Razorback 0.3 Released
Summary: Cisco Talos released Razorback 0.3, the output of its Q3 development run, which adds a scripting nugget that passes registration, alerting and logging data over XML across named pipes so detection scripts can be written in any language that writes XML to STDOUT. The release also rewrites the Snort-as-a-Collector nugget on Snort 2.9.1.1 with request details such as hostname, URI, IP addresses and ports attached to each captured data block, and ships a FreeBSD virtual appliance preconfigured with memcached, MySQL, ActiveMQ and nuggets including Yara, OfficeCat, ClamAV, Archive Inflate, Scripting, File Inject and Snort-as-a-Collector.
What you should know: The scripting nugget watches the scripts directory continuously, so adding detection to a running system is as simple as copying a new script into it - a low-friction path for new detection that also means anyone who can write to that directory can change what the system looks for.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026