question

["Hummert, Austin" <Austin.Hummert () adm com>]

Hello all,

I have a question on a rule that's been firing in my environment.

OS-WINDOWS TRUFFLEHUNTER TALOS-2015-0005 attack attempt (3:36222)

I understand the concept of trufflehunter rules, but I'm wondering how other people are handling these. The packets 
triggering this rule appear to be legitimate outbound traffic, and the destination does not appear to be blacklisted in 
any way. The problem is I don't know exactly what the rule is looking for so it makes it difficult to verify the 
traffic itself.

Any thoughts on trufflehunter?

Thanks,

Austin



Confidentiality Notice:
This message may contain confidential or privileged information, or information that is otherwise exempt from 
disclosure. If you are not the intended recipient, you should promptly delete it and should not disclose, copy or 
distribute it to others.


------------------------------------------------------------------------------

_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!