Forest Global Training Partners

Cyber Risks · Cisco Talos

Blocklist.rules, ClamAV, and Data Mining

Summary: Cisco Talos explained that its blocklist.rules data comes from the ClamAV malware database, which the VRT gained access to through the 2007 ClamAV acquisition and which receives tens of thousands of unique samples per day. The VRT runs the samples on unpatched Windows XP SP2 virtual machines under VMware ESXi, captures the resulting network traffic, and builds rules from the domains and URLs its infected machines access most frequently, adding rules for abnormal User-Agent strings as of the Feb. 8, 2011 release.

Why it matters: Talos warns that the raw IP, URL and domain lists it publishes daily on VRT Labs get far less human verification than the rules and are much more likely to contain false positives, so blocking on them directly can misfire. Much of the captured HTTP traffic went to legitimate domains, including thousands of obscure ad servers, which is why Talos recommends cross-referencing those lists with other data sets before blocking them in an enterprise.

Read the original at Cisco Talos ↗

Topics
Malware
Related