This is an old revision of the document!

IDS - Emerging Threats - Emerging Threat Categories

Category	Description	Reference
3CORESec	Generated automatically from the 3CORESec team IP block lists; based on malicious activity from their Honeypots.	https://blacklist.3coresec.net/lists/et-open.txt
ActiveX	Protects against attacks and exploits against Microsoft ActiveX controls.
Adware-PUP	Ad tracking and spyware related activity.
Attack Response	Identifies responses indicative of intrusion; such as LMHost file download, presence of certain web banners and the detection of Metasploit Meterpreter kill command.
Botcc (Bot Command and Control)	Autogenerated from several sources of known and confirmed active botnet and other Command and Control (C2) hosts.	https://www.shadowserver.org
Botcc Portgrouped	Similar to the Botcc category but grouped by destination port. Rules grouped by port can offer higher fidelity than those not grouped by port.

References