrations.txt access"
  http /.*[\/\\]_private[\/\\]registrations\.txt/
  tcp-state established,originator
  }

signature sid-958 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE service.cnf access"
  http /.*[\/\\]_vti_pvt[\/\\]service\.cnf/
  tcp-state established,originator
  }

signature sid-959 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE service.pwd"
  http /.*[\/\\]service\.pwd/
  tcp-state established,originator
  }

signature sid-960 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE service.stp access"
  http /.*[\/\\]_vti_pvt[\/\\]service\.stp/
  tcp-state established,originator
  }

signature sid-961 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE services.cnf access"
  http /.*[\/\\]_vti_pvt[\/\\]services\.cnf/
  tcp-state established,originator
  }

signature sid-962 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE shtml.exe access"
  http /.*[\/\\]_vti_bin[\/\\]shtml\.exe/
  tcp-state established,originator
  }

signature sid-963 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE svcacl.cnf access"
  http /.*[\/\\]_vti_pvt[\/\\]svcacl\.cnf/
  tcp-state established,originator
  }

signature sid-964 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE users.pwd access"
  http /.*[\/\\]users\.pwd/
  tcp-state established,originator
  }

signature sid-965 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE writeto.cnf access"
  http /.*[\/\\]_vti_pvt[\/\\]writeto\.cnf/
  tcp-state established,originator
  }

signature sid-966 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE fourdots request"
  tcp-state established,originator
  payload /.*\x2e\x2e\x2e\x2e\x2f/
  }

signature sid-967 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE dvwssr.dll access"
  http /.*[\/\\]dvwssr\.dll/
  tcp-state established,originator
  }

signature sid-968 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE register.htm access"
  http /.*[\/\\]_private[\/\\]register\.htm/
  tcp-state established,originator
  }

signature sid-1288 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-FRONTPAGE /_vti_bin/ access"
  http /.*[\/\\]_vti_bin[\/\\]/
  tcp-state established,originator
  }

signature sid-1497 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC cross site scripting attempt"
  tcp-state established,originator
  payload /.*<[sS][cC][rR][iI][pP][tT]>/
  }

signature sid-1667 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC cross site scripting (img src=javascript) attempt"
  tcp-state established,originator
  payload /.*[iI][mM][gG] [sS][rR][cC]=[jJ][aA][vV][aA][sS][cC][rR][iI][pP][tT]/
  }

signature sid-1250 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Cisco IOS HTTP configuration attempt"
  http /.*[\/\\]level[\/\\]/
  http /.*[\/\\]exec[\/\\]/
  tcp-state established,originator
  }

signature sid-1047 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Netscape Enterprise DOS"
  tcp-state established,originator
  payload /REVLOG \/ /
  }

signature sid-1048 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Netscape Enterprise directory listing attempt"
  tcp-state established,originator
  payload /INDEX /
  }

signature sid-1050 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC iPlanet GETPROPERTIES attempt"
  tcp-state established,originator
  payload /GETPROPERTIES/
  }

signature sid-1054 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC weblogic view source attempt"
  http /.*\.js%70/
  tcp-state established,originator
  }

signature sid-1055 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Tomcat directory traversal attempt"
  http /.*%00\.jsp/
  tcp-state established,originator
  }

signature sid-1056 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Tomcat view source attempt"
  http /.*%252ejsp/
  tcp-state established,originator
  }

signature sid-1057 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC ftp attempt"
  tcp-state established,originator
  payload /.*[fF][tT][pP]\.[eE][xX][eE]/
  }

signature sid-1058 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC xp_enumdsn attempt"
  tcp-state established,originator
  payload /.*[xX][pP]_[eE][nN][uU][mM][dD][sS][nN]/
  }

signature sid-1059 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC xp_filelist attempt"
  tcp-state established,originator
  payload /.*[xX][pP]_[fF][iI][lL][eE][lL][iI][sS][tT]/
  }

signature sid-1060 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC xp_availablemedia attempt"
  tcp-state established,originator
  payload /.*[xX][pP]_[aA][vV][aA][iI][lL][aA][bB][lL][eE][mM][eE][dD][iI][aA]/
  }

signature sid-1061 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC xp_cmdshell attempt"
  tcp-state established,originator
  payload /.*[xX][pP]_[cC][mM][dD][sS][hH][eE][lL][lL]/
  }

signature sid-1062 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC nc.exe attempt"
  tcp-state established,originator
  payload /.*[nN][cC]\.[eE][xX][eE]/
  }

signature sid-1064 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC wsh attempt"
  tcp-state established,originator
  payload /.*[wW][sS][hH]\.[eE][xX][eE]/
  }

signature sid-1065 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC rcmd attempt"
  tcp-state established,originator
  payload /.*[rR][cC][mM][dD]\.[eE][xX][eE]/
  }

signature sid-1066 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC telnet attempt"
  tcp-state established,originator
  payload /.*[tT][eE][lL][nN][eE][tT]\.[eE][xX][eE]/
  }

signature sid-1067 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC net attempt"
  tcp-state established,originator
  payload /.*[nN][eE][tT]\.[eE][xX][eE]/
  }

signature sid-1068 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC tftp attempt"
  tcp-state established,originator
  payload /.*[tT][fF][tT][pP]\.[eE][xX][eE]/
  }

signature sid-1069 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC xp_regread attempt"
  tcp-state established,originator
  payload /.*[xX][pP]_[rR][eE][gG][rR][eE][aA][dD]/
  }

signature sid-1977 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC xp_regwrite attempt"
  tcp-state established,originator
  payload /.*[xX][pP]_[rR][eE][gG][wW][rR][iI][tT][eE]/
  }

signature sid-1978 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC xp_regdeletekey attempt"
  tcp-state established,originator
  payload /.*[xX][pP]_[rR][eE][gG][dD][eE][lL][eE][tT][eE][kK][eE][yY]/
  }

signature sid-1070 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC WebDAV search access"
  tcp-state established,originator
  payload /.{0,1}[sS][eE][aA][rR][cC][hH] /
  }

signature sid-1071 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC .htpasswd access"
  tcp-state established,originator
  payload /.*\.[hH][tT][pP][aA][sS][sS][wW][dD]/
  }

signature sid-1072 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Lotus Domino directory traversal"
  http /.*\.nsf[\/\\]/
  http /.*\.\.[\/\\]/
  tcp-state established,originator
  }

signature sid-1077 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC queryhit.htm access"
  http /.*[\/\\]samples[\/\\]search[\/\\]queryhit\.htm/
  tcp-state established,originator
  }

signature sid-1078 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC counter.exe access"
  http /.*[\/\\]scripts[\/\\]counter\.exe/
  tcp-state established,originator
  }

signature sid-1079 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC WebDAV propfind access"
  tcp-state established,originator
  payload /.*<[aA]:[pP][rR][oO][pP][fF][iI][nN][dD]/
  payload /.*[xX][mM][lL][nN][sS]:[aA]=\"[dD][aA][vV]\">/
  }

signature sid-1080 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC unify eWave ServletExec upload"
  http /.*[\/\\]servlet[\/\\]com\.unify\.servletexec\.UploadServlet/
  tcp-state established,originator
  }

signature sid-1081 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Netscape Servers suite DOS"
  http /.*[\/\\]dsgw[\/\\]bin[\/\\]search\?context=/
  tcp-state established,originator
  }

signature sid-1082 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC amazon 1-click cookie theft"
  tcp-state established,originator
  payload /.*[rR][eE][fF]%3[cC][sS][cC][rR][iI][pP][tT]%20[lL][aA][nN][gG][uU][aA][gG][eE]%3[dD]%22[jJ][aA][vV][aA][sS][cC][rR][iI][pP][tT]/
  }

signature sid-1083 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC unify eWave ServletExec DOS"
  http /.*[\/\\]servlet[\/\\]ServletExec/
  tcp-state established,originator
  }

signature sid-1084 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Allaire JRUN DOS attempt"
  http /.*servlet[\/\\]\.\.\.\.\.\.\./
  tcp-state established,originator
  }

signature sid-1091 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC ICQ Webfront HTTP DOS"
  http /.*\?\?\?\?\?\?\?\?\?\?/
  tcp-state established,originator
  }

signature sid-1095 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Talentsoft Web+ Source Code view access"
  http /.*[\/\\]webplus\.exe\?script=test\.wml/
  tcp-state established,originator
  }

signature sid-1096 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Talentsoft Web+ internal IP Address access"
  http /.*[\/\\]webplus\.exe\?about/
  tcp-state established,originator
  }

signature sid-1098 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC SmartWin CyberOffice Shopping Cart access"
  http /.*_private[\/\\]shopping_cart\.mdb/
  tcp-state established,originator
  }

signature sid-1099 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC cybercop scan"
  http /.*[\/\\]cybercop/
  tcp-state established,originator
  }

signature sid-1100 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC L3retriever HTTP Probe"
  tcp-state established,originator
  payload /.*User-Agent\x3a Java1\.2\.1\x0d\x0a/
  }

signature sid-1101 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Webtrends HTTP probe"
  tcp-state established,originator
  payload /.*User-Agent\x3a Webtrends Security Analyzer\x0d\x0a/
  }

signature sid-1102 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Nessus 404 probe"
  http /.*[\/\\]nessus_is_probing_you_/
  tcp-state established,originator
  }

signature sid-1103 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Netscape admin passwd"
  http /.*[\/\\]admin-serv[\/\\]config[\/\\]admpw/
  tcp-state established,originator
  }

signature sid-1105 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC BigBrother access"
  http /.*[\/\\]bb-hostsvc\.sh\?HOSTSVC/
  tcp-state established,originator
  }

signature sid-1612 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC ftp.pl attempt"
  http /.*[\/\\]ftp\.pl\?dir=\.\.[\/\\]\.\./
  tcp-state established,originator
  }

signature sid-1107 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC ftp.pl access"
  http /.*[\/\\]ftp\.pl/
  tcp-state established,originator
  }

signature sid-1108 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Tomcat server snoop access"
  http /.*[\/\\]jsp[\/\\]snp[\/\\]/
  http /.*\.snp/
  tcp-state established,originator
  }

signature sid-1109 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC ROXEN directory list attempt"
  http /.*\x2F\x25\x30\x30/
  tcp-state established,originator
  }

signature sid-1110 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC apache source.asp file access"
  http /.*[\/\\]site[\/\\]eg[\/\\]source\.asp/
  tcp-state established,originator
  }

signature sid-1111 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Tomcat server exploit access"
  http /.*[\/\\]contextAdmin[\/\\]contextAdmin\.html/
  tcp-state established,originator
  }

signature sid-1112 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC http directory traversal"
  tcp-state established,originator
  payload /.*\.\.\\/
  }

signature sid-1115 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC ICQ webserver DOS"
  http /.*\.html[\/\\]\.\.\.\.\.\./
  tcp-state established,originator
  }

signature sid-1116 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Lotus DelDoc attempt"
  http /.*\?DeleteDocument/
  tcp-state established,originator
  }

signature sid-1117 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Lotus EditDoc attempt"
  http /.*\?EditDocument/
  tcp-state established,originator
  }

signature sid-1118 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC ls%20-l"
  tcp-state established,originator
  payload /.*[lL][sS]%20-[lL]/
  }

signature sid-1119 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC mlog.phtml access"
  http /.*[\/\\]mlog\.phtml/
  tcp-state established,originator
  }

signature sid-1120 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC mylog.phtml access"
  http /.*[\/\\]mylog\.phtml/
  tcp-state established,originator
  }

signature sid-1122 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC /etc/passwd"
  tcp-state established,originator
  payload /.*\/[eE][tT][cC]\/[pP][aA][sS][sS][wW][dD]/
  }

signature sid-1123 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC ?PageServices access"
  http /.*\?PageServices/
  tcp-state established,originator
  }

signature sid-1124 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Ecommerce check.txt access"
  http /.*[\/\\]config[\/\\]check\.txt/
  tcp-state established,originator
  }

signature sid-1125 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC webcart access"
  http /.*[\/\\]webcart[\/\\]/
  tcp-state established,originator
  }

signature sid-1126 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC AuthChangeUrl access"
  http /.*_AuthChangeUrl\?/
  tcp-state established,originator
  }

signature sid-1127 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC convert.bas access"
  http /.*[\/\\]scripts[\/\\]convert\.bas/
  tcp-state established,originator
  }

signature sid-1128 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC cpshost.dll access"
  http /.*[\/\\]scripts[\/\\]cpshost\.dll/
  tcp-state established,originator
  }

signature sid-1129 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC .htaccess access"
  tcp-state established,originator
  payload /.*\.[hH][tT][aA][cC][cC][eE][sS][sS]/
  }

signature sid-1130 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC .wwwacl access"
  http /.*\.wwwacl/
  tcp-state established,originator
  }

signature sid-1131 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC .wwwacl access"
  http /.*\.www_acl/
  tcp-state established,originator
  }

signature sid-1136 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC cd.."
  tcp-state established,originator
  payload /.*[cC][dD]\.\./
  }

signature sid-1140 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC guestbook.pl access"
  http /.*[\/\\]guestbook\.pl/
  tcp-state established,originator
  }

signature sid-1613 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC handler attempt"
  http /.*[\/\\]handler/
  http /.*\|/
  tcp-state established,originator
  }

signature sid-1141 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC handler access"
  http /.*[\/\\]handler/
  tcp-state established,originator
  }

signature sid-1142 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC /.... access"
  tcp-state established,originator
  payload /.*\/\.\.\.\./
  }

signature sid-1143 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC ///cgi-bin access"
  http /.*[\/\\][\/\\][\/\\]cgi-bin/
  tcp-state established,originator
  }

signature sid-1144 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC /cgi-bin/// access"
  http /.*[\/\\]cgi-bin[\/\\][\/\\][\/\\]/
  tcp-state established,originator
  }

signature sid-1145 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC /~root access"
  http /.*[\/\\]~root/
  tcp-state established,originator
  }

signature sid-1662 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC /~ftp access"
  http /.*[\/\\]~ftp/
  tcp-state established,originator
  }

signature sid-1146 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Ecommerce import.txt access"
  http /.*[\/\\]config[\/\\]import\.txt/
  tcp-state established,originator
  }

signature sid-1147 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC cat%20 access"
  tcp-state established,originator
  payload /.*[cC][aA][tT]%20/
  }

signature sid-1148 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Ecommerce import.txt access"
  http /.*[\/\\]orders[\/\\]import\.txt/
  tcp-state established,originator
  }

signature sid-1150 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Domino catalog.nsf access"
  http /.*[\/\\]catalog\.nsf/
  tcp-state established,originator
  }

signature sid-1151 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Domino domcfg.nsf access"
  http /.*[\/\\]domcfg\.nsf/
  tcp-state established,originator
  }

signature sid-1152 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Domino domlog.nsf access"
  http /.*[\/\\]domlog\.nsf/
  tcp-state established,originator
  }

signature sid-1153 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Domino log.nsf access"
  http /.*[\/\\]log\.nsf/
  tcp-state established,originator
  }

signature sid-1154 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Domino names.nsf access"
  http /.*[\/\\]names\.nsf/
  tcp-state established,originator
  }

signature sid-1575 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Domino mab.nsf access"
  http /.*[\/\\]mab\.nsf/
  tcp-state established,originator
  }

signature sid-1576 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Domino cersvr.nsf access"
  http /.*[\/\\]cersvr\.nsf/
  tcp-state established,originator
  }

signature sid-1577 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Domino setup.nsf access"
  http /.*[\/\\]setup\.nsf/
  tcp-state established,originator
  }

signature sid-1578 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Domino statrep.nsf access"
  http /.*[\/\\]statrep\.nsf/
  tcp-state established,originator
  }

signature sid-1579 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Domino webadmin.nsf access"
  http /.*[\/\\]webadmin\.nsf/
  tcp-state established,originator
  }

signature sid-1580 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Domino events4.nsf access"
  http /.*[\/\\]events4\.nsf/
  tcp-state established,originator
  }

signature sid-1581 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Domino ntsync4.nsf access"
  http /.*[\/\\]ntsync4\.nsf/
  tcp-state established,originator
  }

signature sid-1582 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Domino collect4.nsf access"
  http /.*[\/\\]collect4\.nsf/
  tcp-state established,originator
  }

signature sid-1583 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Domino mailw46.nsf access"
  http /.*[\/\\]mailw46\.nsf/
  tcp-state established,originator
  }

signature sid-1584 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Domino bookmark.nsf access"
  http /.*[\/\\]bookmark\.nsf/
  tcp-state established,originator
  }

signature sid-1585 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Domino agentrunner.nsf access"
  http /.*[\/\\]agentrunner\.nsf/
  tcp-state established,originator
  }

signature sid-1586 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Domino mail.box access"
  http /.*[\/\\]mail\.box/
  tcp-state established,originator
  }

signature sid-1155 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Ecommerce checks.txt access"
  http /.*[\/\\]orders[\/\\]checks\.txt/
  tcp-state established,originator
  }

signature sid-1156 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC apache DOS attempt"
  tcp-state established,originator
  payload /.*\x2f\x2f\x2f\x2f\x2f\x2f\x2f\x2f/
  }

signature sid-1157 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Netscape PublishingXpert access"
  http /.*[\/\\]PSUser[\/\\]PSCOErrPage\.htm/
  tcp-state established,originator
  }

signature sid-1158 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC windmail.exe access"
  http /.*[\/\\]windmail\.exe/
  tcp-state established,originator
  }

signature sid-1159 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC webplus access"
  http /.*[\/\\]webplus\?script/
  tcp-state established,originator
  }

signature sid-1160 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Netscape dir index wp"
  http /.*\?wp-/
  tcp-state established,originator
  }

signature sid-1162 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC cart 32 AdminPwd access"
  http /.*[\/\\]c32web\.exe[\/\\]ChangeAdminPassword/
  tcp-state established,originator
  }

signature sid-1164 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC shopping cart access"
  http /.*[\/\\]quikstore\.cfg/
  tcp-state established,originator
  }

signature sid-1614 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Novell Groupwise gwweb.exe attempt"
  http /.*[\/\\]GWWEB\.EXE\?HELP=/
  tcp-state established,originator
  }

signature sid-1165 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Novell Groupwise gwweb.exe access"
  tcp-state established,originator
  payload /.*\/[gG][wW][wW][eE][bB]\.[eE][xX][eE]/
  }

signature sid-1166 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC ws_ftp.ini access"
  http /.*[\/\\]ws_ftp\.ini/
  tcp-state established,originator
  }

signature sid-1167 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC rpm_query access"
  http /.*[\/\\]rpm_query/
  tcp-state established,originator
  }

signature sid-1168 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC mall log order access"
  http /.*[\/\\]mall_log_files[\/\\]order\.log/
  tcp-state established,originator
  }

signature sid-1173 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC architext_query.pl access"
  http /.*[\/\\]ews[\/\\]architext_query\.pl/
  tcp-state established,originator
  }

signature sid-1175 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC wwwboard.pl access"
  http /.*[\/\\]wwwboard\.pl/
  tcp-state established,originator
  }

signature sid-1176 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC order.log access"
  http /.*[\/\\]admin_files[\/\\]order\.log/
  tcp-state established,originator
  }

signature sid-1177 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Netscape Enterprise Server directory view"
  http /.*\?wp-verify-link/
  tcp-state established,originator
  }

signature sid-1180 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC get32.exe access"
  http /.*[\/\\]get32\.exe/
  tcp-state established,originator
  }

signature sid-1181 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Annex Terminal DOS attempt"
  http /.*[\/\\]ping\?query=/
  tcp-state established,originator
  }

signature sid-1182 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC cgitest.exe attempt"
  http /.*[\/\\]cgitest\.exe\x0d\x0auser/
  tcp-state established,originator
  }

signature sid-1587 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC cgitest.exe access"
  http /.*[\/\\]cgitest\.exe/
  tcp-state established,originator
  }

signature sid-1183 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Netscape Enterprise Server directory view"
  http /.*\?wp-cs-dump/
  tcp-state established,originator
  }

signature sid-1184 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Netscape Enterprise Server directory view"
  http /.*\?wp-ver-info/
  tcp-state established,originator
  }

signature sid-1186 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Netscape Enterprise Server directory view"
  http /.*\?wp-ver-diff/
  tcp-state established,originator
  }

signature sid-1187 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC SalesLogix Eviewer web command attempt"
  http /.*[\/\\]slxweb\.dll[\/\\]admin\?command=/
  tcp-state established,originator
  }

signature sid-1588 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC SalesLogix Eviewer access"
  http /.*[\/\\]slxweb\.dll/
  tcp-state established,originator
  }

signature sid-1188 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Netscape Enterprise Server directory view"
  http /.*\?wp-start-ver/
  tcp-state established,originator
  }

signature sid-1189 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Netscape Enterprise Server directory view"
  http /.*\?wp-stop-ver/
  tcp-state established,originator
  }

signature sid-1190 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Netscape Enterprise Server directory view"
  http /.*\?wp-uncheckout/
  tcp-state established,originator
  }

signature sid-1191 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Netscape Enterprise Server directory view"
  http /.*\?wp-html-rend/
  tcp-state established,originator
  }

signature sid-1381 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Trend Micro OfficeScan attempt"
  http /.*[\/\\]officescan[\/\\]cgi[\/\\]jdkRqNotify\.exe\?/
  http /.*domain=/
  http /.*event=/
  tcp-state established,originator
  }

signature sid-1192 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Trend Micro OfficeScan access"
  http /.*[\/\\]officescan[\/\\]cgi[\/\\]jdkRqNotify\.exe/
  tcp-state established,originator
  }

signature sid-1193 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC oracle web arbitrary command execution attempt"
  http /.*[\/\\]ows-bin[\/\\]/
  http /.*\?&/
  tcp-state established,originator
  }

signature sid-1880 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC oracle web application server access"
  http /.*[\/\\]ows-bin[\/\\]/
  tcp-state established,originator
  }

signature sid-1198 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Netscape Enterprise Server directory view"
  http /.*\?wp-usr-prop/
  tcp-state established,originator
  }

signature sid-1202 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC search.vts access"
  http /.*[\/\\]search\.vts/
  tcp-state established,originator
  }

signature sid-1615 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC htgrep attempt"
  http /.*[\/\\]htgrep/
  tcp-state established,originator
  payload /.*hdr=\//
  }

signature sid-1207 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC htgrep access"
  http /.*[\/\\]htgrep/
  tcp-state established,originator
  }

signature sid-1209 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC .nsconfig access"
  http /.*[\/\\]\.nsconfig/
  tcp-state established,originator
  }

signature sid-1212 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Admin_files access"
  http /.*[\/\\]admin_files/
  tcp-state established,originator
  }

signature sid-1213 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC backup access"
  http /.*[\/\\]backup/
  tcp-state established,originator
  }

signature sid-1214 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC intranet access"
  http /.*[\/\\]intranet[\/\\]/
  tcp-state established,originator
  }

signature sid-1216 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC filemail access"
  http /.*[\/\\]filemail/
  tcp-state established,originator
  }

signature sid-1217 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC plusmail access"
  http /.*[\/\\]plusmail/
  tcp-state established,originator
  }

signature sid-1218 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC adminlogin access"
  http /.*[\/\\]adminlogin/
  tcp-state established,originator
  }

signature sid-1220 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC ultraboard access"
  http /.*[\/\\]ultraboard/
  tcp-state established,originator
  }

signature sid-1589 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC musicat empower attempt"
  http /.*[\/\\]empower\?DB=/
  tcp-state established,originator
  }

signature sid-1221 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC musicat empower access"
  http /.*[\/\\]empower/
  tcp-state established,originator
  }

signature sid-1224 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC ROADS search.pl attempt"
  http /.*[\/\\]ROADS[\/\\]cgi-bin[\/\\]search\.pl/
  tcp-state established,originator
  payload /.*[fF][oO][rR][mM]=/
  }

signature sid-1230 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC VirusWall FtpSave access"
  http /.*[\/\\]FtpSave\.dll/
  tcp-state established,originator
  }

signature sid-1234 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC VirusWall FtpSaveCSP access"
  http /.*[\/\\]FtpSaveCSP\.dll/
  tcp-state established,originator
  }

signature sid-1235 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC VirusWall FtpSaveCVP access"
  http /.*[\/\\]FtpSaveCVP\.dll/
  tcp-state established,originator
  }

signature sid-1236 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Tomcat sourecode view"
  http /.*\.js%2570/
  tcp-state established,originator
  }

signature sid-1237 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Tomcat sourecode view"
  http /.*\.j%2573p/
  tcp-state established,originator
  }

signature sid-1238 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Tomcat sourecode view"
  http /.*\.%256Asp/
  tcp-state established,originator
  }

signature sid-1241 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC SWEditServlet directory traversal attempt"
  http /.*[\/\\]SWEditServlet/
  tcp-state established,originator
  payload /.*template=\.\.\/\.\.\/\.\.\//
  }

signature sid-1259 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC SWEditServlet access"
  http /.*[\/\\]SWEditServlet/
  tcp-state established,originator
  }

signature sid-1139 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC whisker HEAD/./"
  tcp-state established,originator
  payload /.*HEAD\/\.\//
  }

signature sid-1258 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC HP OpenView Manager DOS"
  http /.*[\/\\]OvCgi[\/\\]OpenView5\.exe\?Context=Snmp&Action=Snmp&Host=&Oid=/
  tcp-state established,originator
  }

signature sid-1260 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC long basic authorization string"
  tcp-state established,originator
  payload /.*[aA][uU][tT][hH][oO][rR][iI][zZ][aA][tT][iI][oO][nN]: [bB][aA][sS][iI][cC] [^\x0A]{512}/
  }

signature sid-1291 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC sml3com access"
  http /.*[\/\\]graphics[\/\\]sml3com/
  tcp-state established,originator
  }

signature sid-1001 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC carbo.dll access"
  http /.*[\/\\]carbo\.dll/
  tcp-state established,originator
  payload /.*[iI][cC][aA][tT][cC][oO][mM][mM][aA][nN][dD]=/
  }

signature sid-1302 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC console.exe access"
  http /.*[\/\\]cgi-bin[\/\\]console\.exe/
  tcp-state established,originator
  }

signature sid-1303 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC cs.exe access"
  http /.*[\/\\]cgi-bin[\/\\]cs\.exe/
  tcp-state established,originator
  }

signature sid-1113 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC http directory traversal"
  tcp-state established,originator
  payload /.*\.\.\//
  }

signature sid-1375 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC sadmind worm access"
  tcp-state established,originator
  payload /.{0,1}GET x HTTP\/1\.0/
  }

signature sid-1376 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC jrun directory browse attempt"
  http /.*[\/\\]%3f\.jsp/
  tcp-state established,originator
  }

signature sid-1385 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC mod-plsql administration access"
  http /.*[\/\\]admin_[\/\\]/
  tcp-state established,originator
  }

signature sid-1391 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Phorecast remote code execution attempt"
  tcp-state established,originator
  payload /.*includedir=/
  }

signature sid-1403 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC viewcode access"
  http /.*[\/\\]viewcode/
  tcp-state established,originator
  }

signature sid-1404 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC showcode access"
  http /.*[\/\\]showcode/
  tcp-state established,originator
  }

signature sid-1433 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC .history access"
  http /.*[\/\\]\.history/
  tcp-state established,originator
  }

signature sid-1434 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC .bash_history access"
  http /.*[\/\\]\.bash_history/
  tcp-state established,originator
  }

signature sid-1489 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC /~nobody access"
  http /.*[\/\\]~nobody/
  tcp-state established,originator
  }

signature sid-1492 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC RBS ISP /newuser  directory traversal attempt"
  http /.*[\/\\]newuser\?Image=\.\.[\/\\]\.\./
  tcp-state established,originator
  }

signature sid-1493 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC RBS ISP /newuser access"
  http /.*[\/\\]newuser/
  tcp-state established,originator
  }

signature sid-1663 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC *%0a.pl access"
  http /.*[\/\\]\*%0a\.pl/
  tcp-state established,originator
  }

signature sid-1664 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC mkplog.exe access"
  http /.*[\/\\]mkplog\.exe/
  tcp-state established,originator
  }

signature sid-1665 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC mkilog.exe access"
  http /.*[\/\\]mkilog\.exe/
  tcp-state established,originator
  }

signature sid-509 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC PCCS mysql database admin tool access"
  tcp-state established,originator
  payload /.{0,5}[pP][cC][cC][sS][mM][yY][sS][qQ][lL][aA][dD][mM]\/[iI][nN][cC][sS]\/[dD][bB][cC][oO][nN][nN][eE][cC][tT]\.[iI][nN][cC]/
  }

signature sid-1769 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC .DS_Store access"
  http /.*[\/\\]\.DS_Store/
  tcp-state established,originator
  }

signature sid-1770 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC .FBCIndex access"
  http /.*[\/\\]\.FBCIndex/
  tcp-state established,originator
  }

signature sid-1500 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC ExAir access"
  http /.*[\/\\]exair[\/\\]search[\/\\]/
  tcp-state established,originator
  }

signature sid-1519 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC apache ?M=D directory list attempt"
  http /.*[\/\\]\?M=D/
  tcp-state established,originator
  }

signature sid-1520 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC server-info access"
  http /.*[\/\\]server-info/
  tcp-state established,originator
  }

signature sid-1521 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC server-status access"
  http /.*[\/\\]server-status/
  tcp-state established,originator
  }

signature sid-1522 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC ans.pl attempt"
  http /.*[\/\\]ans\.pl\?p=\.\.[\/\\]\.\.[\/\\]/
  tcp-state established,originator
  }

signature sid-1523 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC ans.pl access"
  http /.*[\/\\]ans\.pl/
  tcp-state established,originator
  }

signature sid-1524 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC AxisStorpoint CD attempt"
  http /.*[\/\\]cd[\/\\]\.\.[\/\\]config[\/\\]html[\/\\]cnf_gi\.htm/
  tcp-state established,originator
  }

signature sid-1525 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Axis Storpoint CD access"
  http /.*[\/\\]config[\/\\]html[\/\\]cnf_gi\.htm/
  tcp-state established,originator
  }

signature sid-1526 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC basilix sendmail.inc access"
  http /.*[\/\\]inc[\/\\]sendmail\.inc/
  tcp-state established,originator
  }

signature sid-1527 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC basilix mysql.class access"
  http /.*[\/\\]class[\/\\]mysql\.class/
  tcp-state established,originator
  }

signature sid-1528 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC BBoard access"
  http /.*[\/\\]servlet[\/\\]sunexamples\.BBoardServlet/
  tcp-state established,originator
  }

signature sid-1544 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Cisco Catalyst command execution attempt"
  http /.*[\/\\]exec[\/\\]show[\/\\]config[\/\\]cr/
  tcp-state established,originator
  }

signature sid-1546 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Cisco /%% DOS attempt"
  http /.*[\/\\]%%/
  tcp-state established,originator
  }

signature sid-1551 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC /CVS/Entries access"
  http /.*[\/\\]CVS[\/\\]Entries/
  tcp-state established,originator
  }

signature sid-1552 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC cvsweb version access"
  http /.*[\/\\]cvsweb[\/\\]version/
  tcp-state established,originator
  }

signature sid-1559 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC /doc/packages access"
  http /.*[\/\\]doc[\/\\]packages/
  tcp-state established,originator
  }

signature sid-1560 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC /doc/ access"
  http /.*[\/\\]doc[\/\\]/
  tcp-state established,originator
  }

signature sid-1561 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC ?open access"
  http /.*\?open/
  tcp-state established,originator
  }

signature sid-1563 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC login.htm attempt"
  http /.*[\/\\]login\.htm\?password=/
  tcp-state established,originator
  }

signature sid-1564 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC login.htm access"
  http /.*[\/\\]login\.htm/
  tcp-state established,originator
  }

signature sid-1603 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC DELETE attempt"
  tcp-state established,originator
  payload /[dD][eE][lL][eE][tT][eE] /
  }

signature sid-1670 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC /home/ftp access"
  http /.*[\/\\]home[\/\\]ftp/
  tcp-state established,originator
  }

signature sid-1671 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC /home/www access"
  http /.*[\/\\]home[\/\\]www/
  tcp-state established,originator
  }

signature sid-1738 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC global.inc access"
  http /.*[\/\\]global\.inc/
  tcp-state established,originator
  }

signature sid-1744 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC SecureSite authentication bypass attempt"
  tcp-state established,originator
  payload /.*[sS][eE][cC][uU][rR][eE]_[sS][iI][tT][eE], [oO][kK]/
  }

signature sid-1757 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC b2 arbitrary command execution attempt"
  http /.*[\/\\]b2[\/\\]b2-include[\/\\]/
  tcp-state established,originator
  payload /.*b2inc/
  payload /.*http:\/\//
  }

signature sid-1758 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC b2 access"
  http /.*[\/\\]b2[\/\\]b2-include[\/\\]/
  tcp-state established,originator
  payload /.*b2inc/
  payload /.*http:\/\//
  }

signature sid-1766 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC search.dll directory listing attempt"
  http /.*[\/\\]search\.dll/
  tcp-state established,originator
  payload /.*query=%00/
  }

signature sid-1767 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC search.dll access"
  http /.*[\/\\]search\.dll/
  tcp-state established,originator
  }

signature sid-1498 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 8181
  event "WEB-MISC PIX firewall manager directory traversal attempt"
  http /.*[\/\\]\.\.[\/\\]\.\.[\/\\]/
  tcp-state established,originator
  }

signature sid-1604 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 4080
  event "WEB-MISC iChat directory traversal attempt"
  http /.*[\/\\]\.\.[\/\\]\.\.[\/\\]/
  tcp-state established,originator
  }

signature sid-1558 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 8080
  event "WEB-MISC Delegate whois overflow attempt"
  tcp-state established,originator
  payload /.*[wW][hH][oO][iI][sS]:\/\//
  }

signature sid-1518 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 8000
  event "WEB-MISC nstelemetry.adp access"
  http /.*[\/\\]nstelemetry\.adp/
  tcp-state established,originator
  }

signature sid-1132 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 457
  event "WEB-MISC Netscape Unixware overflow"
  tcp-state established,originator
  payload /.*\xeb\x5f\x9a\xff\xff\xff\xff\x07\xff\xc3\x5e\x31\xc0\x89\x46\x9d/
  }

signature sid-1199 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 2301
  event "WEB-MISC Compaq Insight directory traversal"
  http /.*\.\.[\/\\]/
  tcp-state established,originator
  }

signature sid-1231 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC VirusWall catinfo access"
  http /.*[\/\\]catinfo/
  tcp-state established,originator
  }

signature sid-1232 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 1812
  event "WEB-MISC VirusWall catinfo access"
  http /.*[\/\\]catinfo/
  tcp-state established,originator
  }

signature sid-1809 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Apache Chunked-Encoding worm attempt"
  tcp-state established,originator
  payload /.*[cC][cC][cC][cC][cC][cC][cC]: [aA][aA][aA][aA][aA][aA][aA][aA][aA][aA][aA][aA][aA][aA][aA][aA][aA][aA][aA]/
  }

signature sid-1807 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Transfer-Encoding: chunked"
  tcp-state established,originator
  payload /.*[tT][rR][aA][nN][sS][fF][eE][rR]-[eE][nN][cC][oO][dD][iI][nN][gG]:/
  payload /.*[cC][hH][uU][nN][kK][eE][dD]/
  }

signature sid-1814 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC CISCO VoIP DOS ATTEMPT"
  http /.*[\/\\]StreamingStatistics/
  tcp-state established,originator
  }

signature sid-1820 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC IBM Net.Commerce orderdspc.d2w access"
  http /.*[\/\\]ncommerce3[\/\\]ExecMacro[\/\\]orderdspc\.d2w/
  tcp-state established,originator
  }

signature sid-1826 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC WEB-INF access"
  http /.*[\/\\]WEB-INF/
  tcp-state established,originator
  }

signature sid-1827 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Tomcat servlet mapping cross site scripting attempt"
  http /.*[\/\\]servlet[\/\\]/
  http /.*[\/\\]org\.apache\./
  tcp-state established,originator
  }

signature sid-1828 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC iPlanet Search directory traversal attempt"
  http /.*[\/\\]search/
  tcp-state established,originator
  payload /.*NS-query-pat=/
  payload /.*\.\.\/\.\.\//
  }

signature sid-1829 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Tomcat TroubleShooter servlet access"
  http /.*[\/\\]examples[\/\\]servlet[\/\\]TroubleShooter/
  tcp-state established,originator
  }

signature sid-1830 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Tomcat SnoopServlet servlet access"
  http /.*[\/\\]examples[\/\\]servlet[\/\\]SnoopServlet/
  tcp-state established,originator
  }

signature sid-1831 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC jigsaw dos attempt"
  http /.*[\/\\]servlet[\/\\]con/
  tcp-state established,originator
  }

signature sid-1835 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Macromedia SiteSpring cross site scripting attempt"
  http /.*[\/\\]error[\/\\]500error\.jsp/
  http /.*et=/
  http /.*<script/
  tcp-state established,originator
  }

signature sid-1839 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC mailman cross site scripting attempt"
  http /.*[\/\\]mailman[\/\\]/
  http /.*\?/
  http /.*info=/
  http /.*<script/
  tcp-state established,originator
  }

signature sid-1847 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC webalizer access"
  http /.*[\/\\]webalizer[\/\\]/
  tcp-state established,originator
  }

signature sid-1848 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC webcart-lite access"
  http /.*[\/\\]webcart-lite[\/\\]/
  tcp-state established,originator
  }

signature sid-1849 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC webfind.exe access"
  http /.*[\/\\]webfind\.exe/
  tcp-state established,originator
  }

signature sid-1851 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC active.log access"
  http /.*[\/\\]active\.log/
  tcp-state established,originator
  }

signature sid-1852 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC robots.txt access"
  http /.*[\/\\]robots\.txt/
  tcp-state established,originator
  }

signature sid-1857 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC robot.txt access"
  http /.*[\/\\]robot\.txt/
  tcp-state established,originator
  }

signature sid-1858 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 8181
  event "WEB-MISC CISCO PIX Firewall Manager directory traversal attempt"
  http /.*[\/\\]pixfir~1[\/\\]how_to_login\.html/
  tcp-state established,originator
  }

signature sid-1859 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 9090
  event "WEB-MISC Sun JavaServer default password login attempt"
  http /.*[\/\\]servlet[\/\\]admin/
  tcp-state established,originator
  payload /.*ae9f86d6beaa3f9ecb9a5b7e072a4138/
  }

signature sid-1860 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 8080
  event "WEB-MISC Linksys router default password login attempt (:admin)"
  tcp-state established,originator
  payload /.*Authorization: Basic OmFkbWlu/
  }

signature sid-1861 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 8080
  event "WEB-MISC Linksys router default password login attempt (admin:admin)"
  tcp-state established,originator
  payload /.*[aA][uU][tT][hH][oO][rR][iI][zZ][aA][tT][iI][oO][nN]: /
  payload /.* [bB][aA][sS][iI][cC] /
  payload /.*YWRtaW46YWRtaW4/
  }

signature sid-1871 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Oracle XSQLConfig.xml access"
  http /.*[\/\\]XSQLConfig\.xml/
  tcp-state established,originator
  }

signature sid-1872 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Oracle Dynamic Monitoring Services (dms) access"
  http /.*[\/\\]dms0/
  tcp-state established,originator
  }

signature sid-1873 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC globals.jsa access"
  http /.*[\/\\]globals\.jsa/
  tcp-state established,originator
  }

signature sid-1874 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC Oracle Java Process Manager access"
  http /.*[\/\\]oprocmgr-status/
  tcp-state established,originator
  }

signature sid-1881 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC bad HTTP/1.1 request, Potentially worm attack"
  tcp-state established,originator
  payload /GET \/ HTTP\/1\.1\x0d\x0a\x0d\x0a/
  }

signature sid-1104 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  payload-size == 1
  event "WEB-MISC whisker space splice attack"
  tcp-state established,originator
  payload /\x20/
  }

signature sid-1087 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  payload-size < 5
  event "WEB-MISC whisker tab splice attack"
  tcp-state established,originator
  payload /.*\x09/
  }

signature sid-1808 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC apache chunked encoding memory corruption exploit attempt"
  tcp-state established,originator
  payload /.*\xC0\x50\x52\x89\xE1\x50\x51\x52\x50\xB8\x3B\x00\x00\x00\xCD\x80/
  }

signature sid-1943 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC /Carello/add.exe access"
  http /.*[\/\\]Carello[\/\\]add\.exe/
  tcp-state established,originator
  }

signature sid-1944 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC /ecscripts/ecware.exe access"
  http /.*[\/\\]ecscripts[\/\\]ecware\.exe/
  tcp-state established,originator
  }

signature sid-1969 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-MISC ion-p access"
  http /.*[\/\\]ion-p/
  tcp-state established,originator
  }

signature sid-1499 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 8888
  event "WEB-MISC SiteScope Service access"
  http /.*[\/\\]SiteScope[\/\\]cgi[\/\\]go\.exe[\/\\]SiteScope/
  tcp-state established,originator
  }

signature sid-1946 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 8888
  event "WEB-MISC answerbook2 admin attempt"
  http /.*[\/\\]cgi-bin[\/\\]admin[\/\\]admin/
  tcp-state established,originator
  }

signature sid-1947 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 8888
  event "WEB-MISC answerbook2 arbitrary command execution attempt"
  http /.*[\/\\]ab2[\/\\]/
  tcp-state established,originator
  payload /.{1}.*;/
  }

signature sid-1979 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC perl post attempt"
  http /.*[\/\\]perl[\/\\]/
  tcp-state established,originator
  payload /POST/
  }

signature sid-2056 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC TRACE attempt"
  tcp-state established,originator
  payload /TRACE/
  }

signature sid-2057 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC helpout.exe access"
  http /.*[\/\\]helpout\.exe/
  tcp-state established,originator
  }

signature sid-2058 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC MsmMask.exe attempt"
  http /.*[\/\\]MsmMask\.exe/
  tcp-state established,originator
  payload /.*mask=/
  }

signature sid-2059 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC MsmMask.exe access"
  http /.*[\/\\]MsmMask\.exe/
  tcp-state established,originator
  }

signature sid-2060 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC DB4Web access"
  http /.*[\/\\]DB4Web[\/\\]/
  tcp-state established,originator
  }

signature sid-2061 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC Tomcat null byte directory listing attempt"
  http /.*\x00\.jsp/
  tcp-state established,originator
  }

signature sid-2062 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC iPlanet .perf access"
  http /.*[\/\\]\.perf/
  tcp-state established,originator
  }

signature sid-2063 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC Demarc SQL injection attempt"
  http /.*[\/\\]dm[\/\\]demarc/
  tcp-state established,originator
  payload /.*s_key=.*.{0}.*'.{1}.*'.*.{0}.*'/
  }

signature sid-2064 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC Lotus Notes .csp script source download attempt"
  http /.*\.csp/
  tcp-state established,originator
  payload /.*\.csp\./
  }

signature sid-2066 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC Lotus Notes .pl script source download attempt"
  http /.*\.pl/
  tcp-state established,originator
  payload /.*\.pl\./
  }

signature sid-2067 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC Lotus Notes .exe script source download attempt"
  http /.*\.exe/
  tcp-state established,originator
  payload /.*\.exe\./
  }

signature sid-2068 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC BitKeeper arbitrary command attempt"
  http /.*[\/\\]diffs[\/\\]/
  tcp-state established,originator
  payload /.*'.*.{0}.*\x3b.{1}.*'/
  }

signature sid-2069 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC chip.ini access"
  http /.*[\/\\]chip\.ini/
  tcp-state established,originator
  }

signature sid-2070 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC post32.exe arbitrary command attempt"
  http /.*[\/\\]post32\.exe\|/
  tcp-state established,originator
  }

signature sid-2071 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC post32.exe access"
  http /.*[\/\\]post32\.exe/
  tcp-state established,originator
  }

signature sid-2072 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC lyris.pl access"
  http /.*[\/\\]lyris\.pl/
  tcp-state established,originator
  }

signature sid-2073 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC globals.pl access"
  http /.*[\/\\]globals\.pl/
  tcp-state established,originator
  }

signature sid-2135 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC philboard.mdb access"
  http /.*[\/\\]philboard\.mdb/
  tcp-state established,originator
  }

signature sid-2136 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC philboard_admin.asp authentication bypass attempt"
  http /.*[\/\\]philboard_admin\.asp/
  tcp-state established,originator
  payload /.*[cC][oO][oO][kK][iI][eE].*.{0}.*philboard_admin=True/
  }

signature sid-2137 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC philboard_admin.asp access"
  http /.*[\/\\]philboard_admin\.asp/
  tcp-state established,originator
  }

signature sid-2138 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC logicworks.ini access"
  http /.*[\/\\]logicworks\.ini/
  tcp-state established,originator
  }

signature sid-2139 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC /*.shtml access"
  http /.*[\/\\]\*\.shtml/
  tcp-state established,originator
  }

signature sid-2156 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == http_ports
  event "WEB-MISC mod_gzip_status access"
  http /.*[\/\\]mod_gzip_status/
  tcp-state established,originator
  }

signature sid-1233 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  dst-port == http_ports
  event "WEB-CLIENT Outlook EML access"
  http /.*\.eml/
  tcp-state established,originator
  }

signature sid-1735 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  src-port == http_ports
  event "WEB-CLIENT XMLHttpRequest attempt"
  tcp-state established,responder
  payload /.*new XMLHttpRequest\(/
  payload /.*[fF][iI][lL][eE]:\/\//
  }

signature sid-1284 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  dst-port == http_ports
  event "WEB-CLIENT readme.eml download attempt"
  http /.*[\/\\]readme\.eml/
  tcp-state established,originator
  }

signature sid-1290 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  src-port == http_ports
  event "WEB-CLIENT readme.eml autoload attempt"
  tcp-state established,responder
  payload /.*[wW][iI][nN][dD][oO][wW]\.[oO][pP][eE][nN]\(\"[rR][eE][aA][dD][mM][eE]\.[eE][mM][lL]\"/
  }

signature sid-1840 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  src-port == http_ports
  event "WEB-CLIENT Javascript document.domain attempt"
  tcp-state established,responder
  payload /.*[dD][oO][cC][uU][mM][eE][nN][tT]\.[dD][oO][mM][aA][iI][nN]\(/
  }

signature sid-1841 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  src-port == http_ports
  event "WEB-CLIENT Javascript URL host spoofing attempt"
  tcp-state established,responder
  payload /.*[jJ][aA][vV][aA][sS][cC][rR][iI][pP][tT]:\/\//
  }

signature sid-1774 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP bb_smilies.php access"
  http /.*[\/\\]bb_smilies\.php/
  tcp-state established,originator
  }

signature sid-1423 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP content-disposition memchr overflow"
  tcp-state established,originator
  payload /.*Content-Disposition:/
  payload /.*name=\"\xCC\xCC\xCC\xCC\xCC/
  }

signature sid-1736 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP squirrel mail spell-check arbitrary command attempt"
  http /.*[\/\\]squirrelspell[\/\\]modules[\/\\]check_me\.mod\.php/
  tcp-state established,originator
  payload /.*[sS][qQ][sS][pP][eE][lL][lL]_[aA][pP][pP]\[/
  }

signature sid-1737 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP squirrel mail theme arbitrary command attempt"
  http /.*[\/\\]left_main\.php/
  tcp-state established,originator
  payload /.*[cC][mM][dD][dD]=/
  }

signature sid-1739 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP DNSTools administrator authentication bypass attempt"
  http /.*[\/\\]dnstools\.php/
  tcp-state established,originator
  payload /.*[uU][sS][eE][rR]_[lL][oO][gG][gG][eE][dD]_[iI][nN]=[tT][rR][uU][eE]/
  payload /.*[uU][sS][eE][rR]_[dD][nN][sS][tT][oO][oO][lL][sS]_[aA][dD][mM][iI][nN][iI][sS][tT][rR][aA][tT][oO][rR]=[tT][rR][uU][eE]/
  }

signature sid-1740 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP DNSTools authentication bypass attempt"
  http /.*[\/\\]dnstools\.php/
  tcp-state established,originator
  payload /.*[uU][sS][eE][rR]_[lL][oO][gG][gG][eE][dD]_[iI][nN]=[tT][rR][uU][eE]/
  }

signature sid-1741 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP DNSTools access"
  http /.*[\/\\]dnstools\.php/
  tcp-state established,originator
  }

signature sid-1742 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP Blahz-DNS dostuff.php modify user attempt"
  http /.*[\/\\]dostuff\.php\?action=modify_user/
  tcp-state established,originator
  }

signature sid-1743 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP Blahz-DNS dostuff.php access"
  http /.*[\/\\]dostuff\.php/
  tcp-state established,originator
  }

signature sid-1745 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP Messagerie supp_membre.php access"
  http /.*[\/\\]supp_membre\.php/
  tcp-state established,originator
  }

signature sid-1773 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP php.exe access"
  http /.*[\/\\]php\.exe/
  tcp-state established,originator
  }

signature sid-1815 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP directory.php arbitrary command attempt"
  http /.*[\/\\]directory\.php/
  tcp-state established,originator
  payload /.*dir=/
  payload /.*;/
  }

signature sid-1816 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP directory.php access"
  http /.*[\/\\]directory\.php/
  tcp-state established,originator
  }

signature sid-1834 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP PHP-Wiki cross site scripting attempt"
  http /.*[\/\\]modules\.php\?/
  http /.*name=Wiki/
  http /.*<script/
  tcp-state established,originator
  }

signature sid-1967 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP phpbb quick-reply.php arbitrary command attempt"
  http /.*[\/\\]quick-reply\.php/
  tcp-state established,originator
  payload /.{1}.*phpbb_root_path=/
  }

signature sid-1968 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP phpbb quick-reply.php access"
  http /.*[\/\\]quick-reply\.php/
  tcp-state established,originator
  }

signature sid-1997 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP read_body.php access attempt"
  http /.*[\/\\]read_body\.php/
  tcp-state established,originator
  }

signature sid-1998 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP calendar.php access"
  http /.*[\/\\]calendar\.php/
  tcp-state established,originator
  }

signature sid-1999 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP edit_image.php access"
  http /.*[\/\\]edit_image\.php/
  tcp-state established,originator
  }

signature sid-2000 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP readmsg.php access"
  http /.*[\/\\]readmsg\.php/
  tcp-state established,originator
  }

signature sid-2002 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP external include path"
  http /.*\.php/
  tcp-state established,originator
  payload /.*path=http:\/\//
  }

signature sid-1134 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP Phorum admin access"
  http /.*[\/\\]admin\.php3/
  tcp-state established,originator
  }

signature sid-1161 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP piranha passwd.php3 access"
  http /.*[\/\\]passwd\.php3/
  tcp-state established,originator
  }

signature sid-1178 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP Phorum read access"
  http /.*[\/\\]read\.php3/
  tcp-state established,originator
  }

signature sid-1179 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP Phorum violation access"
  http /.*[\/\\]violation\.php3/
  tcp-state established,originator
  }

signature sid-1197 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP Phorum code access"
  http /.*[\/\\]code\.php3/
  tcp-state established,originator
  }

signature sid-1300 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP admin.php file upload attempt"
  http /.*[\/\\]admin\.php/
  tcp-state established,originator
  payload /.*[fF][iI][lL][eE]_[nN][aA][mM][eE]=/
  }

signature sid-1301 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP admin.php access"
  http /.*[\/\\]admin\.php/
  tcp-state established,originator
  }

signature sid-1407 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP smssend.php access"
  http /.*[\/\\]smssend\.php/
  tcp-state established,originator
  }

signature sid-1399 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP PHP-Nuke remote file include attempt"
  http /.*index\.php/
  tcp-state established,originator
  payload /.*[fF][iI][lL][eE]=[hH][tT][tT][pP]:\/\//
  }

signature sid-1490 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP Phorum /support/common.php attempt"
  http /.*[\/\\]support[\/\\]common\.php/
  tcp-state established,originator
  payload /.*ForumLang=\.\.\//
  }

signature sid-1491 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP Phorum /support/common.php access"
  http /.*[\/\\]support[\/\\]common\.php/
  tcp-state established,originator
  }

signature sid-1137 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP Phorum authentication access"
  tcp-state established,originator
  payload /.*[pP][hH][pP]_[aA][uU][tT][hH]_[uU][sS][eE][rR]=[bB][oO][oO][gG][iI][eE][mM][aA][nN]/
  }

signature sid-1085 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP strings overflow"
  tcp-state established,originator
  payload /.*\xba\x49\xfe\xff\xff\xf7\xd2\xb9\xbf\xff\xff\xff\xf7\xd1/
  }

signature sid-1086 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP strings overflow"
  http /.*\?STRENGUR/
  tcp-state established,originator
  }

signature sid-1254 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP PHPLIB remote command attempt"
  tcp-state established,originator
  payload /.*_PHPLIB\[libdir\]/
  }

signature sid-1255 {
  ip-proto == tcp
  src-ip == http_servers
  dst-ip != local_nets
  dst-port == http_ports
  event "WEB-PHP PHPLIB remote command attempt"
  http /.*[\/\\]db_mysql\.inc/
  tcp-state established,originator
  }

signature sid-2074 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP Mambo uploadimage.php upload php file attempt"
  http /.*[\/\\]uploadimage\.php/
  tcp-state established,originator
  payload /.*userfile_name=.{1}.*\.php/
  }

signature sid-2075 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP Mambo upload.php upload php file attempt"
  http /.*[\/\\]upload\.php/
  tcp-state established,originator
  payload /.*userfile_name=.{1}.*\.php/
  }

signature sid-2076 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP Mambo uploadimage.php access"
  http /.*[\/\\]uploadimage\.php/
  tcp-state established,originator
  }

signature sid-2077 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP Mambo upload.php access"
  http /.*[\/\\]upload\.php/
  tcp-state established,originator
  }

signature sid-2078 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP phpBB privmsg.php access"
  http /.*[\/\\]privmsg\.php/
  tcp-state established,originator
  }

signature sid-2140 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP p-news.php access"
  http /.*[\/\\]p-news\.php/
  tcp-state established,originator
  }

signature sid-2141 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP shoutbox.php directory traversal attempt"
  http /.*[\/\\]shoutbox\.php/
  tcp-state established,originator
  payload /.*conf=.*.{0}.*\.\.\//
  }

signature sid-2142 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP shoutbox.php access"
  http /.*[\/\\]shoutbox\.php/
  tcp-state established,originator
  }

signature sid-2143 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP b2 cafelog gm-2-b2.php remote command execution attempt"
  http /.*[\/\\]gm-2-b2\.php/
  tcp-state established,originator
  payload /.*b2inc=http/
  }

signature sid-2144 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP b2 cafelog gm-2-b2.php access"
  http /.*[\/\\]gm-2-b2\.php/
  tcp-state established,originator
  }

signature sid-2145 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP TextPortal admin.php default password (admin) attempt"
  http /.*[\/\\]admin\.php/
  tcp-state established,originator
  payload /.*op=admin_enter/
  payload /.*password=admin/
  }

signature sid-2146 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP TextPortal admin.php default password (12345) attempt"
  http /.*[\/\\]admin\.php/
  tcp-state established,originator
  payload /.*op=admin_enter/
  payload /.*password=12345/
  }

signature sid-2147 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP BLNews objects.inc.php4 remote command execution attempt"
  http /.*[\/\\]objects\.inc\.php4/
  tcp-state established,originator
  payload /.*Server\[path\]=http/
  }

signature sid-2148 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP BLNews objects.inc.php4 access"
  http /.*[\/\\]objects\.inc\.php4/
  tcp-state established,originator
  }

signature sid-2149 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP Turba status.php access"
  http /.*[\/\\]turba[\/\\]status\.php/
  tcp-state established,originator
  }

signature sid-2150 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP ttCMS header.php remote command execution attempt"
  http /.*[\/\\]admin[\/\\]templates[\/\\]header\.php/
  tcp-state established,originator
  payload /.*admin_root=http/
  }

signature sid-2151 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP ttCMS header.php access"
  http /.*[\/\\]admin[\/\\]templates[\/\\]header\.php/
  tcp-state established,originator
  }

signature sid-2152 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP test.php access"
  http /.*[\/\\]test\.php/
  tcp-state established,originator
  }

signature sid-2153 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP autohtml.php directory traversal attempt"
  http /.*[\/\\]autohtml\.php/
  tcp-state established,originator
  payload /.*name=.*.{0}.*\.\.\/\.\.\//
  }

signature sid-2154 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP autohtml.php access"
  http /.*[\/\\]autohtml\.php/
  tcp-state established,originator
  }

signature sid-2155 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == http_ports
  event "WEB-PHP ttforum remote command execution attempt"
  http /.*forum[\/\\]index\.php/
  tcp-state established,originator
  payload /.*template=http/
  }

signature sid-676 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB sp_start_job - program execution"
  tcp-state established,originator
  payload /.{31}[sS]\x00[pP]\x00_\x00[sS]\x00[tT]\x00[aA]\x00[rR]\x00[tT]\x00_\x00[jJ]\x00[oO]\x00[bB]\x00/
  }

signature sid-677 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB sp_password password change"
  tcp-state established,originator
  payload /.*[sS]\x00[pP]\x00_\x00[pP]\x00[aA]\x00[sS]\x00[sS]\x00[wW]\x00[oO]\x00[rR]\x00[dD]\x00/
  }

signature sid-678 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB sp_delete_alert log file deletion"
  tcp-state established,originator
  payload /.*[sS]\x00[pP]\x00_\x00[dD]\x00[eE]\x00[lL]\x00[eE]\x00[tT]\x00[eE]\x00_\x00[aA]\x00[lL]\x00[eE]\x00/
  }

signature sid-679 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB sp_adduser database user creation"
  tcp-state established,originator
  payload /.{31}[sS]\x00[pP]\x00_\x00[aA]\x00[dD]\x00[dD]\x00[uU]\x00[sS]\x00[eE]\x00[rR]\x00/
  }

signature sid-708 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB xp_enumresultset possible buffer overflow"
  tcp-state established,originator
  payload /.{31}.*[xX]\x00[pP]\x00_\x00[eE]\x00[nN]\x00[uU]\x00[mM]\x00[rR]\x00[eE]\x00[sS]\x00[uU]\x00[lL]\x00[tT]\x00[sS]\x00[eE]\x00[tT]\x00/
  }

signature sid-1386 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB raiserror possible buffer overflow"
  tcp-state established,originator
  payload /.{31}.*[rR]\x00[aA]\x00[iI]\x00[sS]\x00[eE]\x00[rR]\x00[rR]\x00[oO]\x00[rR]\x00/
  }

signature sid-702 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB xp_displayparamstmt possible buffer overflow"
  tcp-state established,originator
  payload /.{31}.*[xX]\x00[pP]\x00_\x00[dD]\x00[iI]\x00[sS]\x00[pP]\x00[lL]\x00[aA]\x00[yY]\x00[pP]\x00[aA]\x00[rR]\x00[aA]\x00[mM]\x00[sS]\x00[tT]\x00[mM]\x00[tT]\x00/
  }

signature sid-703 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB xp_setsqlsecurity possible buffer overflow"
  tcp-state established,originator
  payload /.{31}.*[xX]\x00[pP]\x00_\x00[sS]\x00[eE]\x00[tT]\x00[sS]\x00[qQ]\x00[lL]\x00[sS]\x00[eE]\x00[cC]\x00[uU]\x00[rR]\x00[iI]\x00[tT]\x00[yY]\x00/
  }

signature sid-681 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB xp_cmdshell program execution"
  tcp-state established,originator
  payload /.{31}.*[xX]\x00[pP]\x00_\x00[cC]\x00[mM]\x00[dD]\x00[sS]\x00[hH]\x00[eE]\x00[lL]\x00[lL]\x00/
  }

signature sid-689 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB xp_reg* registry access"
  tcp-state established,originator
  payload /.{31}[xX]\x00[pP]\x00_\x00[rR]\x00[eE]\x00[gG]\x00/
  }

signature sid-690 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB xp_printstatements possible buffer overflow"
  tcp-state established,originator
  payload /.{31}.*[xX]\x00[pP]\x00_\x00[pP]\x00[rR]\x00[iI]\x00[nN]\x00[tT]\x00[sS]\x00[tT]\x00[aA]\x00[tT]\x00[eE]\x00[mM]\x00[eE]\x00[nN]\x00[tT]\x00[sS]\x00/
  }

signature sid-692 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB shellcode attempt"
  tcp-state established,originator
  payload /.*\x39\x20\xd0\x00\x92\x01\xc2\x00\x52\x00\x55\x00\x39\x20\xec\x00/
  }

signature sid-694 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB shellcode attempt"
  tcp-state established,originator
  payload /.*\x48\x00\x25\x00\x78\x00\x77\x00\x90\x00\x90\x00\x90\x00\x90\x00\x90\x00\x33\x00\xc0\x00\x50\x00\x68\x00\x2e\x00/
  }

signature sid-695 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB xp_sprintf possible buffer overflow"
  tcp-state established,originator
  payload /.{31}.*[xX]\x00[pP]\x00_\x00[sS]\x00[pP]\x00[rR]\x00[iI]\x00[nN]\x00[tT]\x00[fF]\x00/
  }

signature sid-696 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB xp_showcolv possible buffer overflow"
  tcp-state established,originator
  payload /.{31}.*[xX]\x00[pP]\x00_\x00[sS]\x00[hH]\x00[oO]\x00[wW]\x00[cC]\x00[oO]\x00[lL]\x00[vV]\x00/
  }

signature sid-697 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB xp_peekqueue possible buffer overflow"
  tcp-state established,originator
  payload /.{31}.*[xX]\x00[pP]\x00_\x00[pP]\x00[eE]\x00[eE]\x00[kK]\x00[qQ]\x00[uU]\x00[eE]\x00[uU]\x00[eE]\x00/
  }

signature sid-698 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB xp_proxiedmetadata possible buffer overflow"
  tcp-state established,originator
  payload /.{31}.*[xX]\x00[pP]\x00_\x00[pP]\x00[rR]\x00[oO]\x00[xX]\x00[iI]\x00[eE]\x00[dD]\x00[mM]\x00[eE]\x00[tT]\x00[aA]\x00[dD]\x00[aA]\x00[tT]\x00[aA]\x00/
  }

signature sid-700 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 139
  event "MS-SQL/SMB xp_updatecolvbm possible buffer overflow"
  tcp-state established,originator
  payload /.{31}.*[xX]\x00[pP]\x00_\x00[uU]\x00[pP]\x00[dD]\x00[aA]\x00[tT]\x00[eE]\x00[cC]\x00[oO]\x00[lL]\x00[vV]\x00[bB]\x00[mM]\x00/
  }

signature sid-673 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL sp_start_job - program execution"
  tcp-state established,originator
  payload /.*[sS]\x00[pP]\x00_\x00[sS]\x00[tT]\x00[aA]\x00[rR]\x00[tT]\x00_\x00[jJ]\x00[oO]\x00[bB]\x00/
  }

signature sid-674 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL xp_displayparamstmt possible buffer overflow"
  tcp-state established,originator
  payload /.*[xX]\x00[pP]\x00_\x00[dD]\x00[iI]\x00[sS]\x00[pP]\x00[lL]\x00[aA]\x00[yY]\x00[pP]\x00[aA]\x00[rR]\x00[aA]\x00[mM]\x00[sS]\x00[tT]\x00[mM]\x00[tT]/
  }

signature sid-675 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL xp_setsqlsecurity possible buffer overflow"
  tcp-state established,originator
  payload /.*[xX]\x00[pP]\x00_\x00[sS]\x00[eE]\x00[tT]\x00[sS]\x00[qQ]\x00[lL]\x00[sS]\x00[eE]\x00[cC]\x00[uU]\x00[rR]\x00[iI]\x00[tT]\x00[yY]\x00/
  }

signature sid-682 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL xp_enumresultset possible buffer overflow"
  tcp-state established,originator
  payload /.*[xX]\x00[pP]\x00_\x00[eE]\x00[nN]\x00[uU]\x00[mM]\x00[rR]\x00[eE]\x00[sS]\x00[uU]\x00[lL]\x00[tT]\x00[sS]\x00[eE]\x00[tT]\x00/
  }

signature sid-683 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL sp_password - password change"
  tcp-state established,originator
  payload /.*[sS]\x00[pP]\x00_\x00[pP]\x00[aA]\x00[sS]\x00[sS]\x00[wW]\x00[oO]\x00[rR]\x00[dD]\x00/
  }

signature sid-684 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL sp_delete_alert log file deletion"
  tcp-state established,originator
  payload /.*[sS]\x00[pP]\x00_\x00[dD]\x00[eE]\x00[lL]\x00[eE]\x00[tT]\x00[eE]\x00_\x00[aA]\x00[lL]\x00[eE]\x00[rR]\x00[tT]\x00/
  }

signature sid-685 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL sp_adduser - database user creation"
  tcp-state established,originator
  payload /.*[sS]\x00[pP]\x00_\x00[aA]\x00[dD]\x00[dD]\x00[uU]\x00[sS]\x00[eE]\x00[rR]\x00/
  }

signature sid-686 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL xp_reg* - registry access"
  tcp-state established,originator
  payload /.*[xX]\x00[pP]\x00_\x00[rR]\x00[eE]\x00[gG]\x00/
  }

signature sid-687 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL xp_cmdshell - program execution"
  tcp-state established,originator
  payload /.*[xX]\x00[pP]\x00_\x00[cC]\x00[mM]\x00[dD]\x00[sS]\x00[hH]\x00[eE]\x00[lL]\x00[lL]\x00/
  }

signature sid-691 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL shellcode attempt"
  tcp-state established,originator
  payload /.*\x39\x20\xd0\x00\x92\x01\xc2\x00\x52\x00\x55\x00\x39\x20\xec\x00/
  }

signature sid-693 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL shellcode attempt"
  tcp-state established,originator
  payload /.*\x48\x00\x25\x00\x78\x00\x77\x00\x90\x00\x90\x00\x90\x00\x90\x00\x90\x00\x33\x00\xc0\x00\x50\x00\x68\x00\x2e\x00/
  }

signature sid-699 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL xp_printstatements possible buffer overflow"
  tcp-state established,originator
  payload /.*[xX]\x00[pP]\x00_\x00[pP]\x00[rR]\x00[iI]\x00[nN]\x00[tT]\x00[sS]\x00[tT]\x00[aA]\x00[tT]\x00[eE]\x00[mM]\x00[eE]\x00[nN]\x00[tT]\x00[sS]\x00/
  }

signature sid-701 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL xp_updatecolvbm possible buffer overflow"
  tcp-state established,originator
  payload /.*[xX]\x00[pP]\x00_\x00[uU]\x00[pP]\x00[dD]\x00[aA]\x00[tT]\x00[eE]\x00[cC]\x00[oO]\x00[lL]\x00[vV]\x00[bB]\x00[mM]\x00/
  }

signature sid-704 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL xp_sprintf possible buffer overflow"
  tcp-state established,originator
  payload /.*[xX]\x00[pP]\x00_\x00[sS]\x00[pP]\x00[rR]\x00[iI]\x00[nN]\x00[tT]\x00[fF]\x00/
  }

signature sid-705 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL xp_showcolv possible buffer overflow"
  tcp-state established,originator
  payload /.*[xX]\x00[pP]\x00_\x00[sS]\x00[hH]\x00[oO]\x00[wW]\x00[cC]\x00[oO]\x00[lL]\x00[vV]\x00/
  }

signature sid-706 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL xp_peekqueue possible buffer overflow"
  tcp-state established,originator
  payload /.*[xX]\x00[pP]\x00_\x00[pP]\x00[eE]\x00[eE]\x00[kK]\x00[qQ]\x00[uU]\x00[eE]\x00[uU]\x00[eE]\x00/
  }

signature sid-707 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL xp_proxiedmetadata possible buffer overflow"
  tcp-state established,originator
  payload /.*[xX]\x00[pP]\x00_\x00[pP]\x00[rR]\x00[oO]\x00[xX]\x00[iI]\x00[eE]\x00[dD]\x00[mM]\x00[eE]\x00[tT]\x00[aA]\x00[dD]\x00[aA]\x00[tT]\x00[aA]\x00/
  }

signature sid-1387 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 1433
  event "MS-SQL raiserror possible buffer overflow"
  tcp-state established,originator
  payload /.*[rR]\x00[aA]\x00[iI]\x00[sS]\x00[eE]\x00[rR]\x00[rR]\x00[oO]\x00[rR]\x00/
  }

signature sid-1759 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 445
  event "MS-SQL xp_cmdshell program execution (445)"
  tcp-state established,originator
  payload /.*[xX]\x00[pP]\x00_\x00[cC]\x00[mM]\x00[dD]\x00[sS]\x00[hH]\x00[eE]\x00[lL]\x00[lL]\x00/
  }

signature sid-688 {
  ip-proto == tcp
  src-ip == sql_servers
  dst-ip != local_nets
  src-port == 1433
  event "MS-SQL sa login failed"
  tcp-state established,responder
  payload /.*Login failed for user \x27sa\x27/
  }

signature sid-680 {
  ip-proto == tcp
  src-ip == sql_servers
  dst-ip != local_nets
  src-port == 139
  event "MS-SQL/SMB sa login failed"
  tcp-state established,responder
  payload /.{82}.*Login failed for user \x27sa\x27/
  }

signature sid-2003 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 1434
  event "MS-SQL Worm propagation attempt"
  payload /\x04/
  payload /.*\x81\xF1\x03\x01\x04\x9B\x81\xF1\x01/
  payload /.*sock/
  payload /.*send/
  }

signature sid-2004 {
  ip-proto == udp
  src-ip == local_nets
  dst-ip != local_nets
  dst-port == 1434
  event "MS-SQL Worm propagation attempt OUTBOUND"
  payload /\x04/
  payload /.*\x81\xF1\x03\x01\x04\x9B\x81\xF1/
  payload /.*sock/
  payload /.*send/
  }

signature sid-2049 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 1434
  event "MS-SQL ping attempt"
  payload /\x02/
  }

signature sid-2050 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 1434
  payload-size > 100
  event "MS-SQL version overflow attempt"
  payload /\x04/
  }

signature sid-1225 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 6000
  event "X11 MIT Magic Cookie detected"
  tcp-state established
  payload /.*MIT-MAGIC-COOKIE-1/
  }

signature sid-1226 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 6000
  event "X11 xopen"
  tcp-state established
  payload /.*\x6c\x00\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00/
  }

signature sid-465 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 8
  event "ICMP ISS Pinger"
  payload /.{0,24}\x49\x53\x53\x50\x4e\x47\x52\x51/
  }

signature sid-466 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[1:1] == 0
  header icmp[0:1] == 8
  event "ICMP L3retriever Ping"
  payload /ABCDEFGHIJKLMNOPQRSTUVWABCDEFGHI/
  }

signature sid-467 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  payload-size == 20
  header icmp[0:1] == 8
  header icmp[0:1] == 0,8
  header icmp[6:2] == 0
  event "ICMP Nemesis v1.1 Echo"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 0
  payload /\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00/
  }

signature sid-469 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  payload-size == 0
  header icmp[0:1] == 8
  event "ICMP PING NMAP"
  }

signature sid-471 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  payload-size == 0
  header icmp[0:1] == 8
  header icmp[0:1] == 0,8
  header icmp[6:2] == 0
  event "ICMP icmpenum v1.1.1"
  header ip[4:2] == 666
  header icmp[0:1] == 0,8
  header icmp[4:2] == 666
  }

signature sid-472 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[1:1] == 1
  header icmp[0:1] == 5
  event "ICMP redirect host"
  }

signature sid-473 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[1:1] == 0
  header icmp[0:1] == 5
  event "ICMP redirect net"
  }

signature sid-474 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  payload-size == 8
  header icmp[0:1] == 8
  event "ICMP superscan echo"
  payload /\x00\x00\x00\x00\x00\x00\x00\x00/
  }

signature sid-475 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 0
  event "ICMP traceroute ipopts"
  ip-options rr
  }

signature sid-476 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[1:1] == 0
  header icmp[0:1] == 8
  event "ICMP webtrends scanner"
  payload /.*\x00\x00\x00\x00\x45\x45\x45\x45\x45\x45\x45\x45\x45\x45\x45\x45/
  }

signature sid-477 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[1:1] == 0
  header icmp[0:1] == 4
  event "ICMP Source Quench"
  }

signature sid-478 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  payload-size == 4
  header icmp[0:1] == 8
  header icmp[0:1] == 0,8
  header icmp[6:2] == 0
  event "ICMP Broadscan Smurf Scanner"
  header icmp[0:1] == 0,8
  header icmp[4:2] == 0
  }

signature sid-480 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 8
  event "ICMP PING speedera"
  payload /.{0,92}\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f/
  }

signature sid-481 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 8
  event "ICMP TJPingPro1.1Build 2 Windows"
  payload /.{0,16}\x54\x4a\x50\x69\x6e\x67\x50\x72\x6f\x20\x62\x79\x20\x4a\x69\x6d/
  }

signature sid-482 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 8
  event "ICMP PING WhatsupGold Windows"
  payload /.{0,16}\x57\x68\x61\x74\x73\x55\x70\x20\x2d\x20\x41\x20\x4e\x65\x74\x77/
  }

signature sid-483 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 8
  event "ICMP PING CyberKit 2.2 Windows"
  payload /.{0,16}\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa/
  }

signature sid-484 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  header icmp[0:1] == 8
  event "ICMP PING Sniffer Pro/NetXRay network scan"
  payload /.{0,13}\x43\x69\x6e\x63\x6f\x20\x4e\x65\x74\x77\x6f\x72\x6b\x2c\x20\x49\x6e\x63\x2e/
  }

signature sid-485 {
  ip-proto == icmp
  header icmp[1:1] == 13
  header icmp[0:1] == 3
  event "ICMP Destination Unreachable (Communication Administratively Prohibited)"
  }

signature sid-486 {
  ip-proto == icmp
  header icmp[1:1] == 10
  header icmp[0:1] == 3
  event "ICMP Destination Unreachable (Communication with Destination Host is Administratively Prohibited)"
  }

signature sid-487 {
  ip-proto == icmp
  header icmp[1:1] == 9
  header icmp[0:1] == 3
  event "ICMP Destination Unreachable (Communication with Destination Network is Administratively Prohibited)"
  }

signature sid-1813 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  event "ICMP digital island bandwidth query"
  payload /mailto:ops@digisle\.com/
  }

signature sid-499 {
  ip-proto == icmp
  src-ip != local_nets
  dst-ip == local_nets
  payload-size > 800
  event "ICMP Large ICMP Packet"
  }

signature sid-1293 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS nimda .eml"
  tcp-state established,originator
  payload /.*\x00\.\x00E\x00M\x00L/
  }

signature sid-1294 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS nimda .nws"
  tcp-state established,originator
  payload /.*\x00\.\x00N\x00W\x00S/
  }

signature sid-1295 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS nimda RICHED20.DLL"
  tcp-state established,originator
  payload /.*R\x00I\x00C\x00H\x00E\x00D\x002\x000/
  }

signature sid-529 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS DOS RFPoison"
  tcp-state established,originator
  payload /.*\x5C\x00\x5C\x00\x2A\x00\x53\x00\x4D\x00\x42\x00\x53\x00\x45\x00\x52\x00\x56\x00\x45\x00\x52\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xFF\xFF\xFF\xFF\x00\x00\x00\x00/
  }

signature sid-530 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS NT NULL session"
  tcp-state established,originator
  payload /.*\x00\x00\x00\x00\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00\x77\x00\x73\x00\x20\x00\x4E\x00\x54\x00\x20\x00\x31\x00\x33\x00\x38\x00\x31/
  }

signature sid-1239 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS RFParalyze Attempt"
  tcp-state established,originator
  payload /.*BEAVIS/
  payload /.*yep yep/
  }

signature sid-532 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS SMB ADMIN$access"
  tcp-state established,originator
  payload /.*\\ADMIN\$\x00\x41\x3a\x00/
  }

signature sid-533 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS SMB C$ access"
  tcp-state established,originator
  payload /.*\x5cC\$\x00\x41\x3a\x00/
  }

signature sid-534 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS SMB CD.."
  tcp-state established,originator
  payload /.*\\\.\.\x2f\x00\x00\x00/
  }

signature sid-535 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS SMB CD..."
  tcp-state established,originator
  payload /.*\\\.\.\.\x00\x00\x00/
  }

signature sid-536 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS SMB D$access"
  tcp-state established,originator
  payload /.*\\D\$\x00\x41\x3a\x00/
  }

signature sid-537 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS SMB IPC$ share access"
  tcp-state established,originator
  payload /\x00/
  payload /.{3}\xFFSMB\x75/
  payload /.*\\[iI][pP][cC]\$\x00/
  }

signature sid-538 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS SMB IPC$ share access (unicode)"
  tcp-state established,originator
  payload /\x00/
  payload /.{3}\xFFSMB\x75/
  payload /.*\x5c\x00[iI]\x00[pP]\x00[cC]\x00\$\x00/
  }

signature sid-2101 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS SMB SMB_COM_TRANSACTION Max Parameter and Max Count of 0 DOS Attempt"
  tcp-state established,originator
  payload /\x00/
  payload /.{3}\xFFSMB\x25/
  payload /.{42}\x00\x00\x00\x00/
  }

signature sid-2103 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  # Not supported: byte_test: 2,>,1024,0,relative,little
  event "NETBIOS SMB trans2open buffer overflow attempt"
  tcp-state established,originator
  payload /\x00/
  payload /.{3}\xffSMB\x32/
  payload /.{59}\x00\x14/
  }

signature sid-2174 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS SMB winreg access"
  tcp-state established,originator
  payload /\x00/
  payload /.{3}\xFFSMB\xa2/
  payload /.{84}.*\\[wW][iI][nN][rR][eE][gG]\x00/
  }

signature sid-2175 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS SMB winreg access (unicode)"
  tcp-state established,originator
  payload /\x00/
  payload /.{3}\xFFSMB\xa2/
  payload /.{84}.*\\\x00[wW]\x00[iI]\x00[nN]\x00[rR]\x00[eE]\x00[gG]\x00/
  }

signature sid-2176 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS SMB Startup Folder access attempt"
  tcp-state established,originator
  payload /\x00/
  payload /.{3}\xFFSMB\x32/
  payload /.*Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\x00/
  }

signature sid-2177 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 139
  event "NETBIOS SMB Startup Folder access attempt (unicode)"
  tcp-state established,originator
  payload /\x00/
  payload /.{3}\xFFSMB\x32/
  payload /.*\\\x00S\x00t\x00a\x00r\x00t\x00 \x00M\x00e\x00n\x00u\x00\\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00s\x00\\\x00S\x00t\x00a\x00r\x00t\x00u\x00p/
  }

signature sid-2190 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 135
  # Not supported: byte_test: 1,&,1,0,relative
  event "NETBIOS DCERPC invalid bind attempt"
  tcp-state established,originator
  payload /.{0}\x05.{1}\x0b.{21}\x00/
  }

signature sid-2191 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 445
  # Not supported: byte_test: 1,&,1,0,relative
  event "NETBIOS SMB DCERPC invalid bind attempt"
  tcp-state established,originator
  payload /.{3}\xFF[sS][mM][bB]\x25.{56}\x26\x00.{5}\x5c\x00[pP]\x00[iI]\x00[pP]\x00[eE]\x00\x5c\x00.{2}\x05.{1}\x0b.{21}\x00/
  }

signature sid-2192 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 135
  # Not supported: byte_test: 1,&,1,0,relative
  event "NETBIOS DCERPC ISystemActivator bind attempt"
  tcp-state established,originator
  payload /.{0}\x05.{1}\x0b.{29}\xA0\x01\x00\x00\x00\x00\x00\x00\xC0\x00\x00\x00\x00\x00\x00\x46/
  }

signature sid-2193 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 445
  # Not supported: byte_test: 1,&,1,0,relative
  event "NETBIOS SMB DCERPC ISystemActivator bind attempt"
  tcp-state established,originator
  payload /.{3}\xFF[sS][mM][bB]\x25.{56}\x26\x00.{5}\x5c\x00[pP]\x00[iI]\x00[pP]\x00[eE]\x00\x5c\x00.{0}\x05.{1}\x0b.{29}\xA0\x01\x00\x00\x00\x00\x00\x00\xC0\x00\x00\x00\x00\x00\x00\x46/
  }

signature sid-2251 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 135
  # Not supported: byte_test: 1,&,1,0,relative
  event "NETBIOS DCERPC Remote Activation bind attempt"
  payload /.{0}\x05.{1}\x0b.{29}\xB8\x4A\x9F\x4D\x1C\x7D\xCF\x11\x86\x1E\x00\x20\xAF\x6E\x7C\x57/
  }

signature sid-2252 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 445
  # Not supported: byte_test: 1,&,1,0,relative
  event "NETBIOS SMB DCERPC Remote Activation bind attempt"
  tcp-state established,originator
  payload /.{3}\xFF[sS][mM][bB]\x25.{56}\x26\x00.{5}\x5c\x00[pP]\x00[iI]\x00[pP]\x00[eE]\x00\x5c\x00.{0}\x05.{1}\x0b.{29}\xB8\x4A\x9F\x4D\x1C\x7D\xCF\x11\x86\x1E\x00\x20\xAF\x6E\x7C\x57/
  }

signature sid-500 {
  src-ip != local_nets
  dst-ip == local_nets
  event "MISC source route lssr"
  ip-options lsrr
  }

signature sid-501 {
  src-ip != local_nets
  dst-ip == local_nets
  event "MISC source route lssre"
  ip-options lsrre
  }

signature sid-502 {
  src-ip != local_nets
  dst-ip == local_nets
  event "MISC source route ssrr"
  ip-options ssrr 
  }

signature sid-503 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  src-port == 20
  dst-port >= 0
  dst-port <= 1023
  header tcp[13:1] & 255 == 2
  event "MISC Source Port 20 to <1024"
  }

signature sid-504 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  src-port == 53
  dst-port >= 0
  dst-port <= 1023
  header tcp[13:1] & 255 == 2
  event "MISC source port 53 to <1024"
  }

signature sid-505 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 1417
  event "MISC Insecure TIMBUKTU Password"
  tcp-state established,originator
  payload /.{0,13}\x05\x00\x3E/
  }

signature sid-507 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 5631
  event "MISC PCAnywhere Attempted Administrator Login"
  tcp-state established,originator
  payload /.*ADMINISTRATOR/
  }

signature sid-508 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 70
  event "MISC gopher proxy"
  tcp-state established,originator
  payload /.*[fF][tT][pP]\x3a/
  payload /.*@\//
  }

signature sid-512 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port >= 5631
  src-port <= 5632
  event "MISC PCAnywhere Failed Login"
  tcp-state established,responder
  payload /.{0,3}Invalid login/
  }

signature sid-513 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 7161
  header tcp[13:1] & 255 == 18
  event "MISC Cisco Catalyst Remote Access"
  }

signature sid-514 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  dst-port == 27374
  event "MISC ramen worm"
  tcp-state established,originator
  payload /.{0,4}[gG][eE][tT] /
  }

signature sid-516 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 161
  event "MISC SNMP NT UserList"
  payload /.*\x2b\x06\x10\x40\x14\xd1\x02\x19/
  }

signature sid-517 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 177
  event "MISC xdmcp query"
  payload /.*\x00\x01\x00\x03\x00\x01\x00/
  }

signature sid-1867 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 177
  event "MISC xdmcp info query"
  payload /.*\x00\x01\x00\x02\x00\x01\x00/
  }

signature sid-522 {
  src-ip != local_nets
  dst-ip == local_nets
  header ip[6:1] & 224 == 32
  payload-size < 25
  event "MISC Tiny Fragments"
  }

signature sid-1384 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 1900
  event "MISC UPnP malformed advertisement"
  payload /.*[nN][oO][tT][iI][fF][yY] \* /
  }

signature sid-1388 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 1900
  event "MISC UPnP Location overflow"
  payload /.*\x0d[lL][oO][cC][aA][tT][iI][oO][nN]\x3a[^\x0a]{128}/
  }

signature sid-1393 {
  ip-proto == tcp
  src-ip == aim_servers
  dst-ip == local_nets
  event "MISC AIM AddGame attempt"
  tcp-state established,responder
  payload /.*[aA][iI][mM]:[aA][dD][dD][gG][aA][mM][eE]\?/
  }

signature sid-1752 {
  ip-proto == tcp
  src-ip == aim_servers
  dst-ip == local_nets
  event "MISC AIM AddExternalApp attempt"
  tcp-state established,responder
  payload /.*[aA][iI][mM]:[aA][dD][dD][eE][xX][tT][eE][rR][nN][aA][lL][aA][pP][pP]\?/
  }

signature sid-1504 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 7001
  event "MISC AFS access"
  payload /.*\x00\x00\x03\xe7\x00\x00\x00\x00\x00\x00\x00\x65\x00\x00\x00\x00\x00\x00\x00\x00\x0d\x05\x00\x00\x00\x00\x00\x00\x00/
  }

signature sid-1636 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 32000
  payload-size > 500
  event "MISC Xtramail Username overflow attempt"
  tcp-state established,originator
  payload /.*[uU][sS][eE][rR][nN][aA][mM][eE]: /
  }

signature sid-1887 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == http_servers
  dst-port == 443
  event "MISC OpenSSL Worm traffic"
  tcp-state established,originator
  payload /.*[tT][eE][rR][mM]=[xX][tT][eE][rR][mM]/
  }

signature sid-1889 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == http_servers
  src-port == 2002
  dst-port == 2002
  event "MISC slapper worm admin traffic"
  payload /\x00\x00\x45\x00\x00\x45\x00\x00\x40\x00/
  }

signature sid-1447 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 3389
  event "MISC MS Terminal server request (RDP)"
  tcp-state established,originator
  payload /\x03\x00\x00\x0b\x06\xE0\x00\x00\x00\x00\x00/
  }

signature sid-1448 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 3389
  event "MISC MS Terminal server request"
  tcp-state established,originator
  payload /\x03\x00\x00/
  payload /.{4}\xe0\x00\x00\x00\x00\x00/
  }

signature sid-1819 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 2533
  event "MISC Alcatel PABX 4400 connection attempt"
  tcp-state established,originator
  payload /\x00\x01\x43/
  }

signature sid-1939 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 67
  # Not supported: byte_test: 1,>,6,2
  event "MISC bootp hardware address length overflow"
  payload /\x01/
  }

signature sid-1940 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 67
  # Not supported: byte_test: 1,>,7,1
  event "MISC bootp invalid hardware type"
  payload /\x01/
  }

signature sid-2039 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 67
  event "MISC bootp hostname format string attempt"
  payload /\x01.{240}.*\x0C.*.{0}.*%.{1}.{0,7}%.{1}.{0,7}%/
  }

signature sid-1966 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 27155
  event "MISC GlobalSunTech Access Point Information Disclosure attempt"
  payload /.*gstsearch/
  }

signature sid-1987 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 7100
  payload-size > 512
  event "MISC xfs overflow attempt"
  tcp-state established,originator
  payload /\x42\x00\x02/
  }

signature sid-2041 {
  ip-proto == udp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 49
  event "MISC xtacacs failed login response"
  payload /\x80\x02.{4}.*\x02/
  }

signature sid-2043 {
  ip-proto == udp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 500
  dst-port == 500
  event "MISC isakmp login failed"
  payload /.{16}\x10\x05.{13}\x00\x00\x00\x01\x01\x00\x00\x18/
  }

signature sid-2047 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 873
  event "MISC rsyncd module list access"
  tcp-state established,originator
  payload /\x23list/
  }

signature sid-2048 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 873
  # Not supported: byte_test: 2,>,4000,0
  event "MISC rsyncd overflow attempt"
  tcp-state originator
  payload /.{1}\x00\x00/
  }

signature sid-2008 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 2401
  event "MISC CVS invalid user authentication response"
  tcp-state established,responder
  payload /.*E Fatal error, aborting\./
  payload /.*\x3a no such user/
  }

signature sid-2009 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 2401
  event "MISC CVS invalid repository response"
  tcp-state established,responder
  payload /.*error /
  payload /.*: no such repository/
  payload /.*I HATE YOU/
  }

signature sid-2010 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 2401
  event "MISC CVS double free exploit attempt response"
  tcp-state established,responder
  payload /.*free\(\): warning: chunk is already free/
  }

signature sid-2011 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 2401
  event "MISC CVS invalid directory response"
  tcp-state established,responder
  payload /.*E protocol error: invalid directory syntax in/
  }

signature sid-2012 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 2401
  event "MISC CVS missing cvsroot response"
  tcp-state established,responder
  payload /.*E protocol error: Root request missing/
  }

signature sid-2013 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 2401
  event "MISC CVS invalid module response"
  tcp-state established,responder
  payload /.*cvs server: cannot find module.{1}.*error/
  }

signature sid-2126 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 1723
  payload-size > 156
  event "MISC Microsoft PPTP Start Control Request buffer overflow attempt"
  tcp-state established,originator
  payload /.{1}\x00\x01/
  payload /.{7}\x00\x01/
  }

signature sid-2158-a {
  ip-proto == tcp
  src-port == 179
  # Not supported: byte_test: 2,<,19,0,relative
  event "MISC BGP invalid length"
  payload /.*\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff/
  }

signature sid-2158-b {
  ip-proto == tcp
  dst-port == 179
  # Not supported: byte_test: 2,<,19,0,relative
  event "MISC BGP invalid length"
  payload /.*\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff/
  }

signature sid-2159-a {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 179
  event "MISC BGP invalid type (0)"
  tcp-state established
  payload /\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff.{2}\x00/
  }

signature sid-2159-b {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 179
  event "MISC BGP invalid type (0)"
  tcp-state established
  payload /\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff.{2}\x00/
  }

signature sid-1292 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  event "ATTACK-RESPONSES directory listing"
  tcp-state established,responder
  payload /.*Volume Serial Number/
  }

signature sid-494 {
  ip-proto == tcp
  src-ip == http_servers
  dst-ip != local_nets
  src-port == http_ports
  event "ATTACK-RESPONSES command completed"
  tcp-state established,responder
  payload /.*[cC][oO][mM][mM][aA][nN][dD] [cC][oO][mM][pP][lL][eE][tT][eE][dD]/
  }

signature sid-495 {
  ip-proto == tcp
  src-ip == http_servers
  dst-ip != local_nets
  src-port == http_ports
  event "ATTACK-RESPONSES command error"
  tcp-state established,responder
  payload /.*[bB][aA][dD] [cC][oO][mM][mM][aA][nN][dD] [oO][rR] [fF][iI][lL][eE][nN][aA][mM][eE]/
  }

signature sid-497 {
  ip-proto == tcp
  src-ip == http_servers
  dst-ip != local_nets
  src-port == http_ports
  event "ATTACK-RESPONSES file copied ok"
  tcp-state established,responder
  payload /.*1 [fF][iI][lL][eE]\([sS]\) [cC][oO][pP][iI][eE][dD]/
  }

signature sid-1200 {
  ip-proto == tcp
  src-ip == http_servers
  dst-ip != local_nets
  src-port == http_ports
  event "ATTACK-RESPONSES Invalid URL"
  tcp-state established,responder
  payload /.*[iI][nN][vV][aA][lL][iI][dD] [uU][rR][lL]/
  }

signature sid-1666 {
  ip-proto == tcp
  src-ip == http_servers
  dst-ip != local_nets
  src-port == http_ports
  event "ATTACK-RESPONSES index of /cgi-bin/ response"
  tcp-state established,responder
  payload /.*[iI][nN][dD][eE][xX] [oO][fF] \/[cC][gG][iI]-[bB][iI][nN]\//
  }

signature sid-1201 {
  ip-proto == tcp
  src-ip == http_servers
  dst-ip != local_nets
  src-port == http_ports
  event "ATTACK-RESPONSES 403 Forbidden"
  tcp-state established,responder
  payload /HTTP\/1\.1 403/
  }

signature sid-498 {
  event "ATTACK-RESPONSES id check returned root"
  payload /.*uid=0\(root\)/
  }

signature sid-1882 {
  src-ip == local_nets
  dst-ip != local_nets
  # Not supported: byte_test: 5,<,65537,0,relative,string,5,<,65537,0,relative,string
  event "ATTACK-RESPONSES id check returned userid"
  payload /.*uid=.{0}.{0,10} gid=/
  }

signature sid-1464 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 8002
  event "ATTACK-RESPONSES oracle one hour install"
  tcp-state established,responder
  payload /.*Oracle Applications One-Hour Install/
  }

signature sid-1900 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 749
  event "ATTACK-RESPONSES successful kadmind buffer overflow attempt"
  tcp-state established,responder
  payload /\*GOBBLE\*/
  }

signature sid-1901 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 751
  event "ATTACK-RESPONSES successful kadmind buffer overflow attempt"
  tcp-state established,responder
  payload /\*GOBBLE\*/
  }

signature sid-1810 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 22
  event "ATTACK-RESPONSES successful gobbles ssh exploit (GOBBLE)"
  tcp-state established,responder
  payload /.*\x2aGOBBLE\x2a/
  }

signature sid-1811 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 22
  event "ATTACK-RESPONSES successful gobbles ssh exploit (uname)"
  tcp-state established,responder
  payload /.*uname/
  }

signature sid-2104 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 512
  event "ATTACK-RESPONSES rexec username too long response"
  tcp-state established,responder
  payload /username too long/
  }

signature sid-2123 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port < 21
  src-port > 23
  event "ATTACK-RESPONSES Microsoft cmd.exe banner"
  tcp-state established,responder
  payload /.*Microsoft Windows.*.{0}.*\(C\) Copyright 1985-.*.{0}.*Microsoft Corp\./
  }

signature sid-1673 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE EXECUTE_SYSTEM attempt"
  tcp-state established,originator
  payload /.*[eE][xX][eE][cC][uU][tT][eE]_[sS][yY][sS][tT][eE][mM]/
  }

signature sid-1674 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE connect_data(command=version) attempt"
  tcp-state established,originator
  payload /.*[cC][oO][nN][nN][eE][cC][tT]_[dD][aA][tT][aA]\([cC][oO][mM][mM][aA][nN][dD]=[vV][eE][rR][sS][iI][oO][nN]\)/
  }

signature sid-1675 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE misparsed login response"
  tcp-state established,responder
  payload /.*[dD][eE][sS][cC][rR][iI][pP][tT][iI][oO][nN]=\(/
  payload /.*<willnevermatch>/
  payload /.*<willnevermatch>/
  }

signature sid-1676 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE select union attempt"
  tcp-state established,originator
  payload /.*[sS][eE][lL][eE][cC][tT] /
  payload /.* [uU][nN][iI][oO][nN] /
  }

signature sid-1677 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE select like '%' attempt"
  tcp-state established,originator
  payload /.* [wW][hH][eE][rR][eE] /
  payload /.* [lL][iI][kK][eE] '%'/
  }

signature sid-1678 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE select like \"%\" attempt"
  tcp-state established,originator
  payload /.* [wW][hH][eE][rR][eE] /
  payload /.* [lL][iI][kK][eE] \"%\"/
  }

signature sid-1679 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE describe attempt"
  tcp-state established,originator
  payload /.*[dD][eE][sS][cC][rR][iI][bB][eE] /
  }

signature sid-1680 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE all_constraints access"
  tcp-state established,originator
  payload /.*[aA][lL][lL]_[cC][oO][nN][sS][tT][rR][aA][iI][nN][tT][sS]/
  }

signature sid-1681 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE all_views access"
  tcp-state established,originator
  payload /.*[aA][lL][lL]_[vV][iI][eE][wW][sS]/
  }

signature sid-1682 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE all_source access"
  tcp-state established,originator
  payload /.*[aA][lL][lL]_[sS][oO][uU][rR][cC][eE]/
  }

signature sid-1683 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE all_tables access"
  tcp-state established,originator
  payload /.*[aA][lL][lL]_[tT][aA][bB][lL][eE][sS]/
  }

signature sid-1684 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE all_tab_columns access"
  tcp-state established,originator
  payload /.*[aA][lL][lL]_[tT][aA][bB]_[cC][oO][lL][uU][mM][nN][sS]/
  }

signature sid-1685 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE all_tab_privs access"
  tcp-state established,originator
  payload /.*[aA][lL][lL]_[tT][aA][bB]_[cC][oO][lL][uU][mM][nN][sS]/
  }

signature sid-1686 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE dba_tablespace access"
  tcp-state established,originator
  payload /.*[dD][bB][aA]_[tT][aA][bB][lL][eE][sS][pP][aA][cC][eE]/
  }

signature sid-1687 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE dba_tables access"
  tcp-state established,originator
  payload /.*[dD][bB][aA]_[tT][aA][bB][lL][eE][sS]/
  }

signature sid-1688 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE user_tablespace access"
  tcp-state established,originator
  payload /.*[uU][sS][eE][rR]_[tT][aA][bB][lL][eE][sS][pP][aA][cC][eE]/
  }

signature sid-1689 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE sys.all_users access"
  tcp-state established,originator
  payload /.*[sS][yY][sS]\.[aA][lL][lL]_[uU][sS][eE][rR][sS]/
  }

signature sid-1690 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE grant attempt"
  tcp-state established,originator
  payload /.*[gG][rR][aA][nN][tT] /
  payload /.* [tT][oO] /
  }

signature sid-1691 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE ALTER USER attempt"
  tcp-state established,originator
  payload /.*[aA][lL][tT][eE][rR] [uU][sS][eE][rR]/
  payload /.* [iI][dD][eE][nN][tT][iI][fF][iI][eE][dD] [bB][yY] /
  }

signature sid-1692 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE drop table attempt"
  tcp-state established,originator
  payload /.*[dD][rR][oO][pP] [tT][aA][bB][lL][eE]/
  }

signature sid-1693 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE create table attempt"
  tcp-state established,originator
  payload /.*[cC][rR][eE][aA][tT][eE] [tT][aA][bB][lL][eE]/
  }

signature sid-1694 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE alter table attempt"
  tcp-state established,originator
  payload /.*[aA][lL][tT][eE][rR] [tT][aA][bB][lL][eE]/
  }

signature sid-1695 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE truncate table attempt"
  tcp-state established,originator
  payload /.*[tT][rR][uU][nN][cC][aA][tT][eE] [tT][aA][bB][lL][eE]/
  }

signature sid-1696 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE create database attempt"
  tcp-state established,originator
  payload /.*[cC][rR][eE][aA][tT][eE] [dD][aA][tT][aA][bB][aA][sS][eE]/
  }

signature sid-1697 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == oracle_ports
  event "ORACLE alter database attempt"
  tcp-state established,originator
  payload /.*[aA][lL][tT][eE][rR] [dD][aA][tT][aA][bB][aA][sS][eE]/
  }

signature sid-1775 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 3306
  event "MYSQL root login attempt"
  tcp-state established,originator
  payload /.*\x0A\x00\x00\x01\x85\x04\x00\x00\x80\x72\x6F\x6F\x74\x00/
  }

signature sid-1776 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == sql_servers
  dst-port == 3306
  event "MYSQL show databases attempt"
  tcp-state established,originator
  payload /.*\x0f\x00\x00\x00\x03show databases/
  }

signature sid-1893 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 161
  event "SNMP missing community string attempt"
  payload /.{4}.{0,8}\x04\x00/
  }

signature sid-1892 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 161
  event "SNMP null community string attempt"
  payload /.{4}.{0,7}\x04\x01\x00/
  }

signature sid-1409 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port >= 161
  dst-port <= 162
  event "SNMP community string buffer overflow attempt"
  payload /.{3}.*\x02\x01\x00\x04\x82\x01\x00/
  }

signature sid-1422 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port >= 161
  dst-port <= 162
  event "SNMP community string buffer overflow attempt (with evasion)"
  payload /.{6} \x04\x82\x01\x00/
  }

signature sid-1411 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 161
  event "SNMP public access udp"
  payload /.*public/
  }

signature sid-1412 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 161
  event "SNMP public access tcp"
  tcp-state established,originator
  payload /.*public/
  }

signature sid-1413 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 161
  event "SNMP private access udp"
  payload /.*private/
  }

signature sid-1414 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 161
  event "SNMP private access tcp"
  tcp-state established,originator
  payload /.*private/
  }

signature sid-1415 {
  ip-proto == udp
  dst-ip == 255.255.255.255
  dst-port == 161
  event "SNMP Broadcast request"
  }

signature sid-1416 {
  ip-proto == udp
  dst-ip == 255.255.255.255
  dst-port == 162
  event "SNMP broadcast trap"
  }

signature sid-1417 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 161
  event "SNMP request udp"
  }

signature sid-1418 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 161
  event "SNMP request tcp"
  }

signature sid-1419 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 162
  event "SNMP trap udp"
  }

signature sid-1420 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 162
  event "SNMP trap tcp"
  }

signature sid-1421 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 705
  event "SNMP AgentX/tcp request"
  }

signature sid-1426 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 161
  event "SNMP PROTOS test-suite-req-app attempt"
  payload /.*\x30\x26\x02\x01\x00\x04\x06\x70\x75\x62\x6C\x69\x63\xA0\x19\x02\x01\x00\x02\x01\x00\x02\x01\x00\x30\x0E\x30\x0C\x06\x08\x2B\x06\x01\x02\x01\x01\x05\x00\x05\x00/
  }

signature sid-1427 {
  ip-proto == udp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 162
  event "SNMP PROTOS test-suite-trap-app attempt"
  payload /.*\x30\x38\x02\x01\x00\x04\x06\x70\x75\x62\x6C\x69\x63\xA4\x2B\x06/
  }

signature sid-655 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  src-port == 113
  dst-port == 25
  event "SMTP sendmail 8.6.9 exploit"
  tcp-state established,originator
  payload /.*\x0aD\//
  }

signature sid-658 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP exchange mime DOS"
  tcp-state established,originator
  payload /.*charset = \x22\x22/
  }

signature sid-659 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP expn decode"
  tcp-state established,originator
  payload /.*[eE][xX][pP][nN] [dD][eE][cC][oO][dD][eE]/
  }

signature sid-660 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP expn root"
  tcp-state established,originator
  payload /.*[eE][xX][pP][nN] [rR][oO][oO][tT]/
  }

signature sid-1450 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP expn *@"
  tcp-state established,originator
  payload /.*[eE][xX][pP][nN] \*@/
  }

signature sid-661 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP majordomo ifs"
  tcp-state established,originator
  payload /.*eply-to\x3a a~\.`\/bin\//
  }

signature sid-662 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP sendmail 5.5.5 exploit"
  tcp-state established,originator
  payload /.*[mM][aA][iI][lL] [fF][rR][oO][mM]\x3a\x20\x22\x7c/
  }

signature sid-663 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP rcpt to sed command attempt"
  tcp-state established,originator
  payload /.*[rR][cC][pP][tT] [tT][oO]:.*.{0}.*\|.*.{0}.*sed /
  }

signature sid-664 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP RCPT TO decode attempt"
  tcp-state established,originator
  payload /.*[rR][cC][pP][tT] [tT][oO]\x3a [dD][eE][cC][oO][dD][eE]/
  }

signature sid-665 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP sendmail 5.6.5 exploit"
  tcp-state established,originator
  payload /.*[mM][aA][iI][lL] [fF][rR][oO][mM]\x3a\x20\x7c\/[uU][sS][rR]\/[uU][cC][bB]\/[tT][aA][iI][lL]/
  }

signature sid-667 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP sendmail 8.6.10 exploit"
  tcp-state established,originator
  payload /.*Croot\x0d\x0aMprog, P=\/bin\//
  }

signature sid-668 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP sendmail 8.6.10 exploit"
  tcp-state established,originator
  payload /.*Croot\x09\x09\x09\x09\x09\x09\x09Mprog,P=\/bin/
  }

signature sid-669 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP sendmail 8.6.9 exploit"
  tcp-state established,originator
  payload /.*\x0aCroot\x0aMprog/
  }

signature sid-670 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP sendmail 8.6.9 exploit"
  tcp-state established,originator
  payload /.*\x0aC\x3adaemon\x0aR/
  }

signature sid-671 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP sendmail 8.6.9c exploit"
  tcp-state established,originator
  payload /.*\x0aCroot\x0d\x0aMprog/
  }

signature sid-672 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP vrfy decode"
  tcp-state established,originator
  payload /.*[vV][rR][fF][yY] [dD][eE][cC][oO][dD][eE]/
  }

signature sid-1446 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP vrfy root"
  tcp-state established,originator
  payload /.*[vV][rR][fF][yY] [rR][oO][oO][tT]/
  }

signature sid-631 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP ehlo cybercop attempt"
  tcp-state established,originator
  payload /.*ehlo cybercop\x0aquit\x0a/
  }

signature sid-632 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP expn cybercop attempt"
  tcp-state established,originator
  payload /.*expn cybercop/
  }

signature sid-1549 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP HELO overflow attempt"
  tcp-state established,originator
  payload /HELO [^\x0a]{500}/
  }

signature sid-1550 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP ETRN overflow attempt"
  tcp-state established,originator
  payload /ETRN [^\x0A]{500}/
  }

signature sid-2087 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  event "SMTP From comment overflow attempt"
  tcp-state established,originator
  payload /.*From:.*.{0}.*<><><><><><><><><><><><><><><><><><><><><><>.{1}.*\(.{1}.*\)/
  }

signature sid-2183 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == smtp_servers
  dst-port == 25
  # Not supported: byte_test: 1,<,256,100,relative
  event "SMTP Content-Transfer-Encoding overflow attempt"
  tcp-state established,originator
  payload /.*Content-Transfer-Encoding:[^\x0a]{100}/
  }

signature sid-1993 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 143
  # Not supported: byte_test: 5,>,256,0,string,dec,relative
  event "IMAP login literal buffer overflow attempt"
  tcp-state established,originator
  payload /.* LOGIN .*.{0}.* \{/
  }

signature sid-1842 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 143
  event "IMAP login buffer overflow attempt"
  tcp-state established,originator
  payload /.* LOGIN [^\x0a]{100}/
  }

signature sid-2105 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 143
  # Not supported: byte_test: 5,>,256,0,string,dec,relative
  event "IMAP authenticate literal overflow attempt"
  tcp-state established,originator
  payload /.* [aA][uU][tT][hH][eE][nN][tT][iI][cC][aA][tT][eE] .*.{0}.*\{/
  }

signature sid-1844 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 143
  event "IMAP authenticate overflow attempt"
  tcp-state established,originator
  payload /.* [aA][uU][tT][hH][eE][nN][tT][iI][cC][aA][tT][eE] [^\x0a]{100}/
  }

signature sid-1930 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 143
  # Not supported: byte_test: 5,>,256,0,string,dec,relative
  event "IMAP auth overflow attempt"
  tcp-state established,originator
  payload /.* [aA][uU][tT][hH]/
  payload /.*\{/
  }

signature sid-1902 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 143
  # Not supported: byte_test: 5,>,256,0,string,dec,relative
  event "IMAP lsub literal overflow attempt"
  payload /.* LSUB \x22.*.{0}.*\x22 \{/
  }

signature sid-2106 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 143
  event "IMAP lsub overflow attempt"
  payload /.* LSUB [^\x0a]{100}/
  }

signature sid-1845 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 143
  # Not supported: byte_test: 5,>,256,0,string,dec,relative
  event "IMAP list literal overflow attempt"
  tcp-state established,originator
  payload /.* LIST \x22.*.{0}.*\x22 \{/
  }

signature sid-2118 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 143
  event "IMAP list overflow attempt"
  tcp-state established,originator
  payload /.* [lL][iI][sS][tT] [^\x0a]{100}/
  }

signature sid-2119 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 143
  # Not supported: byte_test: 5,>,256,0,string,dec,relative
  event "IMAP rename literal overflow attempt"
  tcp-state established,originator
  payload /.* RENAME \x22.*.{0}.*\x22 \{/
  }

signature sid-1903 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 143
  event "IMAP rename overflow attempt"
  tcp-state established,originator
  payload /.* [rR][eE][nN][aA][mM][eE] [^\x0a]{1024}/
  }

signature sid-1904 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 143
  event "IMAP find overflow attempt"
  tcp-state established,originator
  payload /.* [fF][iI][nN][dD] [^\x0a]{1024}/
  }

signature sid-1755 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 143
  event "IMAP partial body buffer overflow attempt"
  tcp-state established,originator
  payload /.* PARTIAL /
  payload /.* BODY\[[^\]]{1024}/
  }

signature sid-2046 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 143
  event "IMAP partial body.peek buffer overflow attempt"
  tcp-state established,originator
  payload /.* PARTIAL /
  payload /.* BODY\.PEEK\[[^\]]{1024}/
  }

signature sid-2107 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 143
  event "IMAP create buffer overflow attempt"
  tcp-state established,originator
  payload /.* CREATE [^\x0a]{1024}/
  }

signature sid-2120 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 143
  # Not supported: byte_test: 5,>,256,0,string,dec,relative
  event "IMAP create literal buffer overflow attempt"
  tcp-state established,originator
  payload /.* CREATE.*.{0}.* \{/
  }

signature sid-1934 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 109
  event "POP2 FOLD overflow attempt"
  tcp-state established,originator
  payload /.*FOLD [^\x0A]{256}/
  }

signature sid-1935 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 109
  event "POP2 FOLD arbitrary file attempt"
  tcp-state established,originator
  payload /.*FOLD \//
  }

signature sid-284 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 109
  event "POP2 x86 Linux overflow"
  tcp-state established,originator
  payload /.*\xeb\x2c\x5b\x89\xd9\x80\xc1\x06\x39\xd9\x7c\x07\x80\x01/
  }

signature sid-285 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 109
  event "POP2 x86 Linux overflow"
  tcp-state established,originator
  payload /.*\xff\xff\xff\x2f\x42\x49\x4e\x2f\x53\x48\x00/
  }

signature sid-2121 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  # Not supported: byte_test: 1,>,0,0,relative,string
  event "POP3 DELE negative arguement attempt"
  payload /[dD][eE][lL][eE].{1}.*-/
  }

signature sid-2122 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  # Not supported: byte_test: 1,>,0,0,relative,string
  event "POP3 UIDL negative arguement attempt"
  payload /[uU][iI][dD][lL].{1}.*-/
  }

signature sid-1866 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  event "POP3 USER overflow attempt"
  tcp-state established,originator
  payload /.*[uU][sS][eE][rR][^\x0a]{50}/
  }

signature sid-2108 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  event "POP3 CAPA overflow attempt"
  tcp-state established,originator
  payload /.*[cC][aA][pP][aA][^\x0a]{10}/
  }

signature sid-2109 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  event "POP3 TOP overflow attempt"
  tcp-state established,originator
  payload /.*[tT][oO][pP][^\x0a]{10}/
  }

signature sid-2110 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  event "POP3 STAT overflow attempt"
  tcp-state established,originator
  payload /.*[sS][tT][aA][tT][^\x0a]{10}/
  }

signature sid-2111 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  event "POP3 DELE overflow attempt"
  tcp-state established,originator
  payload /.*[dD][eE][lL][eE][^\x0a]{10}/
  }

signature sid-2112 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  event "POP3 RSET overflow attempt"
  tcp-state established,originator
  payload /.*[rR][sS][eE][tT][^\x0a]{10}/
  }

signature sid-1936 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  event "POP3 AUTH overflow attempt"
  tcp-state established,originator
  payload /.*[aA][uU][tT][hH][^\x0a]{50}/
  }

signature sid-1937 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  event "POP3 LIST overflow attempt"
  tcp-state established,originator
  payload /.*[lL][iI][sS][tT][^\x0a]{50}/
  }

signature sid-1938 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  event "POP3 XTND overflow attempt"
  tcp-state established,originator
  payload /.*[xX][tT][nN][dD][^\x0a]{50}/
  }

signature sid-1634 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  event "POP3 PASS overflow attempt"
  tcp-state established,originator
  payload /.*[pP][aA][sS][sS][^\x0a]{50}/
  }

signature sid-1635 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  event "POP3 APOP overflow attempt"
  tcp-state established,originator
  payload /.*[aA][pP][oO][pP][^\x0a]{256}/
  }

signature sid-286 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  event "POP3 EXPLOIT x86 BSD overflow"
  tcp-state established,originator
  payload /.*\|5e0 e31c 0b03 b8d7 e0e8 9fa 89f9\|/
  }

signature sid-287 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  event "POP3 EXPLOIT x86 BSD overflow"
  tcp-state established,originator
  payload /.*\x68\x5d\x5e\xff\xd5\xff\xd4\xff\xf5\x8b\xf5\x90\x66\x31/
  }

signature sid-288 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  event "POP3 EXPLOIT x86 Linux overflow"
  tcp-state established,originator
  payload /.*\xd8\x40\xcd\x80\xe8\xd9\xff\xff\xff\/bin\/sh/
  }

signature sid-289 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  event "POP3 EXPLOIT x86 SCO overflow"
  tcp-state established,originator
  payload /.*\x56\x0e\x31\xc0\xb0\x3b\x8d\x7e\x12\x89\xf9\x89\xf9/
  }

signature sid-290 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 110
  event "POP3 EXPLOIT qpopper overflow"
  tcp-state established,originator
  payload /.*\xE8\xD9\xFF\xFF\xFF\/bin\/sh/
  }

signature sid-1792 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  src-port == 119
  event "NNTP return code buffer overflow attempt"
  tcp-state established,originator
  payload /200 [^\x0a]{64}/
  }

signature sid-1538 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  dst-port == 119
  event "NNTP AUTHINFO USER overflow attempt"
  tcp-state established,originator
  payload /[aA][uU][tT][hH][iI][nN][fF][oO] [uU][sS][eE][rR] [^\x0a]{500}/
  }

signature sid-1760 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 902
  event "OTHER-IDS ISS RealSecure 6 event collector connection attempt"
  tcp-state established,responder
  payload /.{29}6[iI][sS][sS] [eE][cC][nN][rR][aA] [bB][uU][iI][lL][tT]-[iI][nN] [pP][rR][oO][vV][iI][dD][eE][rR], [sS][tT][rR][oO][nN][gG] [eE][nN][cC][rR][yY][pP][tT][iI][oO][nN]/
  }

signature sid-1761 {
  ip-proto == tcp
  src-ip == local_nets
  dst-ip != local_nets
  src-port == 2998
  event "OTHER-IDS ISS RealSecure 6 daemon connection attempt"
  tcp-state established,responder
  payload /.{29}6[iI][sS][sS] [eE][cC][nN][rR][aA] [bB][uU][iI][lL][tT]-[iI][nN] [pP][rR][oO][vV][iI][dD][eE][rR], [sS][tT][rR][oO][nN][gG] [eE][nN][cC][rR][yY][pP][tT][iI][oO][nN]/
  }

signature sid-1629 {
  ip-proto == tcp
  src-ip != local_nets
  dst-ip == local_nets
  event "OTHER-IDS SecureNetPro traffic"
  tcp-state established
  payload /\x00\x67\x00\x01\x00\x03/
  }