Talos has added and modified multiple rules in the browser-chrome, file-office, file-pdf, malware-cnc and server-webapp rule sets to provide coverage for emerging threats from these technologies.
For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2092000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60043 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60044 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60045 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60046 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60047 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60048 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60049 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt (malware-cnc.rules) * 1:60050 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt (malware-cnc.rules) * 1:60051 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60052 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60053 <-> ENABLED <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection (malware-cnc.rules) * 1:60057 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection (malware-cnc.rules) * 1:60058 <-> DISABLED <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt (server-other.rules) * 3:59990 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:59992 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:59993 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:59994 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:59988 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:59989 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:59995 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59996 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59997 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59998 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59999 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60000 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60001 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60002 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60003 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60004 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60005 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60006 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt (server-webapp.rules) * 3:60007 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:59991 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60008 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60009 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60010 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60011 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60012 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60013 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60014 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60015 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60016 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60017 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60018 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60019 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60020 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60021 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60022 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60023 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60024 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60026 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60027 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60028 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60029 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60030 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60031 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60032 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60033 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60034 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60035 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60036 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60037 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60038 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60039 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60040 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60041 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60042 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60054 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60055 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60056 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules)
* 1:58431 <-> ENABLED <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection (malware-cnc.rules) * 1:59867 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules) * 1:59866 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091900.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60047 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60043 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60045 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60046 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60044 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60048 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60049 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt (malware-cnc.rules) * 1:60050 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt (malware-cnc.rules) * 1:60051 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60052 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60053 <-> ENABLED <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection (malware-cnc.rules) * 1:60057 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection (malware-cnc.rules) * 1:60058 <-> DISABLED <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt (server-other.rules) * 3:59994 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:59993 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:59989 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:59988 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:60028 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:59991 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:59990 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60029 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60030 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:59992 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:59995 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59996 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59997 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59998 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59999 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60000 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60001 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60002 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60003 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60004 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60005 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60008 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60006 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt (server-webapp.rules) * 3:60007 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60009 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60010 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60011 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60012 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60013 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60014 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60015 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60016 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60017 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60018 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60019 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60020 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60021 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60022 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60023 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60024 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60026 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60027 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60031 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60032 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60033 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60034 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60035 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60036 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60037 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60038 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60039 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60040 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60041 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60042 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60054 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60055 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60056 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules)
* 1:59866 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules) * 1:58431 <-> ENABLED <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection (malware-cnc.rules) * 1:59867 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091801.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60045 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60047 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60044 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60050 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt (malware-cnc.rules) * 1:60046 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60048 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60051 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60049 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt (malware-cnc.rules) * 1:60043 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60052 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60053 <-> ENABLED <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection (malware-cnc.rules) * 1:60057 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection (malware-cnc.rules) * 1:60058 <-> DISABLED <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt (server-other.rules) * 3:59991 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60008 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60031 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:59993 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:59988 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:59989 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:59992 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:59994 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:60054 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60034 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60032 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60033 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60036 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:59990 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60037 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60038 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60039 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60040 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60041 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60042 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60055 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60056 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60030 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60035 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:59995 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59996 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59998 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59999 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:59997 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:60000 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60001 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60002 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60003 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60004 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60005 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60006 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt (server-webapp.rules) * 3:60007 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60009 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60010 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60011 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60012 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60013 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60014 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60015 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60017 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60016 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60018 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60019 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60020 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60021 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60022 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60023 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60024 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60026 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60027 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60028 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60029 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules)
* 1:58431 <-> ENABLED <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection (malware-cnc.rules) * 1:59867 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules) * 1:59866 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091701.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60043 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60046 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60047 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60052 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60053 <-> ENABLED <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection (malware-cnc.rules) * 1:60048 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60049 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt (malware-cnc.rules) * 1:60050 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt (malware-cnc.rules) * 1:60057 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection (malware-cnc.rules) * 1:60058 <-> DISABLED <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt (server-other.rules) * 1:60051 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60045 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60044 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 3:59994 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:59993 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:60008 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:59992 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60033 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60001 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:59990 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:59988 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:60002 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:59991 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60035 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:59989 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:59995 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59996 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59997 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:60039 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:59999 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60037 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60000 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60038 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60040 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60041 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60042 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60054 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60055 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60056 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:59998 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:60034 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60003 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60004 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60005 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60006 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt (server-webapp.rules) * 3:60036 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60007 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60009 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60010 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60011 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60012 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60013 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60014 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60015 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60016 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60017 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60018 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60019 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60021 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60020 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60022 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60023 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60024 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60026 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60027 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60028 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60029 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60030 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60031 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60032 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules)
* 1:59867 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules) * 1:59866 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules) * 1:58431 <-> ENABLED <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091700.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60047 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60046 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60045 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60049 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt (malware-cnc.rules) * 1:60044 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60051 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60043 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60052 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60050 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt (malware-cnc.rules) * 1:60053 <-> ENABLED <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection (malware-cnc.rules) * 1:60057 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection (malware-cnc.rules) * 1:60058 <-> DISABLED <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt (server-other.rules) * 1:60048 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 3:60008 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60003 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:59990 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60030 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:59994 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:60036 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60034 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60033 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60037 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:59992 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60038 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60032 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:59991 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60039 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60040 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:59989 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:60041 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60002 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:59988 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:59996 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59997 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:60042 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60054 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:59998 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59999 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60000 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60001 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60031 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60035 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60055 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60056 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:59993 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:60004 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60005 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60006 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt (server-webapp.rules) * 3:60007 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60009 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60010 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60011 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60012 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60013 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60014 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60015 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60016 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60017 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60019 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60018 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:59995 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:60020 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60021 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60022 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60023 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60024 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60026 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60027 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60028 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60029 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules)
* 1:59867 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules) * 1:59866 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules) * 1:58431 <-> ENABLED <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091601.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60048 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60044 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60050 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt (malware-cnc.rules) * 1:60045 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60043 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60051 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60052 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60053 <-> ENABLED <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection (malware-cnc.rules) * 1:60057 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection (malware-cnc.rules) * 1:60058 <-> DISABLED <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt (server-other.rules) * 1:60046 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60049 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt (malware-cnc.rules) * 1:60047 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 3:60003 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60031 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60036 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:59993 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:60038 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:59989 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:59990 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60054 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60055 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60041 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:59998 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:60034 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60035 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:59991 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60039 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60040 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60033 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60056 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60029 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60020 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:59995 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59996 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59999 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60000 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60001 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60002 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60004 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:59997 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:60005 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60006 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt (server-webapp.rules) * 3:60030 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60007 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60042 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60009 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:59988 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:60037 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60010 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60011 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60012 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:59992 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60013 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60014 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60015 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60032 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60016 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60017 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60019 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60018 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60021 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60022 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60023 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60024 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60026 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60027 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60028 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:59994 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:60008 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules)
* 1:59866 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules) * 1:58431 <-> ENABLED <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection (malware-cnc.rules) * 1:59867 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091600.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60048 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60047 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60049 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt (malware-cnc.rules) * 1:60045 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60044 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60051 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60050 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt (malware-cnc.rules) * 1:60043 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60052 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60053 <-> ENABLED <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection (malware-cnc.rules) * 1:60057 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection (malware-cnc.rules) * 1:60058 <-> DISABLED <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt (server-other.rules) * 1:60046 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 3:60028 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60012 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:59993 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:59989 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:60035 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60004 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:59991 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:59992 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60036 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60038 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60030 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:59994 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:60054 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60055 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:59988 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:60034 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60016 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60031 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60032 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60039 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60033 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60040 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60041 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60042 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60056 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:59996 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59997 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:60003 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:59998 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59999 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60000 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60001 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60002 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60005 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60006 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt (server-webapp.rules) * 3:60008 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60007 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60029 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60009 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60010 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60011 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60013 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60014 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60015 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:59990 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60017 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60018 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60020 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60019 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:59995 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:60021 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60022 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60023 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60024 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60026 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60027 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60037 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules)
* 1:59866 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules) * 1:59867 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules) * 1:58431 <-> ENABLED <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091501.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60044 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60057 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection (malware-cnc.rules) * 1:60048 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60053 <-> ENABLED <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection (malware-cnc.rules) * 1:60051 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60043 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60047 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60046 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60050 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt (malware-cnc.rules) * 1:60058 <-> DISABLED <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt (server-other.rules) * 1:60045 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60052 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60049 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt (malware-cnc.rules) * 3:60029 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60039 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60035 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60032 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60030 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60054 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60056 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60008 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60031 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:59990 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:59992 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:59988 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:59991 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60028 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:59989 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:59995 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59996 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59997 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59998 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59999 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60033 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60000 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60001 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60002 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60003 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60005 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60004 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60006 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt (server-webapp.rules) * 3:60007 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:59994 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:59993 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:60034 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60036 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60040 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60038 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60042 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60009 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60010 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60011 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60012 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60013 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60014 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60015 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60016 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60017 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60018 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60019 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60020 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60021 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60022 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60023 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60024 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60026 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60027 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60055 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60041 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60037 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules)
* 1:58431 <-> ENABLED <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection (malware-cnc.rules) * 1:59867 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules) * 1:59866 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091401.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60049 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt (malware-cnc.rules) * 1:60047 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60045 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60052 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60043 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60048 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60057 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection (malware-cnc.rules) * 1:60046 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60058 <-> DISABLED <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt (server-other.rules) * 1:60051 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60050 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt (malware-cnc.rules) * 1:60053 <-> ENABLED <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection (malware-cnc.rules) * 1:60044 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 3:59990 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60012 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:59993 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:59992 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:59998 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:60008 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60011 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60033 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60009 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:59999 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60036 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60035 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:59988 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:59991 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:59994 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:60054 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60032 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60056 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60040 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:59996 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59997 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:60031 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60000 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:59989 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:60034 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60024 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60042 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60001 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60002 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60041 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60005 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60006 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt (server-webapp.rules) * 3:60004 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60007 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60019 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60003 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:59995 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:60013 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60014 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60015 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60016 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60017 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60018 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60020 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60021 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60023 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60039 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60022 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60026 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60027 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60028 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60029 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60037 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60030 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60055 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60038 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60010 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules)
* 1:59867 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules) * 1:59866 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules) * 1:58431 <-> ENABLED <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091300.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60044 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60045 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60048 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60051 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60043 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60052 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60053 <-> ENABLED <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection (malware-cnc.rules) * 1:60057 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection (malware-cnc.rules) * 1:60058 <-> DISABLED <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt (server-other.rules) * 1:60050 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt (malware-cnc.rules) * 1:60046 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60047 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60049 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt (malware-cnc.rules) * 3:60054 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60056 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:59997 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:60039 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60008 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:59990 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:59992 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:59993 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:60000 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:59994 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:60036 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60035 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:59988 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:59999 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60028 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60031 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60009 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:59995 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59996 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:60038 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:59998 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:60003 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60004 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60005 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60006 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt (server-webapp.rules) * 3:60007 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:59989 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:60034 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60037 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60040 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60041 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60002 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60029 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:59991 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60032 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60019 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60026 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60010 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60011 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60012 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60013 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60014 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60042 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60015 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60016 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60017 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60020 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60018 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60001 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60021 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60022 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60023 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60033 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60024 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60030 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60055 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60027 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules)
* 1:58431 <-> ENABLED <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection (malware-cnc.rules) * 1:59866 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules) * 1:59867 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091101.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60045 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60051 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60044 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60048 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60052 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60053 <-> ENABLED <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection (malware-cnc.rules) * 1:60049 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt (malware-cnc.rules) * 1:60050 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt (malware-cnc.rules) * 1:60058 <-> DISABLED <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt (server-other.rules) * 1:60043 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60057 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection (malware-cnc.rules) * 1:60047 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60046 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 3:60031 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:59993 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:59988 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:59989 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt (server-webapp.rules) * 3:60028 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60055 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60042 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60038 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60034 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:59990 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60007 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60030 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:59994 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt (server-webapp.rules) * 3:60032 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60029 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60054 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:60040 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60008 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60037 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60033 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60006 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt (server-webapp.rules) * 3:59995 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59996 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59997 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59998 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt (server-webapp.rules) * 3:59999 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60000 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt (server-webapp.rules) * 3:60005 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60001 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60002 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt (server-webapp.rules) * 3:60003 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60036 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60004 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt (server-webapp.rules) * 3:60035 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt (file-office.rules) * 3:60039 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:59992 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60056 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt (server-webapp.rules) * 3:59991 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt (server-webapp.rules) * 3:60041 <-> ENABLED <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt (file-office.rules) * 3:60009 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60010 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60011 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60012 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60013 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60014 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60015 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60016 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60017 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60018 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60019 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60020 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60021 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60022 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt (server-webapp.rules) * 3:60023 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60024 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60025 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60026 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules) * 3:60027 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt (server-webapp.rules)
* 1:59867 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules) * 1:59866 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules) * 1:58431 <-> ENABLED <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60058 <-> ENABLED <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt (snort3-server-other.rules) * 1:60045 <-> ENABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (snort3-server-webapp.rules) * 1:60053 <-> ENABLED <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection (snort3-malware-cnc.rules) * 1:60057 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection (snort3-malware-cnc.rules) * 1:60050 <-> ENABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt (snort3-malware-cnc.rules) * 1:60044 <-> ENABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (snort3-server-webapp.rules) * 1:60046 <-> ENABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (snort3-server-webapp.rules) * 1:60043 <-> ENABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (snort3-server-webapp.rules)
* 1:59866 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (snort3-server-other.rules) * 1:58431 <-> ENABLED <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection (snort3-malware-cnc.rules) * 1:59867 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (snort3-server-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60053 <-> ENABLED <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection (malware-cnc.rules) * 1:60043 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60058 <-> DISABLED <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt (server-other.rules) * 1:60048 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60045 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60052 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60047 <-> DISABLED <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt (file-pdf.rules) * 1:60044 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60046 <-> DISABLED <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt (server-webapp.rules) * 1:60051 <-> DISABLED <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt (browser-chrome.rules) * 1:60049 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt (malware-cnc.rules) * 1:60050 <-> DISABLED <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt (malware-cnc.rules) * 1:60057 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection (malware-cnc.rules)
* 1:58431 <-> ENABLED <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection (malware-cnc.rules) * 1:59867 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules) * 1:59866 <-> ENABLED <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt (server-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.1.
The format of the file is:
gid:sid <-> Message
* 1:300205 <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt * 1:300206 <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt * 3:59988 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59989 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59990 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59991 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59992 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59993 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59994 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59995 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59996 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59997 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59998 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59999 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60000 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60001 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60002 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60003 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60004 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60005 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60006 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt * 3:60007 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60008 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60009 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60010 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60011 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60012 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60013 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60014 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60015 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60016 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60017 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60018 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60019 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60020 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60021 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60022 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60023 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60024 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60026 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60027 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60028 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60029 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60030 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60031 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60032 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60033 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60034 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60035 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60036 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60037 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60038 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60039 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60040 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60041 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60042 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 1:60043 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60044 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60045 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60046 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60049 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt * 1:60050 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt * 1:60053 <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection * 3:60054 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60055 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60056 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 1:60057 <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection * 1:60058 <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt
* 1:58431 <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection * 1:59866 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt * 1:59867 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.4.
The format of the file is:
gid:sid <-> Message
* 1:300205 <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt * 1:300206 <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt * 3:59988 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59989 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59990 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59991 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59992 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59993 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59994 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59995 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59996 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59997 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59998 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59999 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60000 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60001 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60002 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60003 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60004 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60005 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60006 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt * 3:60007 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60008 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60009 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60010 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60011 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60012 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60013 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60014 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60015 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60016 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60017 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60018 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60019 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60020 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60021 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60022 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60023 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60024 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60026 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60027 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60028 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60029 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60030 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60031 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60032 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60033 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60034 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60035 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60036 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60037 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60038 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60039 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60040 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60041 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60042 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 1:60043 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60044 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60045 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60046 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60049 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt * 1:60050 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt * 1:60053 <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection * 3:60054 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60055 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60056 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 1:60057 <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection * 1:60058 <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt
* 1:58431 <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection * 1:59866 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt * 1:59867 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.0.
The format of the file is:
gid:sid <-> Message
* 1:300205 <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt * 1:300206 <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt * 3:59988 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59989 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59990 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59991 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59992 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59993 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59994 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59995 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59996 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59997 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59998 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59999 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60000 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60001 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60002 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60003 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60004 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60005 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60006 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt * 3:60007 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60008 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60009 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60010 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60011 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60012 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60013 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60014 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60015 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60016 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60017 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60018 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60019 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60020 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60021 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60022 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60023 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60024 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60026 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60027 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60028 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60029 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60030 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60031 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60032 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60033 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60034 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60035 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60036 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60037 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60038 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60039 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60040 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60041 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60042 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 1:60043 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60044 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60045 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60046 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60049 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt * 1:60050 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt * 1:60053 <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection * 3:60054 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60055 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60056 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 1:60057 <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection * 1:60058 <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt
* 1:58431 <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection * 1:59866 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt * 1:59867 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.1.
The format of the file is:
gid:sid <-> Message
* 1:300205 <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt * 1:300206 <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt * 3:59988 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59989 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59990 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59991 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59992 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59993 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59994 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59995 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59996 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59997 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59998 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59999 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60000 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60001 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60002 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60003 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60004 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60005 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60006 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt * 3:60007 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60008 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60009 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60010 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60011 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60012 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60013 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60014 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60015 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60016 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60017 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60018 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60019 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60020 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60021 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60022 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60023 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60024 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60026 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60027 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60028 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60029 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60030 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60031 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60032 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60033 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60034 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60035 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60036 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60037 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60038 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60039 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60040 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60041 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60042 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 1:60043 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60044 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60045 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60046 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60049 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt * 1:60050 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt * 1:60053 <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection * 3:60054 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60055 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60056 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 1:60057 <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection * 1:60058 <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt
* 1:58431 <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection * 1:59866 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt * 1:59867 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.1.0.
The format of the file is:
gid:sid <-> Message
* 1:300205 <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt * 1:300206 <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt * 3:59988 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59989 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59990 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59991 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59992 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59993 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59994 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59995 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59996 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59997 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59998 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59999 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60000 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60001 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60002 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60003 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60004 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60005 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60006 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt * 3:60007 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60008 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60009 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60010 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60011 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60012 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60013 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60014 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60015 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60016 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60017 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60018 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60019 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60020 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60021 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60022 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60023 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60024 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60026 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60027 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60028 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60029 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60030 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60031 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60032 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60033 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60034 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60035 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60036 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60037 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60038 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60039 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60040 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60041 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60042 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 1:60043 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60044 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60045 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60046 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60049 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt * 1:60050 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt * 1:60053 <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection * 3:60054 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60055 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60056 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 1:60057 <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection * 1:60058 <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt
* 1:58431 <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection * 1:59866 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt * 1:59867 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.3.0.
The format of the file is:
gid:sid <-> Message
* 1:300205 <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt * 1:300206 <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt * 3:59988 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59989 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59990 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59991 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59992 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59993 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59994 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59995 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59996 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59997 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59998 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59999 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60000 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60001 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60002 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60003 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60004 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60005 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60006 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt * 3:60007 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60008 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60009 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60010 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60011 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60012 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60013 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60014 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60015 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60016 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60017 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60018 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60019 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60020 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60021 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60022 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60023 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60024 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60026 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60027 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60028 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60029 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60030 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60031 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60032 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60033 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60034 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60035 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60036 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60037 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60038 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60039 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60040 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60041 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60042 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 1:60043 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60044 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60045 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60046 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60049 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt * 1:60050 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt * 1:60053 <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection * 3:60054 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60055 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60056 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 1:60057 <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection * 1:60058 <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt
* 1:58431 <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection * 1:59866 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt * 1:59867 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.4.0.
The format of the file is:
gid:sid <-> Message
* 1:300205 <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt * 1:300206 <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt * 3:59988 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59989 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59990 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59991 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59992 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59993 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59994 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59995 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59996 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59997 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59998 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59999 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60000 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60001 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60002 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60003 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60004 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60005 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60006 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt * 3:60007 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60008 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60009 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60010 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60011 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60012 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60013 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60014 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60015 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60016 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60017 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60018 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60019 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60020 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60021 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60022 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60023 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60024 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60026 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60027 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60028 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60029 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60030 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60031 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60032 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60033 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60034 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60035 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60036 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60037 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60038 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60039 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60040 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60041 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60042 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 1:60043 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60044 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60045 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60046 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60049 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt * 1:60050 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt * 1:60053 <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection * 3:60054 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60055 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60056 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 1:60057 <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection * 1:60058 <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt
* 1:58431 <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection * 1:59866 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt * 1:59867 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.5.0.
The format of the file is:
gid:sid <-> Message
* 1:300205 <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt * 1:300206 <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt * 3:59988 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59989 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59990 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59991 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59992 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59993 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59994 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59995 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59996 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59997 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59998 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59999 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60000 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60001 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60002 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60003 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60004 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60005 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60006 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt * 3:60007 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60008 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60009 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60010 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60011 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60012 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60013 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60014 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60015 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60016 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60017 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60018 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60019 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60020 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60021 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60022 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60023 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60024 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60026 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60027 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60028 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60029 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60030 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60031 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60032 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60033 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60034 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60035 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60036 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60037 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60038 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60039 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60040 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60041 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60042 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 1:60043 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60044 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60045 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60046 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60049 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt * 1:60050 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt * 1:60053 <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection * 3:60054 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60055 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60056 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 1:60057 <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection * 1:60058 <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt
* 1:58431 <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection * 1:59866 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt * 1:59867 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.7.0.
The format of the file is:
gid:sid <-> Message
* 1:300205 <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt * 1:300206 <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt * 3:59988 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59989 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59990 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59991 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59992 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59993 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59994 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59995 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59996 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59997 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59998 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59999 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60000 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60001 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60002 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60003 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60004 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60005 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60006 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt * 3:60007 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60008 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60009 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60010 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60011 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60012 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60013 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60014 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60015 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60016 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60017 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60018 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60019 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60020 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60021 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60022 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60023 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60024 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60026 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60027 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60028 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60029 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60030 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60031 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60032 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60033 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60034 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60035 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60036 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60037 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60038 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60039 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60040 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60041 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60042 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 1:60043 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60044 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60045 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60046 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60049 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt * 1:60050 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt * 1:60053 <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection * 3:60054 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60055 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60056 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 1:60057 <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection * 1:60058 <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt
* 1:58431 <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection * 1:59866 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt * 1:59867 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.9.0.
The format of the file is:
gid:sid <-> Message
* 1:300205 <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt * 1:300206 <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt * 3:59988 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59989 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59990 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59991 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59992 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59993 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59994 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59995 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59996 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59997 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59998 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59999 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60000 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60001 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60002 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60003 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60004 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60005 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60006 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt * 3:60007 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60008 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60009 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60010 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60011 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60012 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60013 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60014 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60015 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60016 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60017 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60018 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60019 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60020 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60021 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60022 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60023 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60024 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60026 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60027 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60028 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60029 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60030 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60031 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60032 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60033 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60034 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60035 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60036 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60037 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60038 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60039 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60040 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60041 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60042 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 1:60043 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60044 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60045 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60046 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60049 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt * 1:60050 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt * 1:60053 <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection * 3:60054 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60055 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60056 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 1:60057 <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection * 1:60058 <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt
* 1:58431 <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection * 1:59866 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt * 1:59867 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.11.0.
The format of the file is:
gid:sid <-> Message
* 1:300205 <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt * 1:300206 <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt * 3:59988 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59989 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59990 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59991 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59992 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59993 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59994 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59995 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59996 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59997 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59998 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59999 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60000 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60001 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60002 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60003 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60004 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60005 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60006 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt * 3:60007 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60008 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60009 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60010 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60011 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60012 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60013 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60014 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60015 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60016 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60017 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60018 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60019 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60020 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60021 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60022 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60023 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60024 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60026 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60027 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60028 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60029 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60030 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60031 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60032 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60033 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60034 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60035 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60036 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60037 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60038 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60039 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60040 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60041 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60042 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 1:60043 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60044 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60045 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60046 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60049 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt * 1:60050 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt * 1:60053 <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection * 3:60054 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60055 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60056 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 1:60057 <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection * 1:60058 <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt
* 1:58431 <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection * 1:59866 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt * 1:59867 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.15.0.
The format of the file is:
gid:sid <-> Message
* 1:300205 <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt * 1:300206 <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt * 3:59988 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59989 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59990 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59991 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59992 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59993 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59994 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59995 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59996 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59997 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59998 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59999 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60000 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60001 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60002 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60003 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60004 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60005 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60006 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt * 3:60007 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60008 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60009 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60010 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60011 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60012 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60013 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60014 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60015 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60016 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60017 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60018 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60019 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60020 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60021 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60022 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60023 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60024 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60026 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60027 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60028 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60029 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60030 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60031 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60032 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60033 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60034 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60035 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60036 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60037 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60038 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60039 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60040 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60041 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60042 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 1:60043 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60044 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60045 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60046 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60049 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt * 1:60050 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt * 1:60053 <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection * 3:60054 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60055 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60056 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 1:60057 <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection * 1:60058 <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt
* 1:58431 <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection * 1:59866 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt * 1:59867 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.18.0.
The format of the file is:
gid:sid <-> Message
* 1:300205 <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt * 1:300206 <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt * 3:59988 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59989 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59990 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59991 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59992 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59993 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59994 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59995 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59996 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59997 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59998 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59999 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60000 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60001 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60002 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60003 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60004 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60005 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60006 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt * 3:60007 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60008 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60009 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60010 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60011 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60012 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60013 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60014 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60015 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60016 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60017 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60018 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60019 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60020 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60021 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60022 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60023 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60024 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60026 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60027 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60028 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60029 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60030 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60031 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60032 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60033 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60034 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60035 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60036 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60037 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60038 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60039 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60040 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60041 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60042 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 1:60043 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60044 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60045 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60046 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60049 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt * 1:60050 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt * 1:60053 <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection * 3:60054 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60055 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60056 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 1:60057 <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection * 1:60058 <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt
* 1:58431 <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection * 1:59866 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt * 1:59867 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.20.0.
The format of the file is:
gid:sid <-> Message
* 1:300205 <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt * 1:300206 <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt * 3:59988 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59989 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59990 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59991 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59992 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59993 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59994 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59995 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59996 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59997 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59998 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59999 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60000 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60001 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60002 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60003 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60004 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60005 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60006 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt * 3:60007 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60008 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60009 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60010 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60011 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60012 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60013 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60014 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60015 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60016 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60017 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60018 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60019 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60020 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60021 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60022 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60023 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60024 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60026 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60027 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60028 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60029 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60030 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60031 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60032 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60033 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60034 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60035 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60036 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60037 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60038 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60039 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60040 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60041 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60042 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 1:60043 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60044 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60045 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60046 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60049 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt * 1:60050 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt * 1:60053 <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection * 3:60054 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60055 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60056 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 1:60057 <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection * 1:60058 <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt
* 1:58431 <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection * 1:59866 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt * 1:59867 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.21.0.
The format of the file is:
gid:sid <-> Message
* 1:300205 <-> FILE-PDF Adobe Acrobat Reader DC heap-based buffer overflow attempt * 1:300206 <-> BROWSER-CHROME Google Chrome V8 JavaScript Engine type confusion attempt * 3:59988 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59989 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1539 attack attempt * 3:59990 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59991 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59992 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1531 attack attempt * 3:59993 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59994 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1540 attack attempt * 3:59995 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59996 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59997 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59998 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1546 attack attempt * 3:59999 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60000 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1541 attack attempt * 3:60001 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60002 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1532 attack attempt * 3:60003 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60004 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60005 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1538 attack attempt * 3:60006 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1537 attack attempt * 3:60007 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60008 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60009 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60010 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60011 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60012 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60013 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60014 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60015 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60016 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60017 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60018 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60019 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60020 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60021 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60022 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1573 attack attempt * 3:60023 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60024 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60025 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60026 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60027 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60028 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60029 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60030 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60031 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60032 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60033 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60034 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1572 attack attempt * 3:60035 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60036 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60037 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60038 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1527 attack attempt * 3:60039 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60040 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60041 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 3:60042 <-> FILE-OFFICE TRUFFLEHUNTER TALOS-2022-1533 attack attempt * 1:60043 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60044 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60045 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60046 <-> SERVER-WEBAPP Comtrend VR-3033 routers command injection attempt * 1:60049 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP Tunneling attempt * 1:60050 <-> MALWARE-CNC Win.Rootkit.Daxin HTTP host information exchange attempt * 1:60053 <-> MALWARE-CNC Win.Trojan.DarkVNC variant outbound connection * 3:60054 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60055 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 3:60056 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1528 attack attempt * 1:60057 <-> MALWARE-CNC Win.Trojan.Qakbot variant outbound connection * 1:60058 <-> SERVER-OTHER Hewlett Packard Enterprise Intelligent Management Center imiccdm service directory traversal file write attempt
* 1:58431 <-> MALWARE-CNC Win.Trojan.MirrorBlast outbound connection * 1:59866 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt * 1:59867 <-> SERVER-OTHER Debian Redis Lua sandbox escape attempt
©2024 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
