Cloud One Workload Security and Deep Security Center

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DCERPC Services
1007134* - Batch File Uploaded On Network Share (ATT&CK T1021.002, T1204.002)
1007064* - Executable File Uploaded On System32 Folder Through SMB Share (ATT&CK T1021.002, T1204.002)
1007114* - Portable Executable File Uploaded On SMB Share (ATT&CK T1021.002, T1204.002)
1007020* - Remote CreateService Request Detected Through SMBv1 Protocol (ATT&CK T1543.003)
1007035* - Remote DeleteService Request Through SMBv1 Detected (ATT&CK T1543.003)
1007069* - Remote Service Execution Through SMBv1 Detected (ATT&CK T1569.002)


DNS Client
1002988* - Multiple Vendors libspf2 DNS TXT Record Parsing Buffer Overflow


File Sharing Applications
1007608* - Amazon Cloud Drive (ATT&CK T1102.002, T1567.002)
1007605* - BOX (ATT&CK T1102.002, T1567.002)
1004707* - Dropbox (ATT&CK T1102.002, T1567.002)
1002472* - FTP Client (ATT&CK T1048.003, T1071.002)
1007463* - Microsoft OneDrive (ATT&CK T1102.002, T1567.002)


Instant Messenger Applications
1002103* - AOL Instant Messenger (ATT&CK T1102.002)
1004663* - IP Messenger (ATT&CK T1102.002)
1002507* - Jabber (ATT&CK T1102.002)
1003067* - MSN Instant Message URL Blocker (ATT&CK T1102.002)
1002162* - MSN Messenger (ATT&CK T1102.002)
1002462* - MSN Messenger File Transfers (ATT&CK T1102.002)
1004941* - QQ Messenger (ATT&CK T1102.002)


Mail Client Applications
1001112* - SMTP Client (ATT&CK T1071.003)


Remote Login Applications
1002508* - RDP (ATT&CK T1021.001)


SSL Client
1006561* - Identified Usage Of TLS/SSL EXPORT Cipher Suite In Response (ATT&CK T1573.002)


SSL/TLS Server
1006293* - Detected SSLv3 Request (ATT&CK T1573.002)
1006297* - Identified CBC Based Cipher Suite In SSLv3 Response (ATT&CK T1573.002)
1006311* - Identified Too Many SSL Alert Messages In SSLv3 Traffic (ATT&CK T1573.002)


Suspicious Client Application Activity
1001162* - Detected HTTP Client Traffic (ATT&CK T1071.001)
1005324* - Detected SSLv2 Response (ATT&CK T1573.002)
1005401* - Identified Suspicious HTTP Traffic (ATT&CK T1071.001)


Suspicious Server Application Activity
1003594* - Detected SSL/TLS Server Traffic (ATT&CK T1573.002)
1005321* - Detected SSLv2 Request (ATT&CK T1573.002)
1002378* - Detected Virtual Network Computing (VNC) Server Traffic (ATT&CK T1021.005)


Trend Micro OfficeScan
1011057 - Trend Micro Multiple Products Arbitrary File Upload Vulnerability (CVE-2021-36741)


Web Application Common
1011047* - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
1011056* - WordPress 'SP Project & Document Manager' Plugin Remote Code Execution Vulnerability (CVE-2021-24347)
1011038* - Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability (CVE-2021-20081)


Web Application PHP Based
1011045 - WordPress 'Modern Events Calendar Lite' Plugin Improper Access Control Vulnerability (CVE-2021-24146)


Web Client Common
1011032* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)
1009407* - Detected Suspicious DLL Side Loading Attempt Over WebDAV (ATT&CK T1574.002)
1006442* - Identified Suspicious Obfuscated JavaScript - 2 (ATT&CK T1203, T1001)
1011054* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
1011065 - Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability (CVE-2021-33742)
1004302* - Microsoft Windows Shortcut Remote Code Execution


Web Server Common
1007213* - Disallow Upload Of A Class File (ATT&CK T1190)
1007212* - Disallow Upload Of An Archive File (ATT&CK T1190)


Web Server HTTPS
1006741* - Identified SSL/TLS Diffie-Hellman Key Exchange Using Weak Parameters Server (ATT&CK T1573.002)
1011050* - Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2021-34523)
1011072 - Microsoft Exchange Server Security Feature Bypass Vulnerability (CVE-2021-31207)
1011046 - rConfig 'vendor.crud.php' Arbitrary File Upload Vulnerability


Web Server SharePoint
1011051* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34520)


Zoho ManageEngine
1011062 - Zoho ManageEngine Applications Manager Cross Site Scripting Vulnerability (CVE-2021-31813)


Zoho ManageEngine ADSelfService Plus
1011064 - Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CVE-2021-28958)


Integrity Monitoring Rules:

1009643* - Linux/Unix - bash command history cleared (ATT&CK T1059.004)


Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DCERPC Services
1009490* - Block Administrative Share - 1 (ATT&CK T1021.002)
1010426* - Identified Domain-Level Account Discovery Over SMB (ATT&CK T1087.002)
1009703* - Identified Domain-Level Permission Groups Discovery Over SMB (ATT&CK T1069.002)
1010101* - Identified Usage Of PAExec Command Line Tool (ATT&CK T1569.002)
1006906* - Identified Usage Of PsExec Command Line Tool (ATT&CK T1569.002)
1005293* - Prevent Windows Administrator User Login Over SMB (ATT&CK T1078.002,T1078.001,T1021.002)


DCERPC Services - Client
1004373* - Identified DLL Side Loading Attempt Over Network Share (ATT&CK T1574.002)
1010106* - Identified Downloading Of PowerShell Scripts Through SMB Share (ATT&CK T1059.001)


Directory Server LDAP
1010640* - Identified Remote Account Discovery Over LDAP (ATT&CK T1087.002)
1010641* - Identified Remote Permission Groups Discovery Over LDAP (ATT&CK 1069.002)


Remote Desktop Protocol Server
1009562* - Identified Remote Desktop Protocol (RDP) Brute Force Attempt (ATT&CK T1110)
1009343* - Identified Too Many SSL Alert Messages In SSLv3 Over RDP (ATT&CK T1021.001)


Suspicious Client Application Activity
1008946* - Heuristic Detection Of Suspicious Digital Certificate (ATT&CK T1587.003)
1010327* - Identified Potential Malicious Client Traffic (ATT&CK T1071.001)
1005299* - Identified Potentially Malicious RAT Traffic - III (ATT&CK T1571, T1219)
1010307* - Identified Reverse Shell Communication Over HTTPS (ATT&CK T1071.001)
1010306* - Identified Reverse Shell Communication Over HTTPS - 1 (ATT&CK T1071.001)
1010364* - Identified Reverse Shell Communication Over HTTPS - 2 (ATT&CK T1071.001)
1010365* - Identified Reverse Shell Communication Over HTTPS - 3 (ATT&CK T1071.001)
1010370* - Identified Reverse Shell Communication Over HTTPS - 4 (ATT&CK T1071.001)
1009952* - Identified WhatsApp Communication Attempt (ATT&CK T1102.002)


Suspicious Server Application Activity
1003593* - Detected SSH Server Traffic (ATT&CK T1021.004)
1009549* - Detected Terminal Services (RDP) Server Traffic - 1 (ATT&CK T1021.001)
1010328* - Identified Potential Malicious Server Traffic (ATT&CK T1071.001)


Unix SSH
1008313* - Identified Many SSH Client Key Exchange Requests (ATT&CK T1499.002, T1110)
1005748* - Multiple SSH Connections Detected (ATT&CK T1499.002, T1110)


Web Application Common
1011047* - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
1011056 - WordPress 'SP Project & Document Manager' Plugin Remote Code Execution Vulnerability (CVE-2021-24347)
1011043* - WordPress 'XCloner' Plugin Remote Code Execution Vulnerability (CVE-2020-35948)
1011038 - Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability (CVE-2021-20081)


Web Client Common
1011032* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)
1011054 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
1010956 - Microsoft Raw Image Extension Remote Code Execution Vulnerability (ZDI-21-506)


Web Client SharePoint
1011052 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34468)


Web Media Applications
1009913* - Identified Pastebin Communication (ATT&CK T1102.002)


Web Server Common
1010336* - Disallow Upload Of Linux Executable File (ATT&CK T1608.001)


Web Server HTTPS
1011050 - Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2021-34523)
1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)


Web Server Miscellaneous
1011035* - Jenkins 'Generic Webhook Trigger' Plugin External Entity Injection Vulnerability (CVE-2021-21669)


Web Server Nagios
1011022* - Nagios XI Account Email Address Stored Cross-Site Scripting Vulnerability


Web Server SharePoint
1011051 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34520)
1010738* - Restrict Attempt To Enumerate Microsoft SharePoint For User Accounts (ATT&CK T1087.003, T1087.002)


Windows Remote Management
1009894* - Powershell Remote Command Execution Via WinRM - HTTP (Request) (ATT&CK T1021.006, T1059.001)
1010048* - WinRM Service Detected & Powershell RCE Over HTTP (ATT&CK T1021.006, T1059.001)


Windows Remote Management Client
1010073* - WinRM Service Detected & Powershell RCE Over HTTP - Client (ATT&CK T1021.006, T1059.001)


Windows SMB Server
1007065* - Executable File Uploaded On Network Share (ATT&CK T1570)
1011058 - Identified DCERPC EfsRpcOpenFileRaw Call Over SMB Protocol


Windows Services RPC Server DCERPC
1009892* - Identified Domain-Level Credentials Dumping Over DCERPC (ATT&CK T1003.006)
1009480* - Identified WMI Query Over DCE/RPC Protocol (ATT&CK T1047)


Integrity Monitoring Rules:

1003587* - Linux/Unix - Directory attributes of /bin modified (ATT&CK T1222.002)
1002766* - Linux/Unix - Directory attributes of /sbin modified (ATT&CK T1222.002)
1003573* - Linux/Unix - File attributes in the /bin directory modified
1003513* - Linux/Unix - File attributes in the /etc directory modified
1003514* - Linux/Unix - File attributes in the /lib directory modified
1003574* - Linux/Unix - File attributes in the /sbin directory modified
1002770* - Linux/Unix - File attributes in the /usr/bin and /usr/sbin directories modified
1008464* - Linux/Unix - File attributes in the /usr/etc, /usr/lib, /usr/lib64, /usr/libexec And /usr/local directories modified
1005193* - Linux/Unix - File attributes modified (ATT&CK T1070.002, T1222.002)
1002771* - Linux/Unix - File permissions in the /var/log directory modified (ATT&CK T1222.002)
1010389* - Linux/Unix - Process running from the /tmp and /var/tmp directories detected (ATT&CK T1543)


Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

Pulsar Binary Protocol
1010998* - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over Pulsar (CVE-2021-22160)


Web Application Common
1011047 - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
1011043 - WordPress 'XCloner' Plugin Remote Code Execution Vulnerability (CVE-2020-35948)


Web Client Common
1011048 - Google Chrome Heap Corruption Vulnerability (CVE-2021-21166)
1011049 - Google Chrome V8 Type Confusion Vulnerability (CVE-2021-30551)


Web Client Internet Explorer/Edge
1010133* - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2020-0674)


Web Server HTTPS
1011041* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473)


Web Server Miscellaneous
1011035 - Jenkins 'Generic Webhook Trigger' Plugin External Entity Injection Vulnerability (CVE-2021-21669)
1011028* - Jenkins 'Scriptler' Plugin Stored Cross-Site Scripting Vulnerability (CVE-2021-21667)


Web Server Nagios
1011023* - Nagios XI 'Custom-includes' Module Directory Traversal Vulnerability (CVE-2021-3277)
1011022 - Nagios XI Account Email Address Stored Cross-Site Scripting Vulnerability


Web Server SharePoint
1011030* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34467)


Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.


Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

Oracle E-Business Suite Web Interface
1011019* - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2190)


Pulsar Binary Protocol
1010998 - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over Pulsar (CVE-2021-22160)


Web Client Common
1011032 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)


Web Client Internet Explorer/Edge
1011040 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2021-34448)


Web Server Common
1009705* - Atlassian Confluence Server Remote Code Execution Vulnerability (CVE-2019-3396)


Web Server HTTPS
1011041 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473)


Web Server Miscellaneous
1011028 - Jenkins 'Scriptler' Plugin Stored Cross-Site Scripting Vulnerability (CVE-2021-21667)


Web Server Nagios
1011023 - Nagios XI 'Custom-includes' Module Directory Traversal Vulnerability (CVE-2021-3277)


Web Server SharePoint
1011030 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34467)


Windows Server DCERPC
1011016* - Identified DCERPC AddPrinterDriverEx Call Over TCP Protocol


Zoho ManageEngine
1011020* - Zoho ManageEngine Applications Manager Stored Cross-Site Scripting Vulnerability


Integrity Monitoring Rules:

1002875* - Linux/Unix - Software installed, updated or removed
1010373* - Linux/Unix - Systemd service modified (ATT&CK T1543.002)
1010791 - Linux/Unix - Task scheduler entries modified (ATT&CK T1053)
1009643* - Linux/Unix - bash command history cleared (ATT&CK T1059.004)
1009622* - Linux/Unix - bash non-root user configuration files modified (ATT&CK T1546.004)
1011021 - Linux/Unix - bash root user configuration files modified (ATT&CK T1546.004)


Log Inspection Rules:

1011042 - SolarWinds Serv-U SSH EXCEPTION (CVE-2021-35211)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

Directory Server LDAP
1011008* - OpenLDAP Integer Underflow Vulnerability (CVE-2020-36221)


Oracle E-Business Suite Web Interface
1010999* - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2189)
1011019 - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2190)


Port Mapper Windows
1001033* - Windows Port Mapper Decoder


Web Application Common
1005934* - Identified Suspicious Command Injection Attack


Web Application PHP Based
1010982* - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)


Web Server Apache
1010997* - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over HTTP (CVE-2021-22160)


Web Server HTTPS
1011015* - WordPress 'Poll, Survey, Questionnaire and Voting system' Plugin Blind SQL Injection Vulnerability


Windows SMB Server
1011018* - Identified DCERPC AddPrinterDriverEx Call Over SMB Protocol


Windows Services RPC Server DCERPC
1011016* - Identified DCERPC AddPrinterDriverEx Call Over TCP Protocol


Zoho ManageEngine
1011020 - Zoho ManageEngine Applications Manager Stored Cross-Site Scripting Vulnerability
1011012* - Zoho ManageEngine Applications Manager URL Monitor SQL Injection Vulnerability


Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.


Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

Port Mapper Windows
1001033* - Windows Port Mapper Decoder


Windows SMB Server
1011018 - Identified DCERPC AddPrinterDriverEx Call Over SMB Protocol


Windows Services RPC Server DCERPC
1011016 - Identified DCERPC AddPrinterDriverEx Call Over TCP Protocol


Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.


Log Inspection Rules:

1011017 - Microsoft Windows - Print Spooler Failed Loading Plugin Module (PrintNightmare)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DNS Server
1010986* - ISC BIND TSIG Integer Overflow Vulnerability (CVE-2021-25216)


Directory Server LDAP
1011008 - OpenLDAP Integer Underflow Vulnerability (CVE-2020-36221)


Oracle E-Business Suite Web Interface
1010999 - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2189)


Web Application PHP Based
1011013 - WordPress 'Stop Spammers' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24245)
1010982* - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)


Web Client Common
1010711* - Google Chrome Buffer Overflow Vulnerability (CVE-2019-5782)
1011007 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-695)
1011006 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-697)
1011005 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-699)
1011004 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-701)
1011002 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-703)
1011001 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-704)
1011000 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-705)
1011003 - Microsoft 3D Viewer Remote Code Execution Vulnerability (ZDI-21-702)
1011011 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-696)
1011010 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-698)
1011009 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-700)


Web Server Apache
1010997 - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over HTTP (CVE-2021-22160)


Web Server Common
1010980* - Apache Airflow Remote Code Execution Vulnerability (CVE-2020-11978)
1010985* - Subrion CMS Remote Code Execution Vulnerability (CVE-2018-19422)


Web Server HTTPS
1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)
1011015 - WordPress 'Poll, Survey, Questionnaire and Voting system' Plugin Blind SQL Injection Vulnerability


Zoho ManageEngine
1011012 - Zoho ManageEngine Applications Manager URL Monitor SQL Injection Vulnerability


Integrity Monitoring Rules:

1010843 - Linux/Unix - Boot files modified (ATT&CK T1542)
1010845 - Linux/Unix - Default firewall rules modified (ATT&CK T1562.004)
1010846 - Linux/Unix - Disk configuration files modified (ATT&CK T1561.002)
1010847 - Linux/Unix - SSL configuration files modified (ATT&CK T1587.003)
1010793 - Linux/Unix - Shared object files modified
1010856 - Linux/Unix - Static boot loader files modified (ATT&CK T1542)
1010848 - Linux/Unix - User access control files modified (ATT&CK T1068)
1010844 - Linux/Unix - modeprobe configuration files modified (ATT&CK T1547.006)


Log Inspection Rules:

1010139* - Microsoft Windows - Remote Desktop Services (ATT&CK T1021.001)

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DNS Server
1010986 - ISC BIND TSIG Integer Overflow Vulnerability (CVE-2021-25216)


Microsoft Office
1010991 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2021-31939)
1010992 - Microsoft Office Graphics Remote Code Execution Vulnerability (CVE-2021-31941)


Web Application PHP Based
1010993 - WordPress 'Directories Pro' Plugin Cross-Site Scripting Vulnerability (CVE-2020-29304)
1010982* - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)


Web Client Common
1010974* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-37)
1010978* - Microsoft Exchange Server Spoofing Vulnerability (CVE-2021-31209)
1010995 - Microsoft Paint 3D Remote Code Execution Vulnerability (CVE-2021-31945)
1010994 - Microsoft Paint 3D Remote Code Execution Vulnerability (CVE-2021-31946)
1010996 - Microsoft Paint 3D Remote Code Execution Vulnerability (CVE-2021-31983)
1010987 - Microsoft Visual Studio Remote Code Execution Vulnerability (CVE-2021-27068)


Web Server Common
1010985 - Subrion CMS Remote Code Execution Vulnerability (CVE-2018-19422)


Web Server HTTPS
1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)


Web Server Miscellaneous
1010976* - SolarWinds NPM 'FromJson' Remote Code Execution Vulnerability (CVE-2021-31474)


Web Server Oracle
1005128* - Oracle Business Transaction Management Server 'FlashTunnelService' WriteToFile Message Remote Code Execution


Web Server SharePoint
1010947* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-31181)


Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.


Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

DCERPC Services
1010900* - Microsoft Windows SMB Information Disclosure Vulnerability (CVE-2021-28325)


SolarWinds Orion NPM
1010975 - SolarWinds Orion Job Scheduler Remote Code Execution Vulnerability (CVE-2021-31475)


Web Application PHP Based
1010982 - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)


Web Client Common
1010978 - Microsoft Exchange Server Spoofing Vulnerability (CVE-2021-31209)
1010984 - Microsoft Windows DWM Core Library Elevation of Privilege Vulnerability (CVE-2021-33739)
1010207* - Microsoft Windows Multiple Type1 Font Parsing Remote Code Execution Vulnerabilities (CVE-2020-1020 and CVE-2020-0938)


Web Server Common
1010980 - Apache Airflow Remote Code Execution Vulnerability (CVE-2020-11978)


Web Server HTTPS
1010983 - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)


Web Server Miscellaneous
1010976 - SolarWinds NPM 'FromJson' Remote Code Execution Vulnerability (CVE-2021-31474)


Integrity Monitoring Rules:

1010821 - Linux/Unix - Alternative commands modified (ATT&CK T1036)
1010842 - Linux/Unix - Boot loader configuration files modified (ATT&CK T1542)
1010838 - Linux/Unix - Core system configuration files modified
1010979 - Linux/Unix - FTP client process initiated (ATT&CK T1048)
1010840 - Linux/Unix - Host access control files modified (ATT&CK T1584.004)
1010964 - Linux/Unix - Internet routing information file modified
1010963 - Linux/Unix - Kernel configuration files modified (ATT&CK T1547.006)
1010809 - Linux/Unix - List of valid login shells modified (ATT&CK T1059.004)
1010798 - Linux/Unix - Local user and group files modified (ATT&CK T1136.001, T1531)
1010839 - Linux/Unix - Name of the local system modified (ATT&CK T1082)
1010812 - Linux/Unix - Name resolver configuration files modified (ATT&CK T1071.004, T1583.002)
1010962 - Linux/Unix - Network services configuration files modified
1010813 - Linux/Unix - PAM configuration files modified (ATT&CK T1068)
1010853 - Linux/Unix - Process initialization scripts and configuration files modified (ATT&CK 1037)
1010817 - Linux/Unix - Run control (rc) scripts modified (ATT&CK T1037.004)
1010815 - Linux/Unix - Samba configuration files modified (ATT&CK T1135)
1010824 - Linux/Unix - Software repository modified (ATT&CK T1195.002)
1010807 - Linux/Unix - System wide environment variables and startup scripts modified (ATT&CK T1546.004)
1010825 - Linux/Unix - adduser, useradd and deluser configuration files modified (ATT&CK T1136.001, T1531)
1010808 - Linux/Unix - bash configuration files modified (ATT&CK T1059.004, T1546.004)
1010827 - Linux/Unix - csh/tcsh configuration files modified (ATT&CK T1059.004, T1546.004)
1010826 - Linux/Unix - dhclient configuration files modified
1010841 - Linux/Unix - ftpd configuration files modified (ATT&CK T1048, T1071.002)
1010805 - Linux/Unix - runtime linker configuration files modified
1010950 - Linux/Unix - sudo files modified (ATT&CK T1548.003)
1010819 - Linux/Unix - xinetd configuration files modified
1010828 - Linux/Unix - zsh configuration files modified (ATT&CK T1059.004, T1546.004)


Log Inspection Rules:

There are no new or updated Log Inspection Rules in this Security Update.

* indicates a new version of an existing rule

Deep Packet Inspection Rules:

Alibaba Nacos
1010971* - Alibaba Nacos AuthFilter Authentication Bypass Vulnerability (CVE-2021-29441)


Directory Server LDAP
1010970* - OpenLDAP Slapd Search Parsing Denial Of Service Vulnerability (CVE-2021-27212)


Mail Server Exim
1010973* - Exim Mail Server Integer Overflow Vulnerability (CVE-2020-28020)


Microsoft Office
1010977 - Microsoft Office Remote Code Execution Vulnerability (CVE-2021-31176)


Web Client Common
1010974 - Adobe Acrobat And Reader Out-Of-Bounds Read Vulnerability (CVE-2021-28554)


Web Client Internet Explorer/Edge
1010981 - Microsoft Internet Explorer Remote Code Execution Vulnerability (CVE-2021-31959)


Web Server Miscellaneous
1010670* - Apache Struts2 Remote Code Execution Vulnerability (CVE-2020-17530)


Integrity Monitoring Rules:

There are no new or updated Integrity Monitoring Rules in this Security Update.


Log Inspection Rules:

1002795* - Microsoft Windows Events