Talos Rules 2022-08-23
This release adds and modifies rules in several categories.

Talos has added and modified multiple rules in the file-other, malware-cnc, malware-other, os-windows and server-webapp rule sets to provide coverage for emerging threats from these technologies.

For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.

Change logs

2022-08-23 19:12:41 UTC

Snort Subscriber Rules Update

Date: 2022-08-23

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2092000.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60437 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60438 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60439 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60440 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60441 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60442 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60443 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60444 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60445 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt (malware-cnc.rules)
 * 1:60446 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60447 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60448 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60449 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60450 <-> DISABLED <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt (malware-cnc.rules)
 * 1:60451 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60452 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60453 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt (malware-other.rules)
 * 1:60454 <-> DISABLED <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt (server-webapp.rules)
 * 1:60456 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60457 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 3:60455 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules)

2022-08-23 19:12:41 UTC

Snort Subscriber Rules Update

Date: 2022-08-23

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091900.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60452 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60453 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt (malware-other.rules)
 * 1:60437 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60438 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60456 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60454 <-> DISABLED <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt (server-webapp.rules)
 * 1:60457 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60451 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60440 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60439 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60442 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60441 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60444 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60443 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60446 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60445 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt (malware-cnc.rules)
 * 1:60448 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60447 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60450 <-> DISABLED <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt (malware-cnc.rules)
 * 1:60449 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 3:60455 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules)

2022-08-23 19:12:41 UTC

Snort Subscriber Rules Update

Date: 2022-08-23

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091801.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60453 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt (malware-other.rules)
 * 1:60452 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60456 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60454 <-> DISABLED <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt (server-webapp.rules)
 * 1:60457 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60451 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60437 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60438 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60446 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60440 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60439 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60442 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60441 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60444 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60443 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60445 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt (malware-cnc.rules)
 * 1:60447 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60449 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60448 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60450 <-> DISABLED <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt (malware-cnc.rules)
 * 3:60455 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules)

2022-08-23 19:12:41 UTC

Snort Subscriber Rules Update

Date: 2022-08-23

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091701.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60453 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt (malware-other.rules)
 * 1:60437 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60454 <-> DISABLED <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt (server-webapp.rules)
 * 1:60438 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60457 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60439 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60440 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60441 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60442 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60443 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60444 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60445 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt (malware-cnc.rules)
 * 1:60446 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60456 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60447 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60452 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60448 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60449 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60450 <-> DISABLED <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt (malware-cnc.rules)
 * 1:60451 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 3:60455 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules)

2022-08-23 19:12:41 UTC

Snort Subscriber Rules Update

Date: 2022-08-23

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091700.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60454 <-> DISABLED <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt (server-webapp.rules)
 * 1:60452 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60457 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60453 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt (malware-other.rules)
 * 1:60437 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60439 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60438 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60451 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60456 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60440 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60441 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60442 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60443 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60444 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60445 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt (malware-cnc.rules)
 * 1:60446 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60447 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60448 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60449 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60450 <-> DISABLED <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt (malware-cnc.rules)
 * 3:60455 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules)

2022-08-23 19:12:41 UTC

Snort Subscriber Rules Update

Date: 2022-08-23

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091601.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60457 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60451 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60452 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60453 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt (malware-other.rules)
 * 1:60454 <-> DISABLED <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt (server-webapp.rules)
 * 1:60440 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60441 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60439 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60445 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt (malware-cnc.rules)
 * 1:60444 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60443 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60438 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60449 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60448 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60447 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60442 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60446 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60437 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60450 <-> DISABLED <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt (malware-cnc.rules)
 * 1:60456 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 3:60455 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules)

2022-08-23 19:12:41 UTC

Snort Subscriber Rules Update

Date: 2022-08-23

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091600.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60437 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60439 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60456 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60443 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60444 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60445 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt (malware-cnc.rules)
 * 1:60446 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60447 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60448 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60449 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60450 <-> DISABLED <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt (malware-cnc.rules)
 * 1:60438 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60451 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60442 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60452 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60453 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt (malware-other.rules)
 * 1:60441 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60457 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60440 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60454 <-> DISABLED <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt (server-webapp.rules)
 * 3:60455 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules)

2022-08-23 19:12:41 UTC

Snort Subscriber Rules Update

Date: 2022-08-23

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091501.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60457 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60453 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt (malware-other.rules)
 * 1:60452 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60454 <-> DISABLED <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt (server-webapp.rules)
 * 1:60456 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60451 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60439 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60440 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60441 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60442 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60443 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60444 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60437 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60445 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt (malware-cnc.rules)
 * 1:60438 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60446 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60447 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60448 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60449 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60450 <-> DISABLED <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt (malware-cnc.rules)
 * 3:60455 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules)

2022-08-23 19:12:41 UTC

Snort Subscriber Rules Update

Date: 2022-08-23

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091401.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60452 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60450 <-> DISABLED <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt (malware-cnc.rules)
 * 1:60449 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60454 <-> DISABLED <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt (server-webapp.rules)
 * 1:60456 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60451 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60453 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt (malware-other.rules)
 * 1:60437 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60438 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60439 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60440 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60441 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60442 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60443 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60444 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60445 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt (malware-cnc.rules)
 * 1:60446 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60457 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60447 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60448 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 3:60455 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules)

2022-08-23 19:12:41 UTC

Snort Subscriber Rules Update

Date: 2022-08-23

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091300.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60440 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60439 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60454 <-> DISABLED <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt (server-webapp.rules)
 * 1:60452 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60445 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt (malware-cnc.rules)
 * 1:60451 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60444 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60442 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60447 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60441 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60453 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt (malware-other.rules)
 * 1:60449 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60450 <-> DISABLED <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt (malware-cnc.rules)
 * 1:60437 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60446 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60443 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60448 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60457 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60456 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60438 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 3:60455 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules)

2022-08-23 19:12:41 UTC

Snort Subscriber Rules Update

Date: 2022-08-23

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091101.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60446 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60444 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60456 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60447 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60452 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60437 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60438 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60445 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt (malware-cnc.rules)
 * 1:60448 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60454 <-> DISABLED <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt (server-webapp.rules)
 * 1:60440 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60442 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60453 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt (malware-other.rules)
 * 1:60441 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60451 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60443 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60450 <-> DISABLED <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt (malware-cnc.rules)
 * 1:60449 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60439 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60457 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 3:60455 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules)

2022-08-23 19:12:41 UTC

Snort Subscriber Rules Update

Date: 2022-08-23

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3000.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60439 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (snort3-malware-cnc.rules)
 * 1:60440 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (snort3-malware-cnc.rules)
 * 1:60447 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (snort3-protocol-voip.rules)
 * 1:60451 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (snort3-malware-other.rules)
 * 1:60448 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (snort3-protocol-voip.rules)
 * 1:60452 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (snort3-malware-other.rules)
 * 1:60449 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (snort3-protocol-voip.rules)
 * 1:60446 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (snort3-protocol-voip.rules)
 * 1:60453 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt (snort3-malware-other.rules)
 * 1:60437 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (snort3-malware-cnc.rules)
 * 1:60454 <-> ENABLED <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt (snort3-server-webapp.rules)
 * 1:60450 <-> ENABLED <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt (snort3-malware-cnc.rules)

Modified Rules:



2022-08-23 19:12:41 UTC

Snort Subscriber Rules Update

Date: 2022-08-23

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60457 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60440 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60446 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60439 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt (malware-cnc.rules)
 * 1:60444 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60452 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60448 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60451 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt (malware-other.rules)
 * 1:60443 <-> ENABLED <-> MALWARE-OTHER Win.Trojan.Matanbuchus variant binary download attempt (malware-other.rules)
 * 1:60449 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60447 <-> ENABLED <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt (protocol-voip.rules)
 * 1:60441 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60456 <-> DISABLED <-> FILE-OTHER UnRAR directory traversal attempt (file-other.rules)
 * 1:60453 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt (malware-other.rules)
 * 1:60438 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60454 <-> DISABLED <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt (server-webapp.rules)
 * 1:60450 <-> DISABLED <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt (malware-cnc.rules)
 * 1:60442 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt (malware-other.rules)
 * 1:60437 <-> ENABLED <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt (malware-cnc.rules)
 * 1:60445 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt (malware-cnc.rules)

Modified Rules:


 * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules)

2022-08-23 19:14:46 UTC

Snort Subscriber Rules Update

Date: 2022-08-23-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.1.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300251 <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt
* 1:300252 <-> MALWARE-OTHER Win.Trojan.Matanbuchus binary download attempt
* 1:300253 <-> FILE-OTHER UnRAR directory traversal attempt
* 1:60437 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60438 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60439 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60440 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60445 <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt
* 1:60446 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60447 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60448 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60449 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60450 <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt
* 1:60451 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60452 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60453 <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt
* 1:60454 <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt
* 3:60455 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt

Modified Rules:



2022-08-23 19:14:46 UTC

Snort Subscriber Rules Update

Date: 2022-08-23-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.4.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300251 <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt
* 1:300252 <-> MALWARE-OTHER Win.Trojan.Matanbuchus binary download attempt
* 1:300253 <-> FILE-OTHER UnRAR directory traversal attempt
* 1:60437 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60438 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60439 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60440 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60445 <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt
* 1:60446 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60447 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60448 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60449 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60450 <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt
* 1:60451 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60452 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60453 <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt
* 1:60454 <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt
* 3:60455 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt

Modified Rules:



2022-08-23 19:14:46 UTC

Snort Subscriber Rules Update

Date: 2022-08-23-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300251 <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt
* 1:300252 <-> MALWARE-OTHER Win.Trojan.Matanbuchus binary download attempt
* 1:300253 <-> FILE-OTHER UnRAR directory traversal attempt
* 1:60437 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60438 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60439 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60440 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60445 <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt
* 1:60446 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60447 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60448 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60449 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60450 <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt
* 1:60451 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60452 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60453 <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt
* 1:60454 <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt
* 3:60455 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt

Modified Rules:



2022-08-23 19:14:46 UTC

Snort Subscriber Rules Update

Date: 2022-08-23-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.1.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300251 <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt
* 1:300252 <-> MALWARE-OTHER Win.Trojan.Matanbuchus binary download attempt
* 1:300253 <-> FILE-OTHER UnRAR directory traversal attempt
* 1:60437 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60438 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60439 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60440 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60445 <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt
* 1:60446 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60447 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60448 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60449 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60450 <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt
* 1:60451 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60452 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60453 <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt
* 1:60454 <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt
* 3:60455 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt

Modified Rules:



2022-08-23 19:14:46 UTC

Snort Subscriber Rules Update

Date: 2022-08-23-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.1.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300251 <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt
* 1:300252 <-> MALWARE-OTHER Win.Trojan.Matanbuchus binary download attempt
* 1:300253 <-> FILE-OTHER UnRAR directory traversal attempt
* 1:60437 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60438 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60439 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60440 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60445 <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt
* 1:60446 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60447 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60448 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60449 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60450 <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt
* 1:60451 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60452 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60453 <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt
* 1:60454 <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt
* 3:60455 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt

Modified Rules:



2022-08-23 19:14:46 UTC

Snort Subscriber Rules Update

Date: 2022-08-23-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.3.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300251 <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt
* 1:300252 <-> MALWARE-OTHER Win.Trojan.Matanbuchus binary download attempt
* 1:300253 <-> FILE-OTHER UnRAR directory traversal attempt
* 1:60437 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60438 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60439 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60440 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60445 <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt
* 1:60446 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60447 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60448 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60449 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60450 <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt
* 1:60451 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60452 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60453 <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt
* 1:60454 <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt
* 3:60455 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt

Modified Rules:



2022-08-23 19:14:46 UTC

Snort Subscriber Rules Update

Date: 2022-08-23-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.4.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300251 <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt
* 1:300252 <-> MALWARE-OTHER Win.Trojan.Matanbuchus binary download attempt
* 1:300253 <-> FILE-OTHER UnRAR directory traversal attempt
* 1:60437 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60438 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60439 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60440 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60445 <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt
* 1:60446 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60447 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60448 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60449 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60450 <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt
* 1:60451 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60452 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60453 <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt
* 1:60454 <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt
* 3:60455 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt

Modified Rules:



2022-08-23 19:14:47 UTC

Snort Subscriber Rules Update

Date: 2022-08-23-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.5.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300251 <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt
* 1:300252 <-> MALWARE-OTHER Win.Trojan.Matanbuchus binary download attempt
* 1:300253 <-> FILE-OTHER UnRAR directory traversal attempt
* 1:60437 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60438 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60439 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60440 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60445 <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt
* 1:60446 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60447 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60448 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60449 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60450 <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt
* 1:60451 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60452 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60453 <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt
* 1:60454 <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt
* 3:60455 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt

Modified Rules:



2022-08-23 19:14:47 UTC

Snort Subscriber Rules Update

Date: 2022-08-23-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.7.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300251 <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt
* 1:300252 <-> MALWARE-OTHER Win.Trojan.Matanbuchus binary download attempt
* 1:300253 <-> FILE-OTHER UnRAR directory traversal attempt
* 1:60437 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60438 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60439 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60440 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60445 <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt
* 1:60446 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60447 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60448 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60449 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60450 <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt
* 1:60451 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60452 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60453 <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt
* 1:60454 <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt
* 3:60455 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt

Modified Rules:



2022-08-23 19:14:47 UTC

Snort Subscriber Rules Update

Date: 2022-08-23-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.9.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300251 <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt
* 1:300252 <-> MALWARE-OTHER Win.Trojan.Matanbuchus binary download attempt
* 1:300253 <-> FILE-OTHER UnRAR directory traversal attempt
* 1:60437 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60438 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60439 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60440 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60445 <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt
* 1:60446 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60447 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60448 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60449 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60450 <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt
* 1:60451 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60452 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60453 <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt
* 1:60454 <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt
* 3:60455 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt

Modified Rules:



2022-08-23 19:14:47 UTC

Snort Subscriber Rules Update

Date: 2022-08-23-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.11.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300251 <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt
* 1:300252 <-> MALWARE-OTHER Win.Trojan.Matanbuchus binary download attempt
* 1:300253 <-> FILE-OTHER UnRAR directory traversal attempt
* 1:60437 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60438 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60439 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60440 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60445 <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt
* 1:60446 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60447 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60448 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60449 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60450 <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt
* 1:60451 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60452 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60453 <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt
* 1:60454 <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt
* 3:60455 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt

Modified Rules:



2022-08-23 19:14:47 UTC

Snort Subscriber Rules Update

Date: 2022-08-23-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.15.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300251 <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt
* 1:300252 <-> MALWARE-OTHER Win.Trojan.Matanbuchus binary download attempt
* 1:300253 <-> FILE-OTHER UnRAR directory traversal attempt
* 1:60437 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60438 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60439 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60440 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60445 <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt
* 1:60446 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60447 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60448 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60449 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60450 <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt
* 1:60451 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60452 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60453 <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt
* 1:60454 <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt
* 3:60455 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt

Modified Rules:



2022-08-23 19:14:47 UTC

Snort Subscriber Rules Update

Date: 2022-08-23-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.18.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300251 <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt
* 1:300252 <-> MALWARE-OTHER Win.Trojan.Matanbuchus binary download attempt
* 1:300253 <-> FILE-OTHER UnRAR directory traversal attempt
* 1:60437 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60438 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60439 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60440 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60445 <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt
* 1:60446 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60447 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60448 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60449 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60450 <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt
* 1:60451 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60452 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60453 <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt
* 1:60454 <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt
* 3:60455 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt

Modified Rules:



2022-08-23 19:14:47 UTC

Snort Subscriber Rules Update

Date: 2022-08-23-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.20.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300251 <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt
* 1:300252 <-> MALWARE-OTHER Win.Trojan.Matanbuchus binary download attempt
* 1:300253 <-> FILE-OTHER UnRAR directory traversal attempt
* 1:60437 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60438 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60439 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60440 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60445 <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt
* 1:60446 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60447 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60448 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60449 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60450 <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt
* 1:60451 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60452 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60453 <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt
* 1:60454 <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt
* 3:60455 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt

Modified Rules:



2022-08-23 19:14:47 UTC

Snort Subscriber Rules Update

Date: 2022-08-23-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.21.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300251 <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt
* 1:300252 <-> MALWARE-OTHER Win.Trojan.Matanbuchus binary download attempt
* 1:300253 <-> FILE-OTHER UnRAR directory traversal attempt
* 1:60437 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60438 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60439 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60440 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60445 <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt
* 1:60446 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60447 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60448 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60449 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60450 <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt
* 1:60451 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60452 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60453 <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt
* 1:60454 <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt
* 3:60455 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt

Modified Rules:



2022-08-23 19:14:47 UTC

Snort Subscriber Rules Update

Date: 2022-08-23-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.35.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300251 <-> MALWARE-OTHER Win.Trojan.Redline variant download attempt
* 1:300252 <-> MALWARE-OTHER Win.Trojan.Matanbuchus binary download attempt
* 1:300253 <-> FILE-OTHER UnRAR directory traversal attempt
* 1:60437 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60438 <-> MALWARE-CNC Win.Trojan.ModernLoader inbound communication attempt
* 1:60439 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60440 <-> MALWARE-CNC Win.Trojan.ModernLoader outbound communication attempt
* 1:60445 <-> MALWARE-CNC Win.Trojan.Matanbuchus outbound communication attempt
* 1:60446 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60447 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60448 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60449 <-> PROTOCOL-VOIP Realtek eCos SDK SIP parsing stack buffer overflow attempt
* 1:60450 <-> MALWARE-CNC Win.Trojan.SVCReady outbound connection attempt
* 1:60451 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60452 <-> MALWARE-OTHER Php.Webshell.Erne inbound connection attempt
* 1:60453 <-> MALWARE-OTHER Php.Webshell.Erne outbound connection attempt
* 1:60454 <-> SERVER-WEBAPP Zimbra Calendar cross site scripting attempt
* 3:60455 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1576 attack attempt

Modified Rules: