"szDescr"="This event indicates that a remote user has attempted to connect to a dagger 1.4.0 trojan server running on Windows. This connection attempt may indicate an existing compromise. The target server should be checked for infection."
"RGBValue"=dword:000000ff
"bFilterBasedAlarm"=dword:00000001
"szFolder"="Hack Filters"
[HKEY_LOCAL_MACHINE\SOFTWARE\Network Instruments\Observer\Filters\(Hack) Net BUS 1]
"szDescr"="This event may indicate that the Netbus remote administration tool is operating on the server. This legitimate administration tool is often used by attackers as a trojan. "
"RGBValue"=dword:000000ff
"bFilterBasedAlarm"=dword:00000001
"szFolder"="Hack Filters"
[HKEY_LOCAL_MACHINE\SOFTWARE\Network Instruments\Observer\Filters\(Hack) Net BUS 2]
"szDescr"="This event may indicate that the Netbus remote administration tool is operating on the server. This legitimate administration tool is often used by attackers as a trojan. "
"RGBValue"=dword:000000ff
"bFilterBasedAlarm"=dword:00000001
"szFolder"="Hack Filters"
[HKEY_LOCAL_MACHINE\SOFTWARE\Network Instruments\Observer\Filters\(Hack) Sub Seven 1]
"szDescr"="This event indicates that a known trojan may be operating on the host. This is not a scan or probe, but response to a connection request. TCP port 27374 is the default port used by SubSeven-2.1/2.2-Gold. "
"szDescr"="This event indicats that an attempt has been made to communicate with a possible ACKcmdS Trojan Server on the target machine using the ACKcmdC Client program . This uses ACK segments to communicate through some firewalls."
"szDescr"="This filter captures the Eicar.Com file which is used to test Anti Virus programs. Eicar is NOT a real virus, but a small file that most anti virus programs see as a virus for testing purposes."
"szDescr"="The sending machine may be infected with the Korgo.x virus. It may be attempting to connect to a remote server in order to update the virus code."
"szDescr"="The sending machine may be infected with the MyDoom - Novarg - Shimg virus. Also captures someone downloading the virus executable from p2p programs like Kazaa"
"szDescr"="The sending machine may be infected with the MyDoom.bb/bc/bd or be varient. It is attempting to download the BackDoor-CEB.f trojan from a known website that contains the varient."
"szDescr"="This filter captures the Sasser Worm sending its data to another machine in order to infect the other system. The sending station is already infected."
"szDescr"="The sending machine may be infected with the Sasser.b Worm which may be sending its data to another machine in order to infect the other system."
"szDescr"="The sending machine may be infected with the Sasser.e Worm which may be sending its data to another machine in order to infect the other system."
