Cisco Talos released the newest set of rules for SNORTⓇ this morning.
.tg {border-collapse:collapse;border-spacing:0;} .tg td{border-color:black;border-style:solid;border-width:1px;font-family:Arial, sans-serif;font-size:14px; overflow:hidden;padding:10px 5px;word-break:normal;} .tg th{border-color:black;border-style:solid;border-width:1px;font-family:Arial, sans-serif;font-size:14px; font-weight:normal;overflow:hidden;padding:10px 5px;word-break:normal;} .tg .tg-6p4y{border-color:#efefef;font-weight:bold;text-align:left;vertical-align:top} .tg .tg-li6d{border-color:#efefef;text-align:center;vertical-align:top}
| Shared object rules | Modified shared object rules | New rules | Modified rules |
|---|---|---|---|
| 11 | 0 | 50 | 503 |
Tuesday's release is full of new rules protecting against various malware strains. Among them are new protections against Emotet, which is now disguising itself as a fake Windows update. There's also new coverage for the Cerber ransomware and the UPATRE trojan.
There were no changes made to the snort.conf in this release.
Talos's rule release: Talos has added and modified multiple rules in the browser-webkit, file-pdf, indicator-compromise, malware-cnc, malware-other, os-linux and server-webapp rule sets to provide coverage for emerging threats from these technologies. You can subscribe to Talos' newest rule detection functionality for as low as $29 a year with a personal account. Be sure and see our business pricing as well here. Make sure and stay up to date to catch the most emerging threats.
