Snort mailing list archives
Snort.org Blog: VRT Rule Update for 4/3/2012, Rule-Recategorization
From: Joel Esler <jesler () sourcefire com>
Date: Tue, 3 Apr 2012 17:35:41 -0400
http://blog.snort.org/2012/04/vrt-rule-update-for-432012-rule.html VRT Rule Update for 4/3/2012, Rule-Recategorization Join us as we welcome the introduction of the newest rule release for today from the VRT. In this release we introduced 30 new rules and made modifications to 169 additional rules. The following changes made to the snort.conf in this release, these can be added to the bottom of the snort.conf where the rule declarations are made: include $RULE_PATH/file-office.rules include $RULE_PATH/file-other.rules include $RULE_PATH/file-pdf.rules include $RULE_PATH/indicator-compromise.rules include $RULE_PATH/indicator-obfuscation.rules include $RULE_PATH/policy-multimedia.rules include $RULE_PATH/policy-other.rules include $RULE_PATH/policy-social.rules include $RULE_PATH/pua-p2p.rules include $RULE_PATH/pua-toolbars.rules include $RULE_PATH/server-mail.rules In VRT's rule release: Synopsis: This release introduces eleven new rule categories and contains new and modified rules in several categories. Details: This release introduces eleven new rule categories: File-Office File-Other File-PDF Indicator-Compromise Indicator-Obfuscation Policy-Multimedia Policy-Other Policy-Social PUA-P2P PUA-Toolbars Server-Mail These categories have been populated with rules that were formerly in policy.rules, leaving 36 rules in that category. These will be moved in the near future. This release contains new and modified rules in the backdoor, botnet-cnc, dos, exploit, file-identify, file-office, file-other, file-pdf, indicator-compromise, indicator-obfuscation, mysql, policy-multimedia, policy-other, policy-social, pua-p2p, pua-toolbars, server-mail, specific-threats, spyware-put, voip, web-client and web-php rule sets to provide coverage for emerging threats from these technologies. In order to subscribe now to the VRT's newest rule detection functionality, you can subscribe for as low as $29 US dollars a year for personal users, be sure and see our business pricing as well at http://www.snort.org/store. Make sure and stay up to date to catch the most emerging threats!
------------------------------------------------------------------------------ Better than sec? Nothing is better than sec when it comes to monitoring Big Data applications. Try Boundary one-second resolution app monitoring today. Free. http://p.sf.net/sfu/Boundary-dev2dev
_______________________________________________ Snort-devel mailing list Snort-devel () lists sourceforge net https://lists.sourceforge.net/lists/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!
Current thread:
- Snort.org Blog: VRT Rule Update for 4/3/2012, Rule-Recategorization Joel Esler (Apr 03)