IDSSigVersion="102"
IDSText1=29999,"Análisis de gestión",""
IDSText2=3700,"Análisis de puerto (TCP)","Un análisis de puerto es un intento por parte de un intruso de determinar el número de servicios (servidores) o 'puertos abiertos' en un equipo host.  Ello se hace para determinar posibles puntos de acceso para un futuro ataque.  Los puertos que se autoanalizan no suelen estar diseñados para dañar un equipo host remoto, pero pueden indicar el intento de ataque de un intruso."
IDSText3=3701,"Análisis de puerto (UDP)","Un análisis de puerto es un intento por parte de un intruso de determinar el número de servicios (servidores) o 'puertos abiertos' en un equipo host.  Ello se hace para determinar posibles puntos de acceso para un futuro ataque.  Los puertos que se autoanalizan no suelen estar diseñados para dañar un equipo host remoto, pero pueden indicar el intento de ataque de un intruso."
IDSText4=3702,"Regla de cortafuegos","Regla del cortafuegos tratada como una intrusión."
IDSText5=3718,"Denegación de servicio del proveedor de recursos compartidos en red (SMBdie)","SMBDie: ataque BSOD en Windows."
IDSText6=3720,"Desbordamiento de búfer en el servicio de resolución MSSQL (Slammer)","SqlSlammer: desbordamiento de búfer"
IDSText7=3721,"Desbordamiento de búfer en pila RPC DCOM (Blaster, Nachi)","RpcDcom: desbordamiento de búfer"
IDSText8=3722,"Denegación de servicio del servicio RPC (WinNuke)","Denegación de servicio del servicio RPC (WinNuke)"
IDSText9=3723,"Desbordamiento de búfer en el servidor Windows PPTP","Un desbordamiento de búfer se produce cuando el servicio RAS PPTP recibe un paquete PPTP SCR (Start Control Request, Solicitud de control de inicio) con un formato incorrecto.  Esto puede permitir la ejecución de comandos arbitrarios con privilegios administrativos."
IDSText10=3724,"Desbordamiento de búfer de archivos de registro LSASS Dcpromo (Sasser)","Sasser: desbordamiento de búfer"
IDSText11=3725,"Desbordamiento por validación de opciones de IP"," Validación de opciones IP MS05-19: un desbordamiento de búfer en TCPIP.SYS se puede vulnerar enviando un paquete de IP con opciones mal formadas. Esto podría tener como consecuencia la denegación de servicio o permitir la ejecución de comandos arbitrarios con privilegios de SISTEMA."
IDSText12=3801,"La vulnerabilidad en TCP/IP podría permitir la ejecución de un código remoto"," Enrutamiento de fuente IP MS06-32: puede explotarse una copia de memoria con una desviación no comprobada para el acceso a un núcleo remoto."
IDSText13=3802,"La vulnerabilidad en el servicio del servidor podría permitir la ejecución de un código remoto"," Ataque CVE-2006-1314."
IDSText14=3803,"Las vulnerabilidades en una resolución DNS podrían permitir la ejecución de un código remoto"," Datos MS06-41 DNS RR: existen múltiples vulnerabilidades que producen corrupción de la memoria y pueden explotarse para un acceso remoto."
IDSText15=3804,"La vulnerabilidad en el servicio del servidor podría permitir la denegación del servicio"," Ataque CVE-2006-3942."
IDSText16=3806,"Desbordamiento de nombre de usuario/contraseña de FTP","Un nombre de usuario o contraseña de FTP demasiado largos causan un ataque por desbordamiento de pila."
IDSText17=3845,"Vulnerability in Universal Plug and Play","Vulnerability in Universal Plug and Play (UPnP) Service Could Allow Remote Code Execution"
IDSText18=3846,"Vulnerability in processing FTP Reply","Vulnerability in processing FTP Reply Could Allow Remote Code Execution"
IDSText19=2232,"SMB Buffer Overflow Remote Code Execution Vulnerability","CVE-2008-4834 Attack."
IDSText20=2233,"SMB Validation Remote Code Execution Vulnerability","CVE-2008-4835 Attack."
IDSText21=2230,"Tiny Or Overlap Fragment Attack Vulnerability","Tiny Or Overlap Fragment Attack."
IDSText22=2231,"Vulnerability in SMB Could Allow Remote Code Execution","CVE-2009-3103 Attack."
IDSText23=6029,"SMB Buffer Underflow Vulnerability","CVE-2008-4038 Attack."
IDSText24=6031,"SMB Pathname Overflow Vulnerability","CVE-2010-0020 Attack."
IDSText25=6038,"SMB Transaction Parsing Vulnerability","CVE-2011-0661 Attack"
IDSText26=6022,"Vulnerability in SMB Could Allow Denial of Service","CVE-2009-3676 Attack."
IDSPreProcSig1="TCP Port Scan","FireNfcp","MDFportScanAttackTCP",2,"IP_RemoteAddr,TCP_LocalPort,TCP_Flags,Process_Info",0,0,3700,1,0,"Max Ports",20,"Min High Port",1024,"High Port Divider",20,"Scan Lifetime",60000,"",0,4,TRUE
IDSPreProcSig2="UDP Port Scan","FireNfcp","MDFportScanAttackUDP",3,"IP_RemoteAddr,UDP_LocalPort,UDP_RemotePort,Process_Info",0,0,3701,1,0,"Max Ports",100,"Min High Port",1024,"High Port Divider",20,"Scan Lifetime",200000,"",0,4,TRUE
IDSPreProcSig3="Firewall Rule","FireNfcp","",0,"",0,0,3702,0,0,"",0,"",0,"0",0,"",0,"",0,4,TRUE
IDSPreProcSig4="SMBDie","FireNfcp","MDFSmbDieAttack",2,"TCP_LocalPort,Data_Len,Data_Start,Data,Process_Info",0,99,3718,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig5="SqlSlammer","FireNfcp","MDFSqlSlammerAttack",3,"IP_RemoteAddr,UDP_LocalPort,Data_Len,Data_Start,Data,UDP_RemotePort,Process_Info",0,300,3720,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig6="RpcDcom","FireNfcp","MDFRpcDcomAttack",2,"IP_RemoteAddr,IP_LocalAddr,TCP_RemotePort,TCP_LocalPort,TCP_Flags,Data_Len,Data_Start,Data,Process_Info",0,300,3721,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig7="RpcMap","FireNfcp","MDFRpcMapAttack",2,"IP_RemoteAddr,IP_LocalAddr,TCP_RemotePort,TCP_LocalPort,TCP_Flags,Data_Len,Data_Start,Data,Process_Info",0,300,3722,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig8="PPTP Buffer Overflow","FireNfcp","MDFPPTPAttack",2,"IP_RemoteAddr,TCP_LocalPort,Data_Len,Data,Data_Start,Process_Info",0,10,3723,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig9="Sasser","FireNfcp","MDFSasserAttack",2,"IP_RemoteAddr,IP_LocalAddr,TCP_RemotePort,TCP_LocalPort,TCP_Flags,Data_Len,Data_Start,Data,Process_Info",0,300,3724,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig10="MS05-19 IP Options Validation (TCP)","FireNfcp","MDFIPOptionsValidationAttack",2,"Data,Data_Start,Process_Info",0,300,3725,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig11="MS05-19 IP Options Validation (UDP)","FireNfcp","MDFIPOptionsValidationAttack",3,"Data,Data_Start,Process_Info",0,300,3725,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig12="MS05-19 IP Options Validation (ICMP)","FireNfcp","MDFIPOptionsValidationAttack",4,"Data,Data_Start,Process_Info",0,300,3725,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig13="CVE_2006_3942","FireNfcp","MDFCVE_2006_3942Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data,Process_Info",0,99,3804,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig14="CVE_2006_1314","FireNfcp","MDFCVE_2006_1314Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data,Process_Info",0,99,3802,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig15="MS06-32 IP Source Routing (ICMP)","FireNfcp","MDFIPSourceRouteAttack",4,"Data,Data_Start,Process_Info",0,300,3801,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig16="MS06-41 DNS RRData","FireNfcp","MDFDNSRRDataAttack",3,"Data,Data_Start,Data_Len,UDP_LocalPort,UDP_RemotePort,Process_Info",0,65536,3803,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig17="FTP Username Or Password Overflow ","FireNfcp","MDFFTPUserPassTooLongAttack",2,"TCP_LocalPort,Data_Len,Data_Start,Data,Process_Info",0,400,3806,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig18="CVE_2007_1204","FireNfcp","MDFCVE_2007_1204Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data,Process_Info",0,99,3845,7,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig19="CVE_2007_0217","FireNfcp","MDFCVE_2007_0217Attack",2,"TCP_RemotePort,Data_Len,Data_Start,Data,Process_Info",0,99,3846,7,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig20="CVE_2008_4834","FireNfcp","MDFCVE_2008_4834Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,2232,1,0,"",0,"",0,"",0,"",0,"",0,1,TRUE
IDSPreProcSig21="CVE_2008_4835","FireNfcp","MDFCVE_2008_4835Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,2233,1,0,"",0,"",0,"",0,"",0,"",0,1,TRUE
IDSPreProcSig22="Tiny Or Overlap Fragment Attack","FireNfcp","MDFFragmentAttack",1,"IP_Protocol,IP_Len,IP_Offset",0,0,2230,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig23="CVE_2009_3103","FireNfcp","MDFCVE_2009_3103Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,2231,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig24="CVE_2008_4038","FireNfcp","MDFCVE_2008_4038Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,6029,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig25="CVE_2010_0020","FireNfcp","MDFCVE_2010_0020Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,6031,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig26="CVE_2011_0661","FireNfcp","MDFCVE_2011_0661Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,6038,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig27="CVE_2009_3676","FireNfcp","MDFCVE_2009_3676Attack",2,"TCP_RemotePort,Data_Len,Data_Start,Data",0,99,6022,1,0,"",0,"",0,"",0,"",0,"",0,0,TRUE
IDSPreProcHash=0x3AA7BE6C01895C9F17DE6C9306D965D28A39E237
IDSVersionHash=0x8887BDD9B3F12F8A781E230CE41C0A405E3EC11C