Talos Rules 2020-09-17
This release adds and modifies rules in several categories.

Talos has added and modified multiple rules in the browser-ie, file-image, file-office, malware-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.

Change logs

2020-09-17 12:04:54 UTC

Snort Subscriber Rules Update

Date: 2020-09-17

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091601.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:55732 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (malware-other.rules)
 * 1:55733 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (malware-other.rules)
 * 1:55734 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (malware-other.rules)
 * 1:55735 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (malware-other.rules)
 * 1:55736 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (malware-other.rules)
 * 1:55737 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (malware-other.rules)
 * 1:55738 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (malware-other.rules)
 * 1:55739 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (malware-other.rules)
 * 1:55740 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (malware-other.rules)
 * 1:55741 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (file-image.rules)
 * 1:55742 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (file-image.rules)
 * 1:55743 <-> DISABLED <-> SERVER-OTHER Exodous Rockwell Automation FactoryTalk Diagnostics remote code execution attempt (server-other.rules)
 * 1:55744 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (malware-other.rules)
 * 1:55745 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (malware-other.rules)
 * 1:55746 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (malware-other.rules)
 * 1:55747 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (malware-other.rules)
 * 1:55705 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (malware-other.rules)
 * 1:55706 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (malware-other.rules)
 * 1:55707 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (malware-other.rules)
 * 1:55708 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (malware-other.rules)
 * 1:55709 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (malware-other.rules)
 * 1:55710 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (malware-other.rules)
 * 1:55711 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (malware-other.rules)
 * 1:55712 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (malware-other.rules)
 * 1:55713 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (malware-other.rules)
 * 1:55714 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (malware-other.rules)
 * 1:55715 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (malware-other.rules)
 * 1:55716 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (malware-other.rules)
 * 1:55717 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (malware-other.rules)
 * 1:55718 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (malware-other.rules)
 * 1:55719 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (malware-other.rules)
 * 1:55720 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (malware-other.rules)
 * 1:55721 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (malware-other.rules)
 * 1:55722 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (malware-other.rules)
 * 1:55723 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (malware-other.rules)
 * 1:55724 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (malware-other.rules)
 * 1:55725 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (malware-other.rules)
 * 1:55726 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (malware-other.rules)
 * 1:55727 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (malware-other.rules)
 * 1:55728 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (malware-other.rules)
 * 1:55729 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (malware-other.rules)
 * 1:55730 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (malware-other.rules)
 * 1:55731 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (malware-other.rules)
 * 3:55748 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1153 attack attempt (file-office.rules)
 * 3:55749 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1153 attack attempt (file-office.rules)

Modified Rules:


 * 1:45660 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (browser-ie.rules)
 * 1:47510 <-> DISABLED <-> SERVER-WEBAPP RoundCube WebMail IMAP command injection attempt (server-webapp.rules)
 * 1:45659 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (browser-ie.rules)

2020-09-17 12:04:54 UTC

Snort Subscriber Rules Update

Date: 2020-09-17

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091600.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:55705 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (malware-other.rules)
 * 1:55706 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (malware-other.rules)
 * 1:55707 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (malware-other.rules)
 * 1:55708 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (malware-other.rules)
 * 1:55709 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (malware-other.rules)
 * 1:55710 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (malware-other.rules)
 * 1:55711 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (malware-other.rules)
 * 1:55712 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (malware-other.rules)
 * 1:55739 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (malware-other.rules)
 * 1:55740 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (malware-other.rules)
 * 1:55741 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (file-image.rules)
 * 1:55742 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (file-image.rules)
 * 1:55743 <-> DISABLED <-> SERVER-OTHER Exodous Rockwell Automation FactoryTalk Diagnostics remote code execution attempt (server-other.rules)
 * 1:55744 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (malware-other.rules)
 * 1:55745 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (malware-other.rules)
 * 1:55746 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (malware-other.rules)
 * 1:55747 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (malware-other.rules)
 * 1:55738 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (malware-other.rules)
 * 1:55713 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (malware-other.rules)
 * 1:55714 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (malware-other.rules)
 * 1:55715 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (malware-other.rules)
 * 1:55716 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (malware-other.rules)
 * 1:55717 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (malware-other.rules)
 * 1:55718 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (malware-other.rules)
 * 1:55719 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (malware-other.rules)
 * 1:55720 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (malware-other.rules)
 * 1:55721 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (malware-other.rules)
 * 1:55722 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (malware-other.rules)
 * 1:55723 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (malware-other.rules)
 * 1:55724 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (malware-other.rules)
 * 1:55725 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (malware-other.rules)
 * 1:55726 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (malware-other.rules)
 * 1:55727 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (malware-other.rules)
 * 1:55728 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (malware-other.rules)
 * 1:55729 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (malware-other.rules)
 * 1:55730 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (malware-other.rules)
 * 1:55731 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (malware-other.rules)
 * 1:55732 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (malware-other.rules)
 * 1:55733 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (malware-other.rules)
 * 1:55734 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (malware-other.rules)
 * 1:55735 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (malware-other.rules)
 * 1:55736 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (malware-other.rules)
 * 1:55737 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (malware-other.rules)
 * 3:55748 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1153 attack attempt (file-office.rules)
 * 3:55749 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1153 attack attempt (file-office.rules)

Modified Rules:


 * 1:47510 <-> DISABLED <-> SERVER-WEBAPP RoundCube WebMail IMAP command injection attempt (server-webapp.rules)
 * 1:45660 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (browser-ie.rules)
 * 1:45659 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (browser-ie.rules)

2020-09-17 12:04:54 UTC

Snort Subscriber Rules Update

Date: 2020-09-17

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091501.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:55739 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (malware-other.rules)
 * 1:55707 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (malware-other.rules)
 * 1:55706 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (malware-other.rules)
 * 1:55708 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (malware-other.rules)
 * 1:55709 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (malware-other.rules)
 * 1:55710 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (malware-other.rules)
 * 1:55711 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (malware-other.rules)
 * 1:55712 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (malware-other.rules)
 * 1:55705 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (malware-other.rules)
 * 1:55738 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (malware-other.rules)
 * 1:55714 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (malware-other.rules)
 * 1:55713 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (malware-other.rules)
 * 1:55740 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (malware-other.rules)
 * 1:55741 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (file-image.rules)
 * 1:55742 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (file-image.rules)
 * 1:55743 <-> DISABLED <-> SERVER-OTHER Exodous Rockwell Automation FactoryTalk Diagnostics remote code execution attempt (server-other.rules)
 * 1:55744 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (malware-other.rules)
 * 1:55745 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (malware-other.rules)
 * 1:55746 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (malware-other.rules)
 * 1:55747 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (malware-other.rules)
 * 1:55715 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (malware-other.rules)
 * 1:55716 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (malware-other.rules)
 * 1:55717 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (malware-other.rules)
 * 1:55718 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (malware-other.rules)
 * 1:55719 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (malware-other.rules)
 * 1:55720 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (malware-other.rules)
 * 1:55721 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (malware-other.rules)
 * 1:55722 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (malware-other.rules)
 * 1:55723 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (malware-other.rules)
 * 1:55724 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (malware-other.rules)
 * 1:55725 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (malware-other.rules)
 * 1:55726 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (malware-other.rules)
 * 1:55727 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (malware-other.rules)
 * 1:55728 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (malware-other.rules)
 * 1:55729 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (malware-other.rules)
 * 1:55730 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (malware-other.rules)
 * 1:55731 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (malware-other.rules)
 * 1:55732 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (malware-other.rules)
 * 1:55733 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (malware-other.rules)
 * 1:55734 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (malware-other.rules)
 * 1:55735 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (malware-other.rules)
 * 1:55736 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (malware-other.rules)
 * 1:55737 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (malware-other.rules)
 * 3:55749 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1153 attack attempt (file-office.rules)
 * 3:55748 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1153 attack attempt (file-office.rules)

Modified Rules:


 * 1:45659 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (browser-ie.rules)
 * 1:45660 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (browser-ie.rules)
 * 1:47510 <-> DISABLED <-> SERVER-WEBAPP RoundCube WebMail IMAP command injection attempt (server-webapp.rules)

2020-09-17 12:04:54 UTC

Snort Subscriber Rules Update

Date: 2020-09-17

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091500.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:55740 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (malware-other.rules)
 * 1:55741 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (file-image.rules)
 * 1:55742 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (file-image.rules)
 * 1:55745 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (malware-other.rules)
 * 1:55747 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (malware-other.rules)
 * 1:55705 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (malware-other.rules)
 * 1:55738 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (malware-other.rules)
 * 1:55743 <-> DISABLED <-> SERVER-OTHER Exodous Rockwell Automation FactoryTalk Diagnostics remote code execution attempt (server-other.rules)
 * 1:55746 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (malware-other.rules)
 * 1:55708 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (malware-other.rules)
 * 1:55739 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (malware-other.rules)
 * 1:55706 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (malware-other.rules)
 * 1:55709 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (malware-other.rules)
 * 1:55710 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (malware-other.rules)
 * 1:55711 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (malware-other.rules)
 * 1:55712 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (malware-other.rules)
 * 1:55713 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (malware-other.rules)
 * 1:55714 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (malware-other.rules)
 * 1:55715 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (malware-other.rules)
 * 1:55716 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (malware-other.rules)
 * 1:55707 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (malware-other.rules)
 * 1:55717 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (malware-other.rules)
 * 1:55718 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (malware-other.rules)
 * 1:55719 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (malware-other.rules)
 * 1:55720 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (malware-other.rules)
 * 1:55721 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (malware-other.rules)
 * 1:55722 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (malware-other.rules)
 * 1:55723 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (malware-other.rules)
 * 1:55724 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (malware-other.rules)
 * 1:55725 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (malware-other.rules)
 * 1:55726 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (malware-other.rules)
 * 1:55727 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (malware-other.rules)
 * 1:55728 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (malware-other.rules)
 * 1:55729 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (malware-other.rules)
 * 1:55730 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (malware-other.rules)
 * 1:55731 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (malware-other.rules)
 * 1:55732 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (malware-other.rules)
 * 1:55733 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (malware-other.rules)
 * 1:55734 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (malware-other.rules)
 * 1:55735 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (malware-other.rules)
 * 1:55736 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (malware-other.rules)
 * 1:55737 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (malware-other.rules)
 * 1:55744 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (malware-other.rules)
 * 3:55749 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1153 attack attempt (file-office.rules)
 * 3:55748 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1153 attack attempt (file-office.rules)

Modified Rules:


 * 1:45660 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (browser-ie.rules)
 * 1:45659 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (browser-ie.rules)
 * 1:47510 <-> DISABLED <-> SERVER-WEBAPP RoundCube WebMail IMAP command injection attempt (server-webapp.rules)

2020-09-17 12:04:54 UTC

Snort Subscriber Rules Update

Date: 2020-09-17

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091401.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:55740 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (malware-other.rules)
 * 1:55742 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (file-image.rules)
 * 1:55744 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (malware-other.rules)
 * 1:55741 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (file-image.rules)
 * 1:55747 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (malware-other.rules)
 * 1:55746 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (malware-other.rules)
 * 1:55745 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (malware-other.rules)
 * 1:55705 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (malware-other.rules)
 * 1:55738 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (malware-other.rules)
 * 1:55707 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (malware-other.rules)
 * 1:55708 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (malware-other.rules)
 * 1:55717 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (malware-other.rules)
 * 1:55743 <-> DISABLED <-> SERVER-OTHER Exodous Rockwell Automation FactoryTalk Diagnostics remote code execution attempt (server-other.rules)
 * 1:55739 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (malware-other.rules)
 * 1:55706 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (malware-other.rules)
 * 1:55709 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (malware-other.rules)
 * 1:55710 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (malware-other.rules)
 * 1:55711 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (malware-other.rules)
 * 1:55712 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (malware-other.rules)
 * 1:55713 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (malware-other.rules)
 * 1:55714 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (malware-other.rules)
 * 1:55715 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (malware-other.rules)
 * 1:55716 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (malware-other.rules)
 * 1:55718 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (malware-other.rules)
 * 1:55719 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (malware-other.rules)
 * 1:55720 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (malware-other.rules)
 * 1:55721 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (malware-other.rules)
 * 1:55722 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (malware-other.rules)
 * 1:55723 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (malware-other.rules)
 * 1:55724 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (malware-other.rules)
 * 1:55725 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (malware-other.rules)
 * 1:55726 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (malware-other.rules)
 * 1:55727 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (malware-other.rules)
 * 1:55728 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (malware-other.rules)
 * 1:55729 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (malware-other.rules)
 * 1:55730 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (malware-other.rules)
 * 1:55731 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (malware-other.rules)
 * 1:55732 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (malware-other.rules)
 * 1:55733 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (malware-other.rules)
 * 1:55734 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (malware-other.rules)
 * 1:55735 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (malware-other.rules)
 * 1:55736 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (malware-other.rules)
 * 1:55737 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (malware-other.rules)
 * 3:55748 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1153 attack attempt (file-office.rules)
 * 3:55749 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1153 attack attempt (file-office.rules)

Modified Rules:


 * 1:47510 <-> DISABLED <-> SERVER-WEBAPP RoundCube WebMail IMAP command injection attempt (server-webapp.rules)
 * 1:45659 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (browser-ie.rules)
 * 1:45660 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (browser-ie.rules)

2020-09-17 12:04:54 UTC

Snort Subscriber Rules Update

Date: 2020-09-17

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091300.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:55743 <-> DISABLED <-> SERVER-OTHER Exodous Rockwell Automation FactoryTalk Diagnostics remote code execution attempt (server-other.rules)
 * 1:55710 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (malware-other.rules)
 * 1:55741 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (file-image.rules)
 * 1:55742 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (file-image.rules)
 * 1:55747 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (malware-other.rules)
 * 1:55746 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (malware-other.rules)
 * 1:55705 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (malware-other.rules)
 * 1:55738 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (malware-other.rules)
 * 1:55709 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (malware-other.rules)
 * 1:55744 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (malware-other.rules)
 * 1:55745 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (malware-other.rules)
 * 1:55739 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (malware-other.rules)
 * 1:55711 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (malware-other.rules)
 * 1:55706 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (malware-other.rules)
 * 1:55707 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (malware-other.rules)
 * 1:55740 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (malware-other.rules)
 * 1:55712 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (malware-other.rules)
 * 1:55713 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (malware-other.rules)
 * 1:55714 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (malware-other.rules)
 * 1:55715 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (malware-other.rules)
 * 1:55716 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (malware-other.rules)
 * 1:55717 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (malware-other.rules)
 * 1:55718 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (malware-other.rules)
 * 1:55719 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (malware-other.rules)
 * 1:55708 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (malware-other.rules)
 * 1:55720 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (malware-other.rules)
 * 1:55721 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (malware-other.rules)
 * 1:55722 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (malware-other.rules)
 * 1:55723 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (malware-other.rules)
 * 1:55724 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (malware-other.rules)
 * 1:55725 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (malware-other.rules)
 * 1:55726 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (malware-other.rules)
 * 1:55727 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (malware-other.rules)
 * 1:55728 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (malware-other.rules)
 * 1:55729 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (malware-other.rules)
 * 1:55730 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (malware-other.rules)
 * 1:55731 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (malware-other.rules)
 * 1:55732 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (malware-other.rules)
 * 1:55733 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (malware-other.rules)
 * 1:55734 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (malware-other.rules)
 * 1:55735 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (malware-other.rules)
 * 1:55736 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (malware-other.rules)
 * 1:55737 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (malware-other.rules)
 * 3:55748 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1153 attack attempt (file-office.rules)
 * 3:55749 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1153 attack attempt (file-office.rules)

Modified Rules:


 * 1:45659 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (browser-ie.rules)
 * 1:47510 <-> DISABLED <-> SERVER-WEBAPP RoundCube WebMail IMAP command injection attempt (server-webapp.rules)
 * 1:45660 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (browser-ie.rules)

2020-09-17 12:04:54 UTC

Snort Subscriber Rules Update

Date: 2020-09-17

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091101.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:55741 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (file-image.rules)
 * 1:55742 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (file-image.rules)
 * 1:55707 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (malware-other.rules)
 * 1:55738 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (malware-other.rules)
 * 1:55705 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (malware-other.rules)
 * 1:55706 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (malware-other.rules)
 * 1:55747 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (malware-other.rules)
 * 1:55743 <-> DISABLED <-> SERVER-OTHER Exodous Rockwell Automation FactoryTalk Diagnostics remote code execution attempt (server-other.rules)
 * 1:55740 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (malware-other.rules)
 * 1:55708 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (malware-other.rules)
 * 1:55710 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (malware-other.rules)
 * 1:55711 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (malware-other.rules)
 * 1:55745 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (malware-other.rules)
 * 1:55746 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (malware-other.rules)
 * 1:55721 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (malware-other.rules)
 * 1:55712 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (malware-other.rules)
 * 1:55739 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (malware-other.rules)
 * 1:55709 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (malware-other.rules)
 * 1:55713 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (malware-other.rules)
 * 1:55714 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (malware-other.rules)
 * 1:55715 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (malware-other.rules)
 * 1:55716 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (malware-other.rules)
 * 1:55717 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (malware-other.rules)
 * 1:55718 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (malware-other.rules)
 * 1:55719 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (malware-other.rules)
 * 1:55720 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (malware-other.rules)
 * 1:55722 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (malware-other.rules)
 * 1:55723 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (malware-other.rules)
 * 1:55724 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (malware-other.rules)
 * 1:55725 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (malware-other.rules)
 * 1:55726 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (malware-other.rules)
 * 1:55727 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (malware-other.rules)
 * 1:55728 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (malware-other.rules)
 * 1:55729 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (malware-other.rules)
 * 1:55730 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (malware-other.rules)
 * 1:55731 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (malware-other.rules)
 * 1:55732 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (malware-other.rules)
 * 1:55733 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (malware-other.rules)
 * 1:55734 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (malware-other.rules)
 * 1:55735 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (malware-other.rules)
 * 1:55736 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (malware-other.rules)
 * 1:55737 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (malware-other.rules)
 * 1:55744 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (malware-other.rules)
 * 3:55749 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1153 attack attempt (file-office.rules)
 * 3:55748 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1153 attack attempt (file-office.rules)

Modified Rules:


 * 1:45659 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (browser-ie.rules)
 * 1:45660 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (browser-ie.rules)
 * 1:47510 <-> DISABLED <-> SERVER-WEBAPP RoundCube WebMail IMAP command injection attempt (server-webapp.rules)

2020-09-17 12:04:54 UTC

Snort Subscriber Rules Update

Date: 2020-09-17

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3000.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:55706 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (snort3-malware-other.rules)
 * 1:55739 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (snort3-malware-other.rules)
 * 1:55745 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (snort3-malware-other.rules)
 * 1:55746 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (snort3-malware-other.rules)
 * 1:55744 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (snort3-malware-other.rules)
 * 1:55707 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (snort3-malware-other.rules)
 * 1:55747 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (snort3-malware-other.rules)
 * 1:55740 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (snort3-malware-other.rules)
 * 1:55708 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (snort3-malware-other.rules)
 * 1:55709 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (snort3-malware-other.rules)
 * 1:55710 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (snort3-malware-other.rules)
 * 1:55711 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (snort3-malware-other.rules)
 * 1:55741 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (snort3-file-image.rules)
 * 1:55712 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (snort3-malware-other.rules)
 * 1:55713 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (snort3-malware-other.rules)
 * 1:55714 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (snort3-malware-other.rules)
 * 1:55742 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (snort3-file-image.rules)
 * 1:55715 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (snort3-malware-other.rules)
 * 1:55716 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (snort3-malware-other.rules)
 * 1:55717 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (snort3-malware-other.rules)
 * 1:55718 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (snort3-malware-other.rules)
 * 1:55705 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (snort3-malware-other.rules)
 * 1:55719 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (snort3-malware-other.rules)
 * 1:55720 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (snort3-malware-other.rules)
 * 1:55721 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (snort3-malware-other.rules)
 * 1:55722 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (snort3-malware-other.rules)
 * 1:55723 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (snort3-malware-other.rules)
 * 1:55724 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (snort3-malware-other.rules)
 * 1:55725 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (snort3-malware-other.rules)
 * 1:55726 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (snort3-malware-other.rules)
 * 1:55727 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (snort3-malware-other.rules)
 * 1:55728 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (snort3-malware-other.rules)
 * 1:55729 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (snort3-malware-other.rules)
 * 1:55730 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (snort3-malware-other.rules)
 * 1:55731 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (snort3-malware-other.rules)
 * 1:55732 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (snort3-malware-other.rules)
 * 1:55733 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (snort3-malware-other.rules)
 * 1:55734 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (snort3-malware-other.rules)
 * 1:55735 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (snort3-malware-other.rules)
 * 1:55736 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (snort3-malware-other.rules)
 * 1:55737 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (snort3-malware-other.rules)
 * 1:55738 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (snort3-malware-other.rules)
 * 1:55743 <-> DISABLED <-> SERVER-OTHER Exodous Rockwell Automation FactoryTalk Diagnostics remote code execution attempt (snort3-server-other.rules)

Modified Rules:


 * 1:45659 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (snort3-browser-ie.rules)
 * 1:47510 <-> DISABLED <-> SERVER-WEBAPP RoundCube WebMail IMAP command injection attempt (snort3-server-webapp.rules)
 * 1:45660 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (snort3-browser-ie.rules)

2020-09-17 12:04:54 UTC

Snort Subscriber Rules Update

Date: 2020-09-17

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:55742 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (file-image.rules)
 * 1:55723 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (malware-other.rules)
 * 1:55732 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (malware-other.rules)
 * 1:55746 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (malware-other.rules)
 * 1:55725 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (malware-other.rules)
 * 1:55734 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (malware-other.rules)
 * 1:55727 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (malware-other.rules)
 * 1:55736 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (malware-other.rules)
 * 1:55729 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (malware-other.rules)
 * 1:55731 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Generickdz-9761624-0 download attempt (malware-other.rules)
 * 1:55733 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9761753-0 download attempt (malware-other.rules)
 * 1:55735 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Zeroaccess-9762029-0 download attempt (malware-other.rules)
 * 1:55740 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (malware-other.rules)
 * 1:55739 <-> DISABLED <-> MALWARE-OTHER Win.Keylogger.Zeroaccess-9762049-0 download attempt (malware-other.rules)
 * 1:55743 <-> DISABLED <-> SERVER-OTHER Exodous Rockwell Automation FactoryTalk Diagnostics remote code execution attempt (server-other.rules)
 * 1:55712 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (malware-other.rules)
 * 1:55744 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (malware-other.rules)
 * 1:55707 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (malware-other.rules)
 * 1:55706 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (malware-other.rules)
 * 1:55745 <-> DISABLED <-> MALWARE-OTHER PUA.Win.Adware.Eorezo-9762085-0 download attempt (malware-other.rules)
 * 1:55747 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Trojanx-9762074-0 download attempt (malware-other.rules)
 * 1:55717 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (malware-other.rules)
 * 1:55711 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Tdss-9761341-0 download attempt (malware-other.rules)
 * 1:55737 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (malware-other.rules)
 * 1:55708 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Urausy-9761337-0 download attempt (malware-other.rules)
 * 1:55738 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9762035-0 download attempt (malware-other.rules)
 * 1:55713 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (malware-other.rules)
 * 1:55705 <-> DISABLED <-> MALWARE-OTHER Win.Packed.Cryptowall-9761312-0 download attempt (malware-other.rules)
 * 1:55714 <-> DISABLED <-> MALWARE-OTHER Win.Dropper.Zbot-9761347-0 download attempt (malware-other.rules)
 * 1:55716 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (malware-other.rules)
 * 1:55719 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (malware-other.rules)
 * 1:55721 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (malware-other.rules)
 * 1:55710 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (malware-other.rules)
 * 1:55709 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Zeroaccess-9761339-0 download attempt (malware-other.rules)
 * 1:55715 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.Urausy-9761556-0 download attempt (malware-other.rules)
 * 1:55741 <-> DISABLED <-> FILE-IMAGE Foxit Reader parsing JPEG with ConvertToPDF remote code execution attempt (file-image.rules)
 * 1:55724 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761425-0 download attempt (malware-other.rules)
 * 1:55718 <-> DISABLED <-> MALWARE-OTHER Win.Worm.Slenfbot-9761391-0 download attempt (malware-other.rules)
 * 1:55726 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761426-0 download attempt (malware-other.rules)
 * 1:55720 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Nitol-9761421-0 download attempt (malware-other.rules)
 * 1:55728 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761427-0 download attempt (malware-other.rules)
 * 1:55722 <-> DISABLED <-> MALWARE-OTHER Win.Malware.Magania-9761424-0 download attempt (malware-other.rules)
 * 1:55730 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Ircbot-9761414-0 download attempt (malware-other.rules)
 * 3:55749 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1153 attack attempt (file-office.rules)
 * 3:55748 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2020-1153 attack attempt (file-office.rules)

Modified Rules:


 * 1:45660 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (browser-ie.rules)
 * 1:45659 <-> ENABLED <-> BROWSER-IE Microsoft Edge scripting engine memory corruption attempt (browser-ie.rules)
 * 1:47510 <-> DISABLED <-> SERVER-WEBAPP RoundCube WebMail IMAP command injection attempt (server-webapp.rules)