19-063 (December 17, 2019)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DCERPC Services
1010101 - Identified Usage Of PAExec Command Line Tool (ATT&CK T1035)


DCERPC Services - Client
1010106 - Identify Downloading Of PowerShell Scripts Through SMB Share (ATT&CK T1086)


DNS Client
1010067 - PHP 'dns_get_record' Buffer Overflow Vulnerability (CVE-2019-9022)


Microsoft Office
1010108 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2019-1448)


Trend Micro OfficeScan
1010039* - Trend Micro OfficeScan Directory Traversal Vulnerability (CVE-2019-18187)


TurboVNC Server
1010079 - TurboVNC Fence Message Stack-based Buffer Overflow Vulnerability (CVE-2019-15683)


Web Client Common
1010110 - Microsoft Windows Jet Database Engine Remote Code Execution Vulnerability (CVE-2019-1406)


Windows Remote Management
1010048 - WinRM Service Detected & Powershell RCE Over HTTP (ATT&CK T1028)


Windows Remote Management Client
1010073 - WinRM Service Detected & Powershell RCE Over HTTP - Client (ATT&CK T1028)


Integrity Monitoring Rules:

1010055 - AntiVirus - Trend Micro ApexOne Server
1003744* - AntiVirus - Trend Micro OfficeScan Server


Log Inspection Rules:

1004057* - Microsoft Windows Security Events - 1