Hand Parsing Packets for False Negative Glory
Summary: A Snort-Sigs mailing list report flagged a possible false negative in an older Snort rule, and the author worked through the submitted packet data by hand in VI, decoding the TDS Login7 protocol against a reference at freetds.org. After decoding the Ethernet, IP and TCP headers, he confirmed the destination port was 1433 and the source IP belonged to the Chinanet AS, then tested an Alex Kirk research pcap and found 94 alerts on the thresholded rule versus 470 on the same rule with thresholding removed.
What you should know: The report was resolved by manual packet decoding rather than tooling, and the 94-versus-470 alert gap shows how much detection signal a threshold setting can absorb before anyone notices.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026