Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 997 / 1026

sos5.0.0,
sos5.1.0 medium This signature detects attempts to access a backdoor web
script installed by the Code Red II worm. The Code Red II
worm, like the original Code Red worm, allows attackers to
remotely access the server. WORM:CODERED-2:CMD-BACKDOOR
sos5.0.0,
sos5.1.0 high This signature detects attempts by the CodeRedII worm to
infect a host. The CodeRedII worm, also known as
CodeRed.F, exploits the same vulnerability as the original
CodeRed worm. WORM:CODERED-2:INFECT-ATTEMPT
sos5.0.0,
sos5.1.0 medium This signature detects attempts to access a backdoor web
script installed by the Code Red II worm. The Code Red II
worm, like the original Code Red worm, allows attackers to
remotely access the server. WORM:CODERED-2:ROOT-BACKDOOR
sos5.0.0,
sos5.1.0 medium This signature detects the Bagle worm activity on a host.
After infecting a host, the Bagle worm attempts to contact
a Web server listening post. The Bagle worm, which affects
Microsoft Windows, copies itself to the system directory,
and edits the system registry. The worm uses an e-mail
attachment to propagate itself to other hosts, and has a
hard-coded expiration date (January 28). This signature
could be prone to false positives. WORM:EMAIL:BAGLE-INFECTION
sos5.1.0 medium This signature detects e-mail attachments containing the
W32.Sobig.E worm sent via SMTP. WORM:EMAIL:W32.SOBIG.E
sos5.1.0 high This signature detects the Mimail.A worm attachment in
SMTP traffic. After infecting a Windows-based host, Mimail
sends itself as an attachment to another target using its own
SMTP engine. WORM:MIMAIL:MIMAIL.A
sos5.1.0 high This signature detects the Mimail.L worm attachment in
SMTP traffic. After infecting a Windows-based host, Mimail
sends itself as an attachment to another target using its own
SMTP engine. WORM:MIMAIL:MIMAIL.L
sos5.1.0 high This signature detects the MoFei worm attempting to
propagate to another host. After infecting a host, the MoFei
worm propagates by depositing a copy of itself in a
vulnerable NetBIOS folder on another host. The MoFei worm
is known by several aliases, including W32.Mofei-B and
W32.Femot.D. WORM:MOFEI:MOFEI-B-PROPAGATION
sos5.1.0 critical This signature detects infection attempts of the Windows
RPC Locator Service by the B, C or D variants of the Nachi
worm. This signature only triggers on a successful connect
to an accessible victim. Follow up is strongly suggested. WORM:NACHI:B-C-D-INFECT-ATTEMPT
sos5.0.0,
sos5.1.0 high This signature detects WebDAV overflows, which can
indicate an infection attempt by the Nachi worm (D variant).
Nachi.D, a worm, typically attempts to infect the target host
by exploiting several vulnerabilities. WORM:NACHI:D-WEBDAV-ATK
947 Copyright © 2010, Juniper Networks, Inc.
Appendix E: Log Entries