A Bigger Botnet

[thehorse13]

"Somehow, this thing is evading the canonical defense techniques that the enterprises use," such as intrusion detection systems and intrusion prevention systems, he said. "It should be caught by IDSes, IPSes and firewalls and it's not."

First of all, I'd like to formally say, "I told you so." LOL. All of these products are useless in today's threat landscape.

Second, the reason these things aren't catching the traffic is because it's inserted into "normal" traffic streams via customized protocol sets developed by the developer(s). Is anyone truly surprised by this?

Morganlefay, see here:
http://isc.sans.org/diary.html?storyid=4256&rss

While no headers are available (yet) you can look for this 8 byte payload data string which is reported to be fixed (perhaps a session string) for this bot:

4d f4 d5 17 dc 04 c1 2e

Of course this will be process intensive at large organizations. I've currently setup a packet filter rule looking for the above string. Nothing has come across my drag net....yet.

Or you can grab some rules that others have written here:
http://doc.emergingthreats.net/bin/view/Main/OdeRoor

--TH13