[Silicon Defense logo]

SnortSnarf signature page

WEB-IIS cmd.exe access

SnortSnarf v021111.1

Signature section (91123)Top 20 source IPsTop 20 dest IPs

2169 alerts with this signature using input module SnortFileInput, with sources:

Earliest such alert at 19:49:22.685527 on 04/17/2003
Latest such alert at 04:47:15.591833 on 06/17/2003

WEB-IIS cmd.exe access 498 sources 1 destinations
Priority: 1Classification: Web Application Attack
[sid:1002]

Sources triggering this attack signature

Source# Alerts (sig)# Alerts (total)# Dsts (sig)# Dsts (total)
24.209.39.2469732611
24.209.105.1568230611
24.209.196.2546813411
24.209.174.06425011
24.209.98.1486312511
24.209.26.1986012011
24.209.36.1946012911
24.209.219.1625221311
24.209.191.914813611
24.209.37.151377411
24.209.44.83367211
24.209.42.242267711
24.209.97.26255011
24.209.229.123244811
24.209.11.98249911
24.209.49.251224211
24.209.219.95208111
24.209.203.150204011
24.63.13.134187611
24.209.18.197176511
24.209.215.159173311
24.209.238.177163211
24.245.2.233166611
24.209.113.11165211
24.209.191.210142811
24.35.68.68124911
24.44.2.165125111
24.130.219.16125011
24.126.82.22124911
24.209.40.219124911
24.98.140.134114611
24.189.230.118104011
24.93.48.91104111
24.98.69.17293311
24.29.173.8193311
24.150.202.3783211
24.99.137.15383311
24.125.85.18783211
24.157.173.3983311
24.114.7.12182511
24.186.148.2483311
24.219.28.22183411
24.98.50.14283211
24.57.13.7883311
24.242.248.24883111
24.99.37.18683411
24.112.153.4483311
24.209.118.13483411
24.74.84.12483411
24.157.60.4872011
24.98.99.14173111
24.129.102.20572711
24.166.45.3773211
24.112.193.14573011
24.46.127.15773211
24.209.5.9871411
24.98.22.11762511
24.157.153.20462111
24.218.160.23862211
24.127.15.1662111
24.209.33.15861211
24.245.36.14262111
24.208.193.21862011
24.34.222.5251911
24.130.75.3351411
24.236.70.251711
24.199.188.22651811
24.114.84.14351711
24.148.85.8551811
24.198.148.10451711
24.209.179.15451011
24.98.20.1451711
24.209.178.8451011
218.16.111.8951011
24.209.210.25251011
24.209.45.2151011
24.147.143.3251811
24.209.50.21251011
24.71.58.20851711
24.91.112.14951811
24.162.12.21041611
24.218.253.6741711
24.130.204.3041511
24.162.219.20341611
24.214.104.3841611
24.138.38.20641711
24.175.171.18041511
24.209.184.904811
24.164.56.16541711
24.120.188.23641611
24.160.157.7941611
24.126.120.8841611
24.201.150.21841711
24.114.38.3741111
24.85.206.15241811
24.62.112.14841611
24.158.5.11341611
24.205.10.24741611
24.220.31.341611
24.242.253.12242311
24.209.34.1854811
24.54.164.10541611
24.148.37.19641611
24.61.174.15841811
24.106.83.10241611
24.76.98.11341611
24.209.45.974811
24.214.128.12641611
24.94.212.16641611
24.28.27.20141711
24.150.19.12341611
24.208.232.17341611
24.226.59.10441711
24.201.83.15241611
24.198.96.14941611
24.101.10.5141111
24.161.112.4041611
24.197.103.21041611
24.43.35.5041511
24.148.68.17741711
24.205.137.1241611
24.114.19.20341611
24.78.148.8541511
24.99.90.2841611
24.52.59.2541811
24.203.10.19441711
24.30.204.14541611
24.226.120.16741711
24.95.244.12941711
24.123.41.13041711
24.140.13.15541711
24.171.142.3241711
24.98.61.17741811
24.201.31.4141711
24.47.19.14441611
24.92.146.11141611
24.150.116.1041611
24.243.175.14441511
24.200.41.11341611
24.243.144.1342011
24.161.94.6141611
24.50.102.8841611
24.150.22.13941811
24.204.108.6141711
24.112.68.20841611
24.99.96.13141511
24.70.71.23641611
24.114.34.2441811
24.62.250.7241611
24.66.107.8741611
24.201.229.6741511
24.84.94.19541711
24.209.133.904811
24.114.70.18241611
24.165.15.14541611
24.198.102.6041711
24.132.247.344811
24.25.55.9341611
24.202.81.5941611
24.191.37.11341711
24.87.77.10641611
24.203.221.541811
24.174.223.21241611
24.202.15.24041611
24.160.16.4641711
24.60.106.18541611
24.201.23.6341611
24.166.119.8841911
24.91.57.21141611
24.243.238.24841611
24.150.35.19441611
24.153.56.2641611
24.74.33.15541511
24.202.34.7241611
24.90.92.16741711
24.206.140.7841611
24.209.100.2454811
24.84.101.19441611
24.209.36.20741711
24.158.6.1541611
24.30.227.13641711
24.126.254.1341711
24.91.73.15241611
24.74.152.24941611
24.99.49.21041611
24.59.74.4741711
24.92.8.841611
24.198.96.12041611
24.167.224.15041711
24.30.115.9341811
24.91.103.15241811
24.98.81.1641611
24.98.186.23141611
24.148.73.9031011
24.99.136.1631411
24.173.130.703511
24.160.23.5331511
211.167.226.783611
24.60.182.12431511
24.98.129.25131211
24.140.76.1431311
24.199.65.16231011
24.98.223.23331511
24.217.213.11131111
24.34.91.2931411
24.209.97.603611
24.71.47.17331411
24.218.33.1672411
24.136.163.1372611
24.130.80.1762411
24.42.15.252411
24.158.157.342411
24.29.111.1662911
24.172.63.2452411
61.139.208.1702411
24.203.122.2222611
24.198.198.272511
24.136.217.1092411
24.165.22.492411
24.68.67.1142411
24.131.113.372911
24.207.34.1102411
24.100.74.1542411
24.203.49.122911
24.98.23.21021311
24.225.182.782611
24.122.7.1362711
24.74.60.1762411
24.57.76.3721411
24.91.100.1802811
24.118.109.2092511
24.150.86.22421211
24.126.90.1632411
24.61.2.1182411
24.62.42.1362411
24.126.123.1612411
24.218.174.972411
24.225.185.1402811
24.168.247.2082411
24.136.138.1732411
24.118.102.1482511
24.136.155.1122411
24.98.4.902411
24.194.228.552411
24.163.219.2512311
24.202.192.1412411
24.166.190.322411
24.237.65.1672611
24.99.77.522411
24.209.66.1272411
24.214.6.2072411
24.239.142.1412411
24.98.123.2391111
24.172.109.751211
24.106.43.61211
24.195.81.511211
24.147.6.1581211
24.103.146.1651211
218.87.235.2531211
24.98.239.1511211
24.231.8.1841311
24.26.238.581211
200.149.157.1531211
24.229.103.2341211
24.155.55.1631211
24.130.74.151211
24.132.129.2061211
24.192.37.2171311
24.112.177.1631211
24.55.29.581211
24.145.197.31211
24.162.194.2181111
218.58.115.1131211
24.27.99.2441211
61.136.148.431211
24.145.197.221211
159.134.176.591211
24.26.146.1151211
206.49.58.301211
24.207.210.1561211
24.217.19.1771211
24.118.162.1081211
24.61.163.311211
24.188.213.731311
24.217.85.281211
65.196.39.361211
24.83.20.1521211
213.145.174.1231211
24.193.243.231211
24.209.14.1641211
24.207.208.471211
24.141.105.2081211
24.216.27.881211
24.29.133.2001211
216.211.89.2211111
62.194.177.981211
61.11.35.671211
24.29.16.2541211
24.128.167.1101211
200.54.64.1301211
24.118.24.561211
24.214.98.641611
24.150.72.1681211
24.88.222.551211
24.99.71.1291211
24.207.196.2291211
24.71.45.891211
24.171.29.231211
24.100.77.71211
24.218.34.1151211
24.145.209.1521211
24.233.151.101211
24.136.140.1271211
24.34.204.451311
202.100.20.761211
61.143.118.721211
61.189.217.311211
24.193.230.461211
24.42.220.1181211
24.91.171.11211
24.98.68.1831211
24.125.71.2261211
24.148.39.971211
24.30.124.2201211
62.220.28.1541211
24.159.116.861211
203.73.143.1231211
24.129.124.681211
24.93.116.2251211
24.167.23.631211
24.196.16.171211
24.166.156.301211
24.130.75.1291211
24.239.159.1591211
24.128.89.171211
24.159.178.251311
24.48.212.451211
24.239.182.1091211
24.98.45.131211
24.209.128.1641211
24.162.60.2011411
24.80.90.2191211
24.145.197.961211
24.165.15.1771211
24.93.51.1061211
210.107.253.2111211
24.25.215.41211
24.34.176.2361211
24.167.80.1551211
24.192.100.1251211
24.77.17.601211
24.99.79.521211
24.118.110.941211
218.151.92.1001211
24.198.148.1991211
24.29.155.701211
24.209.125.1711211
24.98.209.1191211
24.80.9.1681211
24.93.250.1601211
218.27.203.971211
24.212.21.1921211
24.112.238.371211
24.172.109.31211
63.197.51.1701211
24.112.153.1631211
24.33.80.1211211
24.150.134.1301211
218.18.72.331211
24.209.24.981211
24.27.172.1501211
24.112.85.61211
24.101.169.31211
24.28.233.1681211
24.112.69.81211
24.67.245.1281211
24.229.63.1121211
24.208.78.2361211
24.102.124.1701211
24.136.152.2201211
24.43.3.891211
24.155.52.881211
203.93.167.601111
24.174.84.2251211
24.244.187.61211
24.174.88.2201211
24.74.111.191211
24.160.250.2361211
24.225.150.2121211
24.173.6.1061211
24.25.30.571211
24.95.148.341211
24.81.48.2351211
68.72.208.321211
80.117.71.2381211
24.126.31.331211
24.58.202.2191211
24.148.1.421211
24.160.33.541211
24.207.194.1121211
24.167.127.1461211
24.151.33.761211
24.194.136.2161211
24.244.179.281211
200.39.200.1351111
24.162.150.1791211
24.129.65.2451211
61.152.247.171211
12.103.170.701111
24.90.108.921211
24.209.177.1261211
24.161.243.2481211
24.120.224.1141211
24.33.145.2121211
24.94.15.671211
24.209.163.521111
12.27.55.2431211
24.82.171.1101211
24.131.187.2361211
24.116.72.91111
24.225.153.1621211
24.209.252.311211
24.77.219.171211
24.24.212.291211
24.136.23.201211
24.193.104.691211
24.117.37.601211
200.50.90.2471111
24.225.137.2281211
24.73.104.661211
24.42.35.2311211
24.235.161.611211
24.118.108.281211
24.199.81.2101211
219.155.227.1061211
24.91.243.831211
24.81.210.2301211
24.100.46.1211211
24.175.36.191211
24.148.65.681211
24.69.2.1991211
24.90.188.911211
24.63.8.1461211
24.26.92.1851211
24.244.137.891211
24.49.186.1771211
24.93.134.371211
24.237.10.951211
24.33.18.421211
24.63.13.1861211
211.161.149.31211
24.231.32.811211
24.132.51.2511211
24.218.145.2011211
24.164.115.1941211
24.125.88.1361211
24.132.66.2391211
24.118.120.2041211
200.67.24.1381211
24.53.7.791211
24.145.224.141211
24.98.28.211211
24.136.220.91211
24.151.128.1341211
24.42.59.1401211
24.114.141.1491211
24.175.87.101211
24.209.210.1771211
24.162.63.1811211
24.98.153.561211
219.155.227.1181211
209.142.14.601111
217.7.121.1661211
24.90.170.1801211
24.245.10.1921211
81.57.79.961211
24.194.35.1721211
24.218.185.1951211
24.94.192.411211
24.174.80.151211
65.26.95.71211
24.238.141.781211
80.212.222.631211
24.130.90.291211
24.126.134.1041211
24.209.71.221211
24.193.10.2061211
24.71.225.1341211
24.68.101.1131211
24.207.159.2131211
24.145.209.1571211
24.217.69.931211
218.28.4.461211
218.58.6.151111
24.193.153.1461211
24.118.69.1831211
24.106.135.1101211
24.102.7.2351211

Destinations receiving this attack signature

Destinations# Alerts (sig)# Alerts (total)# Srcs (sig)# Srcs (total)
192.168.1.621697770498624

SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:03:51 2003