SNORT alert for Trufflehunter SFVRT 3:29312:1

Question

I am seeing this Snort alert show up multiple times a day, but my Google-foo is failing me, as I can not find any information about this alert on the internet. Can anyone point me in the direction for more information about this particular alert? Also, if anything in particular should be done?

CRITICAL - (2 errors in snort.protocol-2014-06-12-04-47-09) - 06/12-04:43:47.771462  [**] [3:29312:1] MISC TRUFFLEHUNTER SFVRT-1013 attack attempt [**] [Classification: A Network Trojan was Detected] [Priority: 1] {ICMP}

Thanks,

Answer 1

This is Patrick from VRT. That rule is a "truffle," which means it detects a security incident for which we unfortunately cannot provide additional information due to NDA restrictions. I would be quite interested if you could share some alert pcaps for this rule so I could let you know if they are indeed malicious or not. You can either PM me here and I'll give you my direct Sourcefire email address or you can find me on Freenode in #snort as "phoo".

In the mean time, you should investigate the device for a malware infection and watch for any additional suspicious traffic coming from this host. But please do send me some pcaps as I would love to examine them and either confirm the traffic is malicious or fix the detection.

Thanks,

~Patrick