Dcerpc2 Ruleset Now Available
Summary: Cisco Talos's VRT released a special rules file for use with Snort 2.8.4 RC-1 and its new dcerpc pre-processor, and is asking users to help test the ruleset, the Snort version, and the pre-processor. The rules file is intended to replace the regular netbios.rules file used with the old pre-processor and prior Snort versions, and the README.dcerpc2 file that did not ship with Snort 2.8.4 RC-1 is available separately.
Bottom line: This is a testing call, not a finished release: the detection content for the new dcerpc pre-processor is being validated by users, so anyone running Snort 2.8.4 RC-1 is effectively part of the QA for rules that replace netbios.rules.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026