Talos has added and modified multiple rules in the file-image, malware-cnc, malware-other, policy-other, server-mail and server-webapp rule sets to provide coverage for emerging threats from these technologies.
For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2092000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64337 <-> DISABLED <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt (server-webapp.rules) * 1:64338 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64339 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64340 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64341 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64342 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64343 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64344 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64345 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64346 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64347 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64348 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64349 <-> ENABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64350 <-> DISABLED <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt (server-mail.rules) * 1:64351 <-> DISABLED <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt (policy-other.rules) * 1:64352 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt (server-webapp.rules) * 3:64353 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt (policy-other.rules)
* 1:63952 <-> DISABLED <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt (server-other.rules) * 1:38575 <-> DISABLED <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt (server-other.rules) * 1:60793 <-> ENABLED <-> SERVER-WEBAPP VMware Cloud Foundation NSX Manager XStream remote code execution attempt (server-webapp.rules) * 1:53256 <-> ENABLED <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt (server-webapp.rules) * 3:64328 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules) * 3:64329 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091900.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64352 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt (server-webapp.rules) * 1:64348 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64337 <-> DISABLED <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt (server-webapp.rules) * 1:64338 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64340 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64339 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64345 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64346 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64347 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64349 <-> ENABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64341 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64350 <-> DISABLED <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt (server-mail.rules) * 1:64351 <-> DISABLED <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt (policy-other.rules) * 1:64343 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64342 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64344 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 3:64353 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt (policy-other.rules)
* 1:38575 <-> DISABLED <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt (server-other.rules) * 1:60793 <-> ENABLED <-> SERVER-WEBAPP VMware Cloud Foundation NSX Manager XStream remote code execution attempt (server-webapp.rules) * 1:53256 <-> ENABLED <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt (server-webapp.rules) * 1:63952 <-> DISABLED <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt (server-other.rules) * 3:64329 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules) * 3:64328 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091801.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64340 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64352 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt (server-webapp.rules) * 1:64342 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64338 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64343 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64341 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64339 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64344 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64346 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64347 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64348 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64349 <-> ENABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64337 <-> DISABLED <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt (server-webapp.rules) * 1:64345 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64350 <-> DISABLED <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt (server-mail.rules) * 1:64351 <-> DISABLED <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt (policy-other.rules) * 3:64353 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt (policy-other.rules)
* 1:63952 <-> DISABLED <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt (server-other.rules) * 1:53256 <-> ENABLED <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt (server-webapp.rules) * 1:38575 <-> DISABLED <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt (server-other.rules) * 1:60793 <-> ENABLED <-> SERVER-WEBAPP VMware Cloud Foundation NSX Manager XStream remote code execution attempt (server-webapp.rules) * 3:64329 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules) * 3:64328 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091701.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64338 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64351 <-> DISABLED <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt (policy-other.rules) * 1:64339 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64348 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64349 <-> ENABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64340 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64337 <-> DISABLED <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt (server-webapp.rules) * 1:64352 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt (server-webapp.rules) * 1:64345 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64344 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64342 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64341 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64343 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64347 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64346 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64350 <-> DISABLED <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt (server-mail.rules) * 3:64353 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt (policy-other.rules)
* 1:53256 <-> ENABLED <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt (server-webapp.rules) * 1:38575 <-> DISABLED <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt (server-other.rules) * 1:60793 <-> ENABLED <-> SERVER-WEBAPP VMware Cloud Foundation NSX Manager XStream remote code execution attempt (server-webapp.rules) * 1:63952 <-> DISABLED <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt (server-other.rules) * 3:64328 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules) * 3:64329 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091700.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64342 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64343 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64349 <-> ENABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64338 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64339 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64352 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt (server-webapp.rules) * 1:64351 <-> DISABLED <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt (policy-other.rules) * 1:64350 <-> DISABLED <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt (server-mail.rules) * 1:64337 <-> DISABLED <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt (server-webapp.rules) * 1:64340 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64341 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64348 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64344 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64346 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64345 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64347 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 3:64353 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt (policy-other.rules)
* 1:63952 <-> DISABLED <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt (server-other.rules) * 1:38575 <-> DISABLED <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt (server-other.rules) * 1:53256 <-> ENABLED <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt (server-webapp.rules) * 1:60793 <-> ENABLED <-> SERVER-WEBAPP VMware Cloud Foundation NSX Manager XStream remote code execution attempt (server-webapp.rules) * 3:64328 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules) * 3:64329 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091601.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64340 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64338 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64342 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64339 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64343 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64346 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64347 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64348 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64341 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64344 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64337 <-> DISABLED <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt (server-webapp.rules) * 1:64345 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64349 <-> ENABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64351 <-> DISABLED <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt (policy-other.rules) * 1:64350 <-> DISABLED <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt (server-mail.rules) * 1:64352 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt (server-webapp.rules) * 3:64353 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt (policy-other.rules)
* 1:53256 <-> ENABLED <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt (server-webapp.rules) * 1:63952 <-> DISABLED <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt (server-other.rules) * 1:38575 <-> DISABLED <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt (server-other.rules) * 1:60793 <-> ENABLED <-> SERVER-WEBAPP VMware Cloud Foundation NSX Manager XStream remote code execution attempt (server-webapp.rules) * 3:64329 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules) * 3:64328 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091600.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64341 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64339 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64338 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64344 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64352 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt (server-webapp.rules) * 1:64340 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64351 <-> DISABLED <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt (policy-other.rules) * 1:64342 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64348 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64345 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64346 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64343 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64349 <-> ENABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64337 <-> DISABLED <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt (server-webapp.rules) * 1:64347 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64350 <-> DISABLED <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt (server-mail.rules) * 3:64353 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt (policy-other.rules)
* 1:60793 <-> ENABLED <-> SERVER-WEBAPP VMware Cloud Foundation NSX Manager XStream remote code execution attempt (server-webapp.rules) * 1:53256 <-> ENABLED <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt (server-webapp.rules) * 1:63952 <-> DISABLED <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt (server-other.rules) * 1:38575 <-> DISABLED <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt (server-other.rules) * 3:64328 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules) * 3:64329 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091501.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64342 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64340 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64349 <-> ENABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64339 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64351 <-> DISABLED <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt (policy-other.rules) * 1:64348 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64345 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64338 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64347 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64337 <-> DISABLED <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt (server-webapp.rules) * 1:64346 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64341 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64344 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64350 <-> DISABLED <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt (server-mail.rules) * 1:64352 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt (server-webapp.rules) * 1:64343 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 3:64353 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt (policy-other.rules)
* 1:38575 <-> DISABLED <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt (server-other.rules) * 1:60793 <-> ENABLED <-> SERVER-WEBAPP VMware Cloud Foundation NSX Manager XStream remote code execution attempt (server-webapp.rules) * 1:63952 <-> DISABLED <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt (server-other.rules) * 1:53256 <-> ENABLED <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt (server-webapp.rules) * 3:64329 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules) * 3:64328 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091401.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64340 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64345 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64349 <-> ENABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64342 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64338 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64344 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64339 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64352 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt (server-webapp.rules) * 1:64337 <-> DISABLED <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt (server-webapp.rules) * 1:64343 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64346 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64347 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64348 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64350 <-> DISABLED <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt (server-mail.rules) * 1:64351 <-> DISABLED <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt (policy-other.rules) * 1:64341 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 3:64353 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt (policy-other.rules)
* 1:63952 <-> DISABLED <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt (server-other.rules) * 1:53256 <-> ENABLED <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt (server-webapp.rules) * 1:60793 <-> ENABLED <-> SERVER-WEBAPP VMware Cloud Foundation NSX Manager XStream remote code execution attempt (server-webapp.rules) * 1:38575 <-> DISABLED <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt (server-other.rules) * 3:64328 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules) * 3:64329 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091300.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64340 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64345 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64352 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt (server-webapp.rules) * 1:64346 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64338 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64348 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64347 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64349 <-> ENABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64343 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64337 <-> DISABLED <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt (server-webapp.rules) * 1:64341 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64350 <-> DISABLED <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt (server-mail.rules) * 1:64344 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64351 <-> DISABLED <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt (policy-other.rules) * 1:64339 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64342 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 3:64353 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt (policy-other.rules)
* 1:53256 <-> ENABLED <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt (server-webapp.rules) * 1:38575 <-> DISABLED <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt (server-other.rules) * 1:63952 <-> DISABLED <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt (server-other.rules) * 1:60793 <-> ENABLED <-> SERVER-WEBAPP VMware Cloud Foundation NSX Manager XStream remote code execution attempt (server-webapp.rules) * 3:64328 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules) * 3:64329 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091101.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64337 <-> DISABLED <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt (server-webapp.rules) * 1:64349 <-> ENABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64339 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64350 <-> DISABLED <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt (server-mail.rules) * 1:64338 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt (malware-other.rules) * 1:64342 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64341 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64346 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64340 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64343 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64344 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64345 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64347 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt (malware-cnc.rules) * 1:64348 <-> DISABLED <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt (malware-cnc.rules) * 1:64351 <-> DISABLED <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt (policy-other.rules) * 1:64352 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt (server-webapp.rules) * 3:64353 <-> ENABLED <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt (policy-other.rules)
* 1:60793 <-> ENABLED <-> SERVER-WEBAPP VMware Cloud Foundation NSX Manager XStream remote code execution attempt (server-webapp.rules) * 1:38575 <-> DISABLED <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt (server-other.rules) * 1:63952 <-> DISABLED <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt (server-other.rules) * 1:53256 <-> ENABLED <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt (server-webapp.rules) * 3:64328 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules) * 3:64329 <-> ENABLED <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt (file-image.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.3.1.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.3.4.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.0.1.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.1.0.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.3.0.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.4.0.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.5.0.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.7.0.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.9.0.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.2.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.11.0.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.15.0.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.18.0.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.20.0.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.21.0.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.35.0.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.44.0.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.47.0.
The format of the file is:
gid:sid <-> Message
* 1:301093 <-> MALWARE-OTHER Win.Trojan.WezRat variant download attempt * 1:64337 <-> SERVER-WEBAPP MinIO REST API potential information disclosure attempt * 1:64340 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64341 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64342 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64343 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64344 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64345 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64346 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64347 <-> MALWARE-CNC Win.Trojan.WezRat variant inbound connection attempt * 1:64348 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64349 <-> MALWARE-CNC Win.Trojan.WezRat variant outbound connection attempt * 1:64350 <-> SERVER-MAIL Roundcube Webmail SVG animate cross-site scripting attempt * 1:64351 <-> POLICY-OTHER PostgreSQL PL/Perl arbitrary code execution attempt * 1:64352 <-> SERVER-WEBAPP Schneider Electric C-Bus FileCommand directory traversal attempt * 3:64353 <-> POLICY-OTHER TRUFFLEHUNTER TALOS-2024-2115 attack attempt
* 1:38575 <-> SERVER-OTHER OpenSSL TLS change cipher spec protocol denial of service attempt * 1:53256 <-> SERVER-WEBAPP Microsoft SQL Server Reporting Services remote code execution attempt * 1:63952 <-> SERVER-OTHER Roundcube Webmail cross-site scripting attempt * 3:64328 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt * 3:64329 <-> FILE-IMAGE TRUFFLEHUNTER TALOS-2024-2109 attack attempt
©2024 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
