Sourcefire’s “Don’t Do That” rules look for attempts to obfuscate bad behavior, interesting new 0-day, and other bad stuff. The VRT rules were introduced as an easy way to catch lots of different types of malware in one fell swoop. Since we’ve found these rules useful, and have had positive feedback from users who are running them, I’ve decided to highlight some of the more interesting rules in this group. These rules are intended to make time-starved analysts aware of them, and solicit further feedback on their use.”]
Source: https://blog.talosintelligence.com/2010/05/known-unknowns-dont-do-that-rules.html