This means we will no longer be releasing updates for this version of the rule engine. Users of this version are now encouraged to upgrade to the latest version of Snort, which is now Snort 2.9.5.5.
Time to upgrade! Thanks all!
Monday, September 30, 2013
Sourcefire VRT Certified Snort Rules Update for 09/26/2013
Sourcefire VRT Certified Snort Rules Update for 09/26/2013
We welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 29 new rules and made modifications to 5 additional rules.
There were no changes made to the
The VRT would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Avery Tarasov:
28044
Yaser Mansour:
28042
In VRT's rule release:
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
We welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 29 new rules and made modifications to 5 additional rules.
There were no changes made to the
snort.conf in this release.
The VRT would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Avery Tarasov:
28044
Yaser Mansour:
28042
In VRT's rule release:
The Sourcefire VRT has added and modified multiple rules in the app-detect, blacklist, browser-plugins, exploit-kit, file-other, malware-cnc and server-webapp rule sets to provide coverage for emerging threats from these technologies.
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Tuesday, September 24, 2013
Sourcefire VRT Certified Snort Rules Update for 09/24/2013, Snort.conf updates
Just released:
Sourcefire VRT Certified Snort Rules Update for 09/24/2013
We welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 96 new rules and made modifications to 40 additional rules.
There were three changes made to the
8509
7770
1158
The example VRT snort.conf's have been updated at the following address:
https://www.snort.org/configurations
The VRT would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Avery Tarasov:
27965
28004
28012
Yaser Mansour:
28005
28006 (Also special thanks to Avery Tarasov for writing almost the same rule)
28033
28034
28035
28036
James Lay:
28007
28008
28009
28010
28011
In VRT's rule release:
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Sourcefire VRT Certified Snort Rules Update for 09/24/2013
We welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 96 new rules and made modifications to 40 additional rules.
There were three changes made to the
snort.conf in this release. The following ports were added to http_inspects "ports" line, stream5's "both" line, and the HTTP_PORTS variable:8509
7770
1158
The example VRT snort.conf's have been updated at the following address:
https://www.snort.org/configurations
The VRT would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Avery Tarasov:
27965
28004
28012
Yaser Mansour:
28005
28006 (Also special thanks to Avery Tarasov for writing almost the same rule)
28033
28034
28035
28036
James Lay:
28007
28008
28009
28010
28011
In VRT's rule release:
The Sourcefire VRT has added and modified multiple rules in the app-detect, blacklist, browser-ie, deleted, exploit-kit, file-identify, file-office, file-other, indicator-compromise, indicator-obfuscation, indicator-scan, malware-cnc, malware-other, malware-tools and smtp rule sets to provide coverage for emerging threats from these technologies.
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Thursday, September 19, 2013
Sourcefire VRT Certified Snort Rules Update for 09/19/2013
Just released:
Sourcefire VRT Certified Snort Rules Update for 09/19/2013
We welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 2 new rules and made modifications to 5 additional rules.
There were no changes made to the
In VRT's rule release:
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Sourcefire VRT Certified Snort Rules Update for 09/19/2013
We welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 2 new rules and made modifications to 5 additional rules.
There were no changes made to the
snort.conf in this release.In VRT's rule release:
The Sourcefire VRT has added and modified multiple rules in the app-detect, blacklist, browser-ie and file-other rule sets to provide coverage for emerging threats from these technologies.
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Tuesday, September 17, 2013
Sourcefire VRT Certified Snort Rules Update for 09/17/2013 release 2, IE 0Day
Just released:
Sourcefire VRT Certified Snort Rules Update for 09/17/2013 release 2
We welcome the introduction of the second rule release from the VRT. In this release we introduced 6 new rules and made modifications to 9 additional rules.
Sourcefire VRT Certified Snort Rules Update for 09/17/2013 release 2
We welcome the introduction of the second rule release from the VRT. In this release we introduced 6 new rules and made modifications to 9 additional rules.
http://www.snort.org/vrt/docs/ruleset_changelogs/changes-2013-09-17_2.html
There were no changes made to the
In VRT's rule release:
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most
There were no changes made to the
snort.conf in this release. In VRT's rule release:
Synopsis:
The Sourcefire VRT is aware of vulnerabilities affecting products from
Microsoft Corporation.
Details:
Microsoft Security Advisory 2887505:
A programming error in Internet Explorer could lead to remote code
execution.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 27943 and 27944.
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most
Sourcefire VRT Certified Snort Rules Update for 09/17/2013
Just released:
Sourcefire VRT Certified Snort Rules Update for 09/17/2013
We welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 29 new rules and made modifications to 13 additional rules.
There were no changes made to the
The VRT would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Yaser Mansour
In VRT's rule release:
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Sourcefire VRT Certified Snort Rules Update for 09/17/2013
We welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 29 new rules and made modifications to 13 additional rules.
There were no changes made to the
snort.conf in this release.
The VRT would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Yaser Mansour
27913
27914
27915
27916
27917
Avery Tarasov
27918
27919
In VRT's rule release:
The Sourcefire VRT has added and modified multiple rules in the app-detect, browser-ie, exploit-kit, file-other, indicator-obfuscation, malware-cnc, protocol-dns, pua-adware, pua-toolbars and server-other rule sets to provide coverage for emerging threats from these technologies.
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Monday, September 16, 2013
Snort 2.9.5.5 is now available on Snort.org
Snort 2.9.5.5 is now available on Snort.org!
https://www.snort.org/downloads in the Latest Release section.
(Thanks Bram!)
Please submit bugs, questions, and feedback to bugs@snort.org.
Happy Snorting!
The Snort Release Team
https://www.snort.org/downloads in the Latest Release section.
2013-09-12 - Snort 2.9.5.5[*] Improvements* Address issue with SMTP preprocessor and the ignore_tls_data configuration to correctly stop inspection after an SMTP session is encrypted. (Thanks Bram!)
* Disable all rule evaluation (as opposed to just rules with fast patterns) for packets on a previously blocked session.* Corrected when perfmon preprocessor writes stats to occur as soon as both the time and packet count criteria are met.* Enforce same restrictions on relative PCRE for HTTP buffers from shared library rules as already existed with text rules.Please submit bugs, questions, and feedback to bugs@snort.org.
Happy Snorting!
The Snort Release Team
Thursday, September 12, 2013
Sourcefire VRT Certified Snort Rules Update for 09/12/2013
Just released:
Sourcefire VRT Certified Snort Rules Update for 09/12/2013
We welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 46 new rules and made modifications to 37 additional rules.
There were no changes made to the
The VRT would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Avery Tarasov/Adam Gardner
27865
In VRT's rule release:
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Sourcefire VRT Certified Snort Rules Update for 09/12/2013
We welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 46 new rules and made modifications to 37 additional rules.
There were no changes made to the
snort.conf in this release.
The VRT would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Avery Tarasov/Adam Gardner
27865
In VRT's rule release:
The Sourcefire VRT has added and modified multiple rules in the blacklist, browser-ie, browser-plugins, exploit, exploit-kit, file-identify, file-office, indicator-compromise, malware-cnc, protocol-voip, pua-adware and web-client rule sets to provide coverage for emerging threats from these technologies.
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Wednesday, September 11, 2013
PulledPork 0.7.0 Released! #include <IP.Reputation>
PulledPork 0.7.0 - Swine Flu has been released and can be found at the PulledPork site. There are numerous feature changes and enhancements that dramatically affect the functionality and capabilities of PulledPork since the last major 0.6.x release. An excerpt of the changelog is at the bottom of this post and lists all of the changes/features/enhancements.
The most significant change that you are likely to notice deals with how PulledPork now processes the rules tarball. In the previous versions of PulledPork when you would run the application it would process the rules tarball as designated in your configuration, regardless of whether or not the source tarball had changed (no new rules tarball for example). With the new changes the source rules tarball is ONLY processed if it is new/changed OR if you specify the -P runtime flag. So for tuning exercises or out of band runs when the source tarball is unchanged, you MUST specify the -P flag for any processing to occur.
Inline with the new IP Reputation preprocessor that was introduced in Snort 2.9.1 we have included full support for this feature. This support includes a couple of new configuration options that are located in the pulledpork.conf and allow for retrieval of multiple ip reputation lists (PulledPork will automatically de-dupe these lists). If you are running Snort on Linux you are also able to specify at ./configure time an option to allow for in-memory reloading of IP Reputation lists, thus you do not have to SIGHUP or completely reload Snort. This in-memory reload is accomplished by using a control socket that this version of PulledPork is capable of utilizing.
Working closely with the Barnyard2 team we have developed a new version of the data in the sid-msg.map. This allows for more information to be included in intrusion events such as the revision of the rule (currently not included in alerts). The default version is still version 1 of the sid-msg.map file, it is CRITICAL to note that only Barnyard 2.2+ supports this new version of the sid-msg.map file and as such ONLY when using this version or newer of Barnyard 2.2+ should you change this value in your pulledpork.conf.
When utilizing the default configuration that creates two single unified rules files (one for so_rules and one for text rules) the so_rules stub files are now included in the single rules tarball. This means that you no longer need to include the so_rules.rules file. This single rules file is now internally separated by category and rule type, or generator to allow for rapid rule location and more logical perusing of the file.
As per the usual, thank you for your continued support and usage of PulledPork and Snort. Should you have any questions or concerns please feel free to file a bug report or new feature request at http://pulledpork.googlecode.com and also to participate in the community mailing list that can be found at http://groups.google.com/group/pulledpork-users
Bug Fixes:
- Bug #79 - Fixed race condition that did not allow for disabled rules to be modified using modifysid
These rules would then be enabled by flowbit dependency check and be unmodified
- Bug #77 - Adjusted chown property of archive::tar
- Bug #78 - Adjusted per bug report to allow for proper ignoring of preproc.rules
- Bug #102 - Only Enabled rules are written to sid-msg.map now when -E flag is specified
- Bug #99 - Doc Bug, updated docs associated with snort_version variable
- Bug #96 - Modified code to allow for same-line traling comments: "1:10011 #can haz disable!"
Also updated the rulestate files (enable,disable,drop)
- Bug #82 - Modified run order to force modifysid to run before all other sid state modification routines
This allows for sid changes to be made prior to automatic state determination ala automatic
flowbit resolution. NOTE that this DOES NOT AND WILL NOT disable automatic flowbit
resolution, this is a critical piece.
- Bug #81 - Updated valid SO distro pre-compiled list
- Bug #114 - Update Regex to allow for null search/replace in modify_sid sub
- Unlisted Bug - Allow for escaped ; "\;" in references
- Bug #121 - Update to allow for new etpro.com url and cert!
- Bug #119 - Fixed regex [^\\], should have been negative look behind (?<!\\)
- Bug #120 - Updated proxy code for better support and proper runtime load order
- Unlisted Bug - Account for multiple flowbits that are separated using &| operators
(flowbits:isset,flowbit1&flowbit2;)(flowbits:isset,flowbit1|flowbit2;)
- Bug #126 - Removed Switch usage
- Bug #129 - Fixed to allow for -n usage (in conjunction with -P) when an ip list is used also
- Unlisted Bug - Fixed to allow for proper -P usage
New Features / changes:
- Bug #105 - Removed Switch function as it is deprecated in > 5.12 perl
- NEW - Added IP Reputation Preprocessor support
- NEW - Capability to use control socket for IP List reload
- NEW - -P runtime flag to (process even if there is no new rules tarball)**
- Bug #68 - Added basic surricata support
- Bug #115 - Single rules file now has category (and GID) separators
Correlating to this we have also removed the separate so_rules.rules file
All rules are now in a single snort.rules file unless the keep flag is
specified at runtime.
- NEW - Numerous sub rewrites to allow for better performance
- NEW - New sid-msg.map format for barnyard 2.2+ gid || sid || rev || class || pri || msg || @refs
- NEW - SO rule categories are now prepended with VRT-SO
- NEW - More advanced sid-msg.map structure (for use with by2.2+) and backward compatibility
This allows for better mapping of gid:sid:rev in the database!
- NEW - Rewrote the way that extraction is handled, to properly support a single rules tarball being
updated. This includes how md5 validation is done and in what order. If a single
file is updated then they are all extracted and processed.
A few Shared Object platforms have been deprecated
As we indicated in a previous blog post back on August 14th, a few Shared Object rule platforms have been deprecated.
See blog post here: http://blog.snort.org/2013/08/a-few-shared-object-platforms-are-being.html
We are removing support for precompiled Shared Object rules on the following platforms:
OpenBSD 4.8
OpenSUSE 11.3
If you are using any of the above, please consider upgrading, as you will no longer be able to use precompiled Shared Object rules on your platform. Text rules (the vast majority of the ruleset) are unaffected by this.
See blog post here: http://blog.snort.org/2013/08/a-few-shared-object-platforms-are-being.html
We are removing support for precompiled Shared Object rules on the following platforms:
OpenBSD 4.8
OpenSUSE 11.3
If you are using any of the above, please consider upgrading, as you will no longer be able to use precompiled Shared Object rules on your platform. Text rules (the vast majority of the ruleset) are unaffected by this.
Tuesday, September 10, 2013
Sourcefire VRT Certified Snort Rules Update for 09/10/2013, MSTues
Just released:
Sourcefire VRT Certified Snort Rules Update for 09/10/2013
We welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 63 new rules and made modifications to 30 additional rules.
There were no changes made to the
The VRT would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Yaser Mansour:
27801
27802
27803
27804
Paul Bottomley:
27805
In VRT's rule release:
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Sourcefire VRT Certified Snort Rules Update for 09/10/2013
We welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 63 new rules and made modifications to 30 additional rules.
There were no changes made to the
snort.conf in this release.
The VRT would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Yaser Mansour:
27801
27802
27803
27804
Paul Bottomley:
27805
In VRT's rule release:
Synopsis: The Sourcefire VRT is aware of vulnerabilities affecting products from
Microsoft Corporation.
Details:
Microsoft Security Advisory MS13-067:
A programming error in Microsoft Sharepoint could lead to remote code
execution.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 27818 through 27819,
27823, and 27826 through 27828.
Microsoft Security Advisory MS13-069:
Internet Explorer suffers from programming errors that may lead to
remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 27829 through 27846.
Microsoft Security Advisory MS13-071:
A programming error in Microsoft's Windows Theme File could lead to
remote code execution.
A rule to detect attacks targeting this vulnerability is included in
this release and is identified with GID 1, SID 27822.
Microsoft Security Advisory MS13-072:
Microsoft Office suffers from coding errors that may lead to remote
code execution.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 27850 through 27859.
Microsoft Security Advisory MS13-073:
A programming error in Microsoft Excel could lead to remote code
execution.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 27820 through 27821
and 27824 through 27825.
Microsoft Security Advisory MS13-078:
A coding error in Microsoft FrontPage could lead to information
disclosure.
A previously released rules will detect attacks targeting this
vulnerability and has been updated with the appropriate reference
information. It is included in this release and is identified with GID
1, SID 26626.
Microsoft Security Advisory MS13-079:
Programming errors in the .NET Framework and Silverlight may lead to
remote code execution.
A rule to detect attacks targeting this vulnerability is included in
this release and is identified with GID 1, SID 27860.
The Sourcefire VRT has added and modified multiple rules in the
blacklist, browser-ie, deleted, exploit-kit, file-multimedia,
file-office, file-other, indicator-compromise, malware-cnc,
malware-other, os-windows, protocol-voip, server-oracle and
server-webapp rule sets to provide coverage for emerging threats from
these technologies.
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Monday, September 9, 2013
Snort 2.9.5.3 rules for registered users are now available!
The 30 day window for Snort 2.9.5.3 has now expired and registered users can now download the 2.9.5.3 ruleset available here: http://www.snort.org/snort-rules/
Tuesday, September 3, 2013
Sourcefire VRT Certified Snort Rules Update for 09/03/2013
Just released:
Sourcefire VRT Certified Snort Rules Update for 09/03/2013
We welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 35 new rules and made modifications to 30 additional rules.
There were no changes made to the
The VRT would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Avery Tarasov:
27774
27775
In VRT's rule release:
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Sourcefire VRT Certified Snort Rules Update for 09/03/2013
We welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 35 new rules and made modifications to 30 additional rules.
There were no changes made to the
snort.conf in this release.
The VRT would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Avery Tarasov:
27774
27775
In VRT's rule release:
The Sourcefire VRT has added and modified multiple rules in the browser-ie, browser-plugins, exploit-kit, file-executable, file-java, malware-cnc, policy-other, protocol-scada, protocol-tftp, server-apache, server-mail and server-webapp rule sets to provide coverage for emerging threats from these technologies.
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Subscribe to:
Posts (Atom)