1390.txt

snort入侵检测规则文件2.4 Snort是众所周知的网络入侵检测工具

Rule:

--
Sid:
1390

--
Summary:
This event is generated when an attempt is made to execute shellcode on 
a host in the protected network from a source external to that network.

--
Impact:
This set of instructions can be used as a NOOP to pad buffers on an x86 
architecture machines.

--
Detailed Information:
This is the x86 opcode for 'inc ebx'.  This can be used as a NOOP in an 
x86 architecture, however as with all shellcode rules, this can cause 
false positives.  Check to see if you are ignoring shellcode rules on 
web ports, as this will reduce false positives.

--
Attack Scenarios:
An attacker can pad buffers with this opcode, in an attempt to overflow 
the buffer.

--
Ease of Attack:
This is a generic rule designed to pick up this opcode in use.

--
False Positives:
This will false positive if rule is not ignoring clear text ports every 
time snort sees 24 'C' characters (hex code of 43) in a row.

This is the x86 opcode for 'inc ebx'.  This can be used as a NOOP in an 
x86 architecture, however as with all shellcode rules, this can cause 
false positives.

--
False Negatives:
none known

--
Corrective Action:
none known

--
Contributors:
Sourcefire Research Team
Brian Caswell <[e-mail]>
Mike Poor <[e-mail]>
Nigel Houghton <[e-mail]>

--
Additional References:

CansecWest:
http://cansecwest.com/noplist-v1-1.txt

--