Talos Rules 2017-02-14
This release adds and modifies rules in several categories.

Talos has added and modified multiple rules in the blacklist, browser-ie, deleted, exploit-kit, file-executable, file-flash, file-other, indicator-compromise, malware-backdoor, malware-cnc, malware-other, server-apache and server-webapp rule sets to provide coverage for emerging threats from these technologies.

For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.

Change logs

2017-02-14 19:53:00 UTC

Snort Subscriber Rules Update

Date: 2017-02-14

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2976.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:41641 <-> DISABLED <-> FILE-EXECUTABLE QuickHeal Internet Security malformed Mach-O file buffer overflow attempt (file-executable.rules)
 * 1:41634 <-> DISABLED <-> DELETED JZUG1wVRPVZOLCvEyoHz (deleted.rules)
 * 1:41587 <-> DISABLED <-> DELETED v6YNZkcOtoUt4lazjOZg (deleted.rules)
 * 1:41590 <-> DISABLED <-> DELETED tB8in5OHkHx3L0ni1p1I (deleted.rules)
 * 1:41581 <-> DISABLED <-> DELETED lm06mVLIekQJco8ymvCj (deleted.rules)
 * 1:41583 <-> DISABLED <-> DELETED 2104Je8NeYdUapqjyLKN (deleted.rules)
 * 1:41579 <-> DISABLED <-> DELETED tYwrGluX5dObfE6sY3GA (deleted.rules)
 * 1:41580 <-> DISABLED <-> DELETED xozrA27GE3bw8z1WGapk (deleted.rules)
 * 1:41577 <-> DISABLED <-> DELETED 9G9ad7eS9ApSYjQCeMop (deleted.rules)
 * 1:41578 <-> DISABLED <-> DELETED JnY2cb8F710UF6d9lQSp (deleted.rules)
 * 1:41574 <-> DISABLED <-> DELETED 0GQx9qNGzD5JvIgsNsLU (deleted.rules)
 * 1:41575 <-> DISABLED <-> DELETED iXbkLX1dAAlk183HBDqc (deleted.rules)
 * 1:41572 <-> DISABLED <-> DELETED Jo29KjldkTlEL6ev8eBR (deleted.rules)
 * 1:41573 <-> DISABLED <-> DELETED AaEnRMGjoABYzg5s2InU (deleted.rules)
 * 1:41569 <-> DISABLED <-> DELETED SvuhTNxfofLNh6BDRK33 (deleted.rules)
 * 1:41570 <-> DISABLED <-> DELETED j9s3YbYVyYWsbrtQ3uIs (deleted.rules)
 * 1:41567 <-> DISABLED <-> DELETED pTXs7KUhQRGhaWTgKbb7 (deleted.rules)
 * 1:41568 <-> DISABLED <-> DELETED kF3nigJ4JNVVk6rUu4Y3 (deleted.rules)
 * 1:41564 <-> DISABLED <-> DELETED gTgCA88UF8renb5O9NNQ (deleted.rules)
 * 1:41565 <-> DISABLED <-> DELETED j1CGK1PYbr0q4ETiGl8i (deleted.rules)
 * 1:41562 <-> DISABLED <-> DELETED OAFbssmWYTUcAmr92XiO (deleted.rules)
 * 1:41563 <-> DISABLED <-> DELETED fK4NDvjETaezKM19vsBD (deleted.rules)
 * 1:41559 <-> DISABLED <-> DELETED vLuzJQZoy0uX2rfCGyX7 (deleted.rules)
 * 1:41560 <-> DISABLED <-> DELETED 2xy4LeeaJZxrNUR2Zrjn (deleted.rules)
 * 1:41557 <-> DISABLED <-> DELETED nsW9dVJiXbmLiVxuruv3 (deleted.rules)
 * 1:41558 <-> DISABLED <-> DELETED 0dSWPnm7dz6Fcf70zGIL (deleted.rules)
 * 1:41554 <-> DISABLED <-> DELETED oeXHcWOaoDqO97LWE3im (deleted.rules)
 * 1:41555 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer use asm memory corruption attempt (browser-ie.rules)
 * 1:41553 <-> DISABLED <-> DELETED n0AKi5Jy0HRovEdANpIJ (deleted.rules)
 * 1:41550 <-> DISABLED <-> DELETED 9PiGK20daqQ4NG2yUmHJ (deleted.rules)
 * 1:41552 <-> DISABLED <-> DELETED j0lVhTQQnlFPNV8WbXjw (deleted.rules)
 * 1:41549 <-> DISABLED <-> DELETED 3KS9XNn1eqWy808Nag8X (deleted.rules)
 * 1:41624 <-> ENABLED <-> FILE-FLASH Adobe Flash Player MessageChannel type confusion attempt (file-flash.rules)
 * 1:41606 <-> DISABLED <-> DELETED DyPtd537A4oTXII67lLY (deleted.rules)
 * 1:41608 <-> DISABLED <-> DELETED DlljTt5vFr4wpoNJnBJD (deleted.rules)
 * 1:41607 <-> DISABLED <-> DELETED rAZFmWHsPbKcUty7MgrA (deleted.rules)
 * 1:41610 <-> DISABLED <-> DELETED kOVvZrK2dixrCRdcdldP (deleted.rules)
 * 1:41612 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder luminance adjustment out of bounds memory access attempt (file-other.rules)
 * 1:41611 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder luminance adjustment out of bounds memory access attempt (file-other.rules)
 * 1:41613 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41615 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41616 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41640 <-> DISABLED <-> FILE-EXECUTABLE QuickHeal Internet Security malformed Mach-O file buffer overflow attempt (file-executable.rules)
 * 1:41584 <-> DISABLED <-> DELETED xQLvvhaNbAQnF8Jikc0m (deleted.rules)
 * 1:41623 <-> ENABLED <-> FILE-FLASH Adobe Flash Player MessageChannel type confusion attempt (file-flash.rules)
 * 1:41604 <-> DISABLED <-> FILE-FLASH Adobe Flash player BitmapData class use after free attempt (file-flash.rules)
 * 1:41603 <-> DISABLED <-> FILE-FLASH Adobe Flash player BitmapData class use after free attempt (file-flash.rules)
 * 1:41602 <-> DISABLED <-> DELETED aw5zsD18HZVNLa9fNWB7 (deleted.rules)
 * 1:41551 <-> DISABLED <-> DELETED qS9HxX8E8ZuwjJmc2QYy (deleted.rules)
 * 1:41609 <-> DISABLED <-> DELETED Vehj0FCBGiPlqED8fNo1 (deleted.rules)
 * 1:41556 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer use asm memory corruption attempt (browser-ie.rules)
 * 1:41561 <-> DISABLED <-> DELETED WEJm6bj4v3duVaDCRGYl (deleted.rules)
 * 1:41566 <-> DISABLED <-> DELETED eh2wYUkuI278GyheZZwI (deleted.rules)
 * 1:41571 <-> DISABLED <-> DELETED HIFsM6I1zeAoJJ5Yf5li (deleted.rules)
 * 1:41614 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41576 <-> DISABLED <-> DELETED l77NiJB8YylQIdXeb6CM (deleted.rules)
 * 1:41582 <-> DISABLED <-> DELETED A9MKNbvdALHvn3CdLpqv (deleted.rules)
 * 1:41617 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41618 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41619 <-> DISABLED <-> FILE-FLASH Adobe Flash Player addEventListener use after free attempt (file-flash.rules)
 * 1:41620 <-> DISABLED <-> FILE-FLASH Adobe Flash Player addEventListener use after free attempt (file-flash.rules)
 * 1:41621 <-> DISABLED <-> FILE-FLASH Adobe Flash malformed FLV heap overflow attempt (file-flash.rules)
 * 1:41601 <-> DISABLED <-> DELETED QFHU2S6OJHLagIz6pOvI (deleted.rules)
 * 1:41599 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CPeerHolder use after free attempt (browser-ie.rules)
 * 1:41600 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CPeerHolder use after free attempt (browser-ie.rules)
 * 1:41597 <-> DISABLED <-> DELETED bpYVBffSltC9snfZm375 (deleted.rules)
 * 1:41598 <-> DISABLED <-> DELETED tlGo6aXOokNuyU1LDLf2 (deleted.rules)
 * 1:41595 <-> DISABLED <-> DELETED YCkW8nqU9F5eK8z8YSbn (deleted.rules)
 * 1:41596 <-> DISABLED <-> DELETED 92rMZYmep1qp65DS5D1V (deleted.rules)
 * 1:41593 <-> DISABLED <-> DELETED 7ZUEraI3djmWkEg1YJQz (deleted.rules)
 * 1:41594 <-> DISABLED <-> DELETED QB7rs3Z2BDil1quuJNKT (deleted.rules)
 * 1:41591 <-> DISABLED <-> DELETED SZEKQhOGrioANnhLEW71 (deleted.rules)
 * 1:41592 <-> DISABLED <-> DELETED 0POZmpuYEnQ8DWiFvIqZ (deleted.rules)
 * 1:41588 <-> DISABLED <-> DELETED 2rR4CIpZQ1oZBLU01E4M (deleted.rules)
 * 1:41589 <-> DISABLED <-> DELETED BKyoksClYkHqRyMDLret (deleted.rules)
 * 1:41622 <-> DISABLED <-> FILE-FLASH Adobe Flash malformed FLV heap overflow attempt (file-flash.rules)
 * 1:41633 <-> DISABLED <-> DELETED sxNxlO0jW0maiNpR7aM4 (deleted.rules)
 * 1:41625 <-> DISABLED <-> DELETED 1Yn0o2sUhWRHdpZIYQCe (deleted.rules)
 * 1:41626 <-> DISABLED <-> DELETED A8bNNfsFmpiJzXVSVbt6 (deleted.rules)
 * 1:41629 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PSDK EventDispatch removeEventListener use after free attempt (file-flash.rules)
 * 1:41627 <-> ENABLED <-> FILE-FLASH Adobe Flash Player garbage collection use after free attempt (file-flash.rules)
 * 1:41630 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PSDK EventDispatch removeEventListener use after free attempt (file-flash.rules)
 * 1:41628 <-> ENABLED <-> FILE-FLASH Adobe Flash Player garbage collection use after free attempt (file-flash.rules)
 * 1:41632 <-> ENABLED <-> FILE-OTHER Adobe Flash Player mp4 h264 decompression routine out of bounds read attempt (file-other.rules)
 * 1:41631 <-> ENABLED <-> FILE-OTHER Adobe Flash Player mp4 h264 decompression routine out of bounds read attempt (file-other.rules)
 * 1:41585 <-> DISABLED <-> DELETED xePvFEaRV1KmQNOzRGXH (deleted.rules)
 * 1:41586 <-> DISABLED <-> DELETED GXtNgBGUZsao7PElnBoI (deleted.rules)
 * 1:41637 <-> DISABLED <-> INDICATOR-COMPROMISE Writable SQL directories discovery attempt (indicator-compromise.rules)
 * 1:41635 <-> ENABLED <-> FILE-OTHER Adobe AcrobatDC EMF buffer underflow attempt (file-other.rules)
 * 1:41638 <-> DISABLED <-> SERVER-WEBAPP Wordpress NextGEN gallery directory traversal attempt (server-webapp.rules)
 * 1:41636 <-> ENABLED <-> FILE-OTHER Adobe AcrobatDC EMF buffer underflow attempt (file-other.rules)
 * 1:41639 <-> DISABLED <-> SERVER-WEBAPP Wordpress NextGEN gallery directory traversal attempt (server-webapp.rules)
 * 1:41642 <-> DISABLED <-> SERVER-WEBAPP TP-LINK AC750 ping diagnostic command injection attempt (server-webapp.rules)
 * 1:41605 <-> DISABLED <-> DELETED ILkVCsobqFaujNaEjEQV (deleted.rules)

Modified Rules:


 * 1:41122 <-> ENABLED <-> BLACKLIST DNS request for known malware domain editprod.waterfilter.in.ua (blacklist.rules)
 * 1:39220 <-> ENABLED <-> BROWSER-IE Microsoft Edge edgehtml.dll uninitialized pointer vulnerability attempt (browser-ie.rules)
 * 1:38681 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Tooka POST attempt (malware-cnc.rules)
 * 1:39219 <-> ENABLED <-> BROWSER-IE Microsoft Edge edgehtml.dll uninitialized pointer vulnerability attempt (browser-ie.rules)
 * 1:38260 <-> ENABLED <-> MALWARE-CNC PowerShell Empire outbound request (malware-cnc.rules)
 * 1:38729 <-> ENABLED <-> SERVER-OTHER Mediabridge Medialink MWN-WAPR300N and Tenda N3 Wireless N150 inbound admin attempt (server-other.rules)
 * 1:38607 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection (malware-cnc.rules)
 * 1:38610 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Godzilla downloader successful base64 binary download (malware-cnc.rules)
 * 1:38261 <-> ENABLED <-> MALWARE-CNC PowerShell Empire outbound request (malware-cnc.rules)
 * 1:38259 <-> ENABLED <-> MALWARE-CNC PowerShell Empire outbound request (malware-cnc.rules)
 * 1:37091 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PrintJob object use-after-free attempt (file-flash.rules)
 * 1:37679 <-> ENABLED <-> FILE-FLASH Adobe Flash player ASNative textField use after free attempt (file-flash.rules)
 * 1:37680 <-> ENABLED <-> FILE-FLASH Adobe Flash player ASNative textField use after free attempt (file-flash.rules)
 * 1:37076 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:37089 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PrintJob object use-after-free attempt (file-flash.rules)
 * 1:37090 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PrintJob object use-after-free attempt (file-flash.rules)
 * 1:37088 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PrintJob object use-after-free attempt (file-flash.rules)
 * 1:37075 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:37072 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:37073 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:37074 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:37071 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:34842 <-> DISABLED <-> MALWARE-CNC Win.Trojan.DownExecute outbound connection (malware-cnc.rules)
 * 1:35783 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Jiripbot variant outbound connection (malware-cnc.rules)
 * 1:33756 <-> DISABLED <-> MALWARE-CNC Win.Ransomware.CTB-Locker outbound connection (malware-cnc.rules)
 * 1:35035 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Taleretzbj outbound connection  (malware-cnc.rules)
 * 1:33812 <-> ENABLED <-> SERVER-WEBAPP Seagate NAS remote code execution attempt (server-webapp.rules)
 * 1:33880 <-> DISABLED <-> MALWARE-CNC Win.Backdoor.Casper outbound connection (malware-cnc.rules)
 * 1:33166 <-> ENABLED <-> SERVER-OTHER IBM Tivoli Endpoint Manager Mobile Device Management remote code execution attempt (server-other.rules)
 * 1:33757 <-> DISABLED <-> MALWARE-CNC Win.Ransomware.CTB-Locker outbound connection (malware-cnc.rules)
 * 1:33168 <-> ENABLED <-> SERVER-OTHER IBM Tivoli Endpoint Manager Mobile Device Management remote code execution attempt (server-other.rules)
 * 1:33169 <-> ENABLED <-> SERVER-OTHER IBM Tivoli Endpoint Manager Mobile Device Management remote code execution attempt (server-other.rules)
 * 1:32555 <-> ENABLED <-> EXPLOIT-KIT Hellspawn exploit kit outbound Oracle Java jar request (exploit-kit.rules)
 * 1:33167 <-> ENABLED <-> SERVER-OTHER IBM Tivoli Endpoint Manager Mobile Device Management remote code execution attempt (server-other.rules)
 * 1:32623 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Regin outbound connection (malware-cnc.rules)
 * 1:32753 <-> ENABLED <-> SERVER-WEBAPP FreePBX Framework Asterisk recording interface PHP unserialize code execution attempt (server-webapp.rules)
 * 1:29863 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Pirminay variant outbound connection (malware-cnc.rules)
 * 1:32622 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Regin outbound connection (malware-cnc.rules)
 * 1:31896 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Magnetor vairant outbound connection (malware-cnc.rules)
 * 1:31944 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Tavdig outbound connection (malware-cnc.rules)
 * 1:28516 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:31682 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Badur download attempt (malware-cnc.rules)
 * 1:28985 <-> DISABLED <-> MALWARE-CNC Win.Worm.Steckt IRCbot executable download (malware-cnc.rules)
 * 1:28879 <-> DISABLED <-> MALWARE-CNC Win.Backdoor.Tavdig variant outbound connection (malware-cnc.rules)
 * 1:28509 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:28517 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:28511 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:28515 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:27601 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Noobot variant connection (malware-cnc.rules)
 * 1:28510 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:28305 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Mecifg variant outbound connection (malware-cnc.rules)
 * 1:28315 <-> DISABLED <-> FILE-OTHER Microsoft Office Image filter BMP overflow attempt (file-other.rules)
 * 1:24285 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Nomno variant outbound connection (malware-cnc.rules)
 * 1:27804 <-> DISABLED <-> MALWARE-CNC Win.Trojan.PRISM variant outbound connection (malware-cnc.rules)
 * 1:26777 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Kazy variant outbound connection (malware-cnc.rules)
 * 1:27057 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Dalbot variant outbound connection (malware-cnc.rules)
 * 1:26529 <-> DISABLED <-> MALWARE-BACKDOOR Unix.Backdoor.Cdorked backdoor command attempt (malware-backdoor.rules)
 * 1:21074 <-> DISABLED <-> SERVER-APACHE Apache Struts remote code execution attempt - CookieInterceptor (server-apache.rules)
 * 1:21555 <-> DISABLED <-> MALWARE-OTHER Horde javascript.php href backdoor (malware-other.rules)
 * 3:36228 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0060 attack attempt (file-other.rules)
 * 3:36225 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0060 attack attempt (file-other.rules)
 * 3:36226 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0060 attack attempt (file-other.rules)
 * 3:41221 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2016-0234 attack attempt (server-webapp.rules)
 * 3:41467 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2017-0276 TALOS-2017-0277 attack attempt (server-other.rules)
 * 3:36227 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0060 attack attempt (file-other.rules)

2017-02-14 19:53:00 UTC

Snort Subscriber Rules Update

Date: 2017-02-14

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:41633 <-> DISABLED <-> DELETED sxNxlO0jW0maiNpR7aM4 (deleted.rules)
 * 1:41632 <-> ENABLED <-> FILE-OTHER Adobe Flash Player mp4 h264 decompression routine out of bounds read attempt (file-other.rules)
 * 1:41630 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PSDK EventDispatch removeEventListener use after free attempt (file-flash.rules)
 * 1:41628 <-> ENABLED <-> FILE-FLASH Adobe Flash Player garbage collection use after free attempt (file-flash.rules)
 * 1:41629 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PSDK EventDispatch removeEventListener use after free attempt (file-flash.rules)
 * 1:41626 <-> DISABLED <-> DELETED A8bNNfsFmpiJzXVSVbt6 (deleted.rules)
 * 1:41627 <-> ENABLED <-> FILE-FLASH Adobe Flash Player garbage collection use after free attempt (file-flash.rules)
 * 1:41624 <-> ENABLED <-> FILE-FLASH Adobe Flash Player MessageChannel type confusion attempt (file-flash.rules)
 * 1:41625 <-> DISABLED <-> DELETED 1Yn0o2sUhWRHdpZIYQCe (deleted.rules)
 * 1:41622 <-> DISABLED <-> FILE-FLASH Adobe Flash malformed FLV heap overflow attempt (file-flash.rules)
 * 1:41623 <-> ENABLED <-> FILE-FLASH Adobe Flash Player MessageChannel type confusion attempt (file-flash.rules)
 * 1:41620 <-> DISABLED <-> FILE-FLASH Adobe Flash Player addEventListener use after free attempt (file-flash.rules)
 * 1:41621 <-> DISABLED <-> FILE-FLASH Adobe Flash malformed FLV heap overflow attempt (file-flash.rules)
 * 1:41618 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41619 <-> DISABLED <-> FILE-FLASH Adobe Flash Player addEventListener use after free attempt (file-flash.rules)
 * 1:41616 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41617 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41599 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CPeerHolder use after free attempt (browser-ie.rules)
 * 1:41600 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CPeerHolder use after free attempt (browser-ie.rules)
 * 1:41598 <-> DISABLED <-> DELETED tlGo6aXOokNuyU1LDLf2 (deleted.rules)
 * 1:41596 <-> DISABLED <-> DELETED 92rMZYmep1qp65DS5D1V (deleted.rules)
 * 1:41597 <-> DISABLED <-> DELETED bpYVBffSltC9snfZm375 (deleted.rules)
 * 1:41594 <-> DISABLED <-> DELETED QB7rs3Z2BDil1quuJNKT (deleted.rules)
 * 1:41595 <-> DISABLED <-> DELETED YCkW8nqU9F5eK8z8YSbn (deleted.rules)
 * 1:41593 <-> DISABLED <-> DELETED 7ZUEraI3djmWkEg1YJQz (deleted.rules)
 * 1:41591 <-> DISABLED <-> DELETED SZEKQhOGrioANnhLEW71 (deleted.rules)
 * 1:41592 <-> DISABLED <-> DELETED 0POZmpuYEnQ8DWiFvIqZ (deleted.rules)
 * 1:41590 <-> DISABLED <-> DELETED tB8in5OHkHx3L0ni1p1I (deleted.rules)
 * 1:41583 <-> DISABLED <-> DELETED 2104Je8NeYdUapqjyLKN (deleted.rules)
 * 1:41584 <-> DISABLED <-> DELETED xQLvvhaNbAQnF8Jikc0m (deleted.rules)
 * 1:41586 <-> DISABLED <-> DELETED GXtNgBGUZsao7PElnBoI (deleted.rules)
 * 1:41601 <-> DISABLED <-> DELETED QFHU2S6OJHLagIz6pOvI (deleted.rules)
 * 1:41582 <-> DISABLED <-> DELETED A9MKNbvdALHvn3CdLpqv (deleted.rules)
 * 1:41581 <-> DISABLED <-> DELETED lm06mVLIekQJco8ymvCj (deleted.rules)
 * 1:41579 <-> DISABLED <-> DELETED tYwrGluX5dObfE6sY3GA (deleted.rules)
 * 1:41602 <-> DISABLED <-> DELETED aw5zsD18HZVNLa9fNWB7 (deleted.rules)
 * 1:41580 <-> DISABLED <-> DELETED xozrA27GE3bw8z1WGapk (deleted.rules)
 * 1:41577 <-> DISABLED <-> DELETED 9G9ad7eS9ApSYjQCeMop (deleted.rules)
 * 1:41578 <-> DISABLED <-> DELETED JnY2cb8F710UF6d9lQSp (deleted.rules)
 * 1:41575 <-> DISABLED <-> DELETED iXbkLX1dAAlk183HBDqc (deleted.rules)
 * 1:41603 <-> DISABLED <-> FILE-FLASH Adobe Flash player BitmapData class use after free attempt (file-flash.rules)
 * 1:41576 <-> DISABLED <-> DELETED l77NiJB8YylQIdXeb6CM (deleted.rules)
 * 1:41574 <-> DISABLED <-> DELETED 0GQx9qNGzD5JvIgsNsLU (deleted.rules)
 * 1:41572 <-> DISABLED <-> DELETED Jo29KjldkTlEL6ev8eBR (deleted.rules)
 * 1:41573 <-> DISABLED <-> DELETED AaEnRMGjoABYzg5s2InU (deleted.rules)
 * 1:41604 <-> DISABLED <-> FILE-FLASH Adobe Flash player BitmapData class use after free attempt (file-flash.rules)
 * 1:41570 <-> DISABLED <-> DELETED j9s3YbYVyYWsbrtQ3uIs (deleted.rules)
 * 1:41571 <-> DISABLED <-> DELETED HIFsM6I1zeAoJJ5Yf5li (deleted.rules)
 * 1:41568 <-> DISABLED <-> DELETED kF3nigJ4JNVVk6rUu4Y3 (deleted.rules)
 * 1:41569 <-> DISABLED <-> DELETED SvuhTNxfofLNh6BDRK33 (deleted.rules)
 * 1:41605 <-> DISABLED <-> DELETED ILkVCsobqFaujNaEjEQV (deleted.rules)
 * 1:41566 <-> DISABLED <-> DELETED eh2wYUkuI278GyheZZwI (deleted.rules)
 * 1:41567 <-> DISABLED <-> DELETED pTXs7KUhQRGhaWTgKbb7 (deleted.rules)
 * 1:41564 <-> DISABLED <-> DELETED gTgCA88UF8renb5O9NNQ (deleted.rules)
 * 1:41565 <-> DISABLED <-> DELETED j1CGK1PYbr0q4ETiGl8i (deleted.rules)
 * 1:41606 <-> DISABLED <-> DELETED DyPtd537A4oTXII67lLY (deleted.rules)
 * 1:41562 <-> DISABLED <-> DELETED OAFbssmWYTUcAmr92XiO (deleted.rules)
 * 1:41563 <-> DISABLED <-> DELETED fK4NDvjETaezKM19vsBD (deleted.rules)
 * 1:41560 <-> DISABLED <-> DELETED 2xy4LeeaJZxrNUR2Zrjn (deleted.rules)
 * 1:41561 <-> DISABLED <-> DELETED WEJm6bj4v3duVaDCRGYl (deleted.rules)
 * 1:41607 <-> DISABLED <-> DELETED rAZFmWHsPbKcUty7MgrA (deleted.rules)
 * 1:41558 <-> DISABLED <-> DELETED 0dSWPnm7dz6Fcf70zGIL (deleted.rules)
 * 1:41559 <-> DISABLED <-> DELETED vLuzJQZoy0uX2rfCGyX7 (deleted.rules)
 * 1:41556 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer use asm memory corruption attempt (browser-ie.rules)
 * 1:41557 <-> DISABLED <-> DELETED nsW9dVJiXbmLiVxuruv3 (deleted.rules)
 * 1:41608 <-> DISABLED <-> DELETED DlljTt5vFr4wpoNJnBJD (deleted.rules)
 * 1:41554 <-> DISABLED <-> DELETED oeXHcWOaoDqO97LWE3im (deleted.rules)
 * 1:41555 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer use asm memory corruption attempt (browser-ie.rules)
 * 1:41552 <-> DISABLED <-> DELETED j0lVhTQQnlFPNV8WbXjw (deleted.rules)
 * 1:41553 <-> DISABLED <-> DELETED n0AKi5Jy0HRovEdANpIJ (deleted.rules)
 * 1:41550 <-> DISABLED <-> DELETED 9PiGK20daqQ4NG2yUmHJ (deleted.rules)
 * 1:41609 <-> DISABLED <-> DELETED Vehj0FCBGiPlqED8fNo1 (deleted.rules)
 * 1:41551 <-> DISABLED <-> DELETED qS9HxX8E8ZuwjJmc2QYy (deleted.rules)
 * 1:41549 <-> DISABLED <-> DELETED 3KS9XNn1eqWy808Nag8X (deleted.rules)
 * 1:41610 <-> DISABLED <-> DELETED kOVvZrK2dixrCRdcdldP (deleted.rules)
 * 1:41611 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder luminance adjustment out of bounds memory access attempt (file-other.rules)
 * 1:41612 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder luminance adjustment out of bounds memory access attempt (file-other.rules)
 * 1:41613 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41614 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41615 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41631 <-> ENABLED <-> FILE-OTHER Adobe Flash Player mp4 h264 decompression routine out of bounds read attempt (file-other.rules)
 * 1:41588 <-> DISABLED <-> DELETED 2rR4CIpZQ1oZBLU01E4M (deleted.rules)
 * 1:41587 <-> DISABLED <-> DELETED v6YNZkcOtoUt4lazjOZg (deleted.rules)
 * 1:41642 <-> DISABLED <-> SERVER-WEBAPP TP-LINK AC750 ping diagnostic command injection attempt (server-webapp.rules)
 * 1:41641 <-> DISABLED <-> FILE-EXECUTABLE QuickHeal Internet Security malformed Mach-O file buffer overflow attempt (file-executable.rules)
 * 1:41639 <-> DISABLED <-> SERVER-WEBAPP Wordpress NextGEN gallery directory traversal attempt (server-webapp.rules)
 * 1:41589 <-> DISABLED <-> DELETED BKyoksClYkHqRyMDLret (deleted.rules)
 * 1:41640 <-> DISABLED <-> FILE-EXECUTABLE QuickHeal Internet Security malformed Mach-O file buffer overflow attempt (file-executable.rules)
 * 1:41638 <-> DISABLED <-> SERVER-WEBAPP Wordpress NextGEN gallery directory traversal attempt (server-webapp.rules)
 * 1:41637 <-> DISABLED <-> INDICATOR-COMPROMISE Writable SQL directories discovery attempt (indicator-compromise.rules)
 * 1:41636 <-> ENABLED <-> FILE-OTHER Adobe AcrobatDC EMF buffer underflow attempt (file-other.rules)
 * 1:41585 <-> DISABLED <-> DELETED xePvFEaRV1KmQNOzRGXH (deleted.rules)
 * 1:41634 <-> DISABLED <-> DELETED JZUG1wVRPVZOLCvEyoHz (deleted.rules)
 * 1:41635 <-> ENABLED <-> FILE-OTHER Adobe AcrobatDC EMF buffer underflow attempt (file-other.rules)

Modified Rules:


 * 1:21074 <-> DISABLED <-> SERVER-APACHE Apache Struts remote code execution attempt - CookieInterceptor (server-apache.rules)
 * 1:21555 <-> DISABLED <-> MALWARE-OTHER Horde javascript.php href backdoor (malware-other.rules)
 * 1:24285 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Nomno variant outbound connection (malware-cnc.rules)
 * 1:26529 <-> DISABLED <-> MALWARE-BACKDOOR Unix.Backdoor.Cdorked backdoor command attempt (malware-backdoor.rules)
 * 1:26777 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Kazy variant outbound connection (malware-cnc.rules)
 * 1:27057 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Dalbot variant outbound connection (malware-cnc.rules)
 * 1:27601 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Noobot variant connection (malware-cnc.rules)
 * 1:27804 <-> DISABLED <-> MALWARE-CNC Win.Trojan.PRISM variant outbound connection (malware-cnc.rules)
 * 1:28305 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Mecifg variant outbound connection (malware-cnc.rules)
 * 1:28315 <-> DISABLED <-> FILE-OTHER Microsoft Office Image filter BMP overflow attempt (file-other.rules)
 * 1:28509 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:28510 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:28511 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:28515 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:28516 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:28517 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:28879 <-> DISABLED <-> MALWARE-CNC Win.Backdoor.Tavdig variant outbound connection (malware-cnc.rules)
 * 1:28985 <-> DISABLED <-> MALWARE-CNC Win.Worm.Steckt IRCbot executable download (malware-cnc.rules)
 * 1:29863 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Pirminay variant outbound connection (malware-cnc.rules)
 * 1:31682 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Badur download attempt (malware-cnc.rules)
 * 1:31896 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Magnetor vairant outbound connection (malware-cnc.rules)
 * 1:31944 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Tavdig outbound connection (malware-cnc.rules)
 * 1:32555 <-> ENABLED <-> EXPLOIT-KIT Hellspawn exploit kit outbound Oracle Java jar request (exploit-kit.rules)
 * 1:32622 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Regin outbound connection (malware-cnc.rules)
 * 1:32623 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Regin outbound connection (malware-cnc.rules)
 * 1:32753 <-> ENABLED <-> SERVER-WEBAPP FreePBX Framework Asterisk recording interface PHP unserialize code execution attempt (server-webapp.rules)
 * 1:33166 <-> ENABLED <-> SERVER-OTHER IBM Tivoli Endpoint Manager Mobile Device Management remote code execution attempt (server-other.rules)
 * 1:33167 <-> ENABLED <-> SERVER-OTHER IBM Tivoli Endpoint Manager Mobile Device Management remote code execution attempt (server-other.rules)
 * 1:33168 <-> ENABLED <-> SERVER-OTHER IBM Tivoli Endpoint Manager Mobile Device Management remote code execution attempt (server-other.rules)
 * 1:33169 <-> ENABLED <-> SERVER-OTHER IBM Tivoli Endpoint Manager Mobile Device Management remote code execution attempt (server-other.rules)
 * 1:33756 <-> DISABLED <-> MALWARE-CNC Win.Ransomware.CTB-Locker outbound connection (malware-cnc.rules)
 * 1:33757 <-> DISABLED <-> MALWARE-CNC Win.Ransomware.CTB-Locker outbound connection (malware-cnc.rules)
 * 1:33812 <-> ENABLED <-> SERVER-WEBAPP Seagate NAS remote code execution attempt (server-webapp.rules)
 * 1:33880 <-> DISABLED <-> MALWARE-CNC Win.Backdoor.Casper outbound connection (malware-cnc.rules)
 * 1:34842 <-> DISABLED <-> MALWARE-CNC Win.Trojan.DownExecute outbound connection (malware-cnc.rules)
 * 1:35035 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Taleretzbj outbound connection  (malware-cnc.rules)
 * 1:35783 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Jiripbot variant outbound connection (malware-cnc.rules)
 * 1:37071 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:37072 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:37073 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:37074 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:37075 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:37076 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:37088 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PrintJob object use-after-free attempt (file-flash.rules)
 * 1:37089 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PrintJob object use-after-free attempt (file-flash.rules)
 * 1:37090 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PrintJob object use-after-free attempt (file-flash.rules)
 * 1:37091 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PrintJob object use-after-free attempt (file-flash.rules)
 * 1:37679 <-> ENABLED <-> FILE-FLASH Adobe Flash player ASNative textField use after free attempt (file-flash.rules)
 * 1:37680 <-> ENABLED <-> FILE-FLASH Adobe Flash player ASNative textField use after free attempt (file-flash.rules)
 * 1:38259 <-> ENABLED <-> MALWARE-CNC PowerShell Empire outbound request (malware-cnc.rules)
 * 1:38260 <-> ENABLED <-> MALWARE-CNC PowerShell Empire outbound request (malware-cnc.rules)
 * 1:38261 <-> ENABLED <-> MALWARE-CNC PowerShell Empire outbound request (malware-cnc.rules)
 * 1:38607 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection (malware-cnc.rules)
 * 1:38610 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Godzilla downloader successful base64 binary download (malware-cnc.rules)
 * 1:38681 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Tooka POST attempt (malware-cnc.rules)
 * 1:38729 <-> ENABLED <-> SERVER-OTHER Mediabridge Medialink MWN-WAPR300N and Tenda N3 Wireless N150 inbound admin attempt (server-other.rules)
 * 1:39219 <-> ENABLED <-> BROWSER-IE Microsoft Edge edgehtml.dll uninitialized pointer vulnerability attempt (browser-ie.rules)
 * 1:39220 <-> ENABLED <-> BROWSER-IE Microsoft Edge edgehtml.dll uninitialized pointer vulnerability attempt (browser-ie.rules)
 * 1:41122 <-> ENABLED <-> BLACKLIST DNS request for known malware domain editprod.waterfilter.in.ua (blacklist.rules)
 * 3:41221 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2016-0234 attack attempt (server-webapp.rules)
 * 3:41467 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2017-0276 TALOS-2017-0277 attack attempt (server-other.rules)
 * 3:36227 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0060 attack attempt (file-other.rules)
 * 3:36228 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0060 attack attempt (file-other.rules)
 * 3:36225 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0060 attack attempt (file-other.rules)
 * 3:36226 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0060 attack attempt (file-other.rules)

2017-02-14 19:53:00 UTC

Snort Subscriber Rules Update

Date: 2017-02-14

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2990.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:41642 <-> DISABLED <-> SERVER-WEBAPP TP-LINK AC750 ping diagnostic command injection attempt (server-webapp.rules)
 * 1:41641 <-> DISABLED <-> FILE-EXECUTABLE QuickHeal Internet Security malformed Mach-O file buffer overflow attempt (file-executable.rules)
 * 1:41640 <-> DISABLED <-> FILE-EXECUTABLE QuickHeal Internet Security malformed Mach-O file buffer overflow attempt (file-executable.rules)
 * 1:41639 <-> DISABLED <-> SERVER-WEBAPP Wordpress NextGEN gallery directory traversal attempt (server-webapp.rules)
 * 1:41638 <-> DISABLED <-> SERVER-WEBAPP Wordpress NextGEN gallery directory traversal attempt (server-webapp.rules)
 * 1:41637 <-> DISABLED <-> INDICATOR-COMPROMISE Writable SQL directories discovery attempt (indicator-compromise.rules)
 * 1:41636 <-> ENABLED <-> FILE-OTHER Adobe AcrobatDC EMF buffer underflow attempt (file-other.rules)
 * 1:41635 <-> ENABLED <-> FILE-OTHER Adobe AcrobatDC EMF buffer underflow attempt (file-other.rules)
 * 1:41634 <-> DISABLED <-> DELETED JZUG1wVRPVZOLCvEyoHz (deleted.rules)
 * 1:41633 <-> DISABLED <-> DELETED sxNxlO0jW0maiNpR7aM4 (deleted.rules)
 * 1:41632 <-> ENABLED <-> FILE-OTHER Adobe Flash Player mp4 h264 decompression routine out of bounds read attempt (file-other.rules)
 * 1:41631 <-> ENABLED <-> FILE-OTHER Adobe Flash Player mp4 h264 decompression routine out of bounds read attempt (file-other.rules)
 * 1:41630 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PSDK EventDispatch removeEventListener use after free attempt (file-flash.rules)
 * 1:41629 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PSDK EventDispatch removeEventListener use after free attempt (file-flash.rules)
 * 1:41628 <-> ENABLED <-> FILE-FLASH Adobe Flash Player garbage collection use after free attempt (file-flash.rules)
 * 1:41627 <-> ENABLED <-> FILE-FLASH Adobe Flash Player garbage collection use after free attempt (file-flash.rules)
 * 1:41626 <-> DISABLED <-> DELETED A8bNNfsFmpiJzXVSVbt6 (deleted.rules)
 * 1:41625 <-> DISABLED <-> DELETED 1Yn0o2sUhWRHdpZIYQCe (deleted.rules)
 * 1:41624 <-> ENABLED <-> FILE-FLASH Adobe Flash Player MessageChannel type confusion attempt (file-flash.rules)
 * 1:41623 <-> ENABLED <-> FILE-FLASH Adobe Flash Player MessageChannel type confusion attempt (file-flash.rules)
 * 1:41622 <-> DISABLED <-> FILE-FLASH Adobe Flash malformed FLV heap overflow attempt (file-flash.rules)
 * 1:41621 <-> DISABLED <-> FILE-FLASH Adobe Flash malformed FLV heap overflow attempt (file-flash.rules)
 * 1:41620 <-> DISABLED <-> FILE-FLASH Adobe Flash Player addEventListener use after free attempt (file-flash.rules)
 * 1:41619 <-> DISABLED <-> FILE-FLASH Adobe Flash Player addEventListener use after free attempt (file-flash.rules)
 * 1:41618 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41617 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41616 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41615 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41614 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41613 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder heap overflow attempt (file-other.rules)
 * 1:41612 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder luminance adjustment out of bounds memory access attempt (file-other.rules)
 * 1:41611 <-> ENABLED <-> FILE-OTHER Adobe Flash Player h264 decoder luminance adjustment out of bounds memory access attempt (file-other.rules)
 * 1:41610 <-> DISABLED <-> DELETED kOVvZrK2dixrCRdcdldP (deleted.rules)
 * 1:41609 <-> DISABLED <-> DELETED Vehj0FCBGiPlqED8fNo1 (deleted.rules)
 * 1:41608 <-> DISABLED <-> DELETED DlljTt5vFr4wpoNJnBJD (deleted.rules)
 * 1:41607 <-> DISABLED <-> DELETED rAZFmWHsPbKcUty7MgrA (deleted.rules)
 * 1:41606 <-> DISABLED <-> DELETED DyPtd537A4oTXII67lLY (deleted.rules)
 * 1:41605 <-> DISABLED <-> DELETED ILkVCsobqFaujNaEjEQV (deleted.rules)
 * 1:41604 <-> DISABLED <-> FILE-FLASH Adobe Flash player BitmapData class use after free attempt (file-flash.rules)
 * 1:41603 <-> DISABLED <-> FILE-FLASH Adobe Flash player BitmapData class use after free attempt (file-flash.rules)
 * 1:41602 <-> DISABLED <-> DELETED aw5zsD18HZVNLa9fNWB7 (deleted.rules)
 * 1:41601 <-> DISABLED <-> DELETED QFHU2S6OJHLagIz6pOvI (deleted.rules)
 * 1:41600 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CPeerHolder use after free attempt (browser-ie.rules)
 * 1:41599 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer CPeerHolder use after free attempt (browser-ie.rules)
 * 1:41598 <-> DISABLED <-> DELETED tlGo6aXOokNuyU1LDLf2 (deleted.rules)
 * 1:41597 <-> DISABLED <-> DELETED bpYVBffSltC9snfZm375 (deleted.rules)
 * 1:41596 <-> DISABLED <-> DELETED 92rMZYmep1qp65DS5D1V (deleted.rules)
 * 1:41595 <-> DISABLED <-> DELETED YCkW8nqU9F5eK8z8YSbn (deleted.rules)
 * 1:41594 <-> DISABLED <-> DELETED QB7rs3Z2BDil1quuJNKT (deleted.rules)
 * 1:41593 <-> DISABLED <-> DELETED 7ZUEraI3djmWkEg1YJQz (deleted.rules)
 * 1:41592 <-> DISABLED <-> DELETED 0POZmpuYEnQ8DWiFvIqZ (deleted.rules)
 * 1:41591 <-> DISABLED <-> DELETED SZEKQhOGrioANnhLEW71 (deleted.rules)
 * 1:41590 <-> DISABLED <-> DELETED tB8in5OHkHx3L0ni1p1I (deleted.rules)
 * 1:41589 <-> DISABLED <-> DELETED BKyoksClYkHqRyMDLret (deleted.rules)
 * 1:41588 <-> DISABLED <-> DELETED 2rR4CIpZQ1oZBLU01E4M (deleted.rules)
 * 1:41587 <-> DISABLED <-> DELETED v6YNZkcOtoUt4lazjOZg (deleted.rules)
 * 1:41586 <-> DISABLED <-> DELETED GXtNgBGUZsao7PElnBoI (deleted.rules)
 * 1:41585 <-> DISABLED <-> DELETED xePvFEaRV1KmQNOzRGXH (deleted.rules)
 * 1:41584 <-> DISABLED <-> DELETED xQLvvhaNbAQnF8Jikc0m (deleted.rules)
 * 1:41583 <-> DISABLED <-> DELETED 2104Je8NeYdUapqjyLKN (deleted.rules)
 * 1:41582 <-> DISABLED <-> DELETED A9MKNbvdALHvn3CdLpqv (deleted.rules)
 * 1:41581 <-> DISABLED <-> DELETED lm06mVLIekQJco8ymvCj (deleted.rules)
 * 1:41580 <-> DISABLED <-> DELETED xozrA27GE3bw8z1WGapk (deleted.rules)
 * 1:41579 <-> DISABLED <-> DELETED tYwrGluX5dObfE6sY3GA (deleted.rules)
 * 1:41578 <-> DISABLED <-> DELETED JnY2cb8F710UF6d9lQSp (deleted.rules)
 * 1:41577 <-> DISABLED <-> DELETED 9G9ad7eS9ApSYjQCeMop (deleted.rules)
 * 1:41576 <-> DISABLED <-> DELETED l77NiJB8YylQIdXeb6CM (deleted.rules)
 * 1:41575 <-> DISABLED <-> DELETED iXbkLX1dAAlk183HBDqc (deleted.rules)
 * 1:41574 <-> DISABLED <-> DELETED 0GQx9qNGzD5JvIgsNsLU (deleted.rules)
 * 1:41573 <-> DISABLED <-> DELETED AaEnRMGjoABYzg5s2InU (deleted.rules)
 * 1:41572 <-> DISABLED <-> DELETED Jo29KjldkTlEL6ev8eBR (deleted.rules)
 * 1:41571 <-> DISABLED <-> DELETED HIFsM6I1zeAoJJ5Yf5li (deleted.rules)
 * 1:41570 <-> DISABLED <-> DELETED j9s3YbYVyYWsbrtQ3uIs (deleted.rules)
 * 1:41569 <-> DISABLED <-> DELETED SvuhTNxfofLNh6BDRK33 (deleted.rules)
 * 1:41568 <-> DISABLED <-> DELETED kF3nigJ4JNVVk6rUu4Y3 (deleted.rules)
 * 1:41567 <-> DISABLED <-> DELETED pTXs7KUhQRGhaWTgKbb7 (deleted.rules)
 * 1:41566 <-> DISABLED <-> DELETED eh2wYUkuI278GyheZZwI (deleted.rules)
 * 1:41565 <-> DISABLED <-> DELETED j1CGK1PYbr0q4ETiGl8i (deleted.rules)
 * 1:41564 <-> DISABLED <-> DELETED gTgCA88UF8renb5O9NNQ (deleted.rules)
 * 1:41563 <-> DISABLED <-> DELETED fK4NDvjETaezKM19vsBD (deleted.rules)
 * 1:41562 <-> DISABLED <-> DELETED OAFbssmWYTUcAmr92XiO (deleted.rules)
 * 1:41561 <-> DISABLED <-> DELETED WEJm6bj4v3duVaDCRGYl (deleted.rules)
 * 1:41560 <-> DISABLED <-> DELETED 2xy4LeeaJZxrNUR2Zrjn (deleted.rules)
 * 1:41559 <-> DISABLED <-> DELETED vLuzJQZoy0uX2rfCGyX7 (deleted.rules)
 * 1:41558 <-> DISABLED <-> DELETED 0dSWPnm7dz6Fcf70zGIL (deleted.rules)
 * 1:41557 <-> DISABLED <-> DELETED nsW9dVJiXbmLiVxuruv3 (deleted.rules)
 * 1:41556 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer use asm memory corruption attempt (browser-ie.rules)
 * 1:41555 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer use asm memory corruption attempt (browser-ie.rules)
 * 1:41554 <-> DISABLED <-> DELETED oeXHcWOaoDqO97LWE3im (deleted.rules)
 * 1:41553 <-> DISABLED <-> DELETED n0AKi5Jy0HRovEdANpIJ (deleted.rules)
 * 1:41552 <-> DISABLED <-> DELETED j0lVhTQQnlFPNV8WbXjw (deleted.rules)
 * 1:41551 <-> DISABLED <-> DELETED qS9HxX8E8ZuwjJmc2QYy (deleted.rules)
 * 1:41550 <-> DISABLED <-> DELETED 9PiGK20daqQ4NG2yUmHJ (deleted.rules)
 * 1:41549 <-> DISABLED <-> DELETED 3KS9XNn1eqWy808Nag8X (deleted.rules)

Modified Rules:


 * 1:39220 <-> ENABLED <-> BROWSER-IE Microsoft Edge edgehtml.dll uninitialized pointer vulnerability attempt (browser-ie.rules)
 * 1:41122 <-> ENABLED <-> BLACKLIST DNS request for known malware domain editprod.waterfilter.in.ua (blacklist.rules)
 * 1:38729 <-> ENABLED <-> SERVER-OTHER Mediabridge Medialink MWN-WAPR300N and Tenda N3 Wireless N150 inbound admin attempt (server-other.rules)
 * 1:39219 <-> ENABLED <-> BROWSER-IE Microsoft Edge edgehtml.dll uninitialized pointer vulnerability attempt (browser-ie.rules)
 * 1:38610 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Godzilla downloader successful base64 binary download (malware-cnc.rules)
 * 1:38681 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Tooka POST attempt (malware-cnc.rules)
 * 1:38261 <-> ENABLED <-> MALWARE-CNC PowerShell Empire outbound request (malware-cnc.rules)
 * 1:38607 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection (malware-cnc.rules)
 * 1:38259 <-> ENABLED <-> MALWARE-CNC PowerShell Empire outbound request (malware-cnc.rules)
 * 1:38260 <-> ENABLED <-> MALWARE-CNC PowerShell Empire outbound request (malware-cnc.rules)
 * 1:37679 <-> ENABLED <-> FILE-FLASH Adobe Flash player ASNative textField use after free attempt (file-flash.rules)
 * 1:37680 <-> ENABLED <-> FILE-FLASH Adobe Flash player ASNative textField use after free attempt (file-flash.rules)
 * 1:37090 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PrintJob object use-after-free attempt (file-flash.rules)
 * 1:37091 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PrintJob object use-after-free attempt (file-flash.rules)
 * 1:37088 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PrintJob object use-after-free attempt (file-flash.rules)
 * 1:37089 <-> ENABLED <-> FILE-FLASH Adobe Flash Player PrintJob object use-after-free attempt (file-flash.rules)
 * 1:37075 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:37076 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:37073 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:37074 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:37071 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:37072 <-> ENABLED <-> FILE-FLASH Adobe Flash Player ShaderParameter integer overflow attempt (file-flash.rules)
 * 1:35035 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Taleretzbj outbound connection  (malware-cnc.rules)
 * 1:35783 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Jiripbot variant outbound connection (malware-cnc.rules)
 * 1:33880 <-> DISABLED <-> MALWARE-CNC Win.Backdoor.Casper outbound connection (malware-cnc.rules)
 * 1:34842 <-> DISABLED <-> MALWARE-CNC Win.Trojan.DownExecute outbound connection (malware-cnc.rules)
 * 1:33757 <-> DISABLED <-> MALWARE-CNC Win.Ransomware.CTB-Locker outbound connection (malware-cnc.rules)
 * 1:33812 <-> ENABLED <-> SERVER-WEBAPP Seagate NAS remote code execution attempt (server-webapp.rules)
 * 1:33169 <-> ENABLED <-> SERVER-OTHER IBM Tivoli Endpoint Manager Mobile Device Management remote code execution attempt (server-other.rules)
 * 1:33756 <-> DISABLED <-> MALWARE-CNC Win.Ransomware.CTB-Locker outbound connection (malware-cnc.rules)
 * 1:33167 <-> ENABLED <-> SERVER-OTHER IBM Tivoli Endpoint Manager Mobile Device Management remote code execution attempt (server-other.rules)
 * 1:33168 <-> ENABLED <-> SERVER-OTHER IBM Tivoli Endpoint Manager Mobile Device Management remote code execution attempt (server-other.rules)
 * 1:32753 <-> ENABLED <-> SERVER-WEBAPP FreePBX Framework Asterisk recording interface PHP unserialize code execution attempt (server-webapp.rules)
 * 1:33166 <-> ENABLED <-> SERVER-OTHER IBM Tivoli Endpoint Manager Mobile Device Management remote code execution attempt (server-other.rules)
 * 1:32622 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Regin outbound connection (malware-cnc.rules)
 * 1:32623 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Regin outbound connection (malware-cnc.rules)
 * 1:31944 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Tavdig outbound connection (malware-cnc.rules)
 * 1:32555 <-> ENABLED <-> EXPLOIT-KIT Hellspawn exploit kit outbound Oracle Java jar request (exploit-kit.rules)
 * 1:31682 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Badur download attempt (malware-cnc.rules)
 * 1:31896 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Magnetor vairant outbound connection (malware-cnc.rules)
 * 1:28985 <-> DISABLED <-> MALWARE-CNC Win.Worm.Steckt IRCbot executable download (malware-cnc.rules)
 * 1:29863 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Pirminay variant outbound connection (malware-cnc.rules)
 * 1:28517 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:28879 <-> DISABLED <-> MALWARE-CNC Win.Backdoor.Tavdig variant outbound connection (malware-cnc.rules)
 * 1:28515 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:28516 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:28510 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:28511 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:28509 <-> DISABLED <-> FILE-OTHER Microsoft Wordpad embedded BMP overflow attempt (file-other.rules)
 * 1:28305 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Mecifg variant outbound connection (malware-cnc.rules)
 * 1:28315 <-> DISABLED <-> FILE-OTHER Microsoft Office Image filter BMP overflow attempt (file-other.rules)
 * 1:27601 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Noobot variant connection (malware-cnc.rules)
 * 1:27804 <-> DISABLED <-> MALWARE-CNC Win.Trojan.PRISM variant outbound connection (malware-cnc.rules)
 * 1:26777 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Kazy variant outbound connection (malware-cnc.rules)
 * 1:27057 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Dalbot variant outbound connection (malware-cnc.rules)
 * 1:26529 <-> DISABLED <-> MALWARE-BACKDOOR Unix.Backdoor.Cdorked backdoor command attempt (malware-backdoor.rules)
 * 1:21555 <-> DISABLED <-> MALWARE-OTHER Horde javascript.php href backdoor (malware-other.rules)
 * 1:24285 <-> DISABLED <-> MALWARE-CNC Win.Trojan.Nomno variant outbound connection (malware-cnc.rules)
 * 1:21074 <-> DISABLED <-> SERVER-APACHE Apache Struts remote code execution attempt - CookieInterceptor (server-apache.rules)
 * 3:36228 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0060 attack attempt (file-other.rules)
 * 3:41467 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2017-0276 TALOS-2017-0277 attack attempt (server-other.rules)
 * 3:41221 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2016-0234 attack attempt (server-webapp.rules)
 * 3:36226 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0060 attack attempt (file-other.rules)
 * 3:36227 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0060 attack attempt (file-other.rules)
 * 3:36225 <-> ENABLED <-> FILE-OTHER TRUFFLEHUNTER TALOS-CAN-0060 attack attempt (file-other.rules)