21-013 (March 16, 2021)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DNS Client
1010766* - Identified Non Existing DNS Resource Record (RR) Types In DNS Traffic


DNS Server
1010863* - Microsoft Windows DNS Server Remote Code Execution Vulnerability (CVE-2021-26877)
1010865* - Microsoft Windows DNS Server Remote Code Execution Vulnerability (CVE-2021-26897)


Oracle E-Business Suite Web Interface
1010730 - Oracle E-Business Suite 'ozfVendorLov' SQL Injection Information Disclosure Vulnerability (CVE-2020-14876)


SSL Client
1010410* - OpenSSL Large DH Parameter Denial Of Service Vulnerability (CVE-2018-0732)


Suspicious Server Ransomware Activity
1010647* - Identified HTTP Backdoor.Win32.Cobalt.SMHP C&C Traffic Request


Web Application PHP Based
1010852* - phpMyAdmin 'SearchController' SQL Injection Vulnerability (CVE-2020-26935)


Web Server Common
1010862* - SaltStack Salt Directory Traversal Vulnerability (CVE-2021-25282)
1010858* - SaltStack Salt Directory Traversal Vulnerability (CVE-2021-25282) - 1


Web Server HTTPS
1010849 - Identified Zoom WebSocket Upgrade Request
1010854* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-26855)


Web Server Miscellaneous
1010682* - SolarWinds Orion Platform 'SaveUserSetting' Privilege Escalation Vulnerability (CVE-2021-27258)


Web Server Nagios
1010866 - Nagios XI Cross Site Scripting Vulnerability (CVE-2021-25299)


Web Server SharePoint
1010864* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-27076)


Windows SMB Server
1007065* - Executable File Uploaded On Network Share (ATT&CK T1105)


Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.


Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.