Re: Anyone else seeing lots of 129 20 this am?

["Joel Esler \(jesler\) via Snort-users" <snort-users () lists snort org>]

Sounds like you need to update your preprocessor.rules file?

Sent from my  iPhone

> On Sep 3, 2019, at 12:25, Brian Cole <cole () echoworx com> wrote:
>
> 
> It turns out that both of these issues was caused by a Snort update that was issued late last week.  I used 
> PulledPork to download Snort rule updates and the PP log shows the following for last Friday morning:
>  
> -=Begin Changes Logged for Fri Aug 30 04:01:40 2019 GMT=-
>  
> New Rules
>         DECODE_AUTH_HDR_BAD_LEN (116:466)
>         DECODE_AUTH_HDR_TRUNC (116:465)
>         DECODE_FPATH_HDR_TRUNC (116:467)
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory access attempt (1:50812)
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory access attempt (1:50813)
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory access attempt (1:50814)
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory access attempt (1:50815)
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory access attempt (1:50816)
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory access attempt (1:50817)
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory access attempt (1:50818)
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory access attempt (1:50819)
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory access attempt (1:50820)
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory access attempt (1:50821)
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory access attempt (1:50822)
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory access attempt (1:50823)
>         MALWARE-CNC Unix.Backdoor.Godlua variant outbound connection (1:50808)
>         MALWARE-CNC Unix.Backdoor.Godlua variant outbound connection (1:50809)
>         MALWARE-CNC Unix.Backdoor.Godlua variant outbound connection (1:50810)
>         MALWARE-CNC Win.Trojan.Ratsnif variant outbound connection (1:50800)
>         MALWARE-CNC Win.Trojan.SoftCell variant outbound connection (1:50799)
>         MALWARE-OTHER Win.Backdoor.Agent inbound request attempt (1:51368)
>         MALWARE-OTHER Win.Trojan.Ratsnif variant download attempt (1:50801)
>         MALWARE-OTHER Win.Trojan.Ratsnif variant download attempt (1:50802)
>         Unknown MSG (119:35)
>         Unknown MSG (120:12)
>         Unknown MSG (120:13)
>         Unknown MSG (120:14)
>         Unknown MSG (120:15)
>         Unknown MSG (120:16)
>         Unknown MSG (120:17)
>         Unknown MSG (120:18)
>         Unknown MSG (120:19)
>         Unknown MSG (120:20)
>         Unknown MSG (120:21)
>         Unknown MSG (120:22)
>         Unknown MSG (120:23)
>         Unknown MSG (120:24)
>         Unknown MSG (120:25)
>         Unknown MSG (120:26)
>         Unknown MSG (120:27)
>         Unknown MSG (120:28)
>         Unknown MSG (124:15)
>         Unknown MSG (129:20)  <<<<<
>         Unknown MSG (133:58)
>         Unknown MSG (133:59)  <<<<
> And more…
>  
> So maybe a bad set of rules was released ?
>  
> …Brian
>

Attachment: smime.p7s
Description:

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette