topic ThreatID references, or lack thereof in General Topics

ThreatID references, or lack thereof

MCmgt — Fri, 30 Jan 2015 13:53:00 GMT

I frequently come across threat notifications where the info in the Threat DB is so sparse as to make the notification useless.

Take for example my threatid du jour, 13742.

"This signature detects NUCLEAR.Gen Command and Control Traffic."

That's it. Try googling around to see what this is all about.

How do you go about filling in the missing blanks in the ThreatDB?

What do I do, blindly reimage the machine(s) because I have no way of ruling out a false positive?

Dz3015 — Fri, 30 Jan 2015 14:00:09 GMT

Try searching the Threat Vault for more information:

For example, I did a search for "NUCLEAR" and got two hits

MCmgt — Fri, 30 Jan 2015 15:08:43 GMT

Thanks. I had only looked in the Spyware category (by threatid).