Tuesday, February 28, 2017

EOL for Snort 2.9.7.6 is approaching!

As you can see from our EOL page, the End of Life (EOL) for Snort version 2.9.7.6's ruleset is approaching on March 13th.

Our download numbers are clearly illustrating that most people have moved from 2.9.7.6 to 2.9.8.3 or 2.9.9.0, which is great.  However, it appears there are still several thousand users on 2.9.7.6.


Please take the next week to move off of 2.9.7.6 and onto a more updated version before the EOL date hits!

Thanks

Snort Subscriber Rule Set Update for 02/28/2017

Just released:
Snort Subscriber Rule Set Update for 02/28/2017


We welcome the introduction of the newest rule release from Talos. In this release we introduced 17 new rules and made modifications to 10 additional rules.

There were no changes made to the snort.conf in this release.



Talos's rule release:
Talos has added and modified multiple rules in the exploit-kit, file-flash, file-office, policy-other, protocol-scada and server-webapp rule sets to provide coverage for emerging threats from these technologies.


In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats!

Monday, February 27, 2017

Snort Subscriber Rule Set Update for 02/24/2017

Just released:
Snort Subscriber Rule Set Update for 02/24/2017


We welcome the introduction of the newest rule release from Talos. In this release we introduced 12 new rules and made modifications to 29 additional rules.

There were no changes made to the snort.conf in this release.



Talos's rule release:
Talos has added and modified multiple rules in the browser-ie, file-flash, file-other, indicator-obfuscation, indicator-shellcode and server-webapp rule sets to provide coverage for emerging threats from these technologies.


In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats!

Friday, February 24, 2017

Snort++ Update

Pushed build 227 to github (snortadmin/snort3):
  • allow arbitrary / unused gids in text rules
  • support DAQs w/o explicit sources (nfq, ipfw)
  • fix up peg help (remove _)
  • fix u2 logging of PDUs

Thursday, February 23, 2017

Snort Subscriber Rule Set Update for 02/23/2017

Just released:
Snort Subscriber Rule Set Update for 02/23/2017


We welcome the introduction of the newest rule release from Talos. In this release we introduced 21 new rules and made modifications to 9 additional rules.

There were no changes made to the snort.conf in this release.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:

Yaser Mansour:
41710
41711
41712
41713



Talos's rule release:
Talos has added and modified multiple rules in the file-flash, file-office, file-pdf, indicator-compromise, malware-cnc, policy-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.


In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats!

Wednesday, February 22, 2017

Snort Subscriber Rule Set Update for 02/21/2017

Just released:
Snort Subscriber Rule Set Update for 02/21/2017


We welcome the introduction of the newest rule release from Talos. In this release we introduced 33 new rules and made modifications to 30 additional rules.

There were no changes made to the snort.conf in this release.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:

Yaser Mansour
41663


Talos's rule release:
Talos has added and modified multiple rules in the blacklist, browser-plugins, file-flash, malware-cnc, malware-other, protocol-scada, pua-adware, server-apache and server-webapp rule sets to provide coverage for emerging threats from these technologies.


In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats!

Friday, February 17, 2017

Snort++ Update

Pushed build 226 to github (snortadmin/snort3):
  • add PDF/SWF decompression to http_inspect
  • add connectors to generated reference parts of manual
  • add feature documentation for HA, side_channel, and connectors
  • add feature documentation for http_inspect
  • update default manuals
  • fix privilege dropping and chroot behavior
  • fix perf_monitor segfault when tterm is called before tinit
  • fix stream_tcp counter underflow bug and handle max and instant stats
  • fix lzma length calculation bug
  • fix bogus 129:20 alerts
  • fix back orifice compiler warning with -O3
  • fix bug that could cause hang on ctl-C
  • fix memory leak after reload w/o changing search engine
  • fix off by one error when reassembling after TCP FIN received
  • fix cmake doc build to include plugins on SNORT_PLUGIN_PATH
  • fix compiler warnings in dce_http_server and dce_http_proxy
  • fix appid reload issue
  • snort2lua - changes for rpc over http
  • snort2lua - changes to convert config alertfile: <filename>
  • snort2lua - changes to add file_id when smb file inspection is on
  • snort2lua - add deprecated option stream5_tcp: log_asymmetric_traffic

Thursday, February 16, 2017

Snort Subscriber Rule Set Update for 02/16/2017

Just released:
Snort Subscriber Rule Set Update for 02/16/2017


We welcome the introduction of the newest rule release from Talos. In this release we introduced 17 new rules and made modifications to 8 additional rules.

There were no changes made to the snort.conf in this release.


Talos's rule release:
Talos has added and modified multiple rules in the blacklist, browser-ie, exploit-kit, file-flash, file-image, malware-cnc, malware-other, os-windows, policy-other, protocol-scada and server-webapp rule sets to provide coverage for emerging threats from these technologies.


In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats!

Tuesday, February 14, 2017

Snort Subscriber Rule Set Update for 02/14/2017

Just released:
Snort Subscriber Rule Set Update for 02/14/2017


We welcome the introduction of the newest rule release from Talos. In this release we introduced 94 new rules and made modifications to 89 additional rules.

There were no changes made to the snort.conf in this release.



Talos's rule release:
Talos has added and modified multiple rules in the blacklist, browser-ie, exploit-kit, file-executable, file-flash, file-other, indicator-compromise, malware-backdoor, malware-cnc, malware-other, server-apache and server-webapp rule sets to provide coverage for emerging threats from these technologies.


In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats!

Thursday, February 9, 2017

Snort Subscriber Rule Set Update for 02/09/2017, TicketBleed

Just released:
Snort Subscriber Rule Set Update for 02/09/2017, TicketBleed


We welcome the introduction of the newest rule release from Talos. In this release we introduced 29 new rules and made modifications to 284 additional rules.

There were no changes made to the snort.conf in this release.



Talos's rule release:
Talos has added and modified multiple rules in the blacklist, browser-ie, exploit-kit, file-office, file-pdf, indicator-compromise, indicator-obfuscation, malware-cnc, malware-other, policy-other, server-oracle and server-webapp rule sets to provide coverage for emerging threats from these technologies.
Talos has published a blog post on this subject on the Talos Blog. 


In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats!