Deep Security

  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    DCERPC Services
    1003984* - SMB NTLM Authentication Lack Of Entropy Vulnerability


    DCERPC Services - Client
    1008577 - Microsoft Visio OLE DLL Loading Arbitrary Code Execution Vulnerability Over Network Share (CVE-2016-3235)


    Database MySQL
    1004901* - Identified Suspicious Remote Login To MySQL Server Without Password


    HP Intelligent Management Center (IMC)
    1008764 - HPE Intelligent Management Center Directory Traversal Vulnerabilities


    Trend Micro OfficeScan
    1001050* - Trend Micro OfficeScan Server CGI Module Authentication Bypass


    Web Application PHP Based
    1008858 - Identified Access To 'wp-admin' Directory
    1005725* - PHP 'phar_parse_tarfile' Function Integer Overflow
    1005915* - phpLDAPadmin 'query_engine' Remote PHP Code Injection Vulnerability
    1005947* - phpMyAdmin 'setup.php' PHP Code Injection Vulnerability


    Web Application Tomcat
    1001108* - Apache Tomcat Cookie Handling Single Quotes Vulnerability


    Web Client Common
    1008854* - Adobe Flash Player Remote Code Execution Vulnerability (CVE-2018-4878)
    1008133* - Cisco WebEx Plugin Magic URL Arbitrary Remote Command Execution Vulnerability
    1004596* - Detected Night Dragon Network Communication
    1005001* - Disallow Packed Executable Download Over HTTP
    1003834* - FFmpeg 'lavf_demux' Animated GIF Processing Remote Denial Of Service Vulnerability
    1005269* - Identified Download Of DLL File Over WebDAV
    1004242* - Media Player Classic '.mpcpl' File Remote Denial Of Service Vulnerability
    1008573 - Microsoft Visio OLE DLL Loading Arbitrary Code Execution Vulnerability Over WebDAV (CVE-2016-3235)
    1008838 - Microsoft Windows ITS Protocol Information Disclosure Vulnerability (CVE-2017-11927)
    1004665* - Multiple Browser "res://mshtml.dll" Remote Code Execution
    1008457* - Ransomware Erebus
    1005395* - Restrict Serialized Java Applet
    1002519* - Storm Botnet Redirect Script Insertion Vulnerability


    Web Client Internet Explorer/Edge
    1004021* - IE DHTML Object Memory Corruption Vulnerability
    1005301* - Identified Suspicious JavaScript Encoded Window Location Object
    1003931* - Microsoft Windows Script Host wshom.ocx ActiveX RegWrite Code Execution
    1004626* - Restrict Cisco Secure Desktop ActiveX Control
    1004743* - Restrict Citrix Access Gateway ActiveX Control
    1005822* - Restrict IBM iNotes UploadControl ActiveX Controls
    1005152* - Restrict Microsoft Windows TabStrip ActiveX Control


    Web Client Mozilla Firefox
    1004371* - Mozilla Firefox Obfuscated URLs Within Iframes Vulnerability


    Web Server Common
    1005013* - Restrict Microsoft .Net Executable File Upload


    Web Server Miscellaneous
    1005221* - Identified Suspicious Novell ZENworks Asset Management rtrlet Component Authentication Bypass
    1004874* - TimThumb Plugin Remote Code Execution Vulnerability


    Web Server Oracle
    1003439* - Oracle Application Server 10g OPMN Service Format String Vulnerability


    Web Service HP SiteScope
    1005837* - HP SiteScope "issueSiebelCmd" SOAP Request Detected


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    Web Client Common
    1008854 - Adobe Flash Player Remote Code Execution Vulnerability (CVE-2018-4878)


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    Arcserve Unified Data Protection
    1008711* - Arcserve Unified Data Protection Management Service Information Disclosure Vulnerability (CVE-2015-4069)


    DCERPC Services
    1008380* - Microsoft Windows Group Policy Preferences Password Elevation Of Privilege Vulnerability (CVE-2014-1812)
    1008713* - Microsoft Windows SMB Server SMBv1 Information Disclosure Vulnerability (CVE-2017-11815)
    1008560* - Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2017-8620)


    Database Microsoft SQL
    1008559* - Microsoft SQL Server Buffer Overflow Vulnerability (CVE-2008-0106)


    Directory Server LDAP
    1008459* - Samba NDR Parsing Remote Code Execution Vulnerability (CVE-2016-2123)


    HP Intelligent Management Center (IMC)
    1008806* - HPE Intelligent Management Center FileUploadServlet Directory Traversal Vulnerability (CVE-2017-5794)
    1008686* - HPE Operations Orchestration Deserialization Remote Code Execution Vulnerability (CVE-2016-8519)


    Mail Server Exim
    1008758* - Exim Unix Mailer Multiple Security Vulnerabilities


    NFS Server
    1008802 - Linux Kernel NFSv4 nfsd PNFS Denial Of Service Vulnerability (CVE-2017-8797)


    Network Scanner
    1008800 - Bypass Network Scanner Traffic


    OpenSSL
    1008715* - OpenSSL X.509 IPAddressFamily Extension Parsing Out-Of-Bounds Read Vulnerability (CVE-2017-3735) - Server


    Oracle Tuxedo JOLT
    1008798* - Oracle Tuxedo Jolt Heap Buffer Overflow Vulnerability (CVE-2017-10278)
    1008845* - Oracle Tuxedo Remote Security Vulnerability (CVE-2017-10269)


    Symantec Messaging Gateway
    1008741* - Symantec Messaging Gateway Remote Code Execution Vulnerability (CVE-2017-6326)


    Trend Micro Control Manager
    1008760* - Trend Micro Control Manager SQL Injection Vulnerability (CVE-2017-11383)
    1008589* - Trend Micro Control Manager cmdHandlerLicenseManager SQL Injection Vulnerability (CVE-2017-11384)


    Unix Samba
    1008644* - Samba Arbitrary File Write Vulnerability (CVE-2017-12163)


    Web Server Common
    1008724* - Trend Micro SafeSync For Enterprise 'device_id' 'role' Command Injection Vulnerability
    1008723* - Trend Micro SafeSync For Enterprise Command Injection Vulnerability


    Web Server Miscellaneous
    1008747 - Adobe ColdFusion RMI Registry Insecure Deserialization (CVE-2017-11284)
    1008673* - IBM Informix Open Admin Tool Heap Buffer Overflow Vulnerability (CVE-2017-1092)
    1008674* - IBM Informix Open Admin Tool Remote Code Execution Vulnerability (CVE-2017-1092)


    Web Server Oracle
    1008808* - Oracle WebLogic WLS Security Component Remote Code Execution Vulnerabilities


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    1002828* - Application - Secure Shell Daemon (SSHD)
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    DCERPC Services
    1003292* - Block Conficker.B++ Worm Incoming Named Pipe Connection
    1004807* - Identified SMB Raw Named Pipe In Write Mode


    DCERPC Services - Client
    1007494* - Adobe Acrobat DLL Loading Arbitrary Code Execution Vulnerability (CVE-2016-1008)
    1003293* - Block Conficker.B++ Worm Outgoing Named Pipe Connection
    1004373* - Identified Microsoft DLL File Over Network Share
    1007426* - Microsoft Windows DLL Loading Vulnerabilities Over Network Share (MS16-014)


    Database MySQL
    1005063* - Restrict MySQL Database Access


    Database Oracle
    1004995* - Oracle Database TNS Listener Poison Attack Vulnerability


    FTP Server Common
    1003784* - FTP Server Restrict Executable File Uploads
    1005461* - Identified FTP Connection Without AUTH Command


    HP Intelligent Management Center (IMC)
    1008806 - HPE Intelligent Management Center FileUploadServlet Directory Traversal Vulnerability (CVE-2017-5794)


    HP Intelligent Management Center Dbman
    1008790 - HPE Intelligent Management Center dbman Opcode 10012 Use-After-Free Remote Code Execution Vulnerability (CVE-2017-12561)


    Mail Server Exim
    1008758* - Exim Unix Mailer Multiple Security Vulnerabilities


    Microsoft Office
    1004853* - Identified Suspicious Microsoft Office Files With Embedded Font
    1005615* - Identified Suspicious Usage Of Shellcode In Microsoft Office Files
    1004647* - Restrict Microsoft Office File With Embedded SWF
    1005158* - Restrict Microsoft Office Files With Embedded SWF - 2


    Novell File Reporter (NFR) Agent
    1005260* - Novell File Reporter SRS XML Server Request With Path Element Detected


    Oracle Tuxedo JOLT
    1008845 - Oracle Tuxedo Remote Security Vulnerability (CVE-2017-10269)


    Suspicious Client Application Activity
    1005067* - Identified Potentially Harmful Client Traffic
    1005283* - Identified Potentially Malicious RAT Traffic - I
    1005299* - Identified Potentially Malicious RAT Traffic - III
    1005300* - Identified Potentially Malicious RAT Traffic - IV
    1005473* - Identified Potentially Malicious RAT Traffic - V


    Suspicious Server Application Activity
    1005090* - Identified Potentially Harmful Server Traffic


    Unix SSH
    1000798* - Unix OpenSSH sshd Identical Blocks DoS


    Web Application Common
    1004888* - Restrict Number Of Parameters In HTTP Request


    Web Application PHP Based
    1005465* - Identified Access To WordPress Sensitive Files
    1006021* - Joomla JCE Extension Multiple Vulnerabilities
    1000208* - SquirrelMail IMAP Command Injection Vulnerability
    1000209* - SquirrelMail SMTP Command Injection Vulnerability
    1006432* - WordPress Slider Revolution Responsive/Showbiz Pro Responsive Teaser Multiple Security Bypass Vulnerabilities


    Web Client Common
    1008833 - Foxit Reader JPEG2000 Out-Of-Bounds Read Information Disclosure Vulnerabilities
    1005389* - Identified Suspicious Download Of Executable File Over HTTP
    1004900* - Identified Suspicious Microsoft Office Files With Embedded Objects


    Web Client Internet Explorer/Edge
    1004339* - Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability


    Web Server Common
    1008724* - Trend Micro SafeSync For Enterprise 'device_id' 'role' Command Injection Vulnerability
    1008723* - Trend Micro SafeSync For Enterprise Command Injection Vulnerability


    Web Server Miscellaneous
    1008673 - IBM Informix Open Admin Tool Heap Buffer Overflow Vulnerability (CVE-2017-1092)


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    Arcserve Unified Data Protection
    1008711 - Arcserve Unified Data Protection Management Service Information Disclosure Vulnerability (CVE-2015-4069)


    DCERPC Services
    1008327* - Identified Server Suspicious SMB Session
    1008558* - Identified Windows Search Protocol Network Traffic Over SMB
    1008380 - Microsoft Windows Group Policy Preferences Password Elevation Of Privilege Vulnerability (CVE-2014-1812)
    1008225* - Microsoft Windows SMB Remote Code Execution Vulnerability (CVE-2017-0145)
    1008713 - Microsoft Windows SMB Server SMBv1 Information Disclosure Vulnerability (CVE-2017-11815)
    1008560* - Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2017-8620)
    1000735* - Microsoft Windows Server Service Remote Code Execution


    DCERPC Services - Client
    1007592* - Microsoft Windows DLL Loading Vulnerabilities Over Network Share (CVE-2016-0160 and CVE-2016-0148)


    Database Microsoft SQL
    1008559 - Microsoft SQL Server Buffer Overflow Vulnerability (CVE-2008-0106)


    Directory Server LDAP
    1008459 - Samba NDR Parsing Remote Code Execution Vulnerability (CVE-2016-2123)


    HP Intelligent Management Center (IMC)
    1008748* - HPE Intelligent Management Center PLAT flexFileUpload Arbitrary File Upload Vulnerability (CVE-2017-8961)
    1008686 - HPE Operations Orchestration Deserialization Remote Code Execution Vulnerability (CVE-2016-8519)


    Microsoft Office
    1008839 - Microsoft Office Memory Corruption Vulnerability (CVE-2018-0802)


    NTP Client
    1008632* - Identified Zero Origin Timestamp In NTP Traffic


    NTP Server Linux
    1008320* - Network Time Protocol Daemon 'peer_xmit' Mode Denial Of Service Vulnerability (CVE-2017-6464)


    OpenSSL
    1008715* - OpenSSL X.509 IPAddressFamily Extension Parsing Out-Of-Bounds Read Vulnerability (CVE-2017-3735) - Server


    Oracle Tuxedo JOLT
    1008798 - Oracle Tuxedo Jolt Heap Buffer Overflow Vulnerability (CVE-2017-10278)


    RADIUS Server
    1008614* - FreeRADIUS Heap Buffer Overflow Vulnerability (CVE-2017-10984)


    SSL Client
    1008714* - OpenSSL X.509 IPAddressFamily Extension Parsing Out-Of-Bounds Read Vulnerability (CVE-2017-3735) - Client


    Symantec Messaging Gateway
    1008741 - Symantec Messaging Gateway Remote Code Execution Vulnerability (CVE-2017-6326)


    Trend Micro Control Manager
    1008760 - Trend Micro Control Manager SQL Injection Vulnerability (CVE-2017-11383)
    1008589 - Trend Micro Control Manager cmdHandlerLicenseManager SQL Injection Vulnerability (CVE-2017-11384)


    Unix RPC Services
    1008433* - Solaris Calendar Manager Service Daemon (rpc.cmsd) Remote Code Execution Vulnerability (CVE-2017-3632)


    Unix Samba
    1008644 - Samba Arbitrary File Write Vulnerability (CVE-2017-12163)


    Web Application PHP Based
    1008550* - PHP 'imagegammacorrect' Function Arbitrary Write Access vulnerability (CVE-2016-7127)
    1008520* - PHP Malicious Object Injection In Deserialization Vulnerability (CVE-2016-7124)
    1008562* - PHP libgd Signedness Heap Overflow Vulnerability (CVE-2016-3074)


    Web Application Ruby Based
    1008574* - Ruby On Rails Development Web Console Code Execution Vulnerability (CVE-2015-3224)


    Web Client Common
    1008736* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB17-36) - 6
    1008738* - Adobe Flash Player Multiple Security Vulnerabilities (APSB17-33)
    1008726 - Foxit Reader Multiple Use-After-Free Remote Code Execution Vulnerabilities
    1007931* - Microsoft Windows Information Disclosure Vulnerability (CVE-2016-3352)
    1008828* - Speculative Execution Information Disclosure Vulnerabilities (Spectre)


    Web Client Internet Explorer/Edge
    1008836 - Microsoft Edge Scripting Engine Information Disclosure Vulnerability (CVE-2018-0767)
    1008704* - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2017-11840)
    1008706* - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2017-11873)
    1008697* - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2017-11855)


    Web Server Miscellaneous
    1008794* - Apache Struts2 Jackson JSON Library Deserializer Remote Code Execution Vulnerability (CVE-2017-7525)
    1008207* - Apache Struts2 Remote Code Execution Vulnerability (CVE-2017-5638)
    1008674 - IBM Informix Open Admin Tool Remote Code Execution Vulnerability (CVE-2017-1092)


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    DCERPC Services
    1008717* - Microsoft Windows Search Remote Code Execution Vulnerability (CVE-2017-11771)


    DCERPC Services - Client
    1007369* - Microsoft Windows DLL Loading Vulnerabilities Over Network Share (MS16-007)


    DNS Client
    1002657* - Identified Too Many DNS Responses
    1008793 - systemd Network Name Resolution Manager NSEC Resource Record Pseudo-Types Denial Of Service Vulnerability (CVE-2017-15908)


    Microsoft Office
    1008831 - Microsoft Word Memory Corruption Vulnerability (CVE-2018-0797)


    Web Application PHP Based
    1008518* - PHP Double Free Memory Corruption Vulnerability (CVE-2016-5772)


    Web Client Common
    1008830 - Adobe Flash Player Memory Corruption Vulnerability (APSB18-01)


    Web Server Common
    1008724 - Trend Micro SafeSync For Enterprise 'device_id' 'role' Command Injection Vulnerability
    1008723 - Trend Micro SafeSync For Enterprise Command Injection Vulnerability


    Web Server Miscellaneous
    1008794 - Apache Struts2 Jackson JSON Library Deserializer Remote Code Execution Vulnerability (CVE-2017-7525)


    Web Server Oracle
    1008808* - Oracle WebLogic WLS Security Component Remote Code Execution Vulnerabilities


    Integrity Monitoring Rules:

    1008720 - Users and Groups - Create and Delete Activity


    Log Inspection Rules:

    1008619 - Application - Docker
    1003843* - Microsoft Windows Security Events
    1004057* - Microsoft Windows Security Events - 1
    1003987* - Microsoft Windows Security Events - 2
    1008670* - Microsoft Windows Security Events - 3
    1008792* - Microsoft Windows Security Events - 4
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    Web Client Common
    1008828 - Speculative Execution Information Disclosure Vulnerabilities (Spectre)


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    Web Client Internet Explorer/Edge
    1008826 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0758)
    1008825 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0769)
    1008824 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0773)
    1008821 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0774)
    1008822 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0775)
    1008820 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0776)
    1008819 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0777)
    1008823 - Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-0762)


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    Microsoft Office
    1008801 - Microsoft Office Memory Corruption Vulnerability (CVE-2017-11884)


    NTP Server Linux
    1008320 - Network Time Protocol Daemon 'peer_xmit' Mode Denial Of Service Vulnerability (CVE-2017-6464)


    RADIUS Server
    1008614 - FreeRADIUS Heap Buffer Overflow Vulnerability (CVE-2017-10984)


    Web Client Common
    1008656* - Microsoft JET Database Engine Remote Code Execution Vulnerability (CVE-2017-8718)
    1008805 - Microsoft JET Database Engine Remote Code Execution Vulnerability (CVE-2017-8718) - 1


    Web Client Internet Explorer/Edge
    1008803 - Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2017-11812)
    1008616* - Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2017-8641)
    1008698* - Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2017-11856)


    Web Server Oracle
    1008808 - Oracle WebLogic WLS Security Component Remote Code Execution Vulnerabilities


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    HP Intelligent Management Center (IMC)
    1008748 - HPE Intelligent Management Center PLAT flexFileUpload Arbitrary File Upload Vulnerability (CVE-2017-8961)


    Unix RPC Services
    1008314* - Oracle Solaris Remote Code Execution Vulnerability (CVE-2017-3623)


    Web Application PHP Based
    1008518 - PHP Double Free Memory Corruption Vulnerability (CVE-2016-5772)
    1008520 - PHP Malicious Object Injection In Deserialization Vulnerability (CVE-2016-7124)


    Web Client Internet Explorer/Edge
    1008636* - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2017-11793)


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.