©2026 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
Talos has added and modified multiple rules in the malware-cnc, os-other, os-windows, server-mail and server-webapp rule sets to provide coverage for emerging threats from these technologies.
For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2092000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:67485 <-> ENABLED <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt (server-webapp.rules) * 1:67486 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt (os-windows.rules) * 1:67487 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt (os-windows.rules) * 1:67488 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt (os-windows.rules) * 1:67489 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt (os-windows.rules) * 1:67490 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection (malware-cnc.rules) * 1:67491 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection (malware-cnc.rules) * 3:67492 <-> ENABLED <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt (os-other.rules) * 3:67493 <-> ENABLED <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt (os-other.rules)
* 1:67365 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67364 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:62480 <-> DISABLED <-> SERVER-MAIL Exim SMTP Server remote execution attempt (server-mail.rules) * 1:66513 <-> ENABLED <-> MALWARE-CNC Win.Infostealer.XWorm variant communication (malware-cnc.rules) * 1:67368 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67366 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67369 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67370 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67371 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67372 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67373 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67374 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67363 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67367 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091801.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:67487 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt (os-windows.rules) * 1:67491 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection (malware-cnc.rules) * 1:67488 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt (os-windows.rules) * 1:67490 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection (malware-cnc.rules) * 1:67485 <-> ENABLED <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt (server-webapp.rules) * 1:67489 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt (os-windows.rules) * 1:67486 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt (os-windows.rules) * 3:67492 <-> ENABLED <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt (os-other.rules) * 3:67493 <-> ENABLED <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt (os-other.rules)
* 1:67366 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67367 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:62480 <-> DISABLED <-> SERVER-MAIL Exim SMTP Server remote execution attempt (server-mail.rules) * 1:67373 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67374 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:66513 <-> ENABLED <-> MALWARE-CNC Win.Infostealer.XWorm variant communication (malware-cnc.rules) * 1:67364 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67369 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67370 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67371 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67363 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67368 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67365 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67372 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091701.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:67485 <-> ENABLED <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt (server-webapp.rules) * 1:67486 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt (os-windows.rules) * 1:67491 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection (malware-cnc.rules) * 1:67487 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt (os-windows.rules) * 1:67488 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt (os-windows.rules) * 1:67490 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection (malware-cnc.rules) * 1:67489 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt (os-windows.rules) * 3:67492 <-> ENABLED <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt (os-other.rules) * 3:67493 <-> ENABLED <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt (os-other.rules)
* 1:66513 <-> ENABLED <-> MALWARE-CNC Win.Infostealer.XWorm variant communication (malware-cnc.rules) * 1:67369 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67363 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67364 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67366 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67365 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:62480 <-> DISABLED <-> SERVER-MAIL Exim SMTP Server remote execution attempt (server-mail.rules) * 1:67371 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67374 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67370 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67372 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67373 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67367 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules) * 1:67368 <-> DISABLED <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate (server-other.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.2.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301752 <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt * 1:301753 <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt * 1:67485 <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt * 3:67492 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 3:67493 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 7:74 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection * 7:75 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection
* 1:62480 <-> SERVER-MAIL Exim SMTP Server remote execution attempt * 1:67363 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67364 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67365 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67366 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67367 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67368 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67369 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67370 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67371 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67372 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67373 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67374 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 7:9 <-> MALWARE-CNC Win.Infostealer.XWorm variant communication
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.3.5.1.
The format of the file is:
gid:sid <-> Message
* 1:301752 <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt * 1:301753 <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt * 1:67485 <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt * 3:67492 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 3:67493 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 7:74 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection * 7:75 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection
* 1:62480 <-> SERVER-MAIL Exim SMTP Server remote execution attempt * 1:67363 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67364 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67365 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67366 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67367 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67368 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67369 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67370 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67371 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67372 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67373 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67374 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 7:9 <-> MALWARE-CNC Win.Infostealer.XWorm variant communication
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.3.6.0.
The format of the file is:
gid:sid <-> Message
* 1:301752 <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt * 1:301753 <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt * 1:67485 <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt * 3:67492 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 3:67493 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 7:74 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection * 7:75 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection
* 1:62480 <-> SERVER-MAIL Exim SMTP Server remote execution attempt * 1:67363 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67364 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67365 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67366 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67367 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67368 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67369 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67370 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67371 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67372 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67373 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67374 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 7:9 <-> MALWARE-CNC Win.Infostealer.XWorm variant communication
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.3.7.0.
The format of the file is:
gid:sid <-> Message
* 1:301752 <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt * 1:301753 <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt * 1:67485 <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt * 3:67492 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 3:67493 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 7:74 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection * 7:75 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection
* 1:62480 <-> SERVER-MAIL Exim SMTP Server remote execution attempt * 1:67363 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67364 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67365 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67366 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67367 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67368 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67369 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67370 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67371 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67372 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67373 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67374 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 7:9 <-> MALWARE-CNC Win.Infostealer.XWorm variant communication
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.7.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301752 <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt * 1:301753 <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt * 1:67485 <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt * 3:67492 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 3:67493 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 7:74 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection * 7:75 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection
* 1:62480 <-> SERVER-MAIL Exim SMTP Server remote execution attempt * 1:67363 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67364 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67365 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67366 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67367 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67368 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67369 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67370 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67371 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67372 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67373 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67374 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 7:9 <-> MALWARE-CNC Win.Infostealer.XWorm variant communication
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.9.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301752 <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt * 1:301753 <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt * 1:67485 <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt * 3:67492 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 3:67493 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 7:74 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection * 7:75 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection
* 1:62480 <-> SERVER-MAIL Exim SMTP Server remote execution attempt * 1:67363 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67364 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67365 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67366 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67367 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67368 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67369 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67370 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67371 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67372 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67373 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67374 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 7:9 <-> MALWARE-CNC Win.Infostealer.XWorm variant communication
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.11.0.
The format of the file is:
gid:sid <-> Message
* 1:301752 <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt * 1:301753 <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt * 1:67485 <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt * 3:67492 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 3:67493 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 7:74 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection * 7:75 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection
* 1:62480 <-> SERVER-MAIL Exim SMTP Server remote execution attempt * 1:67363 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67364 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67365 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67366 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67367 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67368 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67369 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67370 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67371 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67372 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67373 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67374 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 7:9 <-> MALWARE-CNC Win.Infostealer.XWorm variant communication
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.15.0.
The format of the file is:
gid:sid <-> Message
* 1:301752 <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt * 1:301753 <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt * 1:67485 <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt * 3:67492 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 3:67493 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 7:74 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection * 7:75 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection
* 1:62480 <-> SERVER-MAIL Exim SMTP Server remote execution attempt * 1:67363 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67364 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67365 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67366 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67367 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67368 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67369 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67370 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67371 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67372 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67373 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67374 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 7:9 <-> MALWARE-CNC Win.Infostealer.XWorm variant communication
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.18.0.
The format of the file is:
gid:sid <-> Message
* 1:301752 <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt * 1:301753 <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt * 1:67485 <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt * 3:67492 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 3:67493 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 7:74 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection * 7:75 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection
* 1:62480 <-> SERVER-MAIL Exim SMTP Server remote execution attempt * 1:67363 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67364 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67365 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67366 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67367 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67368 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67369 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67370 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67371 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67372 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67373 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67374 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 7:9 <-> MALWARE-CNC Win.Infostealer.XWorm variant communication
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.12.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301752 <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt * 1:301753 <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt * 1:67485 <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt * 3:67492 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 3:67493 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 7:74 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection * 7:75 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection
* 1:62480 <-> SERVER-MAIL Exim SMTP Server remote execution attempt * 1:67363 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67364 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67365 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67366 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67367 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67368 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67369 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67370 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67371 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67372 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67373 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67374 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 7:9 <-> MALWARE-CNC Win.Infostealer.XWorm variant communication
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.21.0.
The format of the file is:
gid:sid <-> Message
* 1:301752 <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt * 1:301753 <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt * 1:67485 <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt * 3:67492 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 3:67493 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 7:74 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection * 7:75 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection
* 1:62480 <-> SERVER-MAIL Exim SMTP Server remote execution attempt * 1:67363 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67364 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67365 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67366 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67367 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67368 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67369 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67370 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67371 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67372 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67373 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67374 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 7:9 <-> MALWARE-CNC Win.Infostealer.XWorm variant communication
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.35.0.
The format of the file is:
gid:sid <-> Message
* 1:301752 <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt * 1:301753 <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt * 1:67485 <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt * 3:67492 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 3:67493 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 7:74 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection * 7:75 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection
* 1:62480 <-> SERVER-MAIL Exim SMTP Server remote execution attempt * 1:67363 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67364 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67365 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67366 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67367 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67368 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67369 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67370 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67371 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67372 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67373 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67374 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 7:9 <-> MALWARE-CNC Win.Infostealer.XWorm variant communication
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.44.0.
The format of the file is:
gid:sid <-> Message
* 1:301752 <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt * 1:301753 <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt * 1:67485 <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt * 3:67492 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 3:67493 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 7:74 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection * 7:75 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection
* 1:62480 <-> SERVER-MAIL Exim SMTP Server remote execution attempt * 1:67363 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67364 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67365 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67366 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67367 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67368 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67369 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67370 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67371 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67372 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67373 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67374 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 7:9 <-> MALWARE-CNC Win.Infostealer.XWorm variant communication
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.47.0.
The format of the file is:
gid:sid <-> Message
* 1:301752 <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt * 1:301753 <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt * 1:67485 <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt * 3:67492 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 3:67493 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 7:74 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection * 7:75 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection
* 1:62480 <-> SERVER-MAIL Exim SMTP Server remote execution attempt * 1:67363 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67364 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67365 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67366 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67367 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67368 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67369 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67370 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67371 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67372 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67373 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67374 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 7:9 <-> MALWARE-CNC Win.Infostealer.XWorm variant communication
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.11.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301752 <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt * 1:301753 <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt * 1:67485 <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt * 3:67492 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 3:67493 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 7:74 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection * 7:75 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection
* 1:62480 <-> SERVER-MAIL Exim SMTP Server remote execution attempt * 1:67363 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67364 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67365 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67366 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67367 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67368 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67369 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67370 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67371 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67372 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67373 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67374 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 7:9 <-> MALWARE-CNC Win.Infostealer.XWorm variant communication
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.12.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301752 <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt * 1:301753 <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt * 1:67485 <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt * 3:67492 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 3:67493 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 7:74 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection * 7:75 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection
* 1:62480 <-> SERVER-MAIL Exim SMTP Server remote execution attempt * 1:67363 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67364 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67365 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67366 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67367 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67368 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67369 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67370 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67371 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67372 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67373 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67374 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 7:9 <-> MALWARE-CNC Win.Infostealer.XWorm variant communication
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.13.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301752 <-> OS-WINDOWS Microsoft Windows NetBIOS elevation of privilege attempt * 1:301753 <-> OS-WINDOWS Microsoft Windows Management Instrumentation elevation of privilege attempt * 1:67485 <-> SERVER-WEBAPP Collabora Online Built-in CODE Server proxy.php command injection attempt * 3:67492 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 3:67493 <-> OS-OTHER TRUFFLEHUNTER TALOS-2026-2658 attack attempt * 7:74 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection * 7:75 <-> MALWARE-CNC Win.Trojan.Goodgame variant outbound connection
* 1:62480 <-> SERVER-MAIL Exim SMTP Server remote execution attempt * 1:67363 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67364 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67365 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67366 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67367 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67368 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67369 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67370 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67371 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67372 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67373 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 1:67374 <-> SERVER-OTHER eMudhra compromised intermediate TLS CA certificate * 7:9 <-> MALWARE-CNC Win.Infostealer.XWorm variant communication
©2026 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.