Deep Security Center
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1001839* - Restrict Attempt To Enumerate Windows User Accounts (ATT&CK T1087)
DNS Client
1011122* - Zoom Client Marketplace Information Disclosure Vulnerability (ZDI-CAN-13616)
Web Client Common
1011217 - Adobe Acrobat And Reader Use After Free Vulnerability (CVE-2021-40725)
1011219 - Adobe Acrobat And Reader Use After Free Vulnerability (CVE-2021-40726)
Web Proxy Squid
1011213 - Squid Proxy Denial Of Service Vulnerability (CVE-2021-33620)
1011215 - Squid Proxy Denial of Service Vulnerability (CVE-2021-28662)
Web Server HTTPS
1011216* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-42321)
1011214 - VMware vCenter Server Information Disclosure Vulnerability (CVE-2021-21985)
1011220 - WordPress 'Download Manager' Plugin Stored Cross-Site Scripting Vulnerability (CVE-2021-24773)
1011209 - WordPress 'LearnPress' Plugin Stored Cross-Site Scripting Vulnerability (CVE-2021-39348)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
DCERPC Services
1001839* - Restrict Attempt To Enumerate Windows User Accounts (ATT&CK T1087)
DNS Client
1011122* - Zoom Client Marketplace Information Disclosure Vulnerability (ZDI-CAN-13616)
Web Client Common
1011217 - Adobe Acrobat And Reader Use After Free Vulnerability (CVE-2021-40725)
1011219 - Adobe Acrobat And Reader Use After Free Vulnerability (CVE-2021-40726)
Web Proxy Squid
1011213 - Squid Proxy Denial Of Service Vulnerability (CVE-2021-33620)
1011215 - Squid Proxy Denial of Service Vulnerability (CVE-2021-28662)
Web Server HTTPS
1011216* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-42321)
1011214 - VMware vCenter Server Information Disclosure Vulnerability (CVE-2021-21985)
1011220 - WordPress 'Download Manager' Plugin Stored Cross-Site Scripting Vulnerability (CVE-2021-24773)
1011209 - WordPress 'LearnPress' Plugin Stored Cross-Site Scripting Vulnerability (CVE-2021-39348)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1007596* - Identified Possible Ransomware File Extension Rename Activity Over Network Share
SolarWinds Network Performance Monitor
1011205* - SolarWinds Orion Patch Manager Insecure Deserialization Vulnerability (CVE-2021-35218)
1011203* - SolarWinds Orion Platform Insecure Deserialization Vulnerability (CVE-2021-35215)
Web Application Common
1009222* - Identified Directory Traversal Sequence In Zip Archive
1011170* - WordPress 'Contact Form' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24276)
Web Client Common
1010619* - Adobe Acrobat Reader DC Out-Of-Bounds Read Information Disclosure Vulnerability (CVE-2020-24426)
1011211 - Microsoft Visual Studio Code 'Maven for Java' Extension Remote Code Execution Vulnerability (CVE-2021-28472)
Web Server Common
1006540* - Enable X-Forwarded-For HTTP Header Logging
1008581* - Identified Suspicious IP Addresses In XFF HTTP Header
Web Server HTTPS
1011207* - Centreon 'generateImage.php' SQL Injection Vulnerability (CVE-2021-37557)
1011212* - F5 BIG-IP and BIG-IQ iControl REST Authentication Bypass Vulnerability (CVE-2021-22986)
1011204* - GitLab Remote Code Execution Vulnerability (CVE-2021-22205)
1011216 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-42321)
Zoho ManageEngine ADSelfService Plus
1011194* - Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability (CVE-2021-40539)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1008670* - Microsoft Windows Security Events - 3
Deep Packet Inspection Rules:
DCERPC Services
1007596* - Identified Possible Ransomware File Extension Rename Activity Over Network Share
SolarWinds Network Performance Monitor
1011205* - SolarWinds Orion Patch Manager Insecure Deserialization Vulnerability (CVE-2021-35218)
1011203* - SolarWinds Orion Platform Insecure Deserialization Vulnerability (CVE-2021-35215)
Web Application Common
1009222* - Identified Directory Traversal Sequence In Zip Archive
1011170* - WordPress 'Contact Form' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24276)
Web Client Common
1010619* - Adobe Acrobat Reader DC Out-Of-Bounds Read Information Disclosure Vulnerability (CVE-2020-24426)
1011211 - Microsoft Visual Studio Code 'Maven for Java' Extension Remote Code Execution Vulnerability (CVE-2021-28472)
Web Server Common
1006540* - Enable X-Forwarded-For HTTP Header Logging
1008581* - Identified Suspicious IP Addresses In XFF HTTP Header
Web Server HTTPS
1011207* - Centreon 'generateImage.php' SQL Injection Vulnerability (CVE-2021-37557)
1011212* - F5 BIG-IP and BIG-IQ iControl REST Authentication Bypass Vulnerability (CVE-2021-22986)
1011204* - GitLab Remote Code Execution Vulnerability (CVE-2021-22205)
1011216 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-42321)
Zoho ManageEngine ADSelfService Plus
1011194* - Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability (CVE-2021-40539)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1008670* - Microsoft Windows Security Events - 3
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
There are no new or updated Deep Packet Inspection Rules in this Security Update.
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1008670* - Microsoft Windows Security Events - 3
Deep Packet Inspection Rules:
There are no new or updated Deep Packet Inspection Rules in this Security Update.
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1008670* - Microsoft Windows Security Events - 3
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1011037 - Identified Remote System Discovery Over SMB - 1 (ATT&CK T1018)
1011027 - Identified Session Enumeration Request Over SMB (ATT&CK T1049)
Microsoft Office
1011208 - Microsoft Access Remote Code Execution Vulnerability (CVE-2021-41368)
1011095* - Microsoft Excel Remote Code Execution Vulnerability (CVE-2021-34501)
SSL Client
1011178 - MD5 Algorithm Vulnerability (CVE-2004-2761)
SolarWinds Network Performance Monitor
1011205 - SolarWinds Orion Patch Manager Insecure Deserialization Vulnerability (CVE-2021-35218)
1011203 - SolarWinds Orion Platform Insecure Deserialization Vulnerability (CVE-2021-35215)
Suspicious Client Ransomware Activity
1010607* - Identified TCP Meterpreter Payload
Web Application Common
1011206 - BillQuick Web Suite SQL Injection Vulnerability (CVE-2021-42258)
1009621* - Identified Directory Traversal Sequence In HTTP Header
Web Application PHP Based
1011013* - WordPress 'Stop Spammers' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24245)
Web Server Common
1010919 - SQL Injection (SQLi) Decoder
Web Server HTTPS
1011207 - Centreon 'generateImage.php' SQL Injection Vulnerability (CVE-2021-37557)
1011212 - F5 BIG-IP and BIG-IQ iControl REST Authentication Bypass Vulnerability (CVE-2021-22986)
1011204 - GitLab Remote Code Execution Vulnerability (CVE-2021-22205)
1011169* - WordPress 'Supsystic Popup' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24275)
1011165* - WordPress 'Woo-Order-Export-Lite' Plugin Reflected Cross-Site Scripting Vulnerability (CVE-2021-24169)
Web Server Nagios
1011199* - Nagios XI Command Injection Vulnerability (CVE-2021-40345)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1008619* - Application - Docker
1008852* - Auditd
1004488* - Database Server - Microsoft SQL
1003802* - Directory Server - Microsoft Windows Active Directory
1003443* - Mail Server - Postfix
1010595* - Microsoft LDAP Query Execution
1003843* - Microsoft Windows Security Events
1004057* - Microsoft Windows Security Events - 1
1003987* - Microsoft Windows Security Events - 2
1008670* - Microsoft Windows Security Events - 3
1011197 - Microsoft Windows Security Events - 5
1002831* - Unix - Syslog
Deep Packet Inspection Rules:
DCERPC Services
1011037 - Identified Remote System Discovery Over SMB - 1 (ATT&CK T1018)
1011027 - Identified Session Enumeration Request Over SMB (ATT&CK T1049)
Microsoft Office
1011208 - Microsoft Access Remote Code Execution Vulnerability (CVE-2021-41368)
1011095* - Microsoft Excel Remote Code Execution Vulnerability (CVE-2021-34501)
SSL Client
1011178 - MD5 Algorithm Vulnerability (CVE-2004-2761)
SolarWinds Network Performance Monitor
1011205 - SolarWinds Orion Patch Manager Insecure Deserialization Vulnerability (CVE-2021-35218)
1011203 - SolarWinds Orion Platform Insecure Deserialization Vulnerability (CVE-2021-35215)
Suspicious Client Ransomware Activity
1010607* - Identified TCP Meterpreter Payload
Web Application Common
1011206 - BillQuick Web Suite SQL Injection Vulnerability (CVE-2021-42258)
1009621* - Identified Directory Traversal Sequence In HTTP Header
Web Application PHP Based
1011013* - WordPress 'Stop Spammers' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24245)
Web Server Common
1010919 - SQL Injection (SQLi) Decoder
Web Server HTTPS
1011207 - Centreon 'generateImage.php' SQL Injection Vulnerability (CVE-2021-37557)
1011212 - F5 BIG-IP and BIG-IQ iControl REST Authentication Bypass Vulnerability (CVE-2021-22986)
1011204 - GitLab Remote Code Execution Vulnerability (CVE-2021-22205)
1011169* - WordPress 'Supsystic Popup' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24275)
1011165* - WordPress 'Woo-Order-Export-Lite' Plugin Reflected Cross-Site Scripting Vulnerability (CVE-2021-24169)
Web Server Nagios
1011199* - Nagios XI Command Injection Vulnerability (CVE-2021-40345)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1008619* - Application - Docker
1008852* - Auditd
1004488* - Database Server - Microsoft SQL
1003802* - Directory Server - Microsoft Windows Active Directory
1003443* - Mail Server - Postfix
1010595* - Microsoft LDAP Query Execution
1003843* - Microsoft Windows Security Events
1004057* - Microsoft Windows Security Events - 1
1003987* - Microsoft Windows Security Events - 2
1008670* - Microsoft Windows Security Events - 3
1011197 - Microsoft Windows Security Events - 5
1002831* - Unix - Syslog
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DNS Client
1011122 - Zoom Client Marketplace Information Disclosure Vulnerability (ZDI-CAN-13616)
Microsoft Office
1011121* - Microsoft Office Remote Code Execution Vulnerability (CVE-2021-34478)
Web Application Common
1008192* - Identified Directory Traversal Sequence In Multipart HTTP Requests
1009227* - Identified Directory Traversal Sequence In Tar Archive
1009040* - Identified Directory Traversal Sequence In URI
1005933* - Identified Directory Traversal Sequence In Uri Query Parameter
Web Application PHP Based
1011200 - WordPress 'The BulletProof Security' Plugin Information Disclosure Vulnerability (CVE-2021-39327)
1011193* - WordPress 'iThemes Security' Plugin SQL Injection Vulnerability (CVE-2018-12636)
Web Client Common
1011201 - Chromium Use After Free Vulnerability (CVE-2021-30573)
Web Server Apache
1011183* - Apache HTTP Server Server-Side Request Forgery Vulnerability (CVE-2021-40438)
Web Server Common
1010759 - Command Injection Decoder
1008397* - Identified Directory Traversal Attack In HTTP Request Headers
Web Server HTTPS
1011196* - ACME mini_httpd Server Arbitrary File Read Vulnerability (CVE-2018-18778)
1011190* - Centreon 'ProceduresProxy.class.php' SQL Injection Vulnerability (CVE-2021-37558)
1011168* - WordPress 'Supsystic Ultimate Maps' Plugin Reflected Cross-Site Scripting Vulnerability (CVE-2021-24274)
Web Server Miscellaneous
1011177* - Atlassian Confluence Server Arbitrary File Read Vulnerability (CVE-2021-26085)
1011179* - Atlassian Jira Path Traversal Vulnerability (CVE-2021-26086)
Web Server Nagios
1011199 - Nagios XI Command Injection Vulnerability (CVE-2021-40345)
Zoho ManageEngine ADSelfService Plus
1011194* - Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability (CVE-2021-40539)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1010489* - Auditd - Mitre ATT&CK TA0003: Persistence
1010465* - Auditd - Mitre ATT&CK TA0007: Discovery
1002795* - Microsoft Windows Events
1002831* - Unix - Syslog
Deep Packet Inspection Rules:
DNS Client
1011122 - Zoom Client Marketplace Information Disclosure Vulnerability (ZDI-CAN-13616)
Microsoft Office
1011121* - Microsoft Office Remote Code Execution Vulnerability (CVE-2021-34478)
Web Application Common
1008192* - Identified Directory Traversal Sequence In Multipart HTTP Requests
1009227* - Identified Directory Traversal Sequence In Tar Archive
1009040* - Identified Directory Traversal Sequence In URI
1005933* - Identified Directory Traversal Sequence In Uri Query Parameter
Web Application PHP Based
1011200 - WordPress 'The BulletProof Security' Plugin Information Disclosure Vulnerability (CVE-2021-39327)
1011193* - WordPress 'iThemes Security' Plugin SQL Injection Vulnerability (CVE-2018-12636)
Web Client Common
1011201 - Chromium Use After Free Vulnerability (CVE-2021-30573)
Web Server Apache
1011183* - Apache HTTP Server Server-Side Request Forgery Vulnerability (CVE-2021-40438)
Web Server Common
1010759 - Command Injection Decoder
1008397* - Identified Directory Traversal Attack In HTTP Request Headers
Web Server HTTPS
1011196* - ACME mini_httpd Server Arbitrary File Read Vulnerability (CVE-2018-18778)
1011190* - Centreon 'ProceduresProxy.class.php' SQL Injection Vulnerability (CVE-2021-37558)
1011168* - WordPress 'Supsystic Ultimate Maps' Plugin Reflected Cross-Site Scripting Vulnerability (CVE-2021-24274)
Web Server Miscellaneous
1011177* - Atlassian Confluence Server Arbitrary File Read Vulnerability (CVE-2021-26085)
1011179* - Atlassian Jira Path Traversal Vulnerability (CVE-2021-26086)
Web Server Nagios
1011199 - Nagios XI Command Injection Vulnerability (CVE-2021-40345)
Zoho ManageEngine ADSelfService Plus
1011194* - Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability (CVE-2021-40539)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1010489* - Auditd - Mitre ATT&CK TA0003: Persistence
1010465* - Auditd - Mitre ATT&CK TA0007: Discovery
1002795* - Microsoft Windows Events
1002831* - Unix - Syslog
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
Azure Open Management Infrastructure Tool
1011147* - Open Management Infrastructure Remote Code Execution Vulnerability (CVE-2021-38647)
Memcached
1011098* - Oracle MySQL Integer Underflow Vulnerability (CVE-2021-2390)
Suspicious Server Application Activity
1009549* - Detected Terminal Services (RDP) Server Traffic - 1 (ATT&CK T1021.001)
Web Application PHP Based
1011193 - WordPress 'iThemes Security' Plugin SQL Injection Vulnerability (CVE-2018-12636)
Web Client Common
1010806* - Identified Directory Traversal Attack In HTTP Response Headers
1011054* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
Web Server Apache
1011183* - Apache HTTP Server Server-Side Request Forgery Vulnerability (CVE-2021-40438)
Web Server HTTPS
1011196 - ACME mini_httpd Server Arbitrary File Read Vulnerability (CVE-2018-18778)
1011190 - Centreon 'ProceduresProxy.class.php' SQL Injection Vulnerability (CVE-2021-37558)
Web Server Nagios
1011191* - Nagios XI Arbitrary File Upload Vulnerability (CVE-2021-40344)
Zoho ManageEngine
1011188* - Zoho ManageEngine OpManager 'getReportData' SQL Injection Vulnerability (CVE-2021-41288)
Zoho ManageEngine ADSelfService Plus
1011194 - Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability (CVE-2021-40539)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
Deep Packet Inspection Rules:
Azure Open Management Infrastructure Tool
1011147* - Open Management Infrastructure Remote Code Execution Vulnerability (CVE-2021-38647)
Memcached
1011098* - Oracle MySQL Integer Underflow Vulnerability (CVE-2021-2390)
Suspicious Server Application Activity
1009549* - Detected Terminal Services (RDP) Server Traffic - 1 (ATT&CK T1021.001)
Web Application PHP Based
1011193 - WordPress 'iThemes Security' Plugin SQL Injection Vulnerability (CVE-2018-12636)
Web Client Common
1010806* - Identified Directory Traversal Attack In HTTP Response Headers
1011054* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
Web Server Apache
1011183* - Apache HTTP Server Server-Side Request Forgery Vulnerability (CVE-2021-40438)
Web Server HTTPS
1011196 - ACME mini_httpd Server Arbitrary File Read Vulnerability (CVE-2018-18778)
1011190 - Centreon 'ProceduresProxy.class.php' SQL Injection Vulnerability (CVE-2021-37558)
Web Server Nagios
1011191* - Nagios XI Arbitrary File Upload Vulnerability (CVE-2021-40344)
Zoho ManageEngine
1011188* - Zoho ManageEngine OpManager 'getReportData' SQL Injection Vulnerability (CVE-2021-41288)
Zoho ManageEngine ADSelfService Plus
1011194 - Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability (CVE-2021-40539)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
Memcached
1011097* - Oracle MySQL Integer Underflow Vulnerability (CVE-2021-2389)
1011098 - Oracle MySQL Integer Underflow Vulnerability (CVE-2021-2390)
Web Client Common
1011127* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 2
1011185 - Chromium V8 Out Of Bounds Write Vulnerability (CVE-2021-30632)
1010207* - Microsoft Windows Multiple Type1 Font Parsing Remote Code Execution Vulnerabilities (CVE-2020-1020 and CVE-2020-0938)
Web Server HTTPS
1011100* - WordPress 'WooCommerce Blocks' Plugin SQL Injection Vulnerability (CVE-2021-32789)
Web Server Miscellaneous
1011177* - Atlassian Confluence Server Arbitrary File Read Vulnerability (CVE-2021-26085)
1011179* - Atlassian Jira Path Traversal Vulnerability (CVE-2021-26086)
1011163* - Spring Boot Actuator Directory Traversal Vulnerability (CVE-2021-21234)
Web Server Nagios
1011191 - Nagios XI Arbitrary File Upload Vulnerability (CVE-2021-40344)
Web Server Squid
1011159* - Squid HTTP Request Smuggling Vulnerability (CVE-2019-18678)
Zoho ManageEngine
1011188 - Zoho ManageEngine OpManager 'getReportData' SQL Injection Vulnerability (CVE-2021-41288)
Integrity Monitoring Rules:
1002786* - Microsoft Windows - Microsoft hotfixes registry keys modified (ATT&CK T1112)
Log Inspection Rules:
1004488* - Database Server - Microsoft SQL
1010595* - Microsoft LDAP Query Execution
Deep Packet Inspection Rules:
Memcached
1011097* - Oracle MySQL Integer Underflow Vulnerability (CVE-2021-2389)
1011098 - Oracle MySQL Integer Underflow Vulnerability (CVE-2021-2390)
Web Client Common
1011127* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 2
1011185 - Chromium V8 Out Of Bounds Write Vulnerability (CVE-2021-30632)
1010207* - Microsoft Windows Multiple Type1 Font Parsing Remote Code Execution Vulnerabilities (CVE-2020-1020 and CVE-2020-0938)
Web Server HTTPS
1011100* - WordPress 'WooCommerce Blocks' Plugin SQL Injection Vulnerability (CVE-2021-32789)
Web Server Miscellaneous
1011177* - Atlassian Confluence Server Arbitrary File Read Vulnerability (CVE-2021-26085)
1011179* - Atlassian Jira Path Traversal Vulnerability (CVE-2021-26086)
1011163* - Spring Boot Actuator Directory Traversal Vulnerability (CVE-2021-21234)
Web Server Nagios
1011191 - Nagios XI Arbitrary File Upload Vulnerability (CVE-2021-40344)
Web Server Squid
1011159* - Squid HTTP Request Smuggling Vulnerability (CVE-2019-18678)
Zoho ManageEngine
1011188 - Zoho ManageEngine OpManager 'getReportData' SQL Injection Vulnerability (CVE-2021-41288)
Integrity Monitoring Rules:
1002786* - Microsoft Windows - Microsoft hotfixes registry keys modified (ATT&CK T1112)
Log Inspection Rules:
1004488* - Database Server - Microsoft SQL
1010595* - Microsoft LDAP Query Execution
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
Memcached
1011097 - Oracle MySQL Integer Underflow Vulnerability (CVE-2021-2389)
Microsoft Office
1011181 - Microsoft Office Visio Remote Code Execution Vulnerability (CVE-2021-40480)
1011182 - Microsoft Office Visio Remote Code Execution Vulnerability (CVE-2021-40481)
1011184 - Microsoft Word Remote Code Execution Vulnerability (CVE-2021-40486)
Web Application Common
1011173* - WordPress 'Redirect 404 To Parent' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24286)
1011174* - WordPress 'Select All Categories and Taxonomies' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24287)
Web Client Common
1011175 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-104) - 1
1011176 - Adobe Acrobat And Reader Use After Free Vulnerability (CVE-2021-40730)
Web Server Apache
1011183 - Apache HTTP Server Server-Side Request Forgery Vulnerability (CVE-2021-40438)
Web Server HTTPS
1011172* - WordPress 'TranslatePress' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24610)
Web Server Miscellaneous
1011177 - Atlassian Confluence Server Arbitrary File Read Vulnerability (CVE-2021-26085)
1011179 - Atlassian Jira Path Traversal Vulnerability (CVE-2021-26086)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1002828* - Application - Secure Shell Daemon (SSHD)
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
1004057* - Microsoft Windows Security Events - 1
Deep Packet Inspection Rules:
Memcached
1011097 - Oracle MySQL Integer Underflow Vulnerability (CVE-2021-2389)
Microsoft Office
1011181 - Microsoft Office Visio Remote Code Execution Vulnerability (CVE-2021-40480)
1011182 - Microsoft Office Visio Remote Code Execution Vulnerability (CVE-2021-40481)
1011184 - Microsoft Word Remote Code Execution Vulnerability (CVE-2021-40486)
Web Application Common
1011173* - WordPress 'Redirect 404 To Parent' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24286)
1011174* - WordPress 'Select All Categories and Taxonomies' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24287)
Web Client Common
1011175 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-104) - 1
1011176 - Adobe Acrobat And Reader Use After Free Vulnerability (CVE-2021-40730)
Web Server Apache
1011183 - Apache HTTP Server Server-Side Request Forgery Vulnerability (CVE-2021-40438)
Web Server HTTPS
1011172* - WordPress 'TranslatePress' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24610)
Web Server Miscellaneous
1011177 - Atlassian Confluence Server Arbitrary File Read Vulnerability (CVE-2021-26085)
1011179 - Atlassian Jira Path Traversal Vulnerability (CVE-2021-26086)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1002828* - Application - Secure Shell Daemon (SSHD)
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
1004057* - Microsoft Windows Security Events - 1
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1008422* - Detected SMB Request
DCERPC Services - Client
1010585* - Identified Possible Ransomware File Extension Create Activity Over Network Share - Client (ATT&CK T1486, T1080)
Trend Micro OfficeScan
1010709* - Trend Micro Apex One Multiple Information Disclosure Vulnerabilities (CVE-2020-28573 and CVE-2020-28576)
1010708* - Trend Micro OfficeScan Multiple Information Disclosure Vulnerabilities (CVE-2020-28582 and CVE-2020-28583)
Web Application Common
1011171 - Apache HTTP Server Directory Traversal Vulnerability (CVE-2021-41773 and CVE-2021-42013)
1011170 - WordPress 'Contact Form' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24276)
1011173 - WordPress 'Redirect 404 To Parent' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24286)
1011174 - WordPress 'Select All Categories and Taxonomies' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24287)
Web Application PHP Based
1011143* - WordPress 'ProfilePress' Plugin Privilege Escalation Vulnerability (CVE-2021-34621)
Web Server Common
1011110 - Identified Slow HTTP Denial Of Service Attack (ATT&CK T1498.001)
Web Server HTTPS
1011161* - Centreon 'graph-split.php' SQL Injection Vulnerability
1011166* - GitLab Stored Cross-Site Scripting Vulnerability (CVE-2021-22242)
1011167* - VMware vCenter Server File Upload Vulnerability (CVE-2021-22005)
1011120* - WebSVN Command Injection Vulnerability (CVE-2021-32305)
1011169 - WordPress 'Supsystic Popup' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24275)
1011168 - WordPress 'Supsystic Ultimate Maps' Plugin Reflected Cross-Site Scripting Vulnerability (CVE-2021-24274)
1011172 - WordPress 'TranslatePress' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24610)
Web Server Nagios
1011164* - Nagios XI Stored Cross-Site Scripting Vulnerability (CVE-2021-38156)
Zoho ManageEngine
1011162* - Zoho ManageEngine OpManager 'GetDataCollectionFailureReason' SQL Injection Vulnerability (CVE-2021-40493)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
Deep Packet Inspection Rules:
DCERPC Services
1008422* - Detected SMB Request
DCERPC Services - Client
1010585* - Identified Possible Ransomware File Extension Create Activity Over Network Share - Client (ATT&CK T1486, T1080)
Trend Micro OfficeScan
1010709* - Trend Micro Apex One Multiple Information Disclosure Vulnerabilities (CVE-2020-28573 and CVE-2020-28576)
1010708* - Trend Micro OfficeScan Multiple Information Disclosure Vulnerabilities (CVE-2020-28582 and CVE-2020-28583)
Web Application Common
1011171 - Apache HTTP Server Directory Traversal Vulnerability (CVE-2021-41773 and CVE-2021-42013)
1011170 - WordPress 'Contact Form' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24276)
1011173 - WordPress 'Redirect 404 To Parent' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24286)
1011174 - WordPress 'Select All Categories and Taxonomies' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24287)
Web Application PHP Based
1011143* - WordPress 'ProfilePress' Plugin Privilege Escalation Vulnerability (CVE-2021-34621)
Web Server Common
1011110 - Identified Slow HTTP Denial Of Service Attack (ATT&CK T1498.001)
Web Server HTTPS
1011161* - Centreon 'graph-split.php' SQL Injection Vulnerability
1011166* - GitLab Stored Cross-Site Scripting Vulnerability (CVE-2021-22242)
1011167* - VMware vCenter Server File Upload Vulnerability (CVE-2021-22005)
1011120* - WebSVN Command Injection Vulnerability (CVE-2021-32305)
1011169 - WordPress 'Supsystic Popup' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24275)
1011168 - WordPress 'Supsystic Ultimate Maps' Plugin Reflected Cross-Site Scripting Vulnerability (CVE-2021-24274)
1011172 - WordPress 'TranslatePress' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24610)
Web Server Nagios
1011164* - Nagios XI Stored Cross-Site Scripting Vulnerability (CVE-2021-38156)
Zoho ManageEngine
1011162* - Zoho ManageEngine OpManager 'GetDataCollectionFailureReason' SQL Injection Vulnerability (CVE-2021-40493)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
Azure Open Management Infrastructure Tool
1011147* - Open Management Infrastructure Remote Code Execution Vulnerability (CVE-2021-38647)
DCERPC Services
1010164* - Identified Possible Ransomware File Extension Create Activity Over Network Share (ATT&CK T1486, T1080)
DCERPC Services - Client
1010585* - Identified Possible Ransomware File Extension Create Activity Over Network Share - Client (ATT&CK AT1486, T1080)
Directory Server LDAP
1011008* - OpenLDAP Integer Underflow Vulnerability (CVE-2020-36221)
Trend Micro ServerProtect EarthAgent
1011157* - Trend Micro ServerProtect Authentication Bypass Vulnerability (CVE-2021-36745)
Web Application Common
1011155* - FlatCore CMS Remote Code Execution Vulnerability (CVE-2021-39608)
1011103* - PHPUnit Remote Code Execution Vulnerability (CVE-2017-9841)
1010942* - WordPress XML External Entity Injection Vulnerability (CVE-2021-29447)
Web Application PHP Based
1011143 - WordPress 'ProfilePress' Plugin Privilege Escalation Vulnerability (CVE-2021-34621)
Web Client Common
1011129* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 1
1011127* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 2
Web Server HTTPS
1011156* - Centreon 'componentTemplates.php' SQL Injection Vulnerability
1011161 - Centreon 'graph-split.php' SQL Injection Vulnerability
1011158* - Detected VMware vCenter Server Analytics Service Access
1011166 - GitLab Stored Cross-Site Scripting Vulnerability (CVE-2021-22242)
1011167 - VMware vCenter Server File Upload Vulnerability (CVE-2021-22005)
1011120* - WebSVN Command Injection Vulnerability (CVE-2021-32305)
1011165 - WordPress 'Woo-Order-Export-Lite' Plugin Reflected Cross-Site Scripting Vulnerability (CVE-2021-24169)
Web Server Miscellaneous
1011153* - FasterXML jackson-databind Malicious JSON Objects Multiple Remote Code Execution Vulnerabilities
1011163 - Spring Boot Actuator Directory Traversal Vulnerability (CVE-2021-21234)
Web Server Nagios
1011164 - Nagios XI Stored Cross-Site Scripting Vulnerability (CVE-2021-38156)
Web Server Oracle
1011086* - Oracle Business Intelligence 'Scheduler' Remote Code Execution Vulnerability (CVE-2021-2391)
1011084* - Oracle Business Intelligence 'UpdateConnectionServlet' Remote Code Execution Vulnerability (CVE-2021-2396)
1011096* - Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2021-2394)
Web Server SharePoint
1011123* - Microsoft SharePoint WorkflowCompilerInternal Remote Code Execution Vulnerability (CVE-2021-26420)
Web Server Squid
1011159 - Squid HTTP Request Smuggling Vulnerability (CVE-2019-18678)
Zoho ManageEngine
1011162 - Zoho ManageEngine OpManager 'GetDataCollectionFailureReason' SQL Injection Vulnerability (CVE-2021-40493)
Integrity Monitoring Rules:
1005193* - Linux/Unix - File attributes modified (ATT&CK T1070.002, T1222.002)
1011116* - Linux/Unix - Kernel modules loading configuration modified (ATT&CK T1547.006)
1010798* - Linux/Unix - Local user and group files modified (ATT&CK T1136.001, T1531)
1010422* - Linux/Unix - SCP process detected (ATT&CK T1048.001, T1105)
1011070* - Linux/Unix - SSH authorized_keys file modified - non-root users (ATT&CK T1021.004, T1098.004, T1563.001)
1011068* - Linux/Unix - SSH authorized_keys file modified - root user (ATT&CK T1021.004, T1098.004, T1563.001)
1011069* - Linux/Unix - SSH authorized_keys file modified - systemwide (ATT&CK T1021.004, T1098.004, T1563.001)
1011111* - Linux/Unix - Users and Groups - Create and Delete Activity (ATT&CK T1136)
1010825* - Linux/Unix - adduser, useradd and deluser configuration files modified (ATT&CK T1136.001, T1531)
1010808* - Linux/Unix - bash configuration files modified (ATT&CK T1059.004, T1546.004)
1010827* - Linux/Unix - csh/tcsh configuration files modified (ATT&CK T1059.004, T1546.004)
1010828* - Linux/Unix - zsh configuration files modified (ATT&CK T1059.004, T1546.004)
1009626* - Microsoft Windows - Accessibility features registry keys or files modified (ATT&CK T1546.008, T1546.012)
1011151* - Microsoft Windows - Active directory registry keys modified (ATT&CK T1112)
1005195* - Microsoft Windows - Attributes of log file modified (ATT&CK T1070, T1222.001)
1002781* - Microsoft Windows - Attributes of services modified (ATT&CK T1036.004, T1543.003)
1002767* - Microsoft Windows - Attributes of system32 directory modified (ATT&CK T1222)
1011144* - Microsoft Windows - AutoRun registries modified (ATT&CK T1547.001)
1011146* - Microsoft Windows - Autostart execution registries modified (ATT&CK T1547.001)
1011145* - Microsoft Windows - Boot or Logon Autostart Execution registries modified (ATT&CK T1547.004, T1547.014)
1003367* - Microsoft Windows - DHCP server files directory and service modified (ATT&CK T1036.003, T1222.001)
1002869* - Microsoft Windows - DNS Server (ATT&CK T1554, T1584.002)
1011148* - Microsoft Windows - Files in appdata startup folder modified (ATT&CK T1547.001)
1011149* - Microsoft Windows - Files in programdata startup folder modified (ATT&CK T1547.001)
1011150* - Microsoft Windows - Files in start menu directory modified (ATT&CK T1547.001)
1002780* - Microsoft Windows - Installed software attributes modified (ATT&CK T1195.002, T1554)
1002786* - Microsoft Windows - Microsoft hotfixes registry keys modified (ATT&CK T1112)
1011142* - Microsoft Windows - Network services registries modified (ATT&CK T1547.001, T1574.001)
1011071* - Microsoft Windows - OpenSSH registry keys modified (ATT&CK T1021.004, T1112)
1011092* - Microsoft Windows - OpenSSH server configuration file modified (ATT&CK T1021.004)
1002787* - Microsoft Windows - Registry values of event log modified (ATT&CK T1070.001, T1562.002)
1002776* - Microsoft Windows - Startup Programs Modified (ATT&CK T1060, T1112)
1002778* - Microsoft Windows - System .dll or .exe files modified (ATT&CK T1036.003, T1222.001)
1008257* - Microsoft Windows - USB storage device detected (ATT&CK T1052.001, T1092)
1008720* - Microsoft Windows - Users and Groups - Create and Delete Activity (ATT&CK T1136)
1011141* - Microsoft Windows - Windows file protection registry modified (ATT&CK T1112, T1546.008)
1007221* - TMTR-0026: Suspicious Files Detected In Program Files Folder
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
Azure Open Management Infrastructure Tool
1011147* - Open Management Infrastructure Remote Code Execution Vulnerability (CVE-2021-38647)
DCERPC Services
1010164* - Identified Possible Ransomware File Extension Create Activity Over Network Share (ATT&CK T1486, T1080)
DCERPC Services - Client
1010585* - Identified Possible Ransomware File Extension Create Activity Over Network Share - Client (ATT&CK AT1486, T1080)
Directory Server LDAP
1011008* - OpenLDAP Integer Underflow Vulnerability (CVE-2020-36221)
Trend Micro ServerProtect EarthAgent
1011157* - Trend Micro ServerProtect Authentication Bypass Vulnerability (CVE-2021-36745)
Web Application Common
1011155* - FlatCore CMS Remote Code Execution Vulnerability (CVE-2021-39608)
1011103* - PHPUnit Remote Code Execution Vulnerability (CVE-2017-9841)
1010942* - WordPress XML External Entity Injection Vulnerability (CVE-2021-29447)
Web Application PHP Based
1011143 - WordPress 'ProfilePress' Plugin Privilege Escalation Vulnerability (CVE-2021-34621)
Web Client Common
1011129* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 1
1011127* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 2
Web Server HTTPS
1011156* - Centreon 'componentTemplates.php' SQL Injection Vulnerability
1011161 - Centreon 'graph-split.php' SQL Injection Vulnerability
1011158* - Detected VMware vCenter Server Analytics Service Access
1011166 - GitLab Stored Cross-Site Scripting Vulnerability (CVE-2021-22242)
1011167 - VMware vCenter Server File Upload Vulnerability (CVE-2021-22005)
1011120* - WebSVN Command Injection Vulnerability (CVE-2021-32305)
1011165 - WordPress 'Woo-Order-Export-Lite' Plugin Reflected Cross-Site Scripting Vulnerability (CVE-2021-24169)
Web Server Miscellaneous
1011153* - FasterXML jackson-databind Malicious JSON Objects Multiple Remote Code Execution Vulnerabilities
1011163 - Spring Boot Actuator Directory Traversal Vulnerability (CVE-2021-21234)
Web Server Nagios
1011164 - Nagios XI Stored Cross-Site Scripting Vulnerability (CVE-2021-38156)
Web Server Oracle
1011086* - Oracle Business Intelligence 'Scheduler' Remote Code Execution Vulnerability (CVE-2021-2391)
1011084* - Oracle Business Intelligence 'UpdateConnectionServlet' Remote Code Execution Vulnerability (CVE-2021-2396)
1011096* - Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2021-2394)
Web Server SharePoint
1011123* - Microsoft SharePoint WorkflowCompilerInternal Remote Code Execution Vulnerability (CVE-2021-26420)
Web Server Squid
1011159 - Squid HTTP Request Smuggling Vulnerability (CVE-2019-18678)
Zoho ManageEngine
1011162 - Zoho ManageEngine OpManager 'GetDataCollectionFailureReason' SQL Injection Vulnerability (CVE-2021-40493)
Integrity Monitoring Rules:
1005193* - Linux/Unix - File attributes modified (ATT&CK T1070.002, T1222.002)
1011116* - Linux/Unix - Kernel modules loading configuration modified (ATT&CK T1547.006)
1010798* - Linux/Unix - Local user and group files modified (ATT&CK T1136.001, T1531)
1010422* - Linux/Unix - SCP process detected (ATT&CK T1048.001, T1105)
1011070* - Linux/Unix - SSH authorized_keys file modified - non-root users (ATT&CK T1021.004, T1098.004, T1563.001)
1011068* - Linux/Unix - SSH authorized_keys file modified - root user (ATT&CK T1021.004, T1098.004, T1563.001)
1011069* - Linux/Unix - SSH authorized_keys file modified - systemwide (ATT&CK T1021.004, T1098.004, T1563.001)
1011111* - Linux/Unix - Users and Groups - Create and Delete Activity (ATT&CK T1136)
1010825* - Linux/Unix - adduser, useradd and deluser configuration files modified (ATT&CK T1136.001, T1531)
1010808* - Linux/Unix - bash configuration files modified (ATT&CK T1059.004, T1546.004)
1010827* - Linux/Unix - csh/tcsh configuration files modified (ATT&CK T1059.004, T1546.004)
1010828* - Linux/Unix - zsh configuration files modified (ATT&CK T1059.004, T1546.004)
1009626* - Microsoft Windows - Accessibility features registry keys or files modified (ATT&CK T1546.008, T1546.012)
1011151* - Microsoft Windows - Active directory registry keys modified (ATT&CK T1112)
1005195* - Microsoft Windows - Attributes of log file modified (ATT&CK T1070, T1222.001)
1002781* - Microsoft Windows - Attributes of services modified (ATT&CK T1036.004, T1543.003)
1002767* - Microsoft Windows - Attributes of system32 directory modified (ATT&CK T1222)
1011144* - Microsoft Windows - AutoRun registries modified (ATT&CK T1547.001)
1011146* - Microsoft Windows - Autostart execution registries modified (ATT&CK T1547.001)
1011145* - Microsoft Windows - Boot or Logon Autostart Execution registries modified (ATT&CK T1547.004, T1547.014)
1003367* - Microsoft Windows - DHCP server files directory and service modified (ATT&CK T1036.003, T1222.001)
1002869* - Microsoft Windows - DNS Server (ATT&CK T1554, T1584.002)
1011148* - Microsoft Windows - Files in appdata startup folder modified (ATT&CK T1547.001)
1011149* - Microsoft Windows - Files in programdata startup folder modified (ATT&CK T1547.001)
1011150* - Microsoft Windows - Files in start menu directory modified (ATT&CK T1547.001)
1002780* - Microsoft Windows - Installed software attributes modified (ATT&CK T1195.002, T1554)
1002786* - Microsoft Windows - Microsoft hotfixes registry keys modified (ATT&CK T1112)
1011142* - Microsoft Windows - Network services registries modified (ATT&CK T1547.001, T1574.001)
1011071* - Microsoft Windows - OpenSSH registry keys modified (ATT&CK T1021.004, T1112)
1011092* - Microsoft Windows - OpenSSH server configuration file modified (ATT&CK T1021.004)
1002787* - Microsoft Windows - Registry values of event log modified (ATT&CK T1070.001, T1562.002)
1002776* - Microsoft Windows - Startup Programs Modified (ATT&CK T1060, T1112)
1002778* - Microsoft Windows - System .dll or .exe files modified (ATT&CK T1036.003, T1222.001)
1008257* - Microsoft Windows - USB storage device detected (ATT&CK T1052.001, T1092)
1008720* - Microsoft Windows - Users and Groups - Create and Delete Activity (ATT&CK T1136)
1011141* - Microsoft Windows - Windows file protection registry modified (ATT&CK T1112, T1546.008)
1007221* - TMTR-0026: Suspicious Files Detected In Program Files Folder
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.