2018 in Snort Rules
Summary: Cisco Talos reviewed the most frequently triggered Snort rules reported by Cisco Meraki systems in 2018, a year in which the field shifted from ransomware toward cryptocurrency miners and saw APT campaigns including VPNFilter and Olympic Destroyer. The top-triggered rule was 1:46237:1, a PUA-OTHER cryptocurrency miner outbound connection attempt, and trojan activity made up 42.5 percent of all alerts.
Key Takeaway: Outbound rules fired roughly 6.9 times as often as internal rules and far more than inbound, meaning the dominant signal in 2018 was malware already running on endpoints and calling out. The single most common alert was a miner connection attempt, a reminder that the loudest detection in your environment may be resource theft rather than a breach.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026