Trend Micro Deep Security™️およびDPIルール等の関連情報

  • * は既存ルールの新バージョンを示します。

    DPI(Deep Packet Inspection) ルール:

    Memcached
    1011097 - Oracle MySQL Integer Underflow Vulnerability (CVE-2021-2389)


    Microsoft Office
    1011181 - Microsoft Office Visio Remote Code Execution Vulnerability (CVE-2021-40480)
    1011182 - Microsoft Office Visio Remote Code Execution Vulnerability (CVE-2021-40481)
    1011184 - Microsoft Word Remote Code Execution Vulnerability (CVE-2021-40486)


    Webアプリケーション 共通
    1011173* - WordPress 'Redirect 404 To Parent' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24286)
    1011174* - WordPress 'Select All Categories and Taxonomies' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24287)


    Webクライアント 共通
    1011175 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-104) - 1
    1011176 - Adobe Acrobat And Reader Use After Free Vulnerability (CVE-2021-40730)


    Webサーバ Apache
    1011183 - Apache HTTP Server Server-Side Request Forgery Vulnerability (CVE-2021-40438)


    Webサーバ HTTPS
    1011172* - WordPress 'TranslatePress' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24610)


    Webサーバ その他
    1011177 - Atlassian Confluence Server Arbitrary File Read Vulnerability (CVE-2021-26085)
    1011179 - Atlassian Jira Path Traversal Vulnerability (CVE-2021-26086)


    変更監視(Integrity Monitoring)ルール:

    今回のセキュリティアップデートには、新規の変更監視ルールおよび更新は含まれておりません。


    セキュリティログ監視(Log Inspection)ルール:

    1002828* - Application - Secure Shell Daemon (SSHD)
    1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
    1004057* - Microsoft Windows Security Events - 1
  • * は既存ルールの新バージョンを示します。

    DPI(Deep Packet Inspection) ルール:

    DCERPCサービス
    1008422* - Detected SMB Request


    DCERPCサービス - クライアント
    1010585* - Identified Possible Ransomware File Extension Create Activity Over Network Share - Client (ATT&CK T1486, T1080)


    Trend Micro OfficeScan
    1010709* - Trend Micro Apex One Multiple Information Disclosure Vulnerabilities (CVE-2020-28573 and CVE-2020-28576)
    1010708* - Trend Micro OfficeScan Multiple Information Disclosure Vulnerabilities (CVE-2020-28582 and CVE-2020-28583)


    Webアプリケーション 共通
    1011171 - Apache HTTP Server Directory Traversal Vulnerability (CVE-2021-41773 and CVE-2021-42013)
    1011170 - WordPress 'Contact Form' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24276)
    1011173 - WordPress 'Redirect 404 To Parent' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24286)
    1011174 - WordPress 'Select All Categories and Taxonomies' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24287)


    Webアプリケーション PHP
    1011143* - WordPress 'ProfilePress' Plugin Privilege Escalation Vulnerability (CVE-2021-34621)


    Webサーバ 共通
    1011110 - Identified Slow HTTP Denial Of Service Attack (ATT&CK T1498.001)


    Webサーバ HTTPS
    1011161* - Centreon 'graph-split.php' SQL Injection Vulnerability
    1011166* - GitLab Stored Cross-Site Scripting Vulnerability (CVE-2021-22242)
    1011167* - VMware vCenter Server File Upload Vulnerability (CVE-2021-22005)
    1011120* - WebSVN Command Injection Vulnerability (CVE-2021-32305)
    1011169 - WordPress 'Supsystic Popup' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24275)
    1011168 - WordPress 'Supsystic Ultimate Maps' Plugin Reflected Cross-Site Scripting Vulnerability (CVE-2021-24274)
    1011172 - WordPress 'TranslatePress' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24610)


    Webサーバ Nagios
    1011164* - Nagios XI Stored Cross-Site Scripting Vulnerability (CVE-2021-38156)


    Zoho ManageEngine
    1011162* - Zoho ManageEngine OpManager 'GetDataCollectionFailureReason' SQL Injection Vulnerability (CVE-2021-40493)


    変更監視(Integrity Monitoring)ルール:

    今回のセキュリティアップデートには、新規の変更監視ルールおよび更新は含まれておりません。


    セキュリティログ監視(Log Inspection)ルール:

    1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
  • * は既存ルールの新バージョンを示します。

    DPI(Deep Packet Inspection) ルール:

    Azure Open Management Infrastructure Tool
    1011147* - Open Management Infrastructure Remote Code Execution Vulnerability (CVE-2021-38647)


    DCERPCサービス
    1010164* - Identified Possible Ransomware File Extension Create Activity Over Network Share (ATT&CK T1486, T1080)


    DCERPCサービス - クライアント
    1010585* - Identified Possible Ransomware File Extension Create Activity Over Network Share - Client (ATT&CK AT1486, T1080)


    ディレクトリサーバ LDAP
    1011008* - OpenLDAP Integer Underflow Vulnerability (CVE-2020-36221)


    Trend Micro ServerProtect EarthAgent
    1011157* - Trend Micro ServerProtect Authentication Bypass Vulnerability (CVE-2021-36745)


    Webアプリケーション 共通
    1011155* - FlatCore CMS Remote Code Execution Vulnerability (CVE-2021-39608)
    1011103* - PHPUnit Remote Code Execution Vulnerability (CVE-2017-9841)
    1010942* - WordPress XML External Entity Injection Vulnerability (CVE-2021-29447)


    Webアプリケーション PHP
    1011143 - WordPress 'ProfilePress' Plugin Privilege Escalation Vulnerability (CVE-2021-34621)


    Webクライアント 共通
    1011129* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 1
    1011127* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 2


    Webサーバ HTTPS
    1011156* - Centreon 'componentTemplates.php' SQL Injection Vulnerability
    1011161 - Centreon 'graph-split.php' SQL Injection Vulnerability
    1011158* - Detected VMware vCenter Server Analytics Service Access
    1011166 - GitLab Stored Cross-Site Scripting Vulnerability (CVE-2021-22242)
    1011167 - VMware vCenter Server File Upload Vulnerability (CVE-2021-22005)
    1011120* - WebSVN Command Injection Vulnerability (CVE-2021-32305)
    1011165 - WordPress 'Woo-Order-Export-Lite' Plugin Reflected Cross-Site Scripting Vulnerability (CVE-2021-24169)


    Webサーバ その他
    1011153* - FasterXML jackson-databind Malicious JSON Objects Multiple Remote Code Execution Vulnerabilities
    1011163 - Spring Boot Actuator Directory Traversal Vulnerability (CVE-2021-21234)


    Webサーバ Nagios
    1011164 - Nagios XI Stored Cross-Site Scripting Vulnerability (CVE-2021-38156)


    Webサーバ Oracle
    1011086* - Oracle Business Intelligence 'Scheduler' Remote Code Execution Vulnerability (CVE-2021-2391)
    1011084* - Oracle Business Intelligence 'UpdateConnectionServlet' Remote Code Execution Vulnerability (CVE-2021-2396)
    1011096* - Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2021-2394)


    Webサーバ SharePoint
    1011123* - Microsoft SharePoint WorkflowCompilerInternal Remote Code Execution Vulnerability (CVE-2021-26420)


    Webサーバ Squid
    1011159 - Squid HTTP Request Smuggling Vulnerability (CVE-2019-18678)


    Zoho ManageEngine
    1011162 - Zoho ManageEngine OpManager 'GetDataCollectionFailureReason' SQL Injection Vulnerability (CVE-2021-40493)


    変更監視(Integrity Monitoring)ルール:

    1005193* - Linux/Unix - File attributes modified (ATT&CK T1070.002, T1222.002)
    1011116* - Linux/Unix - Kernel modules loading configuration modified (ATT&CK T1547.006)
    1010798* - Linux/Unix - Local user and group files modified (ATT&CK T1136.001, T1531)
    1010422* - Linux/Unix - SCP process detected (ATT&CK T1048.001, T1105)
    1011070* - Linux/Unix - SSH authorized_keys file modified - non-root users (ATT&CK T1021.004, T1098.004, T1563.001)
    1011068* - Linux/Unix - SSH authorized_keys file modified - root user (ATT&CK T1021.004, T1098.004, T1563.001)
    1011069* - Linux/Unix - SSH authorized_keys file modified - systemwide (ATT&CK T1021.004, T1098.004, T1563.001)
    1011111* - Linux/Unix - Users and Groups - Create and Delete Activity (ATT&CK T1136)
    1010825* - Linux/Unix - adduser, useradd and deluser configuration files modified (ATT&CK T1136.001, T1531)
    1010808* - Linux/Unix - bash configuration files modified (ATT&CK T1059.004, T1546.004)
    1010827* - Linux/Unix - csh/tcsh configuration files modified (ATT&CK T1059.004, T1546.004)
    1010828* - Linux/Unix - zsh configuration files modified (ATT&CK T1059.004, T1546.004)
    1009626* - Microsoft Windows - Accessibility features registry keys or files modified (ATT&CK T1546.008, T1546.012)
    1011151* - Microsoft Windows - Active directory registry keys modified (ATT&CK T1112)
    1005195* - Microsoft Windows - Attributes of log file modified (ATT&CK T1070, T1222.001)
    1002781* - Microsoft Windows - Attributes of services modified (ATT&CK T1036.004, T1543.003)
    1002767* - Microsoft Windows - Attributes of system32 directory modified (ATT&CK T1222)
    1011144* - Microsoft Windows - AutoRun registries modified (ATT&CK T1547.001)
    1011146* - Microsoft Windows - Autostart execution registries modified (ATT&CK T1547.001)
    1011145* - Microsoft Windows - Boot or Logon Autostart Execution registries modified (ATT&CK T1547.004, T1547.014)
    1003367* - Microsoft Windows - DHCP server files directory and service modified (ATT&CK T1036.003, T1222.001)
    1002869* - Microsoft Windows - DNS Server (ATT&CK T1554, T1584.002)
    1011148* - Microsoft Windows - Files in appdata startup folder modified (ATT&CK T1547.001)
    1011149* - Microsoft Windows - Files in programdata startup folder modified (ATT&CK T1547.001)
    1011150* - Microsoft Windows - Files in start menu directory modified (ATT&CK T1547.001)
    1002780* - Microsoft Windows - Installed software attributes modified (ATT&CK T1195.002, T1554)
    1002786* - Microsoft Windows - Microsoft hotfixes registry keys modified (ATT&CK T1112)
    1011142* - Microsoft Windows - Network services registries modified (ATT&CK T1547.001, T1574.001)
    1011071* - Microsoft Windows - OpenSSH registry keys modified (ATT&CK T1021.004, T1112)
    1011092* - Microsoft Windows - OpenSSH server configuration file modified (ATT&CK T1021.004)
    1002787* - Microsoft Windows - Registry values of event log modified (ATT&CK T1070.001, T1562.002)
    1002776* - Microsoft Windows - Startup Programs Modified (ATT&CK T1060, T1112)
    1002778* - Microsoft Windows - System .dll or .exe files modified (ATT&CK T1036.003, T1222.001)
    1008257* - Microsoft Windows - USB storage device detected (ATT&CK T1052.001, T1092)
    1008720* - Microsoft Windows - Users and Groups - Create and Delete Activity (ATT&CK T1136)
    1011141* - Microsoft Windows - Windows file protection registry modified (ATT&CK T1112, T1546.008)
    1007221* - TMTR-0026: Suspicious Files Detected In Program Files Folder


    セキュリティログ監視(Log Inspection)ルール:

    今回のセキュリティアップデートには、新規のセキュリティログ監視ルールおよび更新は含まれておりません。
  • * は既存ルールの新バージョンを示します。

    DPI(Deep Packet Inspection) ルール:

    DCERPCサービス - クライアント
    1004304* - Identified Suspicious Microsoft Windows Shortcut File Over Network Share (ATT&CK T1080)


    Trend Micro ServerProtect EarthAgent
    1011157 - Trend Micro ServerProtect Authentication Bypass Vulnerability (CVE-2021-36745)


    Webアプリケーション 共通
    1011155 - FlatCore CMS Remote Code Execution Vulnerability (CVE-2021-39608)
    1011103* - PHPUnit Remote Code Execution Vulnerability (CVE-2017-9841)


    Webアプリケーション PHP
    1011154* - Identified WordPress 'wp-login.php' Brute Force Attempt


    Webクライアント 共通
    1011126 - Microsoft MSHTML Remote Code Execution Vulnerability (CVE-2021-40444)


    Webサーバ 共通
    1011118* - Centreon 'csv_HostGroupLogs.php' SQL Injection Vulnerability (CVE-2021-37556)


    Webサーバ HTTPS
    1011156 - Centreon 'componentTemplates.php' SQL Injection Vulnerability
    1011132* - Centreon 'metaService.php' SQL Injection Vulnerability
    1011158 - Detected VMware vCenter Server Analytics Service Access
    1011072* - Microsoft Exchange Server Security Feature Bypass Vulnerability (CVE-2021-31207)
    1011120 - WebSVN Command Injection Vulnerability (CVE-2021-32305)
    1011100* - WordPress 'WooCommerce Blocks' Plugin SQL Injection Vulnerability (CVE-2021-32789)


    Webサーバ その他
    1011153 - FasterXML jackson-databind Malicious JSON Objects Multiple Remote Code Execution Vulnerabilities


    Webサーバ Nagios
    1011131* - Nagios XI Bulk Modification Tool SQL Injection Vulnerability (CVE-2021-37350)


    Webサーバ SharePoint
    1011123 - Microsoft SharePoint WorkflowCompilerInternal Remote Code Execution Vulnerability (CVE-2021-26420)


    変更監視(Integrity Monitoring)ルール:

    1005193* - Linux/Unix - File attributes modified (ATT&CK T1070.002, T1222.002)


    セキュリティログ監視(Log Inspection)ルール:

    1004488* - Database Server - Microsoft SQL
    1003802* - Directory Server - Microsoft Windows Active Directory
    1010595* - Microsoft LDAP Query Execution
    1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
  • * は既存ルールの新バージョンを示します。

    DPI(Deep Packet Inspection) ルール:

    Azure Open Management Infrastructure Tool
    1011147 - Open Management Infrastructure Remote Code Execution Vulnerability (CVE-2021-38647)


    DCERPCサービス
    1011105* - Identified File Deletion From SMB Share (ATT&CK T1070.004)


    Microsoft Office
    1011135 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2021-38655)
    1011137 - Microsoft Office Graphics Remote Code Execution Vulnerability (CVE-2021-38658)
    1011121 - Microsoft Office Remote Code Execution Vulnerability (CVE-2021-34478)
    1011138 - Microsoft Office Remote Code Execution Vulnerability (CVE-2021-38659)
    1011134 - Microsoft Office Visio Remote Code Execution Vulnerability (CVE-2021-38653)
    1011136 - Microsoft Word Remote Code Execution Vulnerability (CVE-2021-38656)


    Webアプリケーション PHP
    1011154 - Identified WordPress 'wp-login.php' Brute Force Attempt
    1010642* - WordPress XMLRPC Brute Force Amplification Attack


    Webクライアント 共通
    1011129* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 1
    1011130* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 3
    1011140 - Google Chrome Use After Free Vulnerability (CVE-2020-6550)
    1011139 - Google Chrome V8 Type Confusion Vulnerability (CVE-2021-30561)
    1011080 - Microsoft 3D Viewer Remote Code Execution Vulnerability (ZDI-CAN-13085)
    1011133 - Microsoft Visual Studio Remote Code Execution Vulnerability (CVE-2021-36952)


    Webサーバ 共通
    1011118 - Centreon 'csv_HostGroupLogs.php' SQL Injection Vulnerability (CVE-2021-37556)
    1011113* - Nagios XI Remote Command Injection Vulnerability (CVE-2021-37346)


    Webサーバ HTTPS
    1011132 - Centreon 'metaService.php' SQL Injection Vulnerability


    Webサーバ Nagios
    1011131 - Nagios XI Bulk Modification Tool SQL Injection Vulnerability (CVE-2021-37350)


    Webサーバ Oracle
    1011083* - Oracle Business Intelligence 'BIRemotingServlet' Insecure Deserialization Vulnerability (CVE-2021-2456)
    1011086* - Oracle Business Intelligence 'Scheduler' Remote Code Execution Vulnerability (CVE-2021-2391)
    1011084* - Oracle Business Intelligence 'UpdateConnectionServlet' Remote Code Execution Vulnerability (CVE-2021-2396)


    Windowsサービス RPCサーバ DCERPC
    1009892* - Identified Domain-Level Information Dumping Over DCERPC (ATT&CK T1003.006, T1018)


    変更監視(Integrity Monitoring)ルール:

    1011152 - Microsoft Windows - Active directory files modified (ATT&CK T1552.006)
    1011151 - Microsoft Windows - Active directory registry keys modified (ATTACK T1112)
    1011144 - Microsoft Windows - AutoRun registries modified (ATT&CK T1547.001)
    1011146 - Microsoft Windows - Autostart execution registries modified (ATT&CK T1547.001)
    1011145 - Microsoft Windows - Boot or Logon Autostart Execution registries modified (ATT&CK T1547.014, T1547.004)
    1011148 - Microsoft Windows - Files in appdata startup folder modified (ATT&CK T1547.001)
    1011149 - Microsoft Windows - Files in programdata startup folder modified (ATT&CK T1547.001)
    1011150 - Microsoft Windows - Files in start menu directory modified (ATT&CK T1547.001)
    1011142 - Microsoft Windows - Network services registries modified (ATT&CK T1574.001, T1547.001)
    1002860* - Microsoft Windows - SAM registry keys modified (ATT&CK T1098, T1136)
    1011141 - Microsoft Windows - Windows file protection registry modified (ATT&CK T1546.008, T1112)
    1006800* - TMTR-0002: Suspicious Files Detected In Operating System Directories (ATT&CK T1053.005)
    1006798* - TMTR-0005: Suspicious Files Detected In Application Directories (ATT&CK T1562.001)
    1006796* - TMTR-0007: Suspicious Files Detected In Application Directories (ATT&CK T1574.002)
    1006799* - TMTR-0014: Suspicious Service Detected (ATT&CK T1543.003)
    1006684* - TMTR-0015: Suspicious Service Detected (ATT&CK T1543.003)
    1006691* - TMTR-0017: Microsoft Windows - SAM Domain Account Users Modification Detected (ATT&CK T1098, T1136)
    1007214* - TMTR-0019: Suspicious Files Detected In System Drivers Directory (ATT&CK T1014)
    1007218* - TMTR-0023: Suspicious Changes In NTLM Settings (ATT&CK T1547.005)
    1010515* - Vulnerability - Trend Micro ServerProtect For Linux Command Execution Vulnerability (CVE-2020-24561)


    セキュリティログ監視(Log Inspection)ルール:

    1002828* - Application - Secure Shell Daemon (SSHD)
    1008852* - Auditd
    1003802* - Directory Server - Microsoft Windows Active Directory
    1010595* - Microsoft LDAP Query Execution
    1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
    1002795* - Microsoft Windows Events
    1010095* - Microsoft Windows Management Instrumentation Events
    1003987* - Microsoft Windows Security Events - 2
    1008792* - Microsoft Windows Security Events - 4
    1002831* - Unix - Syslog
    1003447* - Web Server - Apache
    1002835* - Web Server - Web Access Events
  • * は既存ルールの新バージョンを示します。

    DPI(Deep Packet Inspection) ルール:

    Webアプリケーション 共通
    1011124 - Ghostscript Remote Code Execution Vulnerability (Sep 2021)


    Webクライアント 共通
    1009440* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB18-41) - 4
    1011129 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 1
    1011127 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 2
    1011130 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-55) - 3
    1011128 - Adobe Acrobat And Reader Type Confusion Vulnerability (CVE-2021-39841)
    1011125 - Ghostscript Remote Code Execution Vulnerability (Sep 2021) - 1


    Webサーバ 共通
    1011109* - Nagios XI 'Switch.inc.php' Command Injection Vulnerability (CVE-2021-37344)
    1011113 - Nagios XI Remote Command Injection Vulnerability (CVE-2021-37346)


    Webサーバ その他
    1011117* - Atlassian Confluence Server Remote Code Execution Vulnerability (CVE-2021-26084)


    Webサーバ Oracle
    1011083 - Oracle Business Intelligence 'BIRemotingServlet' Insecure Deserialization Vulnerability (CVE-2021-2456)
    1011086 - Oracle Business Intelligence 'Scheduler' Remote Code Execution Vulnerability (CVE-2021-2391)
    1011084 - Oracle Business Intelligence 'UpdateConnectionServlet' Remote Code Execution Vulnerability (CVE-2021-2396)
    1011085* - Oracle Business Intelligence Arbitrary File Upload Vulnerability (CVE-2021-2392)
    1011081* - Oracle Business Intelligence Publisher XML External Entity Injection Vulnerability (CVE-2021-2401)


    変更監視(Integrity Monitoring)ルール:

    1005711* - Application - Apache Hadoop
    1003388* - Application - CacheFS
    1008271* - Application - Docker
    1003166* - Application - IBM WebSphere Application Server
    1003333* - Application - Kerberos
    1003381* - Application - Mailman
    1003339* - Application - NFS
    1003360* - Application - Network Information Server
    1003370* - Application - OpenSSL
    1003167* - Application - Oracle Bea WebLogic Server
    1003374* - Application - PHP
    1003359* - Application - Portmapper
    1003375* - Application - Postfix
    1003334* - Application - Samba
    1003386* - Application - VNC Server
    1003385* - Application - Xorg-x / XFree86 / Xfree86 / Xorg-x11
    1007295* - Application - chrony
    1003338* - Application - mountd
    1003361* - Application - rstatd
    1003372* - Application - telnetd
    1003357* - Application - vixie-cron
    1002788* - Microsoft Windows - 'ActiveX Compatibility' registry keys modified (ATT&CK T1112)
    1002773* - Microsoft Windows - 'Hosts' file modified
    1009626* - Microsoft Windows - Accessibility features registry keys or files modified (ATT&CK T1546.008, T1546.012)
    1005195* - Microsoft Windows - Attributes of log file modified (ATT&CK T1222.001, T1070)
    1002767* - Microsoft Windows - Attributes of system32 directory modified
    1003367* - Microsoft Windows - DHCP server files directory and service modified (ATT&CK T1036.003, T1222.001)
    1002869* - Microsoft Windows - DNS Server (ATT&CK T1584.002, T1554)
    1002783* - Microsoft Windows - Default Debugger changed
    1002780* - Microsoft Windows - Installed software attributes modified (ATT&CK T1195.002, T1554)
    1002786* - Microsoft Windows - Microsoft hotfixes registry keys modified (ATT&CK T1112)
    1002775* - Microsoft Windows - Network configuration files modified
    1002787* - Microsoft Windows - Registry values of event log modified (ATT&CK T1562.002, T1070.001)
    1002778* - Microsoft Windows - System .dll or .exe files modified (ATT&CK T1036.003, T1222.001)
    1002777* - Microsoft Windows - System configuration file modified
    1003517* - Microsoft Windows - System driver files modified
    1006076* - Microsoft Windows - Task scheduler entries modified (ATT&CK T1053.005)
    1008257* - Microsoft Windows - USB storage device detected (ATT&CK T1092, T1052.001)
    1006803* - TMTR-0001: Suspicious Files Detected In Operating System Directories (ATT&CK T1560.001)
    1006802* - TMTR-0003: Suspicious Files Detected In Operating System Directories (ATT&CK T1560.001)
    1006805* - TMTR-0009: Suspicious Files Detected In System Folder (ATT&CK T1560.001)
    1006804* - TMTR-0010: Suspicious Files Detected In System Folder (ATT&CK T1560.001)
    1006658* - TMTR-0012: Suspicious Files Detected In Temporary Directories (ATT&CK T1560.001)
    1006677* - TMTR-0013: Suspicious Files Detected In Windows Folder (ATT&CK T1560.001)
    1006683* - TMTR-0016: Suspicious Running Processes Detected (ATT&CK T1560.001)
    1007210* - TMTR-0018: Suspicious Files Detected In User Profile Directory (ATT&CK T1560.001)
    1007216* - TMTR-0021: Suspicious Files Detected In System Drive (ATT&CK T1560.001)
    1007217* - TMTR-0022: Suspicious Files Detected In Recycle Bin (ATT&CK T1560.001)
    1008684* - Threat - BADRABBIT
    1005041* - Threat - Suspicious Microsoft Windows Files Detected
    1005042* - Threat - Suspicious Microsoft Windows Registry Entries Detected
    1006544* - Threat - Suspicious Microsoft Windows Superfish Detected
    1008385* - Threat - WannaCry
    1010855* - Vulnerability - Microsoft Exchange - HAFNIUM Targeted Vulnerabilities
    1010266* - Vulnerability - SaltStack Vulnerabilities Exploitation Detected
    1010138* - Vulnerability - Trend Micro Apex One And OfficeScan Directory Traversal Vulnerability (CVE-2019-9489)
    1010515* - Vulnerability - Trend Micro ServerProtect For Linux Command Execution Vulnerability (CVE-2020-24561)


    セキュリティログ監視(Log Inspection)ルール:

    1008852* - Auditd
    1010558* - Auditd - Mitre ATT&CK TA0005: Defense Evasion
    1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
    1003843* - Microsoft Windows Security Events
    1004057* - Microsoft Windows Security Events - 1
    1008670* - Microsoft Windows Security Events - 3
  • * は既存ルールの新バージョンを示します。

    DPI(Deep Packet Inspection) ルール:

    DCERPCサービス
    1011105* - Identified File Deletion From SMB Share (ATT&CK T1070.004)


    DNSサーバ
    1011102* - PowerDNS Authoritative Server Denial of Service Vulnerability (CVE-2021-36754)


    ディレクトリサーバ LDAP
    1011114 - Identified Subnet Discovery Over LDAP (ATT&CK T1016)


    Port Mapper FTPクライアント
    1011089* - Identified File Upload Over FTP (ATT&CK T1048.003)


    アプリケーションに関連する不審な活動(クライアント)
    1011119 - Disallow Download Of Restricted File Formats (ATT&CK T1105)


    アプリケーションに関連する不審な活動(サーバ)
    1002378* - Detected Virtual Network Computing (VNC) Server Traffic (ATT&CK T1021.005, T1219)


    Webアプリケーション 共通
    1011108* - GitStack Remote Code Execution Vulnerability (CVE-2018-5955) - 1
    1011101* - MODX Revolution Remote Code Execution Vulnerability (CVE-2018-1000207)


    Webクライアント 共通
    1011091* - Identified Download Of Executable File Over HTTP (ATT&CK T1105)
    1011054* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)


    Webクライアント Internet Explorer/Edge
    1009411* - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2018-8617)


    Webサーバ 共通
    1005471* - Identified Suspicious Slow HTTP Denial Of Service Attack (ATT&CK T1498.001)
    1011109 - Nagios XI 'Switch.inc.php' Command Injection Vulnerability (CVE-2021-37344)


    Webサーバ HTTPS
    1011115 - Identified Microsoft Exchange Server ECP Authentication Attempt
    1011041* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473)


    Webサーバ その他
    1011117 - Atlassian Confluence Server Remote Code Execution Vulnerability (CVE-2021-26084)


    Webサーバ Oracle
    1011085 - Oracle Business Intelligence Arbitrary File Upload Vulnerability (CVE-2021-2392)
    1011081 - Oracle Business Intelligence Publisher XML External Entity Injection Vulnerability (CVE-2021-2401)
    1011096* - Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2021-2394)


    変更監視(Integrity Monitoring)ルール:

    1011116 - Linux/Unix - Kernel modules loading configuration modified (ATT&CK T1547.006)
    1011111 - Linux/Unix - Users and Groups - Create and Delete Activity (ATT&CK T1136)
    1009629* - Microsoft Windows - AppCert DLL Registry values modified (ATT&CK T1546.009)
    1009628* - Microsoft Windows - AppInit DLL Registry values modified (ATT&CK T1546.010)
    1009639* - Microsoft Windows - Application shimming detected (ATT&CK T1546.011)
    1002781* - Microsoft Windows - Attributes of services modified (ATT&CK T1543.003, T1036.004)
    1009895* - Microsoft Windows - Component Object Model Registry keys modified (ATT&CK T1546.015)
    1002859* - Microsoft Windows - LSA Authentication Packages modified (ATT&CK T1547.002)
    1010353* - Microsoft Windows - LSA Notification Packages modified (ATT&CK T1556.002)
    1009638* - Microsoft Windows - NetSh Helper DLL Registry keys modified (ATT&CK T1546.007)
    1011071* - Microsoft Windows - OpenSSH registry keys modified (ATT&CK T1021.004, T1112)
    1009618* - Microsoft Windows - Powershell activity detected (ATT&CK T1059.001)
    1009710* - Microsoft Windows - Root Certificate Registry keys modified (ATT&CK T1553.004)
    1009670* - Microsoft Windows - Service Registry keys modified (ATT&CK T1574.011)
    1009672* - Microsoft Windows - Time Provider Registry keys modified (ATT&CK T1547.003)
    1008720* - Microsoft Windows - Users and Groups - Create and Delete Activity (ATT&CK T1136)
    1010382* - Microsoft Windows - Windows Command Shell activity detected (ATT&CK T1059.003)


    セキュリティログ監視(Log Inspection)ルール:

    1003802* - Directory Server - Microsoft Windows Active Directory
    1010595* - Microsoft LDAP Query Execution
    1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
    1002795* - Microsoft Windows Events
  • * は既存ルールの新バージョンを示します。

    DPI(Deep Packet Inspection) ルール:

    DCERPCサービス
    1011105* - Identified File Deletion From SMB Share (ATT&CK T1070.004)


    DNSサーバ
    1011102 - PowerDNS Authoritative Server Denial of Service Vulnerability (CVE-2021-36754)


    Java RMI
    1011078* - Atlassian Jira and Jira Service Management Data Center Insecure Deserialization Vulnerability (CVE-2020-36239)


    Remote Login Applications
    1004364* - TeamViewer (ATT&CK T1219)


    Webアプリケーション 共通
    1011108 - GitStack Remote Code Execution Vulnerability (CVE-2018-5955) - 1
    1011101 - MODX Revolution Remote Code Execution Vulnerability (CVE-2018-1000207)
    1009310* - Microsoft Exchange Server SSRF Vulnerability (CVE-2018-16793)
    1011103 - PHPUnit Remote Code Execution Vulnerability (CVE-2017-9841)


    Webクライアント 共通
    1011049* - Google Chrome V8 Type Confusion Vulnerability (CVE-2021-30551)
    1010207* - Microsoft Windows Multiple Type1 Font Parsing Remote Code Execution Vulnerabilities (CVE-2020-1020 and CVE-2020-0938)


    Webサーバ その他
    1011099* - Jenkins 'Selenium HTML report' Plugin XML External Entity Injection Vulnerability (CVE-2021-21672)


    Webサーバ Oracle
    1011096* - Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2021-2394)


    変更監視(Integrity Monitoring)ルール:

    1002900* - Application - 3CDaemon
    1002998* - Application - ARCserve Backup
    1002851* - Application - Apache HTTP Server
    1002853* - Application - Apache Tomcat
    1003364* - Application - Exim
    1003200* - Application - IBM DB2
    1003077* - Application - IBM Lotus Domino
    1003263* - Application - IBM Tivoli Directory Server
    1003363* - Application - IPSwitch iMail
    1003241* - Application - Ingres Database Server
    1009060* - Application - Kubernetes Cluster master
    1009434* - Application - Kubernetes Cluster node
    1003039* - Application - MDaemon Email Server
    1003040* - Application - MailEnable
    1003092* - Application - Merak Mail Server
    1003063* - Application - Microsoft Exchange
    1002910* - Application - Microsoft IIS
    1002999* - Application - Microsoft SQL Server
    1003000* - Application - MySQL
    1002914* - Application - NettermFTP
    1003102* - Application - Novell eDirectory
    1003090* - Application - Oracle Database Server
    1003105* - Application - PostgreSQL
    1003380* - Application - Squid Proxy
    1003139* - Application - Sun ONE Application Server
    1003142* - Application - Sun ONE Directory Server
    1010055* - Application - Trend Micro ApexOne Server
    1003019* - Application - Trend Micro Deep Security Agent / Relay
    1003020* - Application - Trend Micro Deep Security Manager
    1003744* - Application - Trend Micro OfficeScan Server
    1003087* - Application - Trend Micro OfficeScan client
    1003131* - Application - VMware Server
    1002898* - Application - WS_FTP
    1003403* - Application - WU-FTPD
    1002849* - Application - WarFTPD
    1003391* - Application - vsftpd
    1011070* - Linux/Unix - SSH authorized_keys file modified - non-root users (ATT&CK T1563.001, T1021.004, T1098.004)


    セキュリティログ監視(Log Inspection)ルール:

    今回のセキュリティアップデートには、新規のセキュリティログ監視ルールおよび更新は含まれておりません。
  • * は既存ルールの新バージョンを示します。

    DPI(Deep Packet Inspection) ルール:

    DCERPCサービス
    1011105 - Identified File Deletion From SMB Share (ATT&CK T1070.004)
    1011104 - Identified Network Share Discovery (ATT&CK T1135)


    Java RMI
    1011078 - Atlassian Jira and Jira Service Management Data Center Insecure Deserialization Vulnerability (CVE-2020-36239)


    Webアプリケーション 共通
    1010668* - FUEL CMS Remote Code Execution Vulnerability (CVE-2018-16763)
    1011094 - Identified User Creation Attempt In GitStack


    Webサーバ HTTPS
    1011088* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31198)
    1011100 - WordPress 'WooCommerce Blocks' Plugin SQL Injection Vulnerability (CVE-2021-32789)


    Webサーバ その他
    1011061* - Jenkins 'Config File Provider' Plugin External Entity Injection Vulnerability (CVE-2021-21642)
    1011099 - Jenkins 'Selenium HTML report' Plugin XML External Entity Injection Vulnerability (CVE-2021-21672)
    1011093* - Pivotal Spring Security OAuth Remote Code Execution Vulnerability (CVE-2016-4977)


    Webサーバ Oracle
    1010590* - Oracle WebLogic Server Remote Code Execution Vulnerabilities (CVE-2020-14882, CVE-2020-14750 and CVE-2020-14883)
    1011096 - Oracle WebLogic Server Remote Code Execution Vulnerability (CVE-2021-2394)


    Windows SMBクライアント
    1011055 - Identified DCERPC OpenPrinterEx Call Over SMB Protocol


    変更監視(Integrity Monitoring)ルール:

    1003533* - Application - OpenSSH (ATT&CK T1021.004)
    1011067 - Linux/Unix - Permissions on ssh private host keys modified (ATT&CK T1021.004, T1222.002)
    1011070 - Linux/Unix - SSH authorized_keys file modified - non-root users (ATT&CK T1563.001, T1021.004, T1098.004)
    1011068 - Linux/Unix - SSH authorized_keys file modified - root user (ATT&CK T1563.001, T1021.004, T1098.004)
    1011069 - Linux/Unix - SSH authorized_keys file modified - systemwide (ATT&CK T1563.001, T1021.004, T1098.004)
    1011066 - Linux/Unix - SSH client configuration modified (ATT&CK1021.004)
    1011063 - Linux/Unix - SSH server configuration file modified (ATT&CK T1021.004)
    1011071 - Microsoft Windows - OpenSSH registry keys modified (ATT&CK T1021.004, T1112)
    1011092 - Microsoft Windows - OpenSSH server configuration file modified (ATT&CK T1021.004)


    セキュリティログ監視(Log Inspection)ルール:

    1010465* - Auditd - Mitre ATT&CK TA0007: Discovery
    1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
  • * は既存ルールの新バージョンを示します。

    DPI(Deep Packet Inspection) ルール:

    DCERPCサービス - クライアント
    1007120* - SMB DLL Injection Exploit Detected (ATT&CK T1055.001)


    Microsoft Office
    1011095 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2021-34501)


    NFSサーバ
    1011079* - Microsoft Windows Services NFS ONCRPC XDR Driver Remote Code Execution Vulnerability (CVE-2021-26432)


    OpenSSLクライアント
    1006017* - Restrict OpenSSL TLS/DTLS Heartbeat Message (ATT&CK T1573.002)


    Port Mapper FTPクライアント
    1009558* - Remote File Copy Over FTP (ATT&CK T1544, T1071.002)


    SAP NetWeaver Java Application Server
    1010822* - Identified SAP Solution Manager Tool Transfer Over HTTP (ATT&CK T1105)


    SSLクライアント
    1009915* - Identified WhatsApp Registration (ATT&CK T1102.002)
    1009932* - Telegram Bot API Usage (Used by Telecrypt) (ATT&CK T1102.002)


    SSLクライアント アプリケーション
    1009914* - Identified Github Authentication (ATT&CK T1102.002)
    1001113* - SSL/TLS Client (ATT&CK T1573.002)


    アプリケーションに関連する不審な活動(クライアント)
    1005283* - Identified Potentially Malicious RAT Traffic - I (ATT&CK T1571)
    1005300* - Identified Potentially Malicious RAT Traffic - IV (ATT&CK T1571)
    1005473* - Identified Potentially Malicious RAT Traffic - V (ATT&CK T1571)
    1006247* - Identified Potentially Malicious RAT Traffic - VI (ATT&CK T1571)
    1008756* - Identified Potentially Malicious RAT Traffic - VII (ATT&CK T1571)


    Webアプリケーション 共通
    1007170* - Identified Suspicious China Chopper Webshell Communication (ATT&CK T1505.003)
    1009911* - Identified Twitter Command & Control Communication (ATT&CK T1102.002)


    Webアプリケーション PHP
    1011074* - WordPress 'Backup Guard' Plugin Arbitrary File Upload Vulnerability (CVE-2021-24155)


    Webクライアント 共通
    1000943* - Detect UPX Packed Executable Download (ATT&CK T1027.002)
    1009912* - Detected Vkontakte Site Access Over HTTP (ATT&CK T1102.002)


    Webクライアント SSL
    1006296* - Detected SSLv3 Response (ATT&CK T1573.002)
    1006298* - Identified CBC Based Cipher Suite In SSLv3 Request (ATT&CK T1573.002)


    Webサーバ 共通
    1005434* - Disallow Upload Of A PHP File (ATT&CK T1190)
    1005013* - Restrict Microsoft .Net Executable File Upload (ATT&CK T1190)
    1003025* - Web Server Restrict Executable File Uploads (ATT&CK T1190)


    Webサーバ HTTPS
    1011088 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31198)
    1011060* - WordPress 'LearnPress' Plugin Blind SQL Injection Vulnerability (CVE-2020-6010)


    Webサーバ その他
    1011044* - Apache Superset Open Redirect Vulnerability (CVE-2021-28125)
    1011061 - Jenkins 'Config File Provider' Plugin External Entity Injection Vulnerability (CVE-2021-21642)
    1011093 - Pivotal Spring Security OAuth Remote Code Execution Vulnerability (CVE-2016-4977)


    Webサーバ SharePoint
    1010836* - Identified Microsoft SharePoint GetGroupCollection Request (ATT&CK T1213.002)
    1010835* - Identified Microsoft SharePoint GetGroupCollectionFromRole Request (ATT&CK T1213.002, T1087)
    1010834* - Identified Microsoft SharePoint GetGroupCollectionFromSite Request (ATT&CK T1213.002)
    1010833* - Identified Microsoft SharePoint GetGroupCollectionFromUser Request (ATT&CK T1213.002, T1087)
    1010832* - Identified Microsoft SharePoint GetGroupCollectionFromWeb Request (ATT&CK T1213.002)
    1010831* - Identified Microsoft SharePoint GetGroupInfo Request (ATT&CK T1213.002)
    1010823* - Identified Microsoft SharePoint GetPermissionCollection Request (ATT&CK T1069, T1213.002, T1589.002)
    1010830* - Identified Microsoft SharePoint GetRoleCollection Request (ATT&CK T1213.002)
    1010747* - Identified Microsoft SharePoint GetRolesAndPermissionsForSite Request (ATT&CK T1589.003)
    1010746* - Identified Microsoft SharePoint GetUserInfo Request (ATT&CK T1589.003)


    Windowsサービス RPCサーバ DCERPC
    1009478* - Identified Remote Service Creation Over DCE/RPC Protocol (ATT&CK T1543.003)
    1007054* - Remote Schedule Task 'Create' Through SMBv2 Protocol Detected (ATT&CK T1053.005)
    1007053* - Remote Schedule Task 'Delete' Through SMBv2 Protocol Detected (ATT&CK T1053.005)
    1007017* - Remote Schedule Task 'Run' Through SMBv2 Protocol Detected (ATT&CK T1053.005)


    Zabbixサーバ
    1011073* - Zabbix Server Multiple Remote Code Execution Vulnerabilities


    変更監視(Integrity Monitoring)ルール:

    1003354* - Linux/Unix - Configuration files of sendmail utility modified
    1003168* - Linux/Unix - Listening ports modified
    1003169* - Linux/Unix - Process attributes modified
    1009745* - Linux/Unix - Removable Device Detected (ATT&CK T1092)
    1010422* - Linux/Unix - SCP process detected (ATT&CK T1105, T1048.001)
    1010791* - Linux/Unix - Task scheduler entries modified (ATT&CK T1053)
    1009704* - Microsoft Windows - Boot or Logon Autostart Execution: Port Monitors (ATT&CK T1547.010)


    セキュリティログ監視(Log Inspection)ルール:

    1002797* - Database Server - MySQL
    1010002* - Microsoft PowerShell Command Execution (ATT&CK T1059.001)
    1008670* - Microsoft Windows Security Events - 3