EOL for Snort 2.9.7.6 is approaching!

As you can see from our EOL page, the End of Life (EOL) for Snort version 2.9.7.6's ruleset is approaching on March 13th.

Our download numbers are clearly illustrating that most people have moved from 2.9.7.6 to 2.9.8.3 or 2.9.9.0, which is great.  However, it appears there are still several thousand users on 2.9.7.6.


Please take the next week to move off of 2.9.7.6 and onto a more updated version before the EOL date hits!

Thanks

Snort Subscriber Rule Set Update for 02/28/2017

Just released:
Snort Subscriber Rule Set Update for 02/28/2017


We welcome the introduction of the newest rule release from Talos. In this release we introduced 17 new rules and made modifications to 10 additional rules.

There were no changes made to the snort.conf in this release.



Talos's rule release:

Talos has added and modified multiple rules in the exploit-kit, file-flash, file-office, policy-other, protocol-scada and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats!

Snort Subscriber Rule Set Update for 02/24/2017

Just released:
Snort Subscriber Rule Set Update for 02/24/2017


We welcome the introduction of the newest rule release from Talos. In this release we introduced 12 new rules and made modifications to 29 additional rules.

There were no changes made to the snort.conf in this release.



Talos's rule release:

Talos has added and modified multiple rules in the browser-ie, file-flash, file-other, indicator-obfuscation, indicator-shellcode and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats!

Snort++ Update

Pushed build 227 to github (snortadmin/snort3):

• allow arbitrary / unused gids in text rules
• support DAQs w/o explicit sources (nfq, ipfw)
• fix up peg help (remove _)
• fix u2 logging of PDUs

Snort Subscriber Rule Set Update for 02/23/2017

Just released:
Snort Subscriber Rule Set Update for 02/23/2017


We welcome the introduction of the newest rule release from Talos. In this release we introduced 21 new rules and made modifications to 9 additional rules.

There were no changes made to the snort.conf in this release.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:

Yaser Mansour:
41710
41711
41712
41713

Talos's rule release:

Talos has added and modified multiple rules in the file-flash, file-office, file-pdf, indicator-compromise, malware-cnc, policy-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats!

Snort Subscriber Rule Set Update for 02/21/2017

Just released:
Snort Subscriber Rule Set Update for 02/21/2017


We welcome the introduction of the newest rule release from Talos. In this release we introduced 33 new rules and made modifications to 30 additional rules.

There were no changes made to the snort.conf in this release.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:

Yaser Mansour
41663


Talos's rule release:

Talos has added and modified multiple rules in the blacklist, browser-plugins, file-flash, malware-cnc, malware-other, protocol-scada, pua-adware, server-apache and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats!

Snort++ Update

Pushed build 226 to github (snortadmin/snort3):

• add PDF/SWF decompression to http_inspect
• add connectors to generated reference parts of manual
• add feature documentation for HA, side_channel, and connectors
• add feature documentation for http_inspect
• update default manuals
• fix privilege dropping and chroot behavior
• fix perf_monitor segfault when tterm is called before tinit
• fix stream_tcp counter underflow bug and handle max and instant stats
• fix lzma length calculation bug
• fix bogus 129:20 alerts
• fix back orifice compiler warning with -O3
• fix bug that could cause hang on ctl-C
• fix memory leak after reload w/o changing search engine
• fix off by one error when reassembling after TCP FIN received
• fix cmake doc build to include plugins on SNORT_PLUGIN_PATH
• fix compiler warnings in dce_http_server and dce_http_proxy
• fix appid reload issue
• snort2lua - changes for rpc over http
• snort2lua - changes to convert config alertfile: <filename>
• snort2lua - changes to add file_id when smb file inspection is on
• snort2lua - add deprecated option stream5_tcp: log_asymmetric_traffic

Snort Subscriber Rule Set Update for 02/16/2017

Just released:
Snort Subscriber Rule Set Update for 02/16/2017


We welcome the introduction of the newest rule release from Talos. In this release we introduced 17 new rules and made modifications to 8 additional rules.

There were no changes made to the snort.conf in this release.


Talos's rule release:

Talos has added and modified multiple rules in the blacklist, browser-ie, exploit-kit, file-flash, file-image, malware-cnc, malware-other, os-windows, policy-other, protocol-scada and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats!

Snort Subscriber Rule Set Update for 02/14/2017

Just released:
Snort Subscriber Rule Set Update for 02/14/2017


We welcome the introduction of the newest rule release from Talos. In this release we introduced 94 new rules and made modifications to 89 additional rules.

There were no changes made to the snort.conf in this release.



Talos's rule release:

Talos has added and modified multiple rules in the blacklist, browser-ie, exploit-kit, file-executable, file-flash, file-other, indicator-compromise, malware-backdoor, malware-cnc, malware-other, server-apache and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats!

Snort Subscriber Rule Set Update for 02/09/2017, TicketBleed

Just released:
Snort Subscriber Rule Set Update for 02/09/2017, TicketBleed


We welcome the introduction of the newest rule release from Talos. In this release we introduced 29 new rules and made modifications to 284 additional rules.

There were no changes made to the snort.conf in this release.



Talos's rule release:

Talos has added and modified multiple rules in the blacklist, browser-ie, exploit-kit, file-office, file-pdf, indicator-compromise, indicator-obfuscation, malware-cnc, malware-other, policy-other, server-oracle and server-webapp rule sets to provide coverage for emerging threats from these technologies.

Talos has published a blog post on this subject on the Talos Blog. 

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats!

Snort Subscriber Rule Set Update for 02/07/2017

Just released:
Snort Subscriber Rule Set Update for 02/07/2017


We welcome the introduction of the newest rule release from Talos. In this release we introduced 20 new rules and made modifications to 2 additional rules.

There were no changes made to the snort.conf in this release.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:

Yaser Mansour
41498


Talos's rule release:

Talos has added and modified multiple rules in the browser-plugins, file-office, file-pdf, policy-other, server-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats!

Snort Subscriber Rule Set Update for 02/02/2017, WordPress Vulnerability, Microsoft 0day in SMB

Just released:
Snort Subscriber Rule Set Update for 02/02/2017


We welcome the introduction of the newest rule release from Talos. In this release we introduced 14 new rules and made modifications to 7 additional rules.

There were no changes made to the snort.conf in this release.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:

Yaser Mansour
41498


Talos's rule release:

CVE-2017-0016: A coding deficiency exists in Microsoft Windows SMB that may lead to remote code execution. 

A rule to detect attacks targeting this vulnerability is included in this release and is identified with GID 1, SID 41499. 

This release also provides detection for a WordPress vulnerability using a authentication bypass.  This is the bug that was patched recently via a silent fix, and is particularly nasty.  Please upgrade your WordPress installation immediately if you have not done so.  As WordPress is so widely deployed, and the vulnerability is rather simple, we have placed these rules in the community ruleset for everyone's use.

Talos has also added and modified multiple rules in the browser-ie, browser-plugins, malware-cnc, policy-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats!

Snort++ Build 225 Available Now on Snort.org!

Snort++ build 225 is now available on Snort.org.  This is the latest monthly update available for download.  You can also get the latest updates from github (snortadmin/snort3) which is updated weekly.

There are too many changes to list here so check the ChangeLog for details.

Enhancements:

• implement RPC over HTTP by adding dce_http_server and dce_http_proxy
• port disable_replace option from snort 2.x and add snort2lua support
• port ssh tunnel over http detection

Bug Fixes:

• fix stream splitter handling during final flush of session data
• fix appid to use HTTP inspection events to detect webdav methods
• fix unit test build to work w/o REG_TEST
• fix shell to add missing newline to Lua execution error responses
• fix support for content strings with escaped quotes ("foo\"bar")
•    thanks to secres@linuxmail.org for reporting the issue
• fix various reload issues
• fix various thread sanitizer issues
• fix session disposal to always be after logging
• fix appid pattern matching issues
• fix appid dns flow counts
• fix shell resume after command line --pause
• fix sd_pattern validation boundary conditions

Other Changes:

• build: don't disable asserts when compiling with code coverage
• autoconf: update to latest versions of autoconf-archive macros
• main: add asynchronous, broadcastable analyzer commands
• add salt to flow hash
• normalize peg names to lower snake_case
• update default manuals

Please submit bugs, questions, and feedback to bugs@snort.org or the Snort-Users mailing list.

Happy Snorting!
The Snort Release Team

Snort OpenAppID Detectors have been updated!

An update has been released today for the Snort OpenAppID Detector content. This release, build 279, includes

• A total of 2,825 detectors. 
• It also includes some additional detectors that came in from the open source community. For more details on which contributions were included, we have added them in the AUTHORS file in this package.

Available now for download from our downloads page, we look forward to you downloading and using the new features of 2.9.9.0's OpenAppID preprocessor and sharing your experiences with the community.

The OpenAppID community has a mailing list specifically dedicated to the exchange and discussion of detector content.  Please visit the mailing lists page to sign up.