Snort - Network Intrusion Detection & Prevention System

Talos Rules 2022-08-09

Talos is aware of vulnerabilities affecting products from Microsoft Corporation.

Microsoft Vulnerability CVE-2022-34699: A coding deficiency exists in Microsoft Win32k that may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort2: GID 1, SIDs 60379 through 60380. Snort3: GID 1, SID 300237.

Microsoft Vulnerability CVE-2022-34713: A coding deficiency exists in Microsoft Windows Support Diagnostic Tool (MSDT) that may lead to remote code execution.

A rule to detect attacks targeting this vulnerability is included in this release and is identified with: Snort2: GID 1, SID 60384. Snort3: GID 1, SID 60384.

Microsoft Vulnerability CVE-2022-35748: A coding deficiency exists in HTTP.sys that may lead to a Denial of Service (DoS).

A rule to detect attacks targeting this vulnerability is included in this release and is identified with: Snort2: GID 1, SID 60381. Snort3: GID 1, SID 60381.

Microsoft Vulnerability CVE-2022-35750: A coding deficiency exists in Microsoft Win32k that may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort2: GID 1, SIDs 60382 through 60383. Snort3: GID 1, SID 300238.

Microsoft Vulnerability CVE-2022-35751: A coding deficiency exists in Microsoft Hyper-V that may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort2: GID 1, SIDs 60386 through 60387. Snort3: GID 1, SID 300239.

Microsoft Vulnerability CVE-2022-35755: A coding deficiency exists in Microsoft Windows Print Spooler that may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort2: GID 1, SIDs 60371 through 60372. Snort3: GID 1, SID 300233.

Microsoft Vulnerability CVE-2022-35756: A coding deficiency exists in Microsoft Windows Kerberos that may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort2: GID 1, SIDs 60377 through 60378. Snort3: GID 1, SID 300236.

Microsoft Vulnerability CVE-2022-35761: A coding deficiency exists in Microsoft Windows Kernel that may lead to elevation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort2: GID 1, SIDs 60373 through 60374. Snort3: GID 1, SID 300234.

Microsoft Vulnerability CVE-2022-35793: A coding deficiency exists in Microsoft Windows Print Spooler that may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort2: GID 1, SIDs 60375 through 60376. Snort3: GID 1, SID 300235.

Talos also has added and modified multiple rules in the browser-chrome, os-windows and server-webapp rule sets to provide coverage for emerging threats from these technologies.

For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.

Change logs

29200

2022-08-09 20:39:03 UTC

Snort Subscriber Rules Update

Date: 2022-08-09

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2092000.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60366 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60367 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60368 <-> DISABLED <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt (browser-chrome.rules)
 * 1:60369 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60370 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60371 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60372 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60373 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60374 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60375 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60376 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60377 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60378 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60379 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60380 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60381 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt (os-windows.rules)
 * 1:60382 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60383 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60384 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt (os-windows.rules)
 * 1:60386 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60387 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 3:60385 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt (server-webapp.rules)
 * 3:60388 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60389 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60390 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60391 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60392 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt (policy-other.rules)
 * 3:60393 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt (server-webapp.rules)
 * 3:60394 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules)

29190

2022-08-09 20:39:03 UTC

Snort Subscriber Rules Update

Date: 2022-08-09

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091900.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60383 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60386 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60382 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60368 <-> DISABLED <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt (browser-chrome.rules)
 * 1:60384 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt (os-windows.rules)
 * 1:60387 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60367 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60373 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60376 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60375 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60370 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60371 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60377 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60378 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60379 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60381 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt (os-windows.rules)
 * 1:60380 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60369 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60374 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60366 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60372 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 3:60385 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt (server-webapp.rules)
 * 3:60388 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60389 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60390 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60391 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60392 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt (policy-other.rules)
 * 3:60393 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt (server-webapp.rules)
 * 3:60394 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules)

29181

2022-08-09 20:39:03 UTC

Snort Subscriber Rules Update

Date: 2022-08-09

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091801.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60384 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt (os-windows.rules)
 * 1:60367 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60386 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60370 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60369 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60366 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60376 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60368 <-> DISABLED <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt (browser-chrome.rules)
 * 1:60374 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60382 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60375 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60381 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt (os-windows.rules)
 * 1:60377 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60373 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60380 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60387 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60378 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60371 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60383 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60372 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60379 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 3:60385 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt (server-webapp.rules)
 * 3:60388 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60389 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60390 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60391 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60392 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt (policy-other.rules)
 * 3:60393 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt (server-webapp.rules)
 * 3:60394 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules)

29171

2022-08-09 20:39:03 UTC

Snort Subscriber Rules Update

Date: 2022-08-09

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091701.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60384 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt (os-windows.rules)
 * 1:60387 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60366 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60367 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60369 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60378 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60386 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60377 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60379 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60373 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60368 <-> DISABLED <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt (browser-chrome.rules)
 * 1:60375 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60381 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt (os-windows.rules)
 * 1:60380 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60371 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60370 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60374 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60376 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60372 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60383 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60382 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 3:60385 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt (server-webapp.rules)
 * 3:60388 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60389 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60390 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60391 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60392 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt (policy-other.rules)
 * 3:60393 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt (server-webapp.rules)
 * 3:60394 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules)

29170

2022-08-09 20:39:03 UTC

Snort Subscriber Rules Update

Date: 2022-08-09

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091700.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60387 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60376 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60369 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60384 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt (os-windows.rules)
 * 1:60370 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60375 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60378 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60379 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60366 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60380 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60368 <-> DISABLED <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt (browser-chrome.rules)
 * 1:60377 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60373 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60382 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60372 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60383 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60381 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt (os-windows.rules)
 * 1:60367 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60386 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60371 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60374 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 3:60385 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt (server-webapp.rules)
 * 3:60388 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60389 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60390 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60391 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60392 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt (policy-other.rules)
 * 3:60393 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt (server-webapp.rules)
 * 3:60394 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules)

29161

2022-08-09 20:39:03 UTC

Snort Subscriber Rules Update

Date: 2022-08-09

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091601.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60387 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60377 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60369 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60373 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60367 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60371 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60383 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60384 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt (os-windows.rules)
 * 1:60379 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60366 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60368 <-> DISABLED <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt (browser-chrome.rules)
 * 1:60370 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60372 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60382 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60381 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt (os-windows.rules)
 * 1:60375 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60380 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60376 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60378 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60374 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60386 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 3:60385 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt (server-webapp.rules)
 * 3:60388 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60389 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60390 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60391 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60392 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt (policy-other.rules)
 * 3:60393 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt (server-webapp.rules)
 * 3:60394 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules)

29160

2022-08-09 20:39:03 UTC

Snort Subscriber Rules Update

Date: 2022-08-09

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091600.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60376 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60383 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60368 <-> DISABLED <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt (browser-chrome.rules)
 * 1:60373 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60366 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60387 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60384 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt (os-windows.rules)
 * 1:60370 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60386 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60374 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60382 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60371 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60369 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60372 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60377 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60378 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60379 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60367 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60375 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60380 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60381 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt (os-windows.rules)
 * 3:60385 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt (server-webapp.rules)
 * 3:60388 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60389 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60390 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60391 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60392 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt (policy-other.rules)
 * 3:60393 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt (server-webapp.rules)
 * 3:60394 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules)

29151

2022-08-09 20:39:03 UTC

Snort Subscriber Rules Update

Date: 2022-08-09

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091501.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60386 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60376 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60367 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60381 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt (os-windows.rules)
 * 1:60382 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60373 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60384 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt (os-windows.rules)
 * 1:60369 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60370 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60375 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60379 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60380 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60374 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60371 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60387 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60383 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60372 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60366 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60377 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60368 <-> DISABLED <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt (browser-chrome.rules)
 * 1:60378 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 3:60385 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt (server-webapp.rules)
 * 3:60388 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60389 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60390 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60391 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60392 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt (policy-other.rules)
 * 3:60393 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt (server-webapp.rules)
 * 3:60394 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules)

29141

2022-08-09 20:39:03 UTC

Snort Subscriber Rules Update

Date: 2022-08-09

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091401.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60387 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60384 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt (os-windows.rules)
 * 1:60382 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60381 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt (os-windows.rules)
 * 1:60386 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60372 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60367 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60366 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60370 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60383 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60376 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60368 <-> DISABLED <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt (browser-chrome.rules)
 * 1:60374 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60377 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60379 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60373 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60371 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60369 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60380 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60375 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60378 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 3:60385 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt (server-webapp.rules)
 * 3:60388 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60389 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60390 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60391 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60392 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt (policy-other.rules)
 * 3:60393 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt (server-webapp.rules)
 * 3:60394 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules)

29130

2022-08-09 20:39:03 UTC

Snort Subscriber Rules Update

Date: 2022-08-09

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091300.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60380 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60374 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60382 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60367 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60387 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60376 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60366 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60384 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt (os-windows.rules)
 * 1:60379 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60377 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60369 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60368 <-> DISABLED <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt (browser-chrome.rules)
 * 1:60370 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60381 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt (os-windows.rules)
 * 1:60372 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60371 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60386 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60375 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60373 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60378 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60383 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 3:60385 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt (server-webapp.rules)
 * 3:60388 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60389 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60390 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60391 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60392 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt (policy-other.rules)
 * 3:60393 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt (server-webapp.rules)
 * 3:60394 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules)

29111

2022-08-09 20:39:03 UTC

Snort Subscriber Rules Update

Date: 2022-08-09

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091101.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60370 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60382 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60384 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt (os-windows.rules)
 * 1:60383 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60366 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60368 <-> DISABLED <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt (browser-chrome.rules)
 * 1:60372 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60387 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60373 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60369 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60377 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60375 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60386 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60374 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60378 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60371 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60379 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60367 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60380 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60376 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60381 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt (os-windows.rules)
 * 3:60385 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt (server-webapp.rules)
 * 3:60388 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60389 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60390 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60391 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt (server-webapp.rules)
 * 3:60392 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt (policy-other.rules)
 * 3:60393 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt (server-webapp.rules)
 * 3:60394 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt (server-webapp.rules)

Modified Rules:


 * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules)

3000

2022-08-09 20:39:03 UTC

Snort Subscriber Rules Update

Date: 2022-08-09

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3000.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:

Modified Rules:

2983

2022-08-09 20:39:03 UTC

Snort Subscriber Rules Update

Date: 2022-08-09

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:60367 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60372 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60370 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60384 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt (os-windows.rules)
 * 1:60375 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60369 <-> DISABLED <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt (browser-chrome.rules)
 * 1:60366 <-> DISABLED <-> BROWSER-CHROME V8 Array concat remote code execution attempt (browser-chrome.rules)
 * 1:60371 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt (os-windows.rules)
 * 1:60374 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60382 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:60377 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60376 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt (os-windows.rules)
 * 1:60386 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60378 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt (os-windows.rules)
 * 1:60373 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:60368 <-> DISABLED <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt (browser-chrome.rules)
 * 1:60380 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60387 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt (os-windows.rules)
 * 1:60381 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt (os-windows.rules)
 * 1:60379 <-> DISABLED <-> OS-WINDOWS Windows Win32k escalation of privileges attempt (os-windows.rules)
 * 1:60383 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)

Modified Rules:


 * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules)

3031

2022-08-09 20:40:30 UTC

Snort Subscriber Rules Update

Date: 2022-08-09-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.1.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300231 <-> BROWSER-CHROME V8 Array concat remote code execution attempt
* 1:300232 <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt
* 1:300233 <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt
* 1:300234 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300235 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt
* 1:300236 <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt
* 1:300237 <-> OS-WINDOWS Windows Win32k escalation of privileges attempt
* 1:300238 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300239 <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt
* 1:60368 <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt
* 1:60381 <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt
* 1:60384 <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt
* 3:60385 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt
* 3:60388 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60389 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60390 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60391 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60392 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt
* 3:60393 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt
* 3:60394 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt

Modified Rules:

* 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt

3034

2022-08-09 20:40:30 UTC

Snort Subscriber Rules Update

Date: 2022-08-09-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.4.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300231 <-> BROWSER-CHROME V8 Array concat remote code execution attempt
* 1:300232 <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt
* 1:300233 <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt
* 1:300234 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300235 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt
* 1:300236 <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt
* 1:300237 <-> OS-WINDOWS Windows Win32k escalation of privileges attempt
* 1:300238 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300239 <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt
* 1:60368 <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt
* 1:60381 <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt
* 1:60384 <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt
* 3:60385 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt
* 3:60388 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60389 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60390 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60391 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60392 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt
* 3:60393 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt
* 3:60394 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt

Modified Rules:

* 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt

3100

2022-08-09 20:40:30 UTC

Snort Subscriber Rules Update

Date: 2022-08-09-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300231 <-> BROWSER-CHROME V8 Array concat remote code execution attempt
* 1:300232 <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt
* 1:300233 <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt
* 1:300234 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300235 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt
* 1:300236 <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt
* 1:300237 <-> OS-WINDOWS Windows Win32k escalation of privileges attempt
* 1:300238 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300239 <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt
* 1:60368 <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt
* 1:60381 <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt
* 1:60384 <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt
* 3:60385 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt
* 3:60388 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60389 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60390 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60391 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60392 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt
* 3:60393 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt
* 3:60394 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt

Modified Rules:

* 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt

3101

2022-08-09 20:40:30 UTC

Snort Subscriber Rules Update

Date: 2022-08-09-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.1.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300231 <-> BROWSER-CHROME V8 Array concat remote code execution attempt
* 1:300232 <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt
* 1:300233 <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt
* 1:300234 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300235 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt
* 1:300236 <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt
* 1:300237 <-> OS-WINDOWS Windows Win32k escalation of privileges attempt
* 1:300238 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300239 <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt
* 1:60368 <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt
* 1:60381 <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt
* 1:60384 <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt
* 3:60385 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt
* 3:60388 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60389 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60390 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60391 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60392 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt
* 3:60393 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt
* 3:60394 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt

Modified Rules:

* 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt

3110

2022-08-09 20:40:30 UTC

Snort Subscriber Rules Update

Date: 2022-08-09-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.1.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300231 <-> BROWSER-CHROME V8 Array concat remote code execution attempt
* 1:300232 <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt
* 1:300233 <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt
* 1:300234 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300235 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt
* 1:300236 <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt
* 1:300237 <-> OS-WINDOWS Windows Win32k escalation of privileges attempt
* 1:300238 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300239 <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt
* 1:60368 <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt
* 1:60381 <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt
* 1:60384 <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt
* 3:60385 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt
* 3:60388 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60389 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60390 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60391 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60392 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt
* 3:60393 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt
* 3:60394 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt

Modified Rules:

* 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt

3130

2022-08-09 20:40:30 UTC

Snort Subscriber Rules Update

Date: 2022-08-09-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.3.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300231 <-> BROWSER-CHROME V8 Array concat remote code execution attempt
* 1:300232 <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt
* 1:300233 <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt
* 1:300234 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300235 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt
* 1:300236 <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt
* 1:300237 <-> OS-WINDOWS Windows Win32k escalation of privileges attempt
* 1:300238 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300239 <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt
* 1:60368 <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt
* 1:60381 <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt
* 1:60384 <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt
* 3:60385 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt
* 3:60388 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60389 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60390 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60391 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60392 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt
* 3:60393 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt
* 3:60394 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt

Modified Rules:

* 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt

3140

2022-08-09 20:40:30 UTC

Snort Subscriber Rules Update

Date: 2022-08-09-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.4.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300231 <-> BROWSER-CHROME V8 Array concat remote code execution attempt
* 1:300232 <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt
* 1:300233 <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt
* 1:300234 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300235 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt
* 1:300236 <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt
* 1:300237 <-> OS-WINDOWS Windows Win32k escalation of privileges attempt
* 1:300238 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300239 <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt
* 1:60368 <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt
* 1:60381 <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt
* 1:60384 <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt
* 3:60385 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt
* 3:60388 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60389 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60390 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60391 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60392 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt
* 3:60393 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt
* 3:60394 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt

Modified Rules:

* 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt

3150

2022-08-09 20:40:30 UTC

Snort Subscriber Rules Update

Date: 2022-08-09-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.5.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300231 <-> BROWSER-CHROME V8 Array concat remote code execution attempt
* 1:300232 <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt
* 1:300233 <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt
* 1:300234 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300235 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt
* 1:300236 <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt
* 1:300237 <-> OS-WINDOWS Windows Win32k escalation of privileges attempt
* 1:300238 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300239 <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt
* 1:60368 <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt
* 1:60381 <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt
* 1:60384 <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt
* 3:60385 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt
* 3:60388 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60389 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60390 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60391 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60392 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt
* 3:60393 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt
* 3:60394 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt

Modified Rules:

* 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt

3170

2022-08-09 20:40:30 UTC

Snort Subscriber Rules Update

Date: 2022-08-09-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.7.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300231 <-> BROWSER-CHROME V8 Array concat remote code execution attempt
* 1:300232 <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt
* 1:300233 <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt
* 1:300234 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300235 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt
* 1:300236 <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt
* 1:300237 <-> OS-WINDOWS Windows Win32k escalation of privileges attempt
* 1:300238 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300239 <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt
* 1:60368 <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt
* 1:60381 <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt
* 1:60384 <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt
* 3:60385 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt
* 3:60388 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60389 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60390 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60391 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60392 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt
* 3:60393 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt
* 3:60394 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt

Modified Rules:

* 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt

3190

2022-08-09 20:40:30 UTC

Snort Subscriber Rules Update

Date: 2022-08-09-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.9.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300231 <-> BROWSER-CHROME V8 Array concat remote code execution attempt
* 1:300232 <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt
* 1:300233 <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt
* 1:300234 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300235 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt
* 1:300236 <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt
* 1:300237 <-> OS-WINDOWS Windows Win32k escalation of privileges attempt
* 1:300238 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300239 <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt
* 1:60368 <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt
* 1:60381 <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt
* 1:60384 <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt
* 3:60385 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt
* 3:60388 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60389 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60390 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60391 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60392 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt
* 3:60393 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt
* 3:60394 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt

Modified Rules:

* 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt

31110

2022-08-09 20:40:30 UTC

Snort Subscriber Rules Update

Date: 2022-08-09-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.11.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300231 <-> BROWSER-CHROME V8 Array concat remote code execution attempt
* 1:300232 <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt
* 1:300233 <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt
* 1:300234 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300235 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt
* 1:300236 <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt
* 1:300237 <-> OS-WINDOWS Windows Win32k escalation of privileges attempt
* 1:300238 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300239 <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt
* 1:60368 <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt
* 1:60381 <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt
* 1:60384 <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt
* 3:60385 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt
* 3:60388 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60389 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60390 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60391 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60392 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt
* 3:60393 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt
* 3:60394 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt

Modified Rules:

* 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt

31150

2022-08-09 20:40:30 UTC

Snort Subscriber Rules Update

Date: 2022-08-09-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.15.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300231 <-> BROWSER-CHROME V8 Array concat remote code execution attempt
* 1:300232 <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt
* 1:300233 <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt
* 1:300234 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300235 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt
* 1:300236 <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt
* 1:300237 <-> OS-WINDOWS Windows Win32k escalation of privileges attempt
* 1:300238 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300239 <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt
* 1:60368 <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt
* 1:60381 <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt
* 1:60384 <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt
* 3:60385 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt
* 3:60388 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60389 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60390 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60391 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60392 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt
* 3:60393 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt
* 3:60394 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt

Modified Rules:

* 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt

31180

2022-08-09 20:40:30 UTC

Snort Subscriber Rules Update

Date: 2022-08-09-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.18.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300231 <-> BROWSER-CHROME V8 Array concat remote code execution attempt
* 1:300232 <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt
* 1:300233 <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt
* 1:300234 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300235 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt
* 1:300236 <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt
* 1:300237 <-> OS-WINDOWS Windows Win32k escalation of privileges attempt
* 1:300238 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300239 <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt
* 1:60368 <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt
* 1:60381 <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt
* 1:60384 <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt
* 3:60385 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt
* 3:60388 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60389 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60390 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60391 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60392 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt
* 3:60393 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt
* 3:60394 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt

Modified Rules:

* 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt

31200

2022-08-09 20:40:30 UTC

Snort Subscriber Rules Update

Date: 2022-08-09-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.20.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300231 <-> BROWSER-CHROME V8 Array concat remote code execution attempt
* 1:300232 <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt
* 1:300233 <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt
* 1:300234 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300235 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt
* 1:300236 <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt
* 1:300237 <-> OS-WINDOWS Windows Win32k escalation of privileges attempt
* 1:300238 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300239 <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt
* 1:60368 <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt
* 1:60381 <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt
* 1:60384 <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt
* 3:60385 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt
* 3:60388 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60389 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60390 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60391 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60392 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt
* 3:60393 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt
* 3:60394 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt

Modified Rules:

* 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt

31210

2022-08-09 20:40:30 UTC

Snort Subscriber Rules Update

Date: 2022-08-09-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.21.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300231 <-> BROWSER-CHROME V8 Array concat remote code execution attempt
* 1:300232 <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt
* 1:300233 <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt
* 1:300234 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300235 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt
* 1:300236 <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt
* 1:300237 <-> OS-WINDOWS Windows Win32k escalation of privileges attempt
* 1:300238 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300239 <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt
* 1:60368 <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt
* 1:60381 <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt
* 1:60384 <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt
* 3:60385 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt
* 3:60388 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60389 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60390 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60391 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60392 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt
* 3:60393 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt
* 3:60394 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt

Modified Rules:

* 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt

31350

2022-08-09 20:40:30 UTC

Snort Subscriber Rules Update

Date: 2022-08-09-001

This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.35.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300231 <-> BROWSER-CHROME V8 Array concat remote code execution attempt
* 1:300232 <-> BROWSER-CHROME V8 ReadDenseJSArray out of bounds write attempt
* 1:300233 <-> OS-WINDOWS Microsoft Windows Print Spooler privilege escalation attempt
* 1:300234 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300235 <-> OS-WINDOWS Microsoft Windows Print Spooler elevation of privilege attempt
* 1:300236 <-> OS-WINDOWS Microsoft Windows Kerberos elevation of privilege attempt
* 1:300237 <-> OS-WINDOWS Windows Win32k escalation of privileges attempt
* 1:300238 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300239 <-> OS-WINDOWS Microsoft Windows Hyper-V elevation of privilege attempt
* 1:60368 <-> BROWSER-CHROME Chromium V8 Engine remote code execution attempt
* 1:60381 <-> OS-WINDOWS Microsoft Windows IIS denial-of-service attempt
* 1:60384 <-> OS-WINDOWS Microsoft Windows Support Diagnostic Tool directory traversal attempt
* 3:60385 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1577 attack attempt
* 3:60388 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60389 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60390 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60391 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1578 attack attempt
* 3:60392 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1580 attack attempt
* 3:60393 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1575 attack attempt
* 3:60394 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1586 attack attempt

Modified Rules:

* 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt