Talos has added and modified multiple rules in the browser-chrome, browser-other, file-identify, os-linux, os-mobile and server-webapp rule sets to provide coverage for emerging threats from these technologies.
For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2092000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60643 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60644 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60645 <-> DISABLED <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt (browser-other.rules) * 1:60646 <-> ENABLED <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt (os-windows.rules) * 1:60647 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60648 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60665 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60666 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60668 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60669 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60670 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60671 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60672 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60673 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60674 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60675 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60676 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60677 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60678 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 3:60662 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60663 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60649 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60650 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60651 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60652 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60653 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60654 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60655 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60656 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60657 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60658 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60659 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60660 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60664 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60667 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt (server-webapp.rules) * 3:60661 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules)
* 1:57906 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57907 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57908 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57983 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:60642 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:8478 <-> DISABLED <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected (file-identify.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091900.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60678 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60676 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60645 <-> DISABLED <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt (browser-other.rules) * 1:60665 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60666 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60674 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60668 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60646 <-> ENABLED <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt (os-windows.rules) * 1:60647 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60669 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60670 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60671 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60675 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60672 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60673 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60677 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60643 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60644 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60648 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 3:60663 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60662 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60664 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60667 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt (server-webapp.rules) * 3:60649 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60650 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60651 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60652 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60653 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60654 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60655 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60656 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60657 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60658 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60659 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60660 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60661 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules)
* 1:57983 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57906 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57907 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57908 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:60642 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:8478 <-> DISABLED <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected (file-identify.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091801.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60645 <-> DISABLED <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt (browser-other.rules) * 1:60665 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60677 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60676 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60646 <-> ENABLED <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt (os-windows.rules) * 1:60647 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60670 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60671 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60648 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60666 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60675 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60678 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60672 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60643 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60673 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60668 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60669 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60644 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60674 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 3:60663 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60667 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt (server-webapp.rules) * 3:60649 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60650 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60651 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60652 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60653 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60661 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60664 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60654 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60655 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60656 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60657 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60662 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60658 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60659 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60660 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules)
* 1:57906 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57907 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57908 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57983 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:60642 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:8478 <-> DISABLED <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected (file-identify.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091701.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60676 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60648 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60674 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60646 <-> ENABLED <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt (os-windows.rules) * 1:60647 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60678 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60677 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60675 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60671 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60672 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60673 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60666 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60645 <-> DISABLED <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt (browser-other.rules) * 1:60669 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60643 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60665 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60644 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60668 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60670 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 3:60663 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60649 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60650 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60651 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60662 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60667 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt (server-webapp.rules) * 3:60652 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60653 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60654 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60655 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60661 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60664 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60656 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60657 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60658 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60659 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60660 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules)
* 1:57906 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57907 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57908 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57983 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:60642 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:8478 <-> DISABLED <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected (file-identify.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091700.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60674 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60644 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60647 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60677 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60668 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60648 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60646 <-> ENABLED <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt (os-windows.rules) * 1:60676 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60645 <-> DISABLED <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt (browser-other.rules) * 1:60643 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60671 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60670 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60669 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60678 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60673 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60665 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60672 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60666 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60675 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 3:60663 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60662 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60649 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60650 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60651 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60652 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60653 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60654 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60655 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60664 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60656 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60657 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60658 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60667 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt (server-webapp.rules) * 3:60659 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60661 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60660 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules)
* 1:57906 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57907 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57908 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57983 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:60642 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:8478 <-> DISABLED <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected (file-identify.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091601.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60644 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60646 <-> ENABLED <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt (os-windows.rules) * 1:60676 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60675 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60645 <-> DISABLED <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt (browser-other.rules) * 1:60677 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60666 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60672 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60668 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60648 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60670 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60665 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60669 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60643 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60671 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60674 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60647 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60678 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60673 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 3:60664 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60667 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt (server-webapp.rules) * 3:60649 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60650 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60651 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60662 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60652 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60653 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60654 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60655 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60656 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60661 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60657 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60658 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60659 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60663 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60660 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules)
* 1:57906 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57907 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57908 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57983 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:60642 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:8478 <-> DISABLED <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected (file-identify.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091600.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60668 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60669 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60674 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60676 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60671 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60677 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60646 <-> ENABLED <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt (os-windows.rules) * 1:60666 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60647 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60648 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60645 <-> DISABLED <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt (browser-other.rules) * 1:60673 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60643 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60665 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60672 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60678 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60644 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60670 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60675 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 3:60651 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60663 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60667 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt (server-webapp.rules) * 3:60658 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60660 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60652 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60649 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60655 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60657 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60650 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60653 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60656 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60661 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60659 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60664 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60654 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60662 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules)
* 1:57906 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57907 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57908 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57983 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:60642 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:8478 <-> DISABLED <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected (file-identify.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091501.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60648 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60677 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60676 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60668 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60671 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60674 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60672 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60643 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60678 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60646 <-> ENABLED <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt (os-windows.rules) * 1:60675 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60665 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60673 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60670 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60669 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60666 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60647 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60644 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60645 <-> DISABLED <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt (browser-other.rules) * 3:60662 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60664 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60663 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60667 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt (server-webapp.rules) * 3:60649 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60650 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60651 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60652 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60661 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60653 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60654 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60655 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60656 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60657 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60658 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60659 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60660 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules)
* 1:57906 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57907 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57908 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57983 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:60642 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:8478 <-> DISABLED <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected (file-identify.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091401.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60666 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60643 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60668 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60646 <-> ENABLED <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt (os-windows.rules) * 1:60665 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60677 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60678 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60670 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60647 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60676 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60644 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60648 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60671 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60672 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60673 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60674 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60675 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60669 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60645 <-> DISABLED <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt (browser-other.rules) * 3:60662 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60649 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60650 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60651 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60652 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60661 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60664 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60653 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60663 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60654 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60655 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60656 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60657 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60658 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60659 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60660 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60667 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt (server-webapp.rules)
* 1:57983 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:8478 <-> DISABLED <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected (file-identify.rules) * 1:57908 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:60642 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:57906 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57907 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091300.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60648 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60671 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60673 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60676 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60672 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60677 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60675 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60643 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60678 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60674 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60644 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60669 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60668 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60645 <-> DISABLED <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt (browser-other.rules) * 1:60670 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60646 <-> ENABLED <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt (os-windows.rules) * 1:60666 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60665 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60647 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 3:60662 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60663 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60664 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60649 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60650 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60651 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60661 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60652 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60653 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60654 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60655 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60656 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60657 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60667 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt (server-webapp.rules) * 3:60658 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60659 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60660 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules)
* 1:57906 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57907 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57908 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57983 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:60642 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:8478 <-> DISABLED <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected (file-identify.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091101.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60670 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60672 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60674 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60666 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60645 <-> DISABLED <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt (browser-other.rules) * 1:60669 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60675 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60678 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60676 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60644 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60673 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60671 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60646 <-> ENABLED <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt (os-windows.rules) * 1:60677 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60647 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60643 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60668 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60665 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60648 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 3:60662 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60661 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60649 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60650 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt (server-webapp.rules) * 3:60651 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60652 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt (server-webapp.rules) * 3:60663 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules) * 3:60653 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60654 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60667 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt (server-webapp.rules) * 3:60655 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt (server-webapp.rules) * 3:60656 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60657 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60658 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt (server-webapp.rules) * 3:60659 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60660 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt (server-webapp.rules) * 3:60664 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt (server-webapp.rules)
* 1:57908 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:8478 <-> DISABLED <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected (file-identify.rules) * 1:57907 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57983 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:60642 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:57906 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60645 <-> ENABLED <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt (snort3-browser-other.rules) * 1:60678 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (snort3-server-webapp.rules) * 1:60672 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (snort3-server-webapp.rules) * 1:60671 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (snort3-server-webapp.rules) * 1:60673 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (snort3-server-webapp.rules) * 1:60670 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (snort3-server-webapp.rules) * 1:60676 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (snort3-server-webapp.rules) * 1:60677 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (snort3-server-webapp.rules) * 1:60646 <-> ENABLED <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt (snort3-os-windows.rules) * 1:60674 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (snort3-server-webapp.rules) * 1:60675 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (snort3-server-webapp.rules)
* 1:57906 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (snort3-server-webapp.rules) * 1:57907 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (snort3-server-webapp.rules) * 1:57908 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (snort3-server-webapp.rules) * 1:57983 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (snort3-server-webapp.rules) * 1:60642 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (snort3-server-webapp.rules) * 1:8478 <-> ENABLED <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected (snort3-file-identify.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60675 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60647 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60674 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60665 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60648 <-> DISABLED <-> BROWSER-CHROME Chrome IPC memory dump attempt (browser-chrome.rules) * 1:60678 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60644 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules) * 1:60670 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60676 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60668 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60666 <-> DISABLED <-> OS-MOBILE Android ACDB driver ioctl overflow attempt (os-mobile.rules) * 1:60645 <-> DISABLED <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt (browser-other.rules) * 1:60669 <-> DISABLED <-> OS-WINDOWS Virtual Box kernel address tampering attempt (os-windows.rules) * 1:60671 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60677 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60673 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60646 <-> ENABLED <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt (os-windows.rules) * 1:60672 <-> DISABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:60643 <-> DISABLED <-> OS-LINUX Linux kernel route4_change use after free attempt (os-linux.rules)
* 1:57906 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57907 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57908 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:57983 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt (server-webapp.rules) * 1:60642 <-> ENABLED <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt (server-webapp.rules) * 1:8478 <-> DISABLED <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected (file-identify.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.1.
The format of the file is:
gid:sid <-> Message
* 1:300284 <-> OS-LINUX Linux kernel route4_change use after free attempt * 1:300285 <-> BROWSER-CHROME Chrome IPC memory dump attempt * 1:300286 <-> OS-MOBILE Android ACDB driver ioctl overflow attempt * 1:300287 <-> OS-WINDOWS Virtual Box kernel address tampering attempt * 1:60645 <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt * 1:60646 <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt * 3:60649 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60650 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60651 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60652 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60653 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60654 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60655 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60656 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60657 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60658 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60659 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60660 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60661 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60662 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60663 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60664 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60667 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt * 1:60670 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60671 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60672 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60673 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60674 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60675 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60676 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60677 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60678 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt
* 1:57906 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57907 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57908 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57983 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:60642 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:8478 <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.4.
The format of the file is:
gid:sid <-> Message
* 1:300284 <-> OS-LINUX Linux kernel route4_change use after free attempt * 1:300285 <-> BROWSER-CHROME Chrome IPC memory dump attempt * 1:300286 <-> OS-MOBILE Android ACDB driver ioctl overflow attempt * 1:300287 <-> OS-WINDOWS Virtual Box kernel address tampering attempt * 1:60645 <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt * 1:60646 <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt * 3:60649 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60650 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60651 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60652 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60653 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60654 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60655 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60656 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60657 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60658 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60659 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60660 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60661 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60662 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60663 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60664 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60667 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt * 1:60670 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60671 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60672 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60673 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60674 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60675 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60676 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60677 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60678 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt
* 1:57906 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57907 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57908 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57983 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:60642 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:8478 <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.0.
The format of the file is:
gid:sid <-> Message
* 1:300284 <-> OS-LINUX Linux kernel route4_change use after free attempt * 1:300285 <-> BROWSER-CHROME Chrome IPC memory dump attempt * 1:300286 <-> OS-MOBILE Android ACDB driver ioctl overflow attempt * 1:300287 <-> OS-WINDOWS Virtual Box kernel address tampering attempt * 1:60645 <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt * 1:60646 <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt * 3:60649 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60650 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60651 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60652 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60653 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60654 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60655 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60656 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60657 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60658 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60659 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60660 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60661 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60662 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60663 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60664 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60667 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt * 1:60670 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60671 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60672 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60673 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60674 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60675 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60676 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60677 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60678 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt
* 1:57906 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57907 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57908 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57983 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:60642 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:8478 <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.1.
The format of the file is:
gid:sid <-> Message
* 1:300284 <-> OS-LINUX Linux kernel route4_change use after free attempt * 1:300285 <-> BROWSER-CHROME Chrome IPC memory dump attempt * 1:300286 <-> OS-MOBILE Android ACDB driver ioctl overflow attempt * 1:300287 <-> OS-WINDOWS Virtual Box kernel address tampering attempt * 1:60645 <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt * 1:60646 <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt * 3:60649 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60650 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60651 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60652 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60653 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60654 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60655 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60656 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60657 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60658 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60659 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60660 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60661 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60662 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60663 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60664 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60667 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt * 1:60670 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60671 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60672 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60673 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60674 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60675 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60676 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60677 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60678 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt
* 1:57906 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57907 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57908 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57983 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:60642 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:8478 <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.1.0.
The format of the file is:
gid:sid <-> Message
* 1:300284 <-> OS-LINUX Linux kernel route4_change use after free attempt * 1:300285 <-> BROWSER-CHROME Chrome IPC memory dump attempt * 1:300286 <-> OS-MOBILE Android ACDB driver ioctl overflow attempt * 1:300287 <-> OS-WINDOWS Virtual Box kernel address tampering attempt * 1:60645 <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt * 1:60646 <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt * 3:60649 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60650 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60651 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60652 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60653 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60654 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60655 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60656 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60657 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60658 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60659 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60660 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60661 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60662 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60663 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60664 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60667 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt * 1:60670 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60671 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60672 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60673 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60674 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60675 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60676 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60677 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60678 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt
* 1:57906 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57907 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57908 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57983 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:60642 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:8478 <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.3.0.
The format of the file is:
gid:sid <-> Message
* 1:300284 <-> OS-LINUX Linux kernel route4_change use after free attempt * 1:300285 <-> BROWSER-CHROME Chrome IPC memory dump attempt * 1:300286 <-> OS-MOBILE Android ACDB driver ioctl overflow attempt * 1:300287 <-> OS-WINDOWS Virtual Box kernel address tampering attempt * 1:60645 <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt * 1:60646 <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt * 3:60649 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60650 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60651 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60652 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60653 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60654 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60655 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60656 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60657 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60658 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60659 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60660 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60661 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60662 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60663 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60664 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60667 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt * 1:60670 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60671 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60672 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60673 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60674 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60675 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60676 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60677 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60678 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt
* 1:57906 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57907 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57908 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57983 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:60642 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:8478 <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.4.0.
The format of the file is:
gid:sid <-> Message
* 1:300284 <-> OS-LINUX Linux kernel route4_change use after free attempt * 1:300285 <-> BROWSER-CHROME Chrome IPC memory dump attempt * 1:300286 <-> OS-MOBILE Android ACDB driver ioctl overflow attempt * 1:300287 <-> OS-WINDOWS Virtual Box kernel address tampering attempt * 1:60645 <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt * 1:60646 <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt * 3:60649 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60650 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60651 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60652 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60653 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60654 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60655 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60656 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60657 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60658 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60659 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60660 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60661 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60662 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60663 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60664 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60667 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt * 1:60670 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60671 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60672 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60673 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60674 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60675 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60676 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60677 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60678 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt
* 1:57906 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57907 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57908 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57983 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:60642 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:8478 <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.5.0.
The format of the file is:
gid:sid <-> Message
* 1:300284 <-> OS-LINUX Linux kernel route4_change use after free attempt * 1:300285 <-> BROWSER-CHROME Chrome IPC memory dump attempt * 1:300286 <-> OS-MOBILE Android ACDB driver ioctl overflow attempt * 1:300287 <-> OS-WINDOWS Virtual Box kernel address tampering attempt * 1:60645 <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt * 1:60646 <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt * 3:60649 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60650 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60651 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60652 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60653 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60654 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60655 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60656 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60657 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60658 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60659 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60660 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60661 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60662 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60663 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60664 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60667 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt * 1:60670 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60671 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60672 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60673 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60674 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60675 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60676 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60677 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60678 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt
* 1:57906 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57907 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57908 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57983 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:60642 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:8478 <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.7.0.
The format of the file is:
gid:sid <-> Message
* 1:300284 <-> OS-LINUX Linux kernel route4_change use after free attempt * 1:300285 <-> BROWSER-CHROME Chrome IPC memory dump attempt * 1:300286 <-> OS-MOBILE Android ACDB driver ioctl overflow attempt * 1:300287 <-> OS-WINDOWS Virtual Box kernel address tampering attempt * 1:60645 <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt * 1:60646 <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt * 3:60649 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60650 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60651 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60652 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60653 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60654 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60655 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60656 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60657 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60658 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60659 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60660 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60661 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60662 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60663 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60664 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60667 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt * 1:60670 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60671 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60672 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60673 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60674 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60675 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60676 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60677 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60678 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt
* 1:57906 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57907 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57908 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57983 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:60642 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:8478 <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.9.0.
The format of the file is:
gid:sid <-> Message
* 1:300284 <-> OS-LINUX Linux kernel route4_change use after free attempt * 1:300285 <-> BROWSER-CHROME Chrome IPC memory dump attempt * 1:300286 <-> OS-MOBILE Android ACDB driver ioctl overflow attempt * 1:300287 <-> OS-WINDOWS Virtual Box kernel address tampering attempt * 1:60645 <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt * 1:60646 <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt * 3:60649 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60650 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60651 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60652 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60653 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60654 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60655 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60656 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60657 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60658 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60659 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60660 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60661 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60662 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60663 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60664 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60667 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt * 1:60670 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60671 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60672 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60673 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60674 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60675 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60676 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60677 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60678 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt
* 1:57906 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57907 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57908 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57983 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:60642 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:8478 <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.11.0.
The format of the file is:
gid:sid <-> Message
* 1:300284 <-> OS-LINUX Linux kernel route4_change use after free attempt * 1:300285 <-> BROWSER-CHROME Chrome IPC memory dump attempt * 1:300286 <-> OS-MOBILE Android ACDB driver ioctl overflow attempt * 1:300287 <-> OS-WINDOWS Virtual Box kernel address tampering attempt * 1:60645 <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt * 1:60646 <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt * 3:60649 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60650 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60651 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60652 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60653 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60654 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60655 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60656 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60657 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60658 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60659 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60660 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60661 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60662 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60663 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60664 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60667 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt * 1:60670 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60671 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60672 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60673 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60674 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60675 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60676 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60677 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60678 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt
* 1:57906 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57907 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57908 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57983 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:60642 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:8478 <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.15.0.
The format of the file is:
gid:sid <-> Message
* 1:300284 <-> OS-LINUX Linux kernel route4_change use after free attempt * 1:300285 <-> BROWSER-CHROME Chrome IPC memory dump attempt * 1:300286 <-> OS-MOBILE Android ACDB driver ioctl overflow attempt * 1:300287 <-> OS-WINDOWS Virtual Box kernel address tampering attempt * 1:60645 <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt * 1:60646 <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt * 3:60649 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60650 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60651 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60652 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60653 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60654 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60655 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60656 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60657 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60658 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60659 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60660 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60661 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60662 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60663 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60664 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60667 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt * 1:60670 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60671 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60672 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60673 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60674 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60675 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60676 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60677 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60678 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt
* 1:57906 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57907 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57908 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57983 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:60642 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:8478 <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.18.0.
The format of the file is:
gid:sid <-> Message
* 1:300284 <-> OS-LINUX Linux kernel route4_change use after free attempt * 1:300285 <-> BROWSER-CHROME Chrome IPC memory dump attempt * 1:300286 <-> OS-MOBILE Android ACDB driver ioctl overflow attempt * 1:300287 <-> OS-WINDOWS Virtual Box kernel address tampering attempt * 1:60645 <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt * 1:60646 <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt * 3:60649 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60650 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60651 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60652 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60653 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60654 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60655 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60656 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60657 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60658 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60659 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60660 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60661 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60662 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60663 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60664 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60667 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt * 1:60670 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60671 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60672 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60673 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60674 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60675 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60676 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60677 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60678 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt
* 1:57906 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57907 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57908 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57983 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:60642 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:8478 <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.20.0.
The format of the file is:
gid:sid <-> Message
* 1:300284 <-> OS-LINUX Linux kernel route4_change use after free attempt * 1:300285 <-> BROWSER-CHROME Chrome IPC memory dump attempt * 1:300286 <-> OS-MOBILE Android ACDB driver ioctl overflow attempt * 1:300287 <-> OS-WINDOWS Virtual Box kernel address tampering attempt * 1:60645 <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt * 1:60646 <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt * 3:60649 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60650 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60651 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60652 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60653 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60654 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60655 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60656 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60657 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60658 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60659 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60660 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60661 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60662 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60663 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60664 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60667 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt * 1:60670 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60671 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60672 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60673 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60674 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60675 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60676 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60677 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60678 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt
* 1:57906 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57907 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57908 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57983 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:60642 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:8478 <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.21.0.
The format of the file is:
gid:sid <-> Message
* 1:300284 <-> OS-LINUX Linux kernel route4_change use after free attempt * 1:300285 <-> BROWSER-CHROME Chrome IPC memory dump attempt * 1:300286 <-> OS-MOBILE Android ACDB driver ioctl overflow attempt * 1:300287 <-> OS-WINDOWS Virtual Box kernel address tampering attempt * 1:60645 <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt * 1:60646 <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt * 3:60649 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60650 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60651 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60652 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60653 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60654 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60655 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60656 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60657 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60658 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60659 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60660 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60661 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60662 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60663 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60664 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60667 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt * 1:60670 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60671 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60672 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60673 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60674 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60675 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60676 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60677 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60678 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt
* 1:57906 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57907 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57908 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57983 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:60642 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:8478 <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.35.0.
The format of the file is:
gid:sid <-> Message
* 1:300284 <-> OS-LINUX Linux kernel route4_change use after free attempt * 1:300285 <-> BROWSER-CHROME Chrome IPC memory dump attempt * 1:300286 <-> OS-MOBILE Android ACDB driver ioctl overflow attempt * 1:300287 <-> OS-WINDOWS Virtual Box kernel address tampering attempt * 1:60645 <-> BROWSER-OTHER WhatsApp Desktop persistent cross-site scripting attempt * 1:60646 <-> OS-WINDOWS Microsoft Windows IKE remote code execution attempt * 3:60649 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60650 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1608 attack attempt * 3:60651 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60652 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1605 attack attempt * 3:60653 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60654 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60655 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1606 attack attempt * 3:60656 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60657 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60658 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1609 attack attempt * 3:60659 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60660 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60661 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60662 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1607 attack attempt * 3:60663 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60664 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1610 attack attempt * 3:60667 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1611 attack attempt * 1:60670 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60671 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60672 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60673 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60674 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60675 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60676 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60677 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:60678 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt
* 1:57906 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57907 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57908 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:57983 <-> SERVER-WEBAPP Microsoft Exchange autodiscover server side request forgery attempt * 1:60642 <-> SERVER-WEBAPP Microsoft Exchange Server remote code execution attempt * 1:8478 <-> FILE-IDENTIFY Microsoft Office Publisher file magic detected
©2024 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
