Cisco Talos (VRT) Update for Sourcefire 3D System

* Talos combines our security experts from TRAC, SecApps, and VRT teams.

This SRU number: 2017-03-01-001
Previous SRU number: 2017-02-28-001

Applies to:

This SEU number: 1623
Previous SEU: 1622

Applies to:

This is the complete list of rules added in SRU 2017-03-01-001 and SEU 1623.

The format of the file is:

GID - SID - Rule Group - Rule Message - Policy State

The Policy State refers to each default Sourcefire policy, Connectivity, Balanced and Security.

The default passive policy state is the same as the Balanced policy state with the exception of alert being used instead of drop.

Note: Unless stated explicitly, the rules are for the series of products listed above.

New Rules:

**High Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.
1	41772	BROWSER-IE	Microsoft Internet Explorer runtimeStyle use-after-free attempt	off	off	off
1	41773	BROWSER-IE	Microsoft Internet Explorer runtimeStyle use-after-free attempt	off	off	off
1	41774	BROWSER-IE	Microsoft Internet Explorer runtimeStyle use-after-free attempt	off	off	off
1	41775	BROWSER-IE	Microsoft Internet Explorer runtimeStyle use-after-free attempt	off	off	off
1	41776	BROWSER-IE	Microsoft Internet Explorer runtimeStyle use-after-free attempt	off	off	off
1	41777	BROWSER-IE	Microsoft Internet Explorer runtimeStyle use-after-free attempt	off	off	off
1	41778	PROTOCOL-SCADA	Yokogawa CS3000 BKFSim_vhfd buffer overflow attempt	off	drop	drop
1	41779	BLACKLIST	DNS request for known malware domain eye-watch.in - Ratankba	off	drop	drop
1	41780	MALWARE-CNC	Win.Trojan.Ratankba variant outbound connection	off	drop	drop
1	41781	SERVER-WEBAPP	carel plantvisorpro3 directory traversal attempt	off	drop	drop
1	41782	SERVER-WEBAPP	carel plantvisorpro3 directory traversal attempt	off	drop	drop
1	41783	EXPLOIT-KIT	Rig exploit kit URL outbound communication	off	drop	drop
1	41785	SERVER-WEBAPP	carel plantvisor directory traversal exploitation attempt	off	off	off
1	41787	MALWARE-CNC	Win.Trojan.PowerMacro TCP DNS query response	off	drop	drop
1	41788	MALWARE-CNC	Win.Trojan.PowerMacro DNS query response	off	drop	drop
1	41789	MALWARE-CNC	Win.Trojan.PowerMacro DNS query response	off	drop	drop

**Medium Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.
1	41771	MALWARE-TOOLS	slowhttptest DoS tool	off	drop	drop
1	41784	INDICATOR-COMPROMISE	clorius controls information gathering attempt	off	off	off
3	41786	SERVER-OTHER	Cisco NetFlow Generation Appliance SCTP denial of service attempt	off	off	drop

Updated rules can be found at this link.