2017 in Snort Rules
Summary: Cisco Talos reviewed the most frequently triggered Snort rules of 2017 as reported by Cisco Meraki systems, with the top rule being 1:40522:3 for Mirai variant post-compromise fingerprinting. The most common rule class was "Trojan-activity," followed by "Policy-violation" and "Misc-activity," and outbound rules triggered more often than internal and inbound at a ratio of roughly 9:6:5.
Why it matters: Mirai's post-compromise check, which verifies a device is not a honeypot before proceeding, was the single most-triggered rule of the year and at its February peak accounted for over 20% of all daily alerts. Talos also recorded that within a couple of days of Apache disclosing CVE-2017-5638 on March 6, attackers were running widespread exploitation campaigns that hit more than 20% of all triggering rules at peak.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026