Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1 Administration Manual page 983

SMTP:EXT:DOT-URL
SMTP:EXT:DOT-VB
SMTP:EXT:DOT-VBS
SMTP:EXT:DOT-WMF
SMTP:EXT:DOT-WSC
SMTP:EXT:DOT-WSF
SMTP:EXT:DOT-WSH
SMTP:EXT:JOB
Copyright © 2010, Juniper Networks, Inc.
This signature detects e-mail attachments with the
extension .url sent via SMTP. This may indicate an incoming
e-mail virus. .URLs (Internet Shortcut) contain a link to a
web location. Attackers may create a malicious shortcut,
tricking the user into executing the file and send the user to
a malicious website.
This signature detects e-mail attachments with the
extension .vb sent via SMTP. This may indicate an incoming
e-mail virus. .VBs (VBScript File) contain scripts. Attackers
may create malicious scripts, tricking the user into executing
the file and infecting the system.
This signature detects e-mail attachments with the
extension '.vbs' sent via SMTP. This may indicate an incoming
e-mail virus. VBSs (Visual Basic files) contain one or more
executable scripts. Attackers may create malicious VB files,
tricking the user into executing the file and infecting the
system.
This signature detects metafiles (files with .emf or .wmf
extensions) in an e-mail attachment. Some versions of
Microsoft Windows produce boundary errors when
processing metafiles, enabling attackers to create a denial
of service (DoS) and execute arbitrary code.
This signature detects e-mail attachments with the
extension .wsc sent via SMTP. This may indicate an incoming
e-mail virus. .WSCs (Windows Script Component) contain
scripts. Attackers may create malicious scripts, tricking the
user into executing the file and infecting the system.
This signature detects e-mail attachments with the
extension .wsf sent via SMTP. This may indicate an incoming
e-mail virus. .WSFs (Windows Script File) contain scripts.
Attackers may create malicious scripts, tricking the user into
executing the file and infecting the system.
This signature detects e-mail attachments with the
extension .wsh sent via SMTP. This may indicate an incoming
e-mail virus. .WSHs (Windows Script Host Settings File)
contain configuration parameters. Attackers may create
malicious configurations, tricking the user into executing the
file and infecting the system.
This signature detects an attached Microsoft Task Scheduler
(.job) file. Opening a malicious .job file in Task Scheduler
may allow for arbitrary code execution, leading to system
compromise. This vulnerability is present in Microsoft
Windows 2000 Service Pack 2 and later. It is also present
in Microsoft Windows XP Service Pack 1.
Appendix E: Log Entries
low sos5.1.0
medium sos5.1.0
medium sos5.1.0
info sos5.1.0
medium sos5.1.0
medium sos5.1.0
medium sos5.1.0
medium sos5.1.0
933