[Snort-users] MALWARE-CNC TRUFFLEHUNTER SFVRT-1020 attack attempt" rule being fired

Jeff H jeff61225 at ...11827...
Fri Apr 1 13:27:30 EDT 2016


Did this rule get updated? I don't see it in the change log.

My rule is listed as rev2 and I'm seeing some (not alot) alerts as well.

Jeff

On Thu, Mar 31, 2016 at 5:15 AM, Joel Esler (jesler) <jesler at ...589...>
wrote:

> This should be updated in today’s rule pack.
>
> --
> *Joel Esler*
> Manager, Talos Group
>
>
>
>
> On Mar 31, 2016, at 2:34 AM, Daniel <dky.swe at ...11827...> wrote:
>
> Hi all,
>
> Since a few days ago, we have the "MALWARE-CNC TRUFFLEHUNTER SFVRT-1020
> attack attempt" rule being fired on what to seems to be ICMP pings from a
> Nagios server.
>
> I can provide pcap file if anyone from the Talos team (or others) want to
> look at it.
> Contact me then.
>
> Best Regards,
> Daniel
>
> ------------------------------------------------------------------------------
> Transform Data into Opportunity.
> Accelerate data analysis in your applications with
> Intel Data Analytics Acceleration Library.
> Click to learn more.
>
> http://pubads.g.doubleclick.net/gampad/clk?id=278785471&iu=/4140_______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
>
>
>
> ------------------------------------------------------------------------------
> Transform Data into Opportunity.
> Accelerate data analysis in your applications with
> Intel Data Analytics Acceleration Library.
> Click to learn more.
> http://pubads.g.doubleclick.net/gampad/clk?id=278785471&iu=/4140
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20160401/0ea85573/attachment.html>


More information about the Snort-users mailing list