Rule Update

19-063 (2019年12月17日)


* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DCERPC Services
1010101 - Identified Usage Of PAExec Command Line Tool (ATT&CK T1035)

DCERPC Services - Client
1010106 - Identify Downloading Of PowerShell Scripts Through SMB Share (ATT&CK T1086)

DNS Client
1010067 - PHP 'dns_get_record' Buffer Overflow Vulnerability (CVE-2019-9022)

Microsoft Office
1010108 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2019-1448)

Trend Micro OfficeScan
1010039* - Trend Micro OfficeScan Directory Traversal Vulnerability (CVE-2019-18187)

TurboVNC Server
1010079 - TurboVNC Fence Message Stack-based Buffer Overflow Vulnerability (CVE-2019-15683)

Web Client Common
1010110 - Microsoft Windows Jet Database Engine Remote Code Execution Vulnerability (CVE-2019-1406)

Windows Remote Management
1010048 - WinRM Service Detected & Powershell RCE Over HTTP (ATT&CK T1028)

Windows Remote Management Client
1010073 - WinRM Service Detected & Powershell RCE Over HTTP - Client (ATT&CK T1028)

Integrity Monitoring Rules:

1010055 - AntiVirus - Trend Micro ApexOne Server
1003744* - AntiVirus - Trend Micro OfficeScan Server

Log Inspection Rules:

1004057* - Microsoft Windows Security Events - 1