# Copyright 2001-2019 Sourcefire, Inc. All Rights Reserved. # # This file contains (i) proprietary rules that were created, tested and certified by # Sourcefire, Inc. (the "VRT Certified Rules") that are distributed under the VRT # Certified Rules License Agreement (v 2.0), and (ii) rules that were created by # Sourcefire and other third parties (the "GPL Rules") that are distributed under the # GNU General Public License (GPL), v2. # # The VRT Certified Rules are owned by Sourcefire, Inc. The GPL Rules were created # by Sourcefire and other third parties. The GPL Rules created by Sourcefire are # owned by Sourcefire, Inc., and the GPL Rules not created by Sourcefire are owned by # their respective creators. Please see http://www.snort.org/snort/snort-team/ for a # list of third party owners and their respective copyrights. # # In order to determine what rules are VRT Certified Rules or GPL Rules, please refer # to the VRT Certified Rules License Agreement (v2.0). # #---------------- # FILE-PDF RULES #---------------- alert tcp $EXTERNAL_NET any -> $HOME_NET 25 (msg:"FILE-PDF Microsoft Edge PDF Builder out of bounds read attempt"; flow:to_server,established; file_data; content:"|34 1A 8D 29 34 41 CE 48 24 48 FE 1F C1 5B B7 1D 89 C6 FA E2 FD 2D 09 85 A0 9D 32 DE 17 8B 46 5A|"; fast_pattern:only; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service smtp; reference:cve,2017-0023; reference:url,technet.microsoft.com/en-us/security/bulletin/MS17-009; classtype:attempted-user; sid:41602; rev:4;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Microsoft Edge PDF Builder out of bounds read attempt"; flow:to_client,established; file_data; content:"|34 1A 8D 29 34 41 CE 48 24 48 FE 1F C1 5B B7 1D 89 C6 FA E2 FD 2D 09 85 A0 9D 32 DE 17 8B 46 5A|"; fast_pattern:only; metadata:policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:cve,2017-0023; reference:url,technet.microsoft.com/en-us/security/bulletin/MS17-009; classtype:attempted-user; sid:41601; rev:4;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader/Acrobat Pro CFF font parsing heap overflow attempt"; flow:to_client,established; file_data; content:"6SC.Pseudo.Font.1|00 00 01 01 87|T|01 01 FF|T|00|V|02 00 01|"; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2010-1241; classtype:attempted-user; sid:16546; rev:11;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Possible Adobe Acrobat Reader ActionScript byte_array heap spray attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"ByteArray"; nocase; content:"|04 0C 0C 0C 0C|"; within:100; metadata:service ftp-data, service http, service imap, service pop3; reference:bugtraq,35759; reference:cve,2009-1862; reference:url,blogs.adobe.com/psirt/2009/07/potential_adobe_reader_and_fla.html; classtype:attempted-user; sid:15728; rev:14;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader CoolType.dll remote memory corruption denial of service attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|78 9C C5 97 4D 4B C4 30 10 86 EF 85 FE 87 39 26 87 CD 26 33|"; fast_pattern:only; content:"|AC 6D EE D5 DD 46 CF 88 D4 87 76 9D 7A D7 B3 A0 40 63 A7 6E F4 2C AA 27 8D A4 5E 35 59 B5 9B E3|"; metadata:service ftp-data, service http, service imap, service pop3; reference:bugtraq,41130; reference:cve,2010-2204; classtype:attempted-dos; sid:16801; rev:12;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader JPEG2k uninitialized QCC memory corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|12 12 E0 0F 12 12 E0 0F 12 12 FF|]|00 16|LL"; content:"setTimeout|28 22|doSpray|28 29 22|,2500|29 3B|"; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2009-2995; classtype:attempted-user; sid:16323; rev:12;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader U3D progressive mesh continuation pointer overwrite attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"<|FF FF FF C5 00 00 00 00 00 00 00 05 00|Box01|00 00 00 00 00 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01|k|01 00 00|k|01 00 00 D5 02 00 00 BF 85|]K|00|"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2009-2998; classtype:attempted-user; sid:16173; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader U3D line set heap corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"7|FF FF FF|h|00 00 00 00 00 00 00 06 00|Box_92|00 00 00 00 00 00 00 00 04 05 00 00| |00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|AAAA"; fast_pattern:only; metadata:policy max-detect-ips drop, service ftp-data, service http, service imap, service pop3; reference:cve,2009-2997; classtype:attempted-user; sid:16172; rev:10;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader collab.addStateModel remote corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"Collab.addStateModel"; nocase; content:"cname"; nocase; content:"00"; within:15; distance:2; nocase; pcre:"/Collab\x2EaddStateModel\s*\x28\s*\x7B.*cName\s*\x3A\s*\x22(\x22|\x5Cx00)/smi"; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2009-2996; classtype:attempted-user; sid:16176; rev:12;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader collab.removeStateModel denial of service attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|5C|x00|5C|x00|5C|x00|5C|x00"; nocase; content:"Collab.removeStateModel"; nocase; pcre:"/var\s*(\w+)\s*\x3D\s*\x22\x5Cx00\x5Cx00\x5Cx00\x5Cx00.*\x22.*Collab\x2EremoveStateModel\s*\x28\s*\1.*\x29/smi"; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2009-2988; classtype:attempted-user; sid:16175; rev:13;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader U3D progressive mesh continuation off by one index attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"<|FF FF FF C5 00 00 00 00 00 00 00 05 00|Box01|00 00 00 00 00 00 00 00 08 00 00 00|ABCD"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2009-3458; classtype:attempted-user; sid:16174; rev:9;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF pdf file sent via email"; flow:to_server,established; content:"JVBERi0x"; flowbits:set,email.pdf; flowbits:noalert; metadata:service smtp; classtype:policy-violation; sid:15361; rev:5;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader start-of-file alternate header obfuscation"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"%!PS-Adobe-"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; reference:url,attack.mitre.org/techniques/T1027; reference:url,attack.mitre.org/techniques/T1140; reference:url,www.adobe.com/devnet/acrobat/pdfs/pdf_reference_1-7.pdf; classtype:misc-activity; sid:16354; rev:16;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader alternate file magic obfuscation"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"%COS-0.2"; depth:1032; content:"PDF-"; distance:0; metadata:service ftp-data, service http, service imap, service pop3; reference:url,attack.mitre.org/techniques/T1027; reference:url,attack.mitre.org/techniques/T1140; reference:url,www.adobe.com/devnet/acrobat/pdfs/pdf_reference_1-7.pdf; classtype:misc-activity; sid:16390; rev:15;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF PDF with click-to-launch executable"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"obj"; nocase; content:"<<"; within:4; content:"/Launch"; within:100; fast_pattern; content:"/F"; pcre:"/\/F[^\/>]+\.(exe|dll|swf)/smi"; metadata:policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:cve,2010-1240; reference:url,blog.didierstevens.com/2010/03/29/escape-from-pdf/; reference:url,blogs.adobe.com/adobereader/2010/04/didier_stevens_launch_function.html; classtype:misc-activity; sid:16523; rev:12;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF PDF file with embedded PDF object"; flow:to_client,established; file_data; content:"EmbeddedFile"; nocase; content:"3C7064663E"; distance:0; nocase; content:"3C2F7064663E"; distance:0; nocase; metadata:service ftp-data, service http, service imap, service pop3; reference:url,www.adobe.com/devnet/acrobat/javascript.html; classtype:policy-violation; sid:18684; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF PDF with click-to-launch executable"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"/F"; content:"/Mac"; fast_pattern; nocase; pcre:"/\x2fF\s*(<<|)\s*\x2fMac\s*\x28/smi"; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2010-1240; reference:url,blog.didierstevens.com/2010/03/29/escape-from-pdf/; reference:url,blogs.adobe.com/adobereader/2010/04/didier_stevens_launch_function.html; classtype:misc-activity; sid:19648; rev:12;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF PDF with click-to-launch executable"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"/F"; content:"/Unix"; fast_pattern; nocase; pcre:"/\x2fF\s*(<<|)\s*\x2fUnix\s*\x28/smi"; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2010-1240; reference:url,blog.didierstevens.com/2010/03/29/escape-from-pdf/; reference:url,blogs.adobe.com/adobereader/2010/04/didier_stevens_launch_function.html; classtype:misc-activity; sid:19647; rev:12;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF PDF with click-to-launch executable"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"/F"; content:"/DOS"; fast_pattern; nocase; pcre:"/\x2fF\s*(<<|)\s*\x2fDOS\s*\x28/smi"; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2010-1240; reference:url,blog.didierstevens.com/2010/03/29/escape-from-pdf/; reference:url,blogs.adobe.com/adobereader/2010/04/didier_stevens_launch_function.html; classtype:misc-activity; sid:19646; rev:12;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF attempted download of a PDF with embedded PICT image"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"PICT"; fast_pattern:only; content:"stream"; nocase; pcre:"/^[^\x0A]*?.{88}PICT/mR"; metadata:service ftp-data, service http, service imap, service pop3; classtype:policy-violation; sid:20146; rev:8;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF attempted download of a PDF with embedded PCX image"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"stream"; nocase; pcre:"/^[^\x0A]*?\x0A[\x00\x02\x03\x05][\x00\x01][\x01\x04\x08\x24].{60}\x00.{5}\x00{58}/mR"; metadata:service ftp-data, service http, service imap, service pop3; classtype:policy-violation; sid:20151; rev:8;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader doc.export arbitrary file write attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:".export"; nocase; pcre:"/\x2eexport(AsFDF|AsText|AsXFDF|DataObject|XFAData)\x28[^\x2c\x29]*\x2c[^\x2c\x29]*\x2c[^\x29]+\x2eexe/smi"; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2009-2993; classtype:attempted-user; sid:16324; rev:11;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader embedded BMP colors used integer overflow attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"stream"; nocase; content:"BM"; within:20; content:"|00 00 00 00|"; within:4; distance:4; content:"|28 00 00 00|"; within:4; distance:4; byte_test:4,>,0x1FFFFFFF,28,relative,little; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-4373; reference:url,www.adobe.com/support/security/bulletins/apsb12-01.html; classtype:attempted-user; sid:20921; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader embedded BMP bit count integer overflow attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"stream"; nocase; content:"BM"; within:20; content:"|00 00 00 00|"; within:4; distance:4; content:"|28 00 00 00|"; within:4; distance:4; pcre:"/^.{10}([^\x01\x04\x08\x0F\x10\x18\x20].|.[^\x00]).{16}\x00\x00\x00\x00/R"; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-4373; reference:url,www.adobe.com/support/security/bulletins/apsb12-01.html; classtype:attempted-user; sid:20922; rev:10;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader embedded BMP bit count integer overflow attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"stream"; nocase; content:"BM"; within:20; content:"|00 00 00 00|"; within:4; distance:4; content:"|0C 00 00 00|"; within:4; distance:4; pcre:"/^.{6}([^\x01\x04\x08\x0F\x10\x18\x20].|.[^\x00])/R"; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-4373; reference:url,www.adobe.com/support/security/bulletins/apsb12-01.html; classtype:attempted-user; sid:20923; rev:10;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader PDF subroutine pointer attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|90 90 90 E8 00 00 00 00 5B 90 66 C7 03 EB FE|"; fast_pattern:only; content:"RICN"; content:"AR07"; within:6; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2006-5857; classtype:attempted-user; sid:21765; rev:6;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Plugin Universal cross-site scripting attempt"; flow:to_client,established; file_data; content:".pdf|23|"; fast_pattern:only; pcre:"/\x2Epdf\x23[^\r\n]+\x3Djavascript\x3A/smi"; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2007-0045; reference:url,isc.sans.org/diary.php?storyid=1999; classtype:misc-attack; sid:9842; rev:11;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader JPX malformed code-block width memory corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"JPXDecode|0A 3E 3E 0A|stream"; fast_pattern:only; content:"|6A 50 20 20|"; content:"|FF 4F FF 51|"; distance:0; byte_jump:2,36,relative,multiplier 3,big; content:"|FF 52 00 0C|"; within:4; byte_test:1,>,16,5,relative; metadata:service ftp-data, service http, service imap, service pop3; reference:bugtraq,35274; reference:bugtraq,35289; reference:bugtraq,35295; reference:cve,2009-1859; reference:cve,2009-1861; reference:url,www.adobe.com/support/security/bulletins/apsb09-07.html; classtype:attempted-user; sid:15562; rev:13;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Xpdf Splash DrawImage integer overflow attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"/Subtype"; content:"/Image"; within:20; content:"/FlateDecode"; pcre:"/\x3C{2}(?=[^\x3E]*\x2F(Height|Width)\s*\d{6})(?=[^\x3E]*\x2FFlateDecode)[^\x3E]*\x2FSubtype\s*\x2FImage/"; metadata:service ftp-data, service http, service imap, service pop3; reference:bugtraq,36703; reference:cve,2009-3604; classtype:attempted-user; sid:16355; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader shell metacharacter code execution attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"begin|20|"; depth:6; pcre:"/^begin\s\d+?\s[^\x20\x0d\x0a]*?\x60[^\x20\x0d\x0a]*?\x60/m"; metadata:service ftp-data, service http, service imap, service pop3; reference:bugtraq,10931; reference:cve,2004-0630; classtype:attempted-user; sid:18527; rev:12;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader malicious language.engtesselate.ln file download attempt"; flow:to_client,established; flowbits:isset,file.engtesselate; file_data; content:"2="; isdataat:255,relative; content:!"|0A|"; within:255; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2095; reference:url,www.adobe.com/support/security/bulletins/apsb11-16.html; classtype:attempted-user; sid:19253; rev:11;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader CIDFont dictionary glyph width corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|2F|Subtype|20 2F|CIDFontType2"; content:"|2F|W|20 5B|0|20 5B|778|20|0|5D 20|2|20|3|20|250|20|4|20 5B|333|20|408|5D|"; distance:0; content:"|5B|556|20|722|20|667|20|556|20|611|5D|"; distance:0; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2105; reference:url,www.adobe.com/support/security/bulletins/apsb11-16.html; classtype:attempted-user; sid:19251; rev:11;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader javascript in PDF go-to actions exploit attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"/S /GoToR"; content:"/F |28|javascript:"; distance:0; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2101; reference:url,www.adobe.com/support/security/bulletins/apsb11-16.html; classtype:attempted-user; sid:19254; rev:10;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader sandbox disable attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|B6 84 05 8D 81 80 08 FF E3 A1 87 05 EA 88 A8 83 05 DE 8B B6 04 EA 80 80 08 D6 8B B6 04 99 D0 81 D0 06 EA 80 08 EA 80 A8 03 81 8A B6 04 D0 80 80|"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-1353; reference:url,www.adobe.com/support/security/bulletins/apsb11-24.html; classtype:attempted-user; sid:20162; rev:10;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader embedded IFF file RGBA chunk memory corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"Subtype|2F|image"; nocase; content:"iff"; within:7; content:"TBHD"; distance:0; byte_extract:4,0,tbhd_width,relative; content:"RGBA"; distance:0; byte_test:2,>,tbhd_width,2,relative; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2436; reference:url,www.adobe.com/support/security/bulletins/apsb11-24.html; classtype:attempted-user; sid:20149; rev:10;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat embedded TIFF DotRange structure memory corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"Subtype|2F|image"; nocase; content:"tiff"; within:7; content:"II|2A 00|"; within:250; content:"|50 01|"; distance:0; byte_test:2,<,14,0,relative,little; byte_test:2,>,8,2,relative,little; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2432; reference:url,www.adobe.com/support/security/bulletins/apsb11-24.html; classtype:attempted-user; sid:20144; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader getCosObj file overwrite attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:".write|28|"; nocase; content:".getCosObj|28|"; distance:0; nocase; pcre:"/([A-Z\d_]+)\.write\x28.*?\1\.getCosObj\x28/smi"; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2442; reference:url,www.adobe.com/support/security/bulletins/apsb11-24.html; classtype:attempted-user; sid:20156; rev:10;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader field flags exploit attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"/Ff "; byte_test:10,!&,0x80000000,0,string,relative; byte_test:10,&,0x00100000,0,string,relative; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-0589; reference:url,www.adobe.com/support/security/bulletins/apsb11-03.html; classtype:attempted-user; sid:18419; rev:13;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat XML entity escape attempt"; flow:to_client,established; file_data; content:"<|21|ENTITY"; nocase; content:"SYSTEM"; within:50; nocase; content:"http|3A 2F 2F|"; within:50; nocase; content:"http|3A 2F 2F|"; within:500; nocase; pcre:"/<\x21ENTITY[^>]+SYSTEM[^>]+http\x3A\x2F\x2F[^>\s]+http\x3A\x2F\x2F/smi"; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-0604; reference:url,www.adobe.com/support/security/bulletins/apsb11-03.html; classtype:attempted-user; sid:18456; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader oversized object width attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"/width"; nocase; byte_test:7,>,1000000,1,relative,string; content:"/DCTDecode"; distance:0; nocase; pcre:"/\x2fwidth[^\x3e]+\x2fDCTDecode/smi"; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2009-2980; classtype:attempted-user; sid:16322; rev:12;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader U3D CLODMeshContinuation code execution attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"U3D|00|"; content:"1|FF FF FF|"; distance:0; byte_jump:2,8,relative,little; byte_test:4,<,16777216,12,relative,little; content:"<|FF FF FF|"; distance:0; byte_jump:2,8,relative,little; byte_test:4,>,16777215,12,relative,little; metadata:policy max-detect-ips drop, service ftp-data, service http, service imap, service pop3; reference:bugtraq,36665; reference:cve,2009-2990; reference:url,www.adobe.com/support/security/bulletins/apsb09-15.html; classtype:attempted-user; sid:16373; rev:13;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Foxit Reader title overflow attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"/Title"; nocase; pcre:"/^\s*(\x28[^\x29]{538}|\x3c[^\x3e]{538})/Rs"; metadata:service ftp-data, service http, service imap, service pop3; reference:bugtraq,43785; classtype:attempted-user; sid:20445; rev:12;) alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader U3D CLODMeshDeceleration code execution attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"U3D|00|"; content:"|31 FF FF FF|"; distance:0; byte_jump:2,8,relative,little; byte_test:4,>,200,12,relative,little; content:"|3C FF FF FF|"; distance:0; byte_jump:2,8,relative,little; byte_test:4,<,200,12,relative,little; metadata:policy balanced-ips drop, policy connectivity-ips drop, policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:bugtraq,37758; reference:bugtraq,67368; reference:cve,2009-3953; reference:cve,2014-0523; reference:url,helpx.adobe.com/security/products/reader/apsb14-15.html; reference:url,www.adobe.com/support/security/bulletins/apsb10-02.html; classtype:attempted-user; sid:20429; rev:12;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader javascript submitform memory corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"submitForm"; fast_pattern:only; pcre:"/submitForm\s*\x28[^\x3b]+cURL\s*\x3a\s*[\x22\x27]\s*url\s*\x3a\s*(?!https?)[^\x27\x22\x23]*?\x23/ims"; isdataat:50; content:!"bGet"; within:50; nocase; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-4371; reference:url,www.adobe.com/support/security/bulletins/apsb12-01.html; classtype:attempted-user; sid:20998; rev:7;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Foxit Reader malicious pdf file write access"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"createDataObject"; fast_pattern:only; pcre:"/createDataObject\(\s*?[\x22\x27][cdef]\x3A[\x2F\x5C]/i"; metadata:service ftp-data, service http, service imap, service pop3; reference:url,scarybeastsecurity.blogspot.com/2011/03/dangerous-file-write-bug-in-foxit-pdf.html; classtype:attempted-user; sid:21095; rev:5;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat file extension overflow attempt"; flow:to_client,established; content:"Content|2D|Type|3A|"; nocase; http_header; content:"application|2F|pdf"; within:30; fast_pattern; nocase; http_header; file_data; pcre:"/filename\x3d[^\r\n]*\x2e[^\x3b\x3f\x2e\x22\x27\r\n]{18,}[\x22\x27]/Hsmi"; metadata:service ftp-data, service http, service imap, service pop3; reference:bugtraq,10696; reference:cve,2004-0632; classtype:attempted-user; sid:21162; rev:11;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Foxit Reader createDataObject file write attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"createDataObject"; nocase; pcre:"/^\s*\x5C?\x28\s*[\x22\x27][a-z]\x3A[\x2F\x5C]/iR"; metadata:service ftp-data, service http, service imap, service pop3; reference:url,scarybeastsecurity.blogspot.com/2011/03/dangerous-file-write-bug-in-foxit-pdf.html; classtype:attempted-user; sid:21254; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat JavaScript getIcon method buffer overflow attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|55 1E 42 91 74 A1 4A FA 21 C7 DB 53 14 DE DE 9E A4 6A CD ED 29 C7 4E DE 9E BC ED 49 B3 35 11 D6|"; fast_pattern:only; metadata:policy max-detect-ips drop, service ftp-data, service http, service imap, service pop3; reference:bugtraq,34169; reference:cve,2009-0927; classtype:attempted-user; sid:17471; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat JavaScript getIcon method buffer overflow attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|B3 2E 86 F7 BA C8 F4 4A 2B C7 AB 99 E8 6B 72 99 39 40 C7 59 B1 2E C9 D1 AE 0C 6E 39 A8 E5 DC 60|"; fast_pattern:only; metadata:policy max-detect-ips drop, service ftp-data, service http, service imap, service pop3; reference:bugtraq,34169; reference:cve,2009-0927; classtype:attempted-user; sid:17472; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader malformed U3D texture continuation integer overflow attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|5C FF FF FF 0C 00 00 00 00 00 00 00 08 00 54 65 78 74 75|"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2096; reference:url,www.adobe.com/support/security/bulletins/apsb11-16.html; classtype:attempted-user; sid:19248; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat and Adobe Acrobat Reader U3D file include overflow attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"CDF1048AB8979121691236CBF4378433"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2094; reference:url,www.adobe.com/support/security/bulletins/apsb11-16.html; classtype:attempted-user; sid:19250; rev:7;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader ICC ProfileDescriptionTag overflow attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|CE 00 07 00 09 00 12 00 04 00 33 64 65 73 63 00 00 00 00 00|"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2097; reference:url,www.adobe.com/support/security/bulletins/apsb11-16.html; classtype:attempted-user; sid:19255; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat GDI object leak memory corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"f = getAnnotRichMedia|28|"; nocase; content:"f = getAnnotRichMedia|28|"; distance:0; nocase; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2439; reference:url,www.adobe.com/support/security/bulletins/apsb11-24.html; classtype:attempted-user; sid:20152; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader embedded BMP parsing corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|0E 00 00 C4 0E 00 00 00 40 00 00 00 00 00 00 58 58 58 58 58|"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2438; reference:url,www.adobe.com/support/security/bulletins/apsb11-24.html; classtype:attempted-user; sid:20169; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader app.openDoc path vulnerability"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|42 23 5E 24 C2 C4 4C 62 36 B1 98 F8 3D B1 9A D8 40 6C 21 BA 88 DD C4 61 E2 18 71 8A F8 92 F8 8E|"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2431; reference:url,www.adobe.com/support/security/bulletins/apsb11-24.html; classtype:attempted-user; sid:20142; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat embedded JPEG file APP0 chunk memory corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|FF E0 00 10 4A 46 49 46 00 01 02 01 00 48 00 48 00 00|"; content:"|D8 02 28 FF E1 FF E2 02 F9 02 46 03 47 05|"; within:100; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2440; reference:url,www.adobe.com/support/security/bulletins/apsb11-24.html; classtype:attempted-user; sid:20153; rev:10;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader embedded PICT parsing corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"PICT"; content:"|00 02 10 80 CC CC 58 58 58 58|"; within:10; distance:13; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2433; reference:url,www.adobe.com/support/security/bulletins/apsb11-24.html; classtype:attempted-user; sid:20145; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader embedded PICT parsing corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"PICT"; content:"|00 01 41 41 41 01 41 41 41 01|"; within:10; distance:11; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2435; reference:url,www.adobe.com/support/security/bulletins/apsb11-24.html; classtype:attempted-user; sid:20148; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader embedded PICT parsing corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"PICT"; content:"|00 02 E0 80 CC CC 58 58 58 58|"; within:10; distance:13; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2434; reference:url,www.adobe.com/support/security/bulletins/apsb11-24.html; classtype:attempted-user; sid:20147; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader embedded BMP parsing corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|42 00 00 00 28 00 00 00 AB AA AA 0A 40 00 00 00 01|"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2438; reference:url,www.adobe.com/support/security/bulletins/apsb11-24.html; classtype:attempted-user; sid:20171; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader embedded BMP parsing corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|12 0B 00 00 12 0B 00 00 00 01 00 00 00 01 00 00 41 41 41 41 41 41|"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2438; reference:url,www.adobe.com/support/security/bulletins/apsb11-24.html; classtype:attempted-user; sid:20170; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader embedded PCX parsing corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|20 20 20 0A 0A 05 01 08 00 00 00 00 03 00 FF FF 2C 01 2C 01|"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-2437; reference:url,www.adobe.com/support/security/bulletins/apsb11-24.html; classtype:attempted-user; sid:20150; rev:11;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader malformed jpeg2000 superbox attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"/JPXDecode"; content:"|92 6A 70 32 68 00 00 00 16 69 68 64 72 00 00 02 57 00 00 03 20 00 10 07 07 01 00 00 00 03 44 70 63 6C 72 00 20 19 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08 08|"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-0602; reference:url,www.adobe.com/support/security/bulletins/apsb11-03.html; classtype:attempted-user; sid:18455; rev:14;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe JPEG2k uninitialized QCC memory corruption attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|12 12 E0 0F 12 12 E0 0F 12 12 FF|]|00 16|LL"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2009-2994; classtype:attempted-user; sid:16325; rev:12;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader PDF JBIG2 remote code execution attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"%PDF-1."; content:"8 0 obj"; pcre:"/^\s*<<\s*\/([^>#]*#){9}[^>]*>>\s*stream/smR"; content:"xref|0D 0A|0 9|0D 0A|0000000000 65535 f|0D 0A|"; fast_pattern:only; metadata:policy max-detect-ips drop, service ftp-data, service http, service imap, service pop3; reference:bugtraq,33751; reference:cve,2009-0658; classtype:attempted-user; sid:20575; rev:13;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader PRC file MarkupLinkedItem arbitrary code execution attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|5B 1D 3E DD 05 78 4B E6 00 00 00 00 98 67 25 46|"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-4369; reference:url,www.adobe.com/support/security/bulletins/apsb11-30.html; classtype:attempted-user; sid:20802; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader BMP color unused corruption"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"|6D 70 29 3E 3E 0A 65 6E 64 6F 62 6A 0A 32 30 20 30 20 6F 62 6A 0A 3C 3C 2F 53 75 62 74 79 70 65 2F 69 6D 61 67 65 23 32 66 62 6D 70 3E 3E 73 74 72 65 61 6D 0A 42 4D 80 07 00 00 00 00 00 00 76 00 00 00 28 00 00 00 01 00 00 00 01 00 00 00 01|"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-4372; reference:url,www.adobe.com/support/security/bulletins/apsb12-01.html; classtype:attempted-user; sid:20919; rev:6;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF hostile PDF associated with Laik exploit kit"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"%PDF-1."; content:") /CreationDate (D:20110405234628)>>"; fast_pattern:only; metadata:ruleset community, service ftp-data, service http, service imap, service pop3; classtype:trojan-activity; sid:21417; rev:9;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Possible malicious pdf - new pdf exploit"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"NEW PDF EXPLOIT"; metadata:service ftp-data, service http, service imap, service pop3; classtype:attempted-user; sid:21431; rev:8;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Possible unknown malicious PDF"; flow:to_client, established; flowbits:isset, file.pdf; file_data; content:"%PDF-1."; fast_pattern:only; content:"=new Array"; pcre:"/\d+?(.)\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+/R"; metadata:policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:cve,2010-0188; classtype:attempted-user; sid:21429; rev:10;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Possible unknown malicious PDF"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"%PDF-1."; fast_pattern:only; content:"arr=|27|"; pcre:"/\d+?(.)\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+/"; metadata:policy max-detect-ips drop, policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:cve,2010-0188; classtype:attempted-user; sid:21453; rev:7;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Possible malicious pdf detection - qwe123"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"%PDF-1."; content:"qwe123"; distance:0; metadata:service ftp-data, service http, service imap, service pop3; classtype:trojan-activity; sid:21583; rev:8;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF PDF obfuscation attempt"; flow:to_client, established; flowbits:isset,file.pdf; file_data; content:"application/x-javascript"; pcre:"/ $SMTP_SERVERS 25 (msg:"FILE-PDF Adobe Acrobat Reader shell metacharacter code execution attempt"; flow:to_server,established; flowbits:isset,smtp.contenttype.attachment; content:"begin|20|"; pcre:"/^begin\s\d+?\s[^\x20\x0d\x0a]*?\x60[^\x20\x0d\x0a]*?\x60/m"; metadata:service smtp; reference:bugtraq,10931; reference:cve,2004-0630; classtype:attempted-user; sid:18526; rev:5;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader DCT dequantizer memory corruption attempt"; flow:to_client,established; file_data; content:"|FF DB 00 84 00 01 01 01 01 01 01 01 01 01 01 01|"; content:"|FF DA 00 08 01 01 01 06 3F 00 79 4B EA 28 27 1D 16 B6 AA DC 4E 4E 6F 92 38 02 6D CA CE|"; distance:0; metadata:service ftp-data, service http, service imap, service pop3; reference:cve,2011-4370; reference:url,www.adobe.com/support/security/bulletins/apsb12-01.html; classtype:attempted-user; sid:20920; rev:7;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader javascript toolbar button use after free attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"app|2E|removeToolButton"; fast_pattern:only; content:"app|2E|addToolButton"; nocase; pcre:"/stream\s*?app\x2Eaddtoolbutton\x28\x7B[^\x7d]*?\x09cname\x3A\s*?\x22(?P\w+?)[^\x7D]*?\x09cenable\x3A\s*?\x22app\x2Eremovetoolbutton\x28\x27(?P=buttonname)\x27\x29[^\x7D]*?\x7D\x29\x3B\s*?endstream/smi"; metadata:policy security-ips drop, service ftp-data, service http, service imap, service pop3; reference:bugtraq,52949; reference:cve,2012-0775; reference:url,adobe.com/support/security/bulletins/apsb12-08.html; classtype:attempted-user; sid:21881; rev:6;) # alert tcp $HOME_NET any -> $HOME_NET [139,445] (msg:"FILE-PDF Adobe Acrobat Reader msiexec.exe file load exploit attempt"; flow:to_server,established; content:"|FF|SMB|A2 00 00 00 00|"; content:"m|00|s|00|i|00|e|00|x|00|e|00|c|00|.|00|e|00|x|00|e|00 00 00|"; fast_pattern:only; metadata:policy security-ips drop, service netbios-ssn; reference:bugtraq,52952; reference:cve,2012-0776; reference:url,www.adobe.com/support/security/bulletins/apsb12-08.html; classtype:attempted-user; sid:21858; rev:8;) # alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"FILE-PDF Adobe Acrobat Reader msiexec.exe file load exploit attempt"; flow:to_server,established; content:"|2F|msiexec.exe"; fast_pattern:only; http_uri; metadata:policy security-ips drop, service http; reference:bugtraq,52952; reference:cve,2012-0776; reference:url,www.adobe.com/support/security/bulletins/apsb12-08.html; classtype:attempted-user; sid:21859; rev:8;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Possible malicious PDF detection - qweqwe="; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"> $HOME_NET any (msg:"FILE-PDF Unknown malicious PDF - Title"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"/Title (0aktEPbG1LcQ9f6d8l32m7gI5eY4)>>"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; classtype:trojan-activity; sid:23045; rev:3;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Unknown malicious PDF - CreationDate"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"/CreationDate (D:20100829161936"; fast_pattern:only; metadata:service ftp-data, service http, service imap, service pop3; classtype:trojan-activity; sid:23043; rev:3;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF Unknown Malicious PDF - CreationDate"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"< $HOME_NET any (msg:"FILE-PDF Adobe Acrobat Reader XDP encoded download attempt"; flow:to_client,established; flowbits:isset,file.xml; file_data; content:"JVBERi"; fast_pattern:only; content:" $SMTP_SERVERS 25 (msg:"FILE-PDF Adobe Acrobat JavaScript getIcon method buffer overflow attempt"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"|55 1E 42 91 74 A1 4A FA 21 C7 DB 53 14 DE DE 9E A4 6A CD ED 29 C7 4E DE 9E BC ED 49 B3 35 11 D6|"; fast_pattern:only; metadata:policy max-detect-ips drop, service smtp; reference:bugtraq,34169; reference:cve,2009-0927; classtype:attempted-user; sid:23503; rev:4;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF Adobe flash player newfunction memory corruption attempt"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:" (lolol|5C|056swf)"; fast_pattern:only; metadata:policy max-detect-ips drop, service smtp; reference:cve,2010-1297; classtype:attempted-user; sid:23512; rev:5;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF Microsoft Windows kernel-mode drivers core font parsing integer overflow attempt"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"hmtx"; content:"cmap"; content:"hhea"; pcre:"/(cmap|head|hhea|hmtx|maxp|name|OS\x2F2|post).{4}([\x80-\xFF]|.{4}[\x80-\xFF])/s"; metadata:policy max-detect-ips drop, service smtp; reference:cve,2009-2514; reference:cve,2010-2862; reference:url,technet.microsoft.com/en-us/security/bulletin/MS09-065; classtype:attempted-admin; sid:23508; rev:5;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF PDF with click-to-launch executable"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"/F"; content:"/Unix"; fast_pattern; nocase; pcre:"/\x2fF\s*(<<|)\s*\x2fUnix\s*\x28/smi"; metadata:service smtp; reference:cve,2010-1240; reference:url,blog.didierstevens.com/2010/03/29/escape-from-pdf/; reference:url,blogs.adobe.com/adobereader/2010/04/didier_stevens_launch_function.html; classtype:misc-activity; sid:23514; rev:5;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF Possible unknown malicious PDF"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"%PDF-1."; fast_pattern:only; content:"arr=|27|"; pcre:"/\d+?(.)\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+/"; metadata:policy max-detect-ips drop, policy security-ips drop, service smtp; reference:cve,2010-0188; classtype:attempted-user; sid:23520; rev:5;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF Adobe Acrobat Reader libtiff TIFFFetchShortPair stack buffer overflow attempt"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"stream|0A 78 9C ED 5B 49 73 E2 38 14 BE F7 AF 70 79 6E C3 34 62 87 A4 42 BA C4 36 90 C4 01 C2 9A 5C BA 84 2D 1B 07 DB 32 96 1C 03 BF 7E 24 2F 6C D3 3D 9D C3 54 4D 4D 95 5C F5 81 DE|"; metadata:policy max-detect-ips drop, policy security-ips drop, service smtp; reference:cve,2006-3459; reference:cve,2010-0188; classtype:attempted-user; sid:23518; rev:5;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF Adobe Acrobat Reader libtiff TIFFFetchShortPair stack buffer overflow attempt"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"stream|0A 78 9C ED 5B 5B 6F E2 38 14 7E EF AF 88 B2 6F CB 0E E6 0E AD 0A 23 73 5B 68 9B 02 E5 DA BE 8C 4C E2 04 97 24 0E B1 D3 00 BF 7E ED 24 B4 94 99 DD 19 69 1F 56 5A 39 D2 07 E7 F6 1D 1F DB 71 9E 7C|"; metadata:policy max-detect-ips drop, policy security-ips drop, service smtp; reference:cve,2006-3459; reference:cve,2010-0188; classtype:attempted-user; sid:23517; rev:5;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF Adobe Acrobat Reader malformed TIFF remote code execution attempt"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"|EB|/|ED|Z|B9|qX|F4 D8|C|F5|a|BF|+|0D 8C D2 F3 DD|*|EE 09|W|B1 B3 9B|P|EB AD D1 B3 07 A0|4|D8|m|7C 7F EB B5 EF|j|E8 F5|m[+t|8F 7C BC|f|BB 86|ql|F7 C0 C3 E8|"; metadata:policy max-detect-ips drop, policy security-ips drop, service smtp; reference:cve,2010-0188; reference:url,www.adobe.com/support/security/bulletins/apsb10-07.html; classtype:attempted-user; sid:23524; rev:5;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF PDF with click-to-launch executable"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"/F"; content:"/Mac"; fast_pattern; nocase; pcre:"/\x2fF\s*(<<|)\s*\x2fMac\s*\x28/smi"; metadata:service smtp; reference:cve,2010-1240; reference:url,blog.didierstevens.com/2010/03/29/escape-from-pdf/; reference:url,blogs.adobe.com/adobereader/2010/04/didier_stevens_launch_function.html; classtype:misc-activity; sid:23513; rev:5;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF Adobe Acrobat Reader media.newPlayer memory corruption attempt"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"/S/JavaScript"; content:"this.media.newPlayer"; pcre:"/^\x5C?\x28null\x5C?\x29/R"; metadata:policy max-detect-ips drop, service smtp; reference:bugtraq,37331; reference:cve,2009-4324; classtype:attempted-user; sid:23506; rev:5;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF Adobe Acrobat Reader compressed media.newPlayer memory corruption attempt"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"&|EA A7 7C 9A 1D C4 1C FE|&|7F|"; fast_pattern:only; metadata:policy max-detect-ips drop, service smtp; reference:cve,2009-4324; classtype:attempted-user; sid:23505; rev:5;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF Adobe Acrobat Reader File containing Flash use-after-free attack attempt"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"|3C 3C 2F 46 69 6C 74 65 72 2F 46 6C 61 74 65 44 65 63 6F 64 65 2F 46 69 72 73 74 20 39 39 2F 4C 65 6E 67 74 68 20 35 31 31 2F 4E 20 31 35 2F 54 79 70 65 2F 4F 62 6A 53 74 6D 3E 3E 73 74 72 65 61 6D 0D 0A 68 DE 6C 52 DB 6E E2 30|"; fast_pattern:only; metadata:policy max-detect-ips drop, service smtp; reference:cve,2010-1297; classtype:attempted-user; sid:23510; rev:7;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF Adobe Acrobat JavaScript getIcon method buffer overflow attempt"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"|B3 2E 86 F7 BA C8 F4 4A 2B C7 AB 99 E8 6B 72 99 39 40 C7 59 B1 2E C9 D1 AE 0C 6E 39 A8 E5 DC 60|"; fast_pattern:only; metadata:policy max-detect-ips drop, service smtp; reference:bugtraq,34169; reference:cve,2009-0927; classtype:attempted-user; sid:23502; rev:4;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF PDF with click-to-launch executable"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"obj"; nocase; content:"<<"; within:4; content:"/Launch"; within:100; fast_pattern; content:"/F"; pcre:"/\/F[^\/>]+\.(exe|dll|swf)/smi"; metadata:service smtp; reference:cve,2010-1240; reference:url,blog.didierstevens.com/2010/03/29/escape-from-pdf/; reference:url,blogs.adobe.com/adobereader/2010/04/didier_stevens_launch_function.html; classtype:misc-activity; sid:23516; rev:6;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF Adobe Acrobat Reader malformed TIFF remote code execution attempt"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"jNLjwFWnTvuP9HG9OL+q916q915//n $SMTP_SERVERS 25 (msg:"FILE-PDF Adobe Acrobat Reader javascript getIcon method buffer overflow attempt"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"Collab.getIcon"; fast_pattern:only; pcre:!"/Collab\.getIcon[^\x28]*?\x28\s*([\x22\x27])[^\1]{1,256}\1\s*\x29/smi"; metadata:policy max-detect-ips drop, service smtp; reference:bugtraq,34169; reference:cve,2009-0927; classtype:attempted-user; sid:23501; rev:6;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF Adobe Acrobat Reader spell.customDictionaryOpen exploit attempt"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"spell.customDictionaryOpen|5C|(0,dict|5C|)"; fast_pattern:only; metadata:policy max-detect-ips drop, service smtp; reference:bugtraq,34740; reference:cve,2009-1493; classtype:attempted-user; sid:23500; rev:5;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF Adobe Acrobat Reader authplay.dll vulnerability exploit attempt"; flow:to_server,established; file_data; content:"|43 57 53 09 A2 D2 00 00 78 9C EC BD 79 7C 54 C5 D2 37 DE 7D|"; isdataat:316,relative; content:"|CF E7 77 BC EB 19 53 BF 99 F7 7C FB B8 D4 4B FA 7C EE E7 AC C7 83 AD 58 D8 F3 35 8B A5 1E B4 67 4D EA 3F EE 9E 3F 79 C9 AB ED 63 B6 F4 58 7A 57|"; within:48; distance:316; metadata:policy max-detect-ips drop, service smtp; reference:bugtraq,40586; reference:cve,2010-1297; classtype:attempted-user; sid:23511; rev:7;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF Possible unknown malicious PDF"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"%PDF-1."; fast_pattern:only; content:"new Array"; pcre:"/\d+?(.)\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+\1\d+/"; metadata:policy max-detect-ips drop, policy security-ips drop, service smtp; reference:cve,2010-0188; classtype:attempted-user; sid:23521; rev:5;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF Adobe Acrobat Reader malformed Richmedia annotation exploit attempt"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"/Subtype/RichMedia"; fast_pattern:only; content:"/Annot"; pcre:"/\/Rect\s*\[[^\]]*\./"; metadata:policy max-detect-ips drop, service smtp; reference:cve,2010-0197; reference:cve,2010-1297; classtype:attempted-admin; sid:23509; rev:5;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF PDF with click-to-launch executable"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"/F"; content:"/DOS"; fast_pattern; nocase; pcre:"/\x2fF\s*(<<|)\s*\x2fDOS\s*\x28/smi"; metadata:service smtp; reference:cve,2010-1240; reference:url,blog.didierstevens.com/2010/03/29/escape-from-pdf/; reference:url,blogs.adobe.com/adobereader/2010/04/didier_stevens_launch_function.html; classtype:misc-activity; sid:23515; rev:5;) # alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 (msg:"FILE-PDF Adobe Acrobat Reader malicious TIFF remote code execution attempt"; flow:to_server,established; flowbits:isset,file.pdf; file_data; content:"|3C 3C 2F 23 34 36 23 36 39 6C 23 37 34 23 36 35 23 37 32 2F|"; content:"stream|0D 0A 78 9C A5 7B|"; nocase; content:"|93 A3|"; within:2; distance:1; content:"|B6 E6 7B FF 8A|"; within:5; distance:1; content:"|B7|"; within:1; distance:2; metadata:policy max-detect-ips drop, policy security-ips drop, service smtp; reference:cve,2010-0188; reference:url,www.securityfocus.com/bid/38195/exploit; classtype:attempted-user; sid:23522; rev:5;) # alert tcp $EXTERNAL_NET $FILE_DATA_PORTS -> $HOME_NET any (msg:"FILE-PDF JavaScript contained in an xml template embedded in a pdf attempt"; flow:to_client,established; flowbits:isset,file.pdf; file_data; content:"