New Rule Categories
Summary: Cisco Talos introduced three new rule categories on Tuesday, 13th July 2010 in SEU 348 and the VRT Certified Rule packages, pulling the initial rule sets from the specific-threats and spyware-put categories. The categories are fed by automated malware analysis systems, spam traps, honeynets, and external data feeds, and rules based on sandbox data include md5sums of the binaries that generated the traffic.
Bottom line: The raw lists behind these rules - IP addresses, URLs, and DNS names - are being published so anyone can feed them into other tools like SMTP RBLS or DNS blackholes, which means the detection data your perimeter depends on is also available to anyone else who wants it.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026