IDSSigVersion="102"
IDSText1=29999,"管理スキャン",""
IDSText2=3700,"ポート スキャン (TCP)","ポート スキャンは、侵入者がホスト マシンで実行されているサービス (サーバ) の数や開いているポート数を調べるときに使用する手段です。通常、これは攻撃を仕掛けるポイントを見つけるときに実行されます。ポート スキャン自体は本来リモートのホスト コンピュータに危害を与えるものではありませんが、侵入者に攻撃の意図があるのかどうかを突き止めることができます。"
IDSText3=3701,"ポート スキャン (UDP)","ポート スキャンは、侵入者がホスト マシンで実行されているサービス (サーバ) の数や開いているポート数を調べるときに使用する手段です。通常、これは攻撃を仕掛けるポイントを見つけるときに実行されます。ポート スキャン自体は本来リモートのホスト コンピュータに危害を与えるものではありませんが、侵入者に攻撃の意図があるのかどうかを突き止めることができます。"
IDSText4=3702,"ファイアウォールのルール","侵入として扱うファイアウォール ルールです。"
IDSText5=3718,"ネットワーク共有プロバイダのサービス拒否 (DoS) (SMBdie)","SMBDie : Windows に対する BSOD 攻撃です。"
IDSText6=3720,"MSSQL 解決サービスのバッファ オーバーフロー (Slammer)","SqlSlammer : バッファ オーバーフロー"
IDSText7=3721,"RPC DCOM スタック バッファ オーバーフロー (Blaster、Nachi)","RpcDcom : バッファ オーバーフロー"
IDSText8=3722,"RPC サービスのサービス拒否 (DoS) (WinNuke)","RPC サービスの Denial of Service (DoS : サービス拒否攻撃) (WinNuke)"
IDSText9=3723,"Windows PPTP サーバ バッファ オーバーフロー","バッファ オーバーフローは、PPTP RAS サービスが、PPTP の誤った形式の SCR (Start Control Request) パケットを受信したときに発生します。これによって、管理者特権を使用した任意のコマンドの実行が許可される場合があります。"
IDSText10=3724,"LSASS Dcpromo ログ ファイル バッファ オーバーフロー (Sasser)","Sasser : バッファ オーバーフロー"
IDSText11=3725,"IP オプションの検証オーバーフロー"," MS05-19 IP オプションの確認 : 不正なオプションを使用して IP パケットを送信することにより、TCPIP.SYS のバッファ オーバーフローを悪用される可能性があります。これによって、Denial of Service (DoS : サービス拒否攻撃) を引き起こしたり、SYSTEM 特権を使用した任意のコマンドの実行が許可されたりする場合があります。"
IDSText12=3801,"TCP/IP の脆弱性により、リモートでコードが実行される"," MS06-32 IP ソースのルーティング : オフセットをチェックしないメモリ コピーが、リモート カーネル アクセスに不正使用される。"
IDSText13=3802,"サーバ サービスの脆弱性により、リモートでコードが実行される"," CVE-2006-1314 攻撃。"
IDSText14=3803,"DNS 解決の脆弱性により、リモートでコードが実行される"," MS06-41 DNS RRData : メモリの破損につながり、リモート アクセスに不正使用される可能性のある複数の脆弱性が存在する。"
IDSText15=3804,"サーバ サービスの脆弱性により、サービス拒否 (DoS) が発生する"," CVE-2006-3942 攻撃。"
IDSText16=3806,"FTP ユーザ名/パスワードのオーバーフロー","FTP ユーザ名またはパスワードが長すぎるため、スタック オーバーフロー攻撃が引き起こされる。"
IDSText17=3845,"Vulnerability in Universal Plug and Play","Vulnerability in Universal Plug and Play (UPnP) Service Could Allow Remote Code Execution"
IDSText18=3846,"Vulnerability in processing FTP Reply","Vulnerability in processing FTP Reply Could Allow Remote Code Execution"
IDSText19=2232,"SMB Buffer Overflow Remote Code Execution Vulnerability","CVE-2008-4834 Attack."
IDSText20=2233,"SMB Validation Remote Code Execution Vulnerability","CVE-2008-4835 Attack."
IDSText21=2230,"Tiny Or Overlap Fragment Attack Vulnerability","Tiny Or Overlap Fragment Attack."
IDSText22=2231,"Vulnerability in SMB Could Allow Remote Code Execution","CVE-2009-3103 Attack."
IDSText23=6029,"SMB Buffer Underflow Vulnerability","CVE-2008-4038 Attack."
IDSText24=6031,"SMB Pathname Overflow Vulnerability","CVE-2010-0020 Attack."
IDSText25=6038,"SMB Transaction Parsing Vulnerability","CVE-2011-0661 Attack"
IDSText26=6022,"Vulnerability in SMB Could Allow Denial of Service","CVE-2009-3676 Attack."
IDSPreProcSig1="TCP Port Scan","FireNfcp","MDFportScanAttackTCP",2,"IP_RemoteAddr,TCP_LocalPort,TCP_Flags,Process_Info",0,0,3700,1,0,"Max Ports",20,"Min High Port",1024,"High Port Divider",20,"Scan Lifetime",60000,"",0,4,TRUE
IDSPreProcSig2="UDP Port Scan","FireNfcp","MDFportScanAttackUDP",3,"IP_RemoteAddr,UDP_LocalPort,UDP_RemotePort,Process_Info",0,0,3701,1,0,"Max Ports",100,"Min High Port",1024,"High Port Divider",20,"Scan Lifetime",200000,"",0,4,TRUE
IDSPreProcSig3="Firewall Rule","FireNfcp","",0,"",0,0,3702,0,0,"",0,"",0,"0",0,"",0,"",0,4,TRUE
IDSPreProcSig4="SMBDie","FireNfcp","MDFSmbDieAttack",2,"TCP_LocalPort,Data_Len,Data_Start,Data,Process_Info",0,99,3718,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig5="SqlSlammer","FireNfcp","MDFSqlSlammerAttack",3,"IP_RemoteAddr,UDP_LocalPort,Data_Len,Data_Start,Data,UDP_RemotePort,Process_Info",0,300,3720,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig6="RpcDcom","FireNfcp","MDFRpcDcomAttack",2,"IP_RemoteAddr,IP_LocalAddr,TCP_RemotePort,TCP_LocalPort,TCP_Flags,Data_Len,Data_Start,Data,Process_Info",0,300,3721,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig7="RpcMap","FireNfcp","MDFRpcMapAttack",2,"IP_RemoteAddr,IP_LocalAddr,TCP_RemotePort,TCP_LocalPort,TCP_Flags,Data_Len,Data_Start,Data,Process_Info",0,300,3722,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig8="PPTP Buffer Overflow","FireNfcp","MDFPPTPAttack",2,"IP_RemoteAddr,TCP_LocalPort,Data_Len,Data,Data_Start,Process_Info",0,10,3723,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig9="Sasser","FireNfcp","MDFSasserAttack",2,"IP_RemoteAddr,IP_LocalAddr,TCP_RemotePort,TCP_LocalPort,TCP_Flags,Data_Len,Data_Start,Data,Process_Info",0,300,3724,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig10="MS05-19 IP Options Validation (TCP)","FireNfcp","MDFIPOptionsValidationAttack",2,"Data,Data_Start,Process_Info",0,300,3725,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig11="MS05-19 IP Options Validation (UDP)","FireNfcp","MDFIPOptionsValidationAttack",3,"Data,Data_Start,Process_Info",0,300,3725,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig12="MS05-19 IP Options Validation (ICMP)","FireNfcp","MDFIPOptionsValidationAttack",4,"Data,Data_Start,Process_Info",0,300,3725,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig13="CVE_2006_3942","FireNfcp","MDFCVE_2006_3942Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data,Process_Info",0,99,3804,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig14="CVE_2006_1314","FireNfcp","MDFCVE_2006_1314Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data,Process_Info",0,99,3802,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig15="MS06-32 IP Source Routing (ICMP)","FireNfcp","MDFIPSourceRouteAttack",4,"Data,Data_Start,Process_Info",0,300,3801,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig16="MS06-41 DNS RRData","FireNfcp","MDFDNSRRDataAttack",3,"Data,Data_Start,Data_Len,UDP_LocalPort,UDP_RemotePort,Process_Info",0,65536,3803,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig17="FTP Username Or Password Overflow ","FireNfcp","MDFFTPUserPassTooLongAttack",2,"TCP_LocalPort,Data_Len,Data_Start,Data,Process_Info",0,400,3806,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig18="CVE_2007_1204","FireNfcp","MDFCVE_2007_1204Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data,Process_Info",0,99,3845,7,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig19="CVE_2007_0217","FireNfcp","MDFCVE_2007_0217Attack",2,"TCP_RemotePort,Data_Len,Data_Start,Data,Process_Info",0,99,3846,7,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig20="CVE_2008_4834","FireNfcp","MDFCVE_2008_4834Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,2232,1,0,"",0,"",0,"",0,"",0,"",0,1,TRUE
IDSPreProcSig21="CVE_2008_4835","FireNfcp","MDFCVE_2008_4835Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,2233,1,0,"",0,"",0,"",0,"",0,"",0,1,TRUE
IDSPreProcSig22="Tiny Or Overlap Fragment Attack","FireNfcp","MDFFragmentAttack",1,"IP_Protocol,IP_Len,IP_Offset",0,0,2230,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig23="CVE_2009_3103","FireNfcp","MDFCVE_2009_3103Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,2231,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig24="CVE_2008_4038","FireNfcp","MDFCVE_2008_4038Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,6029,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig25="CVE_2010_0020","FireNfcp","MDFCVE_2010_0020Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,6031,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig26="CVE_2011_0661","FireNfcp","MDFCVE_2011_0661Attack",2,"TCP_LocalPort,Data_Len,Data_Start,Data",0,99,6038,1,0,"",0,"",0,"",0,"",0,"",0,4,TRUE
IDSPreProcSig27="CVE_2009_3676","FireNfcp","MDFCVE_2009_3676Attack",2,"TCP_RemotePort,Data_Len,Data_Start,Data",0,99,6022,1,0,"",0,"",0,"",0,"",0,"",0,0,TRUE
IDSPreProcHash=0x3AA7BE6C01895C9F17DE6C9306D965D28A39E237
IDSVersionHash=0x8887BDD9B3F12F8A781E230CE41C0A405E3EC11C