Known Unknowns: The "Don't Do That" Rules
Summary: A Cisco Talos (Sourcefire) author who spoke with several Sourcefire customers in Tennessee and Kentucky found that none of them were using or even aware of the VRT "Don't Do That" rules - anomaly detection signatures that flag attempts to obfuscate bad behavior, new 0-day activity, and other generically bad traffic. The author highlights these rules to make time-starved analysts aware of them and asks for feedback, samples of false positives at fp@sourcefire.com, and community-contributed anomaly rules via research@sourcefire.com or the Snort-Sigs mailing list.
Why it matters: Experienced analysts running Sourcefire gear to its full potential still weren't deploying the anomaly signatures built to catch obfuscation and unknown 0-day activity - detection capability sitting unused while the threats it targets went unwatched.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026