Talos has added and modified multiple rules in the indicator-compromise, malware-cnc, malware-tools, policy-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.
For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2092000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:61225 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61226 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61227 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61228 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61229 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61230 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61231 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61232 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61233 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61234 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61235 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61236 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61237 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61238 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61239 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61240 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61241 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61242 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61243 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61244 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61245 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61246 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt (server-other.rules) * 1:61247 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt (server-other.rules) * 1:61248 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61249 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61250 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61251 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61253 <-> DISABLED <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection (malware-cnc.rules) * 3:61252 <-> ENABLED <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt (server-webapp.rules) * 3:61254 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt (server-webapp.rules) * 3:61255 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules) * 3:61256 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules) * 3:61257 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61258 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules)
* 3:61212 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt (policy-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091900.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:61246 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt (server-other.rules) * 1:61247 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt (server-other.rules) * 1:61229 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61226 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61228 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61232 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61233 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61234 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61235 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61237 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61238 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61239 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61240 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61241 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61242 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61243 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61244 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61245 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61225 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61227 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61248 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61249 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61250 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61251 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61253 <-> DISABLED <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection (malware-cnc.rules) * 1:61231 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61230 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61236 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 3:61257 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61258 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61252 <-> ENABLED <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt (server-webapp.rules) * 3:61256 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules) * 3:61254 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt (server-webapp.rules) * 3:61255 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules)
* 3:61212 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt (policy-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091801.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:61248 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61249 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61226 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61245 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61229 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61250 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61251 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61230 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61253 <-> DISABLED <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection (malware-cnc.rules) * 1:61240 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61227 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61232 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61233 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61234 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61235 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61236 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61237 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61238 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61239 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61241 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61242 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61243 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61244 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61225 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61231 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61228 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61246 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt (server-other.rules) * 1:61247 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt (server-other.rules) * 3:61256 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules) * 3:61252 <-> ENABLED <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt (server-webapp.rules) * 3:61257 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61258 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61254 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt (server-webapp.rules) * 3:61255 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules)
* 3:61212 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt (policy-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091701.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:61227 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61248 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61246 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt (server-other.rules) * 1:61225 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61228 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61226 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61253 <-> DISABLED <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection (malware-cnc.rules) * 1:61247 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt (server-other.rules) * 1:61249 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61250 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61251 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61236 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61229 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61237 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61238 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61239 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61240 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61241 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61230 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61231 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61234 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61233 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61232 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61235 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61245 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61242 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61243 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61244 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 3:61258 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61257 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61254 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt (server-webapp.rules) * 3:61256 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules) * 3:61252 <-> ENABLED <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt (server-webapp.rules) * 3:61255 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules)
* 3:61212 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt (policy-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091700.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:61253 <-> DISABLED <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection (malware-cnc.rules) * 1:61244 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61247 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt (server-other.rules) * 1:61245 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61228 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61251 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61248 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61231 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61249 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61242 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61241 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61240 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61232 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61233 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61234 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61235 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61230 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61227 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61238 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61243 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61237 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61236 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61225 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61226 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61239 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61250 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61229 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61246 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt (server-other.rules) * 3:61256 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules) * 3:61257 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61254 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt (server-webapp.rules) * 3:61252 <-> ENABLED <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt (server-webapp.rules) * 3:61258 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61255 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules)
* 3:61212 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt (policy-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091601.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:61227 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61229 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61225 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61246 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt (server-other.rules) * 1:61247 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt (server-other.rules) * 1:61249 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61250 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61226 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61248 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61245 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61232 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61230 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61231 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61234 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61233 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61235 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61237 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61238 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61239 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61240 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61236 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61241 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61242 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61228 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61243 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61244 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61253 <-> DISABLED <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection (malware-cnc.rules) * 1:61251 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 3:61255 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules) * 3:61257 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61256 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules) * 3:61252 <-> ENABLED <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt (server-webapp.rules) * 3:61254 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt (server-webapp.rules) * 3:61258 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules)
* 3:61212 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt (policy-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091600.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:61249 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61229 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61247 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt (server-other.rules) * 1:61250 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61239 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61230 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61225 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61244 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61231 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61226 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61227 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61241 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61238 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61228 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61243 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61242 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61240 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61237 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61253 <-> DISABLED <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection (malware-cnc.rules) * 1:61236 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61233 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61235 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61234 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61251 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61248 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61232 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61245 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61246 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt (server-other.rules) * 3:61252 <-> ENABLED <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt (server-webapp.rules) * 3:61255 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules) * 3:61254 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt (server-webapp.rules) * 3:61258 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61257 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61256 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules)
* 3:61212 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt (policy-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091501.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:61246 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt (server-other.rules) * 1:61248 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61253 <-> DISABLED <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection (malware-cnc.rules) * 1:61236 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61232 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61233 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61251 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61242 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61245 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61225 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61230 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61227 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61231 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61249 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61228 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61247 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt (server-other.rules) * 1:61239 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61244 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61241 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61238 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61243 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61237 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61250 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61234 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61235 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61226 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61229 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61240 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 3:61258 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61252 <-> ENABLED <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt (server-webapp.rules) * 3:61257 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61256 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules) * 3:61254 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt (server-webapp.rules) * 3:61255 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules)
* 3:61212 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt (policy-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091401.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:61241 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61235 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61249 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61253 <-> DISABLED <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection (malware-cnc.rules) * 1:61239 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61227 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61232 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61248 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61242 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61243 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61225 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61244 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61246 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt (server-other.rules) * 1:61245 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61226 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61250 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61231 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61238 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61228 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61234 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61230 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61240 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61236 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61233 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61251 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61229 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61247 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt (server-other.rules) * 1:61237 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 3:61256 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules) * 3:61258 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61257 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61255 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules) * 3:61254 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt (server-webapp.rules) * 3:61252 <-> ENABLED <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt (server-webapp.rules)
* 3:61212 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt (policy-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091300.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:61249 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61231 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61251 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61244 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61226 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61245 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61248 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61225 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61229 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61234 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61235 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61236 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61237 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61238 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61230 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61246 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt (server-other.rules) * 1:61247 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt (server-other.rules) * 1:61233 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61232 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61228 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61250 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61239 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61240 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61241 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61242 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61243 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61227 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61253 <-> DISABLED <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection (malware-cnc.rules) * 3:61256 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules) * 3:61254 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt (server-webapp.rules) * 3:61257 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61258 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61252 <-> ENABLED <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt (server-webapp.rules) * 3:61255 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules)
* 3:61212 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt (policy-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091101.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:61226 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61253 <-> DISABLED <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection (malware-cnc.rules) * 1:61250 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61225 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61241 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61248 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61251 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61233 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61249 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61242 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61243 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61228 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61231 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61246 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt (server-other.rules) * 1:61245 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61227 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61230 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61232 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61239 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61247 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt (server-other.rules) * 1:61244 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61237 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61229 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61236 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61240 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61234 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61238 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61235 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 3:61255 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules) * 3:61254 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt (server-webapp.rules) * 3:61258 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61252 <-> ENABLED <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt (server-webapp.rules) * 3:61257 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt (server-other.rules) * 3:61256 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt (server-webapp.rules)
* 3:61212 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt (policy-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:61247 <-> ENABLED <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt (snort3-server-other.rules) * 1:61246 <-> ENABLED <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt (snort3-server-other.rules) * 1:61253 <-> ENABLED <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection (snort3-malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:61237 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61235 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61225 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61229 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61226 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61227 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61230 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt (indicator-compromise.rules) * 1:61236 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61234 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61239 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61244 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61232 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61228 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt (indicator-compromise.rules) * 1:61245 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61241 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61242 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61243 <-> DISABLED <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt (server-webapp.rules) * 1:61246 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt (server-other.rules) * 1:61233 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61247 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt (server-other.rules) * 1:61240 <-> DISABLED <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt (malware-tools.rules) * 1:61238 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt (indicator-compromise.rules) * 1:61248 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61231 <-> ENABLED <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt (indicator-compromise.rules) * 1:61249 <-> DISABLED <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt (server-other.rules) * 1:61250 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61251 <-> ENABLED <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection (malware-cnc.rules) * 1:61253 <-> DISABLED <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection (malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.1.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.4.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.0.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.1.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.1.0.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.3.0.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.4.0.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.5.0.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.7.0.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.9.0.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.11.0.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.15.0.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.18.0.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.20.0.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.21.0.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.35.0.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.44.0.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.47.0.
The format of the file is:
gid:sid <-> Message
* 1:300386 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300387 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Mimikatz download attempt * 1:300388 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Inveigh download attempt * 1:300389 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit PE injector download attempt * 1:300390 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300391 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300392 <-> INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit download attempt * 1:300393 <-> MALWARE-TOOLS Win.Tool.TruffleSnout download attempt * 1:300394 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:300395 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:300396 <-> SERVER-OTHER VMware vRealize Log Insight directory traversal attempt * 1:61243 <-> SERVER-WEBAPP Paid Memberships Pro WordPress Plugin SQL injection attempt * 1:61246 <-> SERVER-OTHER VMware vRealize Log Insight broken access control attempt * 1:61247 <-> SERVER-OTHER VMware vRealize Log Insight configuration information leak attempt * 1:61250 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 1:61251 <-> MALWARE-CNC Win.Dropper.Rhadamanthys variant outbound connection * 3:61252 <-> SERVER-WEBAPP Cisco IOx application environment command injection attempt * 1:61253 <-> MALWARE-CNC Win.Trojan.StrongPity variant outbound connection * 3:61254 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1712 attack attempt * 3:61255 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61256 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1704 attack attempt * 3:61257 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt * 3:61258 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2023-1710 attack attempt
* 3:61212 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2023-1698 attack attempt
©2024 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
