Rule Update
19-050 (October 8, 2019)
Publish date: October 08, 2019
DESCRIPTION
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1007134* - Batch File Uploaded On Network Share (ATT&CK T1105)
1007065* - Executable File Uploaded On Network Share (ATT&CK T1105)
1007064* - Executable File Uploaded On System32 Folder Through SMB Share (ATT&CK T1105)
1001852* - Identified Attempt To Brute Force Windows Login Credentials (ATT&CK T1110)
1006906* - Identified Usage Of PsExec Command Line Tool (ATT&CK T1035)
1007114* - Portable Executable File Uploaded On SMB Share (ATT&CK T1105)
1007020* - Remote CreateService Request Detected Through SMBv1 Protocol (ATT&CK T1021)
1007035* - Remote DeleteService Request Through SMBv1 Detected (ATT&CK T1021)
1007057* - Remote Registry Access Through SMBv1 Protocol Detected (ATT&CK T1012)
1007021* - Remote Registry Access Through SMBv2 Protocol Detected (ATT&CK T1012)
1007069* - Remote Service Execution Through SMBv1 Detected (ATT&CK T1021)
DCERPC Services - Client
1007120* - SMB DLL Injection Exploit Detected (ATT&CK T1039)
Database MySQL
1005045* - MySQL Database Server Possible Login Brute Force Attempt (ATT&CK T1110)
File Sharing Applications
1007608* - Amazon Cloud Drive (ATT&CK T1102)
1007605* - BOX (ATT&CK T1102)
1007463* - Microsoft OneDrive (ATT&CK T1102)
Mail Server Over SSL/TLS
1010010 - Exim Remote Code Execution Vulnerability (CVE-2019-16928)
Remote Desktop Protocol Server
1009343* - Identified Too Many SSL Alert Messages In SSLv3 Over RDP (ATT&CK T1032)
SSL Client
1006561* - Identified Usage Of TLS/SSL EXPORT Cipher Suite In Response (ATT&CK T1032)
Suspicious Client Application Activity
1008946* - Heuristic Detection Of Suspicious Digital Certificate (ATT&CK T1032)
1005283* - Identified Potentially Malicious RAT Traffic - I (ATT&CK T1094)
1005299* - Identified Potentially Malicious RAT Traffic - III (ATT&CK T1094)
1005300* - Identified Potentially Malicious RAT Traffic - IV (ATT&CK T1094)
1005473* - Identified Potentially Malicious RAT Traffic - V (ATT&CK T1094)
1008756* - Identified Potentially Malicious RAT Traffic - VII (ATT&CK T1094)
1007197* - TMTR-0005: GHOST RAT TCP Connection Detected (ATT&CK T1094)
1007200* - TMTR-0010: FAKEM RAT TCP Connection (ATT&CK T1094)
1007207* - TMTR-0014: NJRAT TCP Connection (ATT&CK T1094)
Web Client Common
1010000 - Adobe Acrobat And Reader Out-of-Bounds Read Vulnerability (CVE-2019-7110)
1000943* - Detect UPX Packed Executable Download (ATT&CK T1045)
1010021 - Microsoft Graphics Components Information Disclosure Vulnerability (CVE-2019-1361)
1010009 - Microsoft Windows Elevation of Privilege Vulnerability (CVE-2019-1364)
1009981* - Microsoft Windows GDI Information Disclosure Vulnerability (CVE-2019-1252)
1010015 - Microsoft XML Remote Code Execution Vulnerability (CVE-2019-1060)
Web Client Internet Explorer/Edge
1009787* - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1024)
1009788* - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1051)
1009792* - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1052)
1010018 - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1307)
1010019 - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1308)
1010008 - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1335)
1010020 - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1366)
1010016 - Microsoft Internet Explorer VBScript Engine Remote Code Execution Vulnerability (CVE-2019-1238)
1010017 - Microsoft Internet Explorer VBScript Engine Remote Code Execution Vulnerability (CVE-2019-1239)
Web Server Common
1005434* - Disallow Upload Of A PHP File (ATT&CK T1105)
1003025* - Web Server Restrict Executable File Uploads (ATT&CK T1105)
Web Server Miscellaneous
1005604* - Apache Struts Multiple Remote Command Execution Vulnerability
Web Server Oracle
1009816* - Oracle Weblogic Server Remote Code Execution Vulnerability (CVE-2019-2729)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
DCERPC Services
1007134* - Batch File Uploaded On Network Share (ATT&CK T1105)
1007065* - Executable File Uploaded On Network Share (ATT&CK T1105)
1007064* - Executable File Uploaded On System32 Folder Through SMB Share (ATT&CK T1105)
1001852* - Identified Attempt To Brute Force Windows Login Credentials (ATT&CK T1110)
1006906* - Identified Usage Of PsExec Command Line Tool (ATT&CK T1035)
1007114* - Portable Executable File Uploaded On SMB Share (ATT&CK T1105)
1007020* - Remote CreateService Request Detected Through SMBv1 Protocol (ATT&CK T1021)
1007035* - Remote DeleteService Request Through SMBv1 Detected (ATT&CK T1021)
1007057* - Remote Registry Access Through SMBv1 Protocol Detected (ATT&CK T1012)
1007021* - Remote Registry Access Through SMBv2 Protocol Detected (ATT&CK T1012)
1007069* - Remote Service Execution Through SMBv1 Detected (ATT&CK T1021)
DCERPC Services - Client
1007120* - SMB DLL Injection Exploit Detected (ATT&CK T1039)
Database MySQL
1005045* - MySQL Database Server Possible Login Brute Force Attempt (ATT&CK T1110)
File Sharing Applications
1007608* - Amazon Cloud Drive (ATT&CK T1102)
1007605* - BOX (ATT&CK T1102)
1007463* - Microsoft OneDrive (ATT&CK T1102)
Mail Server Over SSL/TLS
1010010 - Exim Remote Code Execution Vulnerability (CVE-2019-16928)
Remote Desktop Protocol Server
1009343* - Identified Too Many SSL Alert Messages In SSLv3 Over RDP (ATT&CK T1032)
SSL Client
1006561* - Identified Usage Of TLS/SSL EXPORT Cipher Suite In Response (ATT&CK T1032)
Suspicious Client Application Activity
1008946* - Heuristic Detection Of Suspicious Digital Certificate (ATT&CK T1032)
1005283* - Identified Potentially Malicious RAT Traffic - I (ATT&CK T1094)
1005299* - Identified Potentially Malicious RAT Traffic - III (ATT&CK T1094)
1005300* - Identified Potentially Malicious RAT Traffic - IV (ATT&CK T1094)
1005473* - Identified Potentially Malicious RAT Traffic - V (ATT&CK T1094)
1008756* - Identified Potentially Malicious RAT Traffic - VII (ATT&CK T1094)
1007197* - TMTR-0005: GHOST RAT TCP Connection Detected (ATT&CK T1094)
1007200* - TMTR-0010: FAKEM RAT TCP Connection (ATT&CK T1094)
1007207* - TMTR-0014: NJRAT TCP Connection (ATT&CK T1094)
Web Client Common
1010000 - Adobe Acrobat And Reader Out-of-Bounds Read Vulnerability (CVE-2019-7110)
1000943* - Detect UPX Packed Executable Download (ATT&CK T1045)
1010021 - Microsoft Graphics Components Information Disclosure Vulnerability (CVE-2019-1361)
1010009 - Microsoft Windows Elevation of Privilege Vulnerability (CVE-2019-1364)
1009981* - Microsoft Windows GDI Information Disclosure Vulnerability (CVE-2019-1252)
1010015 - Microsoft XML Remote Code Execution Vulnerability (CVE-2019-1060)
Web Client Internet Explorer/Edge
1009787* - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1024)
1009788* - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1051)
1009792* - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1052)
1010018 - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1307)
1010019 - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1308)
1010008 - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1335)
1010020 - Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1366)
1010016 - Microsoft Internet Explorer VBScript Engine Remote Code Execution Vulnerability (CVE-2019-1238)
1010017 - Microsoft Internet Explorer VBScript Engine Remote Code Execution Vulnerability (CVE-2019-1239)
Web Server Common
1005434* - Disallow Upload Of A PHP File (ATT&CK T1105)
1003025* - Web Server Restrict Executable File Uploads (ATT&CK T1105)
Web Server Miscellaneous
1005604* - Apache Struts Multiple Remote Command Execution Vulnerability
Web Server Oracle
1009816* - Oracle Weblogic Server Remote Code Execution Vulnerability (CVE-2019-2729)
Integrity Monitoring Rules:
There are no new or updated Integrity Monitoring Rules in this Security Update.
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Featured Stories
Abusing Argo CD, Helm, and Artifact Hub: An Analysis of Supply Chain Attacks in Cloud-Native ApplicationsWe provide an overview of cloud-native tools and examine how cybercriminals can exploit their vulnerabilities to launch supply chain attacks.Read more
Trends and Shifts in the Underground N-Day Exploit MarketOur two-year research provides insights into the life cycle of exploits, the types of exploit buyers and sellers, and the business models that are reshaping the underground exploit market.Read more
The Nightmares of Patch Management: The Status Quo and BeyondWe discuss the challenges that organizations face in managing endpoint and server patches.Read more
Identifying Weak Parts of a Supply ChainMalicious attacks have consistently been launched on weak points in the supply chain. Like all attacks, these will evolve into more advanced forms. Software development, with multiple phases that could be placed at risk, is particularly vulnerable.Read more