Talos Rules 2016-03-03
This release modifies several rules.

Talos has modified multiple rules in the policy-other rule set to provide coverage for emerging threats from these technologies.

Change logs

2016-03-03 23:41:50 UTC

Snort Subscriber Rules Update

Date: 2016-03-03

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2976.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


Modified Rules:


 * 1:37923 <-> DISABLED <-> POLICY-OTHER Shockwave Flash file using doswf packer (policy-other.rules)
 * 1:37922 <-> DISABLED <-> POLICY-OTHER Shockwave Flash suspicious flash file using URLDownloadToFileA (policy-other.rules)
 * 1:37928 <-> DISABLED <-> POLICY-OTHER Shockwave Flash suspicious flash file using URLDownloadToFileA (policy-other.rules)
 * 1:37929 <-> DISABLED <-> POLICY-OTHER Shockwave Flash file using doswf packer (policy-other.rules)

2016-03-03 23:41:50 UTC

Snort Subscriber Rules Update

Date: 2016-03-03

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2980.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


Modified Rules:


 * 1:37929 <-> DISABLED <-> POLICY-OTHER Shockwave Flash file using doswf packer (policy-other.rules)
 * 1:37928 <-> DISABLED <-> POLICY-OTHER Shockwave Flash suspicious flash file using URLDownloadToFileA (policy-other.rules)
 * 1:37923 <-> DISABLED <-> POLICY-OTHER Shockwave Flash file using doswf packer (policy-other.rules)
 * 1:37922 <-> DISABLED <-> POLICY-OTHER Shockwave Flash suspicious flash file using URLDownloadToFileA (policy-other.rules)

2016-03-03 23:41:50 UTC

Snort Subscriber Rules Update

Date: 2016-03-03

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2962.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


Modified Rules:


 * 1:37929 <-> DISABLED <-> POLICY-OTHER Shockwave Flash file using doswf packer (policy-other.rules)
 * 1:37928 <-> DISABLED <-> POLICY-OTHER Shockwave Flash suspicious flash file using URLDownloadToFileA (policy-other.rules)
 * 1:37923 <-> DISABLED <-> POLICY-OTHER Shockwave Flash file using doswf packer (policy-other.rules)
 * 1:37922 <-> DISABLED <-> POLICY-OTHER Shockwave Flash suspicious flash file using URLDownloadToFileA (policy-other.rules)