Sourcefire VRT Update for Sourcefire 3D System

Date: 2015-01-29

This SRU number: 2015-01-29-001
Previous SRU number: 2015-01-26-001

Applies to:

3D Sensor versions: 5.x
Defense Center versions: 5.x

This SEU number: 1241
Previous SEU: 1238

Applies to:

3D Sensor Versions: 4.10
Defense Center Versions: 4.10

This is the complete list of rules added in SRU 2015-01-29-001 and SEU 1241.

The format of the file is:

GID - SID - Rule Group - Rule Message - Policy State

The Policy State refers to each default Sourcefire policy, Connectivity, Balanced and Security.

The default passive policy state is the same as the Balanced policy state with the exception of alert being used instead of drop.

Note: Unless stated explicitly, the rules are for the series of products listed above.

New Rules:

**High Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.
1	33217	MALWARE-CNC	Win.Trojan.Nuovoscor variant outbound connection	off	drop	drop
1	33218	MALWARE-CNC	Win.Trojan.Cendode system information disclosure attempt	off	drop	drop
1	33219	MALWARE-CNC	Win.Trojan.Gamarue variant outbound connection attempt	off	drop	drop
1	33220	MALWARE-CNC	Win.Trojan.HawkEye keylogger exfiltration attempt	off	drop	drop
1	33221	MALWARE-CNC	Win.Trojan.HawkEye Keylogger exfiltration attempt - clipboard and screenshot	off	off	off
1	33222	MALWARE-CNC	Win.Trojan.HawkEye Keylogger exfiltration attempt - clipboard and screenshot	off	drop	drop
1	33223	MALWARE-CNC	Win.Trojan.HawkEye Keylogger exfiltration attempt - clipboard and screenshot	off	drop	drop
1	33225	SERVER-MAIL	Exim gethostbyname heap buffer overflow attempt	off	drop	drop
1	33226	SERVER-MAIL	Exim gethostbyname heap buffer overflow attempt	off	drop	drop
1	33227	MALWARE-CNC	Win.Trojan.HawkEye Keylogger exfiltration attempt - clipboard and screenshot	off	drop	drop
1	33228	MALWARE-CNC	Win.Kovter variant outbound connection attempt	off	drop	drop
3	33229	SERVER-WEBAPP	Cisco Prime Services Catalog XML external entity injection attempt	off	off	drop
1	33230	BLACKLIST	User-Agent known malicious user-agent string - Firefox - Win.Backdoor.Upatre	off	drop	drop
1	33231	BLACKLIST	User-Agent known malicious user-agent string - Firefox/5.0 - Win.Backdoor.Upatre	off	drop	drop
1	33232	BLACKLIST	User-Agent known malicious user-agent string - AppUpdate - Win.Backdoor.Upatre	off	drop	drop
1	33233	BLACKLIST	User-Agent known malicious user-agent string - 2608cw-1 - Win.Backdoor.Upatre	off	drop	drop
1	33234	BLACKLIST	User-Agent known malicious user-agent string - 2508Inst - Win.Backdoor.Upatre	off	drop	drop
1	33235	BLACKLIST	User-Agent known malicious user-agent string - 2608cw-2 - Win.Backdoor.Upatre	off	drop	drop
1	33236	BLACKLIST	User-Agent known malicious user-agent string - 2808inst - Win.Backdoor.Upatre	off	drop	drop
1	33237	BLACKLIST	User-Agent known malicious user-agent string - Player - Win.Backdoor.Upatre	off	drop	drop
1	33238	BLACKLIST	User-Agent known malicious user-agent string - Wurst - Win.Backdoor.Upatre	off	drop	drop
1	33239	BLACKLIST	User-Agent known malicious user-agent string - Installer/1.0 - Win.Backdoor.Upatre	off	drop	drop
1	33240	BLACKLIST	User-Agent known malicious user-agent string - FixUpdate - Win.Backdoor.Upatre	off	drop	drop
1	33241	DELETED	BLACKLIST User-Agent known malicious user-agent string - MSDW - Win.Backdoor.Upatre
1	33242	BLACKLIST	User-Agent known malicious user-agent string - Explorer - Win.Backdoor.Upatre	off	drop	drop
1	33243	BLACKLIST	User-Agent known malicious user-agent string - Mozilla - Win.Backdoor.Upatre	off	drop	drop
1	33244	BLACKLIST	User-Agent known malicious user-agent string - Opera - Win.Backdoor.Upatre	off	drop	drop
1	33245	BLACKLIST	User-Agent known malicious user-agent string - Opera10 - Win.Backdoor.Upatre	off	drop	drop
1	33246	BLACKLIST	User-Agent known malicious user-agent string - OperaMini - Win.Backdoor.Upatre	off	drop	drop
1	33247	BLACKLIST	User-Agent known malicious user-agent string - PPKHandler - Win.Backdoor.Upatre	off	drop	drop
1	33248	BLACKLIST	User-Agent known malicious user-agent string - Peers12 - Win.Backdoor.Upatre	off	drop	drop
1	33249	BLACKLIST	User-Agent known malicious user-agent string - SLSSoapClient - Win.Backdoor.Upatre	off	drop	drop
1	33250	BLACKLIST	User-Agent known malicious user-agent string - Tintin - Win.Backdoor.Upatre	off	drop	drop
1	33251	BLACKLIST	User-Agent known malicious user-agent string - USER_CHECK - Win.Backdoor.Upatre	off	drop	drop
1	33252	BLACKLIST	User-Agent known malicious user-agent string - WATClient - Win.Backdoor.Upatre	off	drop	drop
1	33253	BLACKLIST	User-Agent known malicious user-agent string - bbbbbbbbbb - Win.Backdoor.Upatre	off	drop	drop
1	33254	BLACKLIST	User-Agent known malicious user-agent string - hi - Win.Backdoor.Upatre	off	drop	drop
1	33255	BLACKLIST	User-Agent known malicious user-agent string - iMacros - Win.Backdoor.Upatre	off	drop	drop
1	33256	BLACKLIST	User-Agent known malicious user-agent string - macrotest - Win.Backdoor.Upatre	off	drop	drop
1	33257	BLACKLIST	User-Agent known malicious user-agent string - onlymacros - Win.Backdoor.Upatre	off	drop	drop
1	33258	BLACKLIST	User-Agent known malicious user-agent string - Updates downloader - Win.Backdoor.Upatre	off	drop	drop
1	33259	BLACKLIST	User-Agent known malicious user-agent string - testupdate - Win.Backdoor.Upatre	off	drop	drop
1	33260	BLACKLIST	User-Agent known malicious user-agent string - onlyupdate - Win.Backdoor.Upatre	off	drop	drop
1	33261	FILE-FLASH	Adobe Flash Player byte array uncompress information disclosure attempt	drop	drop	drop
1	33262	FILE-FLASH	Adobe Flash Player byte array uncompress information disclosure attempt	drop	drop	drop
1	33263	FILE-FLASH	Adobe Flash Player byte array uncompress information disclosure attempt	drop	drop	drop
1	33264	FILE-FLASH	Adobe Flash Player byte array uncompress information disclosure attempt	drop	drop	drop
1	33265	FILE-FLASH	Adobe Flash Player byte array uncompress information disclosure attempt	drop	drop	drop
1	33266	FILE-FLASH	Adobe Flash Player byte array uncompress information disclosure attempt	drop	drop	drop
1	33267	FILE-FLASH	Adobe Flash Player byte array uncompress information disclosure attempt	drop	drop	drop
1	33268	FILE-FLASH	Adobe Flash Player byte array uncompress information disclosure attempt	drop	drop	drop
1	33269	FILE-FLASH	Adobe Flash Player byte array uncompress information disclosure attempt	drop	drop	drop
1	33270	FILE-FLASH	Adobe Flash Player byte array uncompress information disclosure attempt	drop	drop	drop
1	33271	EXPLOIT-KIT	Angler exploit kit Adobe Flash SWF exploit download	off	drop	drop
1	33272	EXPLOIT-KIT	Angler exploit kit Adobe Flash SWF exploit download	off	drop	drop
1	33273	EXPLOIT-KIT	Angler exploit kit Adobe Flash SWF exploit download	off	drop	drop
1	33274	EXPLOIT-KIT	Angler exploit kit Adobe Flash SWF exploit download	off	drop	drop

**Low Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.
1	33224	INDICATOR-COMPROMISE	DNS request for known malware domain tor2web.org	off	off	off

Updated Rules:

Updated rules can be found at this link.