Forest Global Training Partners

Cyber Risks · Cisco Talos

Fishing For Malware: Tread Softly and Carry A Big Net

Summary: Cisco Talos explained that its malware rules are written to cover many samples at once rather than one-to-one, citing SID 20232, which began as detection for a single Win32.Cycbot sample keyed on the string "jpg?v" but was broadened to match "jpg?v", "gif?v" or "png?v", catching 3,856 samples in September 2011 alone. That rule now detects 122,630 distinct samples that have run through Talos's sandbox since the start of 2011, with additional checks added by hand to hold down false positives.

Bottom line: A single rule covering 122,630 samples only helps if it is enabled, and Talos places broad rules in the balanced-ips policy while slower or noisier ones go to security-ips and narrowly applicable ones go to neither - so the policy you run decides how much of that coverage you actually get.

Read the original at Cisco Talos ↗

Topics
Malware
Related