Re: Anyone else seeing lots of 129 20 this am?

[Gordon Wallum via Snort-users <snort-users () lists snort org>]

I am having the same issue. Trying to suppress (threshold.conf) or disable
(disabledsid.conf)  is not working either

Gordon

On Tue, Sep 3, 2019 at 10:51 AM Joel Esler (jesler) via Snort-users <
snort-users () lists snort org> wrote:

> Sounds like you need to update your preprocessor.rules file?
>
> Sent from my  iPhone
>
> On Sep 3, 2019, at 12:25, Brian Cole <cole () echoworx com> wrote:
>
> 
>
> It turns out that both of these issues was caused by a Snort update that
> was issued late last week.  I used PulledPork to download Snort rule
> updates and the PP log shows the following for last Friday morning:
>
>
>
> -=Begin Changes Logged for Fri Aug 30 04:01:40 2019 GMT=-
>
>
>
> New Rules
>
>         DECODE_AUTH_HDR_BAD_LEN (116:466)
>
>         DECODE_AUTH_HDR_TRUNC (116:465)
>
>         DECODE_FPATH_HDR_TRUNC (116:467)
>
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory
> access attempt (1:50812)
>
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory
> access attempt (1:50813)
>
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory
> access attempt (1:50814)
>
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory
> access attempt (1:50815)
>
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory
> access attempt (1:50816)
>
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory
> access attempt (1:50817)
>
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory
> access attempt (1:50818)
>
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory
> access attempt (1:50819)
>
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory
> access attempt (1:50820)
>
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory
> access attempt (1:50821)
>
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory
> access attempt (1:50822)
>
>         FILE-OFFICE Microsoft Office Project file parsing arbitrary memory
> access attempt (1:50823)
>
>         MALWARE-CNC Unix.Backdoor.Godlua variant outbound connection
> (1:50808)
>
>         MALWARE-CNC Unix.Backdoor.Godlua variant outbound connection
> (1:50809)
>
>         MALWARE-CNC Unix.Backdoor.Godlua variant outbound connection
> (1:50810)
>
>         MALWARE-CNC Win.Trojan.Ratsnif variant outbound connection
> (1:50800)
>
>         MALWARE-CNC Win.Trojan.SoftCell variant outbound connection
> (1:50799)
>
>         MALWARE-OTHER Win.Backdoor.Agent inbound request attempt (1:51368)
>
>         MALWARE-OTHER Win.Trojan.Ratsnif variant download attempt (1:50801)
>
>         MALWARE-OTHER Win.Trojan.Ratsnif variant download attempt (1:50802)
>
>         Unknown MSG (119:35)
>
>         Unknown MSG (120:12)
>
>         Unknown MSG (120:13)
>
>         Unknown MSG (120:14)
>
>         Unknown MSG (120:15)
>
>         Unknown MSG (120:16)
>
>         Unknown MSG (120:17)
>
>         Unknown MSG (120:18)
>
>         Unknown MSG (120:19)
>
>         Unknown MSG (120:20)
>
>         Unknown MSG (120:21)
>
>         Unknown MSG (120:22)
>
>         Unknown MSG (120:23)
>
>         Unknown MSG (120:24)
>
>         Unknown MSG (120:25)
>
>         Unknown MSG (120:26)
>
>         Unknown MSG (120:27)
>
>         Unknown MSG (120:28)
>
>         Unknown MSG (124:15)
>
> *        Unknown MSG (129:20)  <<<<<*
>
>         Unknown MSG (133:58)
>
> *        Unknown MSG (133:59)  <<<<*
>
> And more…
>
>
>
> So maybe a bad set of rules was released ?
>
>
>
> …Brian
>
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists snort org
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
>         To unsubscribe, send an email to:
>         snort-users-leave () lists snort org
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
> Please follow these rules:
> https://snort.org/faq/what-is-the-mailing-list-etiquette
_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        snort-users-leave () lists snort org

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette