Cisco Talos released the newest SNORTⓇ rule set this afternoon.
The latest update includes 36 new rules, one modified rule and three new shared object rules.
Tuesday's release provides new coverage several malware families, including the Sodinokibi ransomware and the Emotet spam botnet.One rule, 54793, protects against a newly discovered malware family from a state-sponsored actor. Drovorub, which was first reported on by American intelligence agencies, is a fully formed rootkit targeting Linux machines and networks. A report from CISA and the FBI highlighted this Snort rule.
There were no changes made to the snort.conf in this release.
Talos's rule release:
There were no changes made to the snort.conf in this release.
Talos's rule release:
Talos has added and modified multiple rules in the file-executable, malware-cnc and server-webapp rule sets to provide coverage for emerging threats from these technologies.
You can subscribe to Talos' newest rule detection functionality for as low as $29 a year with a personal account. Be sure and see our business pricing as well here. Make sure and stay up to date to catch the most emerging threats.