Tuesday, April 13, 2021

Snort rule update for April 13, 2021 — Microsoft Patch Tuesday

 The latest SNORT® rule release from Cisco Talos has arrived. This new round of rules provides coverage for many of the vulnerabilities covered in Microsoft Patch Tuesday.

For more details on the vulnerabilities Microsoft disclosed this month, head to the Talos blog.

Here's a breakdown of this afternoon's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
11110

Thursday, April 8, 2021

New "Snort 3 and me" webinar series launches on April 20

Have you upgraded to Snort 3 yet? Want to learn how to transition?

With Snort 3, rules are faster and more efficient, users have more control over their Snort experience, and it runs on multiple environments and operating systems.

To help you make the switch, we're launching a new series of webinars with the help of the Snort product team and our friends across Cisco. 

To kick things off, Alex Tatistcheff, a technical marketing manager for Cisco, will be holding a presentation on Snort 3 on April 20 at 11 a.m. ET. Alex will address specific questions anyone has about Snort 3 and walk you through how to have a successful migration to Snort 3. You can register for this webinar here.

Alex is the author of the book "Essential Firepower: Your best practice guide to configuring Cisco's Next Generation Firewall" and is an expert on all things Snort.

Thursday, April 1, 2021

Snort rule update for April 1, 2021

The latest SNORTⓇ rule update is available this morning, courtesy of Cisco Talos.

Here's a breakdown of today's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
01632

Applications open now for Snort scholarship








Applications are now open for the $10,000 Snort scholarship. We encourage everyone who is eligible to apply here. We will be accepting applications through the end of the month.

After that, our hand-picked panel will look at the submissions and select two students to receive a $10,000 award each.

For more detailed instructions on how to apply, check out the video below.

Monday, March 29, 2021

Official EOL Notice for 2.9.15.0 and 2.9.16.0

Attention Snort User and Integrators:

This blog post serves as your official 90-day notice that we will be EOL'ing rule support for versions 2.9.15.0 and 2.9.16.0 as of 2021-06-21 or June 21, 2021.

As we release new versions of Snort, occasionally we have to decommission older versions, lowering our amount of maintenance to build the ruleset for these different versions.  We continually review the usage of versions, and try to strive to only keep the most actively used versions around.  There are several older Snort rule integrators that are using very old versions (2.9.8.3 for example), which is the reason those versions are still around.  However, we are actively working with these partners to move them to more current versions of Snort.

If you are using an older version of Snort, we encourage you to please start your upgrades to 2.9.17.1 or Snort 3.

Our next versions to EOL will be 2.9.16.1, 2.9.11.1, and 2.9.14.1, so we encourage users of those versions to start your upgrade planning now.

2.9.17.1 has been released!

 Join us as we are pleased to release a minor bug fix version of Snort 2.9.17.1!  Since all new development focus in on Snort 3, we encourage you to take a look.  

First, some release notes:

Snort 2.9.17.1

Improvements / Fix
  • Fixed wrong reference to configuration during
  • Fixed possible memleak in appid.
  • Fixed a race-condition in http preproc and IPS.
  • Fixed a race-condition in stream preproc.

As always this maintenance release of Snort 2.9.17.1 is available on our Snort downloads page.  For any questions, please feel free to visit our Snort-Users mailing list.

Thursday, March 25, 2021

Snort rule update for March 25, 2021

Cisco Talos released the newest rule update for SNORTⓇ this morning.

Thursday's release includes another new rule to protect against attacks from the Hafnium threat group that's been recently spotted exploiting zero-day vulnerabilities in Microsoft Exchange Server. 

There are also multiple rules to protect against the exploitation of several vulnerabilities Cisco recently disclosed in its IOS XE software. Cisco disclosed 15 vulnerabilities earlier this week, all of which are considered to be high-severity.

Here's a breakdown of today's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
16342

Video: Snort 3 roundtable discussion

To celebrate the release of Snort 3, we gathered up some of SNORTⓇ's most influential team members to talk about everything you could ever hope to know about this iteration of Snort.

We were lucky enough to pull in Marty Roesch, the creator of Snort, along with Patrick Mullen of Cisco Talos, Russ Combs of the Snort product development teams, and Joel Esler, the open-source and community manager. The four of them talked about all things Snort 3, going all the way to its initial inception almost 10 years ago.

They also discuss the benefits of upgrading to Snort 3, new tools and features you may have never heard of and other changes that could be coming in the future. Watch the full discussion below or over on the Talos YouTube page.

With Snort 3, rules are faster and more efficient, users have more control over their Snort experience, and it runs on multiple environments and operating systems. We encourage everyone to shift over to Snort 3 from any versions of Snort 2.  You can download the source from snort.org or pull it from GitHub

Thursday, March 18, 2021

Snort scholarship returning this year — here’s what you need to know

The SNORT® scholarship is back this year with a new application process and new benefits that will set this year’s winners up for a future career in cybersecurity (hopefully with Cisco Talos). 

We will start accepting applications starting April 1, through the end of the month. After that, our hand-picked panel will select two winners to award a $10,000 scholarship. 

To be eligible for the scholarship, you must have or be eligible to receive your high school diploma or an equivalent in 2021 as of the date Cisco receives your application. Each applicant must provide reasonable evidence to Cisco that you are seeking a degree in computer science, information technology, computer networking, cybersecurity or a similarly related field of study from a school located in the U.S. or a U.S. territory.  

Snort rule update for March 18, 2021 — Additional rules to protect against Hafnium attacks

The latest rule update for SNORTⓇ released early this morning via Cisco Talos.

This latest release provides several new rules to protect against attacks from the Hafnium state-sponsored actor. Microsoft first discovered this group a few weeks ago when it disclosed several zero-day vulnerabilities in the Exchange Server software. Hafnium reportedly exploited these vulnerabilities to steal emails, among other malicious actions.

These new rules prevent a web shell upload attempt commonly seen with Hafnium.

Here's a breakdown of today's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
111122

Tuesday, March 16, 2021

Snort rule update for March 16, 2021

The newest SNORTⓇ rule release arrived this morning, courtesy of Cisco Talos.

Tuesday's release includes a new rule protecting against the exploitation of the critical vulnerabilities in F5 BIG-IP and BIG-IQ. An adversary could exploit these vulnerabilities, which F5 disclosed last week, to take complete control of affected systems to execute malicious code, disable services and create or delete files, among other malicious actions. 

The new Snort rule detects when attackers try to inject arbitrary commands via the iControl REST interface.

Here's a breakdown of today's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
8011

Thursday, March 11, 2021

Snort rule update for March 11, 2021

Cisco Talos released the newest rule update for SNORTⓇ Thursday afternoon.

This latest release includes multiple rules to protect against the DEWMODE malware. Attackers exploit vulnerabilities in Accellion’s legacy File Transfer Appliance (FTA) to install this web shell. This malware family was first discovered in late February.

Here's a breakdown of the rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
101211

Tuesday, March 9, 2021

Snort rule update for March 9, 2021 — Microsoft Patch Tuesday

The latest SNORT® rule release from Cisco Talos has arrived. This new round of rules provides coverage for many of the vulnerabilities covered in Microsoft Patch Tuesday.

For more details on the vulnerabilities Microsoft disclosed this month, head to the Talos blog.

Here's a breakdown of this afternoon's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
701611

Thursday, March 4, 2021

Snort rule update for March 4, 2021 — Continuing coverage for Microsoft Exchange zero-day

Cisco Talos released another rule update for SNORTⓇ last night that adds additional protection against the exploitation of zero-day vulnerabilities in Microsoft Exchange Server. This follows the eight rules we released earlier this week.

Microsoft disclosed these vulnerabilities earlier in the week, attributing the attacks to a group known as HAFNIUM. For more on this threat, head to the Talos blog.

Here's a breakdown of Wednesday's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
2254

Wednesday, March 3, 2021

Snort rule update for March 3, 2021

The newest SNORTⓇ rule release arrived overnight, courtesy of Cisco Talos. 

Tuesday's release is primarily focused on the recent vulnerabilities Microsoft disclosed in Exchange Server. The company released a statement yesterday warning that a state-sponsored actor was exploiting these zero-day vulnerabilities to steal sensitive information from U.S.-based infectious disease researchers, law firms, colleges, defense contractors, think tanks and non-governmental organizations.

These vulnerabilities are considered to be very serious and all users should update their affected products as soon as possible. Additionally, this rule release provides rules 57233, 57234 and 57241 - 57246 to protect users against the exploitation of these vulnerabilities.

Here's a breakdown of the rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
10140

Tuesday, February 23, 2021

Snort rule update for Feb. 23, 2021

Cisco Talos released the newest rule update for SNORTⓇ on Tuesday morning.

Today's release includes multiple rules to defend against attacks from the Gamaredon threat group. Talos researchers have spotted this group carrying out multiple attacks recently that appear to be mainly motivated by stealing users' information and selling it to other threat actors. For more on this group, check out Talos' full research post.

Here's a breakdown of today's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
0223357

Monday, February 22, 2021

Snort calendar poster giveaway

Each month for the rest of this year, we'll be giving away a poster of the previous month's Snort calendar illustration. We're kicking things off with a giveaway of a Scrapple Street poster.

To enter this month's random drawing, we want you to go on Twitter and send us a picture of your favorite Snort swag. This can be anything from a T-shirt to a previous year's calendar or your favorite squishy Snorty. 

Tag us on Twitter @snort and use #SnortCal2021 by Friday, Feb. 26, at 10 a.m. ET to be entered in the drawing, and we'll select one winner at random.

By participating in this contest, you are agreeing to Twitter’s contest rules. And if you don’t win this month’s, don’t worry, you’ll have another chance in March! Sorry, no multi-time winners.

Thursday, February 18, 2021

Snort rule update for Feb. 18, 2021

The newest rule update for SNORTⓇ is here, courtesy of Cisco Talos. 

Thursday's release includes multiple rules to protect against the exploitation of a vulnerability recently identified in the VMware virtual machine software. VMware disclosed the vulnerability this week, warning an attacker could exploit it to execute shell commands on the underlying system.

Here's a breakdown of today's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
61123

Tuesday, February 16, 2021

Snort rule update for Feb. 16, 2021

Cisco Talos released the newest rule set for SNORTⓇ on Tuesday morning.

Today's update includes several rules to protect against the ObliqueRAT malware from making an outbound connection to its command and control server. Cisco Talos has documented this trojan several times. If installed, ObliqueRAT can give its operators the ability to execute arbitrary commands, exfiltrate files, drop additional payloads and terminate processes on the infected endpoint. 

Here's a breakdown of today's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
62152

Thursday, February 11, 2021

Snort rule update for Feb. 11, 2021

Cisco Talos released the newest rule update for SNORTⓇ Thursday morning.

Today's rule update provides several new protections against the Masslogger credential-stealing malware. There is also a rule protecting against a heap buffer overload attempt in Adobe Acrobat that Adobe disclosed earlier this week as part of its monthly security update.

Here's a breakdown of today's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
502116

Snort OpenAppID Detectors have been updated

 SNORTⓇ released a new update today for the Snort OpenAppID Detector content.

This release — build 341 — includes:
  • A total of 2,926 detectors. 
  • Additional detectors from the open-source community. For more details on which contributions were included, we have added them to the "Authors" file in this package.
The release is available now on our downloads page. We look forward to users downloading and using the new features of 2.9.17.0's OpenAppID preprocessor and sharing your experiences with the community.

The OpenAppID package is also compatible with our Snort 3.x release.

The OpenAppID community has a mailing list specifically dedicated to the exchange and discussion of detector content. Please visit the mailing lists page to sign up.

Tuesday, February 9, 2021

Snort rule update for Feb. 9, 2021 — Microsoft Patch Tuesday

The latest SNORT® rule release from Cisco Talos has arrived. This new round of rules provides coverage for many of the vulnerabilities covered in Microsoft Patch Tuesday.

For more details on the vulnerabilities Microsoft disclosed this month, head to the Talos blog.

Here's a breakdown of this afternoon's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
1002111

Thursday, February 4, 2021

Snort rule update for Feb. 4, 2021

The newest SNORTⓇ rule release is here, courtesy of Cisco Talos.

Thursday's rule set comes with protection against the exploitation of several vulnerabilities Cisco recently disclosed in some of its VPN routers. If exploited, an adversary could gain the ability to execute remote code on the targeted machine. 

Here's a breakdown of today's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
003718

Tuesday, February 2, 2021

Snort rule update for Feb. 2, 2021

Cisco Talos released the newest rule set for SNORTⓇ Tuesday morning.

There are multiple rules in this release that protect against, Generickdz which is often the generic name given to Windows trojans. Our two new rules will prevent the malware from downloading its final payload.

Here's a breakdown of today's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
70421

Thursday, January 28, 2021

Snort rule update for Jan. 28, 2021

This afternoon, Cisco Talos released the newest rule update for SNORTⓇ.

Thursday's release mainly provides coverage for multiple malware families. We have new and updated coverage for the Karangany malware family, which is known for targeting the energy sector, as well as the Nymaim downloader.

Here's a breakdown of today's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
20294

Tuesday, January 26, 2021

Snort rule update for Jan. 26, 2021

The newest SNORTⓇ rule set is available this morning, courtesy of Cisco Talos.

Tuesday's release includes rules protecting against a multitude of malware families, including well-known threats like Emotet and Zbot. There is also new coverage for the ElectroRAT trojan, which was recently spotted in the wild trying to steal money from users' cryptocurrency wallets

Here's a breakdown of this morning's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
122401

Monday, January 25, 2021

New Snort virtual meeting backgrounds available

We love sharing the SNORTⓇ calendar with our users every year. Our designers enjoy creating new designs and themes and we are always humbled by the support it receives every year.

Usually, we love to see pictures of the calendars hung up at cubicles, on the walls of meeting rooms or placed among armies of colored Snorties on desks and server racks.

Unfortunately, all our workspaces look different now than they did this time last year. It looks like it could be many months before we're all returning to a regular in-person schedule at the office, and instead, we've turned to virtual meeting tools like Cisco WebEx to connect with team members.

We get that your home office is not always in peak condition, or you just want to give off the idea that you're on a tropical island while sitting in that 4:30 p.m. meeting on a Friday. But why not sprinkle in a bit of your Snort fandom? 

To help you show off your love of Snort and the Snort calendar, we've converted this year's monthly illustrations into virtual meeting backgrounds, which you can find and download here. Feel free to show off the might of the Sowerpuff Curls or transport your colleagues back in time with the Flintsnouts.

Friday, January 22, 2021

New installation guides for Snort 3 GA

We are excited to release three new guides on the revamped Snort 3 page today to assist users with installing the new Snort 3 GA, version 3.1.0.0, in several different environments. 

The guides will walk you through installing our official Snort 3 release on CentOS Stream, OracleLinux 8 and Ubuntu 18 and 20.

Thursday, January 21, 2021

Snort rule update for Jan. 21, 2021

 Cisco Talos released the latest SNORTⓇ rule update this morning. This is our second rule release since Snort 3 has been officially released. This is a total overhaul of Snort as you know it, so you won't to waste any time switching over. For more information, check out our blog post on the release here and check out the Snort 3 page on Snort.org. 

Thursday's release provides several rules to protect against the exploitation of critical remote code execution vulnerabilities in Cisco's SD-WAN solutions. The most serious among the group of vulnerabilities Cisco disclosed this week is one that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system with root privileges.

Here's a breakdown of today's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
22250

Tuesday, January 19, 2021

Snort 3 officially released

We know users have been anticipating this day for years. So, we are excited to announce that the official release of Snort 3 is here! The version number is 3.1.0.0. 

Snort is an open-source intrusion prevention system (IPS) capable of real-time traffic analysis and packet logging. Snort 3 is the next step in our years-long journey of protecting users’ networks from unwanted traffic, malicious software and spam and phishing documents.  

When we started thinking about what the next generation of IPS looked like, we decided to start from scratch. This latest version of Snort is the result of more than seven years of development and hard work from our team. After many years of success, it is time for Snort to evolve by incorporating lessons we had learned over the many years of the software’s existence and make it even more effective. 

With Snort 3, rules are faster and more efficient, users have more control over their Snort experience, and it runs on multiple environments and operating systems.

Other prominent features of Snort 3 include: 

Thursday, January 14, 2021

Snort rule update for Jan. 14, 2021

Cisco Talos released the latest SNORTⓇ rule update this afternoon.

Thursday's release includes several rules to protect against the high-severity vulnerabilities Cisco disclosed in its RV series of routers. Cisco stated in its security advisory that it will not patch these products, but instead encouraged users to upgrade to more current hardware. However, these Snort rules will prevent attackers from carrying out a stack overflow attack.

Here's a breakdown of this afternoon's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
263114

Tuesday, January 12, 2021

Snort rule update for Jan. 12, 2021 — Microsoft Patch Tuesday

 The latest SNORT® rule release from Cisco Talos has arrived. This new round of rules provides coverage for all of the vulnerabilities covered in Microsoft Patch Tuesday.

For more details on the vulnerabilities Microsoft disclosed this week, head to the Talos blog.

Here's a breakdown of this evening's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
201811

Thursday, January 7, 2021

Snort rule update for Jan. 7, 2021

Cisco Talos released the latest SNORTⓇ rule update Thursday morning.

This release includes four rules to protect against the recently discovered TroubleGrabber malware. This credential stealer commonly spreads through Discord servers with malicious URLs. 

Here's a breakdown of this afternoon's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
00422

Tuesday, January 5, 2021

Snort rule update for Jan. 5, 2021

The latest SNORTⓇ rule update is available now, courtesy of Cisco Talos.

Tuesday's release contains a few rules to protect users against the exploitation of vulnerabilities in two popular WordPress plugins.

Here's a breakdown of this afternoon's rule release:

Shared object rulesModified shared object rulesNew rulesModified rules
1035