Re: False Positives on EXPLOIT-KIT Fiesta exploit kit Adobe Reader exploit download (1:34334:7)

[강명훈 via Snort-sigs <snort-sigs () lists snort org>]

Add a condition for except after extract common patterns of false positives.
Can you show the raw events?

2017-10-27 12:24 GMT+09:00 Joel Esler (jesler) via Snort-sigs <
snort-sigs () lists snort org>:

> The Fiesta exploit kit is largely dead.
>
>
> *--*
> *Joel Esler *| *Talos:* Manager | jesler () cisco com
>
>
>
>
>
>
> On Oct 26, 2017, at 2:03 AM, Egon Grünter <e.gruenter () fz-juelich de>
> wrote:
>
> Hi list members,
>
> we have a lot of events on EXPLOIT-KIT Fiesta exploit kit Adobe Reader
> exploit
> download (1:34334:7). It triggers for any pdf-file that matches the
> following
> regex: [a.z]{5,8}[0-9]{2,3}.pdf
>
> I don't want to disable this signature. Does anyone know about
> improvements?
>
>
>
> _______________________________________________
> Snort-sigs mailing list
> Snort-sigs () lists snort org
> https://lists.snort.org/mailman/listinfo/snort-sigs
>
> Please visit http://blog.snort.org for the latest news about Snort!
>
> Please follow these rules: https://snort.org/faq/what-is-
> the-mailing-list-etiquette
>
> Visit the Snort.org to subscribe to the official Snort ruleset, make sure
> to stay up to date to catch the most <a href="
> https://snort.org/downloads/#rule-downloads";>emerging threats</a>!


-- 
-----------------------
Kang Myoung-hun
-----------------------
+82-10 6604 6084
kangmyounghun.blogspot.kr

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org
https://lists.snort.org/mailman/listinfo/snort-sigs

Please visit http://blog.snort.org for the latest news about Snort!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

Visit the Snort.org to subscribe to the official Snort ruleset, make sure to stay up to date to catch the most <a 
href=" https://snort.org/downloads/#rule-downloads";>emerging threats</a>!