Talos has added and modified multiple rules in the file-office, malware-cnc, malware-other, policy-other and server-webapp rule sets to provide coverage for emerging threats from these technologies.
For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2092000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64487 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt (malware-other.rules) * 1:64488 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt (server-webapp.rules) * 1:64489 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64490 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64491 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64492 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64493 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64494 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64495 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64496 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64497 <-> DISABLED <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt (policy-other.rules) * 1:64498 <-> DISABLED <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt (malware-cnc.rules) * 1:64499 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64500 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64501 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64502 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64503 <-> ENABLED <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt (server-webapp.rules) * 1:64504 <-> DISABLED <-> SERVER-WEBAPP GitLab glm_source denial of service attempt (server-webapp.rules) * 1:64505 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt (malware-other.rules)
* 1:34799 <-> ENABLED <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt (server-webapp.rules) * 1:40784 <-> ENABLED <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091900.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64504 <-> DISABLED <-> SERVER-WEBAPP GitLab glm_source denial of service attempt (server-webapp.rules) * 1:64498 <-> DISABLED <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt (malware-cnc.rules) * 1:64500 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64505 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt (malware-other.rules) * 1:64488 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt (server-webapp.rules) * 1:64489 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64490 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64491 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64492 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64493 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64494 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64495 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64496 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64497 <-> DISABLED <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt (policy-other.rules) * 1:64502 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64501 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64503 <-> ENABLED <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt (server-webapp.rules) * 1:64499 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64487 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt (malware-other.rules)
* 1:40784 <-> ENABLED <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt (server-webapp.rules) * 1:34799 <-> ENABLED <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091801.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64499 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64500 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64501 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64503 <-> ENABLED <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt (server-webapp.rules) * 1:64489 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64505 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt (malware-other.rules) * 1:64504 <-> DISABLED <-> SERVER-WEBAPP GitLab glm_source denial of service attempt (server-webapp.rules) * 1:64487 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt (malware-other.rules) * 1:64488 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt (server-webapp.rules) * 1:64502 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64491 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64492 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64493 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64494 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64495 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64498 <-> DISABLED <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt (malware-cnc.rules) * 1:64497 <-> DISABLED <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt (policy-other.rules) * 1:64490 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64496 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules)
* 1:34799 <-> ENABLED <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt (server-webapp.rules) * 1:40784 <-> ENABLED <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091701.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64487 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt (malware-other.rules) * 1:64501 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64500 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64505 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt (malware-other.rules) * 1:64502 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64488 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt (server-webapp.rules) * 1:64503 <-> ENABLED <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt (server-webapp.rules) * 1:64489 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64490 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64491 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64492 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64493 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64494 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64495 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64504 <-> DISABLED <-> SERVER-WEBAPP GitLab glm_source denial of service attempt (server-webapp.rules) * 1:64496 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64497 <-> DISABLED <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt (policy-other.rules) * 1:64498 <-> DISABLED <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt (malware-cnc.rules) * 1:64499 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules)
* 1:40784 <-> ENABLED <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt (server-webapp.rules) * 1:34799 <-> ENABLED <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091700.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64505 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt (malware-other.rules) * 1:64490 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64503 <-> ENABLED <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt (server-webapp.rules) * 1:64492 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64489 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64493 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64494 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64495 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64496 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64497 <-> DISABLED <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt (policy-other.rules) * 1:64498 <-> DISABLED <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt (malware-cnc.rules) * 1:64499 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64500 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64504 <-> DISABLED <-> SERVER-WEBAPP GitLab glm_source denial of service attempt (server-webapp.rules) * 1:64488 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt (server-webapp.rules) * 1:64501 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64491 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64487 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt (malware-other.rules) * 1:64502 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules)
* 1:40784 <-> ENABLED <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt (server-webapp.rules) * 1:34799 <-> ENABLED <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091601.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64504 <-> DISABLED <-> SERVER-WEBAPP GitLab glm_source denial of service attempt (server-webapp.rules) * 1:64498 <-> DISABLED <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt (malware-cnc.rules) * 1:64505 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt (malware-other.rules) * 1:64489 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64488 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt (server-webapp.rules) * 1:64502 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64501 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64490 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64499 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64497 <-> DISABLED <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt (policy-other.rules) * 1:64492 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64487 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt (malware-other.rules) * 1:64491 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64500 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64503 <-> ENABLED <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt (server-webapp.rules) * 1:64494 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64493 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64495 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64496 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules)
* 1:34799 <-> ENABLED <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt (server-webapp.rules) * 1:40784 <-> ENABLED <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091600.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64504 <-> DISABLED <-> SERVER-WEBAPP GitLab glm_source denial of service attempt (server-webapp.rules) * 1:64495 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64500 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64498 <-> DISABLED <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt (malware-cnc.rules) * 1:64503 <-> ENABLED <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt (server-webapp.rules) * 1:64502 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64487 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt (malware-other.rules) * 1:64493 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64490 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64497 <-> DISABLED <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt (policy-other.rules) * 1:64505 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt (malware-other.rules) * 1:64494 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64491 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64489 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64492 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64501 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64499 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64496 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64488 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt (server-webapp.rules)
* 1:34799 <-> ENABLED <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt (server-webapp.rules) * 1:40784 <-> ENABLED <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091501.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64494 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64504 <-> DISABLED <-> SERVER-WEBAPP GitLab glm_source denial of service attempt (server-webapp.rules) * 1:64490 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64498 <-> DISABLED <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt (malware-cnc.rules) * 1:64493 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64495 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64505 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt (malware-other.rules) * 1:64487 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt (malware-other.rules) * 1:64492 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64491 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64497 <-> DISABLED <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt (policy-other.rules) * 1:64496 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64500 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64501 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64502 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64499 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64503 <-> ENABLED <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt (server-webapp.rules) * 1:64489 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64488 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt (server-webapp.rules)
* 1:34799 <-> ENABLED <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt (server-webapp.rules) * 1:40784 <-> ENABLED <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091401.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64504 <-> DISABLED <-> SERVER-WEBAPP GitLab glm_source denial of service attempt (server-webapp.rules) * 1:64494 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64500 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64498 <-> DISABLED <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt (malware-cnc.rules) * 1:64499 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64488 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt (server-webapp.rules) * 1:64503 <-> ENABLED <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt (server-webapp.rules) * 1:64495 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64505 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt (malware-other.rules) * 1:64487 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt (malware-other.rules) * 1:64502 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64489 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64491 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64492 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64501 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64490 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64496 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64497 <-> DISABLED <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt (policy-other.rules) * 1:64493 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules)
* 1:40784 <-> ENABLED <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt (server-webapp.rules) * 1:34799 <-> ENABLED <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091300.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64501 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64503 <-> ENABLED <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt (server-webapp.rules) * 1:64490 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64498 <-> DISABLED <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt (malware-cnc.rules) * 1:64487 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt (malware-other.rules) * 1:64502 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64500 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64493 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64495 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64489 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64505 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt (malware-other.rules) * 1:64494 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64497 <-> DISABLED <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt (policy-other.rules) * 1:64488 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt (server-webapp.rules) * 1:64491 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64492 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64499 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64496 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64504 <-> DISABLED <-> SERVER-WEBAPP GitLab glm_source denial of service attempt (server-webapp.rules)
* 1:40784 <-> ENABLED <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt (server-webapp.rules) * 1:34799 <-> ENABLED <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091101.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:64490 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64487 <-> DISABLED <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt (malware-other.rules) * 1:64491 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules) * 1:64505 <-> ENABLED <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt (malware-other.rules) * 1:64504 <-> DISABLED <-> SERVER-WEBAPP GitLab glm_source denial of service attempt (server-webapp.rules) * 1:64503 <-> ENABLED <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt (server-webapp.rules) * 1:64489 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt (malware-other.rules) * 1:64488 <-> DISABLED <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt (server-webapp.rules) * 1:64502 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64493 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64494 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt (protocol-voip.rules) * 1:64495 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64496 <-> DISABLED <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt (file-office.rules) * 1:64497 <-> DISABLED <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt (policy-other.rules) * 1:64498 <-> DISABLED <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt (malware-cnc.rules) * 1:64499 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64500 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64501 <-> DISABLED <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt (malware-other.rules) * 1:64492 <-> DISABLED <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt (protocol-voip.rules)
* 1:34799 <-> ENABLED <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt (server-webapp.rules) * 1:40784 <-> ENABLED <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.3.1.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.3.4.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.0.1.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.1.0.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.3.0.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.4.0.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.5.0.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.7.0.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.9.0.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.2.0.0.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.11.0.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.15.0.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.18.0.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.20.0.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.21.0.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.35.0.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.44.0.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.47.0.
The format of the file is:
gid:sid <-> Message
* 1:301125 <-> MALWARE-OTHER Win.Ransomware.GoldenMXWolf download attempt * 1:301126 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message out-of-bounds read attempt * 1:301127 <-> PROTOCOL-VOIP Kamailio SIP Server REGISTER message buffer overflow attempt * 1:301128 <-> FILE-OFFICE Microsoft Windows Shell and WordPad ActiveX validation bypass attempt * 1:301129 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:301130 <-> MALWARE-OTHER Win.Ransomware.FunkSec variant download attempt * 1:64487 <-> MALWARE-OTHER Win.Trojan.Agent Fake AnyDesk variant payload download attempt * 1:64488 <-> SERVER-WEBAPP Fortinet FortiOS authentication bypass attempt * 1:64497 <-> POLICY-OTHER EyesOfNetwork EONAPI admin user creation attempt * 1:64498 <-> MALWARE-CNC Win.Ransomware.FunkSec variant outbound connection attempt * 1:64503 <-> SERVER-WEBAPP Ivanti IFTTLS clientCapabilities stack based buffer overflow attempt * 1:64504 <-> SERVER-WEBAPP GitLab glm_source denial of service attempt * 1:64505 <-> MALWARE-OTHER Unix.Trojan.Mozi variant outbound connection attempt
* 1:34799 <-> SERVER-WEBAPP UPnP AddPortMapping SOAP action command injection attempt * 1:40784 <-> SERVER-WEBAPP ZyXEL TR-064 SetNTPServers command injection attempt * 1:58843 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58844 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt * 1:58845 <-> SERVER-WEBAPP FUEL CMS col SQL injection attempt
©2025 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
