IDSSigVersion="102"
IDSText1=29999,"Administrativer Scan",""
IDSText2=3700,"Port-Scan (TCP)","Ein Port-Scan ist ein Versuch eines Eindringlings, die Anzahl der Dienste (Server) oder 'offenen Ports' auf einem Host-Computer zu ermitteln  Üblicherweise geschieht dies mit der Absicht, mögliche Zugangsstellen für einen künftigen Angriff zu finden.  Port-Scans an sich sollen einem Remote-Host normalerweise nicht schaden, können aber ein Hinweis auf die Angriffsabsichten eines Eindringlings sein."
IDSText3=3701,"Port-Scan (UDP)","Ein Port-Scan ist ein Versuch eines Eindringlings, die Anzahl der Dienste (Server) oder 'offenen Ports' auf einem Host-Computer zu ermitteln  Üblicherweise geschieht dies mit der Absicht, mögliche Zugangsstellen für einen künftigen Angriff zu finden.  Port-Scans an sich sollen einem Remote-Host normalerweise nicht schaden, können aber ein Hinweis auf die Angriffsabsichten eines Eindringlings sein."
IDSText4=3702,"Firewall-Regel","Firewall-Regel als Intrusion behandelt"
IDSText5=3718,"Network Share-Anbieter Denial-of-Service (SMBdie)","SMBDie: BSOD-Angriff auf Windows."
IDSText6=3720,"MSSQL Resolution-Service Pufferüberlauf (Slammer)","SqlSlammer: Pufferüberlauf"
IDSText7=3721,"RPC DCOM-Stack Pufferüberlauf (Blaster, Nachi)","RpcDcom: Pufferüberlauf"
IDSText8=3722,"RPC-Service Denial-of-Service (WinNuke)","RPC-Service Denial-of-Service (WinNuke)"
IDSText9=3723,"Windows PPTP-Server Pufferüberlauf","Ein Pufferüberlauf liegt vor, wenn der PPTP RAS Service ein falsches SCR (Start Control Request) PPTP-Paket empfängt.  Dies ermöglicht eventuell die Ausführung beliebiger Befehle mit Administratorrechten."
IDSText10=3724,"LSASS Dcpromo-Protokolldatei Pufferüberlauf (Sasser)","Sasser: Pufferüberlauf"
IDSText11=3725,"IP-Optionenprüfung Überlauf"," MS05-19 IP-Optionenprüfung: ein Pufferüberlauf in TCPIP.SYS kann ausgenutzt werden, indem ein IP-Paket mit falsch formatierten Optionen gesendet wird. Dies kann zu einem Denial-of-Service-Angriff führen oder die Ausführung willkürlicher Befehle mit SYSTEM-Rechten ermöglichen."
IDSText12=3801,"Sicherheitsrisiko in TCP/IP könnte die Remote-Ausführung eines Codes ermöglichen"," MS06-32 IP-Quell-Routing: Eine Kopie des Arbeitsspeichers mit einem ungeprüften Offset kann für einen Remotezugriff auf den Kernel ausgenutzt werden."
IDSText13=3802,"Sicherheitsrisiko in Server-Dienst könnte die Remote-Ausführung eines Codes ermöglichen"," CVE-2006-1314-Angriff."
IDSText14=3803,"Sicherheitsrisiko in DNS-Auflösung könnte die Remote-Ausführung eines Codes ermöglichen"," MS06-41 DNS RRData: es existieren mehrere Sicherheitsrisiken, die zur Beschädigung des Arbeitsspeichers führen und für Remotezugriff ausgenutzt werden können."
IDSText15=3804,"Sicherheitsrisiko in Server-Dienst könnte Denial-of-Service ermöglichen"," CVE-2006-3942-Angriff."
IDSText16=3806,"Überlauf FTP-Benutzername/Kennwort","Zu langer FTP-Benutzername oder zu langes FTP-Kennwort führen zu einem Stacküberlauf-Angriff."
IDSText17=3845,"Vulnerability in Universal Plug and Play","Vulnerability in Universal Plug and Play (UPnP) Service Could Allow Remote Code Execution"
IDSText18=3846,"Vulnerability in processing FTP Reply","Vulnerability in processing FTP Reply Could Allow Remote Code Execution"
IDSText19=2232,"SMB Buffer Overflow Remote Code Execution Vulnerability","CVE-2008-4834 Attack."
IDSText20=2233,"SMB Validation Remote Code Execution Vulnerability","CVE-2008-4835 Attack."
IDSText21=2230,"Tiny Or Overlap Fragment Attack Vulnerability","Tiny Or Overlap Fragment Attack."
IDSText22=2231,"Vulnerability in SMB Could Allow Remote Code Execution","CVE-2009-3103 Attack."
IDSText23=6029,"SMB Buffer Underflow Vulnerability","CVE-2008-4038 Attack."
IDSText24=6031,"SMB Pathname Overflow Vulnerability","CVE-2010-0020 Attack."
IDSText25=6038,"SMB Transaction Parsing Vulnerability","CVE-2011-0661 Attack"
IDSText26=6022,"Vulnerability in SMB Could Allow Denial of Service","CVE-2009-3676 Attack."
IDSPreProcSig1="TCP Port Scan","FireNfcp","MDFportScanAttackTCP",2,"IP_RemoteAddr,TCP_LocalPort,TCP_Flags,Process_Info",0,0,3700,1,0,"Max Ports",20,"Min High Port",1024,"High Port Divider",20,"Scan Lifetime",60000,"",0,4,TRUE
IDSPreProcSig2="UDP Port Scan","FireNfcp","MDFportScanAttackUDP",3,"IP_RemoteAddr,UDP_LocalPort,UDP_RemotePort,Process_Info",0,0,3701,1,0,"Max Ports",100,"Min High Port",1024,"High Port Divider",20,"Scan Lifetime",200000,"",0,4,TRUE
IDSPreProcSig3="Firewall Rule","FireNfcp","",0,"",0,0,3702,0,0,"",0,"",0,"0",0,"",0,"",0,4,TRUE
IDSPreProcSig4="SMBDie","FireNfcp","MDFSmbDieAttack",2,"TCP_LocalPort,Data_Len,Data_Start,Data,Process_Info",0,99,3718,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig5="SqlSlammer","FireNfcp","MDFSqlSlammerAttack",3,"IP_RemoteAddr,UDP_LocalPort,Data_Len,Data_Start,Data,UDP_RemotePort,Process_Info",0,300,3720,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig6="RpcDcom","FireNfcp","MDFRpcDcomAttack",2,"IP_RemoteAddr,IP_LocalAddr,TCP_RemotePort,TCP_LocalPort,TCP_Flags,Data_Len,Data_Start,Data,Process_Info",0,300,3721,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig7="RpcMap","FireNfcp","MDFRpcMapAttack",2,"IP_RemoteAddr,IP_LocalAddr,TCP_RemotePort,TCP_LocalPort,TCP_Flags,Data_Len,Data_Start,Data,Process_Info",0,300,3722,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig8="PPTP Buffer Overflow","FireNfcp","MDFPPTPAttack",2,"IP_RemoteAddr,TCP_LocalPort,Data_Len,Data,Data_Start,Process_Info",0,10,3723,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig9="Sasser","FireNfcp","MDFSasserAttack",2,"IP_RemoteAddr,IP_LocalAddr,TCP_RemotePort,TCP_LocalPort,TCP_Flags,Data_Len,Data_Start,Data,Process_Info",0,300,3724,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig10="MS05-19 IP Options Validation (TCP)","FireNfcp","MDFIPOptionsValidationAttack",2,"Data,Data_Start,Process_Info",0,300,3725,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig11="MS05-19 IP Options Validation (UDP)","FireNfcp","MDFIPOptionsValidationAttack",3,"Data,Data_Start,Process_Info",0,300,3725,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig12="MS05-19 IP Options Validation (ICMP)","FireNfcp","MDFIPOptionsValidationAttack",4,"Data,Data_Start,Process_Info",0,300,3725,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig13="CVE_2006_3942","FireNfcp","MDFCVE_2006_3942Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data,Process_Info",0,99,3804,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig14="CVE_2006_1314","FireNfcp","MDFCVE_2006_1314Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data,Process_Info",0,99,3802,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig15="MS06-32 IP Source Routing (ICMP)","FireNfcp","MDFIPSourceRouteAttack",4,"Data,Data_Start,Process_Info",0,300,3801,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig16="MS06-41 DNS RRData","FireNfcp","MDFDNSRRDataAttack",3,"Data,Data_Start,Data_Len,UDP_LocalPort,UDP_RemotePort,Process_Info",0,65536,3803,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig17="FTP Username Or Password Overflow ","FireNfcp","MDFFTPUserPassTooLongAttack",2,"TCP_LocalPort,Data_Len,Data_Start,Data,Process_Info",0,400,3806,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig18="CVE_2007_1204","FireNfcp","MDFCVE_2007_1204Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data,Process_Info",0,99,3845,7,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig19="CVE_2007_0217","FireNfcp","MDFCVE_2007_0217Attack",2,"TCP_RemotePort,Data_Len,Data_Start,Data,Process_Info",0,99,3846,7,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig20="CVE_2008_4834","FireNfcp","MDFCVE_2008_4834Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,2232,1,0,"",0,"",0,"",0,"",0,"",0,1,TRUE
IDSPreProcSig21="CVE_2008_4835","FireNfcp","MDFCVE_2008_4835Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,2233,1,0,"",0,"",0,"",0,"",0,"",0,1,TRUE
IDSPreProcSig22="Tiny Or Overlap Fragment Attack","FireNfcp","MDFFragmentAttack",1,"IP_Protocol,IP_Len,IP_Offset",0,0,2230,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig23="CVE_2009_3103","FireNfcp","MDFCVE_2009_3103Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,2231,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig24="CVE_2008_4038","FireNfcp","MDFCVE_2008_4038Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,6029,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig25="CVE_2010_0020","FireNfcp","MDFCVE_2010_0020Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,6031,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig26="CVE_2011_0661","FireNfcp","MDFCVE_2011_0661Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,6038,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig27="CVE_2009_3676","FireNfcp","MDFCVE_2009_3676Attack",2,"TCP_RemotePort,Data_Len,Data_Start,Data",0,99,6022,1,0,"",0,"",0,"",0,"",0,"",0,0,TRUE
IDSPreProcHash=0x3AA7BE6C01895C9F17DE6C9306D965D28A39E237
IDSVersionHash=0x8887BDD9B3F12F8A781E230CE41C0A405E3EC11C