Talos has added and modified multiple rules in the file-other, malware-backdoor, netbios, os-windows and server-webapp rule sets to provide coverage for emerging threats from these technologies.
For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091700.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57277 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 1:57278 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 1:57279 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon DCERPC over SMB NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57280 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57281 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57283 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:57284 <-> DISABLED <-> MALWARE-BACKDOOR DEWMODE webshell upload attempt (malware-backdoor.rules) * 1:57285 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57286 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57287 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 1:57288 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 1:57289 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell outbound connection attempt (malware-backdoor.rules) * 3:57282 <-> ENABLED <-> NETBIOS TRUFFLEHUNTER TALOS-2021-1260 attack attempt (netbios.rules)
* 1:56799 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:55704 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerAuthenticate elevation of privilege attempt (os-windows.rules) * 1:51586 <-> DISABLED <-> SERVER-OTHER Docker daemon API arbitrary code execution attempt (server-other.rules) * 1:55703 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerReqChallenge elevation of privilege attempt (os-windows.rules) * 1:56801 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:57193 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TCP/IP Remote Code Execution Vulnerability attempt (os-windows.rules) * 1:56800 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:56200 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56202 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56201 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56203 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091601.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57288 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 1:57279 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon DCERPC over SMB NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57280 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57285 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57277 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 1:57289 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell outbound connection attempt (malware-backdoor.rules) * 1:57281 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57284 <-> DISABLED <-> MALWARE-BACKDOOR DEWMODE webshell upload attempt (malware-backdoor.rules) * 1:57283 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:57278 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 1:57286 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57287 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 3:57282 <-> ENABLED <-> NETBIOS TRUFFLEHUNTER TALOS-2021-1260 attack attempt (netbios.rules)
* 1:56799 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:51586 <-> DISABLED <-> SERVER-OTHER Docker daemon API arbitrary code execution attempt (server-other.rules) * 1:55704 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerAuthenticate elevation of privilege attempt (os-windows.rules) * 1:57193 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TCP/IP Remote Code Execution Vulnerability attempt (os-windows.rules) * 1:56800 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:56801 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:56200 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:55703 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerReqChallenge elevation of privilege attempt (os-windows.rules) * 1:56202 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56201 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56203 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091600.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57283 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:57288 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 1:57286 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57277 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 1:57289 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell outbound connection attempt (malware-backdoor.rules) * 1:57279 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon DCERPC over SMB NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57281 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57284 <-> DISABLED <-> MALWARE-BACKDOOR DEWMODE webshell upload attempt (malware-backdoor.rules) * 1:57285 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57287 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 1:57280 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57278 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 3:57282 <-> ENABLED <-> NETBIOS TRUFFLEHUNTER TALOS-2021-1260 attack attempt (netbios.rules)
* 1:55704 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerAuthenticate elevation of privilege attempt (os-windows.rules) * 1:57193 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TCP/IP Remote Code Execution Vulnerability attempt (os-windows.rules) * 1:51586 <-> DISABLED <-> SERVER-OTHER Docker daemon API arbitrary code execution attempt (server-other.rules) * 1:56801 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:56799 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:56800 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:55703 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerReqChallenge elevation of privilege attempt (os-windows.rules) * 1:56200 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56202 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56201 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56203 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091501.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57289 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell outbound connection attempt (malware-backdoor.rules) * 1:57277 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 1:57281 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57286 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57285 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57284 <-> DISABLED <-> MALWARE-BACKDOOR DEWMODE webshell upload attempt (malware-backdoor.rules) * 1:57280 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57288 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 1:57283 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:57287 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 1:57279 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon DCERPC over SMB NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57278 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 3:57282 <-> ENABLED <-> NETBIOS TRUFFLEHUNTER TALOS-2021-1260 attack attempt (netbios.rules)
* 1:56800 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:56799 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:57193 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TCP/IP Remote Code Execution Vulnerability attempt (os-windows.rules) * 1:56203 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56200 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:55704 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerAuthenticate elevation of privilege attempt (os-windows.rules) * 1:51586 <-> DISABLED <-> SERVER-OTHER Docker daemon API arbitrary code execution attempt (server-other.rules) * 1:56202 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:55703 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerReqChallenge elevation of privilege attempt (os-windows.rules) * 1:56201 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56801 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091500.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57288 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 1:57286 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57277 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 1:57278 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 1:57279 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon DCERPC over SMB NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57287 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 1:57285 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57280 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57284 <-> DISABLED <-> MALWARE-BACKDOOR DEWMODE webshell upload attempt (malware-backdoor.rules) * 1:57281 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57283 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:57289 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell outbound connection attempt (malware-backdoor.rules) * 3:57282 <-> ENABLED <-> NETBIOS TRUFFLEHUNTER TALOS-2021-1260 attack attempt (netbios.rules)
* 1:56800 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:55704 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerAuthenticate elevation of privilege attempt (os-windows.rules) * 1:51586 <-> DISABLED <-> SERVER-OTHER Docker daemon API arbitrary code execution attempt (server-other.rules) * 1:55703 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerReqChallenge elevation of privilege attempt (os-windows.rules) * 1:56202 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56203 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:57193 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TCP/IP Remote Code Execution Vulnerability attempt (os-windows.rules) * 1:56801 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:56799 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:56201 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56200 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091401.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57286 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57287 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 1:57285 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57281 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57277 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 1:57283 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:57289 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell outbound connection attempt (malware-backdoor.rules) * 1:57288 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 1:57279 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon DCERPC over SMB NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57278 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 1:57284 <-> DISABLED <-> MALWARE-BACKDOOR DEWMODE webshell upload attempt (malware-backdoor.rules) * 1:57280 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 3:57282 <-> ENABLED <-> NETBIOS TRUFFLEHUNTER TALOS-2021-1260 attack attempt (netbios.rules)
* 1:56801 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:56799 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:55703 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerReqChallenge elevation of privilege attempt (os-windows.rules) * 1:55704 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerAuthenticate elevation of privilege attempt (os-windows.rules) * 1:57193 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TCP/IP Remote Code Execution Vulnerability attempt (os-windows.rules) * 1:56201 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56200 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:51586 <-> DISABLED <-> SERVER-OTHER Docker daemon API arbitrary code execution attempt (server-other.rules) * 1:56202 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56800 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:56203 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091300.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57280 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57289 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell outbound connection attempt (malware-backdoor.rules) * 1:57279 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon DCERPC over SMB NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57277 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 1:57288 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 1:57285 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57287 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 1:57278 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 1:57286 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57281 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57283 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:57284 <-> DISABLED <-> MALWARE-BACKDOOR DEWMODE webshell upload attempt (malware-backdoor.rules) * 3:57282 <-> ENABLED <-> NETBIOS TRUFFLEHUNTER TALOS-2021-1260 attack attempt (netbios.rules)
* 1:56799 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:55704 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerAuthenticate elevation of privilege attempt (os-windows.rules) * 1:56801 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:51586 <-> DISABLED <-> SERVER-OTHER Docker daemon API arbitrary code execution attempt (server-other.rules) * 1:56203 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:57193 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TCP/IP Remote Code Execution Vulnerability attempt (os-windows.rules) * 1:56202 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56200 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56201 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56800 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:55703 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerReqChallenge elevation of privilege attempt (os-windows.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091101.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57287 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 1:57285 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57286 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57289 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell outbound connection attempt (malware-backdoor.rules) * 1:57288 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 1:57277 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 1:57284 <-> DISABLED <-> MALWARE-BACKDOOR DEWMODE webshell upload attempt (malware-backdoor.rules) * 1:57280 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57279 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon DCERPC over SMB NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57281 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57283 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:57278 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 3:57282 <-> ENABLED <-> NETBIOS TRUFFLEHUNTER TALOS-2021-1260 attack attempt (netbios.rules)
* 1:56799 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:57193 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TCP/IP Remote Code Execution Vulnerability attempt (os-windows.rules) * 1:51586 <-> DISABLED <-> SERVER-OTHER Docker daemon API arbitrary code execution attempt (server-other.rules) * 1:56800 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:56801 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:55704 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerAuthenticate elevation of privilege attempt (os-windows.rules) * 1:56201 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56200 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56203 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56202 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:55703 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerReqChallenge elevation of privilege attempt (os-windows.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57277 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (snort3-file-other.rules) * 1:57279 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon DCERPC over SMB NetrServerAuthenticate failed elevation of privilege attempt (snort3-os-windows.rules) * 1:57278 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (snort3-file-other.rules) * 1:57281 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (snort3-os-windows.rules) * 1:57289 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell outbound connection attempt (snort3-malware-backdoor.rules) * 1:57283 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (snort3-server-webapp.rules) * 1:57284 <-> DISABLED <-> MALWARE-BACKDOOR DEWMODE webshell upload attempt (snort3-malware-backdoor.rules) * 1:57285 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (snort3-malware-backdoor.rules) * 1:57286 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (snort3-malware-backdoor.rules) * 1:57287 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (snort3-malware-backdoor.rules) * 1:57288 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (snort3-malware-backdoor.rules) * 1:57280 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (snort3-os-windows.rules)
* 1:56800 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (snort3-server-webapp.rules) * 1:56799 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (snort3-server-webapp.rules) * 1:51586 <-> DISABLED <-> SERVER-OTHER Docker daemon API arbitrary code execution attempt (snort3-server-other.rules) * 1:56801 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (snort3-server-webapp.rules) * 1:55704 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerAuthenticate elevation of privilege attempt (snort3-os-windows.rules) * 1:56201 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (snort3-server-webapp.rules) * 1:56203 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (snort3-server-webapp.rules) * 1:57193 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TCP/IP Remote Code Execution Vulnerability attempt (snort3-os-windows.rules) * 1:56202 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (snort3-server-webapp.rules) * 1:55703 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerReqChallenge elevation of privilege attempt (snort3-os-windows.rules) * 1:56200 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (snort3-server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57283 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:57277 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 1:57284 <-> DISABLED <-> MALWARE-BACKDOOR DEWMODE webshell upload attempt (malware-backdoor.rules) * 1:57289 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell outbound connection attempt (malware-backdoor.rules) * 1:57278 <-> DISABLED <-> FILE-OTHER Metasploit Gather Exchange post-exploitation tool download attempt (file-other.rules) * 1:57285 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57288 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 1:57280 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57286 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell cleanup attempt (malware-backdoor.rules) * 1:57279 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon DCERPC over SMB NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57281 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Netlogon NetrServerAuthenticate failed elevation of privilege attempt (os-windows.rules) * 1:57287 <-> ENABLED <-> MALWARE-BACKDOOR DEWMODE webshell file download attempt (malware-backdoor.rules) * 3:57282 <-> ENABLED <-> NETBIOS TRUFFLEHUNTER TALOS-2021-1260 attack attempt (netbios.rules)
* 1:55704 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerAuthenticate elevation of privilege attempt (os-windows.rules) * 1:56800 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:56801 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:57193 <-> DISABLED <-> OS-WINDOWS Microsoft Windows TCP/IP Remote Code Execution Vulnerability attempt (os-windows.rules) * 1:55703 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Netlogon crafted NetrServerReqChallenge elevation of privilege attempt (os-windows.rules) * 1:56203 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56799 <-> DISABLED <-> SERVER-WEBAPP Liferay arbitrary Java object deserialization attempt (server-webapp.rules) * 1:56201 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56202 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:56200 <-> DISABLED <-> SERVER-WEBAPP Oracle WebLogic Server command injection attempt (server-webapp.rules) * 1:51586 <-> DISABLED <-> SERVER-OTHER Docker daemon API arbitrary code execution attempt (server-other.rules)
©2024 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
