Snort Subscriber Rule Set Update for 07/12/2016
We welcome the introduction of the newest rule release from Talos. In this release we introduced 43 new rules and made modifications to 9 additional rules.
There were no changes made to the
snort.conf in this release.
Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Yaser Mansour
39526
39527
39528
39529
Talos's rule release:
Synopsis:
Talos is aware of vulnerabilities affecting products from Microsoft
Corporation.
Details:
Microsoft Security Bulletin MS16-084:
Microsoft Internet Explorer suffers from programming errors that may
lead to remote code execution.
Previously released rules will detect attacks targeting these
vulnerabilities and have been updated with the appropriate reference
information. They are also included in this release and are identified
with GID 1, SIDs 38112 through 38113.
New rules to detect attacks targeting these vulnerabilities are also
included in this release and are identified with GID 1, SIDs 39484
through 39487, 39491 through 39492, 39499 through 39500, and 39510
through 39515.
Microsoft Security Bulletin MS16-085:
A coding deficiency exists in Microsoft Edge that may lead to an
escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 39493 through 39494
and 39505 through 39507.
Microsoft Security Bulletin MS16-088:
A coding deficiency exists in Microsoft Office that may lead to remove
code execution.
Previously released rules will detect attacks targeting these
vulnerabilities and have been updated with the appropriate reference
information. They are also included in this release and are identified
with GID 1, SIDs 16234, 18545, 18548, and 25631.
New rules to detect attacks targeting these vulnerabilities are also
included in this release and are identified with GID 1, SIDs 39503
through 39504 and 39518 through 39525.
Microsoft Security Bulletin MS16-090:
A coding deficiency exists in Microsoft Kernel-Mode drivers that may
lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 39478 through 39483,
39495 through 39496, 39508 through 39509, and 39516 through 39517.
Talos has added and modified multiple rules in the browser-ie,
file-office, file-pdf, indicator-obfuscation, malware-cnc and
policy-other rule sets to provide coverage for emerging threats from
these technologies.
In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!