Talos has added and modified multiple rules in the indicator-compromise, malware-cnc, os-windows and server-other rule sets to provide coverage for emerging threats from these technologies.
For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091800.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57878 <-> DISABLED <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt (protocol-dns.rules) * 1:57879 <-> ENABLED <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload (indicator-compromise.rules)
* 1:25381 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:25312 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:57876 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules) * 1:42894 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt (malware-cnc.rules) * 1:57877 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091701.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57878 <-> DISABLED <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt (protocol-dns.rules) * 1:57879 <-> ENABLED <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload (indicator-compromise.rules)
* 1:25312 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:25381 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:42894 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt (malware-cnc.rules) * 1:57876 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules) * 1:57877 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091700.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57878 <-> DISABLED <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt (protocol-dns.rules) * 1:57879 <-> ENABLED <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload (indicator-compromise.rules)
* 1:25312 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:57876 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules) * 1:25381 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:57877 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules) * 1:42894 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091601.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57878 <-> DISABLED <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt (protocol-dns.rules) * 1:57879 <-> ENABLED <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload (indicator-compromise.rules)
* 1:57877 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules) * 1:25312 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:25381 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:57876 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules) * 1:42894 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091600.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57879 <-> ENABLED <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload (indicator-compromise.rules) * 1:57878 <-> DISABLED <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt (protocol-dns.rules)
* 1:25312 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:57877 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules) * 1:25381 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:42894 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt (malware-cnc.rules) * 1:57876 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091501.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57879 <-> ENABLED <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload (indicator-compromise.rules) * 1:57878 <-> DISABLED <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt (protocol-dns.rules)
* 1:25312 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:25381 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:57876 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules) * 1:42894 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt (malware-cnc.rules) * 1:57877 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091500.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57878 <-> DISABLED <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt (protocol-dns.rules) * 1:57879 <-> ENABLED <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload (indicator-compromise.rules)
* 1:25381 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:57877 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules) * 1:57876 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules) * 1:25312 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:42894 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091401.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57879 <-> ENABLED <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload (indicator-compromise.rules) * 1:57878 <-> DISABLED <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt (protocol-dns.rules)
* 1:42894 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt (malware-cnc.rules) * 1:25381 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:57876 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules) * 1:25312 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:57877 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091300.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57879 <-> ENABLED <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload (indicator-compromise.rules) * 1:57878 <-> DISABLED <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt (protocol-dns.rules)
* 1:57877 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules) * 1:57876 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules) * 1:42894 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt (malware-cnc.rules) * 1:25381 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:25312 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091101.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57878 <-> DISABLED <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt (protocol-dns.rules) * 1:57879 <-> ENABLED <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload (indicator-compromise.rules)
* 1:57877 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules) * 1:25381 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:25312 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:57876 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules) * 1:42894 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57878 <-> DISABLED <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt (snort3-protocol-dns.rules) * 1:57879 <-> ENABLED <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload (snort3-indicator-compromise.rules)
* 1:42894 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt (snort3-malware-cnc.rules) * 1:25312 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (snort3-server-other.rules) * 1:57876 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (snort3-os-windows.rules) * 1:57877 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (snort3-os-windows.rules) * 1:25381 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (snort3-server-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:57878 <-> DISABLED <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt (protocol-dns.rules) * 1:57879 <-> ENABLED <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload (indicator-compromise.rules)
* 1:42894 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt (malware-cnc.rules) * 1:57876 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules) * 1:57877 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt (os-windows.rules) * 1:25312 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules) * 1:25381 <-> DISABLED <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt (server-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.1.
The format of the file is:
gid:sid <-> Message
* 3:41195 <-> PROTOCOL-SNMP Cisco IP routing configuration manipulation via SNMP attempt * 1:57878 <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt * 1:57879 <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload
* 1:25312 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:25381 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:42894 <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt * 1:57876 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt * 1:57877 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.4.
The format of the file is:
gid:sid <-> Message
* 3:41195 <-> PROTOCOL-SNMP Cisco IP routing configuration manipulation via SNMP attempt * 1:57878 <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt * 1:57879 <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload
* 1:25312 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:25381 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:42894 <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt * 1:57876 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt * 1:57877 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.0.
The format of the file is:
gid:sid <-> Message
* 3:41195 <-> PROTOCOL-SNMP Cisco IP routing configuration manipulation via SNMP attempt * 1:57878 <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt * 1:57879 <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload
* 1:25312 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:25381 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:42894 <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt * 1:57876 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt * 1:57877 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.1.
The format of the file is:
gid:sid <-> Message
* 3:41195 <-> PROTOCOL-SNMP Cisco IP routing configuration manipulation via SNMP attempt * 1:57878 <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt * 1:57879 <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload
* 1:25312 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:25381 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:42894 <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt * 1:57876 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt * 1:57877 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.1.0.
The format of the file is:
gid:sid <-> Message
* 3:41195 <-> PROTOCOL-SNMP Cisco IP routing configuration manipulation via SNMP attempt * 1:57878 <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt * 1:57879 <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload
* 1:25312 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:25381 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:42894 <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt * 1:57876 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt * 1:57877 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.3.0.
The format of the file is:
gid:sid <-> Message
* 3:41195 <-> PROTOCOL-SNMP Cisco IP routing configuration manipulation via SNMP attempt * 1:57878 <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt * 1:57879 <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload
* 1:25312 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:25381 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:42894 <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt * 1:57876 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt * 1:57877 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.4.0.
The format of the file is:
gid:sid <-> Message
* 3:41195 <-> PROTOCOL-SNMP Cisco IP routing configuration manipulation via SNMP attempt * 1:57878 <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt * 1:57879 <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload
* 1:25312 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:25381 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:42894 <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt * 1:57876 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt * 1:57877 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.5.0.
The format of the file is:
gid:sid <-> Message
* 3:41195 <-> PROTOCOL-SNMP Cisco IP routing configuration manipulation via SNMP attempt * 1:57878 <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt * 1:57879 <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload
* 1:25312 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:25381 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:42894 <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt * 1:57876 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt * 1:57877 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.1.
The format of the file is:
gid:sid <-> Message
* 3:41195 <-> PROTOCOL-SNMP Cisco IP routing configuration manipulation via SNMP attempt * 1:57878 <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt * 1:57879 <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload
* 1:25312 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:25381 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:42894 <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt * 1:57876 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt * 1:57877 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.4.
The format of the file is:
gid:sid <-> Message
* 3:41195 <-> PROTOCOL-SNMP Cisco IP routing configuration manipulation via SNMP attempt * 1:57878 <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt * 1:57879 <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload
* 1:25312 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:25381 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:42894 <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt * 1:57876 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt * 1:57877 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.0.
The format of the file is:
gid:sid <-> Message
* 3:41195 <-> PROTOCOL-SNMP Cisco IP routing configuration manipulation via SNMP attempt * 1:57878 <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt * 1:57879 <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload
* 1:25312 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:25381 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:42894 <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt * 1:57876 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt * 1:57877 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.1.
The format of the file is:
gid:sid <-> Message
* 3:41195 <-> PROTOCOL-SNMP Cisco IP routing configuration manipulation via SNMP attempt * 1:57878 <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt * 1:57879 <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload
* 1:25312 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:25381 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:42894 <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt * 1:57876 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt * 1:57877 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.1.0.
The format of the file is:
gid:sid <-> Message
* 3:41195 <-> PROTOCOL-SNMP Cisco IP routing configuration manipulation via SNMP attempt * 1:57878 <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt * 1:57879 <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload
* 1:25312 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:25381 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:42894 <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt * 1:57876 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt * 1:57877 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.3.0.
The format of the file is:
gid:sid <-> Message
* 3:41195 <-> PROTOCOL-SNMP Cisco IP routing configuration manipulation via SNMP attempt * 1:57878 <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt * 1:57879 <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload
* 1:25312 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:25381 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:42894 <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt * 1:57876 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt * 1:57877 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.4.0.
The format of the file is:
gid:sid <-> Message
* 3:41195 <-> PROTOCOL-SNMP Cisco IP routing configuration manipulation via SNMP attempt * 1:57878 <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt * 1:57879 <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload
* 1:25312 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:25381 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:42894 <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt * 1:57876 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt * 1:57877 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.5.0.
The format of the file is:
gid:sid <-> Message
* 3:41195 <-> PROTOCOL-SNMP Cisco IP routing configuration manipulation via SNMP attempt * 1:57878 <-> PROTOCOL-DNS Microsoft Threat Management Gateway heap buffer overflow attempt * 1:57879 <-> INDICATOR-COMPROMISE Revil Kaseya ransomware log clearing http upload
* 1:25312 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:25381 <-> SERVER-OTHER Microsoft Threat Management Gateway heap buffer overflow attempt * 1:42894 <-> MALWARE-CNC Win.Trojan.Ursnif variant outbound connection attempt * 1:57876 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt * 1:57877 <-> OS-WINDOWS Microsoft Windows Print Spooler remote code execution attempt