Say Hello to the file-identify category
Summary: Cisco Talos introduced a new VRT rule category called "file-identify.rules" that standardizes rules setting a flowbit and detects file types from file data rather than URI extensions, starting with roughly 70 rules that detect file "magic" bytes. Stage 2 moves all URI file-extension checks into the new category, and a new snort configuration variable, portvar FILE_DATA_PORTS [$HTTP_PORTS,110,143], is introduced alongside standardized flowbit names such as replacing "http.gif" with "file.gif".
What's compelling: Detection built on a URI extension can be fooled by a PDF named with a .jpg extension, producing false positives at best and false negatives at worst - and anyone not running Sourcefire or PulledPork must manually add the FILE_DATA_PORTS variable to snort.conf or their flowbit-dependent rules will not work as intended.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026