Deep Security Center
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services - Client
1004304* - Identified Suspicious Microsoft Windows Shortcut File Over Network Share (ATT&CK T1080)
Trend Micro ServerProtect EarthAgent
1011157 - Trend Micro ServerProtect Authentication Bypass Vulnerability (CVE-2021-36745)
Web Application Common
1011155 - FlatCore CMS Remote Code Execution Vulnerability (CVE-2021-39608)
1011103* - PHPUnit Remote Code Execution Vulnerability (CVE-2017-9841)
Web Application PHP Based
1011154* - Identified WordPress 'wp-login.php' Brute Force Attempt
Web Client Common
1011126 - Microsoft MSHTML Remote Code Execution Vulnerability (CVE-2021-40444)
Web Server Common
1011118* - Centreon 'csv_HostGroupLogs.php' SQL Injection Vulnerability (CVE-2021-37556)
Web Server HTTPS
1011156 - Centreon 'componentTemplates.php' SQL Injection Vulnerability
1011132* - Centreon 'metaService.php' SQL Injection Vulnerability
1011158 - Detected VMware vCenter Server Analytics Service Access
1011072* - Microsoft Exchange Server Security Feature Bypass Vulnerability (CVE-2021-31207)
1011120 - WebSVN Command Injection Vulnerability (CVE-2021-32305)
1011100* - WordPress 'WooCommerce Blocks' Plugin SQL Injection Vulnerability (CVE-2021-32789)
Web Server Miscellaneous
1011153 - FasterXML jackson-databind Malicious JSON Objects Multiple Remote Code Execution Vulnerabilities
Web Server Nagios
1011131* - Nagios XI Bulk Modification Tool SQL Injection Vulnerability (CVE-2021-37350)
Web Server SharePoint
1011123 - Microsoft SharePoint WorkflowCompilerInternal Remote Code Execution Vulnerability (CVE-2021-26420)
Integrity Monitoring Rules:
1005193* - Linux/Unix - File attributes modified (ATT&CK T1070.002, T1222.002)
Log Inspection Rules:
1004488* - Database Server - Microsoft SQL
1003802* - Directory Server - Microsoft Windows Active Directory
1010595* - Microsoft LDAP Query Execution
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
Deep Packet Inspection Rules:
DCERPC Services - Client
1004304* - Identified Suspicious Microsoft Windows Shortcut File Over Network Share (ATT&CK T1080)
Trend Micro ServerProtect EarthAgent
1011157 - Trend Micro ServerProtect Authentication Bypass Vulnerability (CVE-2021-36745)
Web Application Common
1011155 - FlatCore CMS Remote Code Execution Vulnerability (CVE-2021-39608)
1011103* - PHPUnit Remote Code Execution Vulnerability (CVE-2017-9841)
Web Application PHP Based
1011154* - Identified WordPress 'wp-login.php' Brute Force Attempt
Web Client Common
1011126 - Microsoft MSHTML Remote Code Execution Vulnerability (CVE-2021-40444)
Web Server Common
1011118* - Centreon 'csv_HostGroupLogs.php' SQL Injection Vulnerability (CVE-2021-37556)
Web Server HTTPS
1011156 - Centreon 'componentTemplates.php' SQL Injection Vulnerability
1011132* - Centreon 'metaService.php' SQL Injection Vulnerability
1011158 - Detected VMware vCenter Server Analytics Service Access
1011072* - Microsoft Exchange Server Security Feature Bypass Vulnerability (CVE-2021-31207)
1011120 - WebSVN Command Injection Vulnerability (CVE-2021-32305)
1011100* - WordPress 'WooCommerce Blocks' Plugin SQL Injection Vulnerability (CVE-2021-32789)
Web Server Miscellaneous
1011153 - FasterXML jackson-databind Malicious JSON Objects Multiple Remote Code Execution Vulnerabilities
Web Server Nagios
1011131* - Nagios XI Bulk Modification Tool SQL Injection Vulnerability (CVE-2021-37350)
Web Server SharePoint
1011123 - Microsoft SharePoint WorkflowCompilerInternal Remote Code Execution Vulnerability (CVE-2021-26420)
Integrity Monitoring Rules:
1005193* - Linux/Unix - File attributes modified (ATT&CK T1070.002, T1222.002)
Log Inspection Rules:
1004488* - Database Server - Microsoft SQL
1003802* - Directory Server - Microsoft Windows Active Directory
1010595* - Microsoft LDAP Query Execution
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
Azure Open Management Infrastructure Tool
1011147 - Open Management Infrastructure Remote Code Execution Vulnerability (CVE-2021-38647)
DCERPC Services
1011105* - Identified File Deletion From SMB Share (ATT&CK T1070.004)
Microsoft Office
1011135 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2021-38655)
1011137 - Microsoft Office Graphics Remote Code Execution Vulnerability (CVE-2021-38658)
1011121 - Microsoft Office Remote Code Execution Vulnerability (CVE-2021-34478)
1011138 - Microsoft Office Remote Code Execution Vulnerability (CVE-2021-38659)
1011134 - Microsoft Office Visio Remote Code Execution Vulnerability (CVE-2021-38653)
1011136 - Microsoft Word Remote Code Execution Vulnerability (CVE-2021-38656)
Web Application PHP Based
1011154 - Identified WordPress 'wp-login.php' Brute Force Attempt
1010642* - WordPress XMLRPC Brute Force Amplification Attack
Web Client Common
1011129* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 1
1011130* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 3
1011140 - Google Chrome Use After Free Vulnerability (CVE-2020-6550)
1011139 - Google Chrome V8 Type Confusion Vulnerability (CVE-2021-30561)
1011080 - Microsoft 3D Viewer Remote Code Execution Vulnerability (ZDI-CAN-13085)
1011133 - Microsoft Visual Studio Remote Code Execution Vulnerability (CVE-2021-36952)
Web Server Common
1011118 - Centreon 'csv_HostGroupLogs.php' SQL Injection Vulnerability (CVE-2021-37556)
1011113* - Nagios XI Remote Command Injection Vulnerability (CVE-2021-37346)
Web Server HTTPS
1011132 - Centreon 'metaService.php' SQL Injection Vulnerability
Web Server Nagios
1011131 - Nagios XI Bulk Modification Tool SQL Injection Vulnerability (CVE-2021-37350)
Web Server Oracle
1011083* - Oracle Business Intelligence 'BIRemotingServlet' Insecure Deserialization Vulnerability (CVE-2021-2456)
1011086* - Oracle Business Intelligence 'Scheduler' Remote Code Execution Vulnerability (CVE-2021-2391)
1011084* - Oracle Business Intelligence 'UpdateConnectionServlet' Remote Code Execution Vulnerability (CVE-2021-2396)
Windows Services RPC Server DCERPC
1009892* - Identified Domain-Level Information Dumping Over DCERPC (ATT&CK T1003.006, T1018)
Integrity Monitoring Rules:
1011152 - Microsoft Windows - Active directory files modified (ATT&CK T1552.006)
1011151 - Microsoft Windows - Active directory registry keys modified (ATTACK T1112)
1011144 - Microsoft Windows - AutoRun registries modified (ATT&CK T1547.001)
1011146 - Microsoft Windows - Autostart execution registries modified (ATT&CK T1547.001)
1011145 - Microsoft Windows - Boot or Logon Autostart Execution registries modified (ATT&CK T1547.014, T1547.004)
1011148 - Microsoft Windows - Files in appdata startup folder modified (ATT&CK T1547.001)
1011149 - Microsoft Windows - Files in programdata startup folder modified (ATT&CK T1547.001)
1011150 - Microsoft Windows - Files in start menu directory modified (ATT&CK T1547.001)
1011142 - Microsoft Windows - Network services registries modified (ATT&CK T1574.001, T1547.001)
1002860* - Microsoft Windows - SAM registry keys modified (ATT&CK T1098, T1136)
1011141 - Microsoft Windows - Windows file protection registry modified (ATT&CK T1546.008, T1112)
1006800* - TMTR-0002: Suspicious Files Detected In Operating System Directories (ATT&CK T1053.005)
1006798* - TMTR-0005: Suspicious Files Detected In Application Directories (ATT&CK T1562.001)
1006796* - TMTR-0007: Suspicious Files Detected In Application Directories (ATT&CK T1574.002)
1006799* - TMTR-0014: Suspicious Service Detected (ATT&CK T1543.003)
1006684* - TMTR-0015: Suspicious Service Detected (ATT&CK T1543.003)
1006691* - TMTR-0017: Microsoft Windows - SAM Domain Account Users Modification Detected (ATT&CK T1098, T1136)
1007214* - TMTR-0019: Suspicious Files Detected In System Drivers Directory (ATT&CK T1014)
1007218* - TMTR-0023: Suspicious Changes In NTLM Settings (ATT&CK T1547.005)
1010515* - Vulnerability - Trend Micro ServerProtect For Linux Command Execution Vulnerability (CVE-2020-24561)
Log Inspection Rules:
1002828* - Application - Secure Shell Daemon (SSHD)
1008852* - Auditd
1003802* - Directory Server - Microsoft Windows Active Directory
1010595* - Microsoft LDAP Query Execution
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
1002795* - Microsoft Windows Events
1010095* - Microsoft Windows Management Instrumentation Events
1003987* - Microsoft Windows Security Events - 2
1008792* - Microsoft Windows Security Events - 4
1002831* - Unix - Syslog
1003447* - Web Server - Apache
1002835* - Web Server - Web Access Events
Deep Packet Inspection Rules:
Azure Open Management Infrastructure Tool
1011147 - Open Management Infrastructure Remote Code Execution Vulnerability (CVE-2021-38647)
DCERPC Services
1011105* - Identified File Deletion From SMB Share (ATT&CK T1070.004)
Microsoft Office
1011135 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2021-38655)
1011137 - Microsoft Office Graphics Remote Code Execution Vulnerability (CVE-2021-38658)
1011121 - Microsoft Office Remote Code Execution Vulnerability (CVE-2021-34478)
1011138 - Microsoft Office Remote Code Execution Vulnerability (CVE-2021-38659)
1011134 - Microsoft Office Visio Remote Code Execution Vulnerability (CVE-2021-38653)
1011136 - Microsoft Word Remote Code Execution Vulnerability (CVE-2021-38656)
Web Application PHP Based
1011154 - Identified WordPress 'wp-login.php' Brute Force Attempt
1010642* - WordPress XMLRPC Brute Force Amplification Attack
Web Client Common
1011129* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 1
1011130* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 3
1011140 - Google Chrome Use After Free Vulnerability (CVE-2020-6550)
1011139 - Google Chrome V8 Type Confusion Vulnerability (CVE-2021-30561)
1011080 - Microsoft 3D Viewer Remote Code Execution Vulnerability (ZDI-CAN-13085)
1011133 - Microsoft Visual Studio Remote Code Execution Vulnerability (CVE-2021-36952)
Web Server Common
1011118 - Centreon 'csv_HostGroupLogs.php' SQL Injection Vulnerability (CVE-2021-37556)
1011113* - Nagios XI Remote Command Injection Vulnerability (CVE-2021-37346)
Web Server HTTPS
1011132 - Centreon 'metaService.php' SQL Injection Vulnerability
Web Server Nagios
1011131 - Nagios XI Bulk Modification Tool SQL Injection Vulnerability (CVE-2021-37350)
Web Server Oracle
1011083* - Oracle Business Intelligence 'BIRemotingServlet' Insecure Deserialization Vulnerability (CVE-2021-2456)
1011086* - Oracle Business Intelligence 'Scheduler' Remote Code Execution Vulnerability (CVE-2021-2391)
1011084* - Oracle Business Intelligence 'UpdateConnectionServlet' Remote Code Execution Vulnerability (CVE-2021-2396)
Windows Services RPC Server DCERPC
1009892* - Identified Domain-Level Information Dumping Over DCERPC (ATT&CK T1003.006, T1018)
Integrity Monitoring Rules:
1011152 - Microsoft Windows - Active directory files modified (ATT&CK T1552.006)
1011151 - Microsoft Windows - Active directory registry keys modified (ATTACK T1112)
1011144 - Microsoft Windows - AutoRun registries modified (ATT&CK T1547.001)
1011146 - Microsoft Windows - Autostart execution registries modified (ATT&CK T1547.001)
1011145 - Microsoft Windows - Boot or Logon Autostart Execution registries modified (ATT&CK T1547.014, T1547.004)
1011148 - Microsoft Windows - Files in appdata startup folder modified (ATT&CK T1547.001)
1011149 - Microsoft Windows - Files in programdata startup folder modified (ATT&CK T1547.001)
1011150 - Microsoft Windows - Files in start menu directory modified (ATT&CK T1547.001)
1011142 - Microsoft Windows - Network services registries modified (ATT&CK T1574.001, T1547.001)
1002860* - Microsoft Windows - SAM registry keys modified (ATT&CK T1098, T1136)
1011141 - Microsoft Windows - Windows file protection registry modified (ATT&CK T1546.008, T1112)
1006800* - TMTR-0002: Suspicious Files Detected In Operating System Directories (ATT&CK T1053.005)
1006798* - TMTR-0005: Suspicious Files Detected In Application Directories (ATT&CK T1562.001)
1006796* - TMTR-0007: Suspicious Files Detected In Application Directories (ATT&CK T1574.002)
1006799* - TMTR-0014: Suspicious Service Detected (ATT&CK T1543.003)
1006684* - TMTR-0015: Suspicious Service Detected (ATT&CK T1543.003)
1006691* - TMTR-0017: Microsoft Windows - SAM Domain Account Users Modification Detected (ATT&CK T1098, T1136)
1007214* - TMTR-0019: Suspicious Files Detected In System Drivers Directory (ATT&CK T1014)
1007218* - TMTR-0023: Suspicious Changes In NTLM Settings (ATT&CK T1547.005)
1010515* - Vulnerability - Trend Micro ServerProtect For Linux Command Execution Vulnerability (CVE-2020-24561)
Log Inspection Rules:
1002828* - Application - Secure Shell Daemon (SSHD)
1008852* - Auditd
1003802* - Directory Server - Microsoft Windows Active Directory
1010595* - Microsoft LDAP Query Execution
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
1002795* - Microsoft Windows Events
1010095* - Microsoft Windows Management Instrumentation Events
1003987* - Microsoft Windows Security Events - 2
1008792* - Microsoft Windows Security Events - 4
1002831* - Unix - Syslog
1003447* - Web Server - Apache
1002835* - Web Server - Web Access Events
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
Web Application Common
1011124 - Ghostscript Remote Code Execution Vulnerability (Sep 2021)
Web Client Common
1009440* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-41) - 4
1011129 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 1
1011127 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 2
1011130 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 3
1011128 - Adobe Acrobat And Reader Type Confusion Vulnerability (CVE-2021-39841)
1011125 - Ghostscript Remote Code Execution Vulnerability (Sep 2021) - 1
Web Server Common
1011109* - Nagios XI 'Switch.inc.php' Command Injection Vulnerability (CVE-2021-37344)
1011113 - Nagios XI Remote Command Injection Vulnerability (CVE-2021-37346)
Web Server Miscellaneous
1011117* - Atlassian Confluence Server Remote Code Execution Vulnerability (CVE-2021-26084)
Web Server Oracle
1011083 - Oracle Business Intelligence 'BIRemotingServlet' Insecure Deserialization Vulnerability (CVE-2021-2456)
1011086 - Oracle Business Intelligence 'Scheduler' Remote Code Execution Vulnerability (CVE-2021-2391)
1011084 - Oracle Business Intelligence 'UpdateConnectionServlet' Remote Code Execution Vulnerability (CVE-2021-2396)
1011085* - Oracle Business Intelligence Arbitrary File Upload Vulnerability (CVE-2021-2392)
1011081* - Oracle Business Intelligence Publisher XML External Entity Injection Vulnerability (CVE-2021-2401)
Integrity Monitoring Rules:
1005711* - Application - Apache Hadoop
1003388* - Application - CacheFS
1008271* - Application - Docker
1003166* - Application - IBM WebSphere Application Server
1003333* - Application - Kerberos
1003381* - Application - Mailman
1003339* - Application - NFS
1003360* - Application - Network Information Server
1003370* - Application - OpenSSL
1003167* - Application - Oracle Bea WebLogic Server
1003374* - Application - PHP
1003359* - Application - Portmapper
1003375* - Application - Postfix
1003334* - Application - Samba
1003386* - Application - VNC Server
1003385* - Application - Xorg-x / XFree86 / Xfree86 / Xorg-x11
1007295* - Application - chrony
1003338* - Application - mountd
1003361* - Application - rstatd
1003372* - Application - telnetd
1003357* - Application - vixie-cron
1002788* - Microsoft Windows - 'ActiveX Compatibility' registry keys modified (ATT&CK T1112)
1002773* - Microsoft Windows - 'Hosts' file modified
1009626* - Microsoft Windows - Accessibility features registry keys or files modified (ATT&CK T1546.008, T1546.012)
1005195* - Microsoft Windows - Attributes of log file modified (ATT&CK T1222.001, T1070)
1002767* - Microsoft Windows - Attributes of system32 directory modified
1003367* - Microsoft Windows - DHCP server files directory and service modified (ATT&CK T1036.003, T1222.001)
1002869* - Microsoft Windows - DNS Server (ATT&CK T1584.002, T1554)
1002783* - Microsoft Windows - Default Debugger changed
1002780* - Microsoft Windows - Installed software attributes modified (ATT&CK T1195.002, T1554)
1002786* - Microsoft Windows - Microsoft hotfixes registry keys modified (ATT&CK T1112)
1002775* - Microsoft Windows - Network configuration files modified
1002787* - Microsoft Windows - Registry values of event log modified (ATT&CK T1562.002, T1070.001)
1002778* - Microsoft Windows - System .dll or .exe files modified (ATT&CK T1036.003, T1222.001)
1002777* - Microsoft Windows - System configuration file modified
1003517* - Microsoft Windows - System driver files modified
1006076* - Microsoft Windows - Task scheduler entries modified (ATT&CK T1053.005)
1008257* - Microsoft Windows - USB storage device detected (ATT&CK T1092, T1052.001)
1006803* - TMTR-0001: Suspicious Files Detected In Operating System Directories (ATT&CK T1560.001)
1006802* - TMTR-0003: Suspicious Files Detected In Operating System Directories (ATT&CK T1560.001)
1006805* - TMTR-0009: Suspicious Files Detected In System Folder (ATT&CK T1560.001)
1006804* - TMTR-0010: Suspicious Files Detected In System Folder (ATT&CK T1560.001)
1006658* - TMTR-0012: Suspicious Files Detected In Temporary Directories (ATT&CK T1560.001)
1006677* - TMTR-0013: Suspicious Files Detected In Windows Folder (ATT&CK T1560.001)
1006683* - TMTR-0016: Suspicious Running Processes Detected (ATT&CK T1560.001)
1007210* - TMTR-0018: Suspicious Files Detected In User Profile Directory (ATT&CK T1560.001)
1007216* - TMTR-0021: Suspicious Files Detected In System Drive (ATT&CK T1560.001)
1007217* - TMTR-0022: Suspicious Files Detected In Recycle Bin (ATT&CK T1560.001)
1008684* - Threat - BADRABBIT
1005041* - Threat - Suspicious Microsoft Windows Files Detected
1005042* - Threat - Suspicious Microsoft Windows Registry Entries Detected
1006544* - Threat - Suspicious Microsoft Windows Superfish Detected
1008385* - Threat - WannaCry
1010855* - Vulnerability - Microsoft Exchange - HAFNIUM Targeted Vulnerabilities
1010266* - Vulnerability - SaltStack Vulnerabilities Exploitation Detected
1010138* - Vulnerability - Trend Micro Apex One And OfficeScan Directory Traversal Vulnerability (CVE-2019-9489)
1010515* - Vulnerability - Trend Micro ServerProtect For Linux Command Execution Vulnerability (CVE-2020-24561)
Log Inspection Rules:
1008852* - Auditd
1010558* - Auditd - Mitre ATT&CK TA0005: Defense Evasion
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
1003843* - Microsoft Windows Security Events
1004057* - Microsoft Windows Security Events - 1
1008670* - Microsoft Windows Security Events - 3
Deep Packet Inspection Rules:
Web Application Common
1011124 - Ghostscript Remote Code Execution Vulnerability (Sep 2021)
Web Client Common
1009440* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-41) - 4
1011129 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 1
1011127 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 2
1011130 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 3
1011128 - Adobe Acrobat And Reader Type Confusion Vulnerability (CVE-2021-39841)
1011125 - Ghostscript Remote Code Execution Vulnerability (Sep 2021) - 1
Web Server Common
1011109* - Nagios XI 'Switch.inc.php' Command Injection Vulnerability (CVE-2021-37344)
1011113 - Nagios XI Remote Command Injection Vulnerability (CVE-2021-37346)
Web Server Miscellaneous
1011117* - Atlassian Confluence Server Remote Code Execution Vulnerability (CVE-2021-26084)
Web Server Oracle
1011083 - Oracle Business Intelligence 'BIRemotingServlet' Insecure Deserialization Vulnerability (CVE-2021-2456)
1011086 - Oracle Business Intelligence 'Scheduler' Remote Code Execution Vulnerability (CVE-2021-2391)
1011084 - Oracle Business Intelligence 'UpdateConnectionServlet' Remote Code Execution Vulnerability (CVE-2021-2396)
1011085* - Oracle Business Intelligence Arbitrary File Upload Vulnerability (CVE-2021-2392)
1011081* - Oracle Business Intelligence Publisher XML External Entity Injection Vulnerability (CVE-2021-2401)
Integrity Monitoring Rules:
1005711* - Application - Apache Hadoop
1003388* - Application - CacheFS
1008271* - Application - Docker
1003166* - Application - IBM WebSphere Application Server
1003333* - Application - Kerberos
1003381* - Application - Mailman
1003339* - Application - NFS
1003360* - Application - Network Information Server
1003370* - Application - OpenSSL
1003167* - Application - Oracle Bea WebLogic Server
1003374* - Application - PHP
1003359* - Application - Portmapper
1003375* - Application - Postfix
1003334* - Application - Samba
1003386* - Application - VNC Server
1003385* - Application - Xorg-x / XFree86 / Xfree86 / Xorg-x11
1007295* - Application - chrony
1003338* - Application - mountd
1003361* - Application - rstatd
1003372* - Application - telnetd
1003357* - Application - vixie-cron
1002788* - Microsoft Windows - 'ActiveX Compatibility' registry keys modified (ATT&CK T1112)
1002773* - Microsoft Windows - 'Hosts' file modified
1009626* - Microsoft Windows - Accessibility features registry keys or files modified (ATT&CK T1546.008, T1546.012)
1005195* - Microsoft Windows - Attributes of log file modified (ATT&CK T1222.001, T1070)
1002767* - Microsoft Windows - Attributes of system32 directory modified
1003367* - Microsoft Windows - DHCP server files directory and service modified (ATT&CK T1036.003, T1222.001)
1002869* - Microsoft Windows - DNS Server (ATT&CK T1584.002, T1554)
1002783* - Microsoft Windows - Default Debugger changed
1002780* - Microsoft Windows - Installed software attributes modified (ATT&CK T1195.002, T1554)
1002786* - Microsoft Windows - Microsoft hotfixes registry keys modified (ATT&CK T1112)
1002775* - Microsoft Windows - Network configuration files modified
1002787* - Microsoft Windows - Registry values of event log modified (ATT&CK T1562.002, T1070.001)
1002778* - Microsoft Windows - System .dll or .exe files modified (ATT&CK T1036.003, T1222.001)
1002777* - Microsoft Windows - System configuration file modified
1003517* - Microsoft Windows - System driver files modified
1006076* - Microsoft Windows - Task scheduler entries modified (ATT&CK T1053.005)
1008257* - Microsoft Windows - USB storage device detected (ATT&CK T1092, T1052.001)
1006803* - TMTR-0001: Suspicious Files Detected In Operating System Directories (ATT&CK T1560.001)
1006802* - TMTR-0003: Suspicious Files Detected In Operating System Directories (ATT&CK T1560.001)
1006805* - TMTR-0009: Suspicious Files Detected In System Folder (ATT&CK T1560.001)
1006804* - TMTR-0010: Suspicious Files Detected In System Folder (ATT&CK T1560.001)
1006658* - TMTR-0012: Suspicious Files Detected In Temporary Directories (ATT&CK T1560.001)
1006677* - TMTR-0013: Suspicious Files Detected In Windows Folder (ATT&CK T1560.001)
1006683* - TMTR-0016: Suspicious Running Processes Detected (ATT&CK T1560.001)
1007210* - TMTR-0018: Suspicious Files Detected In User Profile Directory (ATT&CK T1560.001)
1007216* - TMTR-0021: Suspicious Files Detected In System Drive (ATT&CK T1560.001)
1007217* - TMTR-0022: Suspicious Files Detected In Recycle Bin (ATT&CK T1560.001)
1008684* - Threat - BADRABBIT
1005041* - Threat - Suspicious Microsoft Windows Files Detected
1005042* - Threat - Suspicious Microsoft Windows Registry Entries Detected
1006544* - Threat - Suspicious Microsoft Windows Superfish Detected
1008385* - Threat - WannaCry
1010855* - Vulnerability - Microsoft Exchange - HAFNIUM Targeted Vulnerabilities
1010266* - Vulnerability - SaltStack Vulnerabilities Exploitation Detected
1010138* - Vulnerability - Trend Micro Apex One And OfficeScan Directory Traversal Vulnerability (CVE-2019-9489)
1010515* - Vulnerability - Trend Micro ServerProtect For Linux Command Execution Vulnerability (CVE-2020-24561)
Log Inspection Rules:
1008852* - Auditd
1010558* - Auditd - Mitre ATT&CK TA0005: Defense Evasion
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
1003843* - Microsoft Windows Security Events
1004057* - Microsoft Windows Security Events - 1
1008670* - Microsoft Windows Security Events - 3
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1011105* - Identified File Deletion From SMB Share (ATT&CK T1070.004)
DNS Server
1011102* - PowerDNS Authoritative Server Denial of Service Vulnerability (CVE-2021-36754)
Directory Server LDAP
1011114 - Identified Subnet Discovery Over LDAP (ATT&CK T1016)
Port Mapper FTP Client
1011089* - Identified File Upload Over FTP (ATT&CK T1048.003)
Suspicious Client Application Activity
1011119 - Disallow Download Of Restricted File Formats (ATT&CK T1105)
Suspicious Server Application Activity
1002378* - Detected Virtual Network Computing (VNC) Server Traffic (ATT&CK T1021.005, T1219)
Web Application Common
1011108* - GitStack Remote Code Execution Vulnerability (CVE-2018-5955) - 1
1011101* - MODX Revolution Remote Code Execution Vulnerability (CVE-2018-1000207)
Web Client Common
1011091* - Identified Download Of Executable File Over HTTP (ATT&CK T1105)
1011054* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
Web Client Internet Explorer/Edge
1009411* - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2018-8617)
Web Server Common
1005471* - Identified Suspicious Slow HTTP Denial Of Service Attack (ATT&CK T1498.001)
1011109 - Nagios XI 'Switch.inc.php' Command Injection Vulnerability (CVE-2021-37344)
Web Server HTTPS
1011115 - Identified Microsoft Exchange Server ECP Authentication Attempt
1011041* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473)
Web Server Miscellaneous
1011117 - Atlassian Confluence Server Remote Code Execution Vulnerability (CVE-2021-26084)
Web Server Oracle
1011085 - Oracle Business Intelligence Arbitrary File Upload Vulnerability (CVE-2021-2392)
1011081 - Oracle Business Intelligence Publisher XML External Entity Injection Vulnerability (CVE-2021-2401)
1011096* - Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2021-2394)
Integrity Monitoring Rules:
1011116 - Linux/Unix - Kernel modules loading configuration modified (ATT&CK T1547.006)
1011111 - Linux/Unix - Users and Groups - Create and Delete Activity (ATT&CK T1136)
1009629* - Microsoft Windows - AppCert DLL Registry values modified (ATT&CK T1546.009)
1009628* - Microsoft Windows - AppInit DLL Registry values modified (ATT&CK T1546.010)
1009639* - Microsoft Windows - Application shimming detected (ATT&CK T1546.011)
1002781* - Microsoft Windows - Attributes of services modified (ATT&CK T1543.003, T1036.004)
1009895* - Microsoft Windows - Component Object Model Registry keys modified (ATT&CK T1546.015)
1002859* - Microsoft Windows - LSA Authentication Packages modified (ATT&CK T1547.002)
1010353* - Microsoft Windows - LSA Notification Packages modified (ATT&CK T1556.002)
1009638* - Microsoft Windows - NetSh Helper DLL Registry keys modified (ATT&CK T1546.007)
1011071* - Microsoft Windows - OpenSSH registry keys modified (ATT&CK T1021.004, T1112)
1009618* - Microsoft Windows - Powershell activity detected (ATT&CK T1059.001)
1009710* - Microsoft Windows - Root Certificate Registry keys modified (ATT&CK T1553.004)
1009670* - Microsoft Windows - Service Registry keys modified (ATT&CK T1574.011)
1009672* - Microsoft Windows - Time Provider Registry keys modified (ATT&CK T1547.003)
1008720* - Microsoft Windows - Users and Groups - Create and Delete Activity (ATT&CK T1136)
1010382* - Microsoft Windows - Windows Command Shell activity detected (ATT&CK T1059.003)
Log Inspection Rules:
1003802* - Directory Server - Microsoft Windows Active Directory
1010595* - Microsoft LDAP Query Execution
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
1002795* - Microsoft Windows Events
Deep Packet Inspection Rules:
DCERPC Services
1011105* - Identified File Deletion From SMB Share (ATT&CK T1070.004)
DNS Server
1011102* - PowerDNS Authoritative Server Denial of Service Vulnerability (CVE-2021-36754)
Directory Server LDAP
1011114 - Identified Subnet Discovery Over LDAP (ATT&CK T1016)
Port Mapper FTP Client
1011089* - Identified File Upload Over FTP (ATT&CK T1048.003)
Suspicious Client Application Activity
1011119 - Disallow Download Of Restricted File Formats (ATT&CK T1105)
Suspicious Server Application Activity
1002378* - Detected Virtual Network Computing (VNC) Server Traffic (ATT&CK T1021.005, T1219)
Web Application Common
1011108* - GitStack Remote Code Execution Vulnerability (CVE-2018-5955) - 1
1011101* - MODX Revolution Remote Code Execution Vulnerability (CVE-2018-1000207)
Web Client Common
1011091* - Identified Download Of Executable File Over HTTP (ATT&CK T1105)
1011054* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
Web Client Internet Explorer/Edge
1009411* - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2018-8617)
Web Server Common
1005471* - Identified Suspicious Slow HTTP Denial Of Service Attack (ATT&CK T1498.001)
1011109 - Nagios XI 'Switch.inc.php' Command Injection Vulnerability (CVE-2021-37344)
Web Server HTTPS
1011115 - Identified Microsoft Exchange Server ECP Authentication Attempt
1011041* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473)
Web Server Miscellaneous
1011117 - Atlassian Confluence Server Remote Code Execution Vulnerability (CVE-2021-26084)
Web Server Oracle
1011085 - Oracle Business Intelligence Arbitrary File Upload Vulnerability (CVE-2021-2392)
1011081 - Oracle Business Intelligence Publisher XML External Entity Injection Vulnerability (CVE-2021-2401)
1011096* - Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2021-2394)
Integrity Monitoring Rules:
1011116 - Linux/Unix - Kernel modules loading configuration modified (ATT&CK T1547.006)
1011111 - Linux/Unix - Users and Groups - Create and Delete Activity (ATT&CK T1136)
1009629* - Microsoft Windows - AppCert DLL Registry values modified (ATT&CK T1546.009)
1009628* - Microsoft Windows - AppInit DLL Registry values modified (ATT&CK T1546.010)
1009639* - Microsoft Windows - Application shimming detected (ATT&CK T1546.011)
1002781* - Microsoft Windows - Attributes of services modified (ATT&CK T1543.003, T1036.004)
1009895* - Microsoft Windows - Component Object Model Registry keys modified (ATT&CK T1546.015)
1002859* - Microsoft Windows - LSA Authentication Packages modified (ATT&CK T1547.002)
1010353* - Microsoft Windows - LSA Notification Packages modified (ATT&CK T1556.002)
1009638* - Microsoft Windows - NetSh Helper DLL Registry keys modified (ATT&CK T1546.007)
1011071* - Microsoft Windows - OpenSSH registry keys modified (ATT&CK T1021.004, T1112)
1009618* - Microsoft Windows - Powershell activity detected (ATT&CK T1059.001)
1009710* - Microsoft Windows - Root Certificate Registry keys modified (ATT&CK T1553.004)
1009670* - Microsoft Windows - Service Registry keys modified (ATT&CK T1574.011)
1009672* - Microsoft Windows - Time Provider Registry keys modified (ATT&CK T1547.003)
1008720* - Microsoft Windows - Users and Groups - Create and Delete Activity (ATT&CK T1136)
1010382* - Microsoft Windows - Windows Command Shell activity detected (ATT&CK T1059.003)
Log Inspection Rules:
1003802* - Directory Server - Microsoft Windows Active Directory
1010595* - Microsoft LDAP Query Execution
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
1002795* - Microsoft Windows Events
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1011105* - Identified File Deletion From SMB Share (ATT&CK T1070.004)
DNS Server
1011102 - PowerDNS Authoritative Server Denial of Service Vulnerability (CVE-2021-36754)
Java RMI
1011078* - Atlassian Jira and Jira Service Management Data Center Insecure Deserialization Vulnerability (CVE-2020-36239)
Remote Login Applications
1004364* - TeamViewer (ATT&CK T1219)
Web Application Common
1011108 - GitStack Remote Code Execution Vulnerability (CVE-2018-5955) - 1
1011101 - MODX Revolution Remote Code Execution Vulnerability (CVE-2018-1000207)
1009310* - Microsoft Exchange Server SSRF Vulnerability (CVE-2018-16793)
1011103 - PHPUnit Remote Code Execution Vulnerability (CVE-2017-9841)
Web Client Common
1011049* - Google Chrome V8 Type Confusion Vulnerability (CVE-2021-30551)
1010207* - Microsoft Windows Multiple Type1 Font Parsing Remote Code Execution Vulnerabilities (CVE-2020-1020 and CVE-2020-0938)
Web Server Miscellaneous
1011099* - Jenkins 'Selenium HTML report' Plugin XML External Entity Injection Vulnerability (CVE-2021-21672)
Web Server Oracle
1011096* - Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2021-2394)
Integrity Monitoring Rules:
1002900* - Application - 3CDaemon
1002998* - Application - ARCserve Backup
1002851* - Application - Apache HTTP Server
1002853* - Application - Apache Tomcat
1003364* - Application - Exim
1003200* - Application - IBM DB2
1003077* - Application - IBM Lotus Domino
1003263* - Application - IBM Tivoli Directory Server
1003363* - Application - IPSwitch iMail
1003241* - Application - Ingres Database Server
1009060* - Application - Kubernetes Cluster master
1009434* - Application - Kubernetes Cluster node
1003039* - Application - MDaemon Email Server
1003040* - Application - MailEnable
1003092* - Application - Merak Mail Server
1003063* - Application - Microsoft Exchange
1002910* - Application - Microsoft IIS
1002999* - Application - Microsoft SQL Server
1003000* - Application - MySQL
1002914* - Application - NettermFTP
1003102* - Application - Novell eDirectory
1003090* - Application - Oracle Database Server
1003105* - Application - PostgreSQL
1003380* - Application - Squid Proxy
1003139* - Application - Sun ONE Application Server
1003142* - Application - Sun ONE Directory Server
1010055* - Application - Trend Micro ApexOne Server
1003019* - Application - Trend Micro Deep Security Agent / Relay
1003020* - Application - Trend Micro Deep Security Manager
1003744* - Application - Trend Micro OfficeScan Server
1003087* - Application - Trend Micro OfficeScan client
1003131* - Application - VMware Server
1002898* - Application - WS_FTP
1003403* - Application - WU-FTPD
1002849* - Application - WarFTPD
1003391* - Application - vsftpd
1011070* - Linux/Unix - SSH authorized_keys file modified - non-root users (ATT&CK T1563.001, T1021.004, T1098.004)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
DCERPC Services
1011105* - Identified File Deletion From SMB Share (ATT&CK T1070.004)
DNS Server
1011102 - PowerDNS Authoritative Server Denial of Service Vulnerability (CVE-2021-36754)
Java RMI
1011078* - Atlassian Jira and Jira Service Management Data Center Insecure Deserialization Vulnerability (CVE-2020-36239)
Remote Login Applications
1004364* - TeamViewer (ATT&CK T1219)
Web Application Common
1011108 - GitStack Remote Code Execution Vulnerability (CVE-2018-5955) - 1
1011101 - MODX Revolution Remote Code Execution Vulnerability (CVE-2018-1000207)
1009310* - Microsoft Exchange Server SSRF Vulnerability (CVE-2018-16793)
1011103 - PHPUnit Remote Code Execution Vulnerability (CVE-2017-9841)
Web Client Common
1011049* - Google Chrome V8 Type Confusion Vulnerability (CVE-2021-30551)
1010207* - Microsoft Windows Multiple Type1 Font Parsing Remote Code Execution Vulnerabilities (CVE-2020-1020 and CVE-2020-0938)
Web Server Miscellaneous
1011099* - Jenkins 'Selenium HTML report' Plugin XML External Entity Injection Vulnerability (CVE-2021-21672)
Web Server Oracle
1011096* - Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2021-2394)
Integrity Monitoring Rules:
1002900* - Application - 3CDaemon
1002998* - Application - ARCserve Backup
1002851* - Application - Apache HTTP Server
1002853* - Application - Apache Tomcat
1003364* - Application - Exim
1003200* - Application - IBM DB2
1003077* - Application - IBM Lotus Domino
1003263* - Application - IBM Tivoli Directory Server
1003363* - Application - IPSwitch iMail
1003241* - Application - Ingres Database Server
1009060* - Application - Kubernetes Cluster master
1009434* - Application - Kubernetes Cluster node
1003039* - Application - MDaemon Email Server
1003040* - Application - MailEnable
1003092* - Application - Merak Mail Server
1003063* - Application - Microsoft Exchange
1002910* - Application - Microsoft IIS
1002999* - Application - Microsoft SQL Server
1003000* - Application - MySQL
1002914* - Application - NettermFTP
1003102* - Application - Novell eDirectory
1003090* - Application - Oracle Database Server
1003105* - Application - PostgreSQL
1003380* - Application - Squid Proxy
1003139* - Application - Sun ONE Application Server
1003142* - Application - Sun ONE Directory Server
1010055* - Application - Trend Micro ApexOne Server
1003019* - Application - Trend Micro Deep Security Agent / Relay
1003020* - Application - Trend Micro Deep Security Manager
1003744* - Application - Trend Micro OfficeScan Server
1003087* - Application - Trend Micro OfficeScan client
1003131* - Application - VMware Server
1002898* - Application - WS_FTP
1003403* - Application - WU-FTPD
1002849* - Application - WarFTPD
1003391* - Application - vsftpd
1011070* - Linux/Unix - SSH authorized_keys file modified - non-root users (ATT&CK T1563.001, T1021.004, T1098.004)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1011105 - Identified File Deletion From SMB Share (ATT&CK T1070.004)
1011104 - Identified Network Share Discovery (ATT&CK T1135)
Java RMI
1011078 - Atlassian Jira and Jira Service Management Data Center Insecure Deserialization Vulnerability (CVE-2020-36239)
Web Application Common
1010668* - FUEL CMS Remote Code Execution Vulnerability (CVE-2018-16763)
1011094 - Identified User Creation Attempt In GitStack
Web Server HTTPS
1011088* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31198)
1011100 - WordPress 'WooCommerce Blocks' Plugin SQL Injection Vulnerability (CVE-2021-32789)
Web Server Miscellaneous
1011061* - Jenkins 'Config File Provider' Plugin External Entity Injection Vulnerability (CVE-2021-21642)
1011099 - Jenkins 'Selenium HTML report' Plugin XML External Entity Injection Vulnerability (CVE-2021-21672)
1011093* - Pivotal Spring Security OAuth Remote Code Execution Vulnerability (CVE-2016-4977)
Web Server Oracle
1010590* - Oracle WebLogic Server Remote Code Execution Vulnerabilities (CVE-2020-14882, CVE-2020-14750 and CVE-2020-14883)
1011096 - Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2021-2394)
Windows SMB Client
1011055 - Identified DCERPC OpenPrinterEx Call Over SMB Protocol
Integrity Monitoring Rules:
1003533* - Application - OpenSSH (ATT&CK T1021.004)
1011067 - Linux/Unix - Permissions on ssh private host keys modified (ATT&CK T1021.004, T1222.002)
1011070 - Linux/Unix - SSH authorized_keys file modified - non-root users (ATT&CK T1563.001, T1021.004, T1098.004)
1011068 - Linux/Unix - SSH authorized_keys file modified - root user (ATT&CK T1563.001, T1021.004, T1098.004)
1011069 - Linux/Unix - SSH authorized_keys file modified - systemwide (ATT&CK T1563.001, T1021.004, T1098.004)
1011066 - Linux/Unix - SSH client configuration modified (ATT&CK1021.004)
1011063 - Linux/Unix - SSH server configuration file modified (ATT&CK T1021.004)
1011071 - Microsoft Windows - OpenSSH registry keys modified (ATT&CK T1021.004, T1112)
1011092 - Microsoft Windows - OpenSSH server configuration file modified (ATT&CK T1021.004)
Log Inspection Rules:
1010465* - Auditd - Mitre ATT&CK TA0007: Discovery
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
Deep Packet Inspection Rules:
DCERPC Services
1011105 - Identified File Deletion From SMB Share (ATT&CK T1070.004)
1011104 - Identified Network Share Discovery (ATT&CK T1135)
Java RMI
1011078 - Atlassian Jira and Jira Service Management Data Center Insecure Deserialization Vulnerability (CVE-2020-36239)
Web Application Common
1010668* - FUEL CMS Remote Code Execution Vulnerability (CVE-2018-16763)
1011094 - Identified User Creation Attempt In GitStack
Web Server HTTPS
1011088* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31198)
1011100 - WordPress 'WooCommerce Blocks' Plugin SQL Injection Vulnerability (CVE-2021-32789)
Web Server Miscellaneous
1011061* - Jenkins 'Config File Provider' Plugin External Entity Injection Vulnerability (CVE-2021-21642)
1011099 - Jenkins 'Selenium HTML report' Plugin XML External Entity Injection Vulnerability (CVE-2021-21672)
1011093* - Pivotal Spring Security OAuth Remote Code Execution Vulnerability (CVE-2016-4977)
Web Server Oracle
1010590* - Oracle WebLogic Server Remote Code Execution Vulnerabilities (CVE-2020-14882, CVE-2020-14750 and CVE-2020-14883)
1011096 - Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2021-2394)
Windows SMB Client
1011055 - Identified DCERPC OpenPrinterEx Call Over SMB Protocol
Integrity Monitoring Rules:
1003533* - Application - OpenSSH (ATT&CK T1021.004)
1011067 - Linux/Unix - Permissions on ssh private host keys modified (ATT&CK T1021.004, T1222.002)
1011070 - Linux/Unix - SSH authorized_keys file modified - non-root users (ATT&CK T1563.001, T1021.004, T1098.004)
1011068 - Linux/Unix - SSH authorized_keys file modified - root user (ATT&CK T1563.001, T1021.004, T1098.004)
1011069 - Linux/Unix - SSH authorized_keys file modified - systemwide (ATT&CK T1563.001, T1021.004, T1098.004)
1011066 - Linux/Unix - SSH client configuration modified (ATT&CK1021.004)
1011063 - Linux/Unix - SSH server configuration file modified (ATT&CK T1021.004)
1011071 - Microsoft Windows - OpenSSH registry keys modified (ATT&CK T1021.004, T1112)
1011092 - Microsoft Windows - OpenSSH server configuration file modified (ATT&CK T1021.004)
Log Inspection Rules:
1010465* - Auditd - Mitre ATT&CK TA0007: Discovery
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services - Client
1007120* - SMB DLL Injection Exploit Detected (ATT&CK T1055.001)
Microsoft Office
1011095 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2021-34501)
NFS Server
1011079* - Microsoft Windows Services NFS ONCRPC XDR Driver Remote Code Execution Vulnerability (CVE-2021-26432)
OpenSSL Client
1006017* - Restrict OpenSSL TLS/DTLS Heartbeat Message (ATT&CK T1573.002)
Port Mapper FTP Client
1009558* - Remote File Copy Over FTP (ATT&CK T1544, T1071.002)
SAP NetWeaver Java Application Server
1010822* - Identified SAP Solution Manager Tool Transfer Over HTTP (ATT&CK T1105)
SSL Client
1009915* - Identified WhatsApp Registration (ATT&CK T1102.002)
1009932* - Telegram Bot API Usage (Used by Telecrypt) (ATT&CK T1102.002)
SSL Client Applications
1009914* - Identified Github Authentication (ATT&CK T1102.002)
1001113* - SSL/TLS Client (ATT&CK T1573.002)
Suspicious Client Application Activity
1005283* - Identified Potentially Malicious RAT Traffic - I (ATT&CK T1571)
1005300* - Identified Potentially Malicious RAT Traffic - IV (ATT&CK T1571)
1005473* - Identified Potentially Malicious RAT Traffic - V (ATT&CK T1571)
1006247* - Identified Potentially Malicious RAT Traffic - VI (ATT&CK T1571)
1008756* - Identified Potentially Malicious RAT Traffic - VII (ATT&CK T1571)
Web Application Common
1007170* - Identified Suspicious China Chopper Webshell Communication (ATT&CK T1505.003)
1009911* - Identified Twitter Command & Control Communication (ATT&CK T1102.002)
Web Application PHP Based
1011074* - WordPress 'Backup Guard' Plugin Arbitrary File Upload Vulnerability (CVE-2021-24155)
Web Client Common
1000943* - Detect UPX Packed Executable Download (ATT&CK T1027.002)
1009912* - Detected Vkontakte Site Access Over HTTP (ATT&CK T1102.002)
Web Client SSL
1006296* - Detected SSLv3 Response (ATT&CK T1573.002)
1006298* - Identified CBC Based Cipher Suite In SSLv3 Request (ATT&CK T1573.002)
Web Server Common
1005434* - Disallow Upload Of A PHP File (ATT&CK T1190)
1005013* - Restrict Microsoft .Net Executable File Upload (ATT&CK T1190)
1003025* - Web Server Restrict Executable File Uploads (ATT&CK T1190)
Web Server HTTPS
1011088 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31198)
1011060* - WordPress 'LearnPress' Plugin Blind SQL Injection Vulnerability (CVE-2020-6010)
Web Server Miscellaneous
1011044* - Apache Superset Open Redirect Vulnerability (CVE-2021-28125)
1011061 - Jenkins 'Config File Provider' Plugin External Entity Injection Vulnerability (CVE-2021-21642)
1011093 - Pivotal Spring Security OAuth Remote Code Execution Vulnerability (CVE-2016-4977)
Web Server SharePoint
1010836* - Identified Microsoft SharePoint GetGroupCollection Request (ATT&CK T1213.002)
1010835* - Identified Microsoft SharePoint GetGroupCollectionFromRole Request (ATT&CK T1213.002, T1087)
1010834* - Identified Microsoft SharePoint GetGroupCollectionFromSite Request (ATT&CK T1213.002)
1010833* - Identified Microsoft SharePoint GetGroupCollectionFromUser Request (ATT&CK T1213.002, T1087)
1010832* - Identified Microsoft SharePoint GetGroupCollectionFromWeb Request (ATT&CK T1213.002)
1010831* - Identified Microsoft SharePoint GetGroupInfo Request (ATT&CK T1213.002)
1010823* - Identified Microsoft SharePoint GetPermissionCollection Request (ATT&CK T1069, T1213.002, T1589.002)
1010830* - Identified Microsoft SharePoint GetRoleCollection Request (ATT&CK T1213.002)
1010747* - Identified Microsoft SharePoint GetRolesAndPermissionsForSite Request (ATT&CK T1589.003)
1010746* - Identified Microsoft SharePoint GetUserInfo Request (ATT&CK T1589.003)
Windows Services RPC Server DCERPC
1009478* - Identified Remote Service Creation Over DCE/RPC Protocol (ATT&CK T1543.003)
1007054* - Remote Schedule Task 'Create' Through SMBv2 Protocol Detected (ATT&CK T1053.005)
1007053* - Remote Schedule Task 'Delete' Through SMBv2 Protocol Detected (ATT&CK T1053.005)
1007017* - Remote Schedule Task 'Run' Through SMBv2 Protocol Detected (ATT&CK T1053.005)
Zabbix Server
1011073* - Zabbix Server Multiple Remote Code Execution Vulnerabilities
Integrity Monitoring Rules:
1003354* - Linux/Unix - Configuration files of sendmail utility modified
1003168* - Linux/Unix - Listening ports modified
1003169* - Linux/Unix - Process attributes modified
1009745* - Linux/Unix - Removable Device Detected (ATT&CK T1092)
1010422* - Linux/Unix - SCP process detected (ATT&CK T1105, T1048.001)
1010791* - Linux/Unix - Task scheduler entries modified (ATT&CK T1053)
1009704* - Microsoft Windows - Boot or Logon Autostart Execution: Port Monitors (ATT&CK T1547.010)
Log Inspection Rules:
1002797* - Database Server - MySQL
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
1008670* - Microsoft Windows Security Events - 3
Deep Packet Inspection Rules:
DCERPC Services - Client
1007120* - SMB DLL Injection Exploit Detected (ATT&CK T1055.001)
Microsoft Office
1011095 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2021-34501)
NFS Server
1011079* - Microsoft Windows Services NFS ONCRPC XDR Driver Remote Code Execution Vulnerability (CVE-2021-26432)
OpenSSL Client
1006017* - Restrict OpenSSL TLS/DTLS Heartbeat Message (ATT&CK T1573.002)
Port Mapper FTP Client
1009558* - Remote File Copy Over FTP (ATT&CK T1544, T1071.002)
SAP NetWeaver Java Application Server
1010822* - Identified SAP Solution Manager Tool Transfer Over HTTP (ATT&CK T1105)
SSL Client
1009915* - Identified WhatsApp Registration (ATT&CK T1102.002)
1009932* - Telegram Bot API Usage (Used by Telecrypt) (ATT&CK T1102.002)
SSL Client Applications
1009914* - Identified Github Authentication (ATT&CK T1102.002)
1001113* - SSL/TLS Client (ATT&CK T1573.002)
Suspicious Client Application Activity
1005283* - Identified Potentially Malicious RAT Traffic - I (ATT&CK T1571)
1005300* - Identified Potentially Malicious RAT Traffic - IV (ATT&CK T1571)
1005473* - Identified Potentially Malicious RAT Traffic - V (ATT&CK T1571)
1006247* - Identified Potentially Malicious RAT Traffic - VI (ATT&CK T1571)
1008756* - Identified Potentially Malicious RAT Traffic - VII (ATT&CK T1571)
Web Application Common
1007170* - Identified Suspicious China Chopper Webshell Communication (ATT&CK T1505.003)
1009911* - Identified Twitter Command & Control Communication (ATT&CK T1102.002)
Web Application PHP Based
1011074* - WordPress 'Backup Guard' Plugin Arbitrary File Upload Vulnerability (CVE-2021-24155)
Web Client Common
1000943* - Detect UPX Packed Executable Download (ATT&CK T1027.002)
1009912* - Detected Vkontakte Site Access Over HTTP (ATT&CK T1102.002)
Web Client SSL
1006296* - Detected SSLv3 Response (ATT&CK T1573.002)
1006298* - Identified CBC Based Cipher Suite In SSLv3 Request (ATT&CK T1573.002)
Web Server Common
1005434* - Disallow Upload Of A PHP File (ATT&CK T1190)
1005013* - Restrict Microsoft .Net Executable File Upload (ATT&CK T1190)
1003025* - Web Server Restrict Executable File Uploads (ATT&CK T1190)
Web Server HTTPS
1011088 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31198)
1011060* - WordPress 'LearnPress' Plugin Blind SQL Injection Vulnerability (CVE-2020-6010)
Web Server Miscellaneous
1011044* - Apache Superset Open Redirect Vulnerability (CVE-2021-28125)
1011061 - Jenkins 'Config File Provider' Plugin External Entity Injection Vulnerability (CVE-2021-21642)
1011093 - Pivotal Spring Security OAuth Remote Code Execution Vulnerability (CVE-2016-4977)
Web Server SharePoint
1010836* - Identified Microsoft SharePoint GetGroupCollection Request (ATT&CK T1213.002)
1010835* - Identified Microsoft SharePoint GetGroupCollectionFromRole Request (ATT&CK T1213.002, T1087)
1010834* - Identified Microsoft SharePoint GetGroupCollectionFromSite Request (ATT&CK T1213.002)
1010833* - Identified Microsoft SharePoint GetGroupCollectionFromUser Request (ATT&CK T1213.002, T1087)
1010832* - Identified Microsoft SharePoint GetGroupCollectionFromWeb Request (ATT&CK T1213.002)
1010831* - Identified Microsoft SharePoint GetGroupInfo Request (ATT&CK T1213.002)
1010823* - Identified Microsoft SharePoint GetPermissionCollection Request (ATT&CK T1069, T1213.002, T1589.002)
1010830* - Identified Microsoft SharePoint GetRoleCollection Request (ATT&CK T1213.002)
1010747* - Identified Microsoft SharePoint GetRolesAndPermissionsForSite Request (ATT&CK T1589.003)
1010746* - Identified Microsoft SharePoint GetUserInfo Request (ATT&CK T1589.003)
Windows Services RPC Server DCERPC
1009478* - Identified Remote Service Creation Over DCE/RPC Protocol (ATT&CK T1543.003)
1007054* - Remote Schedule Task 'Create' Through SMBv2 Protocol Detected (ATT&CK T1053.005)
1007053* - Remote Schedule Task 'Delete' Through SMBv2 Protocol Detected (ATT&CK T1053.005)
1007017* - Remote Schedule Task 'Run' Through SMBv2 Protocol Detected (ATT&CK T1053.005)
Zabbix Server
1011073* - Zabbix Server Multiple Remote Code Execution Vulnerabilities
Integrity Monitoring Rules:
1003354* - Linux/Unix - Configuration files of sendmail utility modified
1003168* - Linux/Unix - Listening ports modified
1003169* - Linux/Unix - Process attributes modified
1009745* - Linux/Unix - Removable Device Detected (ATT&CK T1092)
1010422* - Linux/Unix - SCP process detected (ATT&CK T1105, T1048.001)
1010791* - Linux/Unix - Task scheduler entries modified (ATT&CK T1053)
1009704* - Microsoft Windows - Boot or Logon Autostart Execution: Port Monitors (ATT&CK T1547.010)
Log Inspection Rules:
1002797* - Database Server - MySQL
1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
1008670* - Microsoft Windows Security Events - 3
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
File Sharing Applications
1003651* - Windows Live FolderShare (ATT&CK T1102.002, T1567.002)
Instant Messenger Applications
1003243* - Yahoo Instant Message URL Blocker (ATT&CK T1102.002)
1002163* - Yahoo! Messenger (ATT&CK T1102.002)
1002384* - Yahoo! Messenger File Transfers (ATT&CK T1102.002)
NFS Server
1011079 - Microsoft Windows Services NFS ONCRPC XDR Driver Remote Code Execution Vulnerability (CVE-2021-26432)
OpenSSL
1006307* - Detected Too Many Suspicious TLS/SSL Client Hello Messages (ATT&CK T1573.002)
1006012* - Identified Suspicious OpenSSL TLS/DTLS Heartbeat Request (ATT&CK T1573.002)
1005474* - Identified Weak Cipher Support From TLS/SSL Server (ATT&CK T1573.002)
OpenSSL Client
1006184* - Identified OpenSSL DTLS Anonymous ECDH Cipher Suite (ATT&CK T1573.002)
1006190* - Identified OpenSSL SRP Cipher Suite In Server Hello Message (ATT&CK T1573.002)
Port Mapper FTP Client
1011089 - Identified File Upload Over FTP (ATT&CK T1048.003)
Remote Desktop Protocol Server
1009343* - Identified Too Many SSL Alert Messages In SSLv3 Over RDP (ATT&CK T1021.001, T1573.002)
Remote Login Applications
1002487* - SSH Client (ATT&CK T1021.004)
SSL Client
1006740* - Identified SSL/TLS Diffie-Hellman Key Exchange Using Weak Parameters Client (ATT&CK T1573.002)
SSL/TLS Server
1006026* - Identified Compression Algorithm In SSL/TLS (ATT&CK T1573.002)
Suspicious Client Application Activity
1007197* - TMTR-0005: GHOST RAT TCP Connection Detected (ATT&CK T1571)
1007200* - TMTR-0010: FAKEM RAT TCP Connection (ATT&CK T1571)
1007201* - TMTR-0011: FAKEM RAT TCP Request (ATT&CK T1571)
1007205* - TMTR-0012: FAKEM RAT TCP Connection (ATT&CK T1571)
1007207* - TMTR-0014: NJRAT TCP Connection (ATT&CK T1571)
1007208* - TMTR-0016: SPLINTER RAT TCP Connection (ATT&CK T1571)
1007209* - TMTR-0017: ZIYAZO RAT BKDR Connection (ATT&CK T1571)
Trend Micro OfficeScan
1011057* - Trend Micro Multiple Products Arbitrary File Upload Vulnerability (CVE-2021-36741)
Web Application Common
1005427* - Identified Suspicious Upload Of Archive File (ATT&CK T1190)
1010122* - WordPress Plainview Activity Monitor Plugin Remote Code Execution Vulnerability (CVE-2018-15877)
Web Application PHP Based
1011074 - WordPress 'Backup Guard' Plugin Arbitrary File Upload Vulnerability (CVE-2021-24155)
Web Client Common
1011090 - Google Chrome Heap Corruption Vulnerability (CVE-2021-21148)
1011075 - Google Chrome Type Confusion Vulnerability (CVE-2019-13764)
1005269* - Identified Download Of DLL File Over WebDAV (ATT&CK T1574.002)
1011091 - Identified Download Of Executable File Over HTTP (ATT&CK T1105)
1003244* - Identified Suspicious Obfuscated JavaScript (ATT&CK T1203, T1001)
1006391* - Identified Suspicious Obfuscated JavaScript - 1 (ATT&CK T1203, T1001)
1006599* - Identified Suspicious Obfuscated JavaScript - 3 (ATT&CK T1203, T1001)
1006882* - Identified Suspicious Obfuscated JavaScript - 4 (ATT&CK T1203, T1001)
1008185* - Identified Suspicious Obfuscated PDF Document (ATT&CK T1027, T1204.002)
1008297* - Identified Suspicious RTF File With Obfuscated PowerShell Execution (ATT&CK T1027, T1204.002, T1059.001)
Web Client Internet Explorer/Edge
1011077 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2021-34480)
Web Client SSL
1006024* - Identified Compression Algorithm In SSL/TLS Message (ATT&CK T1573.002)
1005040* - Identified Revoked Certificate Authority In SSL Traffic (ATT&CK T1573.002)
Web Server Common
1008621* - Disallow Upload Of A JSP File (ATT&CK T1190)
1010405* - JAWS Remote Code Execution Vulnerability
Web Server HTTPS
1008137* - Identified TLS/SSL DES Cipher Suite Is Being Supported (ATT&CK T1573.002)
1005641* - Identified TLS/SSL RC4 Cipher Suite Is Being Supported (ATT&CK T1573.002)
1006064* - Identified Too Many Compressed HTTP Responses (ATT&CK T1071.001)
1007491* - Identified Usage Of EXPORT Cipher Suite In SSLv2 Connection (ATT&CK T1573.002)
1006562* - Identified Usage Of TLS/SSL EXPORT Cipher Suite In Request (ATT&CK T1573.002)
1011072* - Microsoft Exchange Server Security Feature Bypass Vulnerability (CVE-2021-31207)
1011060 - WordPress 'LearnPress' Plugin Blind SQL Injection Vulnerability (CVE-2020-6010)
1011046* - rConfig 'vendor.crud.php' Arbitrary File Upload Vulnerability
Web Server Miscellaneous
1011044 - Apache Superset Open Redirect Vulnerability (CVE-2021-28125)
1010976* - SolarWinds NPM 'FromJson' Remote Code Execution Vulnerability (CVE-2021-31474)
Windows SMB Server
1011058* - Identified DCERPC EfsRpcOpenFileRaw Call Over SMB Protocol (PetitPotam)
Zabbix Server
1011073 - Zabbix Server Multiple Remote Code Execution Vulnerabilities
Zoho ManageEngine
1011062* - Zoho ManageEngine Applications Manager Cross Site Scripting Vulnerability (CVE-2021-31813)
Zoho ManageEngine ADSelfService Plus
1011064* - Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CVE-2021-28958)
Integrity Monitoring Rules:
1011059 - Microsoft Windows - Security support providers (SSP) registry key modified (ATT&CK T1547.005)
Log Inspection Rules:
1003802* - Directory Server - Microsoft Windows Active Directory
1010002* - Microsoft PowerShell Command Execution
Deep Packet Inspection Rules:
File Sharing Applications
1003651* - Windows Live FolderShare (ATT&CK T1102.002, T1567.002)
Instant Messenger Applications
1003243* - Yahoo Instant Message URL Blocker (ATT&CK T1102.002)
1002163* - Yahoo! Messenger (ATT&CK T1102.002)
1002384* - Yahoo! Messenger File Transfers (ATT&CK T1102.002)
NFS Server
1011079 - Microsoft Windows Services NFS ONCRPC XDR Driver Remote Code Execution Vulnerability (CVE-2021-26432)
OpenSSL
1006307* - Detected Too Many Suspicious TLS/SSL Client Hello Messages (ATT&CK T1573.002)
1006012* - Identified Suspicious OpenSSL TLS/DTLS Heartbeat Request (ATT&CK T1573.002)
1005474* - Identified Weak Cipher Support From TLS/SSL Server (ATT&CK T1573.002)
OpenSSL Client
1006184* - Identified OpenSSL DTLS Anonymous ECDH Cipher Suite (ATT&CK T1573.002)
1006190* - Identified OpenSSL SRP Cipher Suite In Server Hello Message (ATT&CK T1573.002)
Port Mapper FTP Client
1011089 - Identified File Upload Over FTP (ATT&CK T1048.003)
Remote Desktop Protocol Server
1009343* - Identified Too Many SSL Alert Messages In SSLv3 Over RDP (ATT&CK T1021.001, T1573.002)
Remote Login Applications
1002487* - SSH Client (ATT&CK T1021.004)
SSL Client
1006740* - Identified SSL/TLS Diffie-Hellman Key Exchange Using Weak Parameters Client (ATT&CK T1573.002)
SSL/TLS Server
1006026* - Identified Compression Algorithm In SSL/TLS (ATT&CK T1573.002)
Suspicious Client Application Activity
1007197* - TMTR-0005: GHOST RAT TCP Connection Detected (ATT&CK T1571)
1007200* - TMTR-0010: FAKEM RAT TCP Connection (ATT&CK T1571)
1007201* - TMTR-0011: FAKEM RAT TCP Request (ATT&CK T1571)
1007205* - TMTR-0012: FAKEM RAT TCP Connection (ATT&CK T1571)
1007207* - TMTR-0014: NJRAT TCP Connection (ATT&CK T1571)
1007208* - TMTR-0016: SPLINTER RAT TCP Connection (ATT&CK T1571)
1007209* - TMTR-0017: ZIYAZO RAT BKDR Connection (ATT&CK T1571)
Trend Micro OfficeScan
1011057* - Trend Micro Multiple Products Arbitrary File Upload Vulnerability (CVE-2021-36741)
Web Application Common
1005427* - Identified Suspicious Upload Of Archive File (ATT&CK T1190)
1010122* - WordPress Plainview Activity Monitor Plugin Remote Code Execution Vulnerability (CVE-2018-15877)
Web Application PHP Based
1011074 - WordPress 'Backup Guard' Plugin Arbitrary File Upload Vulnerability (CVE-2021-24155)
Web Client Common
1011090 - Google Chrome Heap Corruption Vulnerability (CVE-2021-21148)
1011075 - Google Chrome Type Confusion Vulnerability (CVE-2019-13764)
1005269* - Identified Download Of DLL File Over WebDAV (ATT&CK T1574.002)
1011091 - Identified Download Of Executable File Over HTTP (ATT&CK T1105)
1003244* - Identified Suspicious Obfuscated JavaScript (ATT&CK T1203, T1001)
1006391* - Identified Suspicious Obfuscated JavaScript - 1 (ATT&CK T1203, T1001)
1006599* - Identified Suspicious Obfuscated JavaScript - 3 (ATT&CK T1203, T1001)
1006882* - Identified Suspicious Obfuscated JavaScript - 4 (ATT&CK T1203, T1001)
1008185* - Identified Suspicious Obfuscated PDF Document (ATT&CK T1027, T1204.002)
1008297* - Identified Suspicious RTF File With Obfuscated PowerShell Execution (ATT&CK T1027, T1204.002, T1059.001)
Web Client Internet Explorer/Edge
1011077 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2021-34480)
Web Client SSL
1006024* - Identified Compression Algorithm In SSL/TLS Message (ATT&CK T1573.002)
1005040* - Identified Revoked Certificate Authority In SSL Traffic (ATT&CK T1573.002)
Web Server Common
1008621* - Disallow Upload Of A JSP File (ATT&CK T1190)
1010405* - JAWS Remote Code Execution Vulnerability
Web Server HTTPS
1008137* - Identified TLS/SSL DES Cipher Suite Is Being Supported (ATT&CK T1573.002)
1005641* - Identified TLS/SSL RC4 Cipher Suite Is Being Supported (ATT&CK T1573.002)
1006064* - Identified Too Many Compressed HTTP Responses (ATT&CK T1071.001)
1007491* - Identified Usage Of EXPORT Cipher Suite In SSLv2 Connection (ATT&CK T1573.002)
1006562* - Identified Usage Of TLS/SSL EXPORT Cipher Suite In Request (ATT&CK T1573.002)
1011072* - Microsoft Exchange Server Security Feature Bypass Vulnerability (CVE-2021-31207)
1011060 - WordPress 'LearnPress' Plugin Blind SQL Injection Vulnerability (CVE-2020-6010)
1011046* - rConfig 'vendor.crud.php' Arbitrary File Upload Vulnerability
Web Server Miscellaneous
1011044 - Apache Superset Open Redirect Vulnerability (CVE-2021-28125)
1010976* - SolarWinds NPM 'FromJson' Remote Code Execution Vulnerability (CVE-2021-31474)
Windows SMB Server
1011058* - Identified DCERPC EfsRpcOpenFileRaw Call Over SMB Protocol (PetitPotam)
Zabbix Server
1011073 - Zabbix Server Multiple Remote Code Execution Vulnerabilities
Zoho ManageEngine
1011062* - Zoho ManageEngine Applications Manager Cross Site Scripting Vulnerability (CVE-2021-31813)
Zoho ManageEngine ADSelfService Plus
1011064* - Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CVE-2021-28958)
Integrity Monitoring Rules:
1011059 - Microsoft Windows - Security support providers (SSP) registry key modified (ATT&CK T1547.005)
Log Inspection Rules:
1003802* - Directory Server - Microsoft Windows Active Directory
1010002* - Microsoft PowerShell Command Execution
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1007134* - Batch File Uploaded On Network Share (ATT&CK T1021.002, T1204.002)
1007064* - Executable File Uploaded On System32 Folder Through SMB Share (ATT&CK T1021.002, T1204.002)
1007114* - Portable Executable File Uploaded On SMB Share (ATT&CK T1021.002, T1204.002)
1007020* - Remote CreateService Request Detected Through SMBv1 Protocol (ATT&CK T1543.003)
1007035* - Remote DeleteService Request Through SMBv1 Detected (ATT&CK T1543.003)
1007069* - Remote Service Execution Through SMBv1 Detected (ATT&CK T1569.002)
DNS Client
1002988* - Multiple Vendors libspf2 DNS TXT Record Parsing Buffer Overflow
File Sharing Applications
1007608* - Amazon Cloud Drive (ATT&CK T1102.002, T1567.002)
1007605* - BOX (ATT&CK T1102.002, T1567.002)
1004707* - Dropbox (ATT&CK T1102.002, T1567.002)
1002472* - FTP Client (ATT&CK T1048.003, T1071.002)
1007463* - Microsoft OneDrive (ATT&CK T1102.002, T1567.002)
Instant Messenger Applications
1002103* - AOL Instant Messenger (ATT&CK T1102.002)
1004663* - IP Messenger (ATT&CK T1102.002)
1002507* - Jabber (ATT&CK T1102.002)
1003067* - MSN Instant Message URL Blocker (ATT&CK T1102.002)
1002162* - MSN Messenger (ATT&CK T1102.002)
1002462* - MSN Messenger File Transfers (ATT&CK T1102.002)
1004941* - QQ Messenger (ATT&CK T1102.002)
Mail Client Applications
1001112* - SMTP Client (ATT&CK T1071.003)
Remote Login Applications
1002508* - RDP (ATT&CK T1021.001)
SSL Client
1006561* - Identified Usage Of TLS/SSL EXPORT Cipher Suite In Response (ATT&CK T1573.002)
SSL/TLS Server
1006293* - Detected SSLv3 Request (ATT&CK T1573.002)
1006297* - Identified CBC Based Cipher Suite In SSLv3 Response (ATT&CK T1573.002)
1006311* - Identified Too Many SSL Alert Messages In SSLv3 Traffic (ATT&CK T1573.002)
Suspicious Client Application Activity
1001162* - Detected HTTP Client Traffic (ATT&CK T1071.001)
1005324* - Detected SSLv2 Response (ATT&CK T1573.002)
1005401* - Identified Suspicious HTTP Traffic (ATT&CK T1071.001)
Suspicious Server Application Activity
1003594* - Detected SSL/TLS Server Traffic (ATT&CK T1573.002)
1005321* - Detected SSLv2 Request (ATT&CK T1573.002)
1002378* - Detected Virtual Network Computing (VNC) Server Traffic (ATT&CK T1021.005)
Trend Micro OfficeScan
1011057 - Trend Micro Multiple Products Arbitrary File Upload Vulnerability (CVE-2021-36741)
Web Application Common
1011047* - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
1011056* - WordPress 'SP Project & Document Manager' Plugin Remote Code Execution Vulnerability (CVE-2021-24347)
1011038* - Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability (CVE-2021-20081)
Web Application PHP Based
1011045 - WordPress 'Modern Events Calendar Lite' Plugin Improper Access Control Vulnerability (CVE-2021-24146)
Web Client Common
1011032* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)
1009407* - Detected Suspicious DLL Side Loading Attempt Over WebDAV (ATT&CK T1574.002)
1006442* - Identified Suspicious Obfuscated JavaScript - 2 (ATT&CK T1203, T1001)
1011054* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
1011065 - Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability (CVE-2021-33742)
1004302* - Microsoft Windows Shortcut Remote Code Execution
Web Server Common
1007213* - Disallow Upload Of A Class File (ATT&CK T1190)
1007212* - Disallow Upload Of An Archive File (ATT&CK T1190)
Web Server HTTPS
1006741* - Identified SSL/TLS Diffie-Hellman Key Exchange Using Weak Parameters Server (ATT&CK T1573.002)
1011050* - Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2021-34523)
1011072 - Microsoft Exchange Server Security Feature Bypass Vulnerability (CVE-2021-31207)
1011046 - rConfig 'vendor.crud.php' Arbitrary File Upload Vulnerability
Web Server SharePoint
1011051* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34520)
Zoho ManageEngine
1011062 - Zoho ManageEngine Applications Manager Cross Site Scripting Vulnerability (CVE-2021-31813)
Zoho ManageEngine ADSelfService Plus
1011064 - Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CVE-2021-28958)
Integrity Monitoring Rules:
1009643* - Linux/Unix - bash command history cleared (ATT&CK T1059.004)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
DCERPC Services
1007134* - Batch File Uploaded On Network Share (ATT&CK T1021.002, T1204.002)
1007064* - Executable File Uploaded On System32 Folder Through SMB Share (ATT&CK T1021.002, T1204.002)
1007114* - Portable Executable File Uploaded On SMB Share (ATT&CK T1021.002, T1204.002)
1007020* - Remote CreateService Request Detected Through SMBv1 Protocol (ATT&CK T1543.003)
1007035* - Remote DeleteService Request Through SMBv1 Detected (ATT&CK T1543.003)
1007069* - Remote Service Execution Through SMBv1 Detected (ATT&CK T1569.002)
DNS Client
1002988* - Multiple Vendors libspf2 DNS TXT Record Parsing Buffer Overflow
File Sharing Applications
1007608* - Amazon Cloud Drive (ATT&CK T1102.002, T1567.002)
1007605* - BOX (ATT&CK T1102.002, T1567.002)
1004707* - Dropbox (ATT&CK T1102.002, T1567.002)
1002472* - FTP Client (ATT&CK T1048.003, T1071.002)
1007463* - Microsoft OneDrive (ATT&CK T1102.002, T1567.002)
Instant Messenger Applications
1002103* - AOL Instant Messenger (ATT&CK T1102.002)
1004663* - IP Messenger (ATT&CK T1102.002)
1002507* - Jabber (ATT&CK T1102.002)
1003067* - MSN Instant Message URL Blocker (ATT&CK T1102.002)
1002162* - MSN Messenger (ATT&CK T1102.002)
1002462* - MSN Messenger File Transfers (ATT&CK T1102.002)
1004941* - QQ Messenger (ATT&CK T1102.002)
Mail Client Applications
1001112* - SMTP Client (ATT&CK T1071.003)
Remote Login Applications
1002508* - RDP (ATT&CK T1021.001)
SSL Client
1006561* - Identified Usage Of TLS/SSL EXPORT Cipher Suite In Response (ATT&CK T1573.002)
SSL/TLS Server
1006293* - Detected SSLv3 Request (ATT&CK T1573.002)
1006297* - Identified CBC Based Cipher Suite In SSLv3 Response (ATT&CK T1573.002)
1006311* - Identified Too Many SSL Alert Messages In SSLv3 Traffic (ATT&CK T1573.002)
Suspicious Client Application Activity
1001162* - Detected HTTP Client Traffic (ATT&CK T1071.001)
1005324* - Detected SSLv2 Response (ATT&CK T1573.002)
1005401* - Identified Suspicious HTTP Traffic (ATT&CK T1071.001)
Suspicious Server Application Activity
1003594* - Detected SSL/TLS Server Traffic (ATT&CK T1573.002)
1005321* - Detected SSLv2 Request (ATT&CK T1573.002)
1002378* - Detected Virtual Network Computing (VNC) Server Traffic (ATT&CK T1021.005)
Trend Micro OfficeScan
1011057 - Trend Micro Multiple Products Arbitrary File Upload Vulnerability (CVE-2021-36741)
Web Application Common
1011047* - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
1011056* - WordPress 'SP Project & Document Manager' Plugin Remote Code Execution Vulnerability (CVE-2021-24347)
1011038* - Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability (CVE-2021-20081)
Web Application PHP Based
1011045 - WordPress 'Modern Events Calendar Lite' Plugin Improper Access Control Vulnerability (CVE-2021-24146)
Web Client Common
1011032* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)
1009407* - Detected Suspicious DLL Side Loading Attempt Over WebDAV (ATT&CK T1574.002)
1006442* - Identified Suspicious Obfuscated JavaScript - 2 (ATT&CK T1203, T1001)
1011054* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
1011065 - Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability (CVE-2021-33742)
1004302* - Microsoft Windows Shortcut Remote Code Execution
Web Server Common
1007213* - Disallow Upload Of A Class File (ATT&CK T1190)
1007212* - Disallow Upload Of An Archive File (ATT&CK T1190)
Web Server HTTPS
1006741* - Identified SSL/TLS Diffie-Hellman Key Exchange Using Weak Parameters Server (ATT&CK T1573.002)
1011050* - Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2021-34523)
1011072 - Microsoft Exchange Server Security Feature Bypass Vulnerability (CVE-2021-31207)
1011046 - rConfig 'vendor.crud.php' Arbitrary File Upload Vulnerability
Web Server SharePoint
1011051* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34520)
Zoho ManageEngine
1011062 - Zoho ManageEngine Applications Manager Cross Site Scripting Vulnerability (CVE-2021-31813)
Zoho ManageEngine ADSelfService Plus
1011064 - Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CVE-2021-28958)
Integrity Monitoring Rules:
1009643* - Linux/Unix - bash command history cleared (ATT&CK T1059.004)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1009490* - Block Administrative Share - 1 (ATT&CK T1021.002)
1010426* - Identified Domain-Level Account Discovery Over SMB (ATT&CK T1087.002)
1009703* - Identified Domain-Level Permission Groups Discovery Over SMB (ATT&CK T1069.002)
1010101* - Identified Usage Of PAExec Command Line Tool (ATT&CK T1569.002)
1006906* - Identified Usage Of PsExec Command Line Tool (ATT&CK T1569.002)
1005293* - Prevent Windows Administrator User Login Over SMB (ATT&CK T1078.002,T1078.001,T1021.002)
DCERPC Services - Client
1004373* - Identified DLL Side Loading Attempt Over Network Share (ATT&CK T1574.002)
1010106* - Identified Downloading Of PowerShell Scripts Through SMB Share (ATT&CK T1059.001)
Directory Server LDAP
1010640* - Identified Remote Account Discovery Over LDAP (ATT&CK T1087.002)
1010641* - Identified Remote Permission Groups Discovery Over LDAP (ATT&CK 1069.002)
Remote Desktop Protocol Server
1009562* - Identified Remote Desktop Protocol (RDP) Brute Force Attempt (ATT&CK T1110)
1009343* - Identified Too Many SSL Alert Messages In SSLv3 Over RDP (ATT&CK T1021.001)
Suspicious Client Application Activity
1008946* - Heuristic Detection Of Suspicious Digital Certificate (ATT&CK T1587.003)
1010327* - Identified Potential Malicious Client Traffic (ATT&CK T1071.001)
1005299* - Identified Potentially Malicious RAT Traffic - III (ATT&CK T1571, T1219)
1010307* - Identified Reverse Shell Communication Over HTTPS (ATT&CK T1071.001)
1010306* - Identified Reverse Shell Communication Over HTTPS - 1 (ATT&CK T1071.001)
1010364* - Identified Reverse Shell Communication Over HTTPS - 2 (ATT&CK T1071.001)
1010365* - Identified Reverse Shell Communication Over HTTPS - 3 (ATT&CK T1071.001)
1010370* - Identified Reverse Shell Communication Over HTTPS - 4 (ATT&CK T1071.001)
1009952* - Identified WhatsApp Communication Attempt (ATT&CK T1102.002)
Suspicious Server Application Activity
1003593* - Detected SSH Server Traffic (ATT&CK T1021.004)
1009549* - Detected Terminal Services (RDP) Server Traffic - 1 (ATT&CK T1021.001)
1010328* - Identified Potential Malicious Server Traffic (ATT&CK T1071.001)
Unix SSH
1008313* - Identified Many SSH Client Key Exchange Requests (ATT&CK T1499.002, T1110)
1005748* - Multiple SSH Connections Detected (ATT&CK T1499.002, T1110)
Web Application Common
1011047* - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
1011056 - WordPress 'SP Project & Document Manager' Plugin Remote Code Execution Vulnerability (CVE-2021-24347)
1011043* - WordPress 'XCloner' Plugin Remote Code Execution Vulnerability (CVE-2020-35948)
1011038 - Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability (CVE-2021-20081)
Web Client Common
1011032* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)
1011054 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
1010956 - Microsoft Raw Image Extension Remote Code Execution Vulnerability (ZDI-21-506)
Web Client SharePoint
1011052 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34468)
Web Media Applications
1009913* - Identified Pastebin Communication (ATT&CK T1102.002)
Web Server Common
1010336* - Disallow Upload Of Linux Executable File (ATT&CK T1608.001)
Web Server HTTPS
1011050 - Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2021-34523)
1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)
Web Server Miscellaneous
1011035* - Jenkins 'Generic Webhook Trigger' Plugin External Entity Injection Vulnerability (CVE-2021-21669)
Web Server Nagios
1011022* - Nagios XI Account Email Address Stored Cross-Site Scripting Vulnerability
Web Server SharePoint
1011051 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34520)
1010738* - Restrict Attempt To Enumerate Microsoft SharePoint For User Accounts (ATT&CK T1087.003, T1087.002)
Windows Remote Management
1009894* - Powershell Remote Command Execution Via WinRM - HTTP (Request) (ATT&CK T1021.006, T1059.001)
1010048* - WinRM Service Detected & Powershell RCE Over HTTP (ATT&CK T1021.006, T1059.001)
Windows Remote Management Client
1010073* - WinRM Service Detected & Powershell RCE Over HTTP - Client (ATT&CK T1021.006, T1059.001)
Windows SMB Server
1007065* - Executable File Uploaded On Network Share (ATT&CK T1570)
1011058 - Identified DCERPC EfsRpcOpenFileRaw Call Over SMB Protocol
Windows Services RPC Server DCERPC
1009892* - Identified Domain-Level Credentials Dumping Over DCERPC (ATT&CK T1003.006)
1009480* - Identified WMI Query Over DCE/RPC Protocol (ATT&CK T1047)
Integrity Monitoring Rules:
1003587* - Linux/Unix - Directory attributes of /bin modified (ATT&CK T1222.002)
1002766* - Linux/Unix - Directory attributes of /sbin modified (ATT&CK T1222.002)
1003573* - Linux/Unix - File attributes in the /bin directory modified
1003513* - Linux/Unix - File attributes in the /etc directory modified
1003514* - Linux/Unix - File attributes in the /lib directory modified
1003574* - Linux/Unix - File attributes in the /sbin directory modified
1002770* - Linux/Unix - File attributes in the /usr/bin and /usr/sbin directories modified
1008464* - Linux/Unix - File attributes in the /usr/etc, /usr/lib, /usr/lib64, /usr/libexec And /usr/local directories modified
1005193* - Linux/Unix - File attributes modified (ATT&CK T1070.002, T1222.002)
1002771* - Linux/Unix - File permissions in the /var/log directory modified (ATT&CK T1222.002)
1010389* - Linux/Unix - Process running from the /tmp and /var/tmp directories detected (ATT&CK T1543)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
DCERPC Services
1009490* - Block Administrative Share - 1 (ATT&CK T1021.002)
1010426* - Identified Domain-Level Account Discovery Over SMB (ATT&CK T1087.002)
1009703* - Identified Domain-Level Permission Groups Discovery Over SMB (ATT&CK T1069.002)
1010101* - Identified Usage Of PAExec Command Line Tool (ATT&CK T1569.002)
1006906* - Identified Usage Of PsExec Command Line Tool (ATT&CK T1569.002)
1005293* - Prevent Windows Administrator User Login Over SMB (ATT&CK T1078.002,T1078.001,T1021.002)
DCERPC Services - Client
1004373* - Identified DLL Side Loading Attempt Over Network Share (ATT&CK T1574.002)
1010106* - Identified Downloading Of PowerShell Scripts Through SMB Share (ATT&CK T1059.001)
Directory Server LDAP
1010640* - Identified Remote Account Discovery Over LDAP (ATT&CK T1087.002)
1010641* - Identified Remote Permission Groups Discovery Over LDAP (ATT&CK 1069.002)
Remote Desktop Protocol Server
1009562* - Identified Remote Desktop Protocol (RDP) Brute Force Attempt (ATT&CK T1110)
1009343* - Identified Too Many SSL Alert Messages In SSLv3 Over RDP (ATT&CK T1021.001)
Suspicious Client Application Activity
1008946* - Heuristic Detection Of Suspicious Digital Certificate (ATT&CK T1587.003)
1010327* - Identified Potential Malicious Client Traffic (ATT&CK T1071.001)
1005299* - Identified Potentially Malicious RAT Traffic - III (ATT&CK T1571, T1219)
1010307* - Identified Reverse Shell Communication Over HTTPS (ATT&CK T1071.001)
1010306* - Identified Reverse Shell Communication Over HTTPS - 1 (ATT&CK T1071.001)
1010364* - Identified Reverse Shell Communication Over HTTPS - 2 (ATT&CK T1071.001)
1010365* - Identified Reverse Shell Communication Over HTTPS - 3 (ATT&CK T1071.001)
1010370* - Identified Reverse Shell Communication Over HTTPS - 4 (ATT&CK T1071.001)
1009952* - Identified WhatsApp Communication Attempt (ATT&CK T1102.002)
Suspicious Server Application Activity
1003593* - Detected SSH Server Traffic (ATT&CK T1021.004)
1009549* - Detected Terminal Services (RDP) Server Traffic - 1 (ATT&CK T1021.001)
1010328* - Identified Potential Malicious Server Traffic (ATT&CK T1071.001)
Unix SSH
1008313* - Identified Many SSH Client Key Exchange Requests (ATT&CK T1499.002, T1110)
1005748* - Multiple SSH Connections Detected (ATT&CK T1499.002, T1110)
Web Application Common
1011047* - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
1011056 - WordPress 'SP Project & Document Manager' Plugin Remote Code Execution Vulnerability (CVE-2021-24347)
1011043* - WordPress 'XCloner' Plugin Remote Code Execution Vulnerability (CVE-2020-35948)
1011038 - Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability (CVE-2021-20081)
Web Client Common
1011032* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)
1011054 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
1010956 - Microsoft Raw Image Extension Remote Code Execution Vulnerability (ZDI-21-506)
Web Client SharePoint
1011052 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34468)
Web Media Applications
1009913* - Identified Pastebin Communication (ATT&CK T1102.002)
Web Server Common
1010336* - Disallow Upload Of Linux Executable File (ATT&CK T1608.001)
Web Server HTTPS
1011050 - Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2021-34523)
1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)
Web Server Miscellaneous
1011035* - Jenkins 'Generic Webhook Trigger' Plugin External Entity Injection Vulnerability (CVE-2021-21669)
Web Server Nagios
1011022* - Nagios XI Account Email Address Stored Cross-Site Scripting Vulnerability
Web Server SharePoint
1011051 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34520)
1010738* - Restrict Attempt To Enumerate Microsoft SharePoint For User Accounts (ATT&CK T1087.003, T1087.002)
Windows Remote Management
1009894* - Powershell Remote Command Execution Via WinRM - HTTP (Request) (ATT&CK T1021.006, T1059.001)
1010048* - WinRM Service Detected & Powershell RCE Over HTTP (ATT&CK T1021.006, T1059.001)
Windows Remote Management Client
1010073* - WinRM Service Detected & Powershell RCE Over HTTP - Client (ATT&CK T1021.006, T1059.001)
Windows SMB Server
1007065* - Executable File Uploaded On Network Share (ATT&CK T1570)
1011058 - Identified DCERPC EfsRpcOpenFileRaw Call Over SMB Protocol
Windows Services RPC Server DCERPC
1009892* - Identified Domain-Level Credentials Dumping Over DCERPC (ATT&CK T1003.006)
1009480* - Identified WMI Query Over DCE/RPC Protocol (ATT&CK T1047)
Integrity Monitoring Rules:
1003587* - Linux/Unix - Directory attributes of /bin modified (ATT&CK T1222.002)
1002766* - Linux/Unix - Directory attributes of /sbin modified (ATT&CK T1222.002)
1003573* - Linux/Unix - File attributes in the /bin directory modified
1003513* - Linux/Unix - File attributes in the /etc directory modified
1003514* - Linux/Unix - File attributes in the /lib directory modified
1003574* - Linux/Unix - File attributes in the /sbin directory modified
1002770* - Linux/Unix - File attributes in the /usr/bin and /usr/sbin directories modified
1008464* - Linux/Unix - File attributes in the /usr/etc, /usr/lib, /usr/lib64, /usr/libexec And /usr/local directories modified
1005193* - Linux/Unix - File attributes modified (ATT&CK T1070.002, T1222.002)
1002771* - Linux/Unix - File permissions in the /var/log directory modified (ATT&CK T1222.002)
1010389* - Linux/Unix - Process running from the /tmp and /var/tmp directories detected (ATT&CK T1543)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.