Talos has added and modified multiple rules in the malware-cnc, os-linux, os-windows and server-webapp rule sets to provide coverage for emerging threats from these technologies.
For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2092000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60416 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60417 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60418 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60419 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60420 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60421 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60422 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60423 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60428 <-> ENABLED <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request (malware-cnc.rules) * 1:60429 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60430 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60431 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60432 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60434 <-> DISABLED <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt (server-webapp.rules) * 1:60435 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60436 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 3:60424 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60425 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60426 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60427 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60433 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt (policy-other.rules)
* 1:60180 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60181 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules) * 1:60183 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60182 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091900.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60428 <-> ENABLED <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request (malware-cnc.rules) * 1:60422 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60434 <-> DISABLED <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt (server-webapp.rules) * 1:60416 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60417 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60420 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60429 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60423 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60430 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60431 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60432 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60418 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60419 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60436 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60435 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60421 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 3:60425 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60427 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60433 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt (policy-other.rules) * 3:60424 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60426 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules)
* 1:60180 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60181 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules) * 1:60182 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60183 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091801.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60434 <-> DISABLED <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt (server-webapp.rules) * 1:60419 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60428 <-> ENABLED <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request (malware-cnc.rules) * 1:60416 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60436 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60435 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60417 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60429 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60423 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60430 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60420 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60432 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60418 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60431 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60421 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60422 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 3:60424 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60425 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60426 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60427 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60433 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt (policy-other.rules)
* 1:60181 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules) * 1:60183 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60180 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60182 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091701.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60418 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60428 <-> ENABLED <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request (malware-cnc.rules) * 1:60421 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60435 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60436 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60431 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60430 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60429 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60417 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60432 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60419 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60420 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60422 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60434 <-> DISABLED <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt (server-webapp.rules) * 1:60423 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60416 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 3:60424 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60425 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60426 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60427 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60433 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt (policy-other.rules)
* 1:60180 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60181 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60183 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules) * 1:60182 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091700.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60422 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60421 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60432 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60428 <-> ENABLED <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request (malware-cnc.rules) * 1:60436 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60416 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60418 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60430 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60434 <-> DISABLED <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt (server-webapp.rules) * 1:60420 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60419 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60435 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60417 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60431 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60423 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60429 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 3:60427 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60433 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt (policy-other.rules) * 3:60424 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60425 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60426 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules)
* 1:60181 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules) * 1:60180 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60182 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60183 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091601.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60419 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60422 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60432 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60436 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60420 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60435 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60421 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60428 <-> ENABLED <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request (malware-cnc.rules) * 1:60434 <-> DISABLED <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt (server-webapp.rules) * 1:60429 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60418 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60423 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60417 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60416 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60431 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60430 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 3:60426 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60425 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60433 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt (policy-other.rules) * 3:60427 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60424 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules)
* 1:60180 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60181 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60182 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60183 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091600.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60417 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60419 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60428 <-> ENABLED <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request (malware-cnc.rules) * 1:60420 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60432 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60436 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60435 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60421 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60422 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60429 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60431 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60430 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60434 <-> DISABLED <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt (server-webapp.rules) * 1:60418 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60423 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60416 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 3:60424 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60425 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60426 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60427 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60433 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt (policy-other.rules)
* 1:60180 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60182 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules) * 1:60183 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60181 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091501.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60423 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60420 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60416 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60430 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60421 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60419 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60435 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60436 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60417 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60434 <-> DISABLED <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt (server-webapp.rules) * 1:60428 <-> ENABLED <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request (malware-cnc.rules) * 1:60429 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60418 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60422 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60431 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60432 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 3:60427 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60425 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60433 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt (policy-other.rules) * 3:60426 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60424 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules)
* 1:60182 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60183 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules) * 1:60180 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60181 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091401.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60423 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60429 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60422 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60435 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60418 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60434 <-> DISABLED <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt (server-webapp.rules) * 1:60432 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60417 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60436 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60428 <-> ENABLED <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request (malware-cnc.rules) * 1:60420 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60419 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60431 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60430 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60416 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60421 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 3:60424 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60425 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60426 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60427 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60433 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt (policy-other.rules)
* 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules) * 1:60182 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60183 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60180 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60181 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091300.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60421 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60428 <-> ENABLED <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request (malware-cnc.rules) * 1:60436 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60434 <-> DISABLED <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt (server-webapp.rules) * 1:60418 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60430 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60422 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60416 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60432 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60429 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60431 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60423 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60420 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60435 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60419 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60417 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 3:60424 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60425 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60426 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60427 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60433 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt (policy-other.rules)
* 1:60180 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60182 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules) * 1:60181 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60183 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091101.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60420 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60431 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60422 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60421 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60416 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60419 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60432 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60430 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60418 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60423 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60428 <-> ENABLED <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request (malware-cnc.rules) * 1:60417 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60436 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60434 <-> DISABLED <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt (server-webapp.rules) * 1:60435 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60429 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 3:60426 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60424 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60433 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt (policy-other.rules) * 3:60427 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules) * 3:60425 <-> ENABLED <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt (server-webapp.rules)
* 1:60181 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60180 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules) * 1:60183 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60182 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60434 <-> ENABLED <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt (snort3-server-webapp.rules) * 1:60420 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (snort3-server-webapp.rules) * 1:60418 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (snort3-server-webapp.rules) * 1:300247 <-> ENABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (snort3-server-webapp.rules) * 1:60419 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (snort3-server-webapp.rules) * 1:60421 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (snort3-server-webapp.rules)
* 1:60181 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (snort3-malware-cnc.rules) * 1:60180 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (snort3-malware-cnc.rules) * 1:60183 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (snort3-malware-cnc.rules) * 1:60182 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (snort3-malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60432 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60417 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60435 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60423 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules) * 1:60416 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt (os-windows.rules) * 1:60429 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60428 <-> ENABLED <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request (malware-cnc.rules) * 1:60436 <-> DISABLED <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt (server-webapp.rules) * 1:60421 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60419 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60434 <-> DISABLED <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt (server-webapp.rules) * 1:60430 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt (os-windows.rules) * 1:60431 <-> DISABLED <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt (os-linux.rules) * 1:60418 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60420 <-> ENABLED <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt (server-webapp.rules) * 1:60422 <-> DISABLED <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt (server-webapp.rules)
* 1:39905 <-> DISABLED <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt (os-windows.rules) * 1:60180 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60181 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60182 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules) * 1:60183 <-> ENABLED <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.1.
The format of the file is:
gid:sid <-> Message
* 1:300246 <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt * 1:300247 <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt * 1:300248 <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt * 1:300249 <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt * 1:300250 <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt * 1:60418 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60419 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60420 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60421 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 3:60424 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60425 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60426 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60427 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 1:60428 <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request * 3:60433 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt * 1:60434 <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt
* 1:39905 <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt * 1:60180 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60181 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60182 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60183 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.4.
The format of the file is:
gid:sid <-> Message
* 1:300246 <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt * 1:300247 <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt * 1:300248 <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt * 1:300249 <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt * 1:300250 <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt * 1:60418 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60419 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60420 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60421 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 3:60424 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60425 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60426 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60427 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 1:60428 <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request * 3:60433 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt * 1:60434 <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt
* 1:39905 <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt * 1:60180 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60181 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60182 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60183 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.0.
The format of the file is:
gid:sid <-> Message
* 1:300246 <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt * 1:300247 <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt * 1:300248 <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt * 1:300249 <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt * 1:300250 <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt * 1:60418 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60419 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60420 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60421 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 3:60424 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60425 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60426 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60427 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 1:60428 <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request * 3:60433 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt * 1:60434 <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt
* 1:39905 <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt * 1:60180 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60181 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60182 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60183 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.1.
The format of the file is:
gid:sid <-> Message
* 1:300246 <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt * 1:300247 <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt * 1:300248 <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt * 1:300249 <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt * 1:300250 <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt * 1:60418 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60419 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60420 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60421 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 3:60424 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60425 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60426 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60427 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 1:60428 <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request * 3:60433 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt * 1:60434 <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt
* 1:39905 <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt * 1:60180 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60181 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60182 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60183 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.1.0.
The format of the file is:
gid:sid <-> Message
* 1:300246 <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt * 1:300247 <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt * 1:300248 <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt * 1:300249 <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt * 1:300250 <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt * 1:60418 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60419 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60420 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60421 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 3:60424 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60425 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60426 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60427 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 1:60428 <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request * 3:60433 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt * 1:60434 <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt
* 1:39905 <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt * 1:60180 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60181 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60182 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60183 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.3.0.
The format of the file is:
gid:sid <-> Message
* 1:300246 <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt * 1:300247 <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt * 1:300248 <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt * 1:300249 <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt * 1:300250 <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt * 1:60418 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60419 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60420 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60421 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 3:60424 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60425 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60426 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60427 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 1:60428 <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request * 3:60433 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt * 1:60434 <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt
* 1:39905 <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt * 1:60180 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60181 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60182 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60183 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.4.0.
The format of the file is:
gid:sid <-> Message
* 1:300246 <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt * 1:300247 <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt * 1:300248 <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt * 1:300249 <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt * 1:300250 <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt * 1:60418 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60419 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60420 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60421 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 3:60424 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60425 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60426 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60427 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 1:60428 <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request * 3:60433 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt * 1:60434 <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt
* 1:39905 <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt * 1:60180 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60181 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60182 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60183 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.5.0.
The format of the file is:
gid:sid <-> Message
* 1:300246 <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt * 1:300247 <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt * 1:300248 <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt * 1:300249 <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt * 1:300250 <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt * 1:60418 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60419 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60420 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60421 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 3:60424 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60425 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60426 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60427 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 1:60428 <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request * 3:60433 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt * 1:60434 <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt
* 1:39905 <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt * 1:60180 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60181 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60182 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60183 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.7.0.
The format of the file is:
gid:sid <-> Message
* 1:300246 <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt * 1:300247 <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt * 1:300248 <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt * 1:300249 <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt * 1:300250 <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt * 1:60418 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60419 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60420 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60421 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 3:60424 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60425 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60426 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60427 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 1:60428 <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request * 3:60433 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt * 1:60434 <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt
* 1:39905 <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt * 1:60180 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60181 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60182 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60183 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.9.0.
The format of the file is:
gid:sid <-> Message
* 1:300246 <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt * 1:300247 <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt * 1:300248 <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt * 1:300249 <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt * 1:300250 <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt * 1:60418 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60419 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60420 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60421 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 3:60424 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60425 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60426 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60427 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 1:60428 <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request * 3:60433 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt * 1:60434 <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt
* 1:39905 <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt * 1:60180 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60181 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60182 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60183 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.11.0.
The format of the file is:
gid:sid <-> Message
* 1:300246 <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt * 1:300247 <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt * 1:300248 <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt * 1:300249 <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt * 1:300250 <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt * 1:60418 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60419 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60420 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60421 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 3:60424 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60425 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60426 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60427 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 1:60428 <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request * 3:60433 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt * 1:60434 <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt
* 1:39905 <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt * 1:60180 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60181 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60182 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60183 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.15.0.
The format of the file is:
gid:sid <-> Message
* 1:300246 <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt * 1:300247 <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt * 1:300248 <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt * 1:300249 <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt * 1:300250 <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt * 1:60418 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60419 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60420 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60421 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 3:60424 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60425 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60426 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60427 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 1:60428 <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request * 3:60433 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt * 1:60434 <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt
* 1:39905 <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt * 1:60180 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60181 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60182 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60183 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.18.0.
The format of the file is:
gid:sid <-> Message
* 1:300246 <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt * 1:300247 <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt * 1:300248 <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt * 1:300249 <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt * 1:300250 <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt * 1:60418 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60419 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60420 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60421 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 3:60424 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60425 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60426 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60427 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 1:60428 <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request * 3:60433 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt * 1:60434 <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt
* 1:39905 <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt * 1:60180 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60181 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60182 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60183 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.20.0.
The format of the file is:
gid:sid <-> Message
* 1:300246 <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt * 1:300247 <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt * 1:300248 <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt * 1:300249 <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt * 1:300250 <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt * 1:60418 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60419 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60420 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60421 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 3:60424 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60425 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60426 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60427 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 1:60428 <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request * 3:60433 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt * 1:60434 <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt
* 1:39905 <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt * 1:60180 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60181 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60182 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60183 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.21.0.
The format of the file is:
gid:sid <-> Message
* 1:300246 <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt * 1:300247 <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt * 1:300248 <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt * 1:300249 <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt * 1:300250 <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt * 1:60418 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60419 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60420 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60421 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 3:60424 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60425 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60426 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60427 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 1:60428 <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request * 3:60433 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt * 1:60434 <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt
* 1:39905 <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt * 1:60180 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60181 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60182 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60183 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.35.0.
The format of the file is:
gid:sid <-> Message
* 1:300246 <-> OS-WINDOWS Microsoft Windows Win32k driver privilege escalation attempt * 1:300247 <-> SERVER-WEBAPP PAN-OS Simple Certificate Enrollment Protocol arbitrary PHP file upload attempt * 1:300248 <-> OS-WINDOWS Microsoft Windows Event Tracing privilege escalation attempt * 1:300249 <-> OS-LINUX Linux kernel PTRACE_TRACEME pkexec escalation of privileges attempt * 1:300250 <-> SERVER-WEBAPP WECON LeviStudio multiple xml parameter overflows attempt * 1:60418 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60419 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60420 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 1:60421 <-> SERVER-WEBAPP HID Mercury Access Controller command injection attempt * 3:60424 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60425 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60426 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 3:60427 <-> SERVER-WEBAPP Cisco Web Security Appliance command injection attempt * 1:60428 <-> MALWARE-CNC Win.Trojan.BoratRat outbound connection request * 3:60433 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2022-1587 attack attempt * 1:60434 <-> SERVER-WEBAPP Zimbra directory traversal remote code execution attempt
* 1:39905 <-> OS-WINDOWS Microsoft Windows IIS denial of service attempt * 1:60180 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60181 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60182 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt * 1:60183 <-> MALWARE-CNC Win.Trojan.CrimsonRAT outbound communication attempt
©2024 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
