Cisco Talos (VRT) Update for Sourcefire 3D System

* Talos combines our security experts from TRAC, SecApps, and VRT teams.

Date: 2016-05-02

This SRU number: 2016-05-02-001
Previous SRU number: 2016-04-27-001

Applies to:

3D Sensor versions: 5.x
Cisco FireSIGHT Management Center (formerly Defense Center) versions: 5.x

This SEU number: 1475
Previous SEU: 1473

Applies to:

3D Sensor Versions: 4.10
Cisco FireSIGHT Management Center (formerly Defense Center) versions: 4.10

This is the complete list of rules modified in SRU 2016-05-02-001 and SEU 1475.

The format of the file is:

GID - SID - Rule Group - Rule Message - Policy State

The Policy State refers to each default Sourcefire policy, Connectivity, Balanced and Security.

The default passive policy state is the same as the Balanced policy state with the exception of alert being used instead of drop.

Note: Unless stated explicitly, the rules are for the series of products listed above.

Updated Rules:

**High Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.
1	21072	SERVER-APACHE	Apache Struts remote code execution attempt - GET parameter	off	drop	drop
1	21656	SERVER-APACHE	Apache Struts remote code execution attempt - GET parameter	off	drop	drop
1	23631	SERVER-APACHE	Apache Struts remote code execution attempt - POST parameter	off	drop	drop
1	26399	BLACKLIST	DNS request for known malware domain f.eastmoon.pl - Win.Trojan.Dorkbot	off	drop	drop
1	26400	BLACKLIST	DNS request for known malware domain s.richlab.pl - Win.Trojan.Dorkbot	off	drop	drop
1	26401	BLACKLIST	DNS request for known malware domain gigasbh.org - Win.Trojan.Dorkbot	off	drop	drop
1	26402	BLACKLIST	DNS request for known malware domain xixbh.com - Win.Trojan.Dorkbot	off	drop	drop
1	26403	BLACKLIST	DNS request for known malware domain h.opennews.su - Win.Trojan.Dorkbot	off	drop	drop
1	26404	BLACKLIST	DNS request for known malware domain o.dailyradio.su - Win.Trojan.Dorkbot	off	drop	drop
1	26405	BLACKLIST	DNS request for known malware domain xixbh.net - Win.Trojan.Dorkbot	off	drop	drop
1	26406	BLACKLIST	DNS request for known malware domain photobeat.su - Win.Trojan.Dorkbot	off	drop	drop
1	26407	BLACKLIST	DNS request for known malware domain uranus.kei.su - Win.Trojan.Dorkbot	off	drop	drop
1	26408	BLACKLIST	DNS request for known malware domain gigasphere.su - Win.Trojan.Dorkbot	off	drop	drop
1	26409	BLACKLIST	DNS request for known malware domain ext.myshopers.com - Win.Trojan.Dorkbot	off	drop	drop
1	26554	BLACKLIST	DNS request for known malware domain d1js21szq85hyn.cloudfront.net - Win.Adware.BProtector	off	drop	drop
1	26555	BLACKLIST	DNS request for known malware domain xxxxxxxxxxxxxxx.kei.su - Win.Trojan.Dorkbot	off	drop	drop
1	26556	BLACKLIST	DNS request for known malware domain f.dailyradio.su - Win.Trojan.Dorkbot	off	drop	drop