Cisco Talos (VRT) Update for Sourcefire 3D System

* Talos combines our security experts from TRAC, SecApps, and VRT teams.

This SRU number: 2016-09-07-001
Previous SRU number: 2016-09-06-001

Applies to:

This SEU number: 1541
Previous SEU: 1540

Applies to:

This is the complete list of rules added in SRU 2016-09-07-001 and SEU 1541.

The format of the file is:

GID - SID - Rule Group - Rule Message - Policy State

The Policy State refers to each default Sourcefire policy, Connectivity, Balanced and Security.

The default passive policy state is the same as the Balanced policy state with the exception of alert being used instead of drop.

Note: Unless stated explicitly, the rules are for the series of products listed above.

New Rules:

**High Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.
1	40050	MALWARE-OTHER	Win.Trojan.Swabfex download attempt	off	drop	drop
1	40051	MALWARE-OTHER	Win.Trojan.Swabfex download attempt	off	drop	drop
1	40052	MALWARE-OTHER	Win.Trojan.Swabfex download attempt	off	drop	drop
1	40053	MALWARE-OTHER	Win.Trojan.Swabfex download attempt	off	drop	drop
1	40054	MALWARE-OTHER	Win.Trojan.Swabfex download attempt	off	drop	drop
1	40055	MALWARE-OTHER	Win.Trojan.Swabfex download attempt	off	drop	drop
1	40056	MALWARE-OTHER	Win.Trojan.Swabfex download attempt	off	drop	drop
1	40057	MALWARE-OTHER	Win.Trojan.Swabfex download attempt	off	drop	drop
1	40058	SERVER-WEBAPP	WordPress Quick-Post Widget GET request using Body cross-site scripting	off	off	off
1	40059	MALWARE-CNC	Win.Trojan.Hadsruda outbound connection detected	off	drop	drop
1	40060	MALWARE-CNC	Win.Trojan.Hadsruda outbound connection detected	off	drop	drop
1	40061	MALWARE-CNC	Win.Backdoor.Morel variant outbound connection	off	off	off
1	40062	MALWARE-CNC	Win.Backdoor.Morel variant inbound connection	off	off	off
1	40063	OS-LINUX	Linux Kernel Challenge ACK provocation attempt	off	off	off
1	40066	BLACKLIST	DNS request for known malware domain web4solution.net - Win.Trojan.Shakti	off	drop	drop
1	40067	MALWARE-CNC	Win.Trojan.Fareit outbound connection attempt	off	drop	drop

**Medium Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.
1	40064	OS-WINDOWS	Microsoft Windows NFS Server NULL pointer dereference denial-of-service attempt	off	off	drop
1	40065	OS-WINDOWS	Microsoft Windows NFS Server NULL pointer dereference denial-of-service attempt	off	off	off

Updated rules can be found at this link.