Snort Subscriber Rule Set Update for 10/18/2016

Just released:
Snort Subscriber Rule Set Update for 10/18/2016


We welcome the introduction of the newest rule release from Talos. In this release we introduced 30 new rules and made modifications to 5 additional rules.

There were no changes made to the snort.conf in this release.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:

Yaser Mansour
40011
40234
40235


Talos's rule release:

Talos has added and modified multiple rules in the file-executable, file-office, file-pdf, malware-cnc, os-windows and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Snort Subscriber Rule Set Update for 10/13/2016

Just released:
Snort Subscriber Rule Set Update for 10/13/2016


We welcome the introduction of the newest rule release from Talos. In this release we introduced 18 new rules and made modifications to 2 additional rules.

There were no changes made to the snort.conf in this release.

Talos's rule release:

Talos has added and modified multiple rules in the browser-other, file-flash, file-office, file-pdf, malware-cnc and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Snort++ Update

Pushed build 215 to github (snortadmin/snort3):

• added module trace facility
• port block malware over ftp for clients/servers that support REST command
• port dce_udp packet processing
• change search_engine.debug_print_fast_pattern to show_fast_patterns
• overhaul appid for multiple threads, memory leaks, and coding style
• fix various appid patterns and counts
• fix fast pattern selection
• fix file hash pruning issue
• fix rate_filter action config and apply_to clean up

Snort Subscriber Rule Set Update for 10/11/2016, Release Two

Just released:
Snort Subscriber Rule Set Update for 10/11/2016, Release two


We welcome the introduction of the newest rule release from Talos. In this release we introduced 13 new rules and made modifications to 2 additional rules.

There were no changes made to the snort.conf in this release.

Talos's rule release:

Talos has added and modified multiple rules in the exploit-kit, file-flash and malware-cnc rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Snort Subscriber Rule Set Update for 10/11/2016, MSTuesday

Just released:
Snort Subscriber Rule Set Update for 10/11/2016


We welcome the introduction of the newest rule release from Talos. In this release we introduced 86 new rules and made modifications to 18 additional rules.

There were no changes made to the snort.conf in this release.



Talos's rule release:

Microsoft Security Bulletin MS16-118: Microsoft Internet Explorer suffers from programming errors that may lead to remote code execution.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 40364 through 40365, 40372 through 40375, 40378 through 40379, 40385 through 40386, 40396 through 40397, and 40420 through 40421.

Microsoft Security Bulletin MS16-119: A coding deficiency exists in Microsoft Edge that may lead to remote code execution.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 40366 through 40367, 40370 through 40371, 40383 through 40384, 40404 through 40405, 40420 through 40421, and 40423 through 40424.

Microsoft Security Bulletin MS16-120: A coding deficiency exists in Microsoft Graphics Component that may lead to remote code execution.

Previously released rules will detect attacks targeting these vulnerabilities and have been updated with the appropriate reference information. They are also included in this release and are identified with GID 1, SIDs 39824 through 39825.

New rules to detect attacks targeting these vulnerabilities are also included in this release and are identified with GID 1, SIDs 40408 through 40411 and 40425 through 40428.

Microsoft Security Bulletin MS16-121: A coding deficiency exists in Microsoft Office that may lead to remote code execution.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 40368 through 40369.

Microsoft Security Bulletin MS16-123: A coding deficiency exists in a Microsoft Kernel mode driver that may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 40376 through 40377, 40380 through 40381, 40392 through 40393, and 40418 through 40419.

Microsoft Security Bulletin MS16-124: A coding deficiency exists in a Microsoft Windows Registry that may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 40394 through 40395, 40400 through 40403, and 40412 through 40413.

Microsoft Security Bulletin MS16-125: A coding deficiency exists in a Microsoft Diagnostic Hub that may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 40398 through 40399.

Microsoft Security Bulletin MS16-126: Microsoft Internet Explorer suffers from programming errors that may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 40364 through 40365.

Talos also has added and modified multiple rules in the browser-firefox, browser-ie, browser-other, browser-plugins, deleted, exploit-kit, file-flash, file-identify, file-office, file-other, file-pdf, indicator-compromise, malware-cnc, os-windows, protocol-dns, protocol-ftp, server-apache and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Snort++ Update

Pushed build 214 to github (snortadmin/snort3):

• updated DAQ - you must use DAQ 2.2.1
• add libDAQ version to snort -V output
• add support http file upload processing and process decode/detection depths
• port sip changes to avoid using NAT ip when calculating callid
• port dce_udp autodetect and session creation
• fix static analysis issues
• fix analyzer/pig race condition
• fix explicit obfuscation disable not working
• fix ftp_data: Gracefully handle cleared flow data
• fix LuaJIT rule option memory leak of plugin name
• fix various appid issues - initial port is nearing completion
• fix http_inspect event 119:66
• fix ac_full initialization performance
• fix stream_tcp left overlap on hpux, solaris
• fix/remove 129:5 ("bad segment") events
• file_mempool: fix initializing total pool size
• fix bpf includes
• fix builds for OpenSolaris
• expected: push expected flow information through the DAQ module
• expected: expected cache revamp and related bugfixes
• ftp_data: add expected data consumption to set service name and fix bugs
• build: remove lingering libDAQ #ifdefs
• defaults: update FTP default config based on Snort2's hardcoded one
• rename default_snort_manual.* to snort_manual.*
• build docs only by explicit target (make html|pdf|text)
• update default manuals to build 213
• tolerate more spaces in ip lists
• add rev to rule latency logs
• change default latency actions to none
• deleted non-functional extra decoder for i4l_rawip

Snort Community Ruleset Winner for September 2016

The September winner of our monthly signature contest for the community ruleset is rmkml! 

For more information on how to get involved, and how you can win your Snort prizes, please take a look at our blog post. 

Good luck to all of those submitting rules in the upcoming months. We'll soon be revamping our signature contest (prizes included) so be sure to check back with our blog for updates! We look forward to a great November and beyond!

Snort Subscriber Rule Set Update for 10/06/2016

Just released:
Snort Subscriber Rule Set Update for 10/06/2016


We welcome the introduction of the newest rule release from Talos. In this release we introduced 10 new rules and made modifications to 7 additional rules.

There were no changes made to the snort.conf in this release.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:

Avery Tarasov
40251
40252


Talos's rule release:

Talos has added and modified multiple rules in the browser-ie, exploit-kit, file-pdf, malware-cnc, protocol-dns and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Snort Subscriber Rule Set Update for 10/04/2016

Just released:
Snort Subscriber Rule Set Update for 10/04/2016


We welcome the introduction of the newest rule release from Talos. In this release we introduced 20 new rules and made modifications to 6 additional rules.

There were no changes made to the snort.conf in this release.



Talos's rule release:

Talos has added and modified multiple rules in the app-detect, malware-cnc, protocol-scada, server-apache and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Snort Subscriber Rule Set Update for 09/29/2016

Just released:
Snort Subscriber Rule Set Update for 09/29/2016


We welcome the introduction of the newest rule release from Talos. In this release we introduced 17 new rules and made modifications to 2 additional rules.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset


Talos's rule release:

Talos has added and modified multiple rules in the app-detect, file-image, file-other, malware-cnc, protocol-scada, protocol-voip, server-apache and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!