Microsoft Vulnerability CVE-2020-0690: A coding deficiency exists in DirectX Graphics Kernel that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 53414 through 53415.
Microsoft Vulnerability CVE-2020-0788: A coding deficiency exists in Microsoft Win32k that may lead to an escalation of privilege.
Previously released rules will detect attacks targeting these vulnerabilities and have been updated with the appropriate reference information. They are also included in this release and are identified with GID 1, SIDs 52213 through 52214.
Microsoft Vulnerability CVE-2020-0824: A coding deficiency exists in Microsoft Internet Explorer that may lead to remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 53419 through 53420.
Microsoft Vulnerability CVE-2020-0832: A coding deficiency exists in Microsoft Scripting Engine that may lead to remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 53402 through 53403.
Microsoft Vulnerability CVE-2020-0833: A coding deficiency exists in Microsoft Scripting Engine that may lead to remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 53404 through 53405.
Microsoft Vulnerability CVE-2020-0847: A coding deficiency exists in Microsoft Windows VBScript Engine that may lead to remote code execution.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 53416 through 53417.
Microsoft Vulnerability CVE-2020-0877: A coding deficiency exists in Microsoft Win32k that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 53421 through 53424.
Microsoft Vulnerability CVE-2020-0887: A coding deficiency exists in Microsoft Win32k that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 53408 through 53409.
Microsoft Vulnerability CVE-2020-0898: A coding deficiency exists in Microsoft Graphics Component that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 53406 through 53407.
Talos also has added and modified multiple rules in the browser-ie, deleted, indicator-scan, os-windows and server-other rule sets to provide coverage for emerging threats from these technologies.
For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091501.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:53416 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53415 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectX kernel memory leak attempt (os-windows.rules) * 1:53414 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectX kernel memory leak attempt (os-windows.rules) * 1:53413 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53412 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53411 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53410 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53409 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53408 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53407 <-> ENABLED <-> OS-WINDOWS Microsoft Windows DirectComposition elevation of privilege attempt (os-windows.rules) * 1:53406 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectComposition elevation of privilege attempt (os-windows.rules) * 1:53405 <-> ENABLED <-> BROWSER-IE Internet Explorer Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53404 <-> ENABLED <-> BROWSER-IE Internet Explorer Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53403 <-> ENABLED <-> BROWSER-IE Microsoft Edge Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53402 <-> ENABLED <-> BROWSER-IE Microsoft Edge Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53424 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53423 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53422 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53421 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53420 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53419 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53417 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 3:53418 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2020-1018 attack attempt (server-other.rules)
* 1:619 <-> DISABLED <-> INDICATOR-SCAN cybercop os probe (indicator-scan.rules) * 1:52213 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Win32k privilege escalation attempt (os-windows.rules) * 1:53341 <-> ENABLED <-> SERVER-APACHE Apache Tomcat AJP connector arbitrary file access attempt (server-apache.rules) * 1:52214 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Win32k privilege escalation attempt (os-windows.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091500.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:53420 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53419 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53403 <-> ENABLED <-> BROWSER-IE Microsoft Edge Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53421 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53402 <-> ENABLED <-> BROWSER-IE Microsoft Edge Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53404 <-> ENABLED <-> BROWSER-IE Internet Explorer Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53405 <-> ENABLED <-> BROWSER-IE Internet Explorer Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53406 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectComposition elevation of privilege attempt (os-windows.rules) * 1:53410 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53411 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53424 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53407 <-> ENABLED <-> OS-WINDOWS Microsoft Windows DirectComposition elevation of privilege attempt (os-windows.rules) * 1:53423 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53422 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53412 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53413 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53414 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectX kernel memory leak attempt (os-windows.rules) * 1:53415 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectX kernel memory leak attempt (os-windows.rules) * 1:53416 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53417 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53408 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53409 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 3:53418 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2020-1018 attack attempt (server-other.rules)
* 1:52214 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Win32k privilege escalation attempt (os-windows.rules) * 1:53341 <-> ENABLED <-> SERVER-APACHE Apache Tomcat AJP connector arbitrary file access attempt (server-apache.rules) * 1:52213 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Win32k privilege escalation attempt (os-windows.rules) * 1:619 <-> DISABLED <-> INDICATOR-SCAN cybercop os probe (indicator-scan.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091401.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:53404 <-> ENABLED <-> BROWSER-IE Internet Explorer Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53402 <-> ENABLED <-> BROWSER-IE Microsoft Edge Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53424 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53423 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53403 <-> ENABLED <-> BROWSER-IE Microsoft Edge Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53421 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53422 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53420 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53419 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53406 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectComposition elevation of privilege attempt (os-windows.rules) * 1:53408 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53407 <-> ENABLED <-> OS-WINDOWS Microsoft Windows DirectComposition elevation of privilege attempt (os-windows.rules) * 1:53411 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53405 <-> ENABLED <-> BROWSER-IE Internet Explorer Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53412 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53413 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53414 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectX kernel memory leak attempt (os-windows.rules) * 1:53415 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectX kernel memory leak attempt (os-windows.rules) * 1:53416 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53410 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53409 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53417 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 3:53418 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2020-1018 attack attempt (server-other.rules)
* 1:619 <-> DISABLED <-> INDICATOR-SCAN cybercop os probe (indicator-scan.rules) * 1:52213 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Win32k privilege escalation attempt (os-windows.rules) * 1:53341 <-> ENABLED <-> SERVER-APACHE Apache Tomcat AJP connector arbitrary file access attempt (server-apache.rules) * 1:52214 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Win32k privilege escalation attempt (os-windows.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091300.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:53420 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53423 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53405 <-> ENABLED <-> BROWSER-IE Internet Explorer Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53424 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53421 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53404 <-> ENABLED <-> BROWSER-IE Internet Explorer Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53408 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53409 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53414 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectX kernel memory leak attempt (os-windows.rules) * 1:53406 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectComposition elevation of privilege attempt (os-windows.rules) * 1:53422 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53410 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53403 <-> ENABLED <-> BROWSER-IE Microsoft Edge Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53417 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53407 <-> ENABLED <-> OS-WINDOWS Microsoft Windows DirectComposition elevation of privilege attempt (os-windows.rules) * 1:53419 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53413 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53412 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53411 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53402 <-> ENABLED <-> BROWSER-IE Microsoft Edge Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53416 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53415 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectX kernel memory leak attempt (os-windows.rules) * 3:53418 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2020-1018 attack attempt (server-other.rules)
* 1:53341 <-> ENABLED <-> SERVER-APACHE Apache Tomcat AJP connector arbitrary file access attempt (server-apache.rules) * 1:52213 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Win32k privilege escalation attempt (os-windows.rules) * 1:52214 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Win32k privilege escalation attempt (os-windows.rules) * 1:619 <-> DISABLED <-> INDICATOR-SCAN cybercop os probe (indicator-scan.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091101.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:53410 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53421 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53422 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53423 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53424 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53402 <-> ENABLED <-> BROWSER-IE Microsoft Edge Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53409 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53405 <-> ENABLED <-> BROWSER-IE Internet Explorer Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53403 <-> ENABLED <-> BROWSER-IE Microsoft Edge Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53407 <-> ENABLED <-> OS-WINDOWS Microsoft Windows DirectComposition elevation of privilege attempt (os-windows.rules) * 1:53408 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53411 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53420 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53406 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectComposition elevation of privilege attempt (os-windows.rules) * 1:53404 <-> ENABLED <-> BROWSER-IE Internet Explorer Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53417 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53415 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectX kernel memory leak attempt (os-windows.rules) * 1:53413 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53419 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53416 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53414 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectX kernel memory leak attempt (os-windows.rules) * 1:53412 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 3:53418 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2020-1018 attack attempt (server-other.rules)
* 1:52213 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Win32k privilege escalation attempt (os-windows.rules) * 1:52214 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Win32k privilege escalation attempt (os-windows.rules) * 1:619 <-> DISABLED <-> INDICATOR-SCAN cybercop os probe (indicator-scan.rules) * 1:53341 <-> ENABLED <-> SERVER-APACHE Apache Tomcat AJP connector arbitrary file access attempt (server-apache.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:53421 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (snort3-os-windows.rules) * 1:53422 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (snort3-os-windows.rules) * 1:53423 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (snort3-os-windows.rules) * 1:53409 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (snort3-os-windows.rules) * 1:53404 <-> ENABLED <-> BROWSER-IE Internet Explorer Scripting Engine memory corruption attempt (snort3-browser-ie.rules) * 1:53402 <-> ENABLED <-> BROWSER-IE Microsoft Edge Scripting Engine memory corruption attempt (snort3-browser-ie.rules) * 1:53410 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (snort3-deleted.rules) * 1:53408 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (snort3-os-windows.rules) * 1:53405 <-> ENABLED <-> BROWSER-IE Internet Explorer Scripting Engine memory corruption attempt (snort3-browser-ie.rules) * 1:53420 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (snort3-browser-ie.rules) * 1:53411 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (snort3-deleted.rules) * 1:53424 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (snort3-os-windows.rules) * 1:53407 <-> ENABLED <-> OS-WINDOWS Microsoft Windows DirectComposition elevation of privilege attempt (snort3-os-windows.rules) * 1:53412 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (snort3-deleted.rules) * 1:53413 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (snort3-deleted.rules) * 1:53403 <-> ENABLED <-> BROWSER-IE Microsoft Edge Scripting Engine memory corruption attempt (snort3-browser-ie.rules) * 1:53414 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectX kernel memory leak attempt (snort3-os-windows.rules) * 1:53415 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectX kernel memory leak attempt (snort3-os-windows.rules) * 1:53416 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (snort3-browser-ie.rules) * 1:53417 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (snort3-browser-ie.rules) * 1:53419 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (snort3-browser-ie.rules) * 1:53406 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectComposition elevation of privilege attempt (snort3-os-windows.rules)
* 1:52213 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Win32k privilege escalation attempt (snort3-os-windows.rules) * 1:53341 <-> ENABLED <-> SERVER-APACHE Apache Tomcat AJP connector arbitrary file access attempt (snort3-server-apache.rules) * 1:619 <-> DISABLED <-> INDICATOR-SCAN cybercop os probe (snort3-indicator-scan.rules) * 1:52214 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Win32k privilege escalation attempt (snort3-os-windows.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:53422 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53402 <-> ENABLED <-> BROWSER-IE Microsoft Edge Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53407 <-> ENABLED <-> OS-WINDOWS Microsoft Windows DirectComposition elevation of privilege attempt (os-windows.rules) * 1:53404 <-> ENABLED <-> BROWSER-IE Internet Explorer Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53410 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53421 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53423 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53408 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53409 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53405 <-> ENABLED <-> BROWSER-IE Internet Explorer Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53420 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53406 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectComposition elevation of privilege attempt (os-windows.rules) * 1:53419 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53424 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k privilege escalation attempt (os-windows.rules) * 1:53403 <-> ENABLED <-> BROWSER-IE Microsoft Edge Scripting Engine memory corruption attempt (browser-ie.rules) * 1:53411 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53412 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53413 <-> DISABLED <-> DELETED POLICY-OTHER malformed connection detected (deleted.rules) * 1:53414 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectX kernel memory leak attempt (os-windows.rules) * 1:53415 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DirectX kernel memory leak attempt (os-windows.rules) * 1:53416 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 1:53417 <-> ENABLED <-> BROWSER-IE Microsoft Edge memory corruption attempt (browser-ie.rules) * 3:53418 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2020-1018 attack attempt (server-other.rules)
* 1:619 <-> DISABLED <-> INDICATOR-SCAN cybercop os probe (indicator-scan.rules) * 1:52213 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Win32k privilege escalation attempt (os-windows.rules) * 1:53341 <-> ENABLED <-> SERVER-APACHE Apache Tomcat AJP connector arbitrary file access attempt (server-apache.rules) * 1:52214 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Win32k privilege escalation attempt (os-windows.rules)
©2024 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
