Wednesday, November 26, 2014

Snort FAQ is now on Snort.org!

When the old Snort.org was still around, we had a section for the FAQ on the documents page. However, contributions to the pages involved sending in suggestions to the admins of the site, via email, and then the changes would be shoved onto the site using regular old html, and then the site had to be pushed.

While this worked, it truly wasn't in the same participatory community that has made many open source projects, including ours, truly inclusive of the community. To counter this, the FAQ was moved to github. Here it allowed forking, editing, pull requests, etc, all in the easy to understand format of Markdown.

Since the move we've had several hundred changes submitted by way of pull request through github, as well as people submitting information the old fashioned way, via the mailing list, or email directly to us. However, the FAQ was on github itself, requiring you to visit an external page off of Snort.org, and then somehow navigate back, if you wanted more content on Snort.org such as other documentation.  

We found this experience to be cumbersome and downright awkward. The user experience was bad, and while no one really complained a great deal, we thought we could do better. 

So now, the FAQ is back on Snort.org. While the content is rendered seamlessly on the page, the meat of the information is actually pulled from Github. This allows the best of both worlds, to allow the user experience of github and allow forks, pulls, etc, the content is now beautifully rendered on Snort.org, providing a much better experience. 

We'd like the community to participate, to create pages, update FAQs, and provide content that you believe would help the Snort community.  You may do so by going to Snort's github page, and either forking, making edits, and submitting back to us, or creating a branch and submitting back to us. We'll review the content for integrity and to ensure it is correct, so we don't have bad, incorrect, or mis-information out there. 

The intent is to make Snort.org, truly the home, of Snort and its ecosystem.  There are around 60 known projects out there that participate or create a project to augment Snort, its input, output, or analysis.  I'd love for every one of those projects to have their own section in the FAQ.

Got an answer to a question that is asked every day on Snort's mailing list?  Create an FAQ page for it, let's point people to that.  Wrote some documentation to help people out with turning off LRO on their NIC?  Submit it!

Let's create a documentation repository.  We'll keep it cleaned up, neat and tidy on the site and make sure we are following all the appropriate rules surrounding content as well as layout in Markdown, etc.  But the content should be living, changing, and updated, and I'd love to have everyone participate.

Check out the Snort.org Documentation page, you'll see on the left hand side the "Snort FAQ".  You'll see all the current pages on the FAQ that people have created over the years, as well as the READMEs that are contained in the doc/ section of the Snort tarball.  Along with the Snort Manual that is also linked from the Documentation page, it should be much simpler to find the answers you need to almost any Snort question.  If you want to participate, head on over to the Github page, create your own branch, and start editing!

I'll be moving some of the one-off documentation that we have on Snort.org to the FAQ in coming days.

For a Markdown primer, head on over to Daring Fireball, the creator of the Markdown format.

A big thanks to our web team here in the Talos Group for making this happen!

Monday, November 24, 2014

Snort Subscriber Rule Set Update for 11/24/2014, Regin Malware

Just released:
Snort Subscriber Rule Set Update for 11/24/2014

We welcome the introduction of the newest rule release from Talos. In this release we introduced 30 new rules and made modifications to 29 additional rules.

There were no changes made to the snort.conf in this release.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:

Avery Tarasov
32604
32605
32606
32607
32608

Talos's rule release:
The VRT has added and modified multiple rules in the blacklist, browser-plugins, exploit-kit, file-identify, file-office, file-other, malware-cnc, os-windows, policy-other and server-webapp rule sets to provide coverage for emerging threats from these technologies. 
New rules to detect attacks from the Regin malware are also included in this release and are identified with GID 1, SIDs 32621 through 32624.


In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Thursday, November 20, 2014

Snort Subscriber Rule Set Update for 11/20/2014

Just released:
Snort Subscriber Rule Set Update for 11/20/2014

We welcome the introduction of the newest rule release from Talos. In this release we introduced 21 new rules and made modifications to 4 additional rules.

There were no changes made to the snort.conf in this release.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:

Avery Tarasov
32583
32584


Talos's rule release:
Talos has added and modified multiple rules in the blacklist, browser-firefox, deleted, file-flash, file-office, malware-cnc and server-webapp rule sets to provide coverage for emerging threats from these technologies.


In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Tuesday, November 18, 2014

Snort Subscriber Rule Set Update for 11/18/2014

Just released:
Snort Subscriber Rule Set Update for 11/18/2014


We welcome the introduction of the newest rule release from Talos. In this release we introduced 29 new rules and made modifications to 23 additional rules.

There were no changes made to the snort.conf in this release.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:

Avery Tarasov
32531


Talos's rule release:
The VRT has added and modified multiple rules in the blacklist, browser-ie, exploit-kit, file-flash, file-other, malware-cnc, os-windows, policy-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.


In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Thursday, November 13, 2014

Snort Subscriber Rule Set Update for 11/13/2014

Just released:
Snort Subscriber Rule Set Update for 11/13/2014


We welcome the introduction of the newest rule release from Talos. In this release we introduced 27 new rules and made modifications to 3 additional rules.

There were no changes made to the snort.conf in this release.


Talos's rule release:
Talos has added and modified multiple rules in the blacklist, browser-ie, browser-other, file-flash, malware-cnc, policy-other, server-mysql and server-webapp rule sets to provide coverage for emerging threats from these technologies.


In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Tuesday, November 11, 2014

Snort Subscriber Rule Set Update for 11/11/2014, MSTuesday Release

Just released:
Snort Subscriber Rule Set Update for 11/11/2014


We welcome the introduction of the newest rule release from Talos. In this release we introduced 123 new rules and made modifications to 9 additional rules.

There were no changes made to the snort.conf in this release.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset


Talos's rule release:
Microsoft Security Bulletin MS14-064:
Coding deficiencies exist in Microsoft Windows OLE that may lead to
remote code execution.

A previously released rule will detect attacks targeting these
vulnerabilities and has been updated with the appropriate reference
information. It is included in this release and is identified with GID
1, SID 7070.

New rules to detect attacks targeting these vulnerabilities are also
included in this release and are identified with GID 1, SIDs 32470
through 32473.

Microsoft Security Bulletin MS14-065:
Microsoft Internet Explorer suffers from programming errors that may
lead to remote code execution.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32424 through 32427,
32430 through 32431, 32436 through 32443, 32458 through 32461, 32476
through 32479, 32481 through 32485, 32491 through 32492, and 32495
through 32500.

Microsoft Security Bulletin MS14-066:
A coding deficiency exists in Microsoft Schannel that may lead to
remote code execution.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32404 through 32423.

Microsoft Security Bulletin MS14-067:
A coding deficiency exists in Microsoft XML Core Services that may lead
to remote code execution.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32501 through 32502.

Microsoft Security Bulletin MS14-069:
Microsoft Office suffers from programming errors that may lead to
remote code execution.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32428 through 32429
and 32432 through 32435.

Microsoft Security Bulletin MS14-070:
Programming errors exist in Microsoft TCP/IP that may lead to an
escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32489 through 32490.

Microsoft Security Bulletin MS14-071:
A coding deficiency exists in the Microsoft Windows Audio Service that
may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32518 through 32519.

Microsoft Security Bulletin MS14-072:
A coding deficiency exists in Microsoft .NET Framework that may lead to
an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 32474 through 32475.

Microsoft Security Bulletin MS14-073:
A coding deficiency exists in Microsoft SharePoint Foundation that may
lead to an escalation of privilege.

A previously released rule will detect attacks targeting this
vulnerability and has been updated with the appropriate reference
information. It is included in this release and is identified with GID
1, SID 7070.

The VRT has also added and modified multiple rules in the blacklist,
browser-ie, deleted, exploit-kit, file-office, file-other, malware-cnc,
os-windows, policy-other, server-mail and server-webapp rule sets to
provide coverage for emerging threats from these technologies.


In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Thursday, November 6, 2014

Snort Subscriber Rule Set Update for 11/06/2014

Just released:
Snort Subscriber Rule Set Update for 11/06/2014


We welcome the introduction of the newest rule release
 from Talos. In this release we introduced 21 new rules and made modifications to 8 additional rules.

There were no changes made to the snort.conf in this release.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:

Avery Tarasov
32385


Talos's rule release: 

Talos has added and modified multiple rules in the blacklist,
browser-ie, exploit-kit, file-identify, file-office,
indicator-obfuscation, malware-cnc and server-other rule sets to
provide coverage for emerging threats from these technologies.


In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!