Cisco Talos (VRT) Update for Sourcefire 3D System

* Talos combines our security experts from TRAC, SecApps, and VRT teams.

Date: 2018-01-18

This SRU number: 2018-01-18-001
Previous SRU number: 2018-01-16-001

Applies to:

3D Sensor versions: 5.x / 6.x
Cisco FireSIGHGT Management Center (formerly Defense Center) versions: 5.x / 6.x

This SEU number: 1785
Previous SEU: 1783

Applies to:

3D Sensor Versions: 4.10
Cisco FireSIGHGT Management Center (formerly Defense Center) versions: 4.10

This is the complete list of rules added in SRU 2018-01-18-001 and SEU 1785.

The format of the file is:

GID - SID - Rule Group - Rule Message - Policy State

The Policy State refers to each default Sourcefire policy, Connectivity, Balanced and Security.

The default passive policy state is the same as the Balanced policy state with the exception of alert being used instead of drop.

Note: Unless stated explicitly, the rules are for the series of products listed above.

New Rules:

**High Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.
1	45455	EXPLOIT-KIT	Rig Exploit Kit URI redirect attempt	off	off	off
1	45456	SERVER-WEBAPP	Samsung SRN-1670D network_ssl_upload.php arbitrary PHP file upload attempt	off	off	off
1	45458	FILE-FLASH	Adobe Flash Player movieclip attachbitmap use-after-free attempt	off	off	off
1	45459	FILE-FLASH	Adobe Flash Player movieclip attachbitmap use-after-free attempt	off	drop	drop
1	45460	PROTOCOL-FTP	Ayukov NFTP FTP Client buffer overflow attempt	off	off	drop
1	45461	PROTOCOL-FTP	Ayukov NFTP FTP Client buffer overflow attempt	off	off	drop
1	45462	BROWSER-IE	Microsoft ChakraCore scripting engine memory corruption attempt	off	off	off
1	45463	BROWSER-IE	Microsoft ChakraCore scripting engine memory corruption attempt	off	off	off
3	45465	SERVER-WEBAPP	Splunk daemon default admin credentials login attempt	off	off	drop
1	45466	FILE-OFFICE	Microsoft Office None type objclass RTF evasion attempt	off	drop	drop
1	45467	FILE-OFFICE	Microsoft Office None type objclass RTF evasion attempt	off	drop	drop
1	45468	MALWARE-CNC	SambaCry ransomware download attempt	off	drop	drop
1	45469	MALWARE-CNC	SambaCry ransomware download attempt	off	drop	drop
1	45470	MALWARE-CNC	SambaCry ransomware download attempt	off	drop	drop
1	45471	MALWARE-CNC	SambaCry ransomware download attempt	off	drop	drop
1	45472	MALWARE-CNC	SambaCry ransomware download attempt	off	drop	drop
1	45473	MALWARE-CNC	SambaCry ransomware download attempt	off	drop	drop
1	45474	BROWSER-IE	Microsoft Edge scripting engine uninitialized pointers memory corruption attempt	off	off	off
1	45475	BROWSER-IE	Microsoft Edge scripting engine uninitialized pointers memory corruption attempt	off	off	off
1	45476	BROWSER-FIREFOX	Mozilla Firefox HTTP index format out of bounds read attempt	off	off	off
1	45477	MALWARE-CNC	Win.Backdoor.Triton Triton ICS malware transfer attempt	off	drop	drop
1	45478	MALWARE-CNC	Win.Backdoor.Triton Triton ICS malware transfer attempt	off	drop	drop

**Medium Priority**
GID	SID	Rule Group	Rule Message	Policy State
GID	SID	Rule Group	Rule Message	Con.	Bal.	Sec.
1	45457	SERVER-WEBAPP	Samsung SRN-1670D cslog_export.php arbitrary file read attempt	off	off	off
3	45464	PROTOCOL-VOIP	Cisco Unified Customer Voice Portal denial of service attempt	off	off	off