Snort 2.9.7.6 has been released!

Please join us in welcoming the newest release of Snort, Version 2.9.7.6!

Below are the release notes for this version:

2015-08-17 Snort 2.9.7.6
[*] New additions
  * Added support for detecting 'SSH tunneling over HTTP'.

[*] Improvements
  * Behavioral change in file processing to block malware files in inline-test mode also.

  * Improvements to XFF handling in case of pipelined HTTP requests. 

  * Stability improvements for Stream6 preprocessor.

  * Resolved an issue where min_ttl decoder was dropping packets in alert mode also.

  * Added improved support to inspect unlimited packets in HTTP.

  * Resolved an issue where reputation config incorrectly displayed 'blacklist' in
    priority field even though 'whitelist' option was configured.

The Snort Team would like to thank the following community members for their contributions to Snort 2.9.7.6:

Mike Cox
Gabriel Corre
Bill Parker
Avery Rozar

If you'd like to be a contributor to Snort, large or small, code changes or manual corrections, we'd love to have you.   Please join our Snort-devel mailing list and submit your ideas/changes/corrections there.

Snort Subscriber Rule Set Update for 09/29/2015

Just released:
Snort Subscriber Rule Set Update for 09/29/2015

We welcome the introduction of the newest rule release from Talos. In this release we introduced 30 new rules and made modifications to 308 additional rules.

There were no changes made to the snort.conf in this release.

Talos would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:

Yaser Mansour
36202

Talos's rule release:

Talos has added and modified multiple rules in the blacklist, browser-firefox, browser-ie, browser-other, browser-plugins, exploit-kit, file-flash, file-image, file-java, file-multimedia, file-office, file-other, file-pdf, indicator-shellcode, malware-cnc, malware-other, os-other, policy-other, protocol-ftp, protocol-rpc, protocol-voip, server-mail, server-other and sql rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Snort OpenAppID Detectors have been updated!

An update has been released today for the Snort OpenAppID Detector content.

This release, build 252, includes

• A total of 2,636 detectors.
• This was a maintenance release with some minor fixes and improvements
• It also includes some additional detectors that came in from the open source community. For more details on which contributions were included, we have added them in the AUTHORS file in this package.

Available now for download from our downloads page, we look forward to you downloading and using the new features of 2.9.7.0's OpenAppID preprocessor and sharing your experiences with the community.

The OpenAppID community has a mailing list specifically dedicated to the exchange and discussion of detector content.  Please visit the mailing lists page to sign up.

Snort++ Update

Pushed build 171 to github (snortadmin/snort3):

• fix metadata:service to work like 2x
• fixed issues when building with LINUX_SMP
• fixed frag tracker accounting
• fix Xcode builds
• implement 116:281 decoder rule
• udpated snort2lua
• add cpputest for unit testing
• don't apply cooked verdicts to raw packets

Snort Subscriber Rule Set Update for 09/24/2015

Just released:
Snort Subscriber Rule Set Update for 09/24/2015

We welcome the introduction of the newest rule release from Talos. In this release we introduced 22 new rules and made modifications to 10 additional rules.

There were no changes made to the snort.conf in this release.

Talos's rule release:

Talos has added and modified multiple rules in the blacklist, browser-ie, deleted, file-flash, file-pdf, malware-cnc, os-windows, policy-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Snort Subscriber Rule Set Update for 09/22/2015

Just released:
Snort Subscriber Rule Set Update for 09/23/2015

We welcome the introduction of the newest rule release from Talos. In this release we introduced 82 new rules and made modifications to 28 additional rules.

There were no changes made to the snort.conf in this release.

Talos's rule release:

Talos has added and modified multiple rules in the blacklist, browser-ie, browser-plugins, file-flash, file-identify, file-multimedia, file-office, indicator-obfuscation, malware-cnc, protocol-dns and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Snort++ Update

Pushed build 170 to github (snortadmin/snort3):

• removed unused control socket defines from cmake
• fixed build error with valgrind build option
• cleanup *FLAGS use in configure.ac
• change configure.ac compiler search order to prefer clang over gcc
• update where to get dnet
• update usage and bug list
• move extra daqs and extra hext logger to main source tree
• fix breakloop in file daq
• fix plain file processing
• fix detection of stream_user and stream_file data
• log innermost proto for type of broken packets

Snort Subscriber Rule Set Update for 09/17/2015

Just released:
Snort Subscriber Rule Set Update for 09/17/2015

We welcome the introduction of the newest rule release from Talos. In this release we introduced 41 new rules and made modifications to 30 additional rules.

There were no changes made to the snort.conf in this release.

Talos's rule release:

Talos has added and modified multiple rules in the app-detect, browser-ie, exploit-kit, file-identify, file-office, file-pdf, indicator-obfuscation, malware-cnc, protocol-dns and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Snort Subscriber Rule Set Update for 09/15/2015, SYNful Knock Malware

Just released:
Snort Subscriber Rule Set Update for 09/15/2015

We welcome the introduction of the newest rule release from Talos. In this release we introduced 18 new rules and made modifications to 0 additional rules.

There were no changes made to the snort.conf in this release.


Talos's rule release:

SYNful Knock Backdoor Connection Attempt: Routers have been discovered running malicious router images containing backdoors. A rule to detect C&C traffic corresponding with this malware is included in this release and is identified with GID 1, SID 36054. 

Talos has also added and modified multiple rules in the blacklist and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!

Snort Subscriber Rule Set Update for 09/10/2015

Just released:
Snort Subscriber Rule Set Update for 09/10/2015

We welcome the introduction of the newest rule release from Talos. In this release we introduced 15 new rules and made modifications to 4 additional rules.

There were no changes made to the snort.conf in this release.

Talos's rule release:

Talos has added and modified multiple rules in the file-flash, file-office, indicator-compromise, indicator-obfuscation, malware-backdoor, malware-cnc, os-windows and server-webapp rule sets to provide coverage for emerging threats from these technologies.

In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://www.snort.org/products. Make sure and stay up to date to catch the most emerging threats!