* Talos combines our security experts from TRAC, SecApps, and VRT teams.
This SRU number: 2017-12-04-001
Previous SRU number: 2017-11-30-001
Applies to:
This SEU number: 1766
Previous SEU: 1765
Applies to:
This is the complete list of rules modified in SRU 2017-12-04-001 and SEU 1766.
The format of the file is:
GID - SID - Rule Group - Rule Message - Policy State
The Policy State refers to each default Sourcefire policy, Connectivity, Balanced and Security.
The default passive policy state is the same as the Balanced policy state with the exception of alert being used instead of drop.
Note: Unless stated explicitly, the rules are for the series of products listed above.
| GID | SID | Rule Group | Rule Message | Policy State | ||
|---|---|---|---|---|---|---|
| Con. | Bal. | Sec. | ||||
| 1 | 28410 | MALWARE-CNC | Win.Trojan.CoinMiner variant outbound connection | off | drop | drop |
| 1 | 28411 | MALWARE-CNC | Win.Trojan.CoinMiner variant outbound connection | off | drop | drop |
| 1 | 29895 | MALWARE-CNC | Win.Trojan.Pyteconte variant outbound connection | off | drop | drop |
| 1 | 29955 | SERVER-WEBAPP | WordPress Quick-Post Widget GET request using Body cross-site scripting | off | off | off |
| 1 | 30251 | MALWARE-CNC | Win.Trojan.Mumawow outbound connection | off | drop | drop |
| 1 | 30259 | MALWARE-CNC | Win.Trojan.Zeus variant outbound connection | off | off | drop |
| 1 | 31262 | MALWARE-CNC | Win.Worm.VBNA variant outbound connection | off | drop | drop |
| 1 | 31834 | MALWARE-CNC | Win.Trojan-Downloader.Delorado variant outbound connection | off | drop | drop |
| 1 | 32016 | MALWARE-CNC | Win.Trojan.MSIL.Menteni variant outbound connection | off | drop | drop |
| 1 | 32129 | MALWARE-CNC | Win.Trojan.Downloader variant outbound connection | off | drop | drop |
| 1 | 32824 | MALWARE-CNC | Win.Trojan.Darkhotel variant outbound connection | off | drop | drop |
| 1 | 33594 | MALWARE-CNC | Win.Trojan.Upatre variant outbound connection | off | drop | drop |
| 1 | 34596 | MALWARE-CNC | Win.Trojan.Atrax variant outbound connection | off | drop | drop |
| 1 | 34597 | MALWARE-CNC | Win.Trojan.Atrax variant outbound connection | off | drop | drop |
| 1 | 34862 | MALWARE-CNC | Win.Trojan.Wheelsof variant outbound connection | off | drop | drop |
| 1 | 34863 | MALWARE-CNC | Win.Trojan.Wheelsof variant outbound connection | off | drop | drop |
| 1 | 34870 | MALWARE-CNC | Win.Trojan.Logreaz variant outbound connection | off | drop | drop |
| 1 | 34871 | MALWARE-CNC | Win.Trojan.Logreaz variant outbound connection | off | off | drop |
| 1 | 34887 | MALWARE-CNC | Win.Trojan.Sojax variant outbound connection | off | drop | drop |
| 1 | 34888 | MALWARE-CNC | Win.Trojan.Sojax variant outbound connection | off | drop | drop |
| 1 | 34932 | MALWARE-CNC | Win.Trojan.Shindo outbound connection | off | drop | drop |
| 1 | 34957 | MALWARE-CNC | Win.Trojan.Sysmain outbound connection | off | drop | drop |
| 1 | 34963 | MALWARE-CNC | Win.Trojan.Threebyte outbound connection | off | drop | drop |
| 1 | 34998 | MALWARE-CNC | Win.Trojan.Bossabot outbound connection | off | drop | drop |
| 1 | 35035 | MALWARE-CNC | Win.Trojan.Taleretzbj outbound connection | off | off | off |
| 1 | 35080 | MALWARE-CNC | Win.Trojan.Tenbus outbound connection | off | drop | drop |
| 1 | 35081 | MALWARE-CNC | Win.Trojan.Tenbus outbound connection | off | drop | drop |
| 1 | 35082 | MALWARE-CNC | Backdoor.Linux.Qenerek outbound connection | off | drop | drop |
| 1 | 35083 | MALWARE-CNC | Win.Trojan.Regiskazi outbound connection | off | drop | drop |
| 1 | 36497 | MALWARE-CNC | Win.Trojan.Hangman.A outbound connection | off | drop | drop |
| 1 | 39835 | FILE-OFFICE | Microsoft Office Word malformed jpeg memory corruption attempt | off | drop | drop |
| 1 | 39836 | FILE-OFFICE | Microsoft Office Word malformed jpeg memory corruption attempt | off | drop | drop |
| 1 | 39920 | MALWARE-CNC | Neutrino outbound connection | off | off | drop |
| 1 | 39921 | MALWARE-CNC | Neutrino outbound connection | off | off | drop |
| 1 | 39931 | MALWARE-CNC | Win.Trojan.BlackEnergy outbound connection | off | off | drop |
| 1 | 40058 | SERVER-WEBAPP | WordPress Quick-Post Widget GET request using Body cross-site scripting | off | off | off |
| 1 | 40067 | MALWARE-CNC | Win.Trojan.Fareit outbound connection | off | drop | drop |
| 1 | 40252 | MALWARE-CNC | Win.Perseus variant outbound connection | off | drop | drop |
| 1 | 40281 | FILE-OFFICE | Microsoft Office Wordpad font conversion buffer overflow attempt | off | off | off |
| 1 | 40282 | FILE-OFFICE | Microsoft Office Wordpad font conversion buffer overflow attempt | off | off | off |
| 1 | 40289 | MALWARE-CNC | Win.Trojan.Philadelphia variant initial outbound connection | off | drop | drop |
| 1 | 40290 | MALWARE-CNC | Win.Trojan.Philadelphia variant status update outbound connection | off | drop | drop |
| 1 | 40306 | FILE-OFFICE | Microsoft Office Word document containing VBA project entry detected | off | off | off |
| 1 | 40307 | FILE-OFFICE | Microsoft Office Word document containing VBA project entry detected | off | off | off |
| 1 | 40368 | FILE-OFFICE | Microsoft Office Word RTF file parsing buffer overflow attempt | off | drop | drop |
| 1 | 40369 | FILE-OFFICE | Microsoft Office Word RTF file parsing buffer overflow attempt | off | drop | drop |
| 1 | 40527 | MALWARE-CNC | Win.Trojan.Locky variant outbound connection | off | drop | drop |
| 1 | 40541 | MALWARE-CNC | Win.Trojan.Satana ransomware outbound connection | off | drop | drop |
| 1 | 40548 | MALWARE-CNC | Win.Trojan.Satana ransomware outbound connection | off | drop | drop |
| 1 | 40559 | MALWARE-CNC | Win.Trojan.iSpy variant outbound connection | off | drop | drop |
| 1 | 40679 | FILE-OFFICE | Microsoft Office Word wwlib out of bounds read attempt | off | drop | drop |
| 1 | 40680 | FILE-OFFICE | Microsoft Office Word wwlib out of bounds read attempt | off | drop | drop |
| 1 | 40701 | FILE-OFFICE | Microsoft Office Word out of bounds memory read attempt | off | drop | drop |
| 1 | 40702 | FILE-OFFICE | Microsoft Office Word out of bounds memory read attempt | off | drop | drop |
| 1 | 40816 | MALWARE-CNC | Win.Trojan.Locky variant outbound connection | off | drop | drop |
| 1 | 40831 | MALWARE-CNC | Win.Backdoor.Houdini variant initial outbound connection | off | drop | drop |
| 1 | 40910 | MALWARE-CNC | Win.Trojan.Locky variant outbound connection | off | drop | drop |
| 1 | 40911 | MALWARE-CNC | Win.Rootkit.Sednit variant outbound connection | off | drop | drop |
| 1 | 41045 | FILE-FLASH | Adobe Flash Player TextField setter use after free attempt | off | off | off |
| 1 | 41046 | FILE-FLASH | Adobe Flash Player TextField setter use after free attempt | off | off | off |
| 1 | 41140 | FILE-OFFICE | Microsoft Office Word Out-of-Bounds Write attempt | off | drop | drop |
| 1 | 41141 | FILE-OFFICE | Microsoft Office Word Out-of-Bounds Write attempt | off | drop | drop |
| 1 | 41173 | MALWARE-CNC | Win.Trojan.August variant outbound connection | off | drop | drop |
| 1 | 41174 | MALWARE-CNC | Win.Trojan.August variant outbound connection | off | drop | drop |
| 1 | 41175 | MALWARE-CNC | Win.Trojan.August variant outbound connection | off | drop | drop |
| 1 | 41176 | MALWARE-CNC | Win.Trojan.August variant outbound connection | off | drop | drop |
| 1 | 41177 | MALWARE-CNC | Win.Trojan.August variant outbound connection | off | drop | drop |
| 1 | 41178 | MALWARE-CNC | Win.Trojan.August variant outbound connection | off | drop | drop |
| 1 | 41331 | MALWARE-CNC | Win.Trojan.Scudy outbound connection | off | drop | drop |
| 1 | 41334 | MALWARE-CNC | Win.Trojan.Locky variant outbound connection | off | drop | drop |
| 1 | 41335 | MALWARE-CNC | Win.Trojan.Locky variant outbound connection | off | drop | drop |
| 1 | 41336 | MALWARE-CNC | Andr.Trojan.Sysch variant outbound connection | off | drop | drop |
| 1 | 41337 | MALWARE-CNC | Andr.Trojan.Sysch variant outbound connection | off | drop | drop |
| 1 | 41424 | MALWARE-CNC | Win.Trojan.Cerber outbound connection | off | drop | drop |
| 1 | 41442 | MALWARE-CNC | Win.Ransomware.X-Mas outbound connection | off | drop | drop |
| 1 | 41443 | MALWARE-CNC | Win.Ransomware.X-Mas variant keylogger outbound connection | off | drop | drop |
| 1 | 41444 | MALWARE-CNC | Win.Ransomware.X-Mas variant keylogger outbound connection | off | drop | drop |
| 1 | 41657 | MALWARE-CNC | Win.Trojan.MagicHound variant outbound connection | off | drop | drop |
| 1 | 41964 | FILE-OFFICE | Microsoft Office Word 2010 use-after-free memory corruption vulnerability attempt | off | off | drop |
| 1 | 41965 | FILE-OFFICE | Microsoft Office Word 2010 use-after-free memory corruption vulnerability attempt | off | off | drop |
| 1 | 42021 | MALWARE-CNC | Andr.Trojan.Agent variant outbound connection | off | drop | drop |
| 1 | 42022 | MALWARE-CNC | Andr.Trojan.Agent variant outbound connection | off | drop | drop |
| 1 | 42023 | MALWARE-CNC | Andr.Trojan.Agent variant outbound connection | off | drop | drop |
| 1 | 42024 | MALWARE-CNC | Andr.Trojan.Agent variant outbound connection | off | drop | drop |
| 1 | 42025 | MALWARE-CNC | Andr.Trojan.Agent variant outbound connection | off | drop | drop |
| 1 | 42026 | MALWARE-CNC | Andr.Trojan.Agent variant outbound connection | off | drop | drop |
| 1 | 42027 | MALWARE-CNC | Andr.Trojan.Agent variant outbound connection | off | drop | drop |
| 1 | 42031 | MALWARE-CNC | Andr.Trojan.Agent variant outbound connection | off | drop | drop |
| 1 | 42079 | MALWARE-CNC | Win.Trojan.Jenxcus outbound connection with unique User-Agent | off | drop | drop |
| 1 | 42080 | MALWARE-CNC | Win.Trojan.Jenxcus outbound connection with unique User-Agent | off | drop | drop |
| 1 | 42083 | MALWARE-CNC | Win.Trojan.Downeks variant initial outbound connection | off | drop | drop |
| 1 | 42126 | MALWARE-CNC | Win.Trojan.Acronym variant outbound connection | off | drop | drop |
| 1 | 42225 | MALWARE-CNC | Win.Trojan.RedLeaves outbound connection | off | drop | drop |
| 1 | 42233 | MALWARE-CNC | Win.Trojan.Mikcer variant outbound connection | off | drop | drop |
| 1 | 42243 | MALWARE-CNC | Win.Downloader.Dimnie file download attempt | off | drop | drop |
| 1 | 42302 | MALWARE-CNC | Win.Trojan.Kuaibu outbound connection | off | drop | drop |
| 1 | 42348 | MALWARE-CNC | Win.Trojan.QQPass variant outbound connection | off | drop | drop |
| 1 | 42385 | MALWARE-CNC | Win.Trojan.Moonwind outbound connection | off | drop | drop |
| 1 | 42386 | MALWARE-CNC | Win.Trojan.Mikcer variant outbound connection | off | drop | drop |
| 1 | 42390 | MALWARE-CNC | Win.Trojan.Moarider variant outbound connection | off | drop | drop |
| 1 | 42391 | MALWARE-CNC | Win.Trojan.Moarider variant outbound connection | off | drop | drop |
| 1 | 42398 | MALWARE-CNC | Win.Trojan.RedLeaves outbound connection | off | drop | drop |
| 1 | 42447 | MALWARE-CNC | Win.Trojan.Batlopma variant outbound connection | off | drop | drop |
| 1 | 42452 | MALWARE-CNC | Win.Trojan.Frethog variant outbound connection | off | drop | drop |
| 1 | 42755 | FILE-OFFICE | Microsoft Office Word 2010 Sepx memory corruption attempt | off | drop | drop |
| 1 | 42756 | FILE-OFFICE | Microsoft Office Word 2010 Sepx memory corruption attempt | off | drop | drop |
| 1 | 42880 | MALWARE-CNC | Deputy Dog implant outbound connection | off | drop | drop |
| 1 | 42881 | MALWARE-CNC | Deputy Dog implant outbound connection | off | drop | drop |
| 1 | 42882 | MALWARE-CNC | ZoxPNG initial outbound connection | off | drop | drop |
| 1 | 42883 | MALWARE-CNC | ZoxPNG initial outbound connection | off | drop | drop |
| 1 | 42884 | MALWARE-CNC | Win.Trojan.MadMax implant outbound connection | off | drop | drop |
| 1 | 42892 | MALWARE-CNC | Linux.Trojan.SpikeA outbound connection | off | drop | drop |
| 1 | 42899 | MALWARE-CNC | Jaff ransomware outbound connection | off | drop | drop |
| 1 | 42925 | MALWARE-CNC | Js.Keylogger.Scanbox outbound connection | off | drop | drop |
| 1 | 42926 | MALWARE-CNC | Js.Keylogger.Scanbox outbound connection | off | drop | drop |
| 1 | 42929 | MALWARE-CNC | Win.Trojan.Niramdat variant initial outbound connection | off | drop | drop |
| 1 | 42945 | MALWARE-CNC | Win.Trojan.Adylkuzz variant initial outbound connection | off | drop | drop |
| 1 | 42996 | MALWARE-CNC | Win.Trojan.Adylkuzz variant initial outbound connection | off | drop | drop |
| 1 | 42997 | MALWARE-CNC | Win.Trojan.Adylkuzz variant initial outbound connection | off | drop | drop |
| 1 | 43049 | MALWARE-CNC | Win.Trojan.Gasonen variant outbound connection | off | drop | drop |
| 1 | 43129 | MALWARE-CNC | Win.Trojan.Kabob outbound connection | off | drop | drop |
| 1 | 43159 | FILE-OFFICE | Microsoft Office Word 2016 use after free attempt | off | drop | drop |
| 1 | 43160 | FILE-OFFICE | Microsoft Office Word 2016 use after free attempt | off | drop | drop |
| 1 | 43171 | FILE-OFFICE | Microsoft Office Word malformed jpeg remote code execution attempt | off | off | drop |
| 1 | 43172 | FILE-OFFICE | Microsoft Office Word malformed jpeg remote code execution attempt | off | off | drop |
| 1 | 43457 | MALWARE-CNC | Win.Trojan.Eorezo variant outbound connection | off | drop | drop |
| 1 | 43523 | MALWARE-CNC | Win.Trojan.Donvibs variant outbound connection | off | drop | drop |
| 1 | 43524 | MALWARE-CNC | Win.Trojan.Donvibs variant outbound connection | off | drop | drop |
| 1 | 43597 | MALWARE-CNC | Win.Trojan.BlackEnergy outbound connection | off | off | off |
| 1 | 43930 | MALWARE-CNC | Win.Malware.GamKer variant outbound connection | off | drop | drop |
| 1 | 43985 | MALWARE-CNC | Win.Trojan.Rortiem outbound connection | off | drop | drop |
| 1 | 44211 | MALWARE-CNC | Win.Trojan.Tarayt outbound connection | off | drop | drop |
| 1 | 44212 | MALWARE-CNC | Win.Trojan.Tarayt outbound connection | off | drop | drop |
| 1 | 44313 | MALWARE-CNC | Win.Downloader.Razy variant outbound connection | off | drop | drop |
| 1 | 44316 | MALWARE-CNC | Win.Trojan.Ellell variant outbound connection | off | drop | drop |
| 1 | 44396 | MALWARE-CNC | Win.Trojan.KediRAT outbound connection | off | drop | drop |
| 1 | 44569 | MALWARE-CNC | Win.Trojan.Fareit variant outbound connection | off | drop | drop |
| 1 | 44570 | MALWARE-CNC | Win.Trojan.Fareit variant outbound connection | off | drop | drop |
| 1 | 44585 | FILE-OFFICE | Microsoft Office Word docx object type confusion attempt | off | off | off |
| 1 | 44586 | FILE-OFFICE | Microsoft Office Word docx object type confusion attempt | off | off | off |
| 1 | 44619 | MALWARE-CNC | Android Red Alert Trojan outbound connection | off | drop | drop |
| 1 | 44620 | MALWARE-CNC | Android Red Alert Trojan outbound connection | off | drop | drop |
| 1 | 44621 | MALWARE-CNC | Android Red Alert Trojan outbound connection | off | drop | drop |
| 1 | 44622 | MALWARE-CNC | Android Red Alert Trojan outbound connection | off | drop | drop |
| 1 | 44659 | MALWARE-CNC | Win.Trojan.Wraut variant outbound connection | off | drop | drop |
| 1 | 44689 | MALWARE-CNC | Win.Trojan.Gen variant outbound connection | off | drop | drop |
| 1 | 44787 | MALWARE-CNC | Win.Trojan.Godzilla outbound connection | off | drop | drop |
| 1 | 44788 | MALWARE-CNC | Win.Trojan.Nymaim variant outbound connection | off | drop | drop |
| 1 | 44789 | MALWARE-CNC | Win.Trojan.Nymaim variant outbound connection | off | drop | drop |
| 1 | 44791 | MALWARE-CNC | Win.Trojan.Retadup variant outbound connection | off | drop | drop |
| 1 | 44797 | MALWARE-CNC | Win.Trojan.Shadowpad DNS TXT encrypted outbound connection | off | drop | drop |
| 1 | 44798 | MALWARE-CNC | Win.Trojan.Shadowpad DNS TXT encrypted outbound connection | off | drop | drop |
| 1 | 44799 | MALWARE-CNC | Win.Trojan.Shadowpad DNS TXT encrypted outbound connection | off | drop | drop |
| 1 | 44800 | MALWARE-CNC | Win.Trojan.Shadowpad DNS TXT encrypted outbound connection | off | drop | drop |
| 1 | 44801 | MALWARE-CNC | Win.Trojan.Shadowpad DNS TXT encrypted outbound connection | off | drop | drop |
| 1 | 44802 | MALWARE-CNC | Win.Trojan.Shadowpad DNS TXT encrypted outbound connection | off | drop | drop |
| 1 | 44803 | MALWARE-CNC | Win.Trojan.Shadowpad DNS TXT encrypted outbound connection | off | drop | drop |
| 1 | 44804 | MALWARE-CNC | Win.Trojan.Shadowpad DNS TXT encrypted outbound connection | off | drop | drop |
| 1 | 44805 | MALWARE-CNC | Win.Trojan.Shadowpad DNS TXT encrypted outbound connection | off | drop | drop |
| 1 | 44806 | MALWARE-CNC | Win.Trojan.Shadowpad DNS TXT encrypted outbound connection | off | drop | drop |
| 1 | 44807 | MALWARE-CNC | Win.Trojan.Shadowpad DNS TXT encrypted outbound connection | off | drop | drop |
| 1 | 44821 | FILE-OFFICE | Microsoft Office Excel use after free vulnerability exploit attempt | off | off | drop |
| 1 | 44822 | FILE-OFFICE | Microsoft Office Excel use after free vulnerability exploit attempt | off | off | drop |
| 1 | 44838 | FILE-OFFICE | Microsoft Office Word RTF memory corruption attempt | off | off | off |
| 1 | 44839 | FILE-OFFICE | Microsoft Office Word RTF memory corruption attempt | off | off | off |
| 1 | 44895 | MALWARE-CNC | Win.Trojan.CoinMiner inbound connection detected | off | drop | drop |
| 1 | 44896 | MALWARE-CNC | Win.Trojan.CoinMiner outbound connection | off | drop | drop |
| 1 | 44897 | MALWARE-CNC | Win.Trojan.CoinMiner outbound connection | off | drop | drop |
| 1 | 44898 | MALWARE-CNC | Win.Trojan.CoinMiner outbound connection | off | drop | drop |
| 1 | 44899 | MALWARE-CNC | Win.Trojan.CoinMiner inbound connection detected | off | drop | drop |
| 1 | 44921 | SERVER-WEBAPP | ManageEngine Applications Manager manageApplications.do SQL injection attempt | off | off | drop |
| 1 | 44922 | SERVER-WEBAPP | ManageEngine Applications Manager manageApplications.do SQL injection attempt | off | off | drop |
| 1 | 44972 | MALWARE-CNC | Win.Trojan.Ramnit variant outbound connection | off | drop | drop |
| 1 | 44973 | MALWARE-CNC | Win.Trojan.Ramnit variant outbound connection | off | drop | drop |
| 1 | 44975 | MALWARE-CNC | Php.Dropper.Mayhem variant outbound connection | off | drop | drop |
| 1 | 45050 | MALWARE-CNC | Win.Trojan.IcedId outbound connection | off | drop | drop |
| 1 | 45062 | MALWARE-CNC | Win.Trojan.Neuron variant inbound service request detected | off | drop | drop |
| 1 | 45063 | MALWARE-CNC | Win.Trojan.Neuron variant inbound service request detected | off | drop | drop |
| 1 | 45064 | MALWARE-CNC | Win.Trojan.Neuron variant inbound service request detected | off | drop | drop |
| 1 | 45065 | MALWARE-CNC | Win.Trojan.Neuron variant inbound service request detected | off | drop | drop |
| 1 | 45074 | SERVER-SAMBA | Samba unsigned connections attempt | off | drop | drop |
| GID | SID | Rule Group | Rule Message | Policy State | ||
|---|---|---|---|---|---|---|
| Con. | Bal. | Sec. | ||||
| 3 | 45049 | SERVER-WEBAPP | TRUFFLEHUNTER TALOS-2017-0493 attack attempt | off | off | off |