Cisco Talos (VRT) Update for Sourcefire 3D System

* Talos combines our security experts from TRAC, SecApps, and VRT teams.

Date: 2017-03-21

This SRU number: 2017-03-20-001
Previous SRU number: 2017-03-15-001

Applies to:

3D Sensor versions: 5.x
Cisco FireSIGHGT Management Center (formerly Defense Center) versions: 5.x

This SEU number: 1631
Previous SEU: 1630

Applies to:

3D Sensor Versions: 4.10
Cisco FireSIGHGT Management Center (formerly Defense Center) versions: 4.10

This is the complete list of rules added in SRU 2017-03-20-001 and SEU 1631.

The format of the file is:

GID - SID - Rule Group - Rule Message - Policy State

The Policy State refers to each default Sourcefire policy, Connectivity, Balanced and Security.

The default passive policy state is the same as the Balanced policy state with the exception of alert being used instead of drop.

Note: Unless stated explicitly, the rules are for the series of products listed above.

New Rules:

**High Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.
1	42018	EXPLOIT-KIT	Exploit Kit EITest Gate redirection attempt detected	off	off	drop
1	42019	BLACKLIST	User-Agent known malicious user-agent string - Andr.Trojan.Agent	off	drop	drop
1	42020	BLACKLIST	User-Agent known malicious user-agent string - Andr.Trojan.Agent	off	drop	drop
1	42021	MALWARE-CNC	Andr.Trojan.Agent variant outbound connection attempt	off	drop	drop
1	42022	MALWARE-CNC	Andr.Trojan.Agent variant outbound connection attempt	off	drop	drop
1	42023	MALWARE-CNC	Andr.Trojan.Agent variant outbound connection attempt	off	drop	drop
1	42024	MALWARE-CNC	Andr.Trojan.Agent variant outbound connection attempt	off	drop	drop
1	42025	MALWARE-CNC	Andr.Trojan.Agent variant outbound connection attempt	off	drop	drop
1	42026	MALWARE-CNC	Andr.Trojan.Agent variant outbound connection attempt	off	drop	drop
1	42027	MALWARE-CNC	Andr.Trojan.Agent variant outbound connection attempt	off	drop	drop
1	42028	MALWARE-CNC	Andr.Trojan.Agent variant file download attempt	off	drop	drop
1	42029	MALWARE-CNC	Andr.Trojan.Agent variant file download attempt	off	drop	drop
1	42030	MALWARE-CNC	Andr.Trojan.Agent variant file download attempt	off	drop	drop
1	42031	MALWARE-CNC	Andr.Trojan.Agent variant outbound connection attempt	off	drop	drop
1	42032	BROWSER-IE	Microsoft Internet Explorer DataView use-after-free attempt	off	drop	drop
1	42033	BROWSER-IE	Microsoft Internet Explorer DataView use-after-free attempt	off	drop	drop
1	42034	BROWSER-IE	Microsoft Internet Explorer DataView use-after-free attempt	off	drop	drop
1	42035	BROWSER-IE	Microsoft Internet Explorer DataView use-after-free attempt	off	drop	drop
1	42036	BROWSER-IE	Microsoft Internet Explorer DataView use-after-free attempt	off	drop	drop
1	42037	BROWSER-IE	Microsoft Internet Explorer DataView use-after-free attempt	off	drop	drop
1	42038	BROWSER-IE	Microsoft Internet Explorer DataView use-after-free attempt	off	drop	drop
1	42039	BROWSER-IE	Microsoft Internet Explorer DataView use-after-free attempt	off	drop	drop
1	42040	BROWSER-IE	Microsoft Edge proxy object type confusion attempt	off	off	drop
1	42041	BROWSER-IE	Microsoft Edge proxy object type confusion attempt	off	drop	drop
1	42043	SERVER-WEBAPP	WordPress embedded URL video cross site scripting attempt	off	off	off
1	42044	FILE-FLASH	Adobe Flash Player custom object garbage collection use after free	off	drop	drop
1	42045	FILE-FLASH	Adobe Flash Player custom object garbage collection use after free	off	drop	drop
1	42046	FILE-FLASH	Adobe Flash Player custom object garbage collection use after free	off	drop	drop
1	42047	FILE-FLASH	Adobe Flash Player custom object garbage collection use after free	off	drop	drop
1	42048	SERVER-WEBAPP	dnaLIMS sysAdmin.cgi arbitrary command execution attempt	off	drop	drop

**Medium Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.
1	42016	PROTOCOL-SCADA	Moxa discovery packet information disclosure attempt	off	drop	drop
1	42017	INDICATOR-OBFUSCATION	Gzip encoded HTTP response with no Content-Length or chunked Transfer-Encoding header	off	off	off
1	42042	SERVER-WEBAPP	Wordpress Press-This cross site request forgery attempt	off	off	off

Updated Rules:

Updated rules can be found at this link.