Cluster details: RPC DCOM probe (port 135/TCP) Name: RPC DCOM probe (port 135/TCP) Date: 2006-11-15 15:32:11 Classification Level: Attack Core: da4874932f7fcaba5277bbcdf2b5e6b0 Ports: 135/TCP Unique Sip: 43 Signature size: 64 Super signature: alert tcp $EXTERNAL_NET any -> $HOME_NET 135 (msg:"RPC DCOM probe (port 135/TCP)"; flow:to_server,es\ tablished; content:"H|00 00 00 01 00 00 00 d0 16 d0 16 00 00 00 00 01 00 00 00 00 00 01 00 80 bd a8 \ af 8a|}|c9 11 be f4 08 00|+|10|)|89 01 00 00 00 04|]|88 8a eb 1c c9 11 9f e8 08 00|+|10|H`|02 00 00 \ 00|";) The public dashboard only gives overall statistics about a cluster. Each cluster has a name, level of classification, port list on which the payload was seen, unique sources seen sending the payload, final signature size and final (“super”) signature computed over the cluster in snort format. This super signature is common to all the flows that formed the cluster, and is potentially the signature of a new threat such as an exploit or worm.

© Copyright by 2007    (Last update: 2012-02-05 07:05:00 CET)