Talos Rules 2023-04-11
Talos is aware of vulnerabilities affecting products from Microsoft Corporation.

Microsoft Vulnerability CVE-2023-21554: A coding deficiency exists in Microsoft Message Queuing that may lead to remote code execution.

A rule to detect attacks targeting this vulnerability is included in this release and is identified with: Snort 2: GID 1, SID 61619, Snort 3: GID 1, SID 61619.

Microsoft Vulnerability CVE-2023-24912: A coding deficiency exists in Microsoft Windows Graphics Component that may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 61617 through 61618, Snort 3: GID 1, SID 300500.

Microsoft Vulnerability CVE-2023-28218: A coding deficiency exists in Microsoft Windows Ancillary Function Driver for WinSock that may lead to an escalation of privilege.

A rule to detect attacks targeting this vulnerability is included in this release and is identified with: Snort 2: GID 1, SIDs 61615 through 61616, Snort 3: GID 1, SID 300499.

Microsoft Vulnerability CVE-2023-28219: A coding deficiency exists in Layer 2 Tunneling Protocol that may lead to remote code execution.

A rule to detect attacks targeting this vulnerability is included in this release and is identified with: Snort 2: GID 1, SID 61614, Snort 3: GID 1, SID 61614.

Microsoft Vulnerability CVE-2023-28220: A coding deficiency exists in Layer 2 Tunneling Protocol that may lead to remote code execution.

A rule to detect attacks targeting this vulnerability is included in this release and is identified with: Snort 2: GID 1, SID 61613, Snort 3: GID 1, SID 61613.

Microsoft Vulnerability CVE-2023-28231: A coding deficiency exists in Microsoft DHCP Server Service that may lead to remote code execution.

A rule to detect attacks targeting this vulnerability is included in this release and is identified with: Snort 2: GID 1, SID 61620, Snort 3: GID 1, SID 61620.

Microsoft Vulnerability CVE-2023-28274: A coding deficiency exists in Microsoft Win32k that may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 61606 through 61607, Snort 3: GID 1, SID 300496.

Talos also has added and modified multiple rules in the browser-chrome, malware-cnc and server-webapp rule sets to provide coverage for emerging threats from these technologies.

For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.

Change logs

29200

2023-04-11 19:09:29 UTC

Snort Subscriber Rules Update

Date: 2023-04-11

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2092000.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:61606 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61607 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61608 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61609 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61610 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61611 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61612 <-> ENABLED <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected (malware-cnc.rules)
 * 1:61613 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt (os-windows.rules)
 * 1:61614 <-> DISABLED <-> OS-WINDOWS Microsoft Windows VPN Server rasl2tp.sys remote code execution attempt (os-windows.rules)
 * 1:61615 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61616 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61617 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61618 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61619 <-> DISABLED <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt (os-windows.rules)
 * 1:61620 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt (os-windows.rules)

Modified Rules:


 * 1:60598 <-> DISABLED <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt (server-webapp.rules)

29190

2023-04-11 19:09:29 UTC

Snort Subscriber Rules Update

Date: 2023-04-11

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091900.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:61620 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt (os-windows.rules)
 * 1:61615 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61616 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61606 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61607 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61608 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61609 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61610 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61611 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61612 <-> ENABLED <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected (malware-cnc.rules)
 * 1:61613 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt (os-windows.rules)
 * 1:61618 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61617 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61619 <-> DISABLED <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt (os-windows.rules)
 * 1:61614 <-> DISABLED <-> OS-WINDOWS Microsoft Windows VPN Server rasl2tp.sys remote code execution attempt (os-windows.rules)

Modified Rules:


 * 1:60598 <-> DISABLED <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt (server-webapp.rules)

29181

2023-04-11 19:09:29 UTC

Snort Subscriber Rules Update

Date: 2023-04-11

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091801.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:61609 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61607 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61619 <-> DISABLED <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt (os-windows.rules)
 * 1:61618 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61620 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt (os-windows.rules)
 * 1:61610 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61611 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61612 <-> ENABLED <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected (malware-cnc.rules)
 * 1:61613 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt (os-windows.rules)
 * 1:61606 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61614 <-> DISABLED <-> OS-WINDOWS Microsoft Windows VPN Server rasl2tp.sys remote code execution attempt (os-windows.rules)
 * 1:61615 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61616 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61608 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61617 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)

Modified Rules:


 * 1:60598 <-> DISABLED <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt (server-webapp.rules)

29171

2023-04-11 19:09:29 UTC

Snort Subscriber Rules Update

Date: 2023-04-11

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091701.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:61618 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61619 <-> DISABLED <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt (os-windows.rules)
 * 1:61609 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61606 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61620 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt (os-windows.rules)
 * 1:61612 <-> ENABLED <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected (malware-cnc.rules)
 * 1:61617 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61616 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61608 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61607 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61611 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61610 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61614 <-> DISABLED <-> OS-WINDOWS Microsoft Windows VPN Server rasl2tp.sys remote code execution attempt (os-windows.rules)
 * 1:61613 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt (os-windows.rules)
 * 1:61615 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)

Modified Rules:


 * 1:60598 <-> DISABLED <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt (server-webapp.rules)

29170

2023-04-11 19:09:29 UTC

Snort Subscriber Rules Update

Date: 2023-04-11

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091700.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:61619 <-> DISABLED <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt (os-windows.rules)
 * 1:61620 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt (os-windows.rules)
 * 1:61618 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61612 <-> ENABLED <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected (malware-cnc.rules)
 * 1:61607 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61615 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61614 <-> DISABLED <-> OS-WINDOWS Microsoft Windows VPN Server rasl2tp.sys remote code execution attempt (os-windows.rules)
 * 1:61610 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61617 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61616 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61609 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61608 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61613 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt (os-windows.rules)
 * 1:61611 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61606 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)

Modified Rules:


 * 1:60598 <-> DISABLED <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt (server-webapp.rules)

29161

2023-04-11 19:09:29 UTC

Snort Subscriber Rules Update

Date: 2023-04-11

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091601.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:61616 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61617 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61608 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61618 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61619 <-> DISABLED <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt (os-windows.rules)
 * 1:61610 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61611 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61614 <-> DISABLED <-> OS-WINDOWS Microsoft Windows VPN Server rasl2tp.sys remote code execution attempt (os-windows.rules)
 * 1:61609 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61615 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61613 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt (os-windows.rules)
 * 1:61612 <-> ENABLED <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected (malware-cnc.rules)
 * 1:61620 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt (os-windows.rules)
 * 1:61606 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61607 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)

Modified Rules:


 * 1:60598 <-> DISABLED <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt (server-webapp.rules)

29160

2023-04-11 19:09:30 UTC

Snort Subscriber Rules Update

Date: 2023-04-11

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091600.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:61606 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61610 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61615 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61609 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61613 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt (os-windows.rules)
 * 1:61608 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61620 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt (os-windows.rules)
 * 1:61619 <-> DISABLED <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt (os-windows.rules)
 * 1:61611 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61614 <-> DISABLED <-> OS-WINDOWS Microsoft Windows VPN Server rasl2tp.sys remote code execution attempt (os-windows.rules)
 * 1:61607 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61612 <-> ENABLED <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected (malware-cnc.rules)
 * 1:61616 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61617 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61618 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)

Modified Rules:


 * 1:60598 <-> DISABLED <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt (server-webapp.rules)

29151

2023-04-11 19:09:30 UTC

Snort Subscriber Rules Update

Date: 2023-04-11

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091501.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:61618 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61610 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61611 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61606 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61616 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61620 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt (os-windows.rules)
 * 1:61607 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61609 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61617 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61614 <-> DISABLED <-> OS-WINDOWS Microsoft Windows VPN Server rasl2tp.sys remote code execution attempt (os-windows.rules)
 * 1:61613 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt (os-windows.rules)
 * 1:61612 <-> ENABLED <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected (malware-cnc.rules)
 * 1:61615 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61608 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61619 <-> DISABLED <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt (os-windows.rules)

Modified Rules:


 * 1:60598 <-> DISABLED <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt (server-webapp.rules)

29141

2023-04-11 19:09:30 UTC

Snort Subscriber Rules Update

Date: 2023-04-11

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091401.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:61608 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61610 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61618 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61616 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61619 <-> DISABLED <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt (os-windows.rules)
 * 1:61617 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61611 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61607 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61614 <-> DISABLED <-> OS-WINDOWS Microsoft Windows VPN Server rasl2tp.sys remote code execution attempt (os-windows.rules)
 * 1:61613 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt (os-windows.rules)
 * 1:61612 <-> ENABLED <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected (malware-cnc.rules)
 * 1:61620 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt (os-windows.rules)
 * 1:61615 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61606 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61609 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)

Modified Rules:


 * 1:60598 <-> DISABLED <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt (server-webapp.rules)

29130

2023-04-11 19:09:30 UTC

Snort Subscriber Rules Update

Date: 2023-04-11

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091300.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:61614 <-> DISABLED <-> OS-WINDOWS Microsoft Windows VPN Server rasl2tp.sys remote code execution attempt (os-windows.rules)
 * 1:61617 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61615 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61616 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61606 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61609 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61607 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61612 <-> ENABLED <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected (malware-cnc.rules)
 * 1:61613 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt (os-windows.rules)
 * 1:61608 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61620 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt (os-windows.rules)
 * 1:61618 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61610 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61611 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61619 <-> DISABLED <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt (os-windows.rules)

Modified Rules:


 * 1:60598 <-> DISABLED <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt (server-webapp.rules)

29111

2023-04-11 19:09:30 UTC

Snort Subscriber Rules Update

Date: 2023-04-11

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091101.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:61614 <-> DISABLED <-> OS-WINDOWS Microsoft Windows VPN Server rasl2tp.sys remote code execution attempt (os-windows.rules)
 * 1:61619 <-> DISABLED <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt (os-windows.rules)
 * 1:61610 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61618 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61620 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt (os-windows.rules)
 * 1:61607 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61609 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61606 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61613 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt (os-windows.rules)
 * 1:61616 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61617 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61611 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61615 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61612 <-> ENABLED <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected (malware-cnc.rules)
 * 1:61608 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)

Modified Rules:


 * 1:60598 <-> DISABLED <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt (server-webapp.rules)

3000

2023-04-11 19:09:30 UTC

Snort Subscriber Rules Update

Date: 2023-04-11

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3000.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:61620 <-> ENABLED <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt (snort3-os-windows.rules)
 * 1:61614 <-> ENABLED <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt (snort3-os-windows.rules)
 * 1:61619 <-> ENABLED <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt (snort3-os-windows.rules)
 * 1:61613 <-> ENABLED <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt (snort3-os-windows.rules)

Modified Rules:

2983

2023-04-11 19:09:30 UTC

Snort Subscriber Rules Update

Date: 2023-04-11

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2983.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:61610 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61606 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61609 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61619 <-> DISABLED <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt (os-windows.rules)
 * 1:61611 <-> DISABLED <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt (os-windows.rules)
 * 1:61620 <-> DISABLED <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt (os-windows.rules)
 * 1:61607 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:61613 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt (os-windows.rules)
 * 1:61617 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)
 * 1:61616 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61612 <-> ENABLED <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected (malware-cnc.rules)
 * 1:61615 <-> DISABLED <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt (os-windows.rules)
 * 1:61608 <-> DISABLED <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt (browser-chrome.rules)
 * 1:61618 <-> DISABLED <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt (os-windows.rules)

Modified Rules:


 * 1:60598 <-> DISABLED <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt (server-webapp.rules)

3031

2023-04-11 19:11:48 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.3.1.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt

3034

2023-04-11 19:11:48 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.3.4.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt

3100

2023-04-11 19:11:48 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.0.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt

3101

2023-04-11 19:11:48 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.0.1.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt

3110

2023-04-11 19:11:48 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.1.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt

3130

2023-04-11 19:11:48 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.3.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt

3140

2023-04-11 19:11:48 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.4.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt

3150

2023-04-11 19:11:48 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.5.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt

3170

2023-04-11 19:11:48 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.7.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt

3190

2023-04-11 19:11:48 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.9.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt

31110

2023-04-11 19:11:48 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.11.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt

31150

2023-04-11 19:11:48 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.15.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt

31180

2023-04-11 19:11:48 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.18.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt

31200

2023-04-11 19:11:48 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.20.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt

31210

2023-04-11 19:11:48 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.21.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt

31350

2023-04-11 19:11:48 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.35.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt

31440

2023-04-11 19:11:49 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.44.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt

31470

2023-04-11 19:11:49 UTC

Snort Subscriber Rules Update

Date: 2023-04-11-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.47.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300496 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300497 <-> BROWSER-CHROME Google Chrome URLLoader NotifyCompleted use-after-free attempt
* 1:300498 <-> OS-WINDOWS Microsoft Windows CD-ROM file system driver remote code execution attempt
* 1:300499 <-> OS-WINDOWS Microsoft Windows AFD.sys privilege escalation attempt
* 1:300500 <-> OS-WINDOWS Microsoft Windows graphics component elevation of privilege attempt
* 1:61612 <-> MALWARE-CNC Win.Ransomware.Lockbit variant network share readme file detected
* 1:61613 <-> OS-WINDOWS Microsoft Windows Server L2TP remote code execution attempt
* 1:61614 <-> OS-WINDOWS Microsoft VPN Server rasl2tp.sys remote code execution attempt
* 1:61619 <-> OS-WINDOWS Microsoft Windows MSMQ remote code execution attempt
* 1:61620 <-> OS-WINDOWS Microsoft Windows DHCP service remove code execution attempt

Modified Rules:

* 1:60598 <-> SERVER-WEBAPP pfSense pfBlockerNG plugin command injection attempt