New SO Rules For Conficker.C P2P Detection
Summary: Cisco Talos ported Phil Porras of SRI International's Snort preprocessor for detecting Conficker.C's P2P update traffic into two SO rules, one for TCP and one for UDP, releasing them under GPLv2 with his consent. Testing on a CWG PCAP spanning just under 25 hours produced 47,450 UDP alerts and 37,541 TCP alerts, which a threshold of 10 events per 300 seconds per source reduced to 296 alerts across both rules.
Bottom line: Untuned, these rules generate tens of thousands of alerts from a single day of traffic, so the detection is only usable if someone owns the threshold tuning and SID deployment; the rules are also framed as a tool for investigating Conficker infections already in the wild, not preventing them.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026