Snort

An update has been released today for the Snort OpenAppID Detector content. This release, build 308, includes A total of 2,833 detectors.  It also includes some additional detectors that came in from the open source community. For more details on ... [More] which contributions were included, we have added them in the AUTHORS file in this package. Available now for download from our downloads page, we look forward to you downloading and using the new features of 2.9.12.0's OpenAppID preprocessor and sharing your experiences with the community.The OpenAppID community has a mailing list specifically dedicated to the exchange and discussion of detector content.  Please visit the mailing lists page to sign up. [Less]

An update has been released today for the Snort OpenAppID Detector content. This release, build 308, includes: A total of 2,833 detectors.  It also includes some additional detectors that came in from the open source community. For more details on ... [More] which contributions were included, we have added them in the AUTHORS file in this package. Available now for download from our downloads page, we look forward to you downloading and using the new features of 2.9.12.0's OpenAppID preprocessor and sharing your experiences with the community. The OpenAppID community has a mailing list specifically dedicated to the exchange and discussion of detector content.  Please visit the mailing lists page to sign up. [Less]

Just released:Snort Subscriber Rule Set Update for Jan. 10, 2019Cisco Talos released the newest SNORTⓇ rule set today. In this release, we introduced 19 new rules, none of which are shared object rules. There are also 56 modified rules.This release ... [More] continues to provide coverage for a slew of bugs that Adobe reported in Acrobat and Reader earlier this month. It also includes new protection against the UPPERCUT backdoor, most recently seen in the wild being used by APT10.There were no changes made to the snort.conf in this release.Talos's rule release:Talos has added and modified multiple rules in the browser-ie, file-image, file-other, file-pdf, indicator-compromise, malware-cnc and server-webapp rule sets to provide coverage for emerging threats from these technologies.As a reminder, today is the last day that we will be covering Snort version 2.9.11.0. We urge everyone using that version to update as soon as possible.You can subscribe to Talos' newest rule detection functionality for as low as $29 a year with a personal account. Be sure and see our business pricing as well here. Make sure and stay up to date to catch the most emerging threats. [Less]

This is a reminder that SNORTⓇ version 2.9.11.0 will be shut down tomorrow, Jan. 10.We first notified users that this version of Snort was reaching its end of life in October as the number of users began to wane. We encouraged everyone to update to ... [More] the latest version of Snort to avoid any service interruptions.We are working on revising Snort’s end-of-life policy for other versions going forward. We will begin to shut down versions of Snort that make up 10 percent or less of our downloads or superseded versions have been around for five years, which ever comes first. We will release more details about this in the future. [Less]

Cisco users with Firepower Threat Defense (FTD) on an Adaptive Security Appliance (ASA) are running SNORTⓇ, our open-source intrusion protection system, under the hood, along with a suite of other Talos-fueled security processes. Snort monitors ... [More] traffic by sniffing packets and comparing their contents against tens of thousands of rules written to find all kinds of malware and other malicious activity. Our analysts are constantly creating new rules to cover vulnerabilities in a wide range of products. The highly active open-source community around Snort adds rules for general and niche network configurations, as well.When Snort sends up an alert — whether that shows in the FTD console or in a command prompt — the user takes over to provide that human element required to research the alert, find out how their network might be affected and respond appropriately.The first resource is the alert, which comes with a brief message, followed by the documentation for the rule that triggered the alert. FTD users can currently see the alert, rule, and any documentation for that SID without leaving the console. Self-compilers need to go the extra step to Snort.org to see the rule. Soon, FTD customers will be directed Snort.org as well, as the end-all repository of data and documentation on Snort.So What’s the Problem?  Users on either the FTD or open-source side may have noticed that the rule documentation is often sparse. At the rate new rules come out, putting out quality documentation is a challenge. This stems from a lack of context — users need the context of why this alert appeared and how it affects them, while analysts don’t always know the context of the users’ needs, their level of understanding, or particular network configurations.So we’re polling the Snort community to find out what you need. What you really need, not what we think you do, or what is easiest for us to provide. We want changes to have an impact on users in order to improve their experience and the quality of Snort.To facilitate this, we’re sending out a survey to all users. Depending on how deep you want to go, the survey takes around five minutes to finish. We are also adding feedback options to Snort rule documentation pages. Let us know if a page was useful or not. If not, leave a note about what you came looking for and couldn't find. Perhaps we can add it, to better educate the community.Our hope is that with the feedback we receive from the survey, our analysts can provide targeted information to communicate the most useful details on rule alerts. The more information we gather on customer frustrations, the better chance we have of finding ways to solve them to create a community and customer base with the right arsenal to overcome their security challenges.Link to Survey: https://www.research.net/r/27CHJCH [Less]

Just released:Snort Subscriber Rule Set Update for Jan. 8, 2019The newest SNORTⓇ rule set is here from Cisco Talos. In this release, we introduced 50 new rules, none of which are shared object rules. There are also eight modified rules, including ... [More] two that are shared object rules.This release covers Microsoft Patch Tuesday, which included fixes for 49 vulnerabilities. You can read more about the bugs that Microsoft disclosed over at the Talos blog.There were no changes made to the snort.conf in this release.Talos's rule release:Microsoft Vulnerability CVE-2019-0539: A coding deficiency exists in Microsoft Chakra Scripting Engine that may lead to remote code execution.  Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 48772 through 48773.  Microsoft Vulnerability CVE-2019-0541: A coding deficiency exists in Microsoft Internet Explorer that may lead to remote code execution.  Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 48782 through 48783.  Microsoft Vulnerability CVE-2019-0543: A coding deficiency exists in Microsoft Windows that may lead to elevation of privilege.  Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 48807 through 48808.  Microsoft Vulnerability CVE-2019-0552: A coding deficiency exists in Microsoft Windows COM that may lead to elevation of privilege.  Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 48787 through 48788.  Microsoft Vulnerability CVE-2019-0555: A coding deficiency exists in Microsoft XmlDocument that may lead to elevation of privilege.  Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 48795 through 48798.  Microsoft Vulnerability CVE-2019-0565: A coding deficiency exists in Microsoft Edge that may lead to remote code execution.  Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 48770 through 48771.  Microsoft Vulnerability CVE-2019-0566: A coding deficiency exists in Microsoft Edge that may lead to elevation of privilege.  Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 48809 through 48810.  Microsoft Vulnerability CVE-2019-0567: A coding deficiency exists in Microsoft Chakra Scripting Engine that may lead to remote code execution.  Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 48780 through 48781.  Microsoft Vulnerability CVE-2019-0568: A coding deficiency exists in Microsoft Chakra Scripting Engine that may lead to remote code execution.  Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 48778 through 48779.  Microsoft Vulnerability CVE-2019-0569: A coding deficiency exists in Microsoft Windows Kernel that may lead to information disclosure.  Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 48789 through 48790.  Microsoft Vulnerability CVE-2019-0572: A coding deficiency exists in Microsoft Windows Data Sharing Service that may lead to elevation of privilege.  A rule to detect attacks targeting this vulnerability is included in this release and is identified with GID 1, SID 48776 and 48777.  Microsoft Vulnerability CVE-2019-0573: A coding deficiency exists in Microsoft Windows Data Sharing Service that may lead to elevation of privilege.  Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 48793 through 48794.  Microsoft Vulnerability CVE-2019-0574: A coding deficiency exists in Microsoft Windows Data Sharing Service that may lead to elevation of privilege.  Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 48768 through 48769.  Talos also has added and modified multiple rules in the browser-ie, file-executable, file-other, file-pdf, malware-cnc, malware-other, os-windows and server-webapp rule sets to provide coverage for emerging threats from these technologies.You can subscribe to Talos' newest rule detection functionality for as low as $29 a year with a personal account. Be sure and see our business pricing as well here. Make sure and stay up to date to catch the most emerging threats.  [Less]

After a brief hiatus, the SNORTⓇ community rule contest is back. Here at Snort, we always strive to improve our detection. And we appreciate it when our community joins in the fight against the bad guys.We are reviving the contest as a way to thank ... [More] those of you who regularly engage with us and submit rules that we wind up deploying. While the old contest ran on a monthly basis, this time around, we will be giving out prizes on a quarterly basis.Each quarter, we will give out a Snort-themed prize — whether it be a calendar, T-shirt, mug or something else exciting — to the community member who submits the most rules to us during that time. Be sure to follow us on Twitter each quarter to see who the winner is. If you are the winner, be sure to keep an eye out in your inbox for details on how to claim your prize.We are accepting signatures into the community ruleset (GPLv2 licensed) via the Snort-Sigs mailing list, which anyone may join here. If you’d like to submit to the Snort ruleset please include your rule and research behind it (pcap, ASCII dump, references, etc.).When we receive a signature, we will follow our standard internal procedures (which involves heavy QA of the signature, testing, optimization for performance, and perhaps sending the rule out to our internal and external testing groups).You may reference the Snort Users Manual for general rules questions, as well as of course discussing it among fellow Snort rule writers in the aforementioned mailing list.The rules will be released in the Snort rule set and are available to our customers and the Snort community as a whole via our normal community rule distribution process, published daily, with full attribution given to the author.As always, false positive reports belong here after logging in.The highest submitter for accepted rules for each quarter will receive some Snort goodies. Keep in mind that we must accept the rules for them to be counted toward your total for the quarter. For example, if you write a rule for an ICMP response on the network, we are not going to accept it.We thank the community in advance for rule submissions, as well as continued submission of false positive reports. [Less]

Just released:Snort Subscriber Rule Set Update for 01/03/2019We welcome the introduction of the newest rule release from Talos. In this release we introduced 18 new rules of which 1 are Shared Object rules and made modifications to 8 additional rules ... [More] of which 0 are Shared Object rules. There were no changes made to the snort.conf in this release. Talos would like to thank the following individuals for their contributions, their rules are included in the Community RulesetTalos's rule release: Talos has added and modified multiple rules in the deleted, file-other, file-pdf and server-webapp rule sets to provide coverage for emerging threats from these technologies. In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats! [Less]

Just released:Snort Subscriber Rule Set Update for 12/27/2018We welcome the introduction of the newest rule release from Talos. In this release we introduced 44 new rules of which 0 are Shared Object rules and made modifications to 51 additional ... [More] rules of which 0 are Shared Object rules. There were no changes made to the snort.conf in this release. Talos would like to thank the following individuals for their contributions, their rules are included in the Community RulesetTalos's rule release: Talos has added and modified multiple rules in the browser-ie, file-image, file-other, file-pdf, indicator-compromise, malware-cnc, malware-other and server-webapp rule sets to provide coverage for emerging threats from these technologies. In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats! [Less]

Just released:Snort Subscriber Rule Set Update for 12/20/2018We welcome the introduction of the newest rule release from Talos. In this release we introduced 4 new rules of which 0 are Shared Object rules and made modifications to 6 additional rules ... [More] of which 0 are Shared Object rules. There were no changes made to the snort.conf in this release.Talos's rule release: Talos has added and modified multiple rules in the browser-ie rule sets to provide coverage for emerging threats from these technologies. In order to subscribe now to Talos's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at https://snort.org/products#rule_subscriptions. Make sure and stay up to date to catch the most emerging threats! [Less]