Weekly Snort rule update for March 25 - April 1

 Cisco Talos released two new rule sets for SNORTⓇ this week, which you can view here and here.

There are multiple rules to protect against the exploitation of the highly publicized Spring4Shell vulnerabilities that could lead to remote code execution. Spring is a popular framework used to develop Java applications. Snort SIDs 30790 - 30793, 59388 and 59416 can detect this activity.

For more on these vulnerabilities, read the Talos blog here. 

All users can subscribe to Talos' newest rule detection functionality for as low as $29 a year with a personal account. Be sure and see our business pricing as well here. The Snort 3 release is also here after years of development and improvements, which you can upgrade to here.

Snort's rule blog posts are switching to a weekly recap format, rather than releasing every day a new rule update is released. If you have any feedback on this blog format, please reach out to us on Twitter @Snort. 

Weekly Snort rule update for March 21 - 25

Cisco Talos released two new rule sets for SNORTⓇ this week, which you can view here and here.

All users can subscribe to Talos' newest rule detection functionality for as low as $29 a year with a personal account. Be sure and see our business pricing as well here. The Snort 3 release is also here after years of development and improvements, which you can upgrade to here.

Snort's rule blog posts are switching to a weekly recap format, rather than releasing every day a new rule update is released. If you have any feedback on this blog format, please reach out to us on Twitter @Snort. 

Snort rule update for Jan. 13, 2022

The newest SNORTⓇ rule update from Cisco Talos is now available.

Thursday morning's rule release includes new protections against the exploitation of a Log4shell-like vulnerability recently discovered in the popular H2 Java SQL database. Although the paths to exploiting this vulnerability are similar to the recent Log4j issue, the scope of execution is less broad.

Here's a full breakdown of the rest of today's rule update:

Shared object rules	Modified shared object rules	New rules	Modified rules
2	0	2	2

Snort rule update for Jan. 11, 2022 — Microsoft Patch Tuesday

Cisco Talos released a new SNORT® ruleset Tuesday evening, providing coverage for many of the vulnerabilities covered in Microsoft Patch Tuesday.

For more details on the vulnerabilities Microsoft disclosed this month, view all of them on Microsoft's security update page. You can also read our breakdown of the most notable vulnerabilities on the Talos blog.

Here's a breakdown of Tuesday's rule release:

Shared object rules	Modified shared object rules	New rules	Modified rules
0	0	22	9

Snort rule update for Dec. 7, 2021

The newest SNORTⓇ rule update from Cisco Talos is now available.

Tuesday's rule update includes multiple rules to protect against vulnerabilities that are being exploited in the wild. One such vulnerability is CVE-2021-44515 in the Zoho patch management software. If exploited, it could allow attackers to bypass authentication and execute arbitrary code. Snort rule 58696 detects if attackers try to upload a file as part of exploiting this vulnerability.

Here's a full breakdown of today's rule update:

Shared object rules	Modified shared object rules	New rules	Modified rules
7	0	17	353

Snort rule update for Nov. 30, 2021

The newest SNORTⓇ rule update from Cisco Talos is now available.

Tuesday morning's release includes a new rule to protect against the high-profile DarkSide ransomware. The group, also known as DarkMatter, targeted several high-profile companies across the globe this year, including two companies in the U.S. food and agriculture sector. 

This new rule detects when the ransomware attempts to make an outbound connection.

Here's a full breakdown of the rest of today's rule update:

Shared object rules	Modified shared object rules	New rules	Modified rules
10	0	19	5

Snort rule update for Nov. 12, 2021

The newest SNORTⓇ rule update from Cisco Talos is now available.

Tuesday morning's release includes a new rule to protect against the SQUIRRELWAFFLE attack we detailed in late October. SQUIRRELWAFFLE provides threat actors with an initial foothold onto systems and their network environments that can then be used to facilitate further compromise or additional malware infections depending on how adversaries choose to attempt to monetize their access. 

Here's a full breakdown of the rest of today's rule update:

Shared object rules	Modified shared object rules	New rules	Modified rules
2	0	12	39

Snort rule update for Nov. 4, 2021

The newest SNORTⓇ rule update from Cisco Talos is now available.

We apologize that these rule blog posts have not been as frequent recently — our comms team was on a bit of a fall break. But, we're excited to let everyone know about today's rule release. 

We have multiple rules available to protect against the exploitation of multiple vulnerabilities Cisco disclosed in some of their routers that could allow unauthenticated attackers to log in using hard-coded credentials or default SSH keys.

Here's a full breakdown of the rest of Tuesday's rule update:

Shared object rules	Modified shared object rules	New rules	Modified rules
12	0	14	1

Snort rule update for Oct. 14, 2021

Cisco Talos released the newest SNORTⓇ rule update today.  This release includes protections against several vulnerabilities including the Trend Micro Encryption Email Gateway and the phpMyAdmin tool.

Here's a full breakdown of the rest of Thursday's rule update:

Shared object rules	Modified shared object rules	New rules	Modified rules
2	2	25	0

Snort rule update for Oct. 7, 2021

The newest SNORTⓇ rule update is available now. 

Cisco Talos' latest ruleset includes SID 58276 (SID 300053 for Snort 3) to protect against the exploitation of a zero-day vulnerability in the Apache HTTP Server Project. An attacker could exploit CVE-2021-41773 to execute remote code on the targeted machine. As of earlier this week, this exploit has already been used in the wild.

Here's a full breakdown of the rest of Thursday's rule update:

Shared object rules	Modified shared object rules	New rules	Modified rules
6	0	22	2

Snort rule update for Oct. 5, 2021

Cisco Talos shared the newest rule update for SNORTⓇ this afternoon. 

Tuesday's release includes new protection against the BlackMatter ransomware attack. Japanese technology company Olympus recently suffered an attack from this group, suffering outages across its European, Middle East and Africa computer networks. BlackMatter also recently infected a large grain co-op in Iowa, with the group demanding a $5.9 million ransom payment. 

Here's a full breakdown of Thursday's rule update:

Shared object rules	Modified shared object rules	New rules	Modified rules
4	0	13	5

Snort rule update for Sept. 23, 2021

A new SNORTⓇ rule update is out this morning.

There are two rules in this package that protect against a zero-day vulnerability in the macOS Finder.  An attacker could exploit this vulnerability by tricking a user into opening a specially crafted email attachment that executes arbitrary commands. Apple released an update for this issue, but it is still exploitable, according to security researchers.

Here's a full breakdown of Thursday's rule update:

Shared object rules	Modified shared object rules	New rules	Modified rules
6	1	20	1

Snort rule update for Sept. 9, 2021 — New coverage for Microsoft MSHTML zero-day

The latest SNORT rule update is available this morning, including new coverage for the recently disclosed zero-day vulnerability in Microsoft MSHTML. 

Users are encouraged to deploy SIDs 58120 – 58129 to detect and prevent the exploitation of CVE-2021-40444, which Microsoft disclosed earlier this week. If an adversary were to successfully exploit this vulnerability, they could remotely execute code on the victim machine or gain complete control. The Microsoft advisory also stated that proof-of-concept code for this vulnerability is available in the wild. 

Here's a full breakdown of this rule update:

Shared object rules	Modified shared object rules	New rules	Modified rules
1	0	19	2

Snort rule update for Sept. 2, 2021

Cisco Talos released the latest rule update for SNORTⓇ Thursday.

This release includes new protection against a critical vulnerability Cisco recently disclosed in its NFVIS software. There is a publicly available proof-of-concept exploit available for this vulnerability that could allow an attacker to bypass authentication and log in to a vulnerable device as an admin.

Here's a full breakdown of this rule update:

Shared object rules	Modified shared object rules	New rules	Modified rules
6	0	18	0

Snort rule update for Aug. 31, 2021

Cisco Talos released the latest SNORTⓇ rule update Tuesday afternoon. 

Today's release includes new rules to protect against vulnerabilities in Apache Flink and the Kentico content management system, among other software.

Here's a full breakdown of this release:

Shared object rules	Modified shared object rules	New rules	Modified rules
8	0	10	4

Snort rule update for Aug. 26, 2021

The newest SNORTⓇ rule update is out now from Cisco Talos.

Thursday's rule release contains new protections against some widely discussed vulnerabilities in Realtek SDKs that affect thousands of internet-of-things devices. The vulnerabilities exist in products from more than 65 manufacturers, including IP cameras, childrens' toys and travel routers.

Here's a full breakdown of this release:

Shared object rules	Modified shared object rules	New rules	Modified rules
1	0	14	3

Snort rule update for Aug. 24, 2021

Cisco Talos released the latest rule update for SNORTⓇ this morning.

Our latest rule set includes two new rules to protect against the LockBit ransomware. Researchers are tracking the 2.0 version of this malware spreading rapidly across the threat landscape, recently hitting multiple high-profile targets.

Here's a full breakdown of this release:

Shared object rules	Modified shared object rules	New rules	Modified rules
10	0	14	0

Snort rule update for Aug. 5, 2021

The latest SNORTⓇ ruleset is available this morning from Cisco Talos.

Thursday's rule update includes protection against two pre-authorization vulnerabilities in the Cisco RV series of routers. The two vulnerabilities Cisco disclosed this week could allow an attacker to trigger a denial-of-service condition or execute commands and arbitrary code on vulnerable devices.

Here's a full breakdown of this release:

Shared object rules	Modified shared object rules	New rules	Modified rules
3	1	0	0

Snort rule update for July 27, 2021

Cisco Talos released the newest SNORTⓇ ruleset this morning.

We released the rule update overnight, featuring new protections against several malware families. Among the coverage are a few rules to detect a new Trickbot module that spies on users by creating an attacker-controlled virtual machine.

There are also new protections against the SeriousSAM vulnerability recently discovered in Windows 10 and 11. The vulnerability could allow an attacker to install programs, edit data or create new accounts with full user rights.

Here's a full breakdown of Monday night's release:

Shared object rules	Modified shared object rules	New rules	Modified rules
3	0	24	2

Snort rule update for July 20, 2021

Cisco Talos released the newest SNORTⓇ ruleset this morning.

Tuesday's rule update provides multiple forms of protection against the exploitation of high-severity vulnerabilities in Cisco's Business Process Automation (BPA) application and Web Security Appliance (WSA). An adversary could take advantage of these issues to access sensitive data or take over a targeted system.

Here's a full breakdown of today's release:

Shared object rules	Modified shared object rules	New rules	Modified rules
0	2	1	72