dos.rules

This is the snapshot of Snot Latest Rules

# Autogenerated skeleton rules file.  Do NOT edit by hand
alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"DOS IGMP IP Options validation attempt"; sid:8092; gid:3; rev:3; classtype:attempted-dos; reference:url,www.microsoft.com/technet/security/bulletin/ms06-007.mspx; reference:cve,2006-0021; reference:bugtraq,16645; metadata: engine shared, soid 3|8092;)
alert tcp $EXTERNAL_NET any <> $HOME_NET 389 (msg:"DOS Microsoft Active Directory LDAP denial of service attempt"; sid:13475; gid:3; rev:1; classtype:attempted-dos; reference:cve,2008-0088; reference:url,www.microsoft.com/technet/security/bulletin/ms08-003.mspx; metadata: engine shared, soid 3|13475;)
alert ip $EXTERNAL_NET any <> 224.0.0.0/4 any (msg:"DOS Microsoft PGM fragment denial of service attempt"; sid:13825; gid:3; rev:1; classtype:attempted-dos; reference:cve,2008-1441; reference:url,www.microsoft.com/technet/security/bulletin/MS08-036.mspx; metadata: engine shared, soid 3|13825, policy balanced-ips drop, policy security-ips drop;)
alert ip $EXTERNAL_NET any <> 224.0.0.0/4 any (msg:"DOS Microsoft PGM denial of service attempt"; sid:13827; gid:3; rev:1; classtype:attempted-dos; reference:cve,2008-1440; reference:url,www.microsoft.com/technet/security/bulletin/MS08-036.mspx; metadata: engine shared, soid 3|13827, policy balanced-ips drop, policy security-ips drop;)
alert tcp $EXTERNAL_NET any <> $HOME_NET 389 (msg:"DOS Microsoft Active Directory LDAP cookie denial of service attempt"; sid:13835; gid:3; rev:1; classtype:attempted-dos; reference:cve,2008-1445; reference:url,www.microsoft.com/technet/security/bulletin/MS08-035.mspx; metadata: engine shared, soid 3|13835;)
alert udp $EXTERNAL_NET any <> $HOME_NET 161:162 (msg:"DOS linux kernel snmp nat netfilter memory corruption attempt"; sid:13773; gid:3; rev:1; classtype:attempted-dos; reference:bugtraq,18081; reference:cve,2006-2444; reference:url,kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.16.18; metadata: engine shared, soid 3|13773;)
alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"DOS Microsoft IP Options denial of service"; sid:10127; gid:3; rev:1; classtype:attempted-dos; reference:url,www.microsoft.com/technet/security/bulletin/ms06-032.mspx; reference:cve,2006-2379; metadata: engine shared, soid 3|10127;)
alert tcp any any -> $HOME_NET 389 (msg:"DOS openldap authcid name denial of service attempt"; sid:13416; gid:3; rev:1; classtype:attempted-dos; reference:bugtraq,20939; reference:cve,2006-5779; metadata: engine shared, soid 3|13416;)
alert tcp any any -> $HOME_NET 389 (msg:"DOS openldap server bind request denial of service attempt"; sid:13425; gid:3; rev:1; classtype:denial-of-service; reference:url,www.milw0rm.com/exploits/2730; reference:cve,2006-5779; reference:bugtraq,20939; metadata: engine shared, soid 3|13425;)
alert tcp any any -> $HOME_NET 389 (msg:"DOS IBM Tivoli Director LDAP server invalid DN message buffer overflow attempt"; sid:13418; gid:3; rev:1; classtype:attempted-dos; reference:url,www-1.ibm.com/support/docview.wss?uid=swg21230820; reference:cve,2006-0717; reference:bugtraq,16593; metadata: engine shared, soid 3|13418;)