IDSSigVersion="102"
IDSText1=29999,"管理扫描",""
IDSText2=3700,"端口扫描(TCP)","端口扫描是指入侵者确定主机上的服务(服务器)数或“开放端口”数的尝试。执行该操作通常是为了确定未来攻击的可能接入点。端口扫描本身通常不用于损害远程主机，但可以表明入侵者的攻击意图。"
IDSText3=3701,"端口扫描(UDP)","端口扫描是指入侵者确定主机上的服务(服务器)数或“开放端口”数的尝试。执行该操作通常是为了确定未来攻击的可能接入点。端口扫描本身通常不用于损害远程主机，但可以表明入侵者的攻击意图。"
IDSText4=3702,"防火墙规则","被视为一种入侵的防火墙规则。"
IDSText5=3718,"网络共享提供程序拒绝服务(SMBdie)","SMBDie:针对 Windows 的蓝屏死机攻击。"
IDSText6=3720,"MSSQL 解析服务缓冲区溢出(Slammer)","SqlSlammer: 缓冲区溢出"
IDSText7=3721,"RPC DCOM 堆栈缓冲区溢出(Blaster、Nachi)","RpcDcom: 缓冲区溢出"
IDSText8=3722,"RPC 服务拒绝服务(WinNuke)","RPC 服务拒绝服务(WinNuke)"
IDSText9=3723,"Windows PPTP 服务器缓冲区溢出","当 PPTP RAS 服务接收到格式不正确的 SCR (Start Control Request) PPTP 包时存在缓冲区溢出。它可能会允许使用管理权限执行任意命令。"
IDSText10=3724,"LSASS Dcpromo 日志文件缓冲区溢出(Sasser)","Sasser: 缓冲区溢出"
IDSText11=3725,"IP 选项验证溢出"," MS05-19 IP 选项验证:可通过发送包含格式不正确的选项的 IP 包利用 TCPIP.SYS 中的缓冲区溢出。它可能会导致拒绝服务或会允许使用 SYSTEM 权限执行任意命令。"
IDSText12=3801,"TCP/IP 中的漏洞可能允许远程代码执行"," MS06-32 IP 源路由:可以利用具有未检查的偏移量的内存副本来进行远程内核访问。"
IDSText13=3802,"服务器服务中的漏洞可能允许远程代码执行","CVE-2006-1314 攻击。"
IDSText14=3803,"DNS 解析中的漏洞可能允许远程代码执行"," MS06-41 DNS RRData:存在可导致内存损坏并可以被利用以进行远程访问的多个漏洞。"
IDSText15=3804,"服务器服务中的漏洞可能允许拒绝服务","CVE-2006-3942 攻击。"
IDSText16=3806,"FTP 用户名/密码溢出","FTP 用户名或密码太长导致堆栈溢出攻击。"
IDSText17=3845,"通用即插即用中的漏洞","通用即插即用(UPnP)服务中的漏洞可能允许远程代码执行"
IDSText18=3846,"处理 FTP 回复时的漏洞","处理 FTP 回复时的漏洞可能允许远程代码执行"
IDSText19=2232,"SMB 缓冲区溢出远程代码执行漏洞","CVE-2008-4834 攻击。"
IDSText20=2233,"SMB 验证远程代码执行漏洞","CVE-2008-4835 攻击。"
IDSText21=2230,"极小碎片攻击或重叠碎片攻击漏洞","极小碎片攻击或重叠碎片攻击。"
IDSText22=2231,"SMB 中的漏洞可能允许远程代码执行","CVE-2009-3103 攻击。"
IDSText23=6029,"SMB 缓冲区下溢漏洞","CVE-2008-4038 攻击。"
IDSText24=6031,"SMB 路径名称溢出漏洞","CVE-2010-0020 攻击。"
IDSText25=6038,"SMB Transaction Parsing Vulnerability","CVE-2011-0661 Attack"
IDSText26=6022,"Vulnerability in SMB Could Allow Denial of Service","CVE-2009-3676 Attack."
IDSPreProcSig1="TCP 端口扫描","FireNfcp","MDFportScanAttackTCP",2,"IP_RemoteAddr,TCP_LocalPort,TCP_Flags,Process_Info",0,0,3700,1,0,"最大端口数",20,"最小高端口",1024,"高端口分隔器",20,"扫描生存期",60000,"",0,4,TRUE
IDSPreProcSig2="UDP 端口扫描","FireNfcp","MDFportScanAttackUDP",3,"IP_RemoteAddr,UDP_LocalPort,UDP_RemotePort,Process_Info",0,0,3701,1,0,"最大端口数",100,"最小高端口",1024,"高端口分隔器",20,"扫描生存期",200000,"",0,4,TRUE
IDSPreProcSig3="防火墙规则","FireNfcp","",0,"",0,0,3702,0,0,"",0,"",0,"0",0,"",0,"",0,4,TRUE
IDSPreProcSig4="SMBDie","FireNfcp","MDFSmbDieAttack",2,"TCP_LocalPort,Data_Len,Data_Start,数据,Process_Info",0,99,3718,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig5="SqlSlammer","FireNfcp","MDFSqlSlammerAttack",3,"IP_RemoteAddr,UDP_LocalPort,Data_Len,Data_Start,数据,UDP_RemotePort,Process_Info",0,300,3720,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig6="RpcDcom","FireNfcp","MDFRpcDcomAttack",2,"IP_RemoteAddr,IP_LocalAddr,TCP_RemotePort,TCP_LocalPort,TCP_Flags,Data_Len,Data_Start,数据,Process_Info",0,300,3721,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig7="RpcMap","FireNfcp","MDFRpcMapAttack",2,"IP_RemoteAddr,IP_LocalAddr,TCP_RemotePort,TCP_LocalPort,TCP_Flags,Data_Len,Data_Start,数据,Process_Info",0,300,3722,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig8="PPTP 缓冲区溢出","FireNfcp","MDFPPTPAttack",2,"IP_RemoteAddr,TCP_LocalPort,Data_Len,数据,Data_Start,Process_Info",0,10,3723,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig9="Sasser","FireNfcp","MDFSasserAttack",2,"IP_RemoteAddr,IP_LocalAddr,TCP_RemotePort,TCP_LocalPort,TCP_Flags,Data_Len,Data_Start,数据,Process_Info",0,300,3724,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig10="MS05-19 IP 选项验证(TCP)","FireNfcp","MDFIPOptionsValidationAttack",2,"数据,Data_Start,Process_Info",0,300,3725,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig11="MS05-19 IP 选项验证(UDP)","FireNfcp","MDFIPOptionsValidationAttack",3,"数据,Data_Start,Process_Info",0,300,3725,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig12="MS05-19 IP 选项验证(ICMP)","FireNfcp","MDFIPOptionsValidationAttack",4,"数据,Data_Start,Process_Info",0,300,3725,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig13="CVE_2006_3942","FireNfcp","MDFCVE_2006_3942Attack",2,"TCP_LocalPort,Data_Len,Data_Start,数据,Process_Info",0,99,3804,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig14="CVE_2006_1314","FireNfcp","MDFCVE_2006_1314Attack",2,"TCP_LocalPort,Data_Len,Data_Start,数据,Process_Info",0,99,3802,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig15="MS06-32 IP 源路由(ICMP)","FireNfcp","MDFIPSourceRouteAttack",4,"数据,Data_Start,Process_Info",0,300,3801,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig16="MS06-41 DNS RRData","FireNfcp","MDFDNSRRDataAttack",3,"数据,Data_Start,Data_Len,UDP_LocalPort,UDP_RemotePort,Process_Info",0,65536,3803,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig17="FTP 用户名或密码溢出 ","FireNfcp","MDFFTPUserPassTooLongAttack",2,"TCP_LocalPort,Data_Len,Data_Start,数据,Process_Info",0,400,3806,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig18="CVE_2007_1204","FireNfcp","MDFCVE_2007_1204Attack",2,"TCP_LocalPort,Data_Len,Data_Start,数据,Process_Info",0,99,3845,7,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig19="CVE_2007_0217","FireNfcp","MDFCVE_2007_0217Attack",2,"TCP_RemotePort,Data_Len,Data_Start,数据,Process_Info",0,99,3846,7,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig20="CVE_2008_4834","FireNfcp","MDFCVE_2008_4834Attack",2,"TCP_LocalPort,Data_Len,Data_Start,数据",0,99,2232,1,0,"",0,"",0,"",0,"",0,"",0,1,TRUE
IDSPreProcSig21="CVE_2008_4835","FireNfcp","MDFCVE_2008_4835Attack",2,"TCP_LocalPort,Data_Len,Data_Start,数据",0,99,2233,1,0,"",0,"",0,"",0,"",0,"",0,1,TRUE
IDSPreProcSig22="极小碎片攻击或重叠碎片攻击","FireNfcp","MDFFragmentAttack",1,"IP_Protocol,IP_Len,IP_Offset",0,0,2230,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig23="CVE_2009_3103","FireNfcp","MDFCVE_2009_3103Attack",2,"TCP_LocalPort,Data_Len,Data_Start,数据",0,99,2231,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig24="CVE_2008_4038","FireNfcp","MDFCVE_2008_4038Attack",2,"TCP_LocalPort,Data_Len,Data_Start,数据",0,99,6029,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig25="CVE_2010_0020","FireNfcp","MDFCVE_2010_0020Attack",2,"TCP_LocalPort,Data_Len,Data_Start,数据",0,99,6031,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig26="CVE_2011_0661","FireNfcp","MDFCVE_2011_0661Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,6038,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig27="CVE_2009_3676","FireNfcp","MDFCVE_2009_3676Attack",2,"TCP_RemotePort,Data_Len,Data_Start,Data",0,99,6022,1,0,"",0,"",0,"",0,"",0,"",0,0,TRUE
IDSPreProcHash=0x3AA7BE6C01895C9F17DE6C9306D965D28A39E237
IDSVersionHash=0x8887BDD9B3F12F8A781E230CE41C0A405E3EC11C
