Subject : "Flame" (worm, trojan, toolkit) activity

[pradnaga]

The Cisco IPS Signature Team is currently researching this threat and will update the forum in the next 24 hours with signature availability.

Additional details of this threat can be found in the following alerts:

http://tools.cisco.com/security/center/viewAlert.x?alertId=26018

http://tools.cisco.com/security/center/viewAlert.x?alertId=26017

[pradnaga]

We are officially releasing the Flame signature in Tuesday’s ( June 5^th ) release.  We are doing further fidelity tests over the weekend, but if you wish to apply this signature early, here is the signature as a custom.

service-http

header-regex  [uU][Ss][Ee][Rr][-][aA][Gg][Ee][Nn][Tt][:]\x20Mozilla\x2f4[.]0\x20[(]compatible[;]\x20MSIE\x206[.]0[;]\x20Windows\x20NT\x205[.]1[;]\x20[.]NET\x20CLR\x201[.]1[.]2150[)]

service-ports #WEBPORTS