Microsoft Vulnerability CVE-2022-21989: A coding deficiency exists in Microsoft Windows Kernel that may lead to elevation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 59001 through 59002.
Microsoft Vulnerability CVE-2022-21994: A coding deficiency exists in Microsoft DWM Core Library that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 58999 through 59000.
Microsoft Vulnerability CVE-2022-21996: A coding deficiency exists in Microsoft Win32k that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 59008 through 59009.
Microsoft Vulnerability CVE-2022-22000: A coding deficiency exists in Microsoft Windows Common Log File System driver that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 59006 through 59007.
Microsoft Vulnerability CVE-2022-22715: A coding deficiency exists in Named Pipe File System that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 59004 through 59005.
Microsoft Vulnerability CVE-2022-22718: A coding deficiency exists in Microsoft Windows Print Spooler that may lead to an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with GID 1, SIDs 58993 through 58994.
Talos also has added and modified multiple rules in the file-executable, file-image, malware-cnc, os-windows, policy-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.
For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091900.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:58992 <-> ENABLED <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai (malware-cnc.rules) * 1:58993 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:58994 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:58995 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58996 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58997 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58998 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58999 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:59000 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:59001 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:59002 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:59003 <-> DISABLED <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt (server-webapp.rules) * 1:59004 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:59005 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:59006 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:59007 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:59008 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:59009 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 3:59010 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59011 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59012 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt (policy-other.rules) * 3:59013 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt (server-other.rules) * 3:59014 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules) * 3:59015 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules)
* 1:58742 <-> ENABLED <-> SERVER-OTHER Apache Log4j logging remote code execution attempt (server-other.rules) * 3:58805 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58808 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58803 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58809 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58802 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58804 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58810 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58807 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58806 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091801.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:59004 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:59003 <-> DISABLED <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt (server-webapp.rules) * 1:58994 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:59007 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:58999 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:58993 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:58992 <-> ENABLED <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai (malware-cnc.rules) * 1:58995 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58997 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58998 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59001 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:58996 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59005 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:59000 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:59008 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:59009 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:59002 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:59006 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 3:59010 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59011 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59012 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt (policy-other.rules) * 3:59013 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt (server-other.rules) * 3:59014 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules) * 3:59015 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules)
* 1:58742 <-> ENABLED <-> SERVER-OTHER Apache Log4j logging remote code execution attempt (server-other.rules) * 3:58808 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58802 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58806 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58805 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58809 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58804 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58810 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58803 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58807 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091701.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:59005 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:59003 <-> DISABLED <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt (server-webapp.rules) * 1:59001 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:58992 <-> ENABLED <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai (malware-cnc.rules) * 1:58996 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59007 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:59008 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:59004 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:58997 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59002 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:58993 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:58995 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59006 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:58994 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:59000 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:58999 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:59009 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:58998 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 3:59010 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59011 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59012 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt (policy-other.rules) * 3:59013 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt (server-other.rules) * 3:59014 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules) * 3:59015 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules)
* 1:58742 <-> ENABLED <-> SERVER-OTHER Apache Log4j logging remote code execution attempt (server-other.rules) * 3:58802 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58809 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58803 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58805 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58804 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58810 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58807 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58806 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58808 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091700.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:59008 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:59004 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:59009 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:58996 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59000 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:58997 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58992 <-> ENABLED <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai (malware-cnc.rules) * 1:58995 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59005 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:59006 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:58998 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58994 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:59007 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:58993 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:58999 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:59002 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:59003 <-> DISABLED <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt (server-webapp.rules) * 1:59001 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 3:59010 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59011 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59012 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt (policy-other.rules) * 3:59013 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt (server-other.rules) * 3:59014 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules) * 3:59015 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules)
* 1:58742 <-> ENABLED <-> SERVER-OTHER Apache Log4j logging remote code execution attempt (server-other.rules) * 3:58802 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58805 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58803 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58806 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58809 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58807 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58810 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58808 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58804 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091601.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:59004 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:59002 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:59006 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:58999 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:58992 <-> ENABLED <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai (malware-cnc.rules) * 1:58993 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:58994 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:59005 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:58995 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59001 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:59003 <-> DISABLED <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt (server-webapp.rules) * 1:59008 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:58996 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58998 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58997 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59000 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:59007 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:59009 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 3:59010 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59011 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59012 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt (policy-other.rules) * 3:59013 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt (server-other.rules) * 3:59014 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules) * 3:59015 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules)
* 1:58742 <-> ENABLED <-> SERVER-OTHER Apache Log4j logging remote code execution attempt (server-other.rules) * 3:58802 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58809 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58810 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58807 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58804 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58808 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58805 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58806 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58803 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091600.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:58994 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:59005 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:59004 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:59000 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:59001 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:58995 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59003 <-> DISABLED <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt (server-webapp.rules) * 1:58992 <-> ENABLED <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai (malware-cnc.rules) * 1:58993 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:58996 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58997 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58998 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58999 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:59009 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:59007 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:59006 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:59008 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:59002 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 3:59010 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59011 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59012 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt (policy-other.rules) * 3:59013 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt (server-other.rules) * 3:59014 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules) * 3:59015 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules)
* 1:58742 <-> ENABLED <-> SERVER-OTHER Apache Log4j logging remote code execution attempt (server-other.rules) * 3:58802 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58805 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58808 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58804 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58806 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58809 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58810 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58803 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58807 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091501.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:59001 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:59007 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:58995 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59008 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:58992 <-> ENABLED <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai (malware-cnc.rules) * 1:58998 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59005 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:59006 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:59003 <-> DISABLED <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt (server-webapp.rules) * 1:58994 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:58993 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:58996 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58999 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:58997 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59002 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:59000 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:59004 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:59009 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 3:59010 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59011 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59012 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt (policy-other.rules) * 3:59013 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt (server-other.rules) * 3:59014 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules) * 3:59015 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules)
* 1:58742 <-> ENABLED <-> SERVER-OTHER Apache Log4j logging remote code execution attempt (server-other.rules) * 3:58802 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58808 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58806 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58805 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58809 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58807 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58804 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58810 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58803 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091401.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:58995 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58999 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:58996 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59001 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:59002 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:58992 <-> ENABLED <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai (malware-cnc.rules) * 1:58993 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:59005 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:59007 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:59003 <-> DISABLED <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt (server-webapp.rules) * 1:59000 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:59006 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:59009 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:59008 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:58997 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59004 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:58994 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:58998 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 3:59010 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59011 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59012 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt (policy-other.rules) * 3:59013 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt (server-other.rules) * 3:59014 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules) * 3:59015 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules)
* 1:58742 <-> ENABLED <-> SERVER-OTHER Apache Log4j logging remote code execution attempt (server-other.rules) * 3:58804 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58808 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58810 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58802 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58807 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58806 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58803 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58809 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58805 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091300.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:59006 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:58993 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:59002 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:58994 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:58998 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59004 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:58992 <-> ENABLED <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai (malware-cnc.rules) * 1:59008 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:59007 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:58999 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:59001 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:58997 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59003 <-> DISABLED <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt (server-webapp.rules) * 1:59009 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:58996 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58995 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59000 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:59005 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 3:59010 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59011 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59012 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt (policy-other.rules) * 3:59013 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt (server-other.rules) * 3:59014 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules) * 3:59015 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules)
* 1:58742 <-> ENABLED <-> SERVER-OTHER Apache Log4j logging remote code execution attempt (server-other.rules) * 3:58803 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58802 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58809 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58804 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58806 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58805 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58808 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58807 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58810 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091101.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:58996 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59000 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:58992 <-> ENABLED <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai (malware-cnc.rules) * 1:59009 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:58993 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:58997 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59005 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:59004 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:59001 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:58999 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:58994 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:58995 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59008 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:59006 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:59007 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:59003 <-> DISABLED <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt (server-webapp.rules) * 1:59002 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:58998 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 3:59010 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59011 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt (file-image.rules) * 3:59012 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt (policy-other.rules) * 3:59013 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt (server-other.rules) * 3:59014 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules) * 3:59015 <-> ENABLED <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt (file-executable.rules)
* 1:58742 <-> ENABLED <-> SERVER-OTHER Apache Log4j logging remote code execution attempt (server-other.rules) * 3:58806 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58810 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58804 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58802 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58809 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58803 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58808 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58807 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules) * 3:58805 <-> ENABLED <-> SERVER-WEBAPP Apache Log4j logging remote code execution attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:58996 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (snort3-server-webapp.rules) * 1:58992 <-> ENABLED <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai (snort3-malware-cnc.rules) * 1:58994 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (snort3-os-windows.rules) * 1:58997 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (snort3-server-webapp.rules) * 1:58998 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (snort3-server-webapp.rules) * 1:58999 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (snort3-os-windows.rules) * 1:59000 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (snort3-os-windows.rules) * 1:59006 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (snort3-os-windows.rules) * 1:58993 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (snort3-os-windows.rules) * 1:59001 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (snort3-os-windows.rules) * 1:59002 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (snort3-os-windows.rules) * 1:59005 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (snort3-os-windows.rules) * 1:59008 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (snort3-os-windows.rules) * 1:58995 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (snort3-server-webapp.rules) * 1:59009 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (snort3-os-windows.rules) * 1:59003 <-> DISABLED <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt (snort3-server-webapp.rules) * 1:59007 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (snort3-os-windows.rules) * 1:59004 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (snort3-os-windows.rules)
* 1:58742 <-> ENABLED <-> SERVER-OTHER Apache Log4j logging remote code execution attempt (snort3-server-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:59009 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:59007 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:58993 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:58996 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58998 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58994 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules) * 1:59003 <-> DISABLED <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt (server-webapp.rules) * 1:58997 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:58995 <-> DISABLED <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt (server-webapp.rules) * 1:59000 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules) * 1:59008 <-> DISABLED <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt (os-windows.rules) * 1:59005 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:59001 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:59004 <-> DISABLED <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt (os-windows.rules) * 1:59006 <-> DISABLED <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt (os-windows.rules) * 1:59002 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt (os-windows.rules) * 1:58992 <-> ENABLED <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai (malware-cnc.rules) * 1:58999 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt (os-windows.rules)
* 1:58742 <-> ENABLED <-> SERVER-OTHER Apache Log4j logging remote code execution attempt (server-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.1.
The format of the file is:
gid:sid <-> Message
* 1:58992 <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai * 1:58993 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58994 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58995 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58996 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58997 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58998 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58999 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59000 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59001 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59002 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59003 <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt * 1:59004 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59005 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59006 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59007 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59008 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 1:59009 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 3:59010 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59011 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59012 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt * 3:59013 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt * 3:59014 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt * 3:59015 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt
* 1:58742 <-> SERVER-OTHER Apache Log4j logging remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.4.
The format of the file is:
gid:sid <-> Message
* 1:58992 <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai * 1:58993 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58994 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58995 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58996 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58997 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58998 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58999 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59000 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59001 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59002 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59003 <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt * 1:59004 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59005 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59006 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59007 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59008 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 1:59009 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 3:59010 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59011 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59012 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt * 3:59013 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt * 3:59014 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt * 3:59015 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt
* 1:58742 <-> SERVER-OTHER Apache Log4j logging remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.0.
The format of the file is:
gid:sid <-> Message
* 1:58992 <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai * 1:58993 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58994 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58995 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58996 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58997 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58998 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58999 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59000 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59001 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59002 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59003 <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt * 1:59004 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59005 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59006 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59007 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59008 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 1:59009 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 3:59010 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59011 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59012 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt * 3:59013 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt * 3:59014 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt * 3:59015 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt
* 1:58742 <-> SERVER-OTHER Apache Log4j logging remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.1.
The format of the file is:
gid:sid <-> Message
* 1:58992 <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai * 1:58993 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58994 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58995 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58996 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58997 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58998 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58999 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59000 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59001 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59002 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59003 <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt * 1:59004 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59005 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59006 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59007 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59008 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 1:59009 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 3:59010 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59011 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59012 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt * 3:59013 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt * 3:59014 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt * 3:59015 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt
* 1:58742 <-> SERVER-OTHER Apache Log4j logging remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.1.0.
The format of the file is:
gid:sid <-> Message
* 1:58992 <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai * 1:58993 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58994 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58995 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58996 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58997 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58998 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58999 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59000 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59001 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59002 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59003 <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt * 1:59004 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59005 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59006 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59007 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59008 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 1:59009 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 3:59010 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59011 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59012 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt * 3:59013 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt * 3:59014 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt * 3:59015 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt
* 1:58742 <-> SERVER-OTHER Apache Log4j logging remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.3.0.
The format of the file is:
gid:sid <-> Message
* 1:58992 <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai * 1:58993 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58994 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58995 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58996 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58997 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58998 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58999 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59000 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59001 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59002 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59003 <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt * 1:59004 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59005 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59006 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59007 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59008 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 1:59009 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 3:59010 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59011 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59012 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt * 3:59013 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt * 3:59014 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt * 3:59015 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt
* 1:58742 <-> SERVER-OTHER Apache Log4j logging remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.4.0.
The format of the file is:
gid:sid <-> Message
* 1:58992 <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai * 1:58993 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58994 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58995 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58996 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58997 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58998 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58999 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59000 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59001 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59002 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59003 <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt * 1:59004 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59005 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59006 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59007 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59008 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 1:59009 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 3:59010 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59011 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59012 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt * 3:59013 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt * 3:59014 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt * 3:59015 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt
* 1:58742 <-> SERVER-OTHER Apache Log4j logging remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.5.0.
The format of the file is:
gid:sid <-> Message
* 1:58992 <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai * 1:58993 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58994 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58995 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58996 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58997 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58998 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58999 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59000 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59001 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59002 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59003 <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt * 1:59004 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59005 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59006 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59007 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59008 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 1:59009 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 3:59010 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59011 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59012 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt * 3:59013 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt * 3:59014 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt * 3:59015 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt
* 1:58742 <-> SERVER-OTHER Apache Log4j logging remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.7.0.
The format of the file is:
gid:sid <-> Message
* 1:58992 <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai * 1:58993 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58994 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58995 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58996 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58997 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58998 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58999 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59000 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59001 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59002 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59003 <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt * 1:59004 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59005 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59006 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59007 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59008 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 1:59009 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 3:59010 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59011 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59012 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt * 3:59013 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt * 3:59014 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt * 3:59015 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt
* 1:58742 <-> SERVER-OTHER Apache Log4j logging remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.9.0.
The format of the file is:
gid:sid <-> Message
* 1:58992 <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai * 1:58993 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58994 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58995 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58996 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58997 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58998 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58999 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59000 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59001 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59002 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59003 <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt * 1:59004 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59005 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59006 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59007 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59008 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 1:59009 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 3:59010 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59011 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59012 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt * 3:59013 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt * 3:59014 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt * 3:59015 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt
* 1:58742 <-> SERVER-OTHER Apache Log4j logging remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.11.0.
The format of the file is:
gid:sid <-> Message
* 1:58992 <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai * 1:58993 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58994 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58995 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58996 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58997 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58998 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58999 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59000 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59001 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59002 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59003 <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt * 1:59004 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59005 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59006 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59007 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59008 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 1:59009 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 3:59010 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59011 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59012 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt * 3:59013 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt * 3:59014 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt * 3:59015 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt
* 1:58742 <-> SERVER-OTHER Apache Log4j logging remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.15.0.
The format of the file is:
gid:sid <-> Message
* 1:58992 <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai * 1:58993 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58994 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58995 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58996 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58997 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58998 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58999 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59000 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59001 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59002 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59003 <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt * 1:59004 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59005 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59006 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59007 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59008 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 1:59009 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 3:59010 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59011 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59012 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt * 3:59013 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt * 3:59014 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt * 3:59015 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt
* 1:58742 <-> SERVER-OTHER Apache Log4j logging remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.18.0.
The format of the file is:
gid:sid <-> Message
* 1:58992 <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai * 1:58993 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58994 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58995 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58996 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58997 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58998 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58999 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59000 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59001 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59002 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59003 <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt * 1:59004 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59005 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59006 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59007 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59008 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 1:59009 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 3:59010 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59011 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59012 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt * 3:59013 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt * 3:59014 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt * 3:59015 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt
* 1:58742 <-> SERVER-OTHER Apache Log4j logging remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.20.0.
The format of the file is:
gid:sid <-> Message
* 1:58992 <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai * 1:58993 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58994 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58995 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58996 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58997 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58998 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58999 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59000 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59001 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59002 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59003 <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt * 1:59004 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59005 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59006 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59007 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59008 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 1:59009 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 3:59010 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59011 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59012 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt * 3:59013 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt * 3:59014 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt * 3:59015 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt
* 1:58742 <-> SERVER-OTHER Apache Log4j logging remote code execution attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.21.0.
The format of the file is:
gid:sid <-> Message
* 1:58992 <-> MALWARE-CNC User-Agent known malicious user-agent string - Mirai * 1:58993 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58994 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt * 1:58995 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58996 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58997 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58998 <-> SERVER-WEBAPP Gemtek WVRTM-127ACN command injection attempt * 1:58999 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59000 <-> OS-WINDOWS Microsoft Windows Desktop Window Manager type confusion attempt * 1:59001 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59002 <-> OS-WINDOWS Microsoft Windows Kernel privilege escalation attempt * 1:59003 <-> SERVER-WEBAPP Trend Micro SafeSync for Enterprise SQL injection attempt * 1:59004 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59005 <-> OS-WINDOWS Microsoft Windows NPFS file system privilege escalation attempt * 1:59006 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59007 <-> OS-WINDOWS Windows Common log file system driver elevation of privilege attempt * 1:59008 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 1:59009 <-> OS-WINDOWS Microsoft Windows win32k local privilege escalation attempt * 3:59010 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59011 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2022-1464 attack attempt * 3:59012 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1461 attack attempt * 3:59013 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1463 attack attempt * 3:59014 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt * 3:59015 <-> FILE-EXECUTABLE TRUFFLEHUNTER TALOS-2022-1452 attack attempt
* 1:58742 <-> SERVER-OTHER Apache Log4j logging remote code execution attempt
©2024 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
