# $Id: s2b-augment.cfg 797 2004-11-27 20:26:50Z rwinslow $

<augment 1724-6>
  active T
  comment WEB-CGI emumail.cgi access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2005-10>
  active T
  comment RPC portmap kcms_server request UDP
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1600-6>
  active T
  comment WEB-CGI htsearch arbitrary configuration file attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 657-12>
  active T
  comment SMTP chameleon overflow
  comment pcre: /^HELP\s[^\n]{500}/ism
  payload /((^)|(\n+))[hH][eE][lL][pP][\x20\x09\x0b][^\n]{500}/
  sigaction SIG_LOG
  requires-reverse-signature ! smtp_server_fail
  snort-rule-file s2b_data_on_weed/rules2.1/smtp.rules
  <delete>
    payload /.*[hH][eE][lL][pP]/
  </delete>
</augment>

<augment 1970-6>
  active T
  comment WEB-IIS MDAC Content-Type overflow attempt
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 333-8>
  active T
  comment FINGER . query
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/finger.rules
</augment>

<augment 818-10>
  active T
  comment WEB-CGI dcforum.cgi access
  comment "informational only"
  comment "too general but low occurence"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 683-5>
  active T
  comment MS-SQL sp_password - password change
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1503-8>
  active T
  comment WEB-CGI admentor admin.asp access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2104-3>
  active T
  comment ATTACK-RESPONSES rexec username too long response
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/attack-responses.rules
</augment>

<augment 1588-8>
  active T
  comment WEB-MISC SalesLogix Eviewer access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1502-8>
  active T
  comment WEB-CGI a1stats a1disp3.cgi access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1426-5>
  active T
  comment SNMP PROTOS test-suite-req-app attempt
  requires-reverse-signature snmp_userver_ok_return
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/snmp.rules
</augment>

<augment 2533-5>
  active T
  comment "MISC LDAP SSLv3 Server_Hello request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 262-6>
  active T
  comment "DNS EXPLOIT x86 Linux overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 1865-4>
  active T
  comment "WEB-CGI webdist.cgi arbitrary command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2063-1>
  active T
  comment "WEB-MISC Demarc SQL injection attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 937-7>
  active T
  comment "WEB-FRONTPAGE _vti_rpc access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 879-7>
  active T
  comment "WEB-CGI admin.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1378-14>
  active T
  comment "FTP wu-ftp bad file completion attempt {"
  sigaction SIG_LOG
  <delete>
  	payload /.*~.{1}.*\{/
  </delete>
  ftp /.{2,} ~.?\{/
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 1107-10>
  active T
  comment "WEB-MISC ftp.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2084-8>
  active T
  comment "RPC rpc.xfsmd xfs_export attempt TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1729-5>
  active T
  comment "CHAT IRC channel join"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 2575-1>
  active T
  comment "WEB-PHP Opt-X header.php remote file include attempt"
  comment pcre: /systempath=(http|https|ftp)/i
  payload /.*[sS][yY][sS][tT][eE][mM][pP][aA][tT][hH]=([hH][tT]{2}[pP][sS]?)|([fF][tT][pP])/
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
  <delete>
    payload /.*[sS][yY][sS][tT][eE][mM][pP][aA][tT][hH]=/
  </delete>
</augment>

<augment 1000-7>
  active T
  comment "WEB-IIS bdir.htr access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1505-7>
  active T
  comment "WEB-CGI alchemy http server PRN arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2385-9>
  active T
  comment "NETBIOS SMB-DS DCERPC NTLMSSP invalid mechlistMIC attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1675-4>
  active T
  comment "ORACLE misparsed login response"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/oracle.rules
</augment>

<augment 1997-3>
  active T
  comment "WEB-PHP read_body.php access attempt"
  comment "java script squirrel mail exploit: just add to signature "
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
  http /.*[fF][rR][oO][mM]\x3a.*\x3cscript\x3e.*document.cookie.*\x3c\x2fscript\x3e/
</augment>

<augment 1181-8>
  active T
  comment "WEB-MISC Annex Terminal DOS attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2411-5>
  active T
  comment WEB-MISC Real Server DESCRIBE buffer overflow attempt
  comment "pcre: /^DESCRIBE\s[^\n]{300}/smi"
  http "/((^)|(\n+))[dD][eE][sS][cC][rR][iI][bB][eE][\x20\x09\x0b][^\n]{300}/"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
  <delete>
    payload "/.*[dD][eE][sS][cC][rR][iI][bB][eE].{1}.*\.\.\//"
  </delete>
</augment>

<augment 1634-11>
  active T
  comment POP3 PASS overflow attempt
  comment "pcre: /^PASS\s[^\n]{50}/smi"
  payload "/((^)|(\n+))[pP][aA][sS][sS][\x20\x09\x0b][^\n]{50}/"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/pop3.rules
  <delete>
    payload "/.*[pP][aA][sS][sS]/"
  </delete>
</augment>

<augment 1960-7>
  active T
  comment "RPC portmap NFS request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1334-5>
  active T
  comment "WEB-ATTACKS echo command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 393-8>
  active F
  comment "ICMP Datagram Conversion Error undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 401-6>
  active F
  comment "ICMP Destination Unreachable Network Unreachable"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2143-3>
  active T
  comment "WEB-PHP b2 cafelog gm-2-b2.php remote file include attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 461-7>
  active F
  comment "ICMP unassigned type 2 undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2081-9>
  active T
  comment "RPC portmap rpc.xfsmd request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2103-9>
  active T
  comment "NETBIOS SMB trans2open buffer overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 940-7>
  active T
  comment "WEB-FRONTPAGE shtml.dll access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 335-5>
  active T
  comment "FTP .rhosts"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  ftp /.*\.rhosts/
  <delete>
  	payload /.*\.rhosts/
  </delete>
</augment>

<augment 2212-6>
  active T
  dst-ip == local_nets
  http /.*[\/\\]imageFolio\.cgi\?.*<script>/
  comment "WEB-CGI imageFolio.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  <delete>
  	http /.*[\/\\]imageFolio\.cgi/
  </delete>
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1231-8>
  active T
  comment "WEB-MISC VirusWall catinfo access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1975-6>
  active T
  comment FTP DELE overflow attempt
  comment "pcre: /^DELE\s[^\n]{100}/smi"
  eval dataSizeG100
  ftp "/((^)|(\n+))[dD][eE][lL][eE][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[dD][eE][lL][eE]/"
  </delete>
</augment>

<augment 426-7>
  active F
  comment "ICMP Parameter Problem Missing a Required Option"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 494-7>
  active F
  comment "ATTACK-RESPONSES command completed"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/attack-responses.rules
</augment>

<augment 1473-5>
  active T
  comment "WEB-CGI newsdesk.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2026-9>
  active T
  comment "RPC yppasswd username overflow attempt TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1392-10>
  active T
  comment "WEB-CGI lastlines.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1453-5>
  active T
  comment "WEB-CGI AT-generated.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1496-5>
  active T
  comment "WEB-CGI spin_client.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1197-6>
  active T
  comment "WEB-PHP Phorum code access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1887-3>
  active T
  comment "MISC OpenSSL Worm traffic"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 589-8>
  active T
  comment "RPC portmap yppasswd request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 533-8>
  active T
  comment "NETBIOS SMB C$ share access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2530-3>
  active T
  comment "IMAP SSLv3 Server_Hello request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/imap.rules
</augment>

<augment 1108-10>
  active T
  comment "WEB-MISC Tomcat server snoop access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 977-7>
  active T
  comment "WEB-IIS .cnf access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1514-9>
  active T
  comment "WEB-CGI input2.bat arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 396-6>
  active F
  comment "ICMP Destination Unreachable Fragmentation Needed and DF bit was set"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 803-9>
  active T
  comment "WEB-CGI HyperSeek hsx.cgi directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1268-12>
  active T
  comment "RPC portmap pcnfsd request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2415-7>
  active T
  comment "EXPLOIT ISAKMP second payload initial contact notification without SPI attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1391-7>
  active T
  comment "WEB-MISC Phorecast remote code execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2436-2>
  active F
  comment "WEB-CLIENT Microsoft wmf metafile access"
  requires-signature http_msie_client
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-client.rules
  comment "Informational only"
</augment>

<augment 1447-11>
  active T
  comment "MISC MS Terminal server request RDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 303-11>
  active T
  comment "DNS EXPLOIT named tsig overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 1720-4>
  active T
  comment "WEB-CGI talkback.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2229-4>
  active T
  comment "WEB-PHP viewtopic.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  http /.*[sS][uU][bB][sS][Ss][tT][rR][iI][nN][gG]\x28[uU][sS][eE][rR][pP][aA][sS][sS][wW][oO][rR][dD]*./
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 236-6>
  active T
  comment "DDOS Stacheldraht client check gag"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 1023-9>
  active T
  comment "WEB-IIS msadcs.dll access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 681-6>
  active T
  comment "MS-SQL/SMB xp_cmdshell program execution"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1629-6>
  active T
  comment "OTHER-IDS SecureNetPro traffic"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/other-ids.rules
</augment>

<augment 1200-10>
  active F
  comment "ATTACK-RESPONSES Invalid URL"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/attack-responses.rules
</augment>

<augment 2329-6>
  active T
  dst-port == 1434
  dst-ip == local_nets
  comment "MS-SQL probe response overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 2019-4>
  active T
  comment "RPC mountd UDP dump request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 956-6>
  active T
  comment "WEB-FRONTPAGE register.txt access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 372-7>
  active F
  comment "ICMP PING Delphi-Piette Windows"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1190-6>
  active T
  comment "WEB-MISC Netscape Enterprise Server directory view"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 676-6>
  active T
  comment "MS-SQL/SMB sp_start_job - program execution"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 2014-5>
  active T
  comment "RPC portmap UNSET attempt TCP 111"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 108-6>
  active T
  comment "BACKDOOR QAZ Worm Client Login access"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 2056-4>
  active T
  comment "WEB-MISC TRACE attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2068-2>
  active T
  comment "WEB-MISC BitKeeper arbitrary command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 361-12>
  active T
  comment "FTP SITE EXEC attempt"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 586-8>
  active T
  comment "RPC portmap selection_svc request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 549-8>
  active F
  comment "P2P napster login"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/p2p.rules
</augment>

<augment 1704-5>
  active T
  comment "WEB-CGI cal_make.pl directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1342-5>
  active T
  comment "WEB-ATTACKS gcc command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 2520-5>
  active T
  comment "WEB-MISC SSLv3 Client_Hello request"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1346-5>
  active F
  comment "WEB-ATTACKS cpp command attempt"
  comment "too general"
  comment "too many false positives"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 520-5>
  active T
  comment "TFTP root directory"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/tftp.rules
</augment>

<augment 1870-5>
  active T
  comment "WEB-CGI siteUserMod.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1864-7>
  active T
  comment FTP SITE NEWER attempt
  comment "pcre: /^SITE\s+NEWER/smi"
  ftp "/((^)|(\n+))[sS][iI][tT][eE][\x20\x09\x0b]+[nN][eE][wW][eE][rR]/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[sS][iI][tT][eE].{1}.*[nN][eE][wW][eE][rR]/"
  </delete>
</augment>

<augment 1002-6>
  active T
  comment "WEB-IIS cmd.exe access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1823-7>
  active T
  dst-ip == local_nets
  http /.*[\/\\](af|alienform)\.cgi\?.*\.\|\./
  event "WEB-CGI AlienForm directory traversal attempt"
  comment "WEB-CGI AlienForm af.cgi directory traversal attempt"
  requires-reverse-signature ! http_error
  <delete>
  	event "WEB-CGI AlienForm af.cgi directory traversal attempt"
  	http /.*[\/\\]af\.cgi/
  	payload /.*\.\x7C\.\/\.\x7C\./
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1556-7>
  active T
  comment "WEB-CGI DCShop orders.txt access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2263-6>
  active T
  comment SMTP SAML FROM sendmail prescan too many addresses overflow
  comment "pcre: /^SAML FROM\x3a\s*[^\n]*?<[^\n]*?<[^\n]*?<[^ ..."
  payload "/((^)|(\n+))[sS][aA][mM][lL] [fF][rR][oO][mM]\x3a[\x20\x09\x0b]*[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?</"
  sigaction SIG_LOG
  requires-reverse-signature ! smtp_server_fail
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload /.*[sS][aA][mM][lL] [fF][rR][oO][mM]\x3A/
  </delete>
</augment>

<augment 974-10>
  active T
  comment "WEB-IIS Directory transversal attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 690-7>
  active T
  comment "MS-SQL/SMB xp_printstatements possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1929-5>
  active F
  comment "BACKDOOR TCPDUMP/PCAP trojan traffic"
  comment "Too general.  Ephemeral windows ports match this easily"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 2048-2>
  active T
  comment "MISC rsyncd overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 386-5>
  active F
  comment "ICMP Address Mask Reply"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1134-7>
  active T
  comment "WEB-PHP Phorum admin access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 374-7>
  active F
  comment "ICMP PING IP NetMonitor Macintosh"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 309-9>
  active T
  comment "EXPLOIT sniffit overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 637-3>
  active T
  comment "SCAN Webtrends Scanner UDP Probe"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 978-11>
  active T
  comment "WEB-IIS ASP contents view"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1151-5>
  active T
  comment "WEB-MISC Domino domcfg.nsf access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2311-7>
  active T
  comment "NETBIOS SMB-DS DCERPC Workstation Service bind attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1955-6>
  active T
  comment "RPC AMD TCP version request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 833-8>
  active T
  comment "WEB-CGI rguest.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 883-5>
  active T
  comment "WEB-CGI flexform access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 887-6>
  active T
  comment "WEB-CGI www-sql access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 588-17>
  active T
  comment "RPC portmap ttdbserv request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1952-5>
  active T
  comment "RPC mountd UDP mount request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 144-9>
  active T
  comment "FTP ADMw0rm ftp login attempt"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 1039-6>
  active T
  comment "WEB-IIS srch.htm access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1146-5>
  active T
  comment "WEB-MISC Ecommerce import.txt access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 121-5>
  active F
  comment "BACKDOOR Infector 1.6 Client to Server Connection Request"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 2119-5>
  active T
  comment IMAP rename literal overflow attempt
  comment  "pcre: /\sRENAME\s[^\n]*?\s\{/smi"
  payload "/((^)|(\n+))[\x20\x09\x0b][rR][eE][nN][aA][mM][eE][\x20\x09\x0b][^\n]*?[\x20\x09\x0b]\{/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/imap.rules
  <delete>
    payload "/.*[rR][eE][nN][aA][mM][eE]/"
  </delete>
</augment>

<augment 2424-3>
  active T
  comment NNTP sendsys overflow attempt
  comment "pcre: /^sendsys\x3a[^\n]{21}/smi"
  payload "/((^)|(\n+))[sS][eE][nN][dD][sS][yY][sS]\x3a[^\n]{21}/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/nntp.rules
  <delete>
    payload "/.*[sS][eE][nN][dD][sS][yY][sS]/"
  </delete>
</augment>

<augment 370-7>
  active F
  comment "ICMP PING BeOS4.x"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1050-7>
  active T
  comment "WEB-MISC iPlanet GETPROPERTIES attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 967-11>
  active T
  comment "WEB-FRONTPAGE dvwssr.dll access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1487-4>
  active T
  comment "WEB-IIS /iisadmpwd/aexp2.htr access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1861-7>
  active T
  comment "WEB-MISC Linksys router default username and password login attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2348-6>
  active T
  comment "NETBIOS SMB-DS DCERPC print spool bind attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1259-5>
  active T
  comment "WEB-MISC SWEditServlet access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1206-10>
  active T
  comment "WEB-CGI cachemgr.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1542-6>
  active T
  comment "WEB-CGI cgimail access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2560-2>
  active T
  comment "EXPLOIT Oracle Web Cache MOVE overflow attempt"
  comment pcre: /^MOVE[^s]{432}/sm
  payload /((^)|(\n+))MOVE[^s]{432}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
  <delete>
    payload /.*MOVE/
  </delete>
</augment>

<augment 944-6>
  active T
  comment "WEB-FRONTPAGE fpremadm.exe access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 110-4>
  active T
  comment "BACKDOOR netbus getinfo"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 2086-4>
  active T
  comment "WEB-CGI streaming server parse_xml.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1721-4>
  active T
  comment "WEB-CGI adcycle access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2477-3>
  active T
  comment "NETBIOS SMB-DS Create AndX Request winreg unicode attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1663-6>
  active T
  comment "WEB-MISC *%0a.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1764-6>
  active T
  comment "WEB-CGI Nortel Contivity cgiproc DOS attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1093-10>
  active T
  comment "WEB-CGI cached_feed.cgi moreover shopping cart directory traversal"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 264-6>
  active T
  comment "DNS EXPLOIT x86 Linux overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 1859-5>
  active T
  comment "WEB-MISC Sun JavaServer default password login attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 804-9>
  active T
  comment "WEB-CGI SWSoft ASPSeek Overflow attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1691-3>
  active T
  comment "ORACLE ALTER USER attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/oracle.rules
</augment>

<augment 718-7>
  active T
  comment "TELNET login incorrect"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/telnet.rules
</augment>

<augment 2464-6>
  active T
  comment "EXPLOIT EIGRP prefix length overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 448-7>
  active F
  comment "ICMP Source Quench undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1189-6>
  active T
  comment "WEB-MISC Netscape Enterprise Server directory view"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2248-3>
  active T
  comment "WEB-IIS DirectoryListing.asp access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2029-5>
  active T
  comment "RPC yppasswd new password overflow attempt UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 865-8>
  active T
  comment "WEB-CGI ksh access"
  requires-reverse-signature ! http_error
  requires-signature ! http_shell_check
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 921-7>
  active T
  comment "WEB-COLDFUSION admin encrypt attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 1205-6>
  active T
  comment "WEB-CGI axs.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 841-7>
  active T
  comment "WEB-CGI pfdisplay.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2021-4>
  active T
  comment "RPC mountd UDP unmount request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 219-6>
  active T
  comment "BACKDOOR HidePak backdoor attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 686-5>
  active T
  comment "MS-SQL xp_reg* - registry access"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1939-4>
  active T
  comment "MISC bootp hardware address length overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 638-5>
  active T
  comment "SHELLCODE SGI NOOP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 1828-6>
  active T
  comment "WEB-MISC iPlanet Search directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2136-2>
  active T
  comment "WEB-MISC philboard_admin.asp authentication bypass attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1645-6>
  active T
  comment "WEB-CGI testcgi access"
  dst-ip == local_nets
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 624-6>
  active F
  comment "SCAN SYN FIN"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 290-7>
  active T
  comment "POP3 EXPLOIT qpopper overflow"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/pop3.rules
</augment>

<augment 640-6>
  active T
  comment "SHELLCODE AIX NOOP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 1995-2>
  active T
  comment "WEB-CGI alya.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1411-10>
  active T
  comment "SNMP public access udp"
  requires-reverse-signature snmp_userver_ok_return
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/snmp.rules
</augment>

<augment 2456-3>
  active F
  comment "CHAT Yahoo IM file transfer request"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 1524-9>
  active T
  comment "WEB-MISC AxisStorpoint CD attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1661-4>
  active T
  comment "WEB-IIS cmd32.exe access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 809-11>
  active T
  comment "WEB-CGI whois_raw.cgi arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2386-6>
  active T
  comment "WEB-IIS NTLM ASN.1 vulnerability scan attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 272-7>
  active T
  comment "DOS IGMP dos attack"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 2301-4>
  active T
  comment "WEB-PHP Advanced Poll booth.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2334-2>
  active T
  comment FTP Yak! FTP server default account login attempt
  comment "pcre: /^USER\s+y049575046/smi"
  payload "/((^)|(\n+))USER[\x20\x09\x0b]+y049575046/"
  sigaction SIG_LOG
  requires-reverse-signature ! ftp_server_error
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[uU][sS][eE][rR]/"
    payload "/.*[yY]049575046/"
  </delete>
</augment>

<augment 1402-4>
  active T
  comment "WEB-IIS iissamples access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1243-11>
  active T
  comment "WEB-IIS ISAPI .ida attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 483-5>
  active F
  comment "ICMP PING CyberKit 2.2 Windows"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 480-5>
  active F
  comment "ICMP PING speedera"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 316-6>
  active T
  comment "EXPLOIT x86 Linux mountd overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 2536-3>
  active T
  comment "POP3 SSLv3 Server_Hello request"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/pop3.rules
</augment>

<augment 618-8>
  active F
  comment "SCAN Squid Proxy attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 1085-8>
  active T
  comment "WEB-PHP strings overflow"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2557-2>
  active T
  comment "EXPLOIT Oracle Web Cache LOCK overflow attempt"
  comment pcre: /^LOCK[^s]{432}/sm
  payload /((^)|(\n+))LOCK[^s]{432}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
  <delete>
    payload /.*LOCK/
  </delete>
</augment>

<augment 265-7>
  active T
  comment "DNS EXPLOIT x86 Linux overflow attempt ADMv2"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 2446-4>
  active T
  comment "EXPLOIT ICQ SRV_MULTI/SRV_META_USER email overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 2453-3>
  active F
  comment "CHAT Yahoo IM conference invitation"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 832-11>
  active T
  comment "WEB-CGI perl.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1587-12>
  active T
  comment "WEB-MISC cgitest.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1575-4>
  active T
  comment "WEB-MISC Domino mab.nsf access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1555-7>
  active T
  dst-ip == local_nets
  comment "WEB-CGI DCShop access"
  comment "only important if destination is local_nets"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 647-6>
  active T
  comment "SHELLCODE sparc setuid 0"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 2514-7>
  active T
  comment "NETBIOS SMB-DS DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1232-8>
  active T
  comment "WEB-MISC VirusWall catinfo access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1196-10>
  active T
  comment "WEB-CGI SGI InfoSearch fname attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1573-6>
  active T
  comment "WEB-CGI cgiforum.pl attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1989-4>
  active F
  comment "CHAT MSN file transfer reject"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 2505-7>
  active T
  comment "WEB-MISC SSLv3 invalid data version attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1594-10>
  active T
  comment "WEB-CGI FormHandler.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 551-7>
  active F
  comment "P2P napster download attempt"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/p2p.rules
</augment>

<augment 2080-6>
  active T
  comment "RPC portmap nlockmgr request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1987-6>
  active T
  comment "MISC xfs overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 699-7>
  active T
  comment "MS-SQL xp_printstatements possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 2459-3>
  active F
  comment "CHAT Yahoo IM webcam offer invitation"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 651-8>
  active T
  comment "SHELLCODE x86 stealth NOOP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 2486-5>
  active T
  comment "DOS ISAKMP invalid identification payload attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 2325-2>
  active T
  comment "WEB-IIS VP-ASP ShopDisplayProducts.asp access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1898-8>
  active T
  comment "EXPLOIT kadmind buffer overflow attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1215-6>
  active T
  comment "WEB-CGI ministats admin access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2545-4>
  active T
  comment "EXPLOIT AFP FPLoginExt username buffer overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1162-7>
  active T
  comment "WEB-MISC cart 32 AdminPwd access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 576-8>
  active T
  comment "RPC portmap amountd request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1714-4>
  active T
  comment "WEB-CGI newdesk access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 241-7>
  active T
  comment "DDOS shaft synflood"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 382-7>
  active F
  comment "ICMP PING Windows"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2235-5>
  active T
  comment "WEB-MISC SpamExcp.dll access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 821-12>
  active T
  comment "WEB-CGI imagemap.exe overflow attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2207-6>
  active T
  comment "WEB-CGI fileseek.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 364-7>
  active F
  comment "ICMP IRDP router selection"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 509-6>
  active T
  comment "WEB-MISC PCCS mysql database admin tool access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 825-6>
  active F
  comment "WEB-CGI glimpse access"
  comment "informational only"
  comment "old signature from 06-01-1999"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1443-4>
  active T
  comment "TFTP GET passwd"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/tftp.rules
</augment>

<augment 1228-6>
  active T
  comment "SCAN nmap XMAS"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 1460-5>
  active T
  comment "WEB-CGI bb-histsvc.sh access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2268-4>
  active T
  comment SMTP MAIL FROM sendmail prescan too long addresses overflow
  comment "pcre: /^MAIL FROM\x3a\s+[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}/smi"
  payload "/((^)|(\n+))[mM][aA][iI][lL] [fF][rR][oO][mM]:[\x20\x09\x0b]+[a-zA-Z0-9_\x20\x09\x0b@\.]{0,200}\x3b[a-zA-Z0-9_\x20\x09\x0b@\.]{200,}\x3b[a-zA-Z0-9_\x20\x09\x0b@\.]{0,200}/"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload /.*[mM][aA][iI][lL] [fF][rR][oO][mM]\x3A/
  </delete>
</augment>

<augment 916-7>
  active T
  comment "WEB-COLDFUSION getodbcdsn access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 1547-11>
  active T
  comment "WEB-CGI csSearch.cgi arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1845-15>
  active T
  comment IMAP list literal overflow attempt
  comment "pcre: /\sLIST\s[^\n]*?\s\{/smi"
  payload "/((^)|(\n+))[\x20\x09\x0b][lL][iI][sS][tT][\x20\x09\x0b][^\n]*?[\x20\x09\x0b]\{/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/imap.rules
  <delete>
    payload "/.*[lL][iI][sS][tT]/"
  </delete>
</augment>

<augment 708-8>
  active T
  comment "MS-SQL/SMB xp_enumresultset possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 276-5>
  active T
  comment "DOS Real Audio Server"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 1599-7>
  active T
  comment "WEB-CGI search.cgi access"
  http /.*[\/\\]search\.cgi\?.*letter\=[^\&]*?\.\.[\\\/]/
  <delete>
  	http /.*[\/\\]search\.cgi/
  </delete>
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2564-4>
  active T
  comment "NETBIOS NS lookup short response attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1105-5>
  active T
  comment "WEB-MISC BigBrother access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 680-6>
  active T
  comment "MS-SQL/SMB sa login failed"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1003-7>
  active T
  comment "WEB-IIS cmd? access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1356-5>
  active T
  comment "WEB-ATTACKS perl execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 2548-1>
  active T
  comment "MISC HP Web JetAdmin setinfo access"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 675-6>
  active T
  comment "MS-SQL xp_setsqlsecurity possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 2222-5>
  active T
  comment "WEB-CGI nph-exploitscanget.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2218-6>
  active T
  dst-ip == local_nets
  comment "WEB-CGI service.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1658-7>
  active T
  comment "WEB-CGI pagelog.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1256-8>
  active T
  comment "WEB-IIS CodeRed v2 root.exe access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1813-5>
  active T
  comment "ICMP digital island bandwidth query"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 2251-11>
  active T
  comment "NETBIOS DCERPC Remote Activation bind attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 422-7>
  active T
  comment "ICMP Mobile Registration Reply undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 973-10>
  active T
  comment "WEB-IIS *.idc attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1706-7>
  active T
  comment "WEB-CGI echo.bat access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1637-7>
  active F
  comment "WEB-CGI yabb access"
  comment "informational only"
  comment "old signature from 2000"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1748-7>
  active F
  comment "FTP command overflow attempt"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 868-9>
  active T
  comment "WEB-CGI rsh access"
  requires-reverse-signature ! http_error
  requires-signature ! http_shell_check
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 424-7>
  active T
  comment "ICMP Mobile Registration Request undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2085-4>
  active T
  comment "WEB-CGI parse_xml.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 619-5>
  active T
  comment "SCAN cybercop os probe"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 1732-9>
  active T
  comment "RPC portmap rwalld request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2403-4>
  active T
  comment "NETBIOS SMB Session Setup AndX request unicode username overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 610-5>
  active T
  comment "RSERVICES rsh root"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rservices.rules
</augment>

<augment 1021-11>
  active T
  comment "WEB-IIS ism.dll attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1307-9>
  active T
  dst-ip == local_nets
  comment "WEB-CGI store.cgi access"
  comment "verify application is not vulnerable"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 850-5>
  active T
  comment "WEB-CGI wais.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2392-4>
  active T
  comment FTP RETR overflow attempt
  comment "pcre: /^RETR\s[^\n]{100}/smi"
  eval dataSizeG100
  ftp "/((^)|(\n+))[rR][eE][tT][rR][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[rR][eE][tT][rR]/"
  </delete>
</augment>

<augment 1053-10>
  active T
  comment "WEB-CGI ads.cgi command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 920-7>
  active T
  comment "WEB-COLDFUSION datasource attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 1590-7>
  active T
  comment "WEB-CGI faqmanager.cgi arbitrary file access attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1755-14>
  active T
  comment IMAP partial body buffer overflow attempt
  comment pcre: /\sPARTIAL.*BODY\[[^\]]{1024}/smi
  payload "/((^)|(\n+))[\x20\x09\x0b][pP][aA][rR][tT][iI][aA][lL].*[bB][oO][dD][yY]\[[^\]]{1024}/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/imap.rules
  <delete>
    payload "/.*[pP][aA][rR][tT][iI][aA][lL].*.*[bB][oO][dD][yY]\[/"
  </delete>
</augment>

<augment 1852-3>
  active F
  comment "WEB-MISC robots.txt access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 924-7>
  active T
  comment "WEB-COLDFUSION admin decrypt attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 2225-1>
  active T
  comment "WEB-CGI gozila.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1125-8>
  active T
  comment "WEB-MISC webcart access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 612-6>
  active T
  comment "RPC rusers query UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 228-3>
  active T
  comment "DDOS TFN client command BE"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 1182-17>
  active T
  comment "WEB-MISC cgitest.exe attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 696-7>
  active T
  comment "MS-SQL/SMB xp_showcolv possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 356-5>
  active T
  comment "FTP passwd retrieval attempt"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  <delete>
  	payload /.*passwd/
  </delete>
  payload /[\x20\x09\x0b\/.]*passwd[\x20\x09\x0b]*$/
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 1251-6>
  active T
  comment "INFO TELNET Bad Login"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/info.rules
</augment>

<augment 704-6>
  active T
  comment "MS-SQL xp_sprintf possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 2145-3>
  active T
  comment "WEB-PHP TextPortal admin.php default password admin attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 239-2>
  active T
  comment "DDOS shaft handler to agent"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 1895-8>
  active T
  comment "EXPLOIT kadmind buffer overflow attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 2079-6>
  active T
  comment "RPC portmap nlockmgr request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 986-6>
  active T
  comment "WEB-IIS MSProxy access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 942-6>
  active T
  comment "WEB-FRONTPAGE orders.htm access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1458-6>
  active T
  comment "WEB-CGI user_update_passwd.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2217-6>
  active T
  comment "WEB-CGI printmail.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1752-4>
  active T
  comment "MISC AIM AddExternalApp attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 957-6>
  active T
  comment "WEB-FRONTPAGE registrations.txt access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 945-6>
  active T
  comment "WEB-FRONTPAGE fpadmin.htm access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1572-7>
  active T
  comment "WEB-CGI commerce.cgi arbitrary file access attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 261-6>
  active T
  comment "DNS EXPLOIT named overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 1068-6>
  active T
  comment "WEB-MISC tftp attempt"
  requires-reverse-signature ! http_error
  http /.*[tT][fF][tT][pP]\.[eE][xX][eE]/
  <delete>
  	payload /.*[tT][fF][tT][pP]\.[eE][xX][eE]/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1326-6>
  active T
  comment "EXPLOIT ssh CRC32 overflow NOOP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 2537-3>
  active T
  comment "POP3 SSLv3 invalid Client_Hello attempt"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/pop3.rules
</augment>

<augment 2438-3>
  active T
  comment "WEB-CLIENT RealPlayer playlist file URL overflow attempt"
  comment pcre: /^file\x3a\x2f\x2f[^\n]{400}/smi
  payload /((^)|(\n+))[fF][iI][lL][eE]\x3a\x2f\x2f[^\n]{400}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-client.rules
  <delete>
    payload /.*[fF][iI][lL][eE]\x3A\/\//
  </delete>
</augment>

<augment 580-9>
  active T
  comment "RPC portmap nisd request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2372-2>
  active F
  comment "WEB-PHP Photopost PHP Pro showphoto.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2441-3>
  active T
  comment WEB-MISC NetObserve authentication bypass attempt
  comment pcre: /^Cookie\x3a[^\n]*?login=0/smi
  http /((^)|(\n+))[cC][oO][oO][kK][iI][eE]\x3a[^\n]*?[lL][oO][gG][iI][nN]=0/
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
  <delete>
    payload /.*[lL][oO][gG][iI][nN]=0/
    payload /.*[cC][oO][oO][kK][iI][eE]\x3A/
  </delete>
</augment>

<augment 653-8>
  active T
  comment "SHELLCODE x86 unicode NOOP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 2418-3>
  active T
  comment "MISC MS Terminal Server no encryption session initiation attmept"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 1664-5>
  active T
  comment "WEB-MISC mkplog.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 221-3>
  active T
  comment "DDOS TFN Probe"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 2554-2>
  active T
  comment "EXPLOIT Oracle Web Cache POST overflow attempt"
  comment pcre: /^POST[^s]{432}/sm
  payload /((^)|(\n+))POST[^s]{432}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
  <delete>
    payload /.*POST/
  </delete>
</augment>

<augment 1986-4>
  active F
  comment "CHAT MSN file transfer request"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 2300-4>
  active T
  comment "WEB-PHP Advanced Poll admin_tpl_new.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1261-10>
  active T
  comment "EXPLOIT AIX pdnsd overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1531-6>
  active T
  comment "WEB-CGI bb-hist.sh attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 404-6>
  active F
  comment "ICMP Destination Unreachable Protocol Unreachable"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2115-2>
  active T
  comment "WEB-CGI album.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1598-7>
  active T
  comment "WEB-CGI Home Free search.cgi directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1700-8>
  active F
  comment "WEB-CGI imagemap.exe access"
  comment "informational only"
  comment "old signature from 10-22-1999"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1064-6>
  active T
  comment "WEB-MISC wsh attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1882-10>
  active T
  comment "ATTACK-RESPONSES id check returned userid"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/attack-responses.rules
</augment>

<augment 1412-13>
  active T
  comment "SNMP public access tcp"
  requires-reverse-signature snmp_userver_ok_return
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/snmp.rules
</augment>

<augment 2190-3>
  active T
  comment "NETBIOS DCERPC invalid bind attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 578-8>
  active T
  comment "RPC portmap cmsd request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1208-6>
  active T
  comment "WEB-CGI responder.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2524-7>
  active T
  comment "NETBIOS DCERPC LSASS direct bind attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 153-5>
  active T
  comment "BACKDOOR DonaldDick 1.53 Traffic"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 2495-5>
  active T
  comment "NETBIOS SMB DCEPRC ORPCThis request flood attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2053-2>
  active F
  comment "WEB-CGI proces_bug.cgi access"
  comment "informational only"
  comment "not exploit worthy"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2238-5>
  active T
  comment "WEB-MISC WebLogic ConsoleHelp view source attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2324-2>
  active T
  comment "WEB-IIS VP-ASP shopsearch.asp access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1409-10>
  active T
  comment "SNMP community string buffer overflow attempt"
  requires-reverse-signature snmp_userver_ok_return
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/snmp.rules
</augment>

<augment 2124-3>
  active T
  comment "BACKDOOR Remote PC Access connection attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1123-9>
  active T
  comment "WEB-MISC ?PageServices access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 591-10>
  active T
  comment "RPC portmap ypupdated request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2155-5>
  active T
  comment "WEB-PHP ttforum remote file include attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 357-5>
  active T
  comment "FTP piss scan"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 622-6>
  active T
  comment "SCAN ipEye SYN scan"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 643-7>
  active F
  comment "SHELLCODE HP-UX NOOP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 908-8>
  active T
  comment "WEB-COLDFUSION administrator access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 106-8>
  active T
  comment "BACKDOOR ACKcmdC trojan scan"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 716-10>
  active F
  comment "TELNET access"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/telnet.rules
</augment>

<augment 2401-4>
  active T
  comment "NETBIOS SMB Session Setup AndX request username overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1154-5>
  active T
  comment "WEB-MISC Domino names.nsf access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1046-6>
  active T
  comment "WEB-IIS site/iisamples access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2261-4>
  active T
  comment SMTP SEND FROM sendmail prescan too many addresses overflow
  comment "pcre: /^SEND FROM\x3a\s*[^\n]*?<[^\n]* ..."
  payload "/((^)|(\n+))[sS][eE][nN][dD] [fF][rR][oO][mM]\x3a[\x20\x09\x0b]*[^\n]*?<[^\n]*? <[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*? <[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*? <[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*? <[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*? <[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?</"
  sigaction SIG_LOG
  requires-reverse-signature ! smtp_server_fail
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload /.*[sS][eE][nN][dD] [fF][rR][oO][mM]\x3A/
  </delete>
</augment>

<augment 1998-4>
  active F
  comment "WEB-PHP calendar.php access"
  comment "informational only"
  comment "too general"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 390-5>
  active T
  comment "ICMP Alternate Host Address"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1515-9>
  active T
  comment "WEB-CGI input2.bat access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1734-16>
  active T
  comment FTP USER overflow attempt
  comment "pcre: /^USER\s[^\n]{100}/smi"
  eval dataSizeG100
  ftp "/((^)|(\n+))[uU][sS][eE][rR][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[uU][sS][eE][rR]/"
  </delete>
</augment>

<augment 2006-10>
  active T
  comment "RPC portmap kcms_server request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1080-13>
  active T
  comment "WEB-MISC unify eWave ServletExec upload"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2547-2>
  active T
  comment "MISC HP Web JetAdmin remote file upload attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 1041-6>
  active T
  comment "WEB-IIS uploadn.asp access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2210-5>
  active T
  comment "WEB-CGI global.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2183-5>
  active F
  comment "Sendmail SMTP Content-Transfer-Encoding overflow attempt"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
  comment "Fair amount of false positives, haven't found a way to fill this out to make it more accurate"
  comment "Released on 2003-03-30"
</augment>

<augment 1840-5>
  active T
  comment "WEB-CLIENT Javascript document.domain attempt"
  requires-signature http_msie_client
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-client.rules
</augment>

<augment 1351-5>
  active T
  comment "WEB-ATTACKS bin/tclsh execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 806-11>
  active T
  comment "WEB-CGI yabb directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1881-6>
  active T
  comment "WEB-MISC bad HTTP/1.1 request, Potential worm attack"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1372-5>
  active T
  comment "WEB-ATTACKS /etc/shadow access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
  comment "Many false positives are possible"
  payload /.*\/[eE][tT][cC]\/[sS][hH][aA][dD][oO][wW].{1,}root:.*:.*:.*:.*:.*:.*:/
  <delete>
  	payload /.*\/[eE][tT][cC]\/[sS][hH][aA][dD][oO][wW]/
  </delete>
</augment>

<augment 1418-11>
  active T
  comment "SNMP request tcp"
  requires-reverse-signature snmp_tserver_ok_return
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/snmp.rules
</augment>

<augment 2230-5>
  active T
  comment "WEB-MISC NetGear router default password login attempt admin/password"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1508-5>
  active T
  comment "WEB-CGI alibaba.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1760-3>
  active T
  comment "OTHER-IDS ISS RealSecure 6 event collector connection attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/other-ids.rules
</augment>

<augment 1043-7>
  active T
  comment "WEB-IIS viewcode.asp access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 678-6>
  active T
  comment "MS-SQL/SMB sp_delete_alert log file deletion"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 950-7>
  active T
  comment "WEB-FRONTPAGE cfgwiz.exe access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1042-8>
  active T
  comment "WEB-IIS view source via translate header"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1444-3>
  active T
  comment "TFTP Get"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/tftp.rules
</augment>

<augment 1582-4>
  active T
  comment "WEB-MISC Domino collect4.nsf access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1099-6>
  active T
  comment "WEB-MISC cybercop scan"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 614-7>
  active T
  comment "BACKDOOR hack-a-tack attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 2003-6>
  active F
  comment "MS-SQL Worm propagation attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1474-7>
  active T
  comment "WEB-CGI cal_make.pl access"
  requires-reverse-signature ! http_error
  http /.*[\/\\]cal_make\.pl(\.\.\/){2,}/
  <delete>
  	http /.*[\/\\]cal_make\.pl/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 689-6>
  active T
  comment "MS-SQL/SMB xp_reg* registry access"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 411-5>
  active F
  comment "ICMP IPV6 I-Am-Here"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2382-8>
  active T
  comment "NETBIOS SMB NTLMSSP invalid mechtype attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2402-5>
  active T
  comment "NETBIOS SMB-DS Session Setup AndX request username overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2573-1>
  active T
  comment "WEB-IIS SmarterTools SmarterMail frmCompose.asp access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1212-5>
  active T
  comment "WEB-MISC Admin_files access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2243-4>
  active T
  comment "WEB-MISC ndcgi.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 642-6>
  active T
  comment "SHELLCODE HP-UX NOOP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 2028-5>
  active T
  comment "RPC yppasswd old password overflow attempt TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1294-10>
  active T
  comment "NETBIOS nimda .nws"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1305-6>
  active T
  comment "WEB-CGI txt2html.cgi directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 882-5>
  active F
  comment "WEB-CGI calendar access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 994-7>
  active T
  comment "WEB-IIS /scripts/iisadmin/default.htm access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 906-7>
  active T
  comment "WEB-COLDFUSION getfile.cfm access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 1914-10>
  active T
  comment "RPC STATD TCP stat mon_name format string exploit attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1226-4>
  active T
  comment "X11 xopen"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/x11.rules
</augment>

<augment 605-6>
  active T
  comment "RSERVICES rlogin login failure"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rservices.rules
</augment>

<augment 685-5>
  active T
  comment "MS-SQL sp_adduser - database user creation"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1740-5>
  active T
  comment "WEB-PHP DNSTools authentication bypass attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2318-3>
  active T
  comment MISC CVS non-relative path access attempt
  comment "pcre: m?^Argument\s+/?smi,/^Directory/smiR"
  payload "/((^)|(\n+))[aA][Rr][Gg][Uu}[Mm][Ee][Nn][Tt][\x20\x09\x0b]]+/"
  payload "/.*[Dd][Ii][Rr][Ee][Cc][Tt][Oo][Rr][Yy]/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
  <delete>
    payload "/.*Argument/"
  </delete>
</augment>

<augment 185-5>
  active T
  comment "BACKDOOR CDK"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1940-3>
  active T
  comment "MISC bootp invalid hardware type"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 152-6>
  active T
  comment "BACKDOOR BackConstruction 2.1 Connection"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 623-5>
  active F
  comment "SCAN NULL"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 1276-14>
  active T
  comment "RPC portmap ypserv request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 141-5>
  active F
  comment "BACKDOOR HackAttack 1.20 Connect"
  comment "too many false positives as this is in the Linux ephemeral range"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1415-9>
  active T
  comment "SNMP Broadcast request"
  requires-reverse-signature snmp_userver_ok_return
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/snmp.rules
</augment>

<augment 1770-3>
  active T
  comment "WEB-MISC .FBCIndex access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1639-6>
  active T
  comment "CHAT IRC DCC file transfer request"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 1272-10>
  active T
  comment "RPC portmap sadmind request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1640-6>
  active T
  comment "CHAT IRC DCC chat request"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 698-8>
  active T
  comment "MS-SQL/SMB xp_proxiedmetadata possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 2413-7>
  active T
  comment "EXPLOIT ISAKMP delete hash with empty hash attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1430-7>
  active T
  comment "TELNET Solaris memory mismanagement exploit attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/telnet.rules
</augment>

<augment 2200-6>
  active T
  comment "WEB-CGI dnewsweb.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1088-9>
  active T
  dst-ip == local_nets
  comment "WEB-CGI eXtropia webstore directory traversal"
  requires-reverse-signature ! http_error
  <delete>
  	http /.*[\/\\]web_store\.cgi/
  	payload /.*page=\.\.\//
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1263-11>
  active T
  comment "RPC portmap amountd request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 354-5>
  active T
  comment "FTP iss scan"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 1766-7>
  active T
  comment "WEB-MISC search.dll directory listing attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1363-5>
  active T
  comment "WEB-ATTACKS X application to remote host attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1386-8>
  active T
  comment "MS-SQL/SMB raiserror possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 2211-5>
  active T
  comment "WEB-CGI guestserver.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 827-7>
  active T
  comment "WEB-CGI info2www access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1595-10>
  active T
  comment "WEB-IIS htimage.exe access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1194-8>
  active T
  comment "WEB-CGI sojourn.cgi File attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 608-5>
  active T
  comment "RSERVICES rsh echo + +"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rservices.rules
</augment>

<augment 481-5>
  active T
  comment "ICMP TJPingPro1.1Build 2 Windows"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 939-6>
  active T
  comment "WEB-FRONTPAGE posting"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1610-11>
  active T
  comment "WEB-CGI formmail arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
  http /.*[\/\\]formmail{0,5}\?/
  <delete>
  	http /.*[\/\\]formmail/
  </delete>
</augment>

<augment 2061-4>
  active T
  comment "WEB-MISC Tomcat null byte directory listing attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 817-10>
  active T
  comment "WEB-CGI dcboard.cgi invalid user addition attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 501-4>
  active T
  comment "MISC source route lssre"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 388-5>
  active T
  comment "ICMP Address Mask Request"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 625-6>
  active F
  comment "SCAN XMAS"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 1193-10>
  active T
  comment "WEB-MISC oracle web arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1545-7>
  active T
  comment "DOS Cisco attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 2458-3>
  active F
  comment "CHAT Yahoo IM successful chat join"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 232-5>
  active T
  comment "DDOS Trin00 Daemon to Master *HELLO* message detected"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 1062-6>
  active T
  comment "WEB-MISC nc.exe attempt"
  comment "sig too general - add some clarity.  remove if noise continues"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
  http /.*[nN][cC]\.[eE][xX][eE]\x20.{5}/
  <delete>
	payload /.*[nN][cC]\.[eE][xX][eE]/
  </delete>
</augment>

<augment 935-6>
  active T
  comment "WEB-COLDFUSION startstop DOS access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 2376-3>
  active T
  comment "EXPLOIT ISAKMP first payload certificate request length overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 2180-2>
  active F
  comment "P2P BitTorrent announce request"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/p2p.rules
</augment>

<augment 2443-4>
  active T
  comment "EXPLOIT ICQ SRV_MULTI/SRV_META_USER first name overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1856-7>
  active T
  comment "DDOS Stacheldraht handler->agent ficken"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 1254-8>
  active T
  comment "WEB-PHP PHPLIB remote command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1536-8>
  active T
  comment "WEB-CGI calendar_admin.pl arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1224-10>
  active T
  comment "WEB-MISC ROADS search.pl attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 853-9>
  active F
  comment "WEB-CGI wrap access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
  comment "informational only"
</augment>

<augment 1433-5>
  active T
  comment "WEB-MISC .history access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1157-7>
  active T
  comment "WEB-MISC Netscape PublishingXpert access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1269-10>
  active T
  comment "RPC portmap rexd request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1048-9>
  active T
  comment "WEB-MISC Netscape Enterprise directory listing attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 145-5>
  active T
  comment "BACKDOOR GirlFriendaccess"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 641-6>
  active T
  comment "SHELLCODE Digital UNIX NOOP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 1394-5>
  active T
  comment "SHELLCODE x86 NOOP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 2572-2>
  active T
  comment "WEB-IIS SmarterTools SmarterMail login.aspx buffer overflow attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1814-6>
  active T
  comment "WEB-MISC CISCO VoIP DOS ATTEMPT"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1343-5>
  active T
  comment "WEB-ATTACKS /usr/bin/cc command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 184-6>
  active F
  comment "BACKDOOR Q access"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 2227-2>
  active T
  comment "WEB-PHP forum_details.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1843-6>
  active T
  comment "BACKDOOR trinity connection attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 446-7>
  active T
  comment "ICMP SKIP undefined code"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2196-6>
  active F
  comment "WEB-CGI catgy.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1534-8>
  active T
  comment "WEB-CGI agora.cgi attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1958-5>
  active T
  comment "RPC sadmind TCP PING"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 104-7>
  active T
  comment "BACKDOOR - Dagger_1.4.0_client_connect"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 2015-5>
  active T
  comment "RPC portmap UNSET attempt UDP 111"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1710-4>
  active T
  comment "WEB-CGI bbs_forum.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 519-6>
  active T
  comment "TFTP parent directory"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/tftp.rules
</augment>

<augment 1344-5>
  active T
  comment "WEB-ATTACKS cc command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1792-8>
  active T
  comment NNTP return code buffer overflow attempt
  comment "pcre: /^200\s[^\n]{64}/smi"
  payload "/((^)|(\n+))200[\x20\x09\x0b][^\n]{64}/"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/nntp.rules
  <delete>
   payload "/.*200/"
  </delete>
</augment>

<augment 2481-3>
  active T
  comment "NETBIOS SMB-DS DCERPC shutdown unicode little endian attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2467-3>
  active T
  comment "NETBIOS SMB D$ share unicode access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 429-6>
  active T
  comment "ICMP Photuris Reserved"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1338-6>
  active T
  comment "WEB-ATTACKS chown command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
  http /.*\/[cC][hH][oO][wW][nN]([^-a-zA-Z0-9_.]|$)/
  <delete>
  	payload /.*\/[cC][hH][oO][wW][nN]/
  </delete>
</augment>

<augment 445-5>
  active T
  comment "ICMP SKIP"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1511-9>
  active T
  comment "WEB-CGI test.bat access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1214-5>
  active F
  comment "WEB-MISC intranet access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1222-9>
  active T
  comment "WEB-CGI pals-cgi arbitrary file access attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1860-4>
  active T
  comment "WEB-MISC Linksys router default password login attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1303-7>
  active T
  comment "WEB-MISC cs.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2049-2>
  active F
  comment "MS-SQL ping attempt"
  src-port != 53
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
  comment Informational only
</augment>

<augment 1422-10>
  active T
  comment "SNMP community string buffer overflow attempt with evasion"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/snmp.rules
</augment>

<augment 1932-3>
  active T
  comment "WEB-CGI rpc-smb.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1455-5>
  active F
  comment "WEB-CGI calender.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 292-8>
  active T
  comment "EXPLOIT x86 Linux samba overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1678-5>
  active T
  comment "ORACLE select like '%' attempt backslash escaped"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/oracle.rules
</augment>

<augment 157-5>
  active T
  comment "BACKDOOR BackConstruction 2.1 Client FTP Open Request"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1633-6>
  active F
  comment "CHAT AIM receive message"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 244-3>
  active T
  comment "DDOS mstream handler to agent"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 1350-5>
  active F
  comment "WEB-ATTACKS python access attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1327-7>
  active T
  comment "EXPLOIT ssh CRC32 overflow"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 391-8>
  active T
  comment "ICMP Alternate Host Address undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 844-7>
  active T
  comment "WEB-CGI args.bat access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2379-3>
  active T
  comment "EXPLOIT ISAKMP forth payload certificate request length overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 358-5>
  active T
  comment "FTP saint scan"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 719-7>
  active T
  comment "TELNET root login"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/telnet.rules
</augment>

<augment 460-7>
  active T
  comment "ICMP unassigned type 2"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1330-5>
  active T
  comment "WEB-ATTACKS wget command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
  comment "would like to inspect contents of reply"
</augment>

<augment 2414-7>
  active T
  comment "EXPLOIT ISAKMP initial contact notification without SPI attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1893-4>
  active F
  comment "SNMP missing community string attempt"
  comment "this is related to NT 4.0 unpatched < sp 4, circa '99"
  requires-reverse-signature snmp_userver_ok_return
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/snmp.rules
</augment>

<augment 2093-5>
  active T
  comment "RPC portmap proxy integer overflow attempt TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2241-5>
  active T
  comment "WEB-MISC cwmail.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1903-8>
  active T
  comment IMAP rename overflow attempt
  comment "pcre: /\sRENAME\s[^\n]{100}/smi"
  payload "/((^)|(\n+))[\x20\x09\x0b][rR][eE][nN][aA][mM][eE][\x20\x09\x0b][^\n]{100}/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/imap.rules
  <delete>
    payload "/.*[rR][eE][nN][aA][mM][eE]/"
  </delete>
</augment>

<augment 2555-2>
  active T
  comment "EXPLOIT Oracle Web Cache TRACE overflow attempt"
  comment pcre: /^TRACE[^s]{432}/sm
  payload /((^)|(\n+))TRACE[^s]{432}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
  <delete>
    payload /.*TRACE/
  </delete>
</augment>

<augment 961-6>
  active T
  comment "WEB-FRONTPAGE services.cnf access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1186-6>
  active T
  comment "WEB-MISC Netscape Enterprise Server directory view"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2546-1>
  active T
  comment "FTP MDTM overflow attempt"
  comment pcre: /^MDTM\s[^\n]{100}/smi
  payload /((^)|(\n+))[mM][dD][tT][mM][\x20\x09\x0b][^\n]{100}/
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload /.*[mM][dD][tT][mM]/
  </delete>
</augment>

<augment 1873-4>
  active T
  comment "WEB-MISC globals.jsa access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 253-4>
  active T
  comment "DNS SPOOF query response PTR with TTL of 1 min. and no authority"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 313-4>
  active T
  comment "EXPLOIT ntalkd x86 Linux overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 2051-3>
  active T
  comment "WEB-CGI cached_feed.cgi moreover shopping cart access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1725-6>
  active T
  comment "WEB-IIS +.htr code fragment attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1309-9>
  active T
  comment "WEB-CGI zsh access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1221-6>
  active T
  comment "WEB-MISC musicat empower access"
  requires-reverse-signature ! http_error
  http /.*[\/\\]empower\?DB=.{1,}/
  <delete>
  	http /.*[\/\\]empower/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1617-8>
  active T
  comment "WEB-CGI Bugzilla doeditvotes.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1091-7>
  active F
  comment "WEB-MISC ICQ Webfront HTTP DOS"
  comment "too general"
  comment "too many false positives"
  comment "exploit from year 2000"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1733-9>
  active T
  comment "RPC portmap rwalld request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1113-5>
  active T
  comment "WEB-MISC http directory traversal"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2050-5>
  active T
  comment "MS-SQL version overflow attempt"
  sigaction SIG_FILE
  # sigaction SIG_SUMMARY
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1535-7>
  active T
  comment "WEB-CGI bizdbsearch access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1776-2>
  active T
  comment "MYSQL show databases attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/mysql.rules
</augment>

<augment 603-5>
  active T
  comment "RSERVICES rlogin echo++"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rservices.rules
</augment>

<augment 1291-8>
  active T
  comment "WEB-MISC sml3com access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 485-4>
  active F
  comment "ICMP Destination Unreachable Communication Administratively Prohibited"
  sigaction SIG_FILE
  # sigaction SIG_SUMMARY
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 1280-9>
  active T
  comment "RPC portmap listing UDP 111"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1242-10>
  active T
  comment "WEB-IIS ISAPI .ida access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1889-5>
  active T
  comment "MISC slapper worm admin traffic"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 870-5>
  active T
  comment "WEB-CGI snorkerz.cmd access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1353-5>
  active T
  comment "WEB-ATTACKS bin/nasm command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1233-9>
  active F
  comment "WEB-CLIENT Outlook EML access"
  comment "too general"
  comment "not an exploit"
  requires-signature http_msie_client
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-client.rules
</augment>

<augment 2277-4>
  active T
  comment "WEB-MISC PeopleSoft PeopleBooks psdoccgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1922-6>
  active T
  comment "RPC portmap proxy attempt TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1644-8>
  active T
  comment "WEB-CGI test-cgi attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2425-3>
  active T
  comment NNTP senduuname overflow attempt
  comment pcre: /^senduuname\x3a[^\n]{21}/smi
  payload /((^)|(\n+))[sS][eE][nN][dD][uU][uU][nN][aA][mM][eE]\x3a[^\n]{21}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/nntp.rules
  <delete>
    payload /.*[sS][eE][nN][dD][uU][uU][nN][aA][mM][eE]/
  </delete>
</augment>

<augment 582-8>
  active T
  comment "RPC portmap rexd request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 952-6>
  active T
  comment "WEB-FRONTPAGE author.exe access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1709-4>
  active F
  comment "WEB-CGI ad.cgi access"
  comment "rule too general, no details provided to fix"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2047-2>
  active F
  comment "MISC rsyncd module list access"
  comment "informational only, not exploit worthy"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 911-7>
  active T
  comment "WEB-COLDFUSION exprcalc access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 2219-6>
  active T
  comment "WEB-CGI setpasswd.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1543-12>
  active F
  comment "WEB-CGI cgiwrap access"
  comment "too general to be useful"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1454-6>
  active T
  comment "WEB-CGI wwwwais access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 452-7>
  active F
  comment "ICMP Timestamp Reply undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2561-2>
  active T
  comment "MISC rsync backup-dir directory traversal attempt"
  comment pcre: /--backup-dir\s+\x2e\x2e\x2f/
  payload /--backup-dir[\x20\x09\x0b]+\x2e\x2e\x2f/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
  <delete>
    payload /.*--backup-dir/
  </delete>
</augment>

<augment 1216-5>
  active T
  comment "WEB-MISC filemail access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2390-4>
  active T
  comment FTP STOU overflow attempt
  comment pcre: /^STOU\s[^\n]{100}/smi
  eval dataSizeG100
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  payload /((^)|(\n+))[sS][tT][oO][uU][\x20\x09\x0b][^\n]{100}/
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload /.*[sS][tT][oO][uU]/
  </delete>
</augment>

<augment 491-8>
  active T
  comment "INFO FTP Bad login"
  comment pcre: /^530\s+(Login|User)/smi
  ftp /((^)|(\n+))530[\x20\x09\x0b]+([lL][oO][gG][iI][nN]|[uU][sS][eE][rR])/
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/info.rules
  <delete>
    payload /.*530 /
  </delete>
</augment>

<augment 246-2>
  active T
  comment "DDOS mstream agent pong to handler"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 324-5>
  active T
  comment "FINGER null request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/finger.rules
</augment>

<augment 2440-3>
  active T
  comment "WEB-CLIENT RealPlayer playlist rtsp URL overflow attempt"
  comment pcre: /^http\x3a\x2f\x2f[^\n]{400}/smi
  payload /((^)|(\n+))[hH][tT]{2}[pP]\x3a\x2f\x2f[^\n]{400}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-client.rules
</augment>

<augment 881-5>
  active T
  comment "WEB-CGI archie access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 829-9>
  active T
  comment "WEB-CGI nph-test-cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 330-9>
  active T
  comment "FINGER redirection attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/finger.rules
</augment>

<augment 981-9>
  active T
  comment "WEB-IIS unicode directory traversal attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 847-7>
  active T
  comment "WEB-CGI campas access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1132-6>
  active T
  comment "WEB-MISC Netscape Unixware overflow"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2534-3>
  active T
  comment "MISC LDAP SSLv3 invalid Client_Hello attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 227-6>
  active T
  comment "DDOS Stacheldraht client spoofworks"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 1902-9>
  active T
  comment "IMAP lsub literal overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/imap.rules
  payload /((^)|(\n+))[\x20\x09\x0b][lL][sS][uU][bB][\x20\x09\x0b][^\n]*?[\x20\x09\x0b]\{/
 <delete>
	payload /.*[lL][sS][uU][bB]/
 </delete>
</augment>

<augment 1648-7>
  active T
  comment "WEB-CGI perl.exe command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1965-8>
  active T
  comment "RPC tooltalk TCP overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1723-7>
  active T
  comment "WEB-CGI emumail.cgi NULL attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1147-7>
  active T
  comment "WEB-MISC cat%20 access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2240-3>
  active T
  comment "WEB-MISC changepw.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1825-6>
  active F
  dst-ip == local_nets
  comment "WEB-CGI AlienForm af.cgi access"
  comment "informational only"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1529-10>
  active T
  comment FTP SITE overflow attempt
  comment "pcre: /^SITE\s[^\n]{100}/smi"
  eval dataSizeG100
  ftp "/((^)|(\n+))[sS][iI][tT][eE][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[sS][iI][tT][eE]/"
  </delete>
</augment>

<augment 486-4>
  active F
  comment "ICMP Destination Unreachable Communication with Destination Host is Administratively Prohibited"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 1459-5>
  active T
  comment "WEB-CGI bb-histlog.sh access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2213-6>
  active T
  comment "WEB-CGI mailfile.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 474-4>
  active F
  comment "ICMP superscan echo"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 1383-6>
  active F
  comment "P2P Fastrack kazaa/morpheus GET request"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/p2p.rules
</augment>

<augment 2032-5>
  active T
  comment "RPC yppasswd user update TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1267-11>
  active T
  comment "RPC portmap nisd request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2308-6>
  active T
  comment "NETBIOS SMB DCERPC Workstation Service unicode bind attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 268-4>
  active T
  comment "DOS Jolt attack"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 1072-9>
  active T
  comment "WEB-MISC Lotus Domino directory traversal"
  requires-reverse-signature ! http_error
  http /.*\.nsf[\/\\].*(\.\.\/){1,}.{2,}/
  <delete>
  	http /.*\.nsf[\/\\]/
  	http /.*\.\.[\/\\]/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 613-5>
  active F
  comment "SCAN myscan"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 251-3>
  active T
  comment "DDOS - TFN client command LE"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 400-7>
  active F
  comment "ICMP Destination Unreachable Network Unreachable for Type of Service"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1124-5>
  active F
  comment "WEB-MISC Ecommerce check.txt access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1805-4>
  active T
  comment "WEB-CGI Oracle reports CGI access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 889-7>
  active T
  comment "WEB-CGI ppdscgi.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 432-6>
  active T
  comment "ICMP Photuris Valid Security Parameters, But Decryption Failed"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1862-7>
  active T
  comment "WEB-CGI mrtg.cgi directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2473-3>
  active T
  comment "NETBIOS SMB ADMIN$ share unicode access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 437-6>
  active F
  comment "ICMP Redirect for TOS and Network"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 904-7>
  active T
  comment "WEB-COLDFUSION exampleapp application.cfm"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 1930-3>
  active T
  comment "IMAP auth literal overflow attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/imap.rules
</augment>

<augment 230-5>
  active T
  comment "DDOS shaft client login to handler"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 583-9>
  active T
  comment "RPC portmap rstatd request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 837-8>
  active T
  comment "WEB-CGI uploader.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1485-4>
  active T
  comment "WEB-IIS mkilog.exe access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 536-7>
  active T
  comment "NETBIOS SMB D$ share access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1161-9>
  active T
  comment "WEB-PHP piranha passwd.php3 access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 648-7>
  active T
  comment "SHELLCODE x86 NOOP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 1301-11>
  active T
  comment "WEB-PHP admin.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 713-7>
  active F
  comment "TELNET livingston DOS"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/telnet.rules
</augment>

<augment 1286-6>
  active T
  comment "WEB-IIS _mem_bin access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1554-9>
  active T
  dst-ip == local_nets
  comment "WEB-CGI dbman db.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1909-10>
  active T
  comment "RPC CMSD TCP CMSD_INSERT buffer overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 286-9>
  active T
  comment "POP3 EXPLOIT x86 BSD overflow"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/pop3.rules
</augment>

<augment 1816-3>
  active T
  comment "WEB-PHP directory.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  <delete>
  	http /.*[\/\\]directory\.php/
  </delete>
  http /.*[\/\\]directory\.php[\;\|]{1,}/
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 421-5>
  active T
  comment "ICMP Mobile Registration Reply"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1366-5>
  active T
  comment "WEB-ATTACKS mail command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 409-7>
  active F
  comment "ICMP Echo Reply undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2271-2>
  active T
  comment "BACKDOOR FsSniffer connection attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1509-9>
  active T
  comment "WEB-CGI AltaVista Intranet Search directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1202-5>
  active T
  comment "WEB-MISC search.vts access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2426-3>
  active T
  comment NNTP version overflow attempt
  comment "pcre: /^version\x3a[^\n]{21}/smi"
  payload "/((^)|(\n+))[vV][eE][rR][sS][iI][oO][nN]\x3a[^\n]{21}/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/nntp.rules
  <delete>
    payload "/.*[vV][eE][rR][sS][iI][oO][nN]/"
  </delete>
</augment>

<augment 1225-4>
  active T
  comment "X11 MIT Magic Cookie detected"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/x11.rules
</augment>

<augment 1994-3>
  active T
  comment "WEB-CGI vpasswd.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 538-10>
  active T
  comment "NETBIOS SMB IPC$ share unicode access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2034-7>
  active T
  comment "RPC ypserv maplist request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2138-2>
  active T
  comment "WEB-MISC logicworks.ini access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1355-5>
  active T
  comment "WEB-ATTACKS /usr/bin/perl execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 2022-4>
  active T
  comment "RPC mountd TCP unmountall request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1708-7>
  active T
  comment "WEB-CGI hello.bat access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 454-7>
  active F
  comment "ICMP Timestamp Request undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2279-2>
  active T
  comment "WEB-PHP UpdateClasses.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 684-5>
  active T
  comment "MS-SQL sp_delete_alert log file deletion"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 922-6>
  active T
  comment "WEB-COLDFUSION displayfile access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 1954-5>
  active T
  comment "RPC AMD UDP pid request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 323-5>
  active T
  comment "FINGER root query"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/finger.rules
</augment>

<augment 2430-3>
  active T
  comment NNTP newgroup overflow attempt
  comment "pcre: /^newgroup\x3a[^\n]{21}/smi"
  payload "/((^)|(\n+))[nN][eE][wW][gG][rR][oO][uU][pP]\x3a[^\n]{21}/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/nntp.rules
  <delete>
    payload "/.*[nN][eE][wW][gG][rR][oO][uU][pP]/"
  </delete>
</augment>

<augment 2432-2>
  active F
  comment "NNTP article post without path attempt"
  comment pcre: ! /^takethis.*?Path\x3a.*?[\r]{0,1}?\n[\r]{0,1}\n/si
  comment Negation of a pattern is not supported
  payload /((^)|(\n+))[tT][aA][kK][eE][tT][hH][iI][sS].*?[pP][aA][tT][hH]\x3a.*?[\r]{0,1}?\n[\r]{0,1}\n/
  sigaction SIG_LOG
  snort-rule-file snort_rules2.2/nntp.rules
  <delete>
    payload /.*[tT][aA][kK][eE][tT][hH][iI][sS]/
  </delete>
</augment>

<augment 903-7>
  active T
  comment "WEB-COLDFUSION cfcache.map access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 2460-3>
  active F
  comment CHAT Yahoo IM webcam request
  comment "informational only"
  comment pcre translate
  payload "/((^)|(\n+))\x3c([rR][eE][qQ][iI][mM][gG]|[rR][vV][wW][cC][fF][gG])\x3e/"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 1097-6>
  active T
  comment "WEB-CGI Talentsoft Web+ exploit attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 406-6>
  active F
  comment "ICMP Destination Unreachable Source Route Failed"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 550-8>
  active F
  comment "P2P napster new user login"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/p2p.rules
</augment>

<augment 1371-5>
  active F
  comment "WEB-ATTACKS /etc/motd access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
  comment "informational only"
</augment>

<augment 943-6>
  active T
  comment "WEB-FRONTPAGE fpsrvadm.exe access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 852-8>
  active T
  comment "WEB-CGI wguest.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 306-9>
  active F
  comment "EXPLOIT VQServer admin"
  comment Too many false positives!!!!!!!!!!!!!!
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 399-6>
  active F
  comment "ICMP Destination Unreachable Host Unreachable"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 891-5>
  active T
  comment "WEB-CGI upload.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1396-8>
  active T
  comment "WEB-CGI zml.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 691-5>
  active T
  comment "MS-SQL shellcode attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1255-8>
  active T
  comment "WEB-PHP PHPLIB remote command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 910-5>
  active T
  comment "WEB-COLDFUSION fileexists.cfm access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 2122-7>
  active T
  comment POP3 UIDL negative arguement attempt
  comment "pcre: /^UIDL\s+-\d/smi"
  payload "/((^)|(\n+))[uU][iI][dD][lL][\x20\x09\x0b]+-[0-9]/"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/pop3.rules
  <delete>
    payload "/.*[uU][iI][dD][lL]/"
  </delete>
</augment>

<augment 1414-11>
  active T
  comment "SNMP private access tcp"
  requires-reverse-signature snmp_tserver_ok_return
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/snmp.rules
</augment>

<augment 1288-6>
  active T
  comment "WEB-FRONTPAGE /_vti_bin/ access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1354-5>
  active T
  comment "WEB-ATTACKS nasm command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 307-9>
  active T
  comment "EXPLOIT CHAT IRC topic overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1962-7>
  active T
  comment "RPC portmap RQUOTA request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2199-6>
  active T
  comment "WEB-CGI multidiff.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1037-10>
  active T
  dst-ip == local_nets
  comment "WEB-IIS showcode.asp access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 463-7>
  active T
  comment "ICMP unassigned type 7 undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1510-9>
  active T
  comment "WEB-CGI test.bat arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 487-4>
  active F
  comment "ICMP Destination Unreachable Communication with Destination Network is Administratively Prohibited"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 1365-5>
  active T
  comment "WEB-ATTACKS rm command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1576-4>
  active T
  comment "WEB-MISC Domino cersvr.nsf access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1038-8>
  active T
  comment "WEB-IIS site server config access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 377-7>
  active T
  comment "ICMP PING Network Toolbox 3 Windows"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 433-8>
  active T
  comment "ICMP Photuris undefined code!"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2502-7>
  active T
  comment "POP3 SSLv3 invalid data version attempt"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/pop3.rules
</augment>

<augment 2375-3>
  active T
  comment "BACKDOOR DoomJuice file upload attempt"
  payload /^\x85\x13<\x9E\xA2/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
  <delete>
    payload /\x85\x13<\x9E\xA2/
  </delete>
</augment>

<augment 1589-4>
  active T
  comment "WEB-MISC musicat empower attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2233-5>
  active T
  comment "WEB-MISC SFNofitication.dll access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1370-5>
  active T
  comment "WEB-ATTACKS /etc/inetd.conf access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1651-4>
  active T
  comment "WEB-CGI enivorn.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1369-5>
  active T
  comment "WEB-ATTACKS /bin/ls command attempt"
  requires-reverse-signature ! http_error
  http /.*[\/\\]bin[\/\\]ls[^a-zA-Z0-9_.-]/
  <delete>
  	http /.*[\/\\]bin[\/\\]ls/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1468-7>
  active T
  comment "WEB-CGI Web Shopper shopper.cgi attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2565-1>
  active T
  comment "WEB-PHP modules.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 626-7>
  active T
  comment "SCAN cybercop os PA12 attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 1956-5>
  active F
  comment "RPC AMD UDP version request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2480-3>
  active T
  comment "NETBIOS SMB-DS DCERPC shutdown unicode attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 897-10>
  active T
  comment "WEB-CGI pals-cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1158-10>
  active T
  comment "WEB-MISC windmail.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 664-13>
  active T
  comment SMTP RCPT TO decode attempt
  comment "pcre: /^rcpt to\:\s+decode/smi"
  payload "/((^)|(\n+))[rR][cC][pP][tT][\x20\x09\x0b][tT][oO]:[\x20\x09\x0b]+[dD][eE][cC][oO][dD][eE]/"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload /.*rcpt to\x3A.*.*[dD][eE][cC][oO][dD][eE]/
  </delete>
</augment>

<augment 2395-3>
  active T
  comment "WEB-MISC InteractiveQuery.jsp access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 877-8>
  active T
  comment "WEB-CGI rksh access"
  requires-reverse-signature ! http_error
  requires-signature ! http_shell_check
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 585-7>
  active T
  comment "RPC portmap sadmind request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2368-4>
  active T
  comment "WEB-PHP PhpGedView PGV config_gedcom.php base directory manipulation attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1512-9>
  active T
  comment "WEB-CGI input.bat arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1470-5>
  active T
  comment "WEB-CGI listrec.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2500-4>
  active T
  comment "MISC LDAP SSLv3 invalid data version attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 245-3>
  active T
  comment "DDOS mstream handler ping to agent"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 1407-8>
  active T
  comment "WEB-PHP smssend.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1331-5>
  active T
  comment "WEB-ATTACKS uname -a command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 2457-2>
  active F
  comment "CHAT Yahoo IM message"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 2550-2>
  active T
  comment "EXPLOIT winamp XM module name overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1809-9>
  active T
  comment "WEB-MISC Apache Chunked-Encoding worm attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1483-9>
  active T
  comment "WEB-CGI ustorekeeper.pl access"
  dst-ip == local_nets
  requires-reverse-signature ! http_error
  comment "informational only"
  comment "verify that application is not vulnerable"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1614-8>
  active T
  comment "WEB-MISC Novell Groupwise gwweb.exe attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1480-9>
  active T
  comment "WEB-CGI ttawebtop.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 670-7>
  active T
  comment "SMTP sendmail 8.6.9 exploit"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 1248-13>
  active T
  comment "WEB-FRONTPAGE rad fp30reg.dll access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 2130-5>
  active T
  comment "WEB-IIS IISProtect siteadmin.asp access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1380-4>
  active T
  comment "WEB-IIS cross-site scripting attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1337-6>
  active T
  comment "WEB-ATTACKS chgrp command attempt"
  requires-reverse-signature ! http_error
  http /.*\/[cC][hH][gG][rR][pP]([^-a-zA-Z0-9_.]|$)/
  <delete>
  	payload /.*\/[cC][hH][gG][rR][pP]/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 2451-3>
  active F
  comment "CHAT Yahoo IM voicechat"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 928-5>
  active T
  comment "WEB-COLDFUSION exampleapp access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 926-7>
  active T
  comment "WEB-COLDFUSION set odbc ini attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 2242-4>
  active T
  comment "WEB-MISC ddicgi.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2298-4>
  active T
  comment "WEB-PHP Advanced Poll admin_templates.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2118-6>
  active T
  comment IMAP list overflow attempt
  comment "pcre: /\sLIST\s[^\n]{100}/smi"
  payload "/((^)|(\n+))[\x20\x09\x0b][lL][iI][sS][tT][\x20\x09\x0b][^\n]{100}/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/imap.rules
  <delete>
    payload "/.*[lL][iI][sS][tT]/"
  </delete>
</augment>

<augment 1442-4>
  active T
  comment "TFTP GET shadow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/tftp.rules
</augment>

<augment 1250-11>
  active T
  comment "WEB-MISC Cisco IOS HTTP configuration attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
  comment "would like to inspect contents of reply"
</augment>

<augment 1996-3>
  active T
  comment "WEB-CGI viralator.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 418-7>
  active F
  comment "ICMP Information Request undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2478-3>
  active T
  comment "NETBIOS SMB-DS DCERPC bind winreg attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1241-5>
  active T
  comment "WEB-MISC SWEditServlet directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1971-4>
  active T
  comment FTP SITE EXEC format string attempt
  comment "pcre: /^SITE\s+EXEC\s[^\n]*?%[^\n]*?%/smi"
  ftp "/((^)|(\n+))[sS][iI][tT][eE][\x20\x09\x0b]+[eE][xX][eE][cC][\x20\x09\x0b][^\n]*?%[^\n]*?%/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[sS][iI][tT][eE].*.*[eE][xX][eE][cC]/"
  </delete>
</augment>

<augment 2286-2>
  active T
  comment "WEB-PHP friends.php access"
  comment "added details for sql *injection*.  rules differ for"
  comment "other attacks, but this seems the most dangerous"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
  http /.*[\/\\]friends\.php\x3fadmin\x3d[a-zA-Z0-9]{5,20}.* /
  <delete>
  	http /.*[\/\\]friends\.php/
  </delete>
</augment>

<augment 1522-10>
  active T
  comment "WEB-MISC ans.pl attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2192-8>
  active T
  comment "NETBIOS DCERPC ISystemActivator bind attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1926-6>
  active T
  comment "RPC mountd UDP exportall request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1717-4>
  active T
  comment "WEB-CGI simplestguest.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2522-7>
  active F
  comment "WEB-MISC SSLv3 invalid Client_Hello attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1738-5>
  active T
  comment "WEB-MISC global.inc access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2121-8>
  active T
  comment POP3 DELE negative arguement attempt
  comment pcre: /^DELE\s+-\d/smi
  payload /((^)|(\n+))[dD][eE][lL][eE]+-[0-9]/
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/pop3.rules
  <delete>
    payload "/.*[dD][eE][lL][eE]/"
  </delete>
</augment>

<augment 1219-10>
  active T
  comment "WEB-CGI dfire.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 834-7>
  active T
  comment "WEB-CGI rwwwshell.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1537-6>
  active T
  comment "WEB-CGI calendar_admin.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 701-7>
  active T
  comment "MS-SQL xp_updatecolvbm possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1163-11>
  active T
  comment "WEB-CGI webdist.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1519-8>
  active T
  comment "WEB-MISC apache ?M=D directory list attempt"
  comment "add additional filters"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
  http /Content-language:.* /
  eval isApacheLt1322
</augment>

<augment 846-8>
  active T
  comment "WEB-CGI bnbform.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 412-7>
  active F
  comment "ICMP IPV6 I-Am-Here undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 492-8>
  active F
  comment "INFO TELNET Bad Login"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/info.rules
</augment>

<augment 2422-2>
  active F
  comment "MULTIMEDIA realplayer .rt playlist download attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/multimedia.rules
</augment>

<augment 1110-7>
  active T
  comment "WEB-MISC apache source.asp file access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1484-5>
  active T
  comment "WEB-IIS /isapi/tstisapi.dll access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2476-3>
  active T
  comment "NETBIOS SMB-DS Create AndX Request winreg attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 440-7>
  active F
  comment "ICMP Reserved for Security Type 19 undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 503-6>
  active T
  comment "MISC Source Port 20 to <1024"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 2471-3>
  active T
  comment "NETBIOS SMB-DS C$ share access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 458-7>
  active T
  comment "ICMP unassigned type 1"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2568-1>
  active T
  comment "WEB-CGI Emumail emumail.fcgi access"
  requires-reverse-signature ! http_error
  http /.*[\/\\]emumail\.fcgi\?./
  <delete>
  	http /.*[\/\\]emumail\.fcgi/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1359-5>
  active T
  comment "WEB-ATTACKS ping command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1569-5>
  active T
  comment "WEB-CGI loadpage.cgi directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1405-5>
  active F
  comment "WEB-CGI AHG search.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 813-9>
  active T
  comment "WEB-CGI webplus directory traversal"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 700-8>
  active T
  comment "MS-SQL/SMB xp_updatecolvbm possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1078-8>
  active F
  comment "WEB-MISC counter.exe access"
  comment "'99 exploit against iis 4.0, remove"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 866-8>
  active T
  comment "WEB-CGI post-query access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 314-9>
  active T
  comment "DNS EXPLOIT named tsig overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 2137-2>
  active T
  comment "WEB-MISC philboard_admin.asp access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2069-5>
  active T
  comment "WEB-MISC chip.ini access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 991-8>
  active T
  comment "WEB-IIS achg.htr access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1566-7>
  active T
  comment "WEB-CGI eshop.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2116-3>
  active T
  comment "WEB-CGI chipcfg.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1872-3>
  active T
  comment "WEB-MISC Oracle Dynamic Monitoring Services dms access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1832-7>
  active F
  comment "CHAT ICQ forced user addition"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 1399-11>
  active T
  comment "WEB-PHP PHP-Nuke remote file include attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  <delete>
  	payload /.*[fF][iI][lL][eE]=/
  	http /.*[\/\\]index\.php/
  </delete>
  http /.*[\/\\]index\.php.*[fF][iI][lL][eE]=([hH][tT][tT][pP][sS]?|[fF][tT][pP])/
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 954-6>
  active T
  comment "WEB-FRONTPAGE form_results.htm access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1736-6>
  active T
  comment "WEB-PHP squirrel mail spell-check arbitrary command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1469-5>
  active T
  comment "WEB-CGI Web Shopper shopper.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 705-7>
  active T
  comment "MS-SQL xp_showcolv possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1177-6>
  active T
  comment "WEB-MISC Netscape Enterprise Server directory view"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2521-5>
  active F
  comment "WEB-MISC SSLv3 Server_Hello request"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 869-8>
  active T
  comment "WEB-CGI dumpenv.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 811-9>
  active F
  comment "WEB-CGI websitepro path access"
  comment "informational only"
  comment "not exploit worthy"
  comment "too general"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1769-3>
  active T
  comment "WEB-MISC .DS_Store access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 963-6>
  active T
  comment "WEB-FRONTPAGE svcacl.cnf access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1137-9>
  active T
  comment "WEB-PHP Phorum authentication access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1066-6>
  active T
  comment "WEB-MISC telnet attempt"
  requires-reverse-signature ! http_error
  http /.*[tT][eE][lL][nN][eE][tT]\.[eE][xX][eE]/
  <delete>
  	payload /.*[tT][eE][lL][nN][eE][tT]\.[eE][xX][eE]/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2182-6>
  active F
  comment "BACKDOOR typot trojan traffic"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 892-8>
  active T
  comment "WEB-CGI AnyForm2 access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2012-2>
  active T
  comment "MISC CVS missing cvsroot response"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 2307-5>
  active T
  comment WEB-PHP PayPal Storefront arbitrary command execution attempt
  comment pcre: /page=(http|https|ftp)/i
  http /[pP][aA][gG][eE]=(http|https|ftp)/
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
  <delete>
    payload /.*page=/
  </delete>
</augment>

<augment 2404-5>
  active T
  comment "NETBIOS SMB-DS Session Setup AndX request unicode username overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1913-10>
  active T
  comment "RPC STATD UDP stat mon_name format string exploit attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2518-10>
  active T
  comment "POP3 PCT Client_Hello overflow attempt"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/pop3.rules
</augment>

<augment 1945-4>
  active T
  comment "WEB-IIS unicode directory traversal attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2493-5>
  active T
  comment "NETBIOS SMB DCERPC ISystemActivator unicode bind attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2517-10>
  active T
  comment "IMAP PCT Client_Hello overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/imap.rules
</augment>

<augment 389-7>
  active F
  comment "ICMP Address Mask Request undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 443-5>
  active F
  comment "ICMP Router Selection"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2563-4>
  active F
  comment "NETBIOS NS lookup response name overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2284-3>
  active T
  comment "WEB-PHP rolis guestbook remote file include attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 420-7>
  active F
  comment "ICMP Mobile Host Redirect undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1917-6>
  active F
  comment "SCAN UPnP service discover attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 820-9>
  active T
  comment "WEB-CGI anaconda directory transversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1746-11>
  active T
  comment "RPC portmap cachefsd request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 414-7>
  active F
  comment "ICMP IPV6 Where-Are-You undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 220-6>
  active F
  dst-ip == local_nets
  comment "BACKDOOR HideSource backdoor attempt"
  comment "old signature from 1997"
  comment "moved check to hot-ids.bro"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 300-7>
  active T
  comment "EXPLOIT nlps x86 Solaris overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 601-6>
  active T
  comment "RSERVICES rlogin LinuxNIS"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rservices.rules
</augment>

<augment 1096-6>
  active T
  comment "WEB-MISC Talentsoft Web+ internal IP Address access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2302-4>
  active T
  comment "WEB-PHP Advanced Poll poll_ssi.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1570-5>
  active T
  dst-ip == local_nets
  comment "WEB-CGI loadpage.cgi access"
  requires-reverse-signature ! http_error
  http /.*[\/\\]loadpage\.cgi\?{1,}\//
  <delete>
  	http /.*[\/\\]loadpage\.cgi/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2519-9>
  active T
  comment "SMTP Client_Hello overflow attempt"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 885-9>
  active F
  comment "WEB-CGI bash access"
  comment "sig too general, shell check does not keep man pages from triggering this"
  requires-reverse-signature ! http_error
  requires-signature ! http_shell_check
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 569-14>
  active T
  comment "RPC snmpXdmi overflow attempt TCP"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2378-3>
  active T
  comment "EXPLOIT ISAKMP third payload certificate request length overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1674-5>
  active T
  comment "ORACLE connect_data remote version detection attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/oracle.rules
</augment>

<augment 914-5>
  active T
  comment "WEB-COLDFUSION beaninfo access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 322-10>
  active T
  comment "FINGER search query"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/finger.rules
</augment>

<augment 365-8>
  active F
  comment "ICMP PING undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2191-3>
  active T
  comment "NETBIOS SMB DCERPC invalid bind attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2037-5>
  active T
  comment "RPC network-status-monitor mon-callback request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 968-6>
  active T
  comment "WEB-FRONTPAGE register.htm access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 901-10>
  active T
  comment "WEB-CGI webspirs.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 609-5>
  active T
  comment "RSERVICES rsh froot"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rservices.rules
</augment>

<augment 513-10>
  active T
  comment "MISC Cisco Catalyst Remote Access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 457-7>
  active F
  comment "ICMP Traceroute undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1067-6>
  active T
  comment "WEB-MISC net attempt"
  requires-reverse-signature ! http_error
  http /.*[^a-zA-Z0-9_.-][nN][eE][tT]\.[eE][xX][eE]/
  <delete>
  	payload /.*[nN][eE][tT]\.[eE][xX][eE]/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 332-8>
  active T
  comment "FINGER 0 query"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/finger.rules
</augment>

<augment 2323-2>
  active T
  comment "WEB-CGI quickstore.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 692-6>
  active T
  comment "MS-SQL/SMB shellcode attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 851-7>
  active T
  comment "WEB-CGI files.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 105-7>
  active T
  comment "BACKDOOR - Dagger_1.4.0"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 599-11>
  active T
  comment "RPC portmap listing TCP 32771"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1847-8>
  active F
  comment "WEB-MISC webalizer access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
  comment "informational only"
</augment>

<augment 1071-6>
  active T
  comment "WEB-MISC .htpasswd access"
  requires-reverse-signature ! http_error
  http /.*\/\.[hH][tT][pP][aA][sS][sS][wW][dD]/
  <delete>
  	payload /.*\.[hH][tT][pP][aA][sS][sS][wW][dD]/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 620-9>
  active F
  comment "SCAN Proxy Port 8080 attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 635-3>
  active T
  comment "SCAN XTACACS logout"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 1265-9>
  active T
  comment "RPC portmap cmsd request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1669-5>
  active T
  comment "WEB-CGI /cgi-dos/ access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1949-5>
  active T
  comment "RPC portmap SET attempt TCP 111"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1581-4>
  active T
  comment "WEB-MISC Domino ntsync4.nsf access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2008-4>
  active T
  comment "MISC CVS invalid user authentication response"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 431-6>
  active F
  comment "ICMP Photuris Valid Security Parameters, But Authentication Failed"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1406-11>
  active T
  comment "WEB-CGI agora.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1871-4>
  active T
  comment "WEB-MISC Oracle XSQLConfig.xml access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1292-8>
  active T
  comment "ATTACK-RESPONSES directory listing"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/attack-responses.rules
</augment>

<augment 109-5>
  active T
  comment "BACKDOOR netbus active"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1789-3>
  active T
  comment "CHAT IRC dns request"
  comment "informational only"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 1925-6>
  active F
  comment "RPC mountd TCP exportall request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1618-14>
  active T
  comment "WEB-IIS .asp chunked Transfer-Encoding"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1501-8>
  active T
  comment "WEB-CGI a1stats a1disp3.cgi directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 249-7>
  active T
  comment "DDOS mstream client to handler"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 2454-3>
  active F
  comment "CHAT Yahoo IM conference logon success"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 2439-3>
  active T
  comment "WEB-CLIENT RealPlayer playlist http URL overflow attempt"
  comment pcre: /^http\x3a\x2f\x2f[^\n]{400}/smi
  payload /((^)|(\n+))[hH][tT]{2}[pP]\x3a\x2f\x2f[^\n]{400}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-client.rules
</augment>

<augment 2472-3>
  active T
  comment "NETBIOS SMB-DS C$ share unicode access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1070-7>
  active T
  comment "WEB-MISC WebDAV search access"
  requires-signature http_iis_server
  http /((^)|(\n+))[sS][eE][aA][rR][cC][hH]/
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  # sigaction SIG_SUMMARY
  snort-rule-file snort_rules/rules2.2/web-misc.rules
  <delete>
    payload /.{0,1}[sS][eE][aA][rR][cC][hH] /
  </delete>
</augment>

<augment 283-10>
  active T
  comment "EXPLOIT Netscape 4.7 client overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 947-6>
  active T
  comment "WEB-FRONTPAGE orders.txt access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 2126-6>
  active F
  comment "MISC Microsoft PPTP Start Control Request buffer overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 1918-6>
  active F
  comment "SCAN SolarWinds IP scan attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 1358-5>
  active T
  comment "WEB-ATTACKS traceroute command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 2236-5>
  active T
  comment "WEB-MISC spamrule.dll access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 376-7>
  active F
  comment "ICMP PING Microsoft Windows"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2335-2>
  active T
  comment "FTP RMD / attempt"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 495-7>
  active T
  comment "ATTACK-RESPONSES command error"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/attack-responses.rules
</augment>

<augment 2523-6>
  active F
  comment "DOS BGP spoofed connection reset attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 1972-10>
  active T
  comment FTP PASS overflow attempt
  comment "pcre: /^PASS\s[^\n]{100}/smi"
  eval dataSizeG100
  ftp "/((^)|(\n+))[pP][aA][sS][sS][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[pP][aA][sS][sS]/"
  </delete>
</augment>

<augment 2374-4>
  active T
  comment FTP NLST overflow attempt
  comment "pcre: /^NLST\s[^\n]{100}/smi"
  eval dataSizeG100
  ftp "/((^)|(\n+))[nNlLsStT][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[nN][lL][sS][tT]/"
  </delete>
</augment>

<augment 2088-5>
  active T
  comment "RPC ypupdated arbitrary command attempt UDP"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 327-8>
  active T
  comment "FINGER remote command pipe execution attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/finger.rules
</augment>

<augment 2535-3>
  active F
  comment "POP3 SSLv3 Client_Hello request"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/pop3.rules
</augment>

<augment 317-6>
  active T
  comment "EXPLOIT x86 Linux mountd overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 856-5>
  active T
  comment "WEB-CGI environ.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1527-7>
  active T
  comment "WEB-MISC basilix mysql.class access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1065-6>
  active T
  comment "WEB-MISC rcmd attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1324-6>
  active T
  comment "EXPLOIT ssh CRC32 overflow /bin/sh"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 507-4>
  active T
  comment "MISC PCAnywhere Attempted Administrator Login"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 899-8>
  active T
  comment "WEB-CGI Amaya templates sendtemp.pl directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2337-7>
  active T
  comment "TFTP PUT filename overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/tftp.rules
</augment>

<augment 819-7>
  active F
  comment "WEB-CGI mmstdod.cgi access"
  comment "informational only"
  comment "old signature from 03-01-2001"
  requires-reverse-signature ! http_error
  http /.*[\/\\]smartsearch\.cgi.*\|/
  <delete>
  	http /.*[\/\\]smartsearch\.cgi/
  </delete>
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1743-5>
  active T
  comment "WEB-PHP Blahz-DNS dostuff.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1083-6>
  active T
  comment "WEB-MISC unify eWave ServletExec DOS"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2228-4>
  active T
  comment "WEB-PHP phpMyAdmin db_details_importdocsql.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 979-9>
  active T
  comment "WEB-IIS ASP contents view"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1230-8>
  active T
  comment "WEB-MISC VirusWall FtpSave access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2377-3>
  active T
  comment "EXPLOIT ISAKMP second payload certificate request length overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 905-7>
  active T
  comment "WEB-COLDFUSION application.cfm access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 1759-5>
  active T
  comment "MS-SQL xp_cmdshell program execution 445"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1585-4>
  active T
  comment "WEB-MISC Domino agentrunner.nsf access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 965-6>
  active T
  comment "WEB-FRONTPAGE writeto.cnf access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 2367-4>
  active T
  comment "WEB-PHP PhpGedView PGV functions.php base directory manipulation attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 980-7>
  active T
  comment "WEB-IIS CGImail.exe access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2041-2>
  active T
  comment "MISC xtacacs failed login response"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 1829-5>
  active T
  comment "WEB-MISC Tomcat TroubleShooter servlet access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 946-6>
  active T
  comment "WEB-FRONTPAGE fpadmcgi.exe access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1593-10>
  active T
  comment "WEB-CGI FormHandler.cgi external site redirection attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 473-4>
  active F
  comment "ICMP redirect net"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 925-5>
  active T
  comment "WEB-COLDFUSION mainframeset access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 1195-8>
  active T
  comment "WEB-CGI sojourn.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1899-8>
  active T
  comment "EXPLOIT kadmind buffer overflow attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1907-10>
  active T
  comment "RPC CMSD UDP CMSD_CREATE buffer overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2203-6>
  active T
  comment "WEB-CGI everythingform.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 993-7>
  active T
  comment "WEB-IIS iisadmin access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2567-1>
  active T
  comment "WEB-CGI Emumail init.emu access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1649-7>
  active T
  comment "WEB-CGI perl command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2497-6>
  active T
  comment "IMAP SSLv3 invalid data version attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/imap.rules
</augment>

<augment 2055-2>
  active F
  comment "WEB-CGI enter_bug.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
  comment "Informational only"
</augment>

<augment 1213-5>
  active T
  comment "WEB-MISC backup access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1631-6>
  active F
  comment "CHAT AIM login"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 466-4>
  active F
  comment "ICMP L3retriever Ping"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 917-7>
  active T
  comment "WEB-COLDFUSION db connections flush attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 697-8>
  active T
  comment "MS-SQL/SMB xp_peekqueue possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1152-5>
  active T
  comment "WEB-MISC Domino domlog.nsf access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1283-9>
  active T
  comment "WEB-IIS outlook web dos"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1462-5>
  active T
  comment "WEB-CGI bb-replog.sh access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 805-10>
  active F
  comment "WEB-CGI webspeed access"
  comment "informational only, not exploit worthy"
  comment "old signature from 2000"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1266-10>
  active T
  comment "RPC portmap mountd request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1204-6>
  active T
  comment "WEB-CGI ax-admin.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1010-7>
  active T
  comment "WEB-IIS encoding access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 482-5>
  active F
  comment "ICMP PING WhatsupGold Windows"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 688-6>
  active T
  comment "MS-SQL sa login failed"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 890-10>
  active T
  comment "WEB-CGI sendform.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 587-8>
  active T
  comment "RPC portmap status request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1401-4>
  active T
  comment "WEB-IIS /msadc/samples/ access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 355-5>
  active T
  comment "FTP pass wh00t"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 405-6>
  active F
  comment "ICMP Destination Unreachable Source Host Isolated"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 828-5>
  active T
  comment "WEB-CGI maillist.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 238-6>
  active F
  comment "DDOS TFN server response"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 2148-4>
  active T
  comment "WEB-PHP BLNews objects.inc.php4 access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1103-8>
  active T
  comment "WEB-MISC Netscape admin passwd"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2419-2>
  active F
  comment "MULTIMEDIA realplayer .ram playlist download attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/multimedia.rules
</augment>

<augment 410-5>
  active F
  comment "ICMP Fragment Reassembly Time Exceeded"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2082-9>
  active T
  comment "RPC portmap rpc.xfsmd request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 929-7>
  active T
  comment "WEB-COLDFUSION CFUSION_VERIFYMAIL access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 2281-2>
  active T
  comment "WEB-PHP Setup.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2226-5>
  active T
  comment "WEB-PHP pmachine remote file include attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 413-5>
  active F
  comment "ICMP IPV6 Where-Are-You"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 564-7>
  active F
  comment "P2P Napster Client Data"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/p2p.rules
</augment>

<augment 1747-11>
  active T
  comment "RPC portmap cachefsd request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 644-5>
  active T
  comment "SHELLCODE sparc NOOP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 1375-6>
  active T
  comment "WEB-MISC sadmind worm access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1719-4>
  active T
  comment "WEB-CGI talkback.cgi directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1507-9>
  active T
  comment "WEB-CGI alibaba.pl arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1081-10>
  active T
  comment "WEB-MISC Netscape Servers suite DOS"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1943-3>
  active T
  comment "WEB-MISC /Carello/add.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1815-4>
  active T
  comment "WEB-PHP directory.php arbitrary command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2011-4>
  active T
  comment "MISC CVS invalid directory response"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 1260-10>
  active T
  comment "WEB-MISC long basic authorization string"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1602-6>
  active T
  comment "WEB-CGI htsearch access"
  comment "add sanity checking to sig to reduce noise"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
  <delete>
	http /.*[\/\\]htsearch/
  </delete>
  http /.*[\/\\]htsearch\x3f.*\x3d[\x22\x60].*[\x22\x60].* /
</augment>

<augment 216-6>
  active T
  comment "BACKDOOR MISC Linux rootkit satori attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1891-8>
  active T
  comment "RPC status GHBN format string attack"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1526-8>
  active T
  comment "WEB-MISC basilix sendmail.inc access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2195-6>
  active T
  comment "WEB-CGI alert.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2462-6>
  active T
  comment "EXPLOIT IGMP IGAP account overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1220-5>
  active T
  comment "WEB-MISC ultraboard access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1854-7>
  active T
  comment "DDOS Stacheldraht handler->agent niggahbitch"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 277-5>
  active F
  comment "DOS Real Server template.html"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 469-3>
  active F
  comment "ICMP PING NMAP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 1532-7>
  active T
  comment "WEB-CGI bb-hostscv.sh attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 281-5>
  active T
  comment "DOS Ascend Route"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 258-6>
  active F
  comment "DNS EXPLOIT named 8.2->8.2.1"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 959-6>
  active T
  comment "WEB-FRONTPAGE service.pwd"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 2559-2>
  active T
  comment "EXPLOIT Oracle Web Cache COPY overflow attempt"
  comment pcre: /^COPY[^s]{432}/sm
  payload /((^)|(\n+))COPY[^s]{432}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
  <delete>
    payload /.*COPY/
  </delete>
</augment>

<augment 2149-1>
  active T
  comment "WEB-PHP Turba status.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2237-5>
  active T
  comment "WEB-MISC cgiWebupdate.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1084-8>
  active T
  comment "WEB-MISC Allaire JRUN DOS attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2073-3>
  active T
  comment "WEB-MISC globals.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1374-5>
  active T
  comment "WEB-ATTACKS .htgroup access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  <delete>
  	http /.*\.htgroup/
  </delete>
  http /.*\.htgroup[\x20\x09\x0b]*$/
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1128-5>
  active T
  comment "WEB-MISC cpshost.dll access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1122-5>
  active T
  comment "WEB-MISC /etc/passwd"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
  payload /.*\/[eE][tT][cC]\/[pP][aA][sS][sS][wW][dD].{1,}root:x:0:0/
  <delete>
  	payload /.*\/[eE][tT][cC]\/[pP][aA][sS][sS][wW][dD]/
  </delete>
</augment>

<augment 1012-10>
  active T
  comment "WEB-IIS fpcount attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 645-5>
  active T
  comment "SHELLCODE sparc NOOP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 1398-10>
  active T
  comment "EXPLOIT CDE dtspcd exploit attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 2543-3>
  active F
  comment "SMTP TLS SSLv3 Server_Hello request"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 2139-5>
  active T
  comment "WEB-MISC /*.shtml access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 229-5>
  active T
  comment "DDOS Stacheldraht client check skillz"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 373-6>
  active F
  comment "ICMP PING Flowpoint2200 or Network Management Software"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 969-5>
  active T
  comment "WEB-IIS WebDAV file lock attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1087-8>
  active T
  comment "WEB-MISC whisker tab splice attack"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 842-7>
  active T
  comment "WEB-CGI aglimpse access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2146-3>
  active T
  comment "WEB-PHP TextPortal admin.php default password 12345 attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1866-10>
  active T
  comment POP3 USER overflow attempt
  comment "pcre: /^USER\s[^\n]{50,}/smi"
  payload "/((^)|(\n+))[uU][sS][eE][rR][\x20\x09\x0b][^\n]{50,}/"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/pop3.rules
  <delete>
    payload "/.*[uU][sS][eE][rR]/"
  </delete>
</augment>

<augment 1906-8>
  active T
  comment "RPC AMD TCP amqproc_mount plog overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2175-5>
  active T
  comment "NETBIOS SMB winreg unicode access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1699-7>
  active F
  comment "P2P Fastrack kazaa/morpheus traffic"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/p2p.rules
</augment>

<augment 498-6>
  active T
  comment "ATTACK-RESPONSES id check returned root"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/attack-responses.rules
</augment>

<augment 976-10>
  active T
  comment "WEB-IIS .bat? access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 907-5>
  active T
  comment "WEB-COLDFUSION addcontent.cfm access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 2177-4>
  active T
  comment "NETBIOS SMB startup folder unicode access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 616-4>
  active T
  comment "SCAN ident version request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 2562-3>
  active T
  comment "WEB-MISC McAfee ePO file upload attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 183-4>
  active F
  comment "BACKDOOR SIGNATURE - Q ICMP"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1472-9>
  active F
  comment "WEB-CGI book.cgi access"
  comment "informational only"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1393-12>
  active T
  comment "MISC AIM AddGame attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 893-7>
  active T
  comment "WEB-CGI MachineInfo access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 115-5>
  active T
  comment "BACKDOOR netbus active"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 2100-2>
  active T
  comment "BACKDOOR SubSeven 2.1 Gold server connection response"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 450-8>
  active F
  comment "ICMP Time-To-Live Exceeded in Transit undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2087-5>
  active T
  comment "Sendmail SMTP From comment overflow attempt"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
  payload /.*From\x3A<><><><><><><><><><><><><><><><><><><><><><>.{1}\x28.{1}\x29/
  <delete>
  	payload /.*From\x3A.*.*<><><><><><><><><><><><><><><><><><><><><><>.{1}.*\x28.{1}.*\x29/
  </delete>
</augment>

<augment 951-10>
  active T
  comment "WEB-FRONTPAGE authors.pwd access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1395-8>
  active T
  comment "WEB-CGI zml.cgi attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1198-7>
  active T
  comment "WEB-MISC Netscape Enterprise Server directory view"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1563-6>
  active T
  comment "WEB-MISC login.htm attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1290-10>
  active F
  comment "WEB-CLIENT readme.eml autoload attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-client.rules
</augment>

<augment 2549-1>
  active T
  comment "MISC HP Web JetAdmin file write attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 1403-5>
  active T
  comment "WEB-MISC viewcode access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 966-9>
  active T
  comment "WEB-FRONTPAGE .... request"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 843-7>
  active T
  comment "WEB-CGI anform2 access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1191-6>
  active T
  comment "WEB-MISC Netscape Enterprise Server directory view"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1413-10>
  active T
  comment "SNMP private access udp"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/snmp.rules
</augment>

<augment 1533-7>
  active T
  comment "WEB-CGI bb-hostscv.sh access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1092-7>
  active T
  comment "WEB-CGI Armada Style Master Index directory traversal"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 331-10>
  active T
  comment "FINGER cybercop query"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/finger.rules
</augment>

<augment 1577-4>
  active T
  comment "WEB-MISC Domino setup.nsf access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2496-5>
  active F
  comment "NETBIOS SMB-DS DCEPRC ORPCThis request flood attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 471-3>
  active T
  comment "ICMP icmpenum v1.1.1"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 2120-3>
  active T
  comment IMAP create literal buffer overflow attempt
  comment pcre: /\sCREATE\s[^\n]*?\s\{/smi
  payload /((^)|(\n+))[\x20\x09\x0b][cC][rR][eE][aA][tT][eE][\x20\x09\x0b][^\n]*?\s\{/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/imap.rules
  <delete>
    payload /.*[cC][rR][eE][aA][tT][eE]/
  </delete>
</augment>

<augment 1436-4>
  active F
  comment "MULTIMEDIA Quicktime User Agent access"
  comment "informational only, not exploit worthy"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/multimedia.rules
</augment>

<augment 302-6>
  active T
  comment "EXPLOIT Redhat 7.0 lprd overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1077-6>
  active T
  comment "WEB-MISC queryhit.htm access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 248-4>
  active F
  comment "DDOS mstream handler to client"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 1467-7>
  active T
  comment "WEB-CGI directorypro.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 867-9>
  active T
  comment "WEB-CGI visadmin.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2201-5>
  active T
  comment "WEB-CGI download.cgi access"
  comment "add f=../ to sig for refinement"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
  http /.*[\/\\]download\.cgi.*f\x3d\x2e\x2e\x2f.* /
  <delete>
	http /.*[\/\\]download\.cgi/
  </delete>
</augment>

<augment 1908-9>
  active T
  comment "RPC CMSD TCP CMSD_CREATE buffer overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1357-5>
  active T
  comment "WEB-ATTACKS nt admin addition attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1175-10>
  active T
  comment "WEB-MISC wwwboard.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1905-8>
  active T
  comment "RPC AMD UDP amqproc_mount plog overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1957-5>
  active T
  comment "RPC sadmind UDP PING"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1495-6>
  active T
  comment "WEB-CGI SIX webboard generate.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1628-10>
  active T
  comment "WEB-CGI FormHandler.cgi directory traversal attempt attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1778-4>
  active T
  comment "FTP EXPLOIT STAT ? dos attempt"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 2266-4>
  active T
  comment SMTP SOML FROM sendmail prescan too long addresses overflow
  comment pcre: /^SOML FROM\x3a\s+[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}/smi
  payload /((^)|(\n+))[sS][oO][mM][lL] [fF][rR][oO][mM]:[\x20\x09\x0b]+[a-zA-Z0-9_\x20\x09\x0b@\.]{0,200}\x3b[a-zA-Z0-9_\x20\x09\x0b@\.]{200,}\x3b[a-zA-Z0-9_\x20\x09\x0b@\.]{0,200}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload /.*[sS][oO][mM][lL] [fF][rR][oO][mM]\x3A/
  </delete>
</augment>

<augment 1293-10>
  active T
  comment "NETBIOS nimda .eml"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1446-6>
  active T
  comment SMTP vrfy root
  comment pcre: /^vrfy\s+root/smi
  payload /((^)|(\n+))[vV][rR][fF][yY][\x20\x09\x0b]+[rR][oO][oO][tT]/
  sigaction SIG_FILE
  requires-reverse-signature ! smtp_server_fail
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload /.*[vV][rR][fF][yY].{1}.*[rR][oO][oO][tT]/
  </delete>
</augment>

<augment 2384-8>
  active T
  comment "NETBIOS SMB NTLMSSP invalid mechlistMIC attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1119-7>
  active T
  comment "WEB-MISC mlog.phtml access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2178-13>
  active T
  comment FTP USER format string attempt
  comment pcre: /^USER\s[^\n]*?%[^\n]*?%/smi
  ftp /((^)|(\n+))[uU][sS][eE][rR][\x20\x09\x0b][^\n]*?%[^\n]*?%/
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload /.*[uU][sS][eE][rR]/
  </delete>
</augment>

<augment 854-7>
  active T
  comment "WEB-CGI classifieds.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2220-6>
  active T
  comment "WEB-CGI simplestmail.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 931-6>
  active T
  comment "WEB-COLDFUSION cfmlsyntaxcheck.cfm access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 1806-7>
  active T
  comment "WEB-IIS .htr chunked Transfer-Encoding"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2492-5>
  active F
  comment "NETBIOS SMB DCERPC ISystemActivator bind attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1715-4>
  active T
  comment "WEB-CGI register.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  http /.*[\/\\]register\.cgi/
  payload /SEND_MAIL/
  <delete>
  	http /.*[\/\\]register\.cgi/
  </delete>
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
  comment "Informational only"
</augment>

<augment 2574-1>
  active T
  comment "FTP RETR format string attempt"
  comment pcre: /^RETR\s[^\n]*?%[^\n]*?%/smi
  ftp /((^)|(\n+))[rR][eE][tT][rR][\x20\x09\x0b][^\n]*?%[^\n]*?%/
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload /.*[rR][eE][tT][rR]/
  </delete>
</augment>

<augment 661-6>
  active T
  comment "SMTP majordomo ifs"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 840-7>
  active T
  comment "WEB-CGI perlshop.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2209-5>
  active T
  comment "WEB-CGI getdoc.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  <delete>
  	http /.*[\/\\]getdoc\.cgi/
  </delete>
  http /.*[\/\\]getdoc\.cgi\?.*form-attachment.*command/
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1289-4>
  active T
  comment "TFTP GET Admin.dll"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/tftp.rules
</augment>

<augment 607-5>
  active T
  comment "RSERVICES rsh bin"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rservices.rules
</augment>

<augment 679-6>
  active T
  comment "MS-SQL/SMB sp_adduser database user creation"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 2326-3>
  active T
  comment "WEB-IIS sgdynamo.exe access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1702-5>
  active F
  comment "WEB-CGI Amaya templates sendtemp.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 915-5>
  active T
  comment "WEB-COLDFUSION evaluate.cfm access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 2033-8>
  active T
  comment "RPC ypserv maplist request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 835-9>
  active T
  comment "WEB-CGI test-cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1333-6>
  active T
  comment WEB-ATTACKS id command attempt
  http /.*;[iI][dD]([;|\x20\x09\x0b]|$)./
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
  <delete>
    payload /.*\x3B[iI][dD]/
  </delete>
</augment>

<augment 826-7>
  active T
  comment "WEB-CGI htmlscript access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 159-6>
  active T
  comment "BACKDOOR NetMetro File List"
  dst-ip == local_nets
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1015-6>
  active T
  comment "WEB-IIS getdrvs.exe access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1173-5>
  active T
  comment "WEB-MISC architext_query.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1104-9>
  active T
  comment "WEB-MISC whisker space splice attack"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>


<augment 353-6>
  active T
  comment "FTP adm scan"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 1712-4>
  active T
  comment "WEB-CGI bslist.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 362-12>
  active T
  comment "FTP tar parameters"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 990-6>
  active T
  comment "WEB-IIS _vti_inf access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1668-6>
  active T
  comment "WEB-CGI /cgi-bin/ access"
  comment "under most conditions the root of cgi-bin should never return a list or valid document"
  comment "tune for site specific"
  http /.*[\/\\]cgi-bin[\/\\]$/
  requires-reverse-signature ! http_error
  <delete>
  	http /.*[\/\\]cgi-bin[\/\\]/
  	payload /.*\/[cC][gG][iI]-[bB][iI][nN]\/ [hH][tT][tT][pP]/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2150-7>
  active T
  comment "WEB-PHP ttCMS header.php remote file include attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2468-3>
  active T
  comment "NETBIOS SMB-DS D$ share access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2013-2>
  active T
  comment "MISC CVS invalid module response"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 665-5>
  active T
  comment "SMTP sendmail 5.6.5 exploit"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 1550-10>
  active T
  comment SMTP ETRN overflow attempt
  comment pcre: /^ETRN\s[^\n]{500}/smi
  payload /((^)|(\n+))[eE][tT][rR][nN]][\x20\x09\x0b][^\n]{500}/
  sigaction SIG_LOG
  requires-reverse-signature ! smtp_server_fail
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload /.*ETRN/
  </delete>
</augment>

<augment 1428-5>
  active T
  comment "MULTIMEDIA audio galaxy keepalive"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/multimedia.rules
</augment>

<augment 2260-5>
  active T
  comment SMTP VRFY overflow attempt
  comment pcre: /^VRFY[^\n]{255,}/smi
  payload /((^)|(\n+))[vV][rR][fF][yY][^\n]{255,}/
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload /.*[vV][rR][fF][yY]/
  </delete>
</augment>

<augment 1024-8>
  active T
  comment "WEB-IIS newdsn.exe access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2252-11>
  active T
  comment "NETBIOS SMB-DS DCERPC Remote Activation bind attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 848-9>
  active T
  comment "WEB-CGI view-source directory traversal"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2296-4>
  active T
  comment "WEB-PHP Advanced Poll admin_stats.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1335-5>
  active T
  comment "WEB-ATTACKS kill command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 2488-4>
  active T
  comment "SMTP WinZip MIME content-disposition buffer overflow"
  comment pcre: /name=[^\r\n]*?\.(mim|uue|uu|b64|bhx|hqx|xxe)/smi
  comment pcre: /name=s*[^\r\n\x3b\s\x2c]{300}/smi
  payload /[nN][aA][mM][eE]=[^\r\n]*?\.(([mM][iI]]mM])|([uU]{2}[eE])|([uU]{2})|([bB]64)|([bB][hH][xX])|([hH][qQ][xX])|([xX]{2}[eE]))/
  payload /[nN][aA][mM][eE]=s*[^\r\n\x3b\x20\x09\x0b\x2c]{300}/
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 1660-4>
  active T
  comment "WEB-IIS trace.axd access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2018-4>
  active T
  comment "RPC mountd TCP dump request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1985-1>
  active F
  comment "BACKDOOR Doly 1.5 server response"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1308-5>
  active T
  comment "WEB-CGI sendmessage.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1323-6>
  active F
  comment "EXPLOIT rwhoisd format string attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1901-10>
  active T
  comment "ATTACK-RESPONSES successful kadmind buffer overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/attack-responses.rules
</augment>

<augment 2070-2>
  active T
  comment "WEB-MISC post32.exe arbitrary command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1164-10>
  active T
  comment "WEB-MISC shopping cart access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 706-7>
  active T
  comment "MS-SQL xp_peekqueue possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 392-5>
  active F
  comment "ICMP Datagram Conversion Error"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1384-8>
  active T
  comment "MISC UPnP malformed advertisement"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 823-6>
  active F
  comment "WEB-CGI cvsweb.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
  comment "informational only"
</augment>

<augment 1156-6>
  active T
  comment "WEB-MISC apache DOS attempt"
  requires-signature ! http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1742-5>
  active T
  comment "WEB-PHP Blahz-DNS dostuff.php modify user attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 155-5>
  active T
  comment "BACKDOOR NetSphere 1.31.337 access"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1217-7>
  active T
  comment "WEB-MISC plusmail access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1969-3>
  active T
  comment "WEB-MISC ion-p remote file access"
  dst-ip == local_nets
  http /.*[\/\\]ion-p\?.*(c:\\|\.\.\/)/
  requires-reverse-signature ! http_error
  <delete>
  	http /.*[\/\\]ion-p/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2176-4>
  active T
  comment "NETBIOS SMB startup folder access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1438-6>
  active F
  comment "MULTIMEDIA Windows Media Video download"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/multimedia.rules
</augment>

<augment 988-7>
  active T
  comment "WEB-IIS SAM Attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2541-5>
  active F
  comment "SMTP TLS SSLv3 invalid data version attempt"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 983-9>
  active T
  comment "WEB-IIS unicode directory traversal attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1950-5>
  active T
  comment "RPC portmap SET attempt UDP 111"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1130-5>
  active T
  comment "WEB-MISC .wwwacl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1434-5>
  active T
  comment "WEB-MISC .bash_history access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 864-7>
  active T
  comment "WEB-CGI day5datanotifier.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1118-5>
  active T
  comment "WEB-MISC ls%20-l"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2256-3>
  active T
  comment "RPC sadmind query with root credentials attempt UDP"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2239-3>
  active T
  comment "WEB-MISC redirect.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2570-6>
  active T
  comment "WEB-MISC Invalid HTTP Version String"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2542-3>
  active F
  comment "SMTP TLS SSLv3 Client_Hello request"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 895-7>
  active F
  comment "WEB-CGI redirect access"
  comment "sig too general for general use"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 654-13>
  active T
  comment SMTP RCPT TO overflow
  comment pcre: /^RCPT TO\s[^\n]{300}/ism
  payload /((^)|(\n+))[rR][cC][pP][tT] [tT][oO][\x20\x09\x0b][^\n]{300}/
  sigaction SIG_LOG
  requires-reverse-signature ! smtp_server_fail
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 2435-2>
  active F
  comment "WEB-CLIENT Microsoft emf metafile access"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-client.rules
  comment "Informational only"
</augment>

<augment 1516-10>
  active T
  comment "WEB-CGI envout.bat arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 260-9>
  active T
  comment "DNS EXPLOIT named overflow ADMROCKS"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 2455-3>
  active F
  comment "CHAT Yahoo IM conference message"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 312-6>
  active F
  comment "EXPLOIT ntpdx overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
  comment "Too general"
  comment "Better handled by the ntp.bro policy"
</augment>

<augment 1199-11>
  active T
  comment "WEB-MISC Compaq Insight directory traversal"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2327-2>
  active T
  comment "WEB-MISC bsml.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2259-5>
  active T
  comment SMTP EXPN overflow attempt
  comment "pcre: /^EXPN[^\n]{255,}/smi"
  payload "/((^)|(\n+))[eE][xX][pP][nN][^\n]{255,}/"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload "/.*[eE][xX][pP][nN]/"
  </delete>
</augment>

<augment 2280-2>
  active T
  comment "WEB-PHP Title.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2106-7>
  active T
  comment IMAP lsub overflow attempt
  comment "pcre: /\sLSUB\s[^\n]{100}/smi"
  payload "/((^)|(\n+))[\x20\x09\x0b][lL][sS][uU][bB][\x20\x09\x0b][^\n]{100}/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/imap.rules
  <delete>
    payload "/.*LSUB/"
  </delete>
</augment>

<augment 646-5>
  active T
  comment "SHELLCODE sparc NOOP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 1141-10>
  active F
  comment "WEB-MISC handler access"
  comment "Disabled because it is too general"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1273-10>
  active T
  comment "RPC portmap selection_svc request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1451-6>
  active T
  comment "WEB-CGI NPH-publish access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1701-4>
  active T
  comment "WEB-CGI calendar-admin.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1716-6>
  active T
  dst-ip == local_nets
  payload /_MAILTO.*\;/
  comment "WEB-CGI gbook.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1149-12>
  active F
  comment "WEB-CGI count.cgi access"
  comment "circa '97, remove rule as too general"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 593-18>
  active T
  comment "RPC portmap snmpXdmi request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 407-7>
  active F
  comment "ICMP Destination Unreachable cndefined code"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1812-5>
  active T
  comment "EXPLOIT gobbles SSH exploit attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 2002-4>
  active T
  comment "WEB-PHP remote include path"
  comment "add better rule"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
  <delete>
	http /.*\.php/
  </delete>
  http /.*\.php.*[pP][aA][tT][hH]\x3d(http|https|ftp)\x2fi/
</augment>

<augment 1423-12>
  active T
  comment "WEB-PHP content-disposition memchr overflow"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2525-6>
  active F
  comment "NETBIOS SMB DCERPC LSASS direct bind attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 672-6>
  active T
  comment SMTP vrfy decode
  comment "pcre: /^vrfy\s+decode/smi"
  payload "/((^)|(\n+))[vV][rR][fF][yY][\x20\x09\x0b]+[dD][eE][cC][oO][dD][eE]/"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload "/.*[vV][rR][fF][yY].{1}.*[dD][eE][cC][oO][dD][eE]/"
  </delete>
</augment>

<augment 1624-5>
  active T
  comment "FTP large PWD command"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 2204-6>
  active T
  comment "WEB-CGI ezadmin.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 301-7>
  active T
  comment "EXPLOIT LPRng overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 2292-4>
  active T
  comment "WEB-PHP Advanced Poll admin_logout.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2179-4>
  active T
  comment FTP PASS format string attempt
  comment "pcre: /^PASS\s[^\n]*?%[^\n]*?%/smi"
  ftp "/((^)|(\n+))[pP][aA][sS][sS]\x20\x09\x0b][^\n]*?%[^\n]*?%/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[pP][aA][sS][sS]/"
  </delete>
</augment>

<augment 630-5>
  active T
  comment "SCAN synscan portscan"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 147-5>
  active T
  comment "BACKDOOR GateCrasher"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 304-9>
  active F
  comment "EXPLOIT SCO calserver overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 2214-6>
  active T
  comment "WEB-CGI mailview.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1727-7>
  active T
  comment "WEB-CGI SGI InfoSearch fname access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1641-5>
  active T
  comment "DOS DB2 dos attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 1924-6>
  active T
  comment "RPC mountd UDP export request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1245-10>
  active T
  comment "WEB-IIS ISAPI .idq access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2221-6>
  active T
  comment "WEB-CGI ws_mail.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2507-6>
  active F
  comment "NETBIOS DCERPC LSASS bind attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1340-5>
  active T
  comment "WEB-ATTACKS tftp command attempt"
  requires-reverse-signature ! http_error
  requires-signature ! http_cool_dll
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1476-5>
  active T
  comment "WEB-CGI sdbsearch.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2193-9>
  active T
  comment "NETBIOS SMB-DS DCERPC ISystemActivator bind attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1869-5>
  active T
  comment "WEB-CGI story.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1165-9>
  active T
  comment "WEB-MISC Novell Groupwise gwweb.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2215-6>
  active T
  comment "WEB-CGI nsManager.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2267-4>
  active T
  comment SMTP MAIL FROM sendmail prescan too many addresses overflow
  comment "pcre: /^MAIL FROM\x3a\s*[^\n]*?<[^\n]*?<[^\n]*? ..."
  payload "/((^)|(\n+))[mM][aA][iI][lL] [fF][rR][oO][mM]\x3a\x20*[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?</"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload /.*[mM][aA][iI][lL] [fF][rR][oO][mM]\x3A/
  </delete>
</augment>

<augment 2255-3>
  active T
  comment "RPC sadmind query with root credentials attempt TCP"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 703-7>
  active F
  comment "MS-SQL/SMB xp_setsqlsecurity possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1211-6>
  active T
  comment "WEB-CGI web-map.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2465-3>
  active T
  comment "NETBIOS SMB-DS IPC$ share access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1160-11>
  active T
  comment "WEB-MISC Netscape dir index wp"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1082-8>
  active F
  comment "WEB-MISC amazon 1-click cookie theft"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 909-6>
  active T
  comment "WEB-COLDFUSION datasource username attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 1155-5>
  active T
  comment "WEB-MISC Ecommerce checks.txt access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2287-4>
  active T
  comment "WEB-PHP Advanced Poll admin_comment.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 927-7>
  active T
  comment "WEB-COLDFUSION settings refresh attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 378-7>
  active F
  comment "ICMP PING Ping-O-MeterWindows"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2544-3>
  active F
  comment "SMTP TLS SSLv3 invalid Client_Hello attempt"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 1842-9>
  active T
  comment IMAP login buffer overflow attempt
  comment "pcre: /\sLOGIN\s[^\n]{100}/smi"
  payload "/((^)|(\n+))[\x20\x09\x0b]LOGIN[\x20\x09\x0b][^\n]{100}/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/imap.rules
  <delete>
    payload "/.*LOGIN/"
  </delete>
</augment>

<augment 932-7>
  active T
  comment "WEB-COLDFUSION application.cfm access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 499-4>
  active F
  comment "ICMP Large ICMP Packet"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 838-9>
  active T
  comment "WEB-CGI webgais access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2448-2>
  active T
  comment "WEB-MISC setinfo.hts access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 465-3>
  active T
  comment "ICMP ISS Pinger"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 674-6>
  active T
  comment "MS-SQL xp_displayparamstmt possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 590-12>
  active T
  comment "RPC portmap ypserv request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1787-7>
  active T
  comment "WEB-CGI csPassword.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1244-10>
  active T
  comment "WEB-IIS ISAPI .idq attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 971-7>
  active T
  comment "WEB-IIS ISAPI .printer access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1662-5>
  active T
  comment "WEB-MISC /~ftp access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1054-7>
  active T
  comment WEB-MISC weblogic/tomcat .jsp view source attempt
  comment "pcre: /^\w+\s+[^\n\s\?]*\.jsp/smi"
  http "/((^)|(\n+))[a-zA-Z0-9_]+[\x20\x09\x0b]+[^\n\x20\x09\x0b\?]*\.[jJ][sS][pP]/"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
  <delete>
    http "/.*\.jsp/"
  </delete>
</augment>

<augment 1737-6>
  active T
  comment "WEB-PHP squirrel mail theme arbitrary command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1892-6>
  active T
  comment "SNMP null community string attempt"
  requires-reverse-signature snmp_userver_ok_return
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/snmp.rules
</augment>

<augment 2269-4>
  active T
  comment SMTP RCPT TO sendmail prescan too many addresses overflow
  comment "pcre: /^RCPT TO\x3a\s*[^\n]*?<[^\n]*?<[^\n]*?<"
  payload "/((^)|(\n+))[rR][cC][pP][tT] [tT][oO]\x3a\x20*[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?</"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload /.*[rR][cC][pP][tT] [tT][oO]\x3A/
  </delete>
</augment>

<augment 1679-4>
  active F
  comment "ORACLE describe attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/oracle.rules
</augment>

<augment 259-7>
  active T
  comment "DNS EXPLOIT named overflow ADM"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 415-5>
  active F
  comment "ICMP Information Reply"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2045-8>
  active T
  comment "RPC snmpXdmi overflow attempt UDP"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2133-5>
  active T
  comment "WEB-IIS MS BizTalk server access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2339-2>
  active T
  comment "TFTP NULL command attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/tftp.rules
</augment>

<augment 1819-5>
  active T
  comment "MISC Alcatel PABX 4400 connection attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 1479-8>
  active T
  comment "WEB-CGI ttawebtop.cgi arbitrary file attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 995-10>
  active T
  comment "WEB-IIS ism.dll access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1159-10>
  active T
  comment "WEB-MISC webplus access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 427-6>
  active F
  comment "ICMP Parameter Problem Unspecified Error"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2091-8>
  active T
  comment "WEB-IIS WEBDAV nessus safe scan attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1604-6>
  active F
  comment "WEB-MISC iChat directory traversal attempt"
  comment "too general"
  comment "old signature from 1999"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 381-6>
  active F
  comment "ICMP PING Sun Solaris"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1117-6>
  active T
  comment "WEB-MISC Lotus EditDoc attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1176-5>
  active T
  comment "WEB-MISC order.log access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 677-6>
  active T
  comment "MS-SQL/SMB sp_password password change"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 871-7>
  active T
  comment "WEB-CGI survey.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2489-2>
  active T
  comment "EXPLOIT esignal STREAMQUOTE buffer overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1030-7>
  active T
  comment "WEB-IIS search97.vts access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2539-3>
  active F
  comment "SMTP SSLv3 Server_Hello request"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 1408-8>
  active T
  comment "DOS MSDTC attempt"
  comment "change payload-size == 1024"
  payload-size "== 1024"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 1638-5>
  active T
  comment "SCAN SSH Version map attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 1133-11>
  active T
  comment "SCAN cybercop os probe"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 2057-5>
  active T
  comment "WEB-MISC helpout.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1988-3>
  active F
  comment "CHAT MSN file transfer accept"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 1625-5>
  active F
  comment "FTP large SYST command"
  comment Too many false positives for normal FTP traffic
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 417-5>
  active F
  comment "ICMP Information Request"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1562-11>
  active T
  comment FTP SITE CHOWN overflow attempt
  comment pcre: /^SITE\s+CHOWN\s[^\n]{100}/smi
  eval dataSizeG100
  ftp /((^)|(\n+))[sS][iI][tT][eE][\x20\x09\x0b]+[cC][hH][oO][wW][nN][\x20\x09\x0b][^\n]{100}/
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload /.*[sS][iI][tT][eE].*.*[cC][hH][oO][wW][nN]/
  </delete>
</augment>

<augment 1131-5>
  active T
  comment "WEB-MISC .wwwacl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2479-3>
  active F
  comment "NETBIOS SMB-DS DCERPC bind winreg unicode attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1849-7>
  active T
  comment "WEB-MISC webfind.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 402-7>
  active F
  comment "ICMP Destination Unreachable Port Unreachable"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1188-6>
  active T
  comment "WEB-MISC Netscape Enterprise Server directory view"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 250-4>
  active T
  comment "DDOS mstream handler to client"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 652-9>
  active T
  comment "SHELLCODE Linux shellcode"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 1345-5>
  active T
  comment "WEB-ATTACKS /usr/bin/cpp command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1218-5>
  active T
  comment "WEB-MISC adminlogin access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 627-7>
  active T
  comment "SCAN cybercop os SFU12 probe"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 1235-8>
  active T
  comment "WEB-MISC VirusWall FtpSaveCVP access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1580-4>
  active T
  comment "WEB-MISC Domino events4.nsf access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1711-4>
  active T
  comment "WEB-CGI bsguest.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1009-4>
  active T
  comment "WEB-IIS directory listing"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1544-5>
  active T
  comment "WEB-MISC Cisco Catalyst command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1915-9>
  active T
  comment "RPC STATD UDP monitor mon_name format string exploit attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2272-4>
  active T
  comment FTP LIST integer overflow attempt
  comment "pcre: /^LIST\s+\x22-W\s+\d+/smi"
  ftp "/((^)|(\n+))[lL][iI][sS][tT][\x20\x09\x0b]+\x22-W[\x20\x09\x0b]+[0-9]+/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[lL][iI][sS][tT]/"
  </delete>
</augment>

<augment 1948-4>
  active T
  comment "DNS zone transfer UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 103-7>
  active T
  comment "BACKDOOR subseven 22"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 663-13>
  active T
  comment SMTP rcpt to command attempt
  comment "pcre: /^rcpt\s+to\:\s+[|\x3b]/smi"
  payload "/((^)|(\n+))[rR][cC][pP][tT][\x20\x09\x0b][tT][oO]:[\x20\x09\x0b]+[|\x3b]/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload /.*[rR][cC][pP][tT] [tT][oO]\x3A/
  </delete>
</augment>

<augment 1959-7>
  active T
  comment "RPC portmap NFS request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2317-4>
  active T
  comment "MISC CVS non-relative path error response"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 1140-11>
  active T
  comment "WEB-MISC guestbook.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1718-4>
  active T
  comment "WEB-CGI statusconfig.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 462-7>
  active F
  comment "ICMP unassigned type 7"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 436-6>
  active F
  comment "ICMP Redirect for TOS and Host"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 579-8>
  active T
  comment "RPC portmap mountd request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 900-11>
  active F
  comment "WEB-CGI webspirs.cgi directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 287-6>
  active T
  comment "POP3 EXPLOIT x86 BSD overflow"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/pop3.rules
</augment>

<augment 1992-5>
  active T
  comment "FTP LIST directory traversal attempt"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 1404-5>
  active F
  comment "WEB-MISC showcode access"
  comment "duplicate of 1037"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 575-8>
  active T
  comment "RPC portmap admind request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 502-2>
  active T
  comment "MISC source route ssrr"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 1574-7>
  active T
  comment "WEB-CGI directorypro.cgi attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1258-10>
  active T
  comment "WEB-MISC HP OpenView Manager DOS"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1827-7>
  active T
  comment "WEB-MISC Tomcat servlet mapping cross site scripting attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1008-7>
  active T
  comment "WEB-IIS del attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2208-5>
  active T
  comment "WEB-CGI fom.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2007-10>
  active T
  comment "RPC kcms_server directory traversal attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1174-8>
  active T
  comment "WEB-CGI /cgi-bin/jj access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2412-3>
  active T
  comment "ATTACK-RESPONSES successful cross site scripting forced download attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/attack-responses.rules
</augment>

<augment 2366-4>
  active T
  comment "WEB-PHP PhpGedView PGV authentication_index.php base directory manipulation attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 886-11>
  active F
  comment "WEB-CGI phf access"
  comment "too general a sig, attack circa '99"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1921-5>
  active T
  comment FTP SITE ZIPCHK overflow attempt
  comment pcre: /^SITE\s+ZIPCHK\s[^\n]{100}/smi
  eval dataSizeG100
  ftp /((^)|(\n+))[sS][iI][tT][eE][\x20\x09\x0b]+[zZ][iI][pP][cC][hH][kK][\x20\x09\x0b][^\n]{100}/
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload /.*[sS][iI][tT][eE].{1}.*[zZ][iI][pP][cC][hH][kK]/
  </delete>
</augment>

<augment 1488-8>
  active T
  dst-ip == local_nets
  comment "WEB-CGI store.cgi directory traversal attempt"
  comment "verify application is not vulnerable"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1150-6>
  active T
  comment "WEB-MISC Domino catalog.nsf access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 541-9>
  active F
  comment "CHAT ICQ access"
  comment "informational only, not exploit worthy"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 2388-4>
  active T
  comment "WEB-CGI streaming server view_broadcast.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 702-8>
  active T
  comment "MS-SQL/SMB xp_displayparamstmt possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 2202-6>
  active T
  comment "WEB-CGI edit_action.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 972-8>
  active F
  comment "WEB-IIS %2E-asp access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 584-11>
  active T
  comment "RPC portmap rusers request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2315-6>
  active T
  comment "NETBIOS DCERPC Workstation Service direct service bind attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1877-5>
  active T
  comment "WEB-CGI printenv access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
  http /.*\/cgi-bin[^\/]*\/printenv/
  comment "Informational only"
  <delete>
  	http /.*[\/\\]printenv/
  </delete>
</augment>

<augment 1013-9>
  active T
  comment "WEB-IIS fpcount access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 518-6>
  active T
  comment "TFTP Put"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/tftp.rules
</augment>

<augment 860-8>
  active T
  comment "WEB-CGI snork.bat access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1999-4>
  active T
  comment "WEB-PHP edit_image.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 453-5>
  active F
  comment "ICMP Timestamp Request"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 669-8>
  active F
  comment "SMTP sendmail 8.6.9 exploit"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 1020-10>
  active T
  comment "WEB-IIS isc$data attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2352-7>
  active F
  comment "NETBIOS DCERPC ISystemActivator path overflow attempt big endian"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 208-5>
  active T
  comment "BACKDOOR PhaseZero Server Active on Network"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1824-6>
  active F
  dst-ip == local_nets
  comment "WEB-CGI alienform.cgi access"
  comment "informational only"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 574-8>
  active T
  comment "RPC mountd TCP export request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1427-4>
  active T
  comment "SNMP PROTOS test-suite-trap-app attempt"
  requires-reverse-signature snmp_userver_ok_return
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/snmp.rules
</augment>

<augment 1098-8>
  active T
  comment "WEB-MISC SmartWin CyberOffice Shopping Cart access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2159-8>
  active T
  comment "MISC BGP invalid type 0"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 807-11>
  active F
  comment "WEB-CGI /wwwboard/passwd.txt access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1961-7>
  active T
  comment "RPC portmap RQUOTA request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 552-7>
  active F
  comment "P2P napster upload request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/p2p.rules
</augment>

<augment 1022-8>
  active T
  comment "WEB-IIS jet vba access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 863-7>
  active T
  comment "WEB-CGI day5datacopier.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2054-4>
  active T
  comment "WEB-CGI enter_bug.cgi arbitrary command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2450-3>
  active F
  comment "CHAT Yahoo IM successful logon"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 1120-8>
  active T
  comment "WEB-MISC mylog.phtml access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 710-7>
  active T
  comment "TELNET EZsetup account attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/telnet.rules
</augment>

<augment 416-7>
  active F
  comment "ICMP Information Reply undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 875-9>
  active T
  comment "WEB-CGI win-c-sample.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1302-7>
  active T
  comment "WEB-MISC console.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2020-4>
  active T
  comment "RPC mountd TCP unmount request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1090-7>
  active T
  comment "WEB-CGI Allaire Pro Web Shell attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2010-4>
  active T
  comment "MISC CVS double free exploit attempt response"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 1672-10>
  active T
  comment FTP CWD ~ attempt
  comment pcre: /^CWD\s+~/smi
  ftp /((^)|(\n+))CWD[\x20\x09\x0b]+~/
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload /.*CWD/
  </delete>
</augment>

<augment 1051-9>
  active T
  comment "WEB-CGI technote main.cgi file directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 898-9>
  active T
  comment "WEB-CGI commerce.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1578-4>
  active F
  comment "WEB-MISC Domino statrep.nsf access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1397-6>
  active T
  comment "WEB-CGI wayboard attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 423-5>
  active F
  comment "ICMP Mobile Registration Request"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1878-5>
  active T
  comment "WEB-CGI sdbsearch.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2030-6>
  active T
  comment "RPC yppasswd new password overflow attempt TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 673-5>
  active T
  comment "MS-SQL sp_start_job - program execution"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1450-5>
  active T
  comment "SMTP expn *@"
  comment "pcre: /^expn\s+\*@/smi"
  payload "/((^)|(\n+))[eE][xX][pP][nN][\x20\x09\x0b]\*@/"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload "/.*[eE][xX][pP][nN]/"
    payload "/.*\*@/"
  </delete>
</augment>

<augment 1106-9>
  active T
  comment "WEB-CGI Poll-it access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1844-9>
  active T
  comment IMAP authenticate overflow attempt
  comment "pcre: /\sAUTHENTICATE\s[^\n]{100}/smi"
  payload "/((^)|(\n+))[\x20\x09\x0b][aA][uU][tT][hH][eE][nN][tT][iI][cC][aA][tT][eE][\x20\x09\x0b][^\n]{100}/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/imap.rules
  <delete>
    payload "/.*[aA][uU][tT][hH][eE][nN][tT][iI][cC][aA][tT][eE]/"
  </delete>
</augment>

<augment 671-8>
  active T
  comment "SMTP sendmail 8.6.9c exploit"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 894-8>
  active T
  comment "WEB-CGI bb-hist.sh access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2206-6>
  active T
  comment "WEB-CGI ezman.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 375-6>
  active F
  comment "ICMP PING LINUX/*BSD"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1148-5>
  active T
  comment "WEB-MISC Ecommerce import.txt access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 695-7>
  active T
  comment "MS-SQL/SMB xp_sprintf possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 857-10>
  active T
  comment "WEB-CGI faxsurvey access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2474-3>
  active T
  comment "NETBIOS SMB-DS ADMIN$ share access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1894-8>
  active T
  comment "EXPLOIT kadmind buffer overflow attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1011-7>
  active T
  comment "WEB-IIS exec-src access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 397-6>
  active F
  comment "ICMP Destination Unreachable Host Precedence Violation"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 255-11>
  active T
  comment "DNS zone transfer TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 1774-3>
  active T
  comment "WEB-PHP bb_smilies.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2501-8>
  active F
  comment "POP3 SSLv3 invalid timestamp attempt"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/pop3.rules
</augment>

<augment 430-6>
  active F
  comment "ICMP Photuris Unknown Security Parameters Index"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 707-8>
  active T
  comment "MS-SQL xp_proxiedmetadata possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1332-5>
  active T
  comment "WEB-ATTACKS /usr/bin/id command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 667-5>
  active T
  comment "SMTP sendmail 8.6.10 exploit"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 2216-6>
  active T
  comment "WEB-CGI readmail.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2558-2>
  active T
  comment "EXPLOIT Oracle Web Cache MKCOL overflow attempt"
  comment pcre: /^MKCOL[^s]{432}/sm
  payload /((^)|(\n+))MKCOL[^s]{432}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
  <delete>
    payload /.*MKCOL/
  </delete>
</augment>

<augment 2205-6>
  active F
  dst-ip == local_nets
  comment "WEB-CGI ezboard.cgi access"
  comment "Too general"
  comment "vulnerabilities are too broad"
  comment "Suggestion: analyze site version of software and test for vulnerability, make any adjustments, and then disable this rule."
  requires-reverse-signature ! http_error
  http /.*[\/\\]ezboard\.cgi/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1910-10>
  active T
  comment "RPC CMSD udp CMSD_INSERT buffer overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 668-6>
  active T
  comment "SMTP sendmail 8.6.10 exploit"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 311-11>
  active T
  comment "EXPLOIT Netscape 4.7 unsucessful overflow"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 2351-7>
  active F
  comment "NETBIOS DCERPC ISystemActivator path overflow attempt little endian"
  comment "Functions not supported"
  comment "Better suited to a Bro analizer"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1951-5>
  active T
  comment "RPC mountd TCP mount request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1185-10>
  active T
  comment "WEB-CGI bizdbsearch attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1608-5>
  active T
  comment "WEB-CGI htmlscript attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 278-5>
  active T
  comment "DOS Real Server template.html"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 812-9>
  active F
  comment "WEB-CGI webplus version access"
  comment "informational only"
  comment "old signature from 04-10-2000"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1707-7>
  active T
  comment "WEB-CGI hello.bat arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2526-6>
  active F
  comment "NETBIOS SMB-DS DCERPC LSASS direct bind attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1642-7>
  active T
  comment "WEB-CGI document.d2w access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1751-5>
  active T
  comment "EXPLOIT cachefsd buffer overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1591-6>
  active T
  comment "WEB-CGI faqmanager.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1336-5>
  active T
  comment "WEB-ATTACKS chmod command attempt"
  requires-reverse-signature ! http_error
  http /.*\/[cC][hH][mM][oO][dD]([^-a-zA-Z0-9_.]|$)/
  <delete>
  	payload /.*\/[bB][iI][nN]\/[cC][hH][mM][oO][dD]/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1029-7>
  active T
  comment "WEB-IIS scripts-browse access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 380-7>
  active F
  comment "ICMP PING Seer Windows"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 808-8>
  active F
  comment "WEB-CGI webdriver access"
  comment "informational only"
  comment "old signature from 12-30-2000"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2410-2>
  active T
  comment "WEB-PHP IGeneric Free Shopping Cart page.php access"
  dst-ip == local_nets
  http /.*[\/\\]page\.php\?.*script/
  <delete>
  	http /.*[\/\\]page\.php/
  </delete>
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1475-4>
  active T
  comment "WEB-CGI mailit.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2151-4>
  active T
  comment "WEB-PHP ttCMS header.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_QUIET
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1730-7>
  active T
  comment "WEB-CGI ustorekeeper.pl directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 310-8>
  active T
  comment "EXPLOIT x86 windows MailMax overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 2510-7>
  active F
  comment "NETBIOS SMB DCERPC LSASS bind attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2293-4>
  active T
  comment "WEB-PHP Advanced Poll admin_password.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1492-5>
  active T
  comment "WEB-MISC RBS ISP /newuser  directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2538-3>
  active F
  comment "SMTP SSLv3 Client_Hello request"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 2428-3>
  active T
  comment NNTP ihave overflow attempt
  comment "pcre: /^ihave\x3a[^\n]{21}/smi"
  payload "/((^)|(\n+))[iI][hH][aA][vV][eE]\x3a[^\n]{21}/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/nntp.rules
  <delete>
    payload "/.*[iI][hH][aA][vV][eE]/"
  </delete>
</augment>

<augment 1810-9>
  active T
  comment "ATTACK-RESPONSES successful gobbles ssh exploit GOBBLE"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/attack-responses.rules
</augment>

<augment 1912-9>
  active T
  comment "RPC sadmind TCP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2017-12>
  active T
  comment "RPC portmap espd request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 497-8>
  active T
  comment "ATTACK-RESPONSES file copied ok"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/attack-responses.rules
</augment>

<augment 1964-8>
  active T
  comment "RPC tooltalk UDP overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 936-5>
  active T
  comment "WEB-COLDFUSION gettempdirectory.cfm access "
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 505-5>
  active T
  comment "MISC Insecure TIMBUKTU Password"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 1506-7>
  active T
  comment "WEB-CGI alchemy http server NUL arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1923-6>
  active T
  comment "RPC portmap proxy attempt UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1390-5>
  active T
  comment "SHELLCODE x86 inc ebx NOOP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 2264-4>
  active T
  comment SMTP SAML FROM sendmail prescan too long addresses overflow
  comment "pcre: /^SAML FROM\x3a\s+[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}/smi"
  payload "/((^)|(\n+))[sS][aA][mM][lL] [fF][rR][oO][mM]:[\x20\x09\x0b]+[a-zA-Z0-9_\x20\x09\x0b@\.]{0,200}\x3b[a-zA-Z0-9_\x20\x09\x0b@\.]{200,}\x3b[a-zA-Z0-9_\x20\x09\x0b@\.]{0,200}/"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload /.*[sS][aA][mM][lL] [fF][rR][oO][mM]\x3A/
  </delete>
</augment>

<augment 709-7>
  active T
  comment "TELNET 4Dgifts SGI account attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/telnet.rules
</augment>

<augment 606-5>
  active T
  comment "RSERVICES rlogin root"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rservices.rules
</augment>

<augment 1788-3>
  active T
  comment "WEB-CGI csPassword password.cgi.tmp access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2469-3>
  active T
  comment "NETBIOS SMB-DS D$ share unicode access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 226-6>
  active T
  comment "DDOS Stacheldraht server response"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 1095-6>
  active T
  comment "WEB-MISC Talentsoft Web+ Source Code view access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 490-6>
  active F
  comment "INFO battle-mail traffic"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/info.rules
</augment>

<augment 2181-2>
  active F
  comment "P2P BitTorrent transfer"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/p2p.rules
</augment>

<augment 1385-11>
  active T
  comment "WEB-MISC mod-plsql administration access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1109-8>
  active T
  comment "WEB-MISC ROXEN directory list attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2105-4>
  active T
  comment IMAP authenticate literal overflow attempt
  comment "pcre: /\sAUTHENTICATE\s[^\n]*?\s\{/smi"
  payload "/((^)|(\n+))[\x20\x09\x0b][aA][uU][tT][hH][eE][nN][tT][iI][cC][aA][tT][eE][\x20\x09\x0b][^\n]*?[\x20\x09\x0b]\{/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/imap.rules
  <delete>
    payload "/.*[aA][uU][tT][hH][eE][nN][tT][iI][cC][aA][tT][eE]/"
  </delete>
</augment>

<augment 231-3>
  active T
  comment "DDOS Trin00 Daemon to Master message detected"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 1439-5>
  active F
  comment "MULTIMEDIA Shoutcast playlist redirection"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/multimedia.rules
</augment>

<augment 1838-8>
  active T
  comment EXPLOIT SSH server banner overflow
  comment "pcre: /^SSH-\s[^\n]{200}/ism"
  payload "/((^)|(\n+))[sS][sS][hH]-[\x20\x09\x0b][^\n]{200}/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
  <delete>
    payload "/.*[sS][sS][hH]-/"
  </delete>
</augment>

<augment 1597-7>
  active F
  comment "WEB-CGI guestbook.cgi access"
  comment "too general"
  comment "informational only"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1858-5>
  active T
  comment "WEB-MISC CISCO PIX Firewall Manager directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 449-6>
  active F
  comment "ICMP Time-To-Live Exceeded in Transit"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 830-7>
  active F
  comment "WEB-CGI NPH-publish access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
  comment "duplicate of 1451-6"
</augment>

<augment 1349-5>
  active F
  comment "WEB-ATTACKS bin/python access attempt"
  comment "informational only"
  comment "too general"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1368-6>
  active T
  comment "WEB-ATTACKS /bin/ls| command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 2101-9>
  active T
  comment "NETBIOS SMB SMB_COM_TRANSACTION Max Parameter and Max Count of 0 DOS Attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2529-3>
  active F
  comment "IMAP SSLv3 Client_Hello request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/imap.rules
</augment>

<augment 2031-5>
  active T
  comment "RPC yppasswd user update UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1025-6>
  active T
  comment "WEB-IIS perl access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2490-3>
  active T
  comment "EXPLOIT esignal SNAPQUOTE buffer overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 810-11>
  active F
  comment "WEB-CGI whois_raw.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
  comment "duplicate of 1410"
</augment>

<augment 2349-5>
  active F
  comment "NETBIOS SMB-DS DCERPC enumerate printers request attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2312-2>
  active T
  comment "SHELLCODE x86 0x71FB7BAB NOOP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 1166-8>
  active T
  comment "WEB-MISC ws_ftp.ini access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 997-6>
  active T
  comment "WEB-IIS asp-dot attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2306-4>
  active T
  comment WEB-PHP gallery arbitrary command execution attempt
  comment pcre: /GALLERY_BASEDIR=(http|https|ftp)/i
  http /.*[gG][aA][lL][lL][eE][rR][yY]_[bB][aA][sS][eE][dD][iI][rR]=(http|https|ftp)/
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
  <delete>
    payload /.*GALLERY_BASEDIR=/
  </delete>
</augment>

<augment 1973-6>
  active T
  comment FTP MKD overflow attempt
  comment pcre: /^MKD\s[^\n]{100}/smi
  eval dataSizeG100
  ftp /((^)|(\n+))[mM][kK][dD][\x20\x09\x0b][^\n]{100}/
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload /.*[mM][kK][dD]/
  </delete>
</augment>

<augment 1279-14>
  active T
  comment "RPC portmap snmpXdmi request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 120-5>
  active T
  comment "BACKDOOR Infector 1.6 Server to Client"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 2310-8>
  active T
  comment "NETBIOS SMB-DS DCERPC Workstation Service unicode bind attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1876-4>
  active T
  comment "WEB-CGI nph-publish.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1558-5>
  active T
  comment "WEB-MISC Delegate whois overflow attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2396-2>
  active T
  comment "WEB-CGI CCBill whereami.cgi arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1757-3>
  active T
  comment "WEB-MISC b2 arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1888-8>
  active T
  comment FTP SITE CPWD overflow attempt
  comment "pcre: /^SITE\s+CPWD\s[^\n]{100}/smi"
  eval dataSizeG100
  ftp "/((^)|(\n+))[sS][iI][tT][eE][\x20\x09\x0b]+[cC][pP][wW][dD][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[sS][iI][tT][eE].*.*[cC][pP][wW][dD]/"
  </delete>
</augment>

<augment 508-7>
  active T
  comment "MISC gopher proxy"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 2095-6>
  active T
  comment "RPC CMSD TCP CMSD_CREATE array buffer overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2491-5>
  active F
  comment "NETBIOS SMB-DS DCERPC ISystemActivator unicode bind attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1178-6>
  active T
  comment "WEB-PHP Phorum read access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1419-9>
  active T
  comment "SNMP trap udp"
  requires-reverse-signature snmp_userver_ok_return
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/snmp.rules
</augment>

<augment 1553-7>
  active T
  comment "WEB-CGI /cart/cart.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2288-4>
  active T
  comment "WEB-PHP Advanced Poll admin_edit.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 271-4>
  active T
  comment "DOS UDP echo+chargen bomb"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 308-8>
  active T
  comment "EXPLOIT NextFTP client overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 2294-4>
  active F
  comment "WEB-PHP Advanced Poll admin_preview.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2035-6>
  active T
  comment "RPC portmap network-status-monitor request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2123-2>
  active T
  comment "ATTACK-RESPONSES Microsoft cmd.exe banner"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/attack-responses.rules
</augment>

<augment 1234-8>
  active T
  comment "WEB-MISC VirusWall FtpSaveCSP access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2147-7>
  active T
  comment "WEB-PHP BLNews objects.inc.php4 remote file include attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1381-5>
  active T
  comment "WEB-MISC Trend Micro OfficeScan attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 371-7>
  active F
  comment "ICMP PING Cisco Type.x"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 522-2>
  active T
  comment "MISC Tiny Fragments"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 1417-9>
  active F
  comment "SNMP request udp"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/snmp.rules
</augment>

<augment 639-5>
  active T
  comment "SHELLCODE SGI NOOP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 1457-6>
  active T
  comment "WEB-CGI user_update_admin.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 334-5>
  active T
  comment "FTP .forward"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 1979-4>
  active F
  comment "WEB-MISC perl post attempt"
  comment "too general"
  comment "perl POST attempts are normal in the real world"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 225-6>
  active T
  comment "DDOS Stacheldraht gag server response"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 2291-4>
  active T
  comment "WEB-PHP Advanced Poll admin_license.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1851-6>
  active T
  comment "WEB-MISC active.log access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1848-5>
  active T
  comment "WEB-MISC webcart-lite access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2487-4>
  active T
  comment "SMTP WinZip MIME content-type buffer overflow"
  comment pcre: /name=[^\r\n]*?\.(mim|uue|uu|b64|bhx|hqx|xxe)/smi
  comment pcre: /(name|id|number|total|boundary)=\s*[^\r\n\x3b\s\x2c]{300}/smi
  payload /[nN][aA][mM][eE]=[^\r\n]*?\.([mM][iI][mM]|[uU]{2}[eE]?|[bB]64|[bB][hH][xX]|[hH][qQ][xX]|[xX]{2}[eE])/
  payload /([nN][aA][mM][eE]|[iI][dD]|[nN][uU][mM][bB][eE][rR]|[tT][oO][tT][aA][lL]|[bB][oO][uU][nN][dD][aA][rR][yY])=[\x20\x09\x0b]*[^\r\n\x3b\s\x2c]{300}/
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 2553-2>
  active T
  comment "EXPLOIT Oracle Web Cache PUT overflow attempt"
  comment pcre: /^PUT[^s]{432}/sm
  payload /((^)|(\n+))PUT[^s]{432}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
  <delete>
    payload /.*PUT/
  </delete>
</augment>

<augment 2009-2>
  active T
  src-ip == local_nets
  comment "MISC CVS invalid repository response"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 459-7>
  active F
  comment "ICMP unassigned type 1 undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2437-5>
  active T
  comment WEB-CLIENT RealPlayer arbitrary javascript command attempt
  comment "pcre: /^Content-Type\x3a\s+application\x2fsmi.*?<area[\s\n\r]+href=[\x22\x27]file\x3ajavascript\x3a/smi"
  requires-signature http_real_client
  http "/((^)|(\n+))[cC][oO][nN][tT][eE][nN][tT]-[tT][yY][pP][eE]\x3a[\x20\x09\x0b][aA][pP][pP][lL][iI][cC][aA][tT][iI][oO][nN]\x2f[sS][mM][iI].*?<[aA][rR][eE][aA][\x20\x09\x0b\n\r]+href=[\x22\x27][fF][iI][lL][eE]\x3ajavascript\x3a/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-client.rules
  <delete>
    payload /.*[cC][oO][nN][tT][eE][nN][tT]-[tT][yY][pP][eE]\x3A/
  </delete>
</augment>

<augment 1904-7>
  active T
  comment "IMAP find overflow attempt"
  comment pcre: /\sFIND\s[^\n]{100}/smi
  payload /((^)|(\n+))[\x20\x09\x0b][fF][iI][nN][dD][\x20\x09\x0b][^\n]{100}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/imap.rules
  <delete>
    payload /.*[fF][iI][nN][dD]/
  </delete>
</augment>

<augment 1636-8>
  active T
  comment MISC Xtramail Username overflow attempt
  comment pcre: /^Username\:[^\n]{100}/smi
  payload /((^)|(\n+))[uU][sS][eE][rR][nN][aA][mM][eE]\:[^\n]{100}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
  <delete>
    payload /.*[uU][sS][eE][rR][nN][aA][mM][eE]\x3A/
  </delete>
</augment>

<augment 1790-4>
  active T
  comment "CHAT IRC dns response"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 815-9>
  active F
  comment "WEB-CGI websendmail access"
  comment "informational only"
  comment "old signature from 06-01-1999"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2016-6>
  active T
  comment "RPC portmap status request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1493-5>
  active T
  comment "WEB-MISC RBS ISP /newuser access"
  comment "port 8002 needs to be referencd and some ../ needs to be there as well"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
  http /.*\x3a8002.*[\/\\]newuser\x3f.*\x2e\x2e[\/\\]/
  <delete>
	http /.*[\/\\]newuser/
  </delete>
</augment>

<augment 581-9>
  active T
  comment "RPC portmap pcnfsd request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 577-13>
  active F
  comment "RPC portmap bootparam request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 223-3>
  active T
  comment "DDOS Trin00 Daemon to Master PONG message detected"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 305-9>
  active T
  comment "EXPLOIT delegate proxy overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 2383-9>
  active T
  comment "NETBIOS SMB-DS DCERPC NTLMSSP invalid mechtype attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 243-2>
  active T
  comment "DDOS mstream agent to handler"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 2072-3>
  active T
  dst-ip == local_nets
  comment "WEB-MISC lyris.pl admin access"
  requires-reverse-signature ! http_error
  http /POST.*[\/\\]lyris\.pl/
  payload /list_admin=T/
  event "WEB-MISC lyris.pl admin access"
  <delete>
  	http /.*[\/\\]lyris\.pl/
  	event "WEB-MISC lyris.pl access"
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 472-4>
  active T
  comment "ICMP redirect host"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 369-6>
  active F
  comment "ICMP PING BayRS Router"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2470-3>
  active T
  comment "NETBIOS SMB C$ share unicode access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1650-6>
  active T
  comment "WEB-CGI tst.bat access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 615-8>
  active F
  comment "SCAN SOCKS Proxy attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 1868-5>
  active T
  comment "WEB-CGI story.pl arbitrary file read attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 693-5>
  active T
  comment "MS-SQL shellcode attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 2052-3>
  active T
  comment "WEB-CGI overflow.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1145-7>
  active T
  comment "WEB-MISC /~root access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1448-10>
  active T
  comment "MISC MS Terminal server request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 266-6>
  active T
  comment "DNS EXPLOIT x86 FreeBSD overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 2092-5>
  active F
  comment "RPC portmap proxy integer overflow attempt UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>


<augment 2576-2>
  active T
  comment "ORACLE generate_replication_support prefix overflow attempt"
  comment "pcre: /(package|procedure)_prefix[\s\r\n]*=>[\s\r\n]*('[^']{1000,}|"[^"]{1000,})/Rsmi"
  payload "/([pP][aA][cC][kK][aA][gG][eE]|[pP][rR][oO][cC][eE][dD][uU][rR][eE])_[pP][rR][eE][fF][iI][xX][\x20\x09\x0b\r\n]*=>[\x20\x09\x0b\r\n]*('[^']{1000,}|"[^"]{1000,})/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/oracle.rules
</augment>

<augment 2125-8>
  active T
  comment "FTP CWD Root directory transversal attempt"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 516-3>
  active T
  comment "MISC SNMP NT UserList"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 1539-6>
  active F
  comment "WEB-CGI /cgi-bin/ls access"
  comment "too many false positives"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1916-9>
  active T
  comment "RPC STATD TCP monitor mon_name format string exploit attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 595-16>
  active T
  comment "RPC portmap espd request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 534-6>
  active T
  comment "NETBIOS SMB CD.."
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2482-3>
  active F
  comment "NETBIOS SMB-DS DCERPC shutdown attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 949-6>
  active T
  comment "WEB-FRONTPAGE registrations.htm access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 824-9>
  active F
  comment "WEB-CGI php.cgi access"
  comment "informational only"
  comment "too general"
  comment "old signature from 06-01-1999"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2197-7>
  active T
  comment "WEB-CGI cvsview2.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 540-11>
  active F
  comment "CHAT MSN message"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 1461-5>
  active T
  comment "WEB-CGI bb-rep.sh access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 395-6>
  active F
  comment "ICMP Destination Unreachable Destination Network Unknown"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1616-6>
  active F
  comment "DNS named version attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 1500-6>
  active T
  comment "WEB-MISC ExAir access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2262-4>
  active T
  comment SMTP SEND FROM sendmail prescan too long addresses overflow
  comment pcre: /^SEND FROM\x3a\s+[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}/smi
  payload /((^)|(\n+))[sS][eE][nN][dD] [fF][rR][oO][mM]:[\x20\x09\x0b]+[a-zA-Z0-9\x5f\x20\x09\x0b@\.]{0,200}\x3b[a-zA-Z0-9_\x20\x09\x0b@\.]{200,}\x3b[a-zA-Z0-9_\x20\x09\x0b@\.]{0,200}/
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload /.*[sS][eE][nN][dD] [fF][rR][oO][mM]\x3A/
  </delete>
</augment>

<augment 2504-6>
  active T
  comment "SMTP SSLv3 invalid data version attempt"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 2089-5>
  active T
  comment "RPC ypupdated arbitrary command attempt TCP"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1513-9>
  active T
  comment "WEB-CGI input.bat access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 682-6>
  active T
  comment "MS-SQL xp_enumresultset possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 2282-2>
  active T
  comment "WEB-PHP GlobalFunctions.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2508-6>
  active F
  comment "NETBIOS DCERPC LSASS DsRolerUpgradeDownlevelServer Exploit attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 117-6>
  active T
  comment "BACKDOOR Infector.1.x"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 158-5>
  active T
  comment "BACKDOOR BackConstruction 2.1 Server FTP Open Reply"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1763-6>
  active T
  comment "WEB-CGI Nortel Contivity cgiproc DOS attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1762-4>
  active T
  comment "WEB-CGI phf arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1179-7>
  active T
  comment "WEB-PHP Phorum violation access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1494-6>
  active T
  comment "WEB-CGI SIX webboard generate.cgi attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1834-5>
  active T
  comment "WEB-PHP PHP-Wiki cross site scripting attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2475-3>
  active T
  comment "NETBIOS SMB-DS ADMIN$ share unicode access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 964-6>
  active T
  comment "WEB-FRONTPAGE users.pwd access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 320-9>
  active T
  comment "FINGER cmd_rootsh backdoor attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/finger.rules
</augment>

<augment 878-6>
  active T
  comment "WEB-CGI w3tvars.pm access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1452-5>
  active T
  comment "WEB-CGI args.cmd access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1101-7>
  active T
  comment "WEB-MISC Webtrends HTTP probe"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1441-4>
  active T
  comment "TFTP GET nc.exe"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/tftp.rules
</augment>

<augment 1207-7>
  active T
  comment "WEB-MISC htgrep access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1019-8>
  active T
  comment "WEB-IIS index server file source code attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1339-5>
  active T
  comment "WEB-ATTACKS chsh command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1240-5>
  active T
  comment "EXPLOIT MDBMS overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1557-7>
  active T
  comment "WEB-CGI DCShop auth_user_file.txt access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1264-13>
  active T
  comment "RPC portmap bootparam request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 933-7>
  active T
  comment "WEB-COLDFUSION onrequestend.cfm access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 512-4>
  active T
  comment "MISC PCAnywhere Failed Login"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 1525-9>
  active T
  comment "WEB-MISC Axis Storpoint CD access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1348-5>
  active T
  comment "WEB-ATTACKS g++ command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_QUIET
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 902-7>
  active T
  comment "WEB-CGI tstisapi.dll access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1767-6>
  active T
  comment "WEB-MISC search.dll access"
  comment "requires sambar web server"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
  eval isNotIIS
  eval isNotApache
</augment>

<augment 1047-9>
  active T
  comment "WEB-MISC Netscape Enterprise DOS"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1089-9>
  active T
  comment "WEB-CGI shopping cart directory traversal"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 687-5>
  active T
  comment "MS-SQL xp_cmdshell - program execution"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 2552-2>
  active T
  comment "EXPLOIT Oracle Web Cache HEAD overflow attempt"
  comment pcre: /^HEAD[^s]{432}/sm
  payload /((^)|(\n+))HEAD[^s]{432}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 384-5>
  active F
  comment "ICMP PING"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 836-7>
  active T
  comment "WEB-CGI textcounter.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1722-4>
  active T
  comment "WEB-CGI MachineInfo access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 873-8>
  active F
  comment "WEB-CGI scriptalias access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 477-2>
  active F
  comment "ICMP Source Quench"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 2198-6>
  active T
  comment "WEB-CGI cvslog.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 859-7>
  active T
  comment "WEB-CGI man.sh access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 662-5>
  active T
  comment "SMTP sendmail 5.5.5 exploit"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 441-6>
  active F
  comment "ICMP Router Advertisement"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 880-8>
  active T
  comment "WEB-CGI LWGate access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1017-8>
  active T
  comment "WEB-IIS idc-srch attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 326-9>
  active T
  comment "FINGER remote command execution attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/finger.rules
</augment>

<augment 2234-5>
  active T
  comment "WEB-MISC TOP10.dll access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 359-5>
  active T
  comment "FTP satan scan"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 2420-2>
  active F
  comment "MULTIMEDIA realplayer .rmp playlist download attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/multimedia.rules
</augment>

<augment 2429-3>
  active T
  comment NNTP sendme overflow attempt
  comment "pcre: /^sendme\x3a[^\n]{21}/smi"
  payload /((^)|(\n+))[sS][eE][nN][dD][mM][eE]\x3a[^\n]{21}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/nntp.rules
  <delete>
    payload /.*[sS][eE][nN][dD][mM][eE]/
  </delete>
</augment>

<augment 2513-7>
  active F
  comment "NETBIOS SMB-DS DCERPC LSASS unicode bind attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2427-3>
  active T
  comment "NNTP checkgroups overflow attempt"
  comment pcre: /^checkgroups\x3a[^\n]{21}/smi
  payload /((^)|(\n+))[cC][hH][eE][cC][kK][gG][rR][oO][uU][pP][sS]\x3a[^\n]{21}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/nntp.rules
  <delete>
    payload /.*[cC][hH][eE][cC][kK][gG][rR][oO][uU][pP][sS]/
  </delete>
</augment>

<augment 2485-4>
  active T
  comment "WEB-CLIENT Nortan antivirus sysmspam.dll load attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-client.rules
</augment>

<augment 488-4>
  active F
  comment "INFO Connection Closed MSG from Port 80"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/info.rules
</augment>

<augment 2483-3>
  active F
  comment "NETBIOS SMB-DS DCERPC shutdown little endian attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2129-9>
  active T
  comment "WEB-IIS nsiislog.dll access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1486-4>
  active T
  comment "WEB-IIS ctss.idc access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 923-7>
  active T
  comment "WEB-COLDFUSION getodbcin attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 2245-5>
  active T
  comment "WEB-MISC Webnews.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2370-2>
  active T
  comment "WEB-MISC BugPort config.conf file access"
  requires-reverse-signature ! http_error
  sigaction SIG_QUIET
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2531-3>
  active F
  comment "IMAP SSLv3 invalid Client_Hello attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/imap.rules
</augment>

<augment 2244-4>
  active T
  comment "WEB-MISC VsSetCookie.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1172-10>
  active T
  comment "WEB-CGI bigconf.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1168-5>
  active T
  comment "WEB-MISC mall log order access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1167-7>
  active T
  comment "WEB-MISC rpm_query access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 530-10>
  active T
  comment "NETBIOS NT NULL session"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2466-3>
  active T
  comment "NETBIOS SMB-DS IPC$ share unicode access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1920-6>
  active T
  comment FTP SITE NEWER overflow attempt
  comment pcre: /^SITE\s+NEWER\s[^\n]{100}/smi
  eval dataSizeG100
  ftp /((^)|(\n+))[sS][iI][tT][eE][\x20\x09\x0b]+[nN][eE][wW][eE][rR][\x20\x09\x0b][^\n]{100}/
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload /.*[sS][iI][tT][eE].*.*[nN][eE][wW][eE][rR]/
  </delete>
</augment>

<augment 1410-9>
  active T
  comment "WEB-CGI dcboard.cgi access"
  comment "too general but low occurence"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1579-4>
  active T
  comment "WEB-MISC Domino webadmin.nsf access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 403-6>
  active F
  comment "ICMP Destination Unreachable Precedence Cutoff in effect"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2389-4>
  active T
  comment FTP RNTO overflow attempt
  comment pcre: /^RNTO\s[^\n]{100}/smi
  eval dataSizeG100
  ftp /((^)|(\n+))[rR][nN][tT][oO][\x20\x09\x0b][^\n]{100}/
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload /.*[rR][nN][tT][oO]/
  </delete>
</augment>

<augment 2158-5>
  active F
  comment "MISC BGP invalid length"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 2417-1>
  active T
  comment "FTP format string attempt"
  comment pcre: /\s+.*?%.*?%/smi
  ftp /[\x20\x09\x0b]+.*?%.*?%/
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 1275-10>
  active T
  comment "RPC portmap yppasswd request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2290-4>
  active T
  comment "WEB-PHP Advanced Poll admin_help.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1253-11>
  active T
  comment "TELNET bsd exploit client finishing"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/telnet.rules
</augment>

<augment 2185-7>
  active T
  comment "RPC mountd UDP mount path overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 387-7>
  active F
  comment "ICMP Address Mask Reply undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 274-5>
  active T
  comment "DOS ath"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 1362-5>
  active T
  comment "WEB-ATTACKS xterm command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 2423-2>
  active T
  comment NNTP article post without path attempt
  comment pcre: /^takethis.*?Path\x3a.*?[\r]{0,1}?\n[\r]{0,1}\n/si
  http /((^)|(\n+))[tT][aA][kK][eE][tT][hH][iI][sS].*?[pP][Aa][Tt][Hh]\x3a.*?[\r]{0,1}?\n[\r]{0,1}\n/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/nntp.rules
  <delete>
    http /.*\.rp/
  </delete>
</augment>

<augment 1741-5>
  active T
  comment "WEB-PHP DNSTools access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1822-7>
  active F
  comment "WEB-CGI alienform.cgi directory traversal attempt"
  comment "merged with s2b-1823-7"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2569-1>
  active F
  comment "WEB-MISC cPanel resetpass access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2043-2>
  active T
  comment "MISC isakmp login failed"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 1586-4>
  active T
  comment "WEB-MISC Domino mail.box access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 542-10>
  active T
  comment "CHAT IRC nick change"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 1643-6>
  active F
  comment "WEB-CGI db2www access"
  comment "too general to be useful"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2577-2>
  active F
  comment "WEB-CLIENT local resource redirection attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-client.rules
</augment>

<augment 2299-4>
  active T
  comment "WEB-PHP Advanced Poll admin_tpl_misc_new.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 275-10>
  active T
  comment "DOS NAPTHA"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 1890-8>
  active T
  comment "RPC status GHBN format string attack"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1284-10>
  active T
  comment "WEB-CLIENT readme.eml download attempt"
  requires-signature http_msie_client
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-client.rules
</augment>

<augment 368-6>
  active F
  comment "ICMP PING BSDtype"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1735-4>
  active T
  comment "WEB-CLIENT XMLHttpRequest attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-client.rules
</augment>

<augment 379-7>
  active F
  comment "ICMP PING Pinger Windows"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1605-6>
  active T
  dst-ip == local_nets
  comment "DOS iParty DOS attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 2094-6>
  active T
  comment "RPC CMSD UDP CMSD_CREATE array buffer overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2540-3>
  active F
  comment "SMTP SSLv3 invalid Client_Hello attempt"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 2004-5>
  active F
  comment "MS-SQL Worm propagation attempt OUTBOUND"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 2391-4>
  active T
  comment FTP APPE overflow attempt
  comment pcre: /^APPE\s[^\n]{100}/smi
  eval dataSizeG100
  payload /((^)|(\n+))[aA][pP][pP][eE][\x20\x09\x0b][^\n]{100}/
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload /.*[aA][pP][pP][eE]/
  </delete>
</augment>

<augment 2025-9>
  active T
  comment "RPC yppasswd username overflow attempt UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 532-8>
  active T
  comment "NETBIOS SMB ADMIN$ share access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2431-3>
  active T
  comment NNTP rmgroup overflow attempt
  comment pcre: /^rmgroup\x3a[^\n]{21}/smi
  payload /((^)|(\n+))[rR][mM][gG][rR][oO][uU][pP]\x3a[^\n]{21}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/nntp.rules
  <delete>
    payload /.*[rR][mM][gG][rR][oO][uU][pP]/
  </delete>
</augment>

<augment 162-4>
  active T
  comment "BACKDOOR Matrix 2.0 Server access"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1552-4>
  active T
  comment "WEB-MISC cvsweb version access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1652-6>
  active T
  comment "WEB-CGI campus attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 222-2>
  active T
  comment "DDOS tfn2k icmp possible communication"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 1435-6>
  active T
  comment "DNS named authors attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 535-6>
  active T
  comment "NETBIOS SMB CD..."
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1549-16>
  active T
  comment SMTP HELO overflow attempt
  comment pcre: /^HELO\s[^\n]{500}/smi
  payload /((^)|(\n+))[hH][eE][lL][oO][\x20\x09\x0b][^\n]{500}/
  sigaction SIG_LOG
  requires-reverse-signature ! smtp_server_fail
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload /.*HELO/
  </delete>
</augment>

<augment 1613-7>
  active F
  dst-ip == local_nets
  http /[\/]handler.{1,}?\;.{2,}\|/
  comment "WEB-MISC handler attempt"
  comment "old IRIX web server vulnerability"
  requires-reverse-signature ! http_error
  <delete>
  	http /.*[\/\\]handler/
  	http /.*\x7C/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 419-5>
  active F
  comment "ICMP Mobile Host Redirect"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 858-7>
  active T
  comment "WEB-CGI filemail access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 315-6>
  active T
  comment "EXPLOIT x86 Linux mountd overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1523-10>
  active T
  comment "WEB-MISC ans.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1726-4>
  active T
  comment "WEB-IIS doctodep.btr access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2528-7>
  active F
  comment "SMTP TLS PCT Client_Hello overflow attempt"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 884-14>
  active T
  comment "WEB-CGI formmail access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
  http /.*[\/\\]formmail{0,5}\?/
  <delete>
  	http /.*[\/\\]formmail/
  </delete>
</augment>

<augment 1086-12>
  active T
  comment "WEB-PHP strings overflow"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1271-14>
  active T
  comment "RPC portmap rusers request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1517-9>
  active T
  comment "WEB-CGI envout.bat access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1115-7>
  active T
  comment "WEB-MISC ICQ webserver DOS"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1919-12>
  active T
  comment FTP CWD overflow attempt
  comment "pcre: /^CWD\s[^\n]{100}/smi"
  eval dataSizeG100
  ftp "/((^)|(\n+))[cC][wW][dD][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[cC][wW][dD]/"
  </delete>
</augment>

<augment 1947-4>
  active T
  comment "WEB-MISC answerbook2 arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1841-5>
  active T
  comment "WEB-CLIENT Javascript URL host spoofing attempt"
  requires-signature http_old_gecko_client
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-client.rules
</augment>

<augment 439-6>
  active F
  comment "ICMP Reserved for Security Type 19"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2285-2>
  active T
  comment "WEB-PHP rolis guestbook access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 996-8>
  active T
  comment "WEB-IIS anot.htr access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1571-8>
  active T
  comment "WEB-CGI dcforum.cgi directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 478-3>
  active T
  comment "ICMP Broadscan Smurf Scanner"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 1880-4>
  active T
  comment "WEB-MISC oracle web application server access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1934-6>
  active T
  comment POP2 FOLD overflow attempt
  comment pcre: /^FOLD\s[^\n]{256}/smi
  payload /((^)|(\n+))[fF][oO][lL][dD][\x20\x09\x0b][^\n]{256}/
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/pop2.rules
  <delete>
    payload /.*FOLD/
  </delete>
</augment>

<augment 861-12>
  active T
  comment "WEB-CGI w3-msql access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1304-7>
  active T
  comment "WEB-CGI txt2html.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 998-7>
  active T
  comment "WEB-IIS asp-srch attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 254-4>
  active T
  comment "DNS SPOOF query response with TTL of 1 min. and no authority"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 941-6>
  active T
  comment "WEB-FRONTPAGE contents.htm access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 611-7>
  active T
  comment "RSERVICES rlogin login failure"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rservices.rules
</augment>

<augment 2421-2>
  active F
  comment "MULTIMEDIA realplayer .smi playlist download attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/multimedia.rules
</augment>

<augment 2313-2>
  active T
  comment "SHELLCODE x86 0x71FB7BAB NOOP unicode"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 2511-9>
  active F
  comment "NETBIOS SMB DCERPC LSASS DsRolerUpgradeDownlevelServer exploit attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1538-13>
  active T
  comment "NNTP AUTHINFO USER overflow attempt"
  comment pcre: /^AUTHINFO\s+USER\s[^\n]{200}/smi
  payload /((^)|(\n+))[aA][uU][tT][hH][iI][nN][fF][oO][\x20\x09\x0b]+[uU][sS][eE][rR][\x20\x09\x0b][^\n]{200}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/nntp.rules
  <delete>
    payload /.*[aA][uU][tT][hH][iI][nN][fF][oO].*.*[uU][sS][eE][rR]/
  </delete>
</augment>

<augment 1373-6>
  active T
  comment "WEB-ATTACKS conf/httpd.conf attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1129-5>
  active T
  comment "WEB-MISC .htaccess access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2445-4>
  active T
  comment "EXPLOIT ICQ SRV_MULTI/SRV_META_USER last name overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1896-8>
  active T
  comment "EXPLOIT kadmind buffer overflow attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 2380-3>
  active T
  comment "EXPLOIT ISAKMP fifth payload certificate request length overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 2447-4>
  active T
  comment "WEB-MISC ServletManager access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1911-10>
  active T
  comment "RPC sadmind UDP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2444-4>
  active T
  comment "EXPLOIT ICQ SRV_MULTI/SRV_META_USER first name overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 438-9>
  active F
  comment "ICMP Redirect undefined code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 500-4>
  active T
  comment "MISC source route lssr"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 1937-5>
  active T
  comment POP3 LIST overflow attempt
  comment "pcre: /^LIST\s[^\n]{10}/smi"
  payload "/((^)|(\n+))[lL][iI][sS][tT][\x20\x09\x0b][^\n]{10}/"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/pop3.rules
  <delete>
    payload "/.*[lL][iI][sS][tT]/"
  </delete>
</augment>

<augment 2247-3>
  active T
  comment "WEB-IIS UploadScript11.asp access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1060-6>
  active T
  comment "WEB-MISC xp_availablemedia attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2184-7>
  active T
  comment "RPC mountd TCP mount path overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 385-4>
  active F
  comment "ICMP traceroute"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1328-5>
  active T
  comment "WEB-ATTACKS ps command attempt"
  requires-reverse-signature ! http_error
  http /.*[\/\\]bin[\/\\]ps([^-_a-zA-Z0-9.]|$)/
  <delete>
  	http /.*[\/\\]bin[\/\\]ps/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 650-8>
  active F
  comment "SHELLCODE x86 setuid 0"
  sigaction SIG_FILE
  dst-ip == local_nets
  snort-rule-file snort_rules/rules2.2/shellcode.rules
  comment "Short binary pattern"
  comment "Mild suspicion"
  comment "too many false positives"
</augment>

<augment 2303-4>
  active F
  comment "WEB-PHP Advanced Poll popup.php access"
  comment "informational only"
  comment "too general"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 598-12>
  active T
  comment "RPC portmap listing TCP 111"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2283-2>
  active T
  comment "WEB-PHP DatabaseFunctions.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 408-5>
  active F
  comment "ICMP Echo Reply"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2494-5>
  active F
  comment "NETBIOS DCEPRC ORPCThis request flood attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 955-6>
  active T
  comment "WEB-FRONTPAGE access.cnf access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1560-6>
  active F
  comment "WEB-MISC /doc/ access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1853-6>
  active T
  comment "BACKDOOR win-trin00 connection attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1052-8>
  active T
  comment "WEB-CGI technote print.cgi directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2532-3>
  active F
  comment "MISC LDAP SSLv3 Client_Hello request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 1739-6>
  active T
  comment "WEB-PHP DNSTools administrator authentication bypass attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 529-7>
  active T
  comment "NETBIOS DOS RFPoison"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1941-8>
  active T
  comment "TFTP GET filename overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/tftp.rules
</augment>

<augment 839-7>
  active F
  comment "WEB-CGI finger access"
  comment "informational only"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2027-5>
  active T
  comment "RPC yppasswd old password overflow attempt UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 428-7>
  active F
  comment "ICMP Parameter Problem undefined Code"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1440-5>
  active F
  comment "MULTIMEDIA Icecast playlist redirection"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/multimedia.rules
</augment>

<augment 1656-4>
  active T
  comment "WEB-CGI pfdispaly.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1612-8>
  active T
  comment "WEB-MISC ftp.pl attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2038-5>
  active T
  comment "RPC network-status-monitor mon-callback request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1136-5>
  active T
  comment "WEB-MISC cd.."
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1611-5>
  active F
  dst-ip == local_nets
  comment "WEB-CGI eXtropia webstore access"
  comment "informational only"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1807-9>
  active T
  comment "WEB-MISC Chunked-Encoding transfer attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  eval isApacheLt1322
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1300-7>
  active T
  comment "WEB-PHP admin.php file upload attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1953-5>
  active T
  comment "RPC AMD TCP pid request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 119-5>
  active T
  comment "BACKDOOR Doly 2.0 access"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1057-6>
  active T
  comment "WEB-MISC ftp attempt"
  requires-reverse-signature ! http_error
  http /.*[fF][tT][pP]\.[eE][xX][eE]/
  <delete>
  	payload /.*[fF][tT][pP]\.[eE][xX][eE]/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 337-10>
  active T
  comment FTP CEL overflow attempt
  comment "pcre: /^CEL\s[^\n]{100}/smi"
  eval dataSizeG100
  ftp "/((^)|(\n+))[cC][eE][lL][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[cC][eE][lL]/"
  </delete>
</augment>

<augment 2297-4>
  active T
  comment "WEB-PHP Advanced Poll admin_templates_misc.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1974-6>
  active T
  comment FTP REST overflow attempt
  comment "pcre: /^REST\s[^\n]{100}/smi"
  eval dataSizeG100
  ftp "/((^)|(\n+))[rR][eE][sS][tT][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[rR][eE][sS][tT]/"
  </delete>
</augment>

<augment 1277-9>
  active T
  comment "RPC portmap ypupdated request UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 649-8>
  active T
  comment "SHELLCODE x86 setgid 0"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/shellcode.rules
  comment "Short binary pattern"
  comment "Mild suspicion"
</augment>

<augment 2023-4>
  active T
  comment "RPC mountd UDP unmountall request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2350-7>
  active F
  comment "NETBIOS DCERPC ISystemActivator bind accept"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1875-4>
  active T
  dst-ip == local_nets
  comment "WEB-CGI cgicso access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 328-8>
  active T
  comment "FINGER bomb attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/finger.rules
</augment>

<augment 2461-3>
  active F
  comment "CHAT Yahoo IM webcam watch"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 1777-4>
  active T
  comment "FTP EXPLOIT STAT * dos attempt"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 1963-9>
  active T
  comment "RPC RQUOTA getquota overflow attempt UDP"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 862-9>
  active T
  comment "WEB-CGI csh access"
  requires-reverse-signature ! http_error
  requires-signature ! http_shell_check
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 537-11>
  active T
  comment "NETBIOS SMB IPC$ share access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2556-2>
  active T
  comment "EXPLOIT Oracle Web Cache DELETE overflow attempt"
  comment pcre: /^DELETE[^s]{432}/sm
  payload /((^)|(\n+))DELETE[^s]{432}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 694-6>
  active T
  comment "MS-SQL/SMB shellcode attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 1187-12>
  active T
  comment "WEB-MISC SalesLogix Eviewer web command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2516-10>
  active T
  comment "MISC LDAP PCT Client_Hello overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 161-4>
  active T
  comment "BACKDOOR Matrix 2.0 Client connect"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1388-12>
  active T
  comment MISC UPnP Location overflow
  comment pcre: /^Location\:[^\n]{128}/smi
  payload /((^)|(\n+))[lL][oO][cC][aA][tT][iI][oO][nN]\x3a[^\n]{128}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
  <delete>
    payload /.*[lL][oO][cC][aA][tT][iI][oO][nN]\x3A/
  </delete>
</augment>

<augment 1615-5>
  active T
  comment "WEB-MISC htgrep attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2249-3>
  active T
  comment "WEB-IIS /pcadmin/login.asp access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1437-5>
  active F
  comment "MULTIMEDIA Windows Media audio download"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/multimedia.rules
</augment>

<augment 146-5>
  active T
  comment "BACKDOOR NetSphere access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 2566-1>
  active T
  comment "WEB-PHP PHPBB viewforum.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2046-6>
  active T
  comment IMAP partial body.peek buffer overflow attempt
  comment "pcre: /\sPARTIAL.*BODY\.PEEK\[[^\]]{1024}/smi"
  payload "/((^)|(\n+))[\x20\x09\x0b][pP][aA][rR][tT][iI][aA][lL].*[bB][oO][dD][yY]\.[pP][eE][eE][kK]\[[^\]]{1024}/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/imap.rules
  <delete>
    payload "/.*[pP][aA][rR][tT][iI][aA][lL].*.*[bB][oO][dD][yY]\.[pP][eE][eE][kK]\[/"
  </delete>
</augment>

<augment 1731-7>
  active T
  comment "WEB-CGI a1stats access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 279-3>
  active T
  comment "DOS Bay/Nortel Nautica Marlin"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 2571-1>
  active T
  comment "WEB-IIS SmarterTools SmarterMail frmGetAttachment.aspx access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 425-6>
  active F
  comment "ICMP Parameter Problem Bad Length"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1606-6>
  active F
  comment "WEB-CGI icat access"
  requires-reverse-signature ! http_error
  http /.*[\/\\]icat([^\.][^h][^t][^m]|$)/
  <delete>
  	http /.*[\/\\]icat/
  </delete>
  sigaction SIG_LOG
  comment "too many false positives"
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 975-12>
  active T
  comment "WEB-IIS Alternate Data streams ASP file access attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 163-8>
  active T
  comment "BACKDOOR WinCrash 1.0 Server Active"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 451-5>
  active F
  comment "ICMP Timestamp Reply"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 2024-8>
  active T
  comment "RPC RQUOTA getquota overflow attempt TCP"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2174-4>
  active T
  comment "NETBIOS SMB winreg access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1635-13>
  active T
  comment POP3 APOP overflow attempt
  comment "pcre: /^APOP\s[^\n]{256}/smi"
  payload "/((^)|(\n+))[aA][pP][oO][pP][\x20\x09\x0b][^\n]{256}/"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/pop3.rules
  <delete>
    payload "/.*[aA][pP][oO][pP]/"
  </delete>
</augment>

<augment 394-6>
  active F
  comment "ICMP Destination Unreachable Destination Host Unknown"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 475-3>
  active T
  comment "ICMP traceroute ipopts"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 2223-5>
  active F
  comment "WEB-CGI csNews.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
  comment "Informational only"
</augment>

<augment 270-6>
  active T
  comment "DOS Teardrop attack"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 2231-5>
  active T
  comment "WEB-MISC register.dll access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1400-4>
  active T
  comment "WEB-IIS /scripts/samples/ access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1184-6>
  active T
  comment "WEB-MISC Netscape Enterprise Server directory view"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1839-4>
  active T
  comment "WEB-MISC mailman cross site scripting attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1360-5>
  active T
  comment "WEB-ATTACKS netcat command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1601-7>
  active T
  comment "WEB-CGI htsearch arbitrary file read attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 962-9>
  active T
  comment "WEB-FRONTPAGE shtml.exe access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1180-12>
  active T
  comment "WEB-MISC get32.exe access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2551-2>
  active T
  comment "EXPLOIT Oracle Web Cache GET overflow attempt"
  comment pcre: /^GET[^s]{432}/sm
  payload /((^)|(\n+))GET[^s]{432}/
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 514-5>
  active T
  comment "MISC ramen worm"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 224-3>
  active T
  comment "DDOS Stacheldraht server spoof"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 2316-6>
  active T
  comment "NETBIOS DCERPC Workstation Service direct service access attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 247-4>
  active T
  comment "DDOS mstream client to handler"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 919-7>
  active T
  comment "WEB-COLDFUSION datasource passwordattempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 1835-5>
  active T
  comment "WEB-MISC Macromedia SiteSpring cross site scripting attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1758-3>
  active T
  comment "WEB-MISC b2 access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 953-7>
  active T
  comment "WEB-FRONTPAGE administrators.pwd access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1465-8>
  active T
  comment "WEB-CGI auktion.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1367-5>
  active T
  comment "WEB-ATTACKS mail command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1421-11>
  active T
  comment "SNMP AgentX/tcp request"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/snmp.rules
</augment>

<augment 2258-6>
  active T
  comment "NETBIOS SMB-DS DCERPC Messenger Service buffer overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1811-8>
  active T
  comment "ATTACK-RESPONSES successful gobbles ssh exploit uname"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/attack-responses.rules
</augment>

<augment 1183-8>
  active T
  comment "WEB-MISC Netscape Enterprise Server directory view"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 918-6>
  active T
  comment "WEB-COLDFUSION expeval access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-coldfusion.rules
</augment>

<augment 2515-9>
  active F
  comment "WEB-MISC PCT Client_Hello overflow attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1270-11>
  active T
  comment "RPC portmap rstatd request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 2512-7>
  active F
  comment "NETBIOS SMB-DS DCERPC LSASS bind attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1347-5>
  active T
  comment "WEB-ATTACKS /usr/bin/g++ command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1100-7>
  active T
  comment "WEB-MISC L3retriever HTTP Probe"
  requires-reverse-signature ! http_error
  sigaction SIG_QUIET
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1127-7>
  active T
  comment "WEB-MISC convert.bas access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2340-4>
  active T
  comment FTP SITE CHMOD overflow attempt
  comment "pcre: /^SITE\s+CHMOD\s[^\n]{100}/smi"
  eval dataSizeG100
  ftp "/((^)|(\n+))[sS][iI][tT][eE][\x20\x09\x0b]+[cC][hH][mM][oO][dD][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[sS][iI][tT][eE].*.*[cC][hH][mM][oO][dD]/"
  </delete>
</augment>

<augment 1504-6>
  active F
  comment "MISC AFS access"
  comment "informational only, not exploit worthy"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 896-11>
  active T
  comment "WEB-CGI way-board access"
  dst-ip == local_nets
  requires-reverse-signature ! http_error
  http /.*[\/\\]way-board\?db\=.{2,}\x00/
  <delete>
  	http /.*[\/\\]way-board/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1855-7>
  active T
  comment "DDOS Stacheldraht agent->handler skillz"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 256-5>
  active T
  comment "DNS named authors attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 989-8>
  active T
  comment "WEB-IIS Unicode2.pl script File permission canonicalization"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1352-5>
  active T
  comment "WEB-ATTACKS tclsh execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1209-5>
  active T
  comment "WEB-MISC .nsconfig access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1900-10>
  active T
  comment "ATTACK-RESPONSES successful kadmind buffer overflow attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/attack-responses.rules
</augment>

<augment 366-7>
  active F
  comment "ICMP PING *NIX"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1361-5>
  active T
  comment "WEB-ATTACKS nmap command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 872-9>
  active T
  comment "WEB-CGI tcsh access"
  requires-reverse-signature ! http_error
  requires-signature ! http_shell_check
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1274-17>
  active T
  comment "RPC portmap ttdbserv request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1817-4>
  active T
  comment "WEB-IIS MS Site Server default login attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1079-11>
  active T
  comment "WEB-MISC WebDAV propfind access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2309-6>
  active T
  comment "NETBIOS SMB DCERPC Workstation Service bind attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1657-6>
  active T
  comment "WEB-CGI pagelog.cgi directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 982-9>
  active T
  comment "WEB-IIS unicode directory traversal attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 845-7>
  active T
  comment "WEB-CGI AT-admin.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 849-8>
  active F
  comment "WEB-CGI view-source access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules2.2/web-cgi.rules
</augment>

<augment 655-8>
  active T
  comment "SMTP sendmail 8.6.9 exploit"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 2278-6>
  active T
  comment "WEB-MISC negative Content-Length attempt"
  comment pcre: /^Content-Length\x3a\s+-\d+/+/smi
  http /((^)|(\n+))[cC][oO][nN][tT][eE][nN][tT]-[lL][eE][nN][gG][tT][hH]\x3a[\x20\x09\x0b]+-[0-9]+\/+/
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
  <delete>
    payload /.*[cC][oO][nN][tT][eE][nN][tT]-[lL][eE][nN][gG][tT][hH]\x3A/
  </delete>
</augment>

<augment 2265-4>
  active T
  comment SMTP SOML FROM sendmail prescan too many addresses overflow
  comment "pcre: /^SOML FROM\x3a\s*[^\n]*?<[^\n]*?<[^\n]*?<[^"
  payload "/((^)|(\n+))[sS][oO][mM][lL] [fF][rR][oO][mM]\x3a[\x20\x09\x0b]*[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?<[^\n]*?</"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload /.*[sS][oO][mM][lL] [fF][rR][oO][mM]\x3A/
  </delete>
</augment>

<augment 240-2>
  active T
  comment "DDOS shaft agent to handler"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 398-6>
  active F
  comment "ICMP Destination Unreachable Host Unreachable for Type of Service"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 888-5>
  active T
  comment "WEB-CGI wwwadmin.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 493-5>
  active F
  comment "INFO psyBNC access"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/info.rules
</augment>

<augment 948-6>
  active T
  comment "WEB-FRONTPAGE form_results access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1489-5>
  active T
  comment "WEB-MISC /~nobody access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1713-4>
  active F
  comment "WEB-CGI cgforum.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1153-5>
  active T
  comment "WEB-MISC Domino log.nsf access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1654-4>
  active T
  comment "WEB-CGI cart32.exe access"
  dst-ip == local_nets
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2083-8>
  active T
  comment "RPC rpc.xfsmd xfs_export attempt UDP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>


<augment 960-6>
  active T
  comment "WEB-FRONTPAGE service.stp access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1018-9>
  active T
  comment "WEB-IIS iisadmpwd attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1257-8>
  active T
  comment "DOS Winnuke attack"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 2442-6>
  active T
  comment WEB-MISC Quicktime User-Agent buffer overflow attempt
  comment pcre: /^User-Agent\x3a[^\n]{244,255}/smi
  http /((^)|(\n+))[uU][sS][eE][rR]-[aA][gG][eE][nN][tT]\x3a[^\n]{244,255}/
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
  <delete>
    payload /.*[uU][sS][eE][rR]-[aA][gG][eE][nN][tT]\x3A/
  </delete>
</augment>

<augment 484-4>
  active T
  comment "ICMP PING Sniffer Pro/NetXRay network scan"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 1565-8>
  active T
  comment "WEB-CGI eshop.pl arbitrary commane execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1016-10>
  active T
  comment "WEB-IIS global.asa access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1607-5>
  active F
  comment "WEB-CGI HyperSeek hsx.cgi access"
  comment "informational only"
  comment "old signature based on NT 4.0 and Linux 2.3x kernel"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 721-7>
  active F
  comment "VIRUS OUTBOUND bad file attachment"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/virus.rules
</augment>

<augment 467-3>
  active T
  comment "ICMP Nemesis v1.1 Echo"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 987-12>
  active T
  comment "WEB-IIS .htr access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2338-5>
  active T
  comment FTP LIST buffer overflow attempt
  comment "pcre: /^LIST\s[^\n]{100,}/smi"
  ftp "/((^)|(\n+))[lL][iI][sS][tT][\x20\x09\x0b][^\n]{100,}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[lL][iI][sS][tT]/"
  </delete>
</augment>

<augment 1040-6>
  active T
  comment "WEB-IIS srchadm access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2463-6>
  active T
  comment "EXPLOIT IGMP IGAP message overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 1192-6>
  active T
  comment "WEB-MISC Trend Micro OfficeScan access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1603-5>
  active T
  comment "WEB-MISC DELETE attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
  <delete>
	payload /[dD][eE][lL][eE][tT][eE] /
  </delete>
  http /.{0,7}[dD][eE][lL][eE][tT][eE] /
</augment>

<augment 363-7>
  active F
  comment "ICMP IRDP router advertisement"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1584-4>
  active T
  comment "WEB-MISC Domino bookmark.nsf access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1830-5>
  active T
  comment "WEB-MISC Tomcat SnoopServlet servlet access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1976-6>
  active T
  comment FTP RMD overflow attempt
  comment "pcre: /^RMD\s[^\n]{100}/smi"
  eval dataSizeG100
  ftp "/((^)|(\n+))[rR][mM][dD][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[rR][mM][dD]/"
  </delete>
</augment>

<augment 476-4>
  active T
  comment "ICMP webtrends scanner"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/icmp.rules
</augment>

<augment 602-5>
  active T
  comment "RSERVICES rlogin bin"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rservices.rules
</augment>

<augment 1897-8>
  active T
  comment "EXPLOIT kadmind buffer overflow attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 336-10>
  active T
  comment FTP CWD ~root attempt
  comment "pcre: /^CWD\s+~root/smi"
  payload "/((^)|(\n+))[cC][wW][dD][\x20\x09\x0b]+~[rR][oO][oO][tT]/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[cC][wW][dD].{1}.*~[rR][oO][oO][tT]/"
  </delete>
</augment>

<augment 2039-4>
  active T
  comment "MISC bootp hostname format string attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 2194-6>
  active T
  comment "WEB-CGI CSMailto.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1564-6>
  active F
  comment "WEB-MISC login.htm access"
  comment "this is removed since *any* login.htm will match "
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1341-5>
  active T
  comment "WEB-ATTACKS /usr/bin/gcc command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 2295-4>
  active T
  comment "WEB-PHP Advanced Poll admin_settings.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2345-4>
  active T
  comment "WEB-PHP PhpGedView search.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2509-7>
  active F
  comment "NETBIOS SMB DCERPC LSASS unicode bind attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1471-5>
  active T
  comment "WEB-CGI mailnews.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2036-6>
  active T
  comment "RPC portmap network-status-monitor request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 257-8>
  active T
  comment "DNS named version attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 958-6>
  active T
  comment "WEB-FRONTPAGE service.cnf access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 2289-4>
  active T
  comment "WEB-PHP Advanced Poll admin_embed.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1249-10>
  active T
  comment "WEB-FRONTPAGE frontpage rad fp4areg.dll access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-frontpage.rules
</augment>

<augment 1583-4>
  active T
  comment "WEB-MISC Domino mailw46.nsf access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1775-2>
  active T
  comment "MYSQL root login attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/mysql.rules
</augment>

<augment 1808-6>
  active T
  comment "WEB-MISC apache chunked encoding memory corruption exploit attempt"
  requires-signature ! http_msie_client
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1528-8>
  active T
  comment "WEB-MISC BBoard access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2270-4>
  active T
  comment SMTP RCPT TO sendmail prescan too long addresses overflow
  comment "pcre: /^RCPT TO\x3a\s+[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}\x3b[\w\s@\.]{200,}/smi"
  payload "/((^)|(\n+))[rR][cC][pP][tT] [tT][oO]\x3a[\x20\x09\x0b]+[a-zA-Z0-9\x5f\x20\x09\x0b\x40\.]{0,200}\x3b[a-zA-Z0-9\x5f\x20\x09\x0b=x40\.]{200,}\x3b[a-zA-Z0-9\x5f\x20\x09\x0b\x40\.]{0,200}/"
  sigaction SIG_LOG
  requires-reverse-signature ! smtp_server_fail
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload /.*[rR][cC][pP][tT] [tT][oO]\x3A/
  </delete>
</augment>

<augment 2128-5>
  active T
  comment "WEB-CGI swsrv.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1416-9>
  active T
  comment "SNMP broadcast trap"
  requires-reverse-signature snmp_userver_ok_return
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/snmp.rules
</augment>

<augment 2387-4>
  active T
  comment "WEB-CGI view_broadcast.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 273-7>
  active T
  comment "DOS IGMP dos attack"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 2232-5>
  active T
  comment "WEB-MISC ContentFilter.dll access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1102-7>
  active T
  comment "WEB-MISC Nessus 404 probe"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 456-5>
  active F
  comment "ICMP Traceroute"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/icmp-info.rules
</augment>

<augment 1285-6>
  active T
  comment "WEB-IIS msdac access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1548-9>
  active T
  comment "WEB-CGI csSearch.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
  eval isApacheLt1325
</augment>

<augment 1765-6>
  active T
  comment "WEB-CGI Nortel Contivity cgiproc access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 712-8>
  active T
  comment "TELNET ld_library_path"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/telnet.rules
</augment>

<augment 1027-8>
  active T
  comment "WEB-IIS perl-browse space attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1420-11>
  active T
  comment "SNMP trap tcp"
  requires-reverse-signature snmp_tserver_ok_return
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/snmp.rules
</augment>

<augment 282-7>
  active T
  comment "DOS arkiea backup"
  sigaction SIG_QUIET
  snort-rule-file snort_rules/rules2.2/dos.rules
</augment>

<augment 360-7>
  active T
  comment "FTP serv-u directory transversal"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 1705-7>
  active T
  comment "WEB-CGI echo.bat arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1821-7>
  active T
  comment "EXPLOIT LPD dvips remote command execution attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/exploit.rules
</augment>

<augment 2452-4>
  active F
  comment "CHAT Yahoo IM ping"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 504-6>
  active T
  comment "MISC source port 53 to <1024"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 267-5>
  active T
  comment "DNS EXPLOIT sparc overflow attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/dns.rules
</augment>

<augment 1001-7>
  active T
  comment "WEB-MISC carbo.dll access"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1931-3>
  active T
  comment "WEB-CGI rpc-nlog.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1116-6>
  active T
  comment "WEB-MISC Lotus DelDoc attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 288-6>
  active T
  comment "POP3 EXPLOIT x86 Linux overflow"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/pop3.rules
</augment>

<augment 1281-7>
  active T
  comment "RPC portmap listing UDP 32771"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 1655-4>
  active T
  comment "WEB-CGI pfdispaly.cgi arbitrary command execution attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1262-9>
  active F
  comment "RPC portmap admind request TCP"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/rpc.rules
</augment>

<augment 118-5>
  active T
  comment "BACKDOOR SatansBackdoor.2.0.Beta"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1646-5>
  active T
  comment "WEB-CGI test.cgi access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 289-6>
  active T
  comment "POP3 EXPLOIT x86 SCO overflow"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/pop3.rules
</augment>

<augment 2371-2>
  active T
  comment "WEB-MISC Sample_showcode.html access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1377-14>
  active F
  comment "FTP wu-ftp bad file completion attempt ["
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 1112-6>
  active F
  comment "WEB-MISC http directory traversal"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1820-7>
  active T
  comment "WEB-MISC IBM Net.Commerce orderdspc.d2w access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1364-5>
  active T
  comment "WEB-ATTACKS lsof command attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-attacks.rules
</augment>

<augment 1026-9>
  active T
  comment "WEB-IIS perl-browse newline attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1387-7>
  active T
  comment "MS-SQL raiserror possible buffer overflow"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/sql.rules
</augment>

<augment 2090-8>
  active T
  comment "WEB-IIS WEBDAV exploit attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1703-7>
  active T
  comment "WEB-CGI auktion.cgi directory traversal attempt"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 2381-5>
  active T
  comment WEB-MISC schema overflow attempt
  comment pcre: /^[^\/]{14,}?\x3a\/\//U
  http /^[^\/]{14,}?\x3a\/\//
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
  <delete>
    http /.*\x3A[\/\\][\/\\]/
  </delete>
</augment>

<augment 1139-7>
  active T
  comment "WEB-MISC whisker HEAD/./"
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1432-6>
  active F
  comment "P2P GNUTella client request"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/p2p.rules
</augment>

<augment 2328-3>
  active T
  comment "WEB-PHP authentication_index.php access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 631-6>
  active T
  comment "SMTP ehlo cybercop attempt"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 621-6>
  active F
  comment "SCAN FIN"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 2257-5>
  active T
  comment "NETBIOS DCERPC Messenger Service buffer overflow attempt"
  sigaction SIG_FILE
  # sigaction SIG_SUMMARY
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 1632-6>
  active F
  comment "CHAT AIM send message"
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 1295-9>
  active T
  comment "NETBIOS nimda RICHED20.DLL"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/netbios.rules
</augment>

<augment 2527-3>
  active F
  comment "SMTP STARTTLS attempt"
  requires-reverse-signature ! smtp_server_fail
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/smtp.rules
</augment>

<augment 195-5>
  active T
  comment "BACKDOOR DeepThroat 3.1 Server Response"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 2117-5>
  active T
  comment "WEB-IIS Battleaxe Forum login.asp access"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1252-13>
  active T
  comment "TELNET bsd telnet exploit response"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/telnet.rules
</augment>

<augment 1007-6>
  active T
  comment "WEB-IIS cross-site scripting attempt"
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1761-3>
  active T
  comment "OTHER-IDS ISS RealSecure 6 daemon connection attempt"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/other-ids.rules
</augment>

<augment 1942-4>
  active T
  comment FTP RMDIR overflow attempt
  comment "pcre: /^RMDIR\s[^\n]{100}/smi"
  eval dataSizeG100
  ftp "/((^)|(\n+))[rR][mM][dD][iI][rR][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[rR][mM][dD][iI][rR]/"
  </delete>
</augment>

<augment 1466-8>
  active T
  comment "WEB-CGI cgiforum.pl access"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1481-4>
  active T
  comment WEB-CGI upload.cgi access
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 517-1>
  active T
  comment MISC xdmcp query
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/misc.rules
</augment>

<augment 634-2>
  active T
  comment SCAN Amanda client version request
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/scan.rules
</augment>

<augment 2067-2>
  active F
  comment WEB-MISC Lotus Notes .exe script source download attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2154-1>
  active T
  comment WEB-PHP autohtml.php access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2144-1>
  active T
  comment WEB-PHP b2 cafelog gm-2-b2.php access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 211-3>
  active T
  comment BACKDOOR MISC r00t attempt
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 2406-1>
  active T
  comment TELNET APC SmartSlot default admin account attempt
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/telnet.rules
</augment>

<augment 2314-1>
  active T
  comment SHELLCODE x86 0x90 NOOP unicode
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 218-4>
  active F
  comment BACKDOOR MISC Solaris 2.5 attempt
  comment "too general"
  comment "too many false positives"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 285-6>
  active T
  comment POP2 x86 Linux overflow
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/pop2.rules
</augment>

<augment 234-2>
  active T
  comment DDOS Trin00 Attacker to Master default password
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ddos.rules
</augment>

<augment 1667-5>
  active T
  comment WEB-MISC cross site scripting HTML Image tag set to javascript attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2134-2>
  active T
  comment WEB-IIS register.asp access
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2359-2>
  active T
  comment WEB-PHP Invision Board ipchat.php file include
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2434-1>
  active T
  comment WEB-CGI MDaemon form2raw.cgi access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1061-6>
  active T
  comment WEB-MISC xp_cmdshell attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1653-4>
  active F
  comment WEB-CGI campus access
  comment NCSA web server only, depricate sig
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-cgi.rules
</augment>

<augment 1676-3>
  active T
  comment "ORACLE select union attempt"
  sigaction SIG_FILE
  snort-rule-file snort_rules2.2/oracle.rules
</augment>

<augment 1681-3>
  active T
  comment "ORACLE all_views access"
  sigaction SIG_FILE
  snort-rule-file snort_rules2.2/oracle.rules
</augment>

<augment 1688-3>
  active T
  comment ORACLE user_tablespace access
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/oracle.rules
</augment>

<augment 2394-1>
  active F
  comment WEB-MISC Compaq web-based management agent denial of service attempt
  comment "too general"
  comment "too many false positives"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2330-1>
  active T
  comment IMAP auth overflow attempt
  comment "pcre: /AUTH\s[^\n]{100}/smi"
  payload "/((^)|(\n+))[aA][uU][tT][hH][\x20\x09\x0b][^\n]{100}/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/imap.rules
  <delete>
    payload "/.*[aA][uU][tT][hH]/"
  </delete>
</augment>

<augment 107-6>
  active T
  comment BACKDOOR subseven DEFCON8 2.1 access
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1424-6>
  active T
  comment SHELLCODE x86 0xEB0C NOOP
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/shellcode.rules
</augment>

<augment 1530-6>
  active T
  comment FTP format string attempt
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 1144-5>
  active T
  comment WEB-MISC /cgi-bin/// access
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1935-4>
  active T
  comment POP2 FOLD arbitrary file attempt
  comment "pcre: /^FOLD\s+\//smi"
  payload "/((^)|(\n+))[fF][oO][lL][dD][\x20\x09\x0b]+\//"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/pop2.rules
  <delete>
    payload /.*FOLD/
  </delete>
</augment>

<augment 2078-2>
  active T
  dst-ip == local_nets
  comment WEB-PHP phpBB privmsg.php access
  requires-reverse-signature ! http_error
  http /.*[\/\\]privmsg\.php.{1,}?[Ff][Oo][Ll][Dd][Ee][Rr]=.{1,}[Mm][Oo][Dd][Ee]=.{1,}[Cc][Oo][Nn][Ff][Ii][Rr][Mm]=[Yy][Ee][Ss]/
  <delete>
  	http /.*[\/\\]privmsg\.php/
  </delete>
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1991-1>
  active F
  comment CHAT MSN login attempt
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/chat.rules
</augment>

<augment 1622-5>
  active F
  comment FTP RNFR ././ attempt
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 1677-3>
  active T
  comment ORACLE select like '%' attempt
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/oracle.rules
</augment>

<augment 2400-1>
  active T
  comment WEB-MISC edittag.pl access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1541-4>
  active T
  comment FINGER version query
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/finger.rules
</augment>

<augment 1993-4>
  active T
  comment IMAP login literal buffer overflow attempt
  comment "pcre: /\sLOGIN\s[^\n]*?\s\{/smi"
  payload "/((^)|(\n+))[lL][oO][gG][iI][nN][\x20\x09\x0b][^\n]*?[\x20\x09\x0b]\{/"
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/imap.rules
  <delete>
    payload "/.*[lL][oO][gG][iI][nN]/"
  </delete>
</augment>

<augment 2343-1>
  active T
  comment FTP STOR overflow attempt
  comment "pcre: /^STOR\s[^\n]{100}/smi"
  eval dataSizeG100
  ftp "/((^)|(\n+))[sS][tT][oO][rR][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[sS][tT][oO][rR]/"
  </delete>
</augment>

<augment 1499-5>
  active T
  comment WEB-MISC SiteScope Service access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 2108-3>
  active T
  comment POP3 CAPA overflow attempt
  comment "pcre: /^CAPA\s[^\n]{10}/smi"
  payload "/((^)|(\n+))[cC][aA][pP][aA][\x20\x09\x0b][^\n]{10}/"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/pop3.rules
  <delete>
    payload "/.*[cC][aA][pP][aA]/"
  </delete>
</augment>

<augment 1983-1>
  active T
  comment BACKDOOR DeepThroat 3.1 Connection attempt [4120]
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1977-1>
  active T
  comment WEB-MISC xp_regwrite attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1754-2>
  active T
  comment WEB-IIS as_web4.exe access
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 1927-2>
  active T
  comment FTP authorized_keys
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/ftp.rules
</augment>

<augment 2075-2>
  active T
  comment WEB-PHP Mambo upload.php upload php file attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 1981-1>
  active T
  comment BACKDOOR DeepThroat 3.1 Connection attempt [3150]
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 1874-1>
  active T
  comment WEB-MISC Oracle Java Process Manager access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 1201-7>
  active F
  comment ATTACK-RESPONSES 403 Forbidden
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/attack-responses.rules
</augment>

<augment 1567-5>
  active T
  comment WEB-IIS /exchange/root.asp attempt
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-iis.rules
</augment>

<augment 2362-2>
  active T
  comment WEB-PHP YaBB SE packages.php file include
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2356-2>
  active T
  comment WEB-PHP WebChat db_mysql.php file include
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
</augment>

<augment 2142-1>
  active F
  comment WEB-PHP shoutbox.php access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-php.rules
  comment "Informational only"
</augment>

<augment 1684-3>
  active T
  comment ORACLE all_tab_columns access
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/oracle.rules
</augment>

<augment 1944-1>
  active T
  comment WEB-MISC /ecscripts/ecware.exe access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 212-3>
  active T
  comment BACKDOOR MISC rewt attempt
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/backdoor.rules
</augment>

<augment 2407-1>
  active F
  comment WEB-MISC util.pl access
  comment "too general"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
</augment>

<augment 660-7>
  active T
  comment SMTP expn root
  comment "pcre: /^expn\s+root/smi"
  payload "/((^)|(\n+))[eE][xX][pP][nN][\x20\x09\x0b][rR][oO][oO][tT]/"
  sigaction SIG_FILE
  requires-reverse-signature ! smtp_server_fail
  snort-rule-file snort_rules/rules2.2/smtp.rules
  <delete>
    payload "/.*[eE][xX][pP][nN]/"
    payload "/.*[rR][oO][oO][tT]/"
  </delete>
</augment>

<augment 1559-5>
  active F
  comment WEB-MISC /doc/packages access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/web-misc.rules
  comment "too many false positives"
</augment>

<augment 2250-1>
  active T
  comment POP3 USER format string attempt
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/pop3.rules
</augment>

<augment 1229-7>
  active T
  comment FTP CWD ...
  comment "pcre: /^CWD\s[^\n]*?\.\.\./smi"
  payload "/((^)|(\n+))[cC][wW][dD][\x20\x09\x0b][^\n]*?\.\.\./"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_FILE
  snort-rule-file snort_rules/rules2.2/ftp.rules
  <delete>
    payload "/.*[cC][wW][dD].*.*\.\.\./"
  </delete>
</augment>

<augment 604-5>
  active T
  comment RSERVICES rsh froot
  sigaction SIG_LOG
  snort-rule-file snort_rules/rules2.2/rservices.rules
</augment>

<augment 556-5>
  active F
  comment P2P Outbound GNUTella client request
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/p2p.rules
</augment>

<augment 717-6>
  active T
  comment TELNET not on console
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/telnet.rules
</augment>

<augment 1857-3>
  active F
  comment WEB-MISC robot.txt access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 2321-1>
  active T
  comment WEB-IIS foxweb.exe access
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-iis.rules
</augment>

<augment 1076-6>
  active T
  comment WEB-IIS repost.asp access
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-iis.rules
</augment>

<augment 1946-3>
  active T
  comment WEB-MISC answerbook2 admin attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 2276-1>
  active T
  comment WEB-MISC oracle portal demo access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 658-5>
  active T
  comment SMTP exchange mime DOS
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/smtp.rules
</augment>

<augment 659-6>
  active T
  comment SMTP expn decode
  comment "pcre: /^expn\s+decode/smi?"
  payload "/((^)|(\n+))[eE][xX][pP][nN][\x20\x09\x0b][dD][eE][cC][oO][dD][eE]/"
  sigaction SIG_FILE
  requires-reverse-signature ! smtp_server_fail
  snort-rule-file s2b_data_on_weed/rules2.1/smtp.rules
  <delete>
    payload "/.*[eE][xX][pP][nN]/"
    payload "/.*[dD][eE][cC][oO][dD][eE]/"
  </delete>
</augment>

<augment 2409-1>
  active T
  comment POP3 APOP USER overflow attempt
  comment "pcre: /^APOP\s+USER\s[^\n]{256}/smi"
  payload "/((^)|(\n+))[aA][pP][oO][pP][\x20\x09\x0b]+[uU][sS][eE][rR][\x20\x09\x0b][^\n]{2,56}/"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/pop3.rules
  <delete>
    payload "/.*[aA][pP][oO][pP]/"
  </delete>
</augment>

<augment 1520-6>
  active T
  comment WEB-MISC server-info access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 1879-5>
  active T
  dst-ip == local_nets
  http /.*[\/]book.cgi\?.{1,}\|.{2,}\|/
  comment WEB-CGI book.cgi arbitrary command execution attempt
  requires-reverse-signature ! http_error
  <delete>
  	http /.*[\/\\]book\.cgi/
  	payload /.*[cC][uU][rR][rR][eE][nN][tT]=\x7C/
  </delete>
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-cgi.rules
</augment>

<augment 2342-1>
  active T
  comment WEB-PHP DCP-Portal remote file include attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 2304-2>
  active T
  comment WEB-PHP files.inc.php access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 2135-1>
  active T
  comment WEB-MISC philboard.mdb access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 2341-1>
  active T
  comment WEB-PHP DCP-Portal remote file include attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 1831-3>
  active T
  comment WEB-MISC jigsaw dos attempt
  comment "not iis or apache web server"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
  eval isNotIIS
  eval isNotApache
</augment>

<augment 2398-1>
  active T
  comment WEB-PHP WAnewsletter newsletter.php file include attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 2354-2>
  active T
  comment WEB-PHP IdeaBox notification.php file include
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 930-5>
  active T
  comment WEB-COLDFUSION snippets attempt
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/web-coldfusion.rules
</augment>

<augment 2156-1>
  active T
  comment WEB-MISC mod_gzip_status access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 1329-5>
  active F
  comment WEB-ATTACKS ps command attempt
  comment this sig is *yoo* general to be useful
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-attacks.rules
</augment>

<augment 1059-6>
  active T
  comment WEB-MISC xp_filelist attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 913-5>
  active T
  comment WEB-COLDFUSION cfappman access
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/web-coldfusion.rules
</augment>

<augment 1670-4>
  active T
  comment WEB-MISC /home/ftp access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 2127-1>
  active T
  comment WEB-CGI ikonboard.cgi access
  dst-ip == local_nets
  payload /Cookie: [^\=]{1,}\=\/[^\x0D\x0A]{2,}\x0D\x0A\x0D\x0A/
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-cgi.rules
</augment>

<augment 1984-1>
  active T
  comment BACKDOOR DeepThroat 3.1 Server Response [4120]
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/backdoor.rules
</augment>

<augment 1671-4>
  active F
  comment WEB-MISC /home/www access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
  comment "Informational only"
</augment>

<augment 1463-6>
  active T
  comment CHAT IRC message
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/chat.rules
</augment>

<augment 2062-1>
  active T
  comment WEB-MISC iPlanet .perf access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 1867-1>
  active T
  comment MISC xdmcp info query
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/misc.rules
</augment>

<augment 2322-1>
  active T
  comment WEB-IIS foxweb.dll access
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-iis.rules
</augment>

<augment 1623-6>
  active T
  comment FTP invalid MODE
  comment "pcre: /^MODE\s+[^ABSC]{1}/msi"
  ftp "/((^)|(\n+))[mM][oO][dD][eE][\x20\x09\x0b]+[^aAbBsScC]{1}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/ftp.rules
  <delete>
    payload "/.*[mM][oO][dD][eE]/"
  </delete>
</augment>

<augment 1666-5>
  active T
  comment ATTACK-RESPONSES index of /cgi-bin/ response
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/attack-responses.rules
</augment>

<augment 1694-3>
  active T
  comment ORACLE alter table attempt
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/oracle.rules
</augment>

<augment 2319-1>
  active T
  comment EXPLOIT ebola PASS overflow attempt
  comment "pcre: /^USER\s[^\n]{49}/smi"
  payload "/((^)|(\n+))[uU][sS][eE][rR][\x20\x09\x0b][^\n]{49}/"
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/exploit.rules
  <delete>
    payload "/.*[pP][aA][sS][sS]/"
  </delete>
</augment>

<augment 1044-6>
  active T
  comment WEB-IIS webhits access
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-iis.rules
</augment>

<augment 214-4>
  active T
  comment BACKDOOR MISC Linux rootkit attempt lrkr0x
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/backdoor.rules
</augment>

<augment 563-6>
  active F
  comment P2P Napster Client Data
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/p2p.rules
</augment>

<augment 2074-2>
  active T
  comment WEB-PHP Mambo uploadimage.php upload php file attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 1967-1>
  active T
  comment WEB-PHP phpbb quick-reply.php arbitrary command attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 1928-3>
  active T
  comment FTP shadow retrieval attempt
  requires-reverse-signature ! ftp_server_error
  requires-signature got_ftp_root
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/ftp.rules
</augment>

<augment 1756-2>
  active T
  comment WEB-IIS NewsPro administration authentication attempt
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-iis.rules
</augment>

<augment 2059-1>
  active F
  dst-ip == local_nets
  comment WEB-MISC MsmMask.exe access
  comment "informational only"
  comment "verify that the application is not vulnerable"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 217-3>
  active T
  comment BACKDOOR MISC sm4ck attempt
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/backdoor.rules
</augment>

<augment 628-3>
  active F
  comment SCAN nmap TCP
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/scan.rules
</augment>

<augment 2353-2>
  active T
  comment WEB-PHP IdeaBox cord.php file include
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 2373-1>
  active T
  comment FTP XMKD overflow attempt
  comment "pcre: /^XMKD\s[^\n]{100}/smi"
  eval dataSizeG100
  payload "/((^)|(\n+))[xXmMkKdD][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/ftp.rules
  <delete>
    payload "/.*[xX][mM][kK][dD]/"
  </delete>
</augment>

<augment 711-5>
  active T
  comment TELNET SGI telnetd format bug
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/telnet.rules
</augment>

<augment 1791-2>
  active F
  comment BACKDOOR fragroute trojan connection attempt
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/backdoor.rules
</augment>

<augment 2071-1>
  active T
  comment WEB-MISC post32.exe access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 2152-1>
  active F
  comment WEB-PHP test.php access
  comment "informational only"
  requires-reverse-signature ! http_error
  http /.*[\/\\]test\.php(\?.{1,}|$)/
  <delete>
  	http /.*[\/\\]test\.php/
  </delete>
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 1687-3>
  active T
  comment ORACLE dba_tables access
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/oracle.rules
</augment>

<augment 714-4>
  active T
  comment TELNET resolv_host_conf
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/telnet.rules
</augment>

<augment 2076-2>
  active T
  comment WEB-PHP Mambo uploadimage.php access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 1058-6>
  active T
  comment WEB-MISC xp_enumdsn attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 1773-3>
  active T
  comment WEB-PHP php.exe access
  requires-reverse-signature ! http_error
  http /.*\/php\/php\.exe\?[cCdD]\:\//
  <delete>
  	http /.*[\/\\]php\.exe/
  </delete>
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 284-6>
  active T
  comment POP2 x86 Linux overflow
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/pop2.rules
</augment>

<augment 1753-2>
  active T
  comment WEB-IIS as_web.exe access
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-iis.rules
</augment>

<augment 1938-4>
  active T
  comment POP3 XTND overflow attempt
  comment pcre: /^XTND\s[^\n]{50}/smi
  payload /((^)|(\n+))[xX][tT][nN][dD][\x20\x09\x0b][^\n]{50}/
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/pop3.rules
</augment>

<augment 1142-5>
  active T
  comment WEB-MISC /.... access
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 2397-2>
  active T
  comment WEB-CGI CCBill whereami.cgi access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-cgi.rules
</augment>

<augment 2060-1>
  active T
  comment WEB-MISC DB4Web access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 1551-3>
  active F
  comment WEB-MISC /CVS/Entries access
  comment "informational only"
  comment "not exploit worthy"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 636-1>
  active T
  comment SCAN cybercop udp bomb
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/scan.rules
</augment>

<augment 2346-2>
  active T
  comment WEB-PHP myPHPNuke chatheader.php access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 561-6>
  active F
  comment P2P Napster Client Data
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/p2p.rules
</augment>

<augment 2224-1>
  active T
  comment WEB-CGI psunami.cgi access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-cgi.rules
</augment>

<augment 2112-3>
  active T
  comment POP3 RSET overflow attempt
  comment "pcre: /^RSET\s[^\n]{10}/smi"
  payload "/((^)|(\n+))[rR][sS][eE][tT][\x20\x09\x0b][^\n]{10}/"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/pop3.rules
  <delete>
    payload "/.*[rR][sS][eE][tT]/"
  </delete>
</augment>

<augment 209-4>
  active T
  comment BACKDOOR w00w00 attempt
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/backdoor.rules
</augment>

<augment 1673-3>
  active T
  comment ORACLE EXECUTE_SYSTEM attempt
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/oracle.rules
</augment>

<augment 2132-2>
  active T
  comment WEB-IIS Synchrologic Email Accelerator userid list access attempt
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-iis.rules
</augment>

<augment 2253-3>
  active T
  comment SMTP XEXCH50 overflow attempt
  comment pcre: /^XEXCH50\s+-\d/smi
  payload /((^)|(\n+))[xX][eE][xX][cC][hH]50[\x20\x09\x0b]+-[0-9]/
  sigaction SIG_LOG
  requires-reverse-signature ! smtp_server_fail
  snort-rule-file s2b_data_on_weed/rules2.1/smtp.rules
  <delete>
    payload "/.*[xX][eE][xX][cC][hH]50/"
  </delete>
</augment>

<augment 2433-1>
  active T
  comment WEB-CGI MDaemon form2raw.cgi overflow attempt
  comment "pcre: /\Wfrom=[^\x3b&\n]{100}/si"
  http "/[^a-zA-Z0-9_][fF][rR][oO][mM]=[^\x3b&\n]{100}/"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-cgi.rules
  <delete>
    http "/.*[\/\\]form2raw\.cgi/"
  </delete>
</augment>

<augment 210-3>
  active T
  comment BACKDOOR attempt
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/backdoor.rules
</augment>

<augment 1978-1>
  active T
  comment WEB-MISC xp_regdeletekey attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 2364-2>
  active T
  comment WEB-PHP Cyboards options_form.php access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 2360-2>
  active T
  comment WEB-PHP myphpPagetool pt_config.inc file include
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 1696-3>
  active T
  comment ORACLE create database attempt
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/oracle.rules
</augment>

<augment 2332-1>
  active T
  comment FTP MKDIR format string attempt
  comment "pcre: /^MKDIR\s[^\n]*?%[^\n]*?%/smi"
  ftp "/((^)|(\n+))[mM][kK][dD][iI][rR][\x20\x09\x0b][^\n]*?%[^\n]*?%/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/ftp.rules
  <delete>
    payload "/.*[mM][kK][dD][iI][rR]/"
  </delete>
</augment>

<augment 2358-2>
  active T
  comment WEB-PHP Typo3 translations.php file include
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 1744-3>
  active T
  comment WEB-MISC SecureSite authentication bypass attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 1686-3>
  active T
  comment ORACLE dba_tablespace access
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/oracle.rules
</augment>

<augment 1659-3>
  active T
  comment WEB-COLDFUSION sendmail.cfm access
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/web-coldfusion.rules
</augment>

<augment 2365-2>
  active T
  comment WEB-PHP newsPHP Language file include attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 1689-3>
  active T
  comment ORACLE sys.all_users access
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/oracle.rules
</augment>

<augment 1772-4>
  active T
  comment WEB-IIS pbserver access
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-iis.rules
</augment>

<augment 2333-1>
  active T
  comment FTP RENAME format string attempt
  comment "pcre: /^RENAME\s[^\n]*?%[^\n]*?%/smi"
  ftp "/((^)|(\n+))[rR][eE][nN][aA][mM][eE][\x20\x09\x0b][^\n]*?%[^\n]*?%/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/ftp.rules
  <delete>
    payload "/.*[rR][eE][nN][aA][mM][eE]/"
  </delete>
</augment>

<augment 1518-5>
  active T
  comment WEB-MISC nstelemetry.adp access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 715-6>
  active T
  comment TELNET Attempted SU from wrong group
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/telnet.rules
</augment>

<augment 1692-3>
  active T
  comment ORACLE drop table attempt
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/oracle.rules
</augment>

<augment 2449-1>
  active T
  comment FTP ALLO overflow attempt
  comment "pcre: /^ALLO\s[^\n]{100}/smi"
  payload "/((^)|(\n+))[aAlLlLoO][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/ftp.rules
  <delete>
    payload "/.*[aA][lL][lL][oO]/"
  </delete>
</augment>

<augment 2066-2>
  active T
  comment WEB-MISC Lotus Notes .pl script source download attempt
  comment "requires lotus notes web server"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
  eval isNotApache
  eval isNotIIS
</augment>

<augment 1498-4>
  active T
  comment WEB-MISC PIX firewall manager directory traversal attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 1056-6>
  active F
  comment WEB-MISC Tomcat view source attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
  comment "Informational only"
  comment "Too general"
</augment>

<augment 2344-1>
  active T
  comment FTP XCWD overflow attempt
  comment "pcre: /^XCWD\s[^\n]{100}/smi"
  eval dataSizeG100
  ftp "/((^)|(\n+))[xX][cC][wW][dD][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/ftp.rules
  <delete>
    payload "/.*[xX][cC][wW][dD]/"
  </delete>
</augment>

<augment 237-2>
  active T
  comment DDOS Trin00 Master to Daemon default password attempt
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/ddos.rules
</augment>

<augment 2153-1>
  active T
  comment WEB-PHP autohtml.php directory traversal attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 2405-1>
  active T
  comment WEB-PHP phptest.php access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 1075-6>
  active T
  comment WEB-IIS postinfo.asp access
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-iis.rules
</augment>

<augment 1568-5>
  active T
  comment WEB-IIS /exchange/root.asp access
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-iis.rules
</augment>

<augment 235-2>
  active T
  comment DDOS Trin00 Attacker to Master default mdie password
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/ddos.rules
</augment>

<augment 2110-3>
  active T
  comment POP3 STAT overflow attempt
  comment "pcre: /^STAT\s[^\n]{10}/smi"
  payload "/((^)|(\n+))[sS][tT][aA][tT][\x20\x09\x0b][^\n]{10}/"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/pop3.rules
  <delete>
    payload "/.*[sS][tT][aA][tT]/"
  </delete>
</augment>

<augment 1968-1>
  active T
  comment WEB-PHP phpbb quick-reply.php access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 213-4>
  active T
  comment BACKDOOR MISC Linux rootkit attempt
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/backdoor.rules
</augment>

<augment 1143-5>
  active T
  comment WEB-MISC ///cgi-bin access
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 2131-2>
  active T
  comment WEB-IIS IISProtect access
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-iis.rules
</augment>

<augment 1621-10>
  active T
  comment FTP CMD overflow attempt
  comment "pcre: /^CMD\s[^\n]{100}/smi"
  eval dataSizeG100
  ftp "/((^)|(\n+))[cC][mM][dD][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/ftp.rules
  <delete>
    payload "/.*[cC][mM][dD]/"
  </delete>
</augment>

<augment 2331-2>
  active T
  comment WEB-PHP MatrikzGB privilege escalation attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 2001-1>
  active T
  comment WEB-CGI smartsearch.cgi access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-cgi.rules
</augment>

<augment 557-6>
  active F
  comment P2P GNUTella client request
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/p2p.rules
</augment>

<augment 1239-5>
  active T
  comment NETBIOS RFParalyze Attempt
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/netbios.rules
</augment>

<augment 1980-1>
  active T
  comment BACKDOOR DeepThroat 3.1 Connection attempt
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/backdoor.rules
</augment>

<augment 2275-2>
  active T
  comment SMTP AUTH LOGON brute force attempt
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/smtp.rules
</augment>

<augment 1111-5>
  active T
  comment WEB-MISC Tomcat server exploit access
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 1690-3>
  active T
  comment ORACLE grant attempt
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/oracle.rules
</augment>

<augment 1982-1>
  active T
  comment BACKDOOR DeepThroat 3.1 Server Response [3150]
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/backdoor.rules
</augment>

<augment 2393-1>
  active F
  dst-ip ==local_nets
  comment "WEB-PHP /_admin access"
  comment "Lots of false positives are possible as this attack really requires multiple steps to be successful"
  comment "Suggestion: analyze site and test for vulnerability, make any adjustments, and then disable this rule."
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 2408-1>
  active F
  comment WEB-MISC Invision Power Board search.pl access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
  comment "Informational only"
  comment "Too general"
</augment>

<augment 629-2>
  active T
  comment SCAN nmap fingerprint attempt
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/scan.rules
</augment>

<augment 1540-5>
  active F
  comment WEB-COLDFUSION ?Mode=debug attempt
  comment "not exploit worthy"
  comment "informational only"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-coldfusion.rules
</augment>

<augment 2305-2>
  active T
  comment WEB-PHP chatbox.php access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 2064-2>
  active T
  dst-ip == local_nets
  comment WEB-MISC Lotus Notes .csp script source download attempt
  comment "verify that the application is not vulnerable"
  comment "informational only"
  requires-reverse-signature ! http_error
  <delete>
  	payload /.*\.csp\./
  </delete>
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 1592-4>
  active T
  comment WEB-CGI /fcgi-bin/echo.exe access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-cgi.rules
</augment>

<augment 1933-1>
  active F
  comment WEB-CGI cart.cgi access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-cgi.rules
  comment "Informational only"
</augment>

<augment 1682-3>
  active T
  comment ORACLE all_source access
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/oracle.rules
</augment>

<augment 2416-1>
  active T
  comment FTP invalid MDTM command attempt
  comment "pcre: /^MDTM \d+[-+]\D/smi"
  ftp "/((^)|(\n+))[mMdDtTmM][0-9]+[-+][^0-9]/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/ftp.rules
  <delete>
    payload "/.*[mM][dD][tT][mM]/"
  </delete>
</augment>

<augment 2107-3>
  active T
  comment IMAP create buffer overflow attempt
  comment "pcre: /\sCREATE\s[^\n]{1024}/smi"
  payload "/((^)|(\n+))[\x20\x09\x0b][cC][rR][eE][aA][tT][eE][\x20\x09\x0b][^\n]{1024}/"
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/imap.rules
  <delete>
    payload "/.*CREATE/"
  </delete>
</augment>

<augment 1697-3>
  active T
  comment ORACLE alter database attempt
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/oracle.rules
</augment>

<augment 1491-6>
  active T
  comment WEB-PHP Phorum /support/common.php access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 632-5>
  active T
  comment SMTP expn cybercop attempt
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/smtp.rules
</augment>

<augment 2357-2>
  active T
  comment WEB-PHP WebChat english.php file include
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 2484-1>
  active T
  comment WEB-MISC source.jsp access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 2114-3>
  active T
  comment "RSERVICES rexec password overflow attempt"
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/rservices.rules
</augment>

<augment 2113-3>
  active T
  dst-ip == local_nets
  comment "RSERVICES rexec username overflow attempt"
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/rservices.rules
</augment>

<augment 2246-1>
  active T
  comment WEB-MISC webadmin.dll access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 1626-4>
  active T
  comment WEB-IIS /StoreCSVS/InstantOrder.asmx request
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-iis.rules
</augment>

<augment 2141-1>
  active T
  comment WEB-PHP shoutbox.php directory traversal attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 2157-2>
  active T
  comment WEB-IIS IISProtect globaladmin.asp access
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-iis.rules
</augment>

<augment 1683-3>
  active T
  comment ORACLE all_tables access
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/oracle.rules
</augment>

<augment 1382-9>
  active T
  comment EXPLOIT CHAT IRC Ettercap parse overflow attempt
  comment "pcre: /^PRIVMSG\s+nickserv\s+IDENTIFY\s[^\n]{100}/smi"
  payload "/((^)|(\n+))[pP][rR][iI][vV][mM][sS][gG][\x20\x09\x0b]+[nN][iI][cC][kK][sS][eE][rR][vV][\x20\x09\x0b]+[iI][dD][eE][nN][tT][iI][fF][yY][\x20\x09\x0b][^\n]{100}/"
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/exploit.rules
  <delete>
    payload "/.*[pP][rR][iI][vV][mM][sS][gG]/"
    payload "/.*[nN][iI][cC][kK][sS][eE][rR][vV]/"
    payload "/.*[iI][dD][eE][nN][tT][iI][fF][yY]/"
  </delete>
</augment>

<augment 215-4>
  active T
  comment BACKDOOR MISC Linux rootkit attempt
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/backdoor.rules
</augment>

<augment 2363-2>
  active T
  comment WEB-PHP Cyboards default_header.php access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 1850-3>
  active T
  comment WEB-CGI way-board.cgi access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-cgi.rules
</augment>

<augment 565-6>
  active F
  comment P2P Napster Server Login
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/p2p.rules
</augment>

<augment 1069-6>
  active T
  comment WEB-MISC xp_regread attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 233-3>
  active T
  comment DDOS Trin00 Attacker to Master default startup password
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/ddos.rules
</augment>

<augment 1490-6>
  active T
  comment WEB-PHP Phorum /support/common.php attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 1693-4>
  active T
  comment ORACLE create table attempt
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/oracle.rules
</augment>

<augment 2320-1>
  active T
  comment EXPLOIT ebola USER overflow attempt
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/exploit.rules
  <delete>
	payload /.*[uU][sS][eE][rR]/
  </delete>
  payload /((^)|(\n+))[uU][sS][eE][rR][^\x0a]{49}/
</augment>

<augment 2140-1>
  active T
  comment WEB-PHP p-news.php access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 2000-1>
  active T
  comment WEB-PHP readmsg.php access
  comment "Possible many false positives"
  commnet "If running this webmail server check version to make sure it's not vulnerable and then disable this signature or adjust the notice action."
  dst-ip == local_nets
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 489-7>
  active T
  comment INFO FTP no password
  comment "pcre: /^PASS\s*\n/smi"
  ftp "/((^)|(\n+))[\x20\x09\x0b][pP][aA][sS][sS][\x20\x09\x0b]*\n/"
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/info.rules
  <delete>
    payload "/.*[pP][aA][sS][sS]/"
  </delete>
</augment>

<augment 1936-4>
  active T
  comment POP3 AUTH overflow attempt
  comment "pcre: /^AUTH\s[^\n]{50}/smi"
  payload "/((^)|(\n+))[aA][uU][tT][hH][\x20\x09\x0b][^\n]{50}/"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/pop3.rules
  <delete>
    payload "/.*[aA][uU][tT][hH]/"
  </delete>
</augment>

<augment 2361-2>
  active F
  comment WEB-PHP news.php file include
  comment "Too general"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 2058-1>
  active T
  comment WEB-MISC MsmMask.exe attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 2355-2>
  active T
  comment WEB-PHP Invision Board emailer.php file include
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 1680-3>
  active T
  comment ORACLE all_constraints access
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/oracle.rules
</augment>

<augment 1826-4>
  active T
  comment WEB-MISC WEB-INF access
  requires-reverse-signature ! http_error
  http /.*[\/\\]WEB-INF \./.{1,}/
  <delete>
  	http /.*[\/\\]WEB-INF/
  </delete>
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 2077-2>
  active T
  comment WEB-PHP Mambo upload.php access
  comment "very general"
  comment "only matters if dest is local_nets and then may be too noisy"
  dst-ip == local_nets
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 1695-3>
  active T
  comment ORACLE truncate table attempt
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/oracle.rules
</augment>

<augment 1126-6>
  active T
  comment WEB-MISC AuthChangeUrl access
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 1464-3>
  active T
  comment ATTACK-RESPONSES oracle one hour install
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/attack-responses.rules
</augment>

<augment 1818-3>
  active T
  comment WEB-IIS MS Site Server admin attempt
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-iis.rules
</augment>

<augment 2347-2>
  active T
  comment WEB-PHP myPHPNuke partner.php access
  comment "adjusted sig based on attack example - this may be too limiting"
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
  http /.*\x3d.*\x3cscript\x3e.*document.cookie.*\x3c\x2fscript\x3e/
</augment>

<augment 1685-4>
  active T
  comment ORACLE all_tab_privs access
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/oracle.rules
</augment>

<augment 562-5>
  active F
  comment P2P Napster Client Data
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/p2p.rules
</augment>

<augment 1497-6>
  active T
  comment WEB-MISC cross site scripting attempt
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 1478-3>
  active T
  comment WEB-CGI swc access
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/web-cgi.rules
</augment>

<augment 1379-7>
  active T
  comment FTP STAT overflow attempt
  comment "pcre: /^STAT\s[^\n]{100}/smi"
  eval dataSizeG100
  ftp "/((^)|(\n+))[sS][tT][aA][tT][\x20\x09\x0b][^\n]{100}/"
  requires-reverse-signature ! ftp_server_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/ftp.rules
  <delete>
    payload "/.*[sS][tT][aA][tT]/"
  </delete>
</augment>

<augment 2399-1>
  active T
  comment WEB-PHP WAnewsletter db_type.php access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 1376-5>
  active T
  comment WEB-MISC jrun directory browse attempt
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 912-5>
  active T
  comment WEB-COLDFUSION parks access
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/web-coldfusion.rules
</augment>

<augment 2369-1>
  active T
  comment WEB-MISC ISAPISkeleton.dll access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
</augment>

<augment 1750-3>
  active T
  comment WEB-IIS users.xml access
  requires-signature http_iis_server
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-iis.rules
</augment>

<augment 1966-2>
  active T
  comment MISC GlobalSunTech Access Point Information Disclosure attempt
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/misc.rules
</augment>

<augment 321-5>
  active T
  comment FINGER account enumeration attempt
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/finger.rules
</augment>

<augment 1990-1>
  active F
  comment CHAT MSN user search
  comment "informational only"
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/chat.rules
</augment>

<augment 1482-4>
  active T
  comment WEB-CGI view_source access
  requires-reverse-signature ! http_error
  sigaction SIG_FILE
  snort-rule-file s2b_data_on_weed/rules2.1/web-cgi.rules
</augment>

<augment 2109-3>
  active T
  comment POP3 TOP overflow attempt
  comment "pcre: /^TOP\s[^\n]{10}/smi"
  payload "/((^)|(\n+))[tT][oO][pP][\x20\x09\x0b][^\n]{10}/"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/pop3.rules
  <delete>
    payload "/.*[tT][oO][pP]/"
  </delete>
</augment>

<augment 1745-3>
  active T
  comment WEB-PHP Messagerie supp_membre.php access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-php.rules
</augment>

<augment 2111-3>
  active T
  comment POP3 DELE overflow attempt
  comment "pcre: /^DELE\s[^\n]{10}/smi"
  payload "/((^)|(\n+))[dD][eE][lL][eE][\x20\x09\x0b][^\n]{10}/"
  requires-reverse-signature ! pop_return_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/pop3.rules
  <delete>
    payload "/.*[dD][eE][lL][eE]/"
  </delete>
</augment>

<augment 1521-6>
  active F
  comment WEB-MISC server-status access
  requires-reverse-signature ! http_error
  sigaction SIG_LOG
  snort-rule-file s2b_data_on_weed/rules2.1/web-misc.rules
  comment "Informational only"
  comment "Could point to a default install or an incorrectly configured Apache server"
</augment>

<augment http-shell-check>
  active T
  comment http_shell_check used for filtering shell reference from man pages
  sigaction SIG_IGNORE
</augment>

###############################
## Augment file compiled on 2004-07-12 from Snort rules dated 2004-07-09
###############################