Symantec™ Security Gateways Reference Guide - Sawmill

380 IDS eventsSuspicious activityHTTP Computrace ActiveBase Event:Details:Response:Affected:HTTP_COMPUTRACE_ACTIVEHTTP traffic characteristic of a Computrace transmission were detected. Computrace is a computertracking service used to monitor and track physical assets (for example, laptops).Location and audit of client is recommended.No specific targets.False Positives: None known.Referenceswww.computrace.comHTTP fileexists.cfm AccessBase Event:Details:Response:Affected:HTTP_FILEEXISTS_CFM_ACCESSAn attempt to access the fileexists.cfm file was detected. This script may reveal information aboutrestricted files on the Web server.Location and audit of client and server is recommended.ColdFusion Server 4.0x.False Positives: None known.ReferencesHTTP SpecificationsHTTP FrontPage Admin ProbeBase Event:Details:Response:Affected:HTTP_FRONTPAGE_ADMIN_PROBEAn attempt to access the administrators.pwd file was detected. This file contains encryptedpasswords and may be used to compromise the system.Location and audit of client and server is recommended.Microsoft FrontPage.False Positives: None known.ReferencesHTTP SpecificationsHTTP High-Bit ASCIIBase Event:Details:HTTP_BAD_REQURL5_HIGH_ASCIITraffic that violates the HTTP RFC was detected. This is likely the result of a Web browser that doesnot conform to the HTTP standard sending high-bit ASCII characters (possibly non-Englishfilenames) without encoding them with UTF-8.