Snort Subscriber Rule Set Update for 01/10/2017
We welcome the introduction of the newest rule release from Talos. In this release we introduced 58 new rules and made modifications to 48 additional rules.
There were no changes made to the
snort.conf in this release.
Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset
Talos's rule release:
Microsoft Security Bulletin MS17-002:
A coding deficiency exists in Microsoft Office that may lead to remote
code execution.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with GID 1, SIDs 41140 through 41141.
Microsoft Security Bulletin MS17-004:
A coding deficiency exists in Local Security Authority Subsystem
Service (LSASS) that may lead to a Denial of Service (DoS).
A previously released rule will detect attacks targeting these
vulnerabilities and has been updated with the appropriate reference
information. It is included in this release and is identified with GID
1, SID 40759.
Talos has added and modified multiple rules in the blacklist,
browser-ie, file-executable, file-flash, file-image, file-office,
file-other, file-pdf, malware-cnc, netbios, os-windows, policy-other
and server-webapp rule sets to provide coverage for emerging threats
from these technologies.
In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats!