Cisco Talos (VRT) Update for Sourcefire 3D System

* Talos combines our security experts from TRAC, SecApps, and VRT teams.

This SRU number: 2016-04-21-001
Previous SRU number: 2016-04-18-001

Applies to:

This SEU number: 1470
Previous SEU: 1468

Applies to:

This is the complete list of rules added in SRU 2016-04-21-001 and SEU 1470.

The format of the file is:

GID - SID - Rule Group - Rule Message - Policy State

The Policy State refers to each default Sourcefire policy, Connectivity, Balanced and Security.

The default passive policy state is the same as the Balanced policy state with the exception of alert being used instead of drop.

Note: Unless stated explicitly, the rules are for the series of products listed above.

New Rules:

**High Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.
3	38578	SERVER-OTHER	TRUFFLEHUNTER TALOS-CAN-0142 attack attempt	off	off	off
1	38580	FILE-OFFICE	RFT document malformed header	off	drop	drop
1	38581	FILE-OFFICE	RFT document malformed header	off	drop	drop
1	38582	EXPLOIT-KIT	Nuclear exploit kit landing page detected	off	off	drop
3	38583	SERVER-OTHER	TRUFFLEHUNTER TALOS-CAN-0143 attack attempt	off	off	off
1	38584	MALWARE-CNC	Win.Backdoor.DFSCook variant JS dropper outbound connection	off	drop	drop
1	38585	MALWARE-CNC	Win.Backdoor.DFSCook variant outbound connection attempt	off	drop	drop
1	38586	MALWARE-CNC	Win.Backdoor.DFSCook variant outbound connection attempt	off	drop	drop
1	38587	MALWARE-CNC	Win.Backdoor.DFSCook variant temporary redirect attempt	off	drop	drop
1	38588	MALWARE-CNC	Win.Backdoor.DFSCook variant outbound connection attempt	off	drop	drop
1	38589	EXPLOIT-KIT	vbscript downloading executable attempt	off	off	drop
1	38592	EXPLOIT-KIT	Nuclear Exploit Kit back end communications attempt	off	drop	drop
1	38593	EXPLOIT-KIT	Nuclear Exploit Kit back end communications attempt	off	drop	drop

**Medium Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.
1	38579	SERVER-WEBAPP	Atvise denial of service attempt	off	off	drop
3	38590	SERVER-OTHER	Cisco Wireless LAN Controller mDNS denial of service attempt	off	off	off
3	38591	SERVER-WEBAPP	Cisco WLAN Controller management interface denial of service attempt	off	off	off
1	38595	INDICATOR-OBFUSCATION	Invalid HTTP version evasion attempt	off	off	off

**Low Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.
1	38594	APP-DETECT	Bloomberg web crawler outbound connection	off	off	off

Updated rules can be found at this link.