Talos Rules 2018-12-20
This release adds and modifies rules in several categories.

Talos has added and modified multiple rules in the browser-ie rule sets to provide coverage for emerging threats from these technologies.

For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.

Change logs

2983

2018-12-20 06:25:13 UTC

Snort Subscriber Rules Update

Date: 2018-12-20

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:48702 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine memory corruption attempt (browser-ie.rules)
 * 1:48700 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine downgrade detected (browser-ie.rules)
 * 1:48699 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine downgrade detected (browser-ie.rules)
 * 1:48701 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine memory corruption attempt (browser-ie.rules)

Modified Rules:


 * 1:48694 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48696 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48693 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48695 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48698 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48697 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)

2990

2018-12-20 06:25:13 UTC

Snort Subscriber Rules Update

Date: 2018-12-20

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2990.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:48699 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine downgrade detected (browser-ie.rules)
 * 1:48702 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine memory corruption attempt (browser-ie.rules)
 * 1:48700 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine downgrade detected (browser-ie.rules)
 * 1:48701 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine memory corruption attempt (browser-ie.rules)

Modified Rules:


 * 1:48693 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48698 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48694 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48696 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48695 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48697 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)

3000

2018-12-20 06:25:13 UTC

Snort Subscriber Rules Update

Date: 2018-12-20

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3000.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:48700 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine downgrade detected (snort3-browser-ie.rules)
 * 1:48702 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine memory corruption attempt (snort3-browser-ie.rules)
 * 1:48701 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine memory corruption attempt (snort3-browser-ie.rules)
 * 1:48699 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine downgrade detected (snort3-browser-ie.rules)

Modified Rules:


 * 1:48696 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (snort3-browser-ie.rules)
 * 1:48695 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (snort3-browser-ie.rules)
 * 1:48698 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (snort3-browser-ie.rules)
 * 1:48694 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (snort3-browser-ie.rules)
 * 1:48693 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (snort3-browser-ie.rules)
 * 1:48697 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (snort3-browser-ie.rules)

29110

2018-12-20 06:25:13 UTC

Snort Subscriber Rules Update

Date: 2018-12-20

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091100.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:48702 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine memory corruption attempt (browser-ie.rules)
 * 1:48700 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine downgrade detected (browser-ie.rules)
 * 1:48701 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine memory corruption attempt (browser-ie.rules)
 * 1:48699 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine downgrade detected (browser-ie.rules)

Modified Rules:


 * 1:48696 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48693 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48695 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48697 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48698 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48694 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)

29111

2018-12-20 06:25:13 UTC

Snort Subscriber Rules Update

Date: 2018-12-20

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091101.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:48699 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine downgrade detected (browser-ie.rules)
 * 1:48701 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine memory corruption attempt (browser-ie.rules)
 * 1:48702 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine memory corruption attempt (browser-ie.rules)
 * 1:48700 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine downgrade detected (browser-ie.rules)

Modified Rules:


 * 1:48695 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48694 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48693 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48697 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48696 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48698 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)

29120

2018-12-20 06:25:13 UTC

Snort Subscriber Rules Update

Date: 2018-12-20

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091200.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:48702 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine memory corruption attempt (browser-ie.rules)
 * 1:48701 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine memory corruption attempt (browser-ie.rules)
 * 1:48700 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine downgrade detected (browser-ie.rules)
 * 1:48699 <-> DISABLED <-> BROWSER-IE Microsoft Internet Explorer JavaScript engine downgrade detected (browser-ie.rules)

Modified Rules:


 * 1:48695 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48693 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48697 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48698 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48696 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)
 * 1:48694 <-> ENABLED <-> BROWSER-IE Microsoft Internet Explorer VBScript remote code execution attempt (browser-ie.rules)