13592.txt

This is the snapshot of Snot Latest Rules

Rule:

--
Sid:
721

--
Summary:
This event is generated when network activity indicating the possible download of a malicious file has occurred.

--
Impact:
Malicious code infection.  This event may indicate that an internal host may be infected with some kind of malicious code or the host has downloaded a file that may be potentially damaging.

--
Detailed Information:
This event may indicate a possible virus infection of a host on the protected network.

--
Affected Systems:
Various systems

--
Attack Scenarios:
Viruses may propogate in many different ways. Many arrive in the form of email attachments that an unsuspecting user may trigger by opening the attachment. Once infected, many viruses have the ability to use the infected host as a means of spreading copies of itself to other machines on the protected and external networks.

--
Ease of Attack:
Simple

--
False Positives:
None known

--
False Negatives:
None known.

--
Corrective Action:
Use antivirus software on hosts to terminate infectors.

--
Contributors:
Sourcefire Vulnerability Research Team

--
Additional References:

--