Forest Global Training Partners

Cyber Risks · Cisco Talos

Anomaly Detection Rules & The Success of Open-Source Rule Testing: Don't Do That, Part 2

Summary: Cisco Talos' Vulnerability Research Team established an open-source rule testing group last November, made up of Snort users from industries including defense contracting and education, and has since tested well over a hundred rules with it. Feedback from the group led to killing rules that underperformed in the field and to releasing rules the team would not previously have put in public, including signatures for fgallery PHP file requests, excessive DNS queries to .cn/.ru/.eu domains, Flashback malware User-Agent strings, and hidden zero-dimension iframes used in malvertising.

What you should know: The group's testing is what separated rules that looked prone to false positives - such as a User-Agent containing "Windows 98" or non-alphanumeric JavaScript strings - from ones safe enough to ship, and some rules were published outside default policies with documentation because testing showed a low but nonzero false positive rate.

Read the original at Cisco Talos ↗

Topics
Malware
Related