Apologizes to Yaser Mansour yesterday, we published three of his rules, and I didn't include his rules in the Community list!
So, thanks to Yaser Mansour for his rules:
29492
29493
29494
The community ruleset is doing great. We've added hundreds of rules since its inception in March, and I get more inquiries all the time about contributing!
Friday, January 31, 2014
Thursday, January 30, 2014
Sourcefire VRT Certified Snort Rules Update for 01/30/2014
Just released:
Sourcefire VRT Certified Snort Rules Update for 01/30/2014
We welcome the introduction of the newest rule release from the VRT. In this release we introduced 19 new rules and made modifications to 15 additional rules.
There were no changes made to the
In VRT's rule release:
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Sourcefire VRT Certified Snort Rules Update for 01/30/2014
We welcome the introduction of the newest rule release from the VRT. In this release we introduced 19 new rules and made modifications to 15 additional rules.
There were no changes made to the
snort.conf in this release.In VRT's rule release:
The Sourcefire VRT has added and modified multiple rules in the blacklist, browser-webkit, exploit-kit, file-java, file-multimedia, malware-cnc, pua-adware and server-webapp rule sets to provide coverage for emerging threats from these technologies.
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Snort 2.9.6.0's manual has been posted!
As many of you may know, the Snort Manual is always included within the tarball in the /docs directory.
However, I always keep the PDF on http://www.snort.org/docs and the HTML version over at http://manual.snort.org updated as well. I've just updated the two manuals to the latest version.
Thanks!
However, I always keep the PDF on http://www.snort.org/docs and the HTML version over at http://manual.snort.org updated as well. I've just updated the two manuals to the latest version.
Thanks!
Snort 2.9.6.0 Install Guides have been posted!
William Parker diligently has updated his great Install Guides for Snort 2.9.6.0 and sent them in. I've uploaded them to the usual spot here: http://www.snort.org/docs
Thanks so much William, your guides and contributions to the community are great!
Thanks so much William, your guides and contributions to the community are great!
Wednesday, January 29, 2014
EOL dates posted for Snort 2.9.4.6 and Snort 2.9.5.5
Greetings everyone. Just wanted to update the site now that we have released Snort 2.9.6.0 with the new EOL dates for VRT rules support for Snort versions 2.9.4.6 and Snort 2.9.5.5.
Please take a look at the updated dates and plan accordingly!
https://www.snort.org/eol
Make sure your review the policy, and if there are any questions, please be sure and ask.
Please take a look at the updated dates and plan accordingly!
https://www.snort.org/eol
Make sure your review the policy, and if there are any questions, please be sure and ask.
Tuesday, January 28, 2014
Sourcefire VRT Certified Snort Rules Update for 01/28/2014
Just released:
Sourcefire VRT Certified Snort Rules Update for 01/28/2014
We welcome the introduction of the newest rule release from the VRT. In this release we introduced 3 new rules and made modifications to 1 additional rule.
There were no changes made to the
In VRT's rule release:
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Sourcefire VRT Certified Snort Rules Update for 01/28/2014
We welcome the introduction of the newest rule release from the VRT. In this release we introduced 3 new rules and made modifications to 1 additional rule.
There were no changes made to the
snort.conf in this release.In VRT's rule release:
The Sourcefire VRT has added and modified multiple rules in the policy-social rule set to provide coverage for emerging threats from these technologies.
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Friday, January 24, 2014
Snort 2.9.6.0 is now available!
Snort 2.9.6.0 is now available on Snort.org, at https://www.snort.org/downloads in the Latest Release section.
See the Release Notes and ChangeLog for more details.
Please submit bugs, questions, and feedback to bugs@snort.org.
Happy Snorting! The Snort Release Team
[*] New additions
* Add support to do file specific processing within DCERPC preprocessor for
files being transferred over SMB.
* File capture and storage -- saves files as they traverse the network via a
new preprocessor that ties in support within HTTP, FTP, SMTP, POP, IMAP,
and SMB. See README.file and README.file_server (under tools/file_server)
for details.
* Add <= and >= operators to byte_test rule option.
* Update SMTP to detect Cyrus SASL authentication attack.
* Add capability to capture a single session from start to end.
* EXPERIMENTAL: Add support to leverage file type identification in snort
rules. See README.file_ips for details.
[*] Improvements
* Only inject active responses when a TCP session is established.
* Update the POP and IMAP protocols to support simple PAF for improved
identification and capture of files.
* Update SMTP, POP, IMAP to improve inspection when mime boundaries are
split across packets.
* Address issue to address end of line incorrectly for Quoted Printable
email attachments.
* Handle out of order SSL handshake in SMTP when STARTTLS is used and
fix checks for SSL type only within the SSL hand shake.
* Update sensitive data preprocessor to handle a stateful search of
patterns across multiple packets.
* Address a few issues in the Snort manual and other READMEs for flowbits
and tunneling.
* Save off packet data for quicker debugging in case of a SIGABRT or SIGBUS.
* Fix alignment of sfxhash node for SPARC platforms.
See the Release Notes and ChangeLog for more details.
Please submit bugs, questions, and feedback to bugs@snort.org.
Happy Snorting! The Snort Release Team
Wednesday, January 22, 2014
Sourcefire VRT Certified Snort Rules Update for 01/22/2014
Just released:
Sourcefire VRT Certified Snort Rules Update for 01/22/2014
We welcome the introduction of the newest rule release from the VRT. In this release we introduced 63 new rules and made modifications to 42 additional rules.
There were no changes made to the
The VRT would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Avery Tarasov:
In VRT's rule release:
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Sourcefire VRT Certified Snort Rules Update for 01/22/2014
We welcome the introduction of the newest rule release from the VRT. In this release we introduced 63 new rules and made modifications to 42 additional rules.
There were no changes made to the
snort.conf in this release.
The VRT would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Avery Tarasov:
29395
29396
29397
29398
29399
In VRT's rule release:
The Sourcefire VRT has added and modified multiple rules in the app-detect, blacklist, browser-firefox, browser-plugins, exploit-kit, file-identify, file-image, file-java, file-multimedia, file-office, file-other, file-pdf, indicator-compromise, malware-cnc, os-mobile, policy-spam, protocol-icmp, protocol-rpc, pua-adware and server-webapp rule sets to provide coverage for emerging threats from these technologies.
In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Tuesday, January 21, 2014
Libpcap 1.5.3 has been released
A quick follow up to an earlier post I put up on the blog concerning Libpcap version 1.5.2: http://blog.snort.org/2014/01/reported-libpcap-152-issues.html
Libpcap has release 1.5.3 which appears to fix the issues caused by 1.5.2. We haven't fully tested it, but under initial assessment, it seems to clear up the issues.
Libpcap has release 1.5.3 which appears to fix the issues caused by 1.5.2. We haven't fully tested it, but under initial assessment, it seems to clear up the issues.
Labels:
snort
Thursday, January 16, 2014
Sourcefire VRT Certified Snort Rules Update for 01/16/2014
Just released:
Sourcefire VRT Certified Snort Rules Update for 01/16/2014
We welcome the introduction of the newest rule release from the VRT. In this release we introduced 35 new rules and made modifications to 2 additional rules.
There were no changes made to the
The VRT would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Yaser Mansour:
29377
29378
29379
29380
In VRT's rule release:
Sourcefire VRT Certified Snort Rules Update for 01/16/2014
We welcome the introduction of the newest rule release from the VRT. In this release we introduced 35 new rules and made modifications to 2 additional rules.
There were no changes made to the
snort.conf in this release.
The VRT would like to thank the following individuals for their contributions, their rules are included in the Community Ruleset:
Yaser Mansour:
29377
29378
29379
29380
In VRT's rule release:
The Sourcefire VRT has added and modified multiple rules in the app-detect, blacklist, browser-webkit, dos, exploit-kit, file-identify, file-pdf, malware-cnc, malware-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
Subscribe to:
Posts (Atom)