概要

* は既存ルールの新バージョンを示します。

DPI(Deep Packet Inspection) ルール:

DNSサーバ
1010613* - Identified DNS Trojan.Win32.Trickbot.Dns Traffic
1010633 - Malware Trojan.Linux.Anchor.A
1010632 - Malware Trojan.Win64.Anchor.A


ディレクトリサーバ LDAP
1010640 - Identified Remote Account Discovery Over LDAP (ATT&CK T1087)
1010641 - Identified Remote Permission Groups Discovery Over LDAP (ATT&CK T1069)
1010433* - Identified Remote System Discovery Over LDAP (ATT&CK T1018, T1033)


Java RMI
1010579 - Adobe ColdFusion 'DataServicesCFProxy ROME' Framework Insecure Deserialization Vulnerability (CVE-2018-4939)
1009766 - Adobe Coldfusion RMI Port Mapper


NFSサーバ
1010604* - Microsoft Windows Network File System Remote Code Execution Vulnerability (CVE-2020-17051)


アプリケーションに関連する不審な活動(クライアント)
1010597* - Identified HTTP Cobalt Strike Malleable C&C Traffic Response (Office 365 Calendar Profile)
1010596* - Identified HTTP Cobalt Strike Malleable C&C Traffic Response (YouTube Profile)
1010617* - Identified TLS Cobalt Strike Beacon (Certificate)


アプリケーションに関連する不審な活動(サーバ)
1010638 - Identified FTP Backdoor.Win32.Qbot.JINX Runtime Detection
1010616* - Identified HTTP Backdoor.Shell.Powertrick.A Runtime Detection
1010608* - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Amazon Profile)
1010637 - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Google Safe Browsing Profile)
1010609* - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Office 365 Calendar Profile)
1010636 - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Pandora GET Profile)
1010639 - Identified HTTP Cobalt Strike Malleable C&C Traffic Request (Pandora POST Profile)
1010614* - Identified HTTP Trickbot Data Exfiltration (Card Payment)
1010615* - Identified HTTP Trickbot Data Exfiltration (Network Module)
1010634 - Identified HTTP Trickbot Data Exfiltration - (Application Credentials Grabber)
1010610* - Identified HTTP Trojan.Win64.BazarTrickbot Traffic
1010611* - Identified HTTP TrojanDownloader.Win64.BazarLoader Traffic
1010607* - Identified TCP Meterpreter Payload


Webアプリケーション 共通
1010635 - Jenkins Groovy Plugin Sandbox Bypass Vulnerability (CVE-2019-1003030)
1010334* - Telerik UI For ASP.NET AJAX Insecure Deserialization Vulnerability (CVE-2019-18935)
1010592* - Zoho ManageEngine ServiceDesk Plus Cross Site Scripting Multiple Vulnerabilities
1010593* - Zoho ManageEngine ServiceDesk Plus Cross Site Scripting Vulnerability (CVE-2019-12543)


Webクライアント 共通
1010622 - Adobe Acrobat Pro DC PDF Export Out-Of-Bounds Read Information Disclosure Vulnerability (CVE-2020-24434)
1010618 - Adobe Acrobat Pro DC PDF Export Out-Of-Bounds Write Remote Code Execution Vulnerability (CVE-2020-24436)
1010619 - Adobe Acrobat Reader DC Out-Of-Bounds Read Information Disclosure Vulnerability (CVE-2020-24426)
1010620 - Adobe Acrobat Reader DC Use-After-Free Information Disclosure Vulnerability (CVE-2020-24438)
1010628 - Google Chrome V8 Memory Corruption Vulnerability (CVE-2020-16009)


Webクライアント Internet Explorer/Edge
1010621 - Microsoft Edge Chakra Array Iterator Type Confusion Vulnerability (CVE-2020-17048)


Webサーバ Apache
1004369* - Apache CXF XML DTD Processing Security Vulnerability
1000630* - Apache htgrep Header Information Leakage
1009045* - Apache httpd 'mod_cache_socache' Denial Of Service Vulnerability (CVE-2018-1303)


Webサーバ 共通
1010099* - Elastic Kibana Timelion Prototype Pollution Vulnerability (CVE-2019-7609)
1010630 - Trend Micro InterScan Web Security Virtual Appliance Command Injection Vulnerability (CVE-2020-8605)


Webサーバ その他
1008134* - Apache Struts Double OGNL Evaluation Remote Code Execution Vulnerability (CVE-2016-0785)
1010627* - Trend Micro InterScan Web Security Virtual Appliance Buffer Overflow Vulnerability (CVE-2020-28578)
1010626* - Trend Micro Interscan Web Security Virtual Appliance 'libuiauutil.so' Buffer Overflow Vulnerability (CVE-2020-28579)


Webサーバ Nagios
1010598* - Nagios XI 'admin_views.inc.php' Arbitrary File Overwrite Vulnerability


Webサーバ Oracle
1010625 - Oracle WebLogic Server IIOP Protocol Insecure Deserialization Vulnerability (CVE-2020-14825)
1010587 - Oracle WebLogic Server IIOP Protocol Remote Code Execution Vulnerability (CVE-2020-14841)
1010624 - Oracle WebLogic Server T3 Protocol Insecure Deserialization Vulnerability (CVE-2020-14825)
1010588 - Oracle WebLogic Server T3 Protocol Remote Code Execution Vulnerability (CVE-2020-14859)


Zoho ManageEngine
1010612 - Zoho ManageEngine Applications Manager SQL Injection Vulnerability (CVE-2020-15927)


変更監視(Integrity Monitoring)ルール:

今回のセキュリティアップデートには、新規の変更監視ルールおよび更新は含まれておりません。


セキュリティログ監視(Log Inspection)ルール:

1010465* - Auditd - Mitre ATT&CK TA0007: Discovery
1010582* - Auditd - Mitre ATT&CK TA0008: Lateral Movement
1010595 - Microsoft LDAP Query Execution
1010139* - Microsoft Windows - Remote Desktop Services (ATT&CK T1021.001)
1002795* - Microsoft Windows Events