Rule Update
19-056 (November 12, 2019)
DESCRIPTION
* indicates a new version of an existing rule
Deep Packet Inspection Rules:
DCERPC Services
1009490* - Block Administrative Share - 1 (ATT&CK T1077,T1105)
1005293* - Prevent Windows Administrator User Login Over SMB (ATT&CK T1077)
DNS Client
1003328* - Disallow Intra-Site Automatic Tunnel Addressing Protocol
Suspicious Server Application Activity
1009549* - Detected Terminal Services (RDP) Server Traffic - 1 (ATT&CK T1015,T1043,T1076,T1048,T1032,T1071)
Web Application Tomcat
1009697* - Apache Tomcat Remote Code Execution Vulnerability (CVE-2019-0232)
Web Client Common
1008206* - ImageMagick 'coders/rle.c' Remote Buffer Overflow Vulnerability (CVE-2016-10049) - 1
1010053 - Microsoft Jet Database Engine Remote Code Execution Vulnerability (CVE-2019-1358)
1010054 - Microsoft Jet Database Engine Remote Code Execution Vulnerability (CVE-2019-1359)
1010052 - Microsoft Windows Imaging API Remote Code Execution Vulnerability (CVE-2019-1311)
Web Client Internet Explorer/Edge
1010050 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-1429)
1010051 - Microsoft Internet Explorer VBScript Remote Code Execution Vulnerability (CVE-2019-1390)
Web Server HTTPS
1010049 - Apache Traffic Server HTTP/2 Denial Of Service Vulnerability (CVE-2019-9515)
Web Server Miscellaneous
1005604* - Apache Struts Multiple Remote Command Execution Vulnerability
1005509* - nginx "ngx_http_parse_chunked()" Buffer Overflow Vulnerability
Windows Services RPC Client DCERPC
1008477* - Identified Usage Of WMI Execute Methods - Client (ATT&CK T1047)
Windows Services RPC Server DCERPC
1009480* - Identified WMI Query Over DCE/RPC Protocol (ATT&CK T1005)
Integrity Monitoring Rules:
1005645* - Microsoft Windows - AutoRun Registry Entries Modified (ATT&CK T1013, T1060)
1002776* - Microsoft Windows - Startup Programs Modified (ATT&CK T1112, T1060)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Deep Packet Inspection Rules:
DCERPC Services
1009490* - Block Administrative Share - 1 (ATT&CK T1077,T1105)
1005293* - Prevent Windows Administrator User Login Over SMB (ATT&CK T1077)
DNS Client
1003328* - Disallow Intra-Site Automatic Tunnel Addressing Protocol
Suspicious Server Application Activity
1009549* - Detected Terminal Services (RDP) Server Traffic - 1 (ATT&CK T1015,T1043,T1076,T1048,T1032,T1071)
Web Application Tomcat
1009697* - Apache Tomcat Remote Code Execution Vulnerability (CVE-2019-0232)
Web Client Common
1008206* - ImageMagick 'coders/rle.c' Remote Buffer Overflow Vulnerability (CVE-2016-10049) - 1
1010053 - Microsoft Jet Database Engine Remote Code Execution Vulnerability (CVE-2019-1358)
1010054 - Microsoft Jet Database Engine Remote Code Execution Vulnerability (CVE-2019-1359)
1010052 - Microsoft Windows Imaging API Remote Code Execution Vulnerability (CVE-2019-1311)
Web Client Internet Explorer/Edge
1010050 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-1429)
1010051 - Microsoft Internet Explorer VBScript Remote Code Execution Vulnerability (CVE-2019-1390)
Web Server HTTPS
1010049 - Apache Traffic Server HTTP/2 Denial Of Service Vulnerability (CVE-2019-9515)
Web Server Miscellaneous
1005604* - Apache Struts Multiple Remote Command Execution Vulnerability
1005509* - nginx "ngx_http_parse_chunked()" Buffer Overflow Vulnerability
Windows Services RPC Client DCERPC
1008477* - Identified Usage Of WMI Execute Methods - Client (ATT&CK T1047)
Windows Services RPC Server DCERPC
1009480* - Identified WMI Query Over DCE/RPC Protocol (ATT&CK T1005)
Integrity Monitoring Rules:
1005645* - Microsoft Windows - AutoRun Registry Entries Modified (ATT&CK T1013, T1060)
1002776* - Microsoft Windows - Startup Programs Modified (ATT&CK T1112, T1060)
Log Inspection Rules:
There are no new or updated Log Inspection Rules in this Security Update.
Featured Stories
Unveiling AI Agent Vulnerabilities Part V: Securing LLM ServicesTo conclude our series on agentic AI, this article examines emerging vulnerabilities that threaten AI agents, focusing on providing proactive security recommendations on areas such as code execution, data exfiltration, and database access.Read more
Unveiling AI Agent Vulnerabilities Part IV: Database Access VulnerabilitiesHow can attackers exploit weaknesses in database-enabled AI agents? This research explores how SQL generation vulnerabilities, stored prompt injection, and vector store poisoning can be weaponized by attackers for fraudulent activities.Read more
The Mirage of AI Programming: Hallucinations and Code IntegrityThe adoption of large language models (LLMs) and Generative Pre-trained Transformers (GPTs), such as ChatGPT, by leading firms like Microsoft, Nuance, Mix and Google CCAI Insights, drives the industry towards a series of transformative changes. As the use of these new technologies becomes prevalent, it is important to understand their key behavior, advantages, and the risks they present.Read more
Open RAN: Attack of the xAppsThis article discusses two O-RAN vulnerabilities that attackers can exploit. One vulnerability stems from insufficient access control, and the other arises from faulty message handlingRead more