The newest SNORTⓇ rule update from Cisco Talos is now available.
Tuesday morning's release includes a new rule to protect against the SQUIRRELWAFFLE attack we detailed in late October. SQUIRRELWAFFLE provides threat actors with an initial foothold onto systems and their network environments that can then be used to facilitate further compromise or additional malware infections depending on how adversaries choose to attempt to monetize their access.
Here's a full breakdown of the rest of today's rule update:
| Shared object rules | Modified shared object rules | New rules | Modified rules |
|---|---|---|---|
| 2 | 0 | 12 | 39 |
There were no changes made to the snort.conf in this release.
Cisco Talos' rule release:
Talos has added and modified multiple rules in the exploit-kit, file-image, file-multimedia, file-other, malware-cnc, netbios, os-mobile, os-solaris, policy-other, protocol-imap, server-mysql and server-webapp rule sets to provide coverage for emerging threats from these technologies.
You can subscribe to Talos' newest rule detection functionality for as low as $29 a year with a personal account. Be sure and see our business pricing as well here. The Snort 3 release is also here after years of development and improvements. Upgrade here.