Talos Rules 2019-07-16
This release adds and modifies rules in several categories.

Talos has added and modified multiple rules in the deleted, file-flash, file-image, file-other, file-pdf, indicator-compromise, malware-cnc, malware-other, os-linux, os-other, os-windows, protocol-dns, server-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.

For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.

Change logs

29140

2019-07-16 12:14:42 UTC

Snort Subscriber Rules Update

Date: 2019-07-16

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091400.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:50722 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid dref atom length buffer overflow attempt (file-other.rules)
 * 1:50721 <-> DISABLED <-> OS-WINDOWS Microsoft Windows malformed NTLMv2 authentication message attempt (os-windows.rules)
 * 1:50720 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 video integer underflow attempt (file-other.rules)
 * 1:50719 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 video integer underflow attempt (file-other.rules)
 * 1:50718 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 length integer underflow attempt (file-other.rules)
 * 1:50717 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Plurox variant outbound connection (malware-cnc.rules)
 * 1:50716 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Plurox variant outbound connection (malware-cnc.rules)
 * 1:50715 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Trickbot sample download attempt (malware-cnc.rules)
 * 1:50714 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot self-signed certificate exchange attempt (malware-other.rules)
 * 1:50713 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot sample download attempt (malware-other.rules)
 * 1:50712 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot sample download attempt (malware-other.rules)
 * 1:50737 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50736 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50735 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50734 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50733 <-> DISABLED <-> SERVER-WEBAPP CyberArk Enterprise Password Vault XML external entity injection attempt (server-webapp.rules)
 * 1:50732 <-> DISABLED <-> SERVER-WEBAPP CyberArk Enterprise Password Vault XML external entity injection attempt (server-webapp.rules)
 * 1:50729 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50728 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50727 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50726 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50725 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50724 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50723 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid dref atom length buffer overflow attempt (file-other.rules)
 * 3:50730 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0856 attack attempt (file-pdf.rules)
 * 3:50731 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0856 attack attempt (file-pdf.rules)
 * 3:50738 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0855 attack attempt (file-pdf.rules)
 * 3:50739 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0855 attack attempt (file-pdf.rules)

Modified Rules:


 * 1:23400 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 length integer underflow attempt (file-other.rules)
 * 1:33022 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid rdrf atom length buffer overflow attempt (file-other.rules)
 * 1:49288 <-> DISABLED <-> INDICATOR-COMPROMISE avi file without matching file magic (indicator-compromise.rules)
 * 1:49287 <-> DISABLED <-> INDICATOR-COMPROMISE avi file without matching file magic (indicator-compromise.rules)
 * 1:33023 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid rdrf atom length buffer overflow attempt (file-other.rules)

29130

2019-07-16 12:14:42 UTC

Snort Subscriber Rules Update

Date: 2019-07-16

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091300.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:50733 <-> DISABLED <-> SERVER-WEBAPP CyberArk Enterprise Password Vault XML external entity injection attempt (server-webapp.rules)
 * 1:50723 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid dref atom length buffer overflow attempt (file-other.rules)
 * 1:50718 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 length integer underflow attempt (file-other.rules)
 * 1:50712 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot sample download attempt (malware-other.rules)
 * 1:50715 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Trickbot sample download attempt (malware-cnc.rules)
 * 1:50714 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot self-signed certificate exchange attempt (malware-other.rules)
 * 1:50732 <-> DISABLED <-> SERVER-WEBAPP CyberArk Enterprise Password Vault XML external entity injection attempt (server-webapp.rules)
 * 1:50737 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50734 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50735 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50736 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50717 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Plurox variant outbound connection (malware-cnc.rules)
 * 1:50716 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Plurox variant outbound connection (malware-cnc.rules)
 * 1:50722 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid dref atom length buffer overflow attempt (file-other.rules)
 * 1:50724 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50725 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50726 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50727 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50728 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50720 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 video integer underflow attempt (file-other.rules)
 * 1:50721 <-> DISABLED <-> OS-WINDOWS Microsoft Windows malformed NTLMv2 authentication message attempt (os-windows.rules)
 * 1:50713 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot sample download attempt (malware-other.rules)
 * 1:50719 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 video integer underflow attempt (file-other.rules)
 * 1:50729 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 3:50730 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0856 attack attempt (file-pdf.rules)
 * 3:50731 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0856 attack attempt (file-pdf.rules)
 * 3:50738 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0855 attack attempt (file-pdf.rules)
 * 3:50739 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0855 attack attempt (file-pdf.rules)

Modified Rules:


 * 1:49287 <-> DISABLED <-> INDICATOR-COMPROMISE avi file without matching file magic (indicator-compromise.rules)
 * 1:49288 <-> DISABLED <-> INDICATOR-COMPROMISE avi file without matching file magic (indicator-compromise.rules)
 * 1:23400 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 length integer underflow attempt (file-other.rules)
 * 1:33023 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid rdrf atom length buffer overflow attempt (file-other.rules)
 * 1:33022 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid rdrf atom length buffer overflow attempt (file-other.rules)

29120

2019-07-16 12:14:42 UTC

Snort Subscriber Rules Update

Date: 2019-07-16

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091200.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:50724 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50715 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Trickbot sample download attempt (malware-cnc.rules)
 * 1:50734 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50719 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 video integer underflow attempt (file-other.rules)
 * 1:50736 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50737 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50735 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50718 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 length integer underflow attempt (file-other.rules)
 * 1:50723 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid dref atom length buffer overflow attempt (file-other.rules)
 * 1:50725 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50733 <-> DISABLED <-> SERVER-WEBAPP CyberArk Enterprise Password Vault XML external entity injection attempt (server-webapp.rules)
 * 1:50721 <-> DISABLED <-> OS-WINDOWS Microsoft Windows malformed NTLMv2 authentication message attempt (os-windows.rules)
 * 1:50722 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid dref atom length buffer overflow attempt (file-other.rules)
 * 1:50714 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot self-signed certificate exchange attempt (malware-other.rules)
 * 1:50720 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 video integer underflow attempt (file-other.rules)
 * 1:50716 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Plurox variant outbound connection (malware-cnc.rules)
 * 1:50713 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot sample download attempt (malware-other.rules)
 * 1:50712 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot sample download attempt (malware-other.rules)
 * 1:50726 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50727 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50728 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50729 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50717 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Plurox variant outbound connection (malware-cnc.rules)
 * 1:50732 <-> DISABLED <-> SERVER-WEBAPP CyberArk Enterprise Password Vault XML external entity injection attempt (server-webapp.rules)
 * 3:50739 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0855 attack attempt (file-pdf.rules)
 * 3:50731 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0856 attack attempt (file-pdf.rules)
 * 3:50738 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0855 attack attempt (file-pdf.rules)
 * 3:50730 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0856 attack attempt (file-pdf.rules)

Modified Rules:


 * 1:49288 <-> DISABLED <-> INDICATOR-COMPROMISE avi file without matching file magic (indicator-compromise.rules)
 * 1:49287 <-> DISABLED <-> INDICATOR-COMPROMISE avi file without matching file magic (indicator-compromise.rules)
 * 1:33022 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid rdrf atom length buffer overflow attempt (file-other.rules)
 * 1:33023 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid rdrf atom length buffer overflow attempt (file-other.rules)
 * 1:23400 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 length integer underflow attempt (file-other.rules)

29111

2019-07-16 12:14:42 UTC

Snort Subscriber Rules Update

Date: 2019-07-16

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091101.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:50733 <-> DISABLED <-> SERVER-WEBAPP CyberArk Enterprise Password Vault XML external entity injection attempt (server-webapp.rules)
 * 1:50735 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50719 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 video integer underflow attempt (file-other.rules)
 * 1:50732 <-> DISABLED <-> SERVER-WEBAPP CyberArk Enterprise Password Vault XML external entity injection attempt (server-webapp.rules)
 * 1:50734 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50724 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50736 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50720 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 video integer underflow attempt (file-other.rules)
 * 1:50713 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot sample download attempt (malware-other.rules)
 * 1:50715 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Trickbot sample download attempt (malware-cnc.rules)
 * 1:50729 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50721 <-> DISABLED <-> OS-WINDOWS Microsoft Windows malformed NTLMv2 authentication message attempt (os-windows.rules)
 * 1:50723 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid dref atom length buffer overflow attempt (file-other.rules)
 * 1:50716 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Plurox variant outbound connection (malware-cnc.rules)
 * 1:50717 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Plurox variant outbound connection (malware-cnc.rules)
 * 1:50712 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot sample download attempt (malware-other.rules)
 * 1:50722 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid dref atom length buffer overflow attempt (file-other.rules)
 * 1:50714 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot self-signed certificate exchange attempt (malware-other.rules)
 * 1:50718 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 length integer underflow attempt (file-other.rules)
 * 1:50737 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50725 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50728 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50726 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50727 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 3:50731 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0856 attack attempt (file-pdf.rules)
 * 3:50739 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0855 attack attempt (file-pdf.rules)
 * 3:50738 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0855 attack attempt (file-pdf.rules)
 * 3:50730 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0856 attack attempt (file-pdf.rules)

Modified Rules:


 * 1:33022 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid rdrf atom length buffer overflow attempt (file-other.rules)
 * 1:33023 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid rdrf atom length buffer overflow attempt (file-other.rules)
 * 1:49288 <-> DISABLED <-> INDICATOR-COMPROMISE avi file without matching file magic (indicator-compromise.rules)
 * 1:49287 <-> DISABLED <-> INDICATOR-COMPROMISE avi file without matching file magic (indicator-compromise.rules)
 * 1:23400 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 length integer underflow attempt (file-other.rules)

3000

2019-07-16 12:14:42 UTC

Snort Subscriber Rules Update

Date: 2019-07-16

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3000.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:50717 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Plurox variant outbound connection (snort3-malware-cnc.rules)
 * 1:50722 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid dref atom length buffer overflow attempt (snort3-file-other.rules)
 * 1:50736 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (snort3-malware-cnc.rules)
 * 1:50721 <-> DISABLED <-> OS-WINDOWS Microsoft Windows malformed NTLMv2 authentication message attempt (snort3-os-windows.rules)
 * 1:50734 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (snort3-malware-cnc.rules)
 * 1:50735 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (snort3-malware-cnc.rules)
 * 1:50712 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot sample download attempt (snort3-malware-other.rules)
 * 1:50715 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Trickbot sample download attempt (snort3-malware-cnc.rules)
 * 1:50723 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid dref atom length buffer overflow attempt (snort3-file-other.rules)
 * 1:50737 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (snort3-malware-cnc.rules)
 * 1:50724 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (snort3-server-webapp.rules)
 * 1:50716 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Plurox variant outbound connection (snort3-malware-cnc.rules)
 * 1:50713 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot sample download attempt (snort3-malware-other.rules)
 * 1:50727 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (snort3-server-webapp.rules)
 * 1:50725 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (snort3-server-webapp.rules)
 * 1:50718 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 length integer underflow attempt (snort3-file-other.rules)
 * 1:50719 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 video integer underflow attempt (snort3-file-other.rules)
 * 1:50714 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot self-signed certificate exchange attempt (snort3-malware-other.rules)
 * 1:50726 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (snort3-server-webapp.rules)
 * 1:50720 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 video integer underflow attempt (snort3-file-other.rules)
 * 1:50729 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (snort3-server-webapp.rules)
 * 1:50733 <-> DISABLED <-> SERVER-WEBAPP CyberArk Enterprise Password Vault XML external entity injection attempt (snort3-server-webapp.rules)
 * 1:50728 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (snort3-server-webapp.rules)
 * 1:50732 <-> DISABLED <-> SERVER-WEBAPP CyberArk Enterprise Password Vault XML external entity injection attempt (snort3-server-webapp.rules)

Modified Rules:


 * 1:33022 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid rdrf atom length buffer overflow attempt (snort3-file-other.rules)
 * 1:49288 <-> DISABLED <-> INDICATOR-COMPROMISE avi file without matching file magic (snort3-indicator-compromise.rules)
 * 1:23400 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 length integer underflow attempt (snort3-file-other.rules)
 * 1:49287 <-> DISABLED <-> INDICATOR-COMPROMISE avi file without matching file magic (snort3-indicator-compromise.rules)
 * 1:33023 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid rdrf atom length buffer overflow attempt (snort3-file-other.rules)

2990

2019-07-16 12:14:42 UTC

Snort Subscriber Rules Update

Date: 2019-07-16

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2990.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:50737 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50724 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50729 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50728 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50722 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid dref atom length buffer overflow attempt (file-other.rules)
 * 1:50735 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50732 <-> DISABLED <-> SERVER-WEBAPP CyberArk Enterprise Password Vault XML external entity injection attempt (server-webapp.rules)
 * 1:50712 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot sample download attempt (malware-other.rules)
 * 1:50714 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot self-signed certificate exchange attempt (malware-other.rules)
 * 1:50733 <-> DISABLED <-> SERVER-WEBAPP CyberArk Enterprise Password Vault XML external entity injection attempt (server-webapp.rules)
 * 1:50717 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Plurox variant outbound connection (malware-cnc.rules)
 * 1:50736 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50720 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 video integer underflow attempt (file-other.rules)
 * 1:50719 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 video integer underflow attempt (file-other.rules)
 * 1:50713 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot sample download attempt (malware-other.rules)
 * 1:50718 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 length integer underflow attempt (file-other.rules)
 * 1:50727 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50726 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50725 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50723 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid dref atom length buffer overflow attempt (file-other.rules)
 * 1:50721 <-> DISABLED <-> OS-WINDOWS Microsoft Windows malformed NTLMv2 authentication message attempt (os-windows.rules)
 * 1:50716 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Plurox variant outbound connection (malware-cnc.rules)
 * 1:50715 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Trickbot sample download attempt (malware-cnc.rules)
 * 1:50734 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 3:50730 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0856 attack attempt (file-pdf.rules)
 * 3:50731 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0856 attack attempt (file-pdf.rules)
 * 3:50738 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0855 attack attempt (file-pdf.rules)
 * 3:50739 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0855 attack attempt (file-pdf.rules)

Modified Rules:


 * 1:49287 <-> DISABLED <-> INDICATOR-COMPROMISE avi file without matching file magic (indicator-compromise.rules)
 * 1:49288 <-> DISABLED <-> INDICATOR-COMPROMISE avi file without matching file magic (indicator-compromise.rules)
 * 1:33023 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid rdrf atom length buffer overflow attempt (file-other.rules)
 * 1:23400 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 length integer underflow attempt (file-other.rules)
 * 1:33022 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid rdrf atom length buffer overflow attempt (file-other.rules)

2983

2019-07-16 12:14:42 UTC

Snort Subscriber Rules Update

Date: 2019-07-16

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:50732 <-> DISABLED <-> SERVER-WEBAPP CyberArk Enterprise Password Vault XML external entity injection attempt (server-webapp.rules)
 * 1:50735 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50720 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 video integer underflow attempt (file-other.rules)
 * 1:50713 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot sample download attempt (malware-other.rules)
 * 1:50718 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 length integer underflow attempt (file-other.rules)
 * 1:50733 <-> DISABLED <-> SERVER-WEBAPP CyberArk Enterprise Password Vault XML external entity injection attempt (server-webapp.rules)
 * 1:50734 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50721 <-> DISABLED <-> OS-WINDOWS Microsoft Windows malformed NTLMv2 authentication message attempt (os-windows.rules)
 * 1:50714 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot self-signed certificate exchange attempt (malware-other.rules)
 * 1:50712 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Trickbot sample download attempt (malware-other.rules)
 * 1:50715 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Trickbot sample download attempt (malware-cnc.rules)
 * 1:50727 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50728 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50737 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50717 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Plurox variant outbound connection (malware-cnc.rules)
 * 1:50716 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Plurox variant outbound connection (malware-cnc.rules)
 * 1:50723 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid dref atom length buffer overflow attempt (file-other.rules)
 * 1:50719 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 video integer underflow attempt (file-other.rules)
 * 1:50722 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid dref atom length buffer overflow attempt (file-other.rules)
 * 1:50726 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50725 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50724 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 1:50736 <-> ENABLED <-> MALWARE-CNC Andr.Trojan.Anubis variant outbound connection (malware-cnc.rules)
 * 1:50729 <-> DISABLED <-> SERVER-WEBAPP Zoom Client information disclosure attempt (server-webapp.rules)
 * 3:50739 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0855 attack attempt (file-pdf.rules)
 * 3:50730 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0856 attack attempt (file-pdf.rules)
 * 3:50738 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0855 attack attempt (file-pdf.rules)
 * 3:50731 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2019-0856 attack attempt (file-pdf.rules)

Modified Rules:


 * 1:23400 <-> DISABLED <-> FILE-OTHER Apple Quicktime JPEG2000 length integer underflow attempt (file-other.rules)
 * 1:33022 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid rdrf atom length buffer overflow attempt (file-other.rules)
 * 1:49288 <-> DISABLED <-> INDICATOR-COMPROMISE avi file without matching file magic (indicator-compromise.rules)
 * 1:49287 <-> DISABLED <-> INDICATOR-COMPROMISE avi file without matching file magic (indicator-compromise.rules)
 * 1:33023 <-> DISABLED <-> FILE-OTHER Apple Quicktime invalid rdrf atom length buffer overflow attempt (file-other.rules)