Discuss about the rule 2012091: No Offset UDP Shellcode"; content:"|E8 00 00 00 00 0F 1A|"

Rule Signatures
5

@Tyrion - The following signatures related to the same reference which all include variants of |E8 00 00 00 00 XX . . .| were removed:

Possible Call with No Offset TCP Shellcode - 2012086
Possible Call with No Offset TCP Shellcode - 2012088
Possible Call with No Offset TCP Shellcode - 2012090
Possible Call with No Offset TCP Shellcode - 2012092

Possible Call with No Offset UDP Shellcode - 2012087
Possible Call with No Offset UDP Shellcode - 2012089
Possible Call with No Offset UDP Shellcode - 2012091
Possible Call with No Offset UDP Shellcode - 2012093

There are two ETPRO rules which contain the a hex pattern but are not related or FP prone so no changes need to be made there. Yesterday I inadvertently included these in my count so there are only 8 signatures total that needed to be disabled.

Group123 Encoded ROKRAT Payload (Observed with CVE-2018-4878) - 2829534
Viknok response - 2807297

@Witty - Typically we communicate our ruleset updates via our Daily Community Ruleset Posts and Twitter. Here is yesterday’s post which shows removed rules.

Assuming Unifi customers are pulling from our official daily ruleset no other changes will be need to be made. That being said if you are manually pulling rules you should use https://rules.emergingthreats.net/ as opposed to that github repo you shared which is 4+ years out of date.

If there is an active support thread on their support forum I’m more than happy to post an update there :slightly_smiling_face:.

Thanks,
Isaac

2 Likes