Important Snort rule changes and the new dcerpc preprocessor
Summary: Snort 2.8.4 will introduce a new dcerpc preprocessor that takes over decoding functions previously handled by rules and flowbits, greatly reducing the number of netbios rules released for vulnerabilities exploitable over dcerpc. The change has no backwards compatibility, a number of netbios rules will be deleted and replaced, and during the release candidate period the VRT will provide a replacement netbios.rules file that becomes the new netbios.rules once 2.8.4 ships.
What's compelling: The old preprocessor will be completely deprecated and no new detection will be released in the old format, so any team that does not upgrade to Snort 2.8.4 and run dcerpc2 loses current detection for dcerpc-exploitable vulnerabilities.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026