Talos has added and modified multiple rules in the browser-chrome, file-other, malware-cnc, malware-other, os-mobile and server-webapp rule sets to provide coverage for emerging threats from these technologies.
For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2092000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60275 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection (malware-cnc.rules) * 1:60276 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60277 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60278 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60279 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60280 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60281 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60282 <-> DISABLED <-> BROWSER-CHROME Intent handling downgrade attempt (browser-chrome.rules) * 1:60283 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60284 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60285 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60286 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt (malware-other.rules) * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules) * 1:60289 <-> DISABLED <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt (server-webapp.rules) * 1:60291 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60292 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60293 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60294 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60295 <-> DISABLED <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt (malware-cnc.rules) * 1:60296 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt (malware-other.rules) * 1:60297 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60298 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60299 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt (malware-other.rules) * 1:60300 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60301 <-> DISABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60302 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60312 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60313 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 3:60287 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt (server-other.rules) * 3:60303 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60288 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt (server-other.rules) * 3:60305 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60304 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60307 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60306 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60309 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60308 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60311 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules) * 3:60310 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091900.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60313 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60300 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60278 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60301 <-> DISABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60291 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60286 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt (malware-other.rules) * 1:60289 <-> DISABLED <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt (server-webapp.rules) * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules) * 1:60276 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60275 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection (malware-cnc.rules) * 1:60277 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60280 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60281 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60283 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60302 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60282 <-> DISABLED <-> BROWSER-CHROME Intent handling downgrade attempt (browser-chrome.rules) * 1:60312 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60284 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60279 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60285 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60292 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60294 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60293 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60295 <-> DISABLED <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt (malware-cnc.rules) * 1:60297 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60296 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt (malware-other.rules) * 1:60299 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt (malware-other.rules) * 1:60298 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 3:60288 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt (server-other.rules) * 3:60287 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt (server-other.rules) * 3:60304 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60303 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60306 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60305 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60308 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60307 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60310 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules) * 3:60309 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60311 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091801.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60291 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60283 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60275 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection (malware-cnc.rules) * 1:60277 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60276 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60279 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60278 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60281 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60280 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60289 <-> DISABLED <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt (server-webapp.rules) * 1:60282 <-> DISABLED <-> BROWSER-CHROME Intent handling downgrade attempt (browser-chrome.rules) * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules) * 1:60296 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt (malware-other.rules) * 1:60293 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60294 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60297 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60299 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt (malware-other.rules) * 1:60298 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60300 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60302 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60301 <-> DISABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60285 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60292 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60284 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60286 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt (malware-other.rules) * 1:60295 <-> DISABLED <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt (malware-cnc.rules) * 1:60312 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60313 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 3:60288 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt (server-other.rules) * 3:60304 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60306 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60287 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt (server-other.rules) * 3:60308 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60303 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60310 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules) * 3:60305 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60307 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60309 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60311 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091701.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60281 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60297 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60279 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60289 <-> DISABLED <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt (server-webapp.rules) * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules) * 1:60296 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt (malware-other.rules) * 1:60298 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60312 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60302 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60278 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60313 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60285 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60291 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60280 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60295 <-> DISABLED <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt (malware-cnc.rules) * 1:60275 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection (malware-cnc.rules) * 1:60276 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60277 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60282 <-> DISABLED <-> BROWSER-CHROME Intent handling downgrade attempt (browser-chrome.rules) * 1:60300 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60283 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60301 <-> DISABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60284 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60299 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt (malware-other.rules) * 1:60286 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt (malware-other.rules) * 1:60292 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60294 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60293 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 3:60288 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt (server-other.rules) * 3:60304 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60306 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60287 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt (server-other.rules) * 3:60308 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60303 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60310 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules) * 3:60305 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60307 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60309 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60311 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091700.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60300 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60313 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60284 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60276 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60278 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60280 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60285 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60282 <-> DISABLED <-> BROWSER-CHROME Intent handling downgrade attempt (browser-chrome.rules) * 1:60289 <-> DISABLED <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt (server-webapp.rules) * 1:60312 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules) * 1:60302 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60286 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt (malware-other.rules) * 1:60279 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60281 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60291 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60292 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60293 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60301 <-> DISABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60294 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60295 <-> DISABLED <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt (malware-cnc.rules) * 1:60296 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt (malware-other.rules) * 1:60283 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60275 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection (malware-cnc.rules) * 1:60297 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60298 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60299 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt (malware-other.rules) * 1:60277 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 3:60288 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt (server-other.rules) * 3:60287 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt (server-other.rules) * 3:60303 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60306 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60305 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60304 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60307 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60310 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules) * 3:60309 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60308 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60311 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091601.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60282 <-> DISABLED <-> BROWSER-CHROME Intent handling downgrade attempt (browser-chrome.rules) * 1:60284 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60300 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60313 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60289 <-> DISABLED <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt (server-webapp.rules) * 1:60292 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60281 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60295 <-> DISABLED <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt (malware-cnc.rules) * 1:60293 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60291 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60275 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection (malware-cnc.rules) * 1:60276 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60277 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60278 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60279 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60280 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60285 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60298 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules) * 1:60299 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt (malware-other.rules) * 1:60297 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60296 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt (malware-other.rules) * 1:60286 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt (malware-other.rules) * 1:60294 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60283 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60302 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60301 <-> DISABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60312 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 3:60311 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules) * 3:60307 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60309 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60310 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules) * 3:60308 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60287 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt (server-other.rules) * 3:60305 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60303 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60304 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60306 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60288 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt (server-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091600.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60275 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection (malware-cnc.rules) * 1:60313 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60284 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60285 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60278 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60312 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60302 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60276 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60279 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60277 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60289 <-> DISABLED <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt (server-webapp.rules) * 1:60282 <-> DISABLED <-> BROWSER-CHROME Intent handling downgrade attempt (browser-chrome.rules) * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules) * 1:60281 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60291 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60292 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60286 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt (malware-other.rules) * 1:60280 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60300 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60293 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60294 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60295 <-> DISABLED <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt (malware-cnc.rules) * 1:60296 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt (malware-other.rules) * 1:60297 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60298 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60299 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt (malware-other.rules) * 1:60283 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60301 <-> DISABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 3:60311 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules) * 3:60303 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60307 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60306 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60310 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules) * 3:60309 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60308 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60287 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt (server-other.rules) * 3:60305 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60288 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt (server-other.rules) * 3:60304 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091501.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60282 <-> DISABLED <-> BROWSER-CHROME Intent handling downgrade attempt (browser-chrome.rules) * 1:60302 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60295 <-> DISABLED <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt (malware-cnc.rules) * 1:60289 <-> DISABLED <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt (server-webapp.rules) * 1:60291 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60285 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60281 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60292 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60275 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection (malware-cnc.rules) * 1:60296 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt (malware-other.rules) * 1:60276 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60297 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60293 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60277 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60298 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60299 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt (malware-other.rules) * 1:60300 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60301 <-> DISABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules) * 1:60278 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60279 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60312 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60294 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60283 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60286 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt (malware-other.rules) * 1:60284 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60280 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60313 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 3:60311 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules) * 3:60308 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60304 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60305 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60303 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60288 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt (server-other.rules) * 3:60310 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules) * 3:60287 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt (server-other.rules) * 3:60307 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60309 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60306 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091401.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60282 <-> DISABLED <-> BROWSER-CHROME Intent handling downgrade attempt (browser-chrome.rules) * 1:60289 <-> DISABLED <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt (server-webapp.rules) * 1:60313 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60280 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules) * 1:60291 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60278 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60292 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60293 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60284 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60294 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60275 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection (malware-cnc.rules) * 1:60295 <-> DISABLED <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt (malware-cnc.rules) * 1:60296 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt (malware-other.rules) * 1:60312 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60279 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60297 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60298 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60299 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt (malware-other.rules) * 1:60300 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60277 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60281 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60283 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60301 <-> DISABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60286 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt (malware-other.rules) * 1:60285 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60302 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60276 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 3:60308 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60310 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules) * 3:60287 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt (server-other.rules) * 3:60288 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt (server-other.rules) * 3:60303 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60309 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60306 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60305 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60311 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules) * 3:60304 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60307 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091300.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60286 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt (malware-other.rules) * 1:60279 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60282 <-> DISABLED <-> BROWSER-CHROME Intent handling downgrade attempt (browser-chrome.rules) * 1:60313 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60300 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60297 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60295 <-> DISABLED <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt (malware-cnc.rules) * 1:60285 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60289 <-> DISABLED <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt (server-webapp.rules) * 1:60302 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60299 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt (malware-other.rules) * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules) * 1:60296 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt (malware-other.rules) * 1:60292 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60275 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection (malware-cnc.rules) * 1:60291 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60280 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60312 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60294 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60281 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60301 <-> DISABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60298 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60283 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60276 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60284 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60278 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60277 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60293 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 3:60310 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules) * 3:60288 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt (server-other.rules) * 3:60303 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60307 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60305 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60304 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60308 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60287 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt (server-other.rules) * 3:60306 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60311 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules) * 3:60309 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2091101.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60312 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60275 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection (malware-cnc.rules) * 1:60301 <-> DISABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60283 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60313 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60278 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60284 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60285 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60302 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60286 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt (malware-other.rules) * 1:60277 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60289 <-> DISABLED <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt (server-webapp.rules) * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules) * 1:60276 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60281 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60291 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60300 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60292 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60293 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60279 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60280 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60294 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60295 <-> DISABLED <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt (malware-cnc.rules) * 1:60296 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt (malware-other.rules) * 1:60297 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60298 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60299 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt (malware-other.rules) * 1:60282 <-> DISABLED <-> BROWSER-CHROME Intent handling downgrade attempt (browser-chrome.rules) * 3:60309 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60307 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60310 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules) * 3:60287 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt (server-other.rules) * 3:60308 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60303 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60306 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-webapp.rules) * 3:60288 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt (server-other.rules) * 3:60305 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60304 <-> ENABLED <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt (server-other.rules) * 3:60311 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3000.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60284 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (snort3-malware-other.rules) * 1:60294 <-> ENABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (snort3-malware-other.rules) * 1:60285 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (snort3-malware-other.rules) * 1:60297 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (snort3-malware-other.rules) * 1:60291 <-> ENABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (snort3-malware-other.rules) * 1:60293 <-> ENABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (snort3-malware-other.rules) * 1:60301 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (snort3-malware-other.rules) * 1:60275 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection (snort3-malware-cnc.rules) * 1:60298 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (snort3-malware-other.rules) * 1:60302 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (snort3-malware-other.rules) * 1:60300 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (snort3-malware-other.rules) * 1:60289 <-> ENABLED <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt (snort3-server-webapp.rules) * 1:60292 <-> ENABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (snort3-malware-other.rules) * 1:60299 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt (snort3-malware-other.rules) * 1:60286 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt (snort3-malware-other.rules) * 1:60283 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (snort3-malware-other.rules) * 1:60282 <-> ENABLED <-> BROWSER-CHROME Intent handling downgrade attempt (snort3-browser-chrome.rules) * 1:60295 <-> ENABLED <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt (snort3-malware-cnc.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 2983.
The format of the file is:
gid:sid <-> Default rule state <-> Message (rule group)
* 1:60297 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60282 <-> DISABLED <-> BROWSER-CHROME Intent handling downgrade attempt (browser-chrome.rules) * 1:60291 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60275 <-> ENABLED <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection (malware-cnc.rules) * 1:60286 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt (malware-other.rules) * 1:60281 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules) * 1:60277 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60278 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60279 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60300 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60289 <-> DISABLED <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt (server-webapp.rules) * 1:60283 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60292 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60312 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60294 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60301 <-> DISABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60296 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt (malware-other.rules) * 1:60285 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60302 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt (malware-other.rules) * 1:60313 <-> DISABLED <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt (file-other.rules) * 1:60284 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt (malware-other.rules) * 1:60276 <-> DISABLED <-> OS-MOBILE SetSockOpts elevation of privilege attempt (os-mobile.rules) * 1:60298 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt (malware-other.rules) * 1:60295 <-> DISABLED <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt (malware-cnc.rules) * 1:60299 <-> ENABLED <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt (malware-other.rules) * 1:60290 <-> DISABLED <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt (browser-chrome.rules) * 1:60293 <-> DISABLED <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt (malware-other.rules) * 1:60280 <-> ENABLED <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt (server-webapp.rules)
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.1.
The format of the file is:
gid:sid <-> Message
* 1:300220 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300221 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300222 <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt * 1:60275 <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection * 1:60280 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60281 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60282 <-> BROWSER-CHROME Intent handling downgrade attempt * 1:60283 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60284 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60285 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60286 <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt * 3:60287 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt * 3:60288 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt * 1:60289 <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt * 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt * 1:60291 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60292 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60293 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60294 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60295 <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt * 1:60296 <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt * 1:60297 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60298 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60299 <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt * 1:60300 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60301 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 1:60302 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 3:60303 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60304 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60305 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60306 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60307 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60308 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60309 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60310 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt * 3:60311 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.0.3.4.
The format of the file is:
gid:sid <-> Message
* 1:300220 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300221 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300222 <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt * 1:60275 <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection * 1:60280 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60281 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60282 <-> BROWSER-CHROME Intent handling downgrade attempt * 1:60283 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60284 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60285 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60286 <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt * 3:60287 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt * 3:60288 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt * 1:60289 <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt * 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt * 1:60291 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60292 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60293 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60294 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60295 <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt * 1:60296 <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt * 1:60297 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60298 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60299 <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt * 1:60300 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60301 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 1:60302 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 3:60303 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60304 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60305 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60306 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60307 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60308 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60309 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60310 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt * 3:60311 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.0.
The format of the file is:
gid:sid <-> Message
* 1:300220 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300221 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300222 <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt * 1:60275 <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection * 1:60280 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60281 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60282 <-> BROWSER-CHROME Intent handling downgrade attempt * 1:60283 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60284 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60285 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60286 <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt * 3:60287 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt * 3:60288 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt * 1:60289 <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt * 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt * 1:60291 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60292 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60293 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60294 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60295 <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt * 1:60296 <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt * 1:60297 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60298 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60299 <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt * 1:60300 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60301 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 1:60302 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 3:60303 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60304 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60305 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60306 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60307 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60308 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60309 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60310 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt * 3:60311 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.0.1.
The format of the file is:
gid:sid <-> Message
* 1:300220 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300221 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300222 <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt * 1:60275 <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection * 1:60280 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60281 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60282 <-> BROWSER-CHROME Intent handling downgrade attempt * 1:60283 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60284 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60285 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60286 <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt * 3:60287 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt * 3:60288 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt * 1:60289 <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt * 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt * 1:60291 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60292 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60293 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60294 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60295 <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt * 1:60296 <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt * 1:60297 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60298 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60299 <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt * 1:60300 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60301 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 1:60302 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 3:60303 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60304 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60305 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60306 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60307 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60308 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60309 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60310 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt * 3:60311 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.1.0.
The format of the file is:
gid:sid <-> Message
* 1:300220 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300221 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300222 <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt * 1:60275 <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection * 1:60280 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60281 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60282 <-> BROWSER-CHROME Intent handling downgrade attempt * 1:60283 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60284 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60285 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60286 <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt * 3:60287 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt * 3:60288 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt * 1:60289 <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt * 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt * 1:60291 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60292 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60293 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60294 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60295 <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt * 1:60296 <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt * 1:60297 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60298 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60299 <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt * 1:60300 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60301 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 1:60302 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 3:60303 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60304 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60305 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60306 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60307 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60308 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60309 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60310 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt * 3:60311 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.3.0.
The format of the file is:
gid:sid <-> Message
* 1:300220 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300221 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300222 <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt * 1:60275 <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection * 1:60280 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60281 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60282 <-> BROWSER-CHROME Intent handling downgrade attempt * 1:60283 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60284 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60285 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60286 <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt * 3:60287 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt * 3:60288 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt * 1:60289 <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt * 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt * 1:60291 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60292 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60293 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60294 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60295 <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt * 1:60296 <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt * 1:60297 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60298 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60299 <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt * 1:60300 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60301 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 1:60302 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 3:60303 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60304 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60305 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60306 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60307 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60308 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60309 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60310 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt * 3:60311 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.4.0.
The format of the file is:
gid:sid <-> Message
* 1:300220 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300221 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300222 <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt * 1:60275 <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection * 1:60280 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60281 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60282 <-> BROWSER-CHROME Intent handling downgrade attempt * 1:60283 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60284 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60285 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60286 <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt * 3:60287 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt * 3:60288 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt * 1:60289 <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt * 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt * 1:60291 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60292 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60293 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60294 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60295 <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt * 1:60296 <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt * 1:60297 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60298 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60299 <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt * 1:60300 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60301 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 1:60302 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 3:60303 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60304 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60305 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60306 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60307 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60308 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60309 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60310 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt * 3:60311 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.5.0.
The format of the file is:
gid:sid <-> Message
* 1:300220 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300221 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300222 <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt * 1:60275 <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection * 1:60280 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60281 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60282 <-> BROWSER-CHROME Intent handling downgrade attempt * 1:60283 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60284 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60285 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60286 <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt * 3:60287 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt * 3:60288 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt * 1:60289 <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt * 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt * 1:60291 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60292 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60293 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60294 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60295 <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt * 1:60296 <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt * 1:60297 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60298 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60299 <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt * 1:60300 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60301 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 1:60302 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 3:60303 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60304 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60305 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60306 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60307 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60308 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60309 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60310 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt * 3:60311 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.7.0.
The format of the file is:
gid:sid <-> Message
* 1:300220 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300221 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300222 <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt * 1:60275 <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection * 1:60280 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60281 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60282 <-> BROWSER-CHROME Intent handling downgrade attempt * 1:60283 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60284 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60285 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60286 <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt * 3:60287 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt * 3:60288 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt * 1:60289 <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt * 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt * 1:60291 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60292 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60293 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60294 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60295 <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt * 1:60296 <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt * 1:60297 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60298 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60299 <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt * 1:60300 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60301 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 1:60302 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 3:60303 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60304 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60305 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60306 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60307 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60308 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60309 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60310 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt * 3:60311 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.9.0.
The format of the file is:
gid:sid <-> Message
* 1:300220 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300221 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300222 <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt * 1:60275 <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection * 1:60280 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60281 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60282 <-> BROWSER-CHROME Intent handling downgrade attempt * 1:60283 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60284 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60285 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60286 <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt * 3:60287 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt * 3:60288 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt * 1:60289 <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt * 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt * 1:60291 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60292 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60293 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60294 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60295 <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt * 1:60296 <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt * 1:60297 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60298 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60299 <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt * 1:60300 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60301 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 1:60302 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 3:60303 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60304 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60305 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60306 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60307 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60308 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60309 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60310 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt * 3:60311 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.11.0.
The format of the file is:
gid:sid <-> Message
* 1:300220 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300221 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300222 <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt * 1:60275 <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection * 1:60280 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60281 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60282 <-> BROWSER-CHROME Intent handling downgrade attempt * 1:60283 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60284 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60285 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60286 <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt * 3:60287 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt * 3:60288 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt * 1:60289 <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt * 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt * 1:60291 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60292 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60293 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60294 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60295 <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt * 1:60296 <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt * 1:60297 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60298 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60299 <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt * 1:60300 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60301 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 1:60302 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 3:60303 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60304 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60305 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60306 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60307 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60308 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60309 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60310 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt * 3:60311 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.15.0.
The format of the file is:
gid:sid <-> Message
* 1:300220 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300221 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300222 <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt * 1:60275 <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection * 1:60280 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60281 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60282 <-> BROWSER-CHROME Intent handling downgrade attempt * 1:60283 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60284 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60285 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60286 <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt * 3:60287 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt * 3:60288 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt * 1:60289 <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt * 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt * 1:60291 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60292 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60293 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60294 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60295 <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt * 1:60296 <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt * 1:60297 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60298 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60299 <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt * 1:60300 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60301 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 1:60302 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 3:60303 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60304 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60305 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60306 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60307 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60308 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60309 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60310 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt * 3:60311 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.18.0.
The format of the file is:
gid:sid <-> Message
* 1:300220 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300221 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300222 <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt * 1:60275 <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection * 1:60280 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60281 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60282 <-> BROWSER-CHROME Intent handling downgrade attempt * 1:60283 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60284 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60285 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60286 <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt * 3:60287 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt * 3:60288 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt * 1:60289 <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt * 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt * 1:60291 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60292 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60293 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60294 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60295 <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt * 1:60296 <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt * 1:60297 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60298 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60299 <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt * 1:60300 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60301 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 1:60302 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 3:60303 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60304 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60305 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60306 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60307 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60308 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60309 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60310 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt * 3:60311 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.20.0.
The format of the file is:
gid:sid <-> Message
* 1:300220 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300221 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300222 <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt * 1:60275 <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection * 1:60280 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60281 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60282 <-> BROWSER-CHROME Intent handling downgrade attempt * 1:60283 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60284 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60285 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60286 <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt * 3:60287 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt * 3:60288 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt * 1:60289 <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt * 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt * 1:60291 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60292 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60293 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60294 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60295 <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt * 1:60296 <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt * 1:60297 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60298 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60299 <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt * 1:60300 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60301 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 1:60302 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 3:60303 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60304 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60305 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60306 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60307 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60308 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60309 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60310 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt * 3:60311 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.21.0.
The format of the file is:
gid:sid <-> Message
* 1:300220 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300221 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300222 <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt * 1:60275 <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection * 1:60280 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60281 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60282 <-> BROWSER-CHROME Intent handling downgrade attempt * 1:60283 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60284 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60285 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60286 <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt * 3:60287 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt * 3:60288 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt * 1:60289 <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt * 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt * 1:60291 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60292 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60293 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60294 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60295 <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt * 1:60296 <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt * 1:60297 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60298 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60299 <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt * 1:60300 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60301 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 1:60302 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 3:60303 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60304 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60305 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60306 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60307 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60308 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60309 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60310 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt * 3:60311 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt
This is the complete list of rules modified and added in the Sourcefire VRT Certified rule pack for Snort version 3.1.35.0.
The format of the file is:
gid:sid <-> Message
* 1:300220 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300221 <-> OS-MOBILE SetSockOpts elevation of privilege attempt * 1:300222 <-> FILE-OTHER Omron CX-Supervisor malicious project file download attempt * 1:60275 <-> MALWARE-CNC Win.Trojan.Manjusaka outbound connection * 1:60280 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60281 <-> SERVER-WEBAPP Atlassian Confluence hardcoded credentials use attempt * 1:60282 <-> BROWSER-CHROME Intent handling downgrade attempt * 1:60283 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60284 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60285 <-> MALWARE-OTHER Php.Webshell.CrewShell inbound connection attempt * 1:60286 <-> MALWARE-OTHER Php.Webshell.CrewShell outbound connection attempt * 3:60287 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1582 attack attempt * 3:60288 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1584 attack attempt * 1:60289 <-> SERVER-WEBAPP PrimeTek PrimeFaces plugin expression language injection attempt * 1:60290 <-> BROWSER-CHROME Google Chrome v8 garbage collector use after free attempt * 1:60291 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60292 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60293 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60294 <-> MALWARE-OTHER Win.Downloader.ChromeLoader payload download attempt * 1:60295 <-> MALWARE-CNC Win.Downloader.ChromeLoader outbound connection attempt * 1:60296 <-> MALWARE-OTHER Php.Webshell.Cybershell download attempt * 1:60297 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60298 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60299 <-> MALWARE-OTHER Php.Webshell.Cybershell upload attempt * 1:60300 <-> MALWARE-OTHER Php.Webshell.Cybershell inbound connection attempt * 1:60301 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 1:60302 <-> MALWARE-OTHER Php.Webshell.Cybershell outbound connection attempt * 3:60303 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60304 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60305 <-> SERVER-OTHER TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60306 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60307 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60308 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60309 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1581 attack attempt * 3:60310 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt * 3:60311 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2022-1585 attack attempt
©2024 Cisco and/or its affiliates. Snort, the Snort and Pig logo are registered trademarks of Cisco. All rights reserved.
