SnortSnarf signature page

WEB-IIS cmd.exe access

SnortSnarf v021111.1

Signature section (91123)

Top 20 source IPs

Top 20 dest IPs

2169 alerts with this signature using input module SnortFileInput, with sources:

/home/rivettmj/snort_alertlog/alert

Earliest such alert at 19:49:22.685527 on 04/17/2003
Latest such alert at 04:47:15.591833 on 06/17/2003

WEB-IIS cmd.exe access	498 sources	1 destinations
Priority: 1	Classification: Web Application Attack
[sid:1002]

Sources triggering this attack signature

Source	# Alerts (sig)	# Alerts (total)	# Dsts (sig)	# Dsts (total)
24.209.39.246	97	326	1	1
24.209.105.156	82	306	1	1
24.209.196.254	68	134	1	1
24.209.174.0	64	250	1	1
24.209.98.148	63	125	1	1
24.209.26.198	60	120	1	1
24.209.36.194	60	129	1	1
24.209.219.162	52	213	1	1
24.209.191.91	48	136	1	1
24.209.37.151	37	74	1	1
24.209.44.83	36	72	1	1
24.209.42.242	26	77	1	1
24.209.97.26	25	50	1	1
24.209.229.123	24	48	1	1
24.209.11.98	24	99	1	1
24.209.49.251	22	42	1	1
24.209.219.95	20	81	1	1
24.209.203.150	20	40	1	1
24.63.13.134	18	76	1	1
24.209.18.197	17	65	1	1
24.209.215.159	17	33	1	1
24.209.238.177	16	32	1	1
24.245.2.233	16	66	1	1
24.209.113.11	16	52	1	1
24.209.191.210	14	28	1	1
24.35.68.68	12	49	1	1
24.44.2.165	12	51	1	1
24.130.219.16	12	50	1	1
24.126.82.22	12	49	1	1
24.209.40.219	12	49	1	1
24.98.140.134	11	46	1	1
24.189.230.118	10	40	1	1
24.93.48.91	10	41	1	1
24.98.69.172	9	33	1	1
24.29.173.81	9	33	1	1
24.150.202.37	8	32	1	1
24.99.137.153	8	33	1	1
24.125.85.187	8	32	1	1
24.157.173.39	8	33	1	1
24.114.7.121	8	25	1	1
24.186.148.24	8	33	1	1
24.219.28.221	8	34	1	1
24.98.50.142	8	32	1	1
24.57.13.78	8	33	1	1
24.242.248.248	8	31	1	1
24.99.37.186	8	34	1	1
24.112.153.44	8	33	1	1
24.209.118.134	8	34	1	1
24.74.84.124	8	34	1	1
24.157.60.48	7	20	1	1
24.98.99.141	7	31	1	1
24.129.102.205	7	27	1	1
24.166.45.37	7	32	1	1
24.112.193.145	7	30	1	1
24.46.127.157	7	32	1	1
24.209.5.98	7	14	1	1
24.98.22.117	6	25	1	1
24.157.153.204	6	21	1	1
24.218.160.238	6	22	1	1
24.127.15.16	6	21	1	1
24.209.33.158	6	12	1	1
24.245.36.142	6	21	1	1
24.208.193.218	6	20	1	1
24.34.222.52	5	19	1	1
24.130.75.33	5	14	1	1
24.236.70.2	5	17	1	1
24.199.188.226	5	18	1	1
24.114.84.143	5	17	1	1
24.148.85.85	5	18	1	1
24.198.148.104	5	17	1	1
24.209.179.154	5	10	1	1
24.98.20.14	5	17	1	1
24.209.178.84	5	10	1	1
218.16.111.89	5	10	1	1
24.209.210.252	5	10	1	1
24.209.45.21	5	10	1	1
24.147.143.32	5	18	1	1
24.209.50.212	5	10	1	1
24.71.58.208	5	17	1	1
24.91.112.149	5	18	1	1
24.162.12.210	4	16	1	1
24.218.253.67	4	17	1	1
24.130.204.30	4	15	1	1
24.162.219.203	4	16	1	1
24.214.104.38	4	16	1	1
24.138.38.206	4	17	1	1
24.175.171.180	4	15	1	1
24.209.184.90	4	8	1	1
24.164.56.165	4	17	1	1
24.120.188.236	4	16	1	1
24.160.157.79	4	16	1	1
24.126.120.88	4	16	1	1
24.201.150.218	4	17	1	1
24.114.38.37	4	11	1	1
24.85.206.152	4	18	1	1
24.62.112.148	4	16	1	1
24.158.5.113	4	16	1	1
24.205.10.247	4	16	1	1
24.220.31.3	4	16	1	1
24.242.253.122	4	23	1	1
24.209.34.185	4	8	1	1
24.54.164.105	4	16	1	1
24.148.37.196	4	16	1	1
24.61.174.158	4	18	1	1
24.106.83.102	4	16	1	1
24.76.98.113	4	16	1	1
24.209.45.97	4	8	1	1
24.214.128.126	4	16	1	1
24.94.212.166	4	16	1	1
24.28.27.201	4	17	1	1
24.150.19.123	4	16	1	1
24.208.232.173	4	16	1	1
24.226.59.104	4	17	1	1
24.201.83.152	4	16	1	1
24.198.96.149	4	16	1	1
24.101.10.51	4	11	1	1
24.161.112.40	4	16	1	1
24.197.103.210	4	16	1	1
24.43.35.50	4	15	1	1
24.148.68.177	4	17	1	1
24.205.137.12	4	16	1	1
24.114.19.203	4	16	1	1
24.78.148.85	4	15	1	1
24.99.90.28	4	16	1	1
24.52.59.25	4	18	1	1
24.203.10.194	4	17	1	1
24.30.204.145	4	16	1	1
24.226.120.167	4	17	1	1
24.95.244.129	4	17	1	1
24.123.41.130	4	17	1	1
24.140.13.155	4	17	1	1
24.171.142.32	4	17	1	1
24.98.61.177	4	18	1	1
24.201.31.41	4	17	1	1
24.47.19.144	4	16	1	1
24.92.146.111	4	16	1	1
24.150.116.10	4	16	1	1
24.243.175.144	4	15	1	1
24.200.41.113	4	16	1	1
24.243.144.13	4	20	1	1
24.161.94.61	4	16	1	1
24.50.102.88	4	16	1	1
24.150.22.139	4	18	1	1
24.204.108.61	4	17	1	1
24.112.68.208	4	16	1	1
24.99.96.131	4	15	1	1
24.70.71.236	4	16	1	1
24.114.34.24	4	18	1	1
24.62.250.72	4	16	1	1
24.66.107.87	4	16	1	1
24.201.229.67	4	15	1	1
24.84.94.195	4	17	1	1
24.209.133.90	4	8	1	1
24.114.70.182	4	16	1	1
24.165.15.145	4	16	1	1
24.198.102.60	4	17	1	1
24.132.247.34	4	8	1	1
24.25.55.93	4	16	1	1
24.202.81.59	4	16	1	1
24.191.37.113	4	17	1	1
24.87.77.106	4	16	1	1
24.203.221.5	4	18	1	1
24.174.223.212	4	16	1	1
24.202.15.240	4	16	1	1
24.160.16.46	4	17	1	1
24.60.106.185	4	16	1	1
24.201.23.63	4	16	1	1
24.166.119.88	4	19	1	1
24.91.57.211	4	16	1	1
24.243.238.248	4	16	1	1
24.150.35.194	4	16	1	1
24.153.56.26	4	16	1	1
24.74.33.155	4	15	1	1
24.202.34.72	4	16	1	1
24.90.92.167	4	17	1	1
24.206.140.78	4	16	1	1
24.209.100.245	4	8	1	1
24.84.101.194	4	16	1	1
24.209.36.207	4	17	1	1
24.158.6.15	4	16	1	1
24.30.227.136	4	17	1	1
24.126.254.13	4	17	1	1
24.91.73.152	4	16	1	1
24.74.152.249	4	16	1	1
24.99.49.210	4	16	1	1
24.59.74.47	4	17	1	1
24.92.8.8	4	16	1	1
24.198.96.120	4	16	1	1
24.167.224.150	4	17	1	1
24.30.115.93	4	18	1	1
24.91.103.152	4	18	1	1
24.98.81.16	4	16	1	1
24.98.186.231	4	16	1	1
24.148.73.90	3	10	1	1
24.99.136.16	3	14	1	1
24.173.130.70	3	5	1	1
24.160.23.53	3	15	1	1
211.167.226.78	3	6	1	1
24.60.182.124	3	15	1	1
24.98.129.251	3	12	1	1
24.140.76.14	3	13	1	1
24.199.65.162	3	10	1	1
24.98.223.233	3	15	1	1
24.217.213.111	3	11	1	1
24.34.91.29	3	14	1	1
24.209.97.60	3	6	1	1
24.71.47.173	3	14	1	1
24.218.33.167	2	4	1	1
24.136.163.137	2	6	1	1
24.130.80.176	2	4	1	1
24.42.15.25	2	4	1	1
24.158.157.34	2	4	1	1
24.29.111.166	2	9	1	1
24.172.63.245	2	4	1	1
61.139.208.170	2	4	1	1
24.203.122.222	2	6	1	1
24.198.198.27	2	5	1	1
24.136.217.109	2	4	1	1
24.165.22.49	2	4	1	1
24.68.67.114	2	4	1	1
24.131.113.37	2	9	1	1
24.207.34.110	2	4	1	1
24.100.74.154	2	4	1	1
24.203.49.12	2	9	1	1
24.98.23.210	2	13	1	1
24.225.182.78	2	6	1	1
24.122.7.136	2	7	1	1
24.74.60.176	2	4	1	1
24.57.76.37	2	14	1	1
24.91.100.180	2	8	1	1
24.118.109.209	2	5	1	1
24.150.86.224	2	12	1	1
24.126.90.163	2	4	1	1
24.61.2.118	2	4	1	1
24.62.42.136	2	4	1	1
24.126.123.161	2	4	1	1
24.218.174.97	2	4	1	1
24.225.185.140	2	8	1	1
24.168.247.208	2	4	1	1
24.136.138.173	2	4	1	1
24.118.102.148	2	5	1	1
24.136.155.112	2	4	1	1
24.98.4.90	2	4	1	1
24.194.228.55	2	4	1	1
24.163.219.251	2	3	1	1
24.202.192.141	2	4	1	1
24.166.190.32	2	4	1	1
24.237.65.167	2	6	1	1
24.99.77.52	2	4	1	1
24.209.66.127	2	4	1	1
24.214.6.207	2	4	1	1
24.239.142.141	2	4	1	1
24.98.123.239	1	1	1	1
24.172.109.75	1	2	1	1
24.106.43.6	1	2	1	1
24.195.81.51	1	2	1	1
24.147.6.158	1	2	1	1
24.103.146.165	1	2	1	1
218.87.235.253	1	2	1	1
24.98.239.151	1	2	1	1
24.231.8.184	1	3	1	1
24.26.238.58	1	2	1	1
200.149.157.153	1	2	1	1
24.229.103.234	1	2	1	1
24.155.55.163	1	2	1	1
24.130.74.15	1	2	1	1
24.132.129.206	1	2	1	1
24.192.37.217	1	3	1	1
24.112.177.163	1	2	1	1
24.55.29.58	1	2	1	1
24.145.197.3	1	2	1	1
24.162.194.218	1	1	1	1
218.58.115.113	1	2	1	1
24.27.99.244	1	2	1	1
61.136.148.43	1	2	1	1
24.145.197.22	1	2	1	1
159.134.176.59	1	2	1	1
24.26.146.115	1	2	1	1
206.49.58.30	1	2	1	1
24.207.210.156	1	2	1	1
24.217.19.177	1	2	1	1
24.118.162.108	1	2	1	1
24.61.163.31	1	2	1	1
24.188.213.73	1	3	1	1
24.217.85.28	1	2	1	1
65.196.39.36	1	2	1	1
24.83.20.152	1	2	1	1
213.145.174.123	1	2	1	1
24.193.243.23	1	2	1	1
24.209.14.164	1	2	1	1
24.207.208.47	1	2	1	1
24.141.105.208	1	2	1	1
24.216.27.88	1	2	1	1
24.29.133.200	1	2	1	1
216.211.89.221	1	1	1	1
62.194.177.98	1	2	1	1
61.11.35.67	1	2	1	1
24.29.16.254	1	2	1	1
24.128.167.110	1	2	1	1
200.54.64.130	1	2	1	1
24.118.24.56	1	2	1	1
24.214.98.64	1	6	1	1
24.150.72.168	1	2	1	1
24.88.222.55	1	2	1	1
24.99.71.129	1	2	1	1
24.207.196.229	1	2	1	1
24.71.45.89	1	2	1	1
24.171.29.23	1	2	1	1
24.100.77.7	1	2	1	1
24.218.34.115	1	2	1	1
24.145.209.152	1	2	1	1
24.233.151.10	1	2	1	1
24.136.140.127	1	2	1	1
24.34.204.45	1	3	1	1
202.100.20.76	1	2	1	1
61.143.118.72	1	2	1	1
61.189.217.31	1	2	1	1
24.193.230.46	1	2	1	1
24.42.220.118	1	2	1	1
24.91.171.1	1	2	1	1
24.98.68.183	1	2	1	1
24.125.71.226	1	2	1	1
24.148.39.97	1	2	1	1
24.30.124.220	1	2	1	1
62.220.28.154	1	2	1	1
24.159.116.86	1	2	1	1
203.73.143.123	1	2	1	1
24.129.124.68	1	2	1	1
24.93.116.225	1	2	1	1
24.167.23.63	1	2	1	1
24.196.16.17	1	2	1	1
24.166.156.30	1	2	1	1
24.130.75.129	1	2	1	1
24.239.159.159	1	2	1	1
24.128.89.17	1	2	1	1
24.159.178.25	1	3	1	1
24.48.212.45	1	2	1	1
24.239.182.109	1	2	1	1
24.98.45.13	1	2	1	1
24.209.128.164	1	2	1	1
24.162.60.201	1	4	1	1
24.80.90.219	1	2	1	1
24.145.197.96	1	2	1	1
24.165.15.177	1	2	1	1
24.93.51.106	1	2	1	1
210.107.253.211	1	2	1	1
24.25.215.4	1	2	1	1
24.34.176.236	1	2	1	1
24.167.80.155	1	2	1	1
24.192.100.125	1	2	1	1
24.77.17.60	1	2	1	1
24.99.79.52	1	2	1	1
24.118.110.94	1	2	1	1
218.151.92.100	1	2	1	1
24.198.148.199	1	2	1	1
24.29.155.70	1	2	1	1
24.209.125.171	1	2	1	1
24.98.209.119	1	2	1	1
24.80.9.168	1	2	1	1
24.93.250.160	1	2	1	1
218.27.203.97	1	2	1	1
24.212.21.192	1	2	1	1
24.112.238.37	1	2	1	1
24.172.109.3	1	2	1	1
63.197.51.170	1	2	1	1
24.112.153.163	1	2	1	1
24.33.80.121	1	2	1	1
24.150.134.130	1	2	1	1
218.18.72.33	1	2	1	1
24.209.24.98	1	2	1	1
24.27.172.150	1	2	1	1
24.112.85.6	1	2	1	1
24.101.169.3	1	2	1	1
24.28.233.168	1	2	1	1
24.112.69.8	1	2	1	1
24.67.245.128	1	2	1	1
24.229.63.112	1	2	1	1
24.208.78.236	1	2	1	1
24.102.124.170	1	2	1	1
24.136.152.220	1	2	1	1
24.43.3.89	1	2	1	1
24.155.52.88	1	2	1	1
203.93.167.60	1	1	1	1
24.174.84.225	1	2	1	1
24.244.187.6	1	2	1	1
24.174.88.220	1	2	1	1
24.74.111.19	1	2	1	1
24.160.250.236	1	2	1	1
24.225.150.212	1	2	1	1
24.173.6.106	1	2	1	1
24.25.30.57	1	2	1	1
24.95.148.34	1	2	1	1
24.81.48.235	1	2	1	1
68.72.208.32	1	2	1	1
80.117.71.238	1	2	1	1
24.126.31.33	1	2	1	1
24.58.202.219	1	2	1	1
24.148.1.42	1	2	1	1
24.160.33.54	1	2	1	1
24.207.194.112	1	2	1	1
24.167.127.146	1	2	1	1
24.151.33.76	1	2	1	1
24.194.136.216	1	2	1	1
24.244.179.28	1	2	1	1
200.39.200.135	1	1	1	1
24.162.150.179	1	2	1	1
24.129.65.245	1	2	1	1
61.152.247.17	1	2	1	1
12.103.170.70	1	1	1	1
24.90.108.92	1	2	1	1
24.209.177.126	1	2	1	1
24.161.243.248	1	2	1	1
24.120.224.114	1	2	1	1
24.33.145.212	1	2	1	1
24.94.15.67	1	2	1	1
24.209.163.52	1	1	1	1
12.27.55.243	1	2	1	1
24.82.171.110	1	2	1	1
24.131.187.236	1	2	1	1
24.116.72.9	1	1	1	1
24.225.153.162	1	2	1	1
24.209.252.31	1	2	1	1
24.77.219.17	1	2	1	1
24.24.212.29	1	2	1	1
24.136.23.20	1	2	1	1
24.193.104.69	1	2	1	1
24.117.37.60	1	2	1	1
200.50.90.247	1	1	1	1
24.225.137.228	1	2	1	1
24.73.104.66	1	2	1	1
24.42.35.231	1	2	1	1
24.235.161.61	1	2	1	1
24.118.108.28	1	2	1	1
24.199.81.210	1	2	1	1
219.155.227.106	1	2	1	1
24.91.243.83	1	2	1	1
24.81.210.230	1	2	1	1
24.100.46.121	1	2	1	1
24.175.36.19	1	2	1	1
24.148.65.68	1	2	1	1
24.69.2.199	1	2	1	1
24.90.188.91	1	2	1	1
24.63.8.146	1	2	1	1
24.26.92.185	1	2	1	1
24.244.137.89	1	2	1	1
24.49.186.177	1	2	1	1
24.93.134.37	1	2	1	1
24.237.10.95	1	2	1	1
24.33.18.42	1	2	1	1
24.63.13.186	1	2	1	1
211.161.149.3	1	2	1	1
24.231.32.81	1	2	1	1
24.132.51.251	1	2	1	1
24.218.145.201	1	2	1	1
24.164.115.194	1	2	1	1
24.125.88.136	1	2	1	1
24.132.66.239	1	2	1	1
24.118.120.204	1	2	1	1
200.67.24.138	1	2	1	1
24.53.7.79	1	2	1	1
24.145.224.14	1	2	1	1
24.98.28.21	1	2	1	1
24.136.220.9	1	2	1	1
24.151.128.134	1	2	1	1
24.42.59.140	1	2	1	1
24.114.141.149	1	2	1	1
24.175.87.10	1	2	1	1
24.209.210.177	1	2	1	1
24.162.63.181	1	2	1	1
24.98.153.56	1	2	1	1
219.155.227.118	1	2	1	1
209.142.14.60	1	1	1	1
217.7.121.166	1	2	1	1
24.90.170.180	1	2	1	1
24.245.10.192	1	2	1	1
81.57.79.96	1	2	1	1
24.194.35.172	1	2	1	1
24.218.185.195	1	2	1	1
24.94.192.41	1	2	1	1
24.174.80.15	1	2	1	1
65.26.95.7	1	2	1	1
24.238.141.78	1	2	1	1
80.212.222.63	1	2	1	1
24.130.90.29	1	2	1	1
24.126.134.104	1	2	1	1
24.209.71.22	1	2	1	1
24.193.10.206	1	2	1	1
24.71.225.134	1	2	1	1
24.68.101.113	1	2	1	1
24.207.159.213	1	2	1	1
24.145.209.157	1	2	1	1
24.217.69.93	1	2	1	1
218.28.4.46	1	2	1	1
218.58.6.15	1	1	1	1
24.193.153.146	1	2	1	1
24.118.69.183	1	2	1	1
24.106.135.110	1	2	1	1
24.102.7.235	1	2	1	1

Destinations receiving this attack signature

Destinations	# Alerts (sig)	# Alerts (total)	# Srcs (sig)	# Srcs (total)
192.168.1.6	2169	7770	498	624

SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:03:51 2003