Talos Rules 2024-01-09
Talos is aware of vulnerabilities affecting products from Microsoft Corporation.

Microsoft Vulnerability CVE-2024-20653: A coding deficiency exists in Microsoft Common Log File System that may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 62854 through 62859, Snort 3: GID 1, SIDs 300799 through 300801.

Microsoft Vulnerability CVE-2024-20683: A coding deficiency exists in Microsoft Win32k that may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 62847 through 62848, Snort 3: GID 1, SID 300797.

Microsoft Vulnerability CVE-2024-20698: A coding deficiency exists in Microsoft Windows Kernel that may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 62849 through 62850, Snort 3: GID 1, SID 300798.

Microsoft Vulnerability CVE-2024-21310: A coding deficiency exists in Microsoft Windows Cloud Files Mini Filter Driver that may lead to an escalation of privilege.

Rules to detect attacks targeting these vulnerabilities are included in this release and are identified with: Snort 2: GID 1, SIDs 62860 through 62861, Snort 3: GID 1, SID 300802.

Talos also has added and modified multiple rules in the browser-chrome, file-pdf and server-webapp rule sets to provide coverage for emerging threats from these technologies.

For information about Snort Subscriber Rulesets available for purchase, please visit the Snort product page.

Change logs

29200

2024-01-09 18:31:44 UTC

Snort Subscriber Rules Update

Date: 2024-01-09

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2092000.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:62844 <-> ENABLED <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt (server-webapp.rules)
 * 1:62845 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62846 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62847 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62848 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62849 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62850 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62851 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt (server-webapp.rules)
 * 1:62854 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62855 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62856 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62857 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62858 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62859 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62860 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62861 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 3:62852 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62853 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62862 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62863 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62864 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62865 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62866 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62867 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62868 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt (server-webapp.rules)

Modified Rules:


 * 3:62807 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt (server-webapp.rules)

29190

2024-01-09 18:31:44 UTC

Snort Subscriber Rules Update

Date: 2024-01-09

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091900.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:62848 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62857 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62851 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt (server-webapp.rules)
 * 1:62861 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62844 <-> ENABLED <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt (server-webapp.rules)
 * 1:62860 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62847 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62854 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62855 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62856 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62849 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62850 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62858 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62859 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62846 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62845 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 3:62866 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62862 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62863 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62867 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62868 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt (server-webapp.rules)
 * 3:62853 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62852 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62865 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62864 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)

Modified Rules:


 * 3:62807 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt (server-webapp.rules)

29181

2024-01-09 18:31:44 UTC

Snort Subscriber Rules Update

Date: 2024-01-09

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091801.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:62861 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62854 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62851 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt (server-webapp.rules)
 * 1:62845 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62849 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62858 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62850 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62844 <-> ENABLED <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt (server-webapp.rules)
 * 1:62847 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62846 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62856 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62857 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62859 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62860 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62855 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62848 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 3:62852 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62864 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62863 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62866 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62867 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62853 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62868 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt (server-webapp.rules)
 * 3:62865 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62862 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)

Modified Rules:


 * 3:62807 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt (server-webapp.rules)

29171

2024-01-09 18:31:44 UTC

Snort Subscriber Rules Update

Date: 2024-01-09

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091701.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:62850 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62857 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62849 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62861 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62854 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62844 <-> ENABLED <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt (server-webapp.rules)
 * 1:62847 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62846 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62845 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62848 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62858 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62859 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62860 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62855 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62851 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt (server-webapp.rules)
 * 1:62856 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 3:62862 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62868 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt (server-webapp.rules)
 * 3:62864 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62852 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62865 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62866 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62867 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62863 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62853 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)

Modified Rules:


 * 3:62807 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt (server-webapp.rules)

29170

2024-01-09 18:31:44 UTC

Snort Subscriber Rules Update

Date: 2024-01-09

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091700.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:62861 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62856 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62855 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62849 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62857 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62854 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62858 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62847 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62851 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt (server-webapp.rules)
 * 1:62844 <-> ENABLED <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt (server-webapp.rules)
 * 1:62850 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62860 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62859 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62848 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62845 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62846 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 3:62865 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62864 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62853 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62852 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62868 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt (server-webapp.rules)
 * 3:62867 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62866 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62863 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62862 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)

Modified Rules:


 * 3:62807 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt (server-webapp.rules)

29161

2024-01-09 18:31:44 UTC

Snort Subscriber Rules Update

Date: 2024-01-09

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091601.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:62861 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62848 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62860 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62845 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62857 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62851 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt (server-webapp.rules)
 * 1:62856 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62849 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62846 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62858 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62859 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62850 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62855 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62844 <-> ENABLED <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt (server-webapp.rules)
 * 1:62854 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62847 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 3:62867 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62863 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62868 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt (server-webapp.rules)
 * 3:62864 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62866 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62862 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62853 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62852 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62865 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)

Modified Rules:


 * 3:62807 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt (server-webapp.rules)

29160

2024-01-09 18:31:44 UTC

Snort Subscriber Rules Update

Date: 2024-01-09

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091600.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:62844 <-> ENABLED <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt (server-webapp.rules)
 * 1:62850 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62855 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62856 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62847 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62859 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62861 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62858 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62851 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt (server-webapp.rules)
 * 1:62854 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62860 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62846 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62848 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62845 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62849 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62857 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 3:62853 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62868 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt (server-webapp.rules)
 * 3:62867 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62864 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62866 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62852 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62862 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62863 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62865 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)

Modified Rules:


 * 3:62807 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt (server-webapp.rules)

29151

2024-01-09 18:31:44 UTC

Snort Subscriber Rules Update

Date: 2024-01-09

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091501.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:62848 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62847 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62860 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62849 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62855 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62856 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62857 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62861 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62859 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62851 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt (server-webapp.rules)
 * 1:62858 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62846 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62844 <-> ENABLED <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt (server-webapp.rules)
 * 1:62850 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62845 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62854 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 3:62867 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62863 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62865 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62868 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt (server-webapp.rules)
 * 3:62852 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62853 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62864 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62866 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62862 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)

Modified Rules:


 * 3:62807 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt (server-webapp.rules)

29141

2024-01-09 18:31:44 UTC

Snort Subscriber Rules Update

Date: 2024-01-09

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091401.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:62851 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt (server-webapp.rules)
 * 1:62844 <-> ENABLED <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt (server-webapp.rules)
 * 1:62856 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62846 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62858 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62857 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62854 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62850 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62855 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62848 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62861 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62845 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62847 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62849 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62860 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62859 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 3:62864 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62863 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62868 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt (server-webapp.rules)
 * 3:62853 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62866 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62852 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62862 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62865 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62867 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)

Modified Rules:


 * 3:62807 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt (server-webapp.rules)

29130

2024-01-09 18:31:44 UTC

Snort Subscriber Rules Update

Date: 2024-01-09

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091300.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:62857 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62860 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62858 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62848 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62856 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62861 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62859 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62847 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62850 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62845 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62851 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt (server-webapp.rules)
 * 1:62846 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62849 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62844 <-> ENABLED <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt (server-webapp.rules)
 * 1:62855 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62854 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 3:62853 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62866 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62867 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62852 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62865 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62864 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62862 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62863 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62868 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt (server-webapp.rules)

Modified Rules:


 * 3:62807 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt (server-webapp.rules)

29111

2024-01-09 18:31:44 UTC

Snort Subscriber Rules Update

Date: 2024-01-09

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2091101.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:62849 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62855 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62857 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62858 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62848 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62845 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62856 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62847 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62859 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62861 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62846 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62860 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62850 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62844 <-> ENABLED <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt (server-webapp.rules)
 * 1:62851 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt (server-webapp.rules)
 * 1:62854 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 3:62853 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62865 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)
 * 3:62867 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62863 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62852 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt (server-webapp.rules)
 * 3:62868 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt (server-webapp.rules)
 * 3:62862 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt (file-pdf.rules)
 * 3:62866 <-> ENABLED <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt (browser-chrome.rules)
 * 3:62864 <-> ENABLED <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt (file-pdf.rules)

Modified Rules:


 * 3:62807 <-> ENABLED <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt (server-webapp.rules)

2983

2024-01-09 18:31:44 UTC

Snort Subscriber Rules Update

Date: 2024-01-09

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 2983.

The format of the file is:

gid:sid <-> Default rule state <-> Message (rule group)

New Rules:


 * 1:62854 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62846 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62855 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62861 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62847 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62848 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt (os-windows.rules)
 * 1:62858 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62860 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt (os-windows.rules)
 * 1:62845 <-> DISABLED <-> SERVER-WEBAPP Netgate pfSense command injection attempt (server-webapp.rules)
 * 1:62850 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62856 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62851 <-> DISABLED <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt (server-webapp.rules)
 * 1:62859 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62849 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt (os-windows.rules)
 * 1:62857 <-> DISABLED <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt (os-windows.rules)
 * 1:62844 <-> ENABLED <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt (server-webapp.rules)

Modified Rules:

3000

2024-01-09 18:35:18 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.0.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

3031

2024-01-09 18:35:18 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.3.1.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

3034

2024-01-09 18:35:18 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.0.3.4.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

3100

2024-01-09 18:35:18 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.0.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

3101

2024-01-09 18:35:18 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.0.1.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

3110

2024-01-09 18:35:18 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.1.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

3130

2024-01-09 18:35:18 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.3.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

3140

2024-01-09 18:35:18 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.4.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

3150

2024-01-09 18:35:18 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.5.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

3170

2024-01-09 18:35:18 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.7.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

3190

2024-01-09 18:35:18 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.9.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

31110

2024-01-09 18:35:19 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.11.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

31150

2024-01-09 18:35:19 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.15.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

31180

2024-01-09 18:35:19 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.18.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

31200

2024-01-09 18:35:19 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.20.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

31210

2024-01-09 18:35:19 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.21.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

31350

2024-01-09 18:35:19 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.35.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

31440

2024-01-09 18:35:19 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.44.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt

31470

2024-01-09 18:35:19 UTC

Snort Subscriber Rules Update

Date: 2024-01-08-001

This is the complete list of rules modified and added in the Cisco Talos Certified rule pack for Snort version 3.1.47.0.

The format of the file is:

gid:sid <-> Message

New Rules:

* 1:300797 <-> OS-WINDOWS Microsoft Windows Win32k elevation of privilege attempt
* 1:300798 <-> OS-WINDOWS Microsoft Windows Kernel elevation of privilege attempt
* 1:300799 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300800 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300801 <-> OS-WINDOWS Microsoft Windows Common Log File System escalation of privilege attempt
* 1:300802 <-> OS-WINDOWS Microsoft Windows Cloud Files Mini Filter Driver elevation of privilege attempt
* 1:62844 <-> SERVER-WEBAPP WordPress Backup Migration plugin PHP code injection attempt
* 1:62845 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62846 <-> SERVER-WEBAPP Netgate pfSense command injection attempt
* 1:62851 <-> SERVER-WEBAPP Schneider Electric IIoT Monitor frmUpdateSetting_FileInput directory traversal attempt
* 3:62852 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62853 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1872 attack attempt
* 3:62862 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62863 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1901 attack attempt
* 3:62864 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62865 <-> FILE-PDF TRUFFLEHUNTER TALOS-2023-1890 attack attempt
* 3:62866 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62867 <-> BROWSER-CHROME TRUFFLEHUNTER TALOS-2023-1870 attack attempt
* 3:62868 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1898 attack attempt

Modified Rules:

* 3:62807 <-> SERVER-WEBAPP TRUFFLEHUNTER TALOS-2023-1873 attack attempt