SnortSnarf signature page

WEB-IIS CodeRed v2 root.exe access

SnortSnarf v021111.1

Signature section (91123)

Top 20 source IPs

Top 20 dest IPs

680 alerts with this signature using input module SnortFileInput, with sources:

/home/rivettmj/snort_alertlog/alert

Earliest such alert at 19:49:18.916733 on 04/17/2003
Latest such alert at 04:46:56.419521 on 06/17/2003

WEB-IIS CodeRed v2 root.exe access	204 sources	1 destinations
Priority: 1	Classification: Web Application Attack
[url:www.cert.org/advisories/CA-2001-19.html] [sid:1256]

Sources triggering this attack signature

Source	# Alerts (sig)	# Alerts (total)	# Dsts (sig)	# Dsts (total)
24.209.105.156	36	306	1	1
24.209.39.246	32	326	1	1
24.209.174.0	30	250	1	1
24.209.219.162	27	213	1	1
24.209.11.98	12	99	1	1
24.63.13.134	10	76	1	1
24.209.191.91	10	136	1	1
24.209.219.95	10	81	1	1
24.245.2.233	8	66	1	1
24.209.18.197	8	65	1	1
24.126.82.22	8	49	1	1
24.130.219.16	6	50	1	1
24.209.113.11	6	52	1	1
24.44.2.165	6	51	1	1
24.35.68.68	6	49	1	1
24.130.75.33	6	14	1	1
24.242.253.122	6	23	1	1
24.189.230.118	6	40	1	1
24.93.48.91	6	41	1	1
24.129.102.205	6	27	1	1
24.209.40.219	6	49	1	1
24.209.42.242	6	77	1	1
24.114.7.121	5	25	1	1
24.98.140.134	5	46	1	1
24.98.50.142	4	32	1	1
24.98.69.172	4	33	1	1
24.148.85.85	4	18	1	1
24.157.153.204	4	21	1	1
24.166.45.37	4	32	1	1
24.57.13.78	4	33	1	1
24.219.28.221	4	34	1	1
24.166.119.88	4	19	1	1
24.99.37.186	4	34	1	1
24.29.173.81	4	33	1	1
24.99.137.153	4	33	1	1
24.157.173.39	4	33	1	1
24.74.84.124	4	34	1	1
24.98.20.14	4	17	1	1
24.245.36.142	4	21	1	1
24.125.85.187	4	32	1	1
24.218.160.238	4	22	1	1
24.243.144.13	4	20	1	1
24.112.153.44	4	33	1	1
24.98.99.141	4	31	1	1
24.98.22.117	4	25	1	1
24.46.127.157	4	32	1	1
24.112.193.145	4	30	1	1
24.209.118.134	4	34	1	1
24.186.148.24	4	33	1	1
24.150.202.37	4	32	1	1
24.208.193.218	4	20	1	1
24.199.188.226	3	18	1	1
24.61.174.158	3	18	1	1
24.242.248.248	3	31	1	1
24.98.61.177	3	18	1	1
24.90.92.167	3	17	1	1
24.243.238.248	2	16	1	1
24.74.33.155	2	15	1	1
24.202.34.72	2	16	1	1
24.150.116.10	2	16	1	1
24.209.36.194	2	129	1	1
24.158.6.15	2	16	1	1
24.160.66.26	2	2	1	1
24.30.227.136	2	17	1	1
24.126.254.13	2	17	1	1
24.204.108.61	2	17	1	1
24.70.71.236	2	16	1	1
24.160.23.53	2	15	1	1
24.91.73.152	2	16	1	1
24.66.107.87	2	16	1	1
24.74.152.249	2	16	1	1
24.192.37.217	2	3	1	1
24.148.73.90	2	10	1	1
24.99.49.210	2	16	1	1
24.114.70.182	2	16	1	1
24.59.74.47	2	17	1	1
24.92.8.8	2	16	1	1
24.198.96.120	2	16	1	1
24.140.76.14	2	13	1	1
24.30.115.93	2	18	1	1
24.98.81.16	2	16	1	1
24.98.23.210	2	13	1	1
24.191.37.113	2	17	1	1
24.87.77.106	2	16	1	1
24.98.186.231	2	16	1	1
24.214.104.38	2	16	1	1
24.218.253.67	2	17	1	1
24.57.76.37	2	14	1	1
24.138.38.206	2	17	1	1
24.217.213.111	2	11	1	1
24.201.23.63	2	16	1	1
24.136.163.137	2	6	1	1
24.91.57.211	2	16	1	1
24.153.56.26	2	16	1	1
24.199.65.162	2	10	1	1
24.160.157.79	2	16	1	1
24.126.120.88	2	16	1	1
24.85.206.152	2	18	1	1
24.127.23.32	2	2	1	1
24.206.140.78	2	16	1	1
24.84.101.194	2	16	1	1
24.205.10.247	2	16	1	1
24.127.15.16	2	21	1	1
24.209.36.207	2	17	1	1
24.25.55.93	2	16	1	1
24.54.164.105	2	16	1	1
24.106.83.102	2	16	1	1
24.148.37.196	2	16	1	1
24.76.98.113	2	16	1	1
24.188.213.73	2	3	1	1
24.167.224.150	2	17	1	1
24.157.60.48	2	20	1	1
24.71.58.208	2	17	1	1
24.60.182.124	2	15	1	1
24.162.219.203	2	16	1	1
24.91.103.152	2	18	1	1
24.91.112.149	2	18	1	1
24.162.12.210	2	16	1	1
24.130.204.30	2	15	1	1
24.202.81.59	2	16	1	1
24.94.212.166	2	16	1	1
24.214.128.126	2	16	1	1
24.164.56.165	2	17	1	1
24.239.167.179	2	2	1	1
24.28.27.201	2	17	1	1
24.150.19.123	2	16	1	1
24.225.185.140	2	8	1	1
24.98.129.251	2	12	1	1
24.203.221.5	2	18	1	1
24.158.5.113	2	16	1	1
24.62.112.148	2	16	1	1
24.98.31.200	2	2	1	1
24.120.188.236	2	16	1	1
24.201.150.218	2	17	1	1
24.99.136.16	2	14	1	1
24.114.38.37	2	11	1	1
24.208.232.173	2	16	1	1
24.198.148.104	2	17	1	1
24.214.98.64	2	6	1	1
24.198.96.149	2	16	1	1
24.118.102.148	2	5	1	1
24.161.112.40	2	16	1	1
24.197.103.210	2	16	1	1
24.91.100.180	2	8	1	1
24.99.90.28	2	16	1	1
24.29.111.166	2	9	1	1
24.220.31.3	2	16	1	1
24.203.10.194	2	17	1	1
24.43.35.50	2	15	1	1
24.226.120.167	2	17	1	1
24.165.22.49	2	4	1	1
24.203.122.222	2	6	1	1
24.226.59.104	2	17	1	1
24.114.19.203	2	16	1	1
24.131.113.37	2	9	1	1
24.201.83.152	2	16	1	1
24.174.223.212	2	16	1	1
24.161.94.61	2	16	1	1
24.78.148.85	2	15	1	1
24.101.10.51	2	11	1	1
24.202.192.141	2	4	1	1
24.150.22.139	2	18	1	1
24.50.102.88	2	16	1	1
24.114.84.143	2	17	1	1
24.52.59.25	2	18	1	1
24.202.15.240	2	16	1	1
24.203.49.12	2	9	1	1
24.148.68.177	2	17	1	1
24.160.16.46	2	17	1	1
24.205.137.12	2	16	1	1
24.30.204.145	2	16	1	1
24.95.244.129	2	17	1	1
24.147.143.32	2	18	1	1
24.34.222.52	2	19	1	1
24.236.70.2	2	17	1	1
24.140.13.155	2	17	1	1
24.98.223.233	2	15	1	1
24.237.65.167	2	6	1	1
24.112.68.208	2	16	1	1
24.171.142.32	2	17	1	1
24.60.106.185	2	16	1	1
24.71.47.173	2	14	1	1
24.114.34.24	2	18	1	1
24.201.31.41	2	17	1	1
24.102.69.64	2	2	1	1
24.123.41.130	2	17	1	1
24.122.7.136	2	7	1	1
24.62.250.72	2	16	1	1
24.47.19.144	2	16	1	1
24.201.229.67	2	15	1	1
24.92.146.111	2	16	1	1
24.165.15.145	2	16	1	1
24.84.94.195	2	17	1	1
24.198.102.60	2	17	1	1
24.200.41.113	2	16	1	1
24.150.35.194	2	16	1	1
24.34.44.131	2	2	1	1
24.34.91.29	2	14	1	1
24.175.171.180	1	15	1	1
24.99.96.131	1	15	1	1
24.102.203.62	1	1	1	1
24.243.175.144	1	15	1	1
24.202.106.81	1	1	1	1
24.201.185.125	1	1	1	1

Destinations receiving this attack signature

Destinations	# Alerts (sig)	# Alerts (total)	# Srcs (sig)	# Srcs (total)
192.168.1.6	680	7770	204	624

SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:03:48 2003