Cloud One Workload Security and Deep Security Updates

  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    DCERPC Services
    1007134* - Batch File Uploaded On Network Share (ATT&CK T1021.002, T1204.002)
    1007064* - Executable File Uploaded On System32 Folder Through SMB Share (ATT&CK T1021.002, T1204.002)
    1007114* - Portable Executable File Uploaded On SMB Share (ATT&CK T1021.002, T1204.002)
    1007020* - Remote CreateService Request Detected Through SMBv1 Protocol (ATT&CK T1543.003)
    1007035* - Remote DeleteService Request Through SMBv1 Detected (ATT&CK T1543.003)
    1007069* - Remote Service Execution Through SMBv1 Detected (ATT&CK T1569.002)


    DNS Client
    1002988* - Multiple Vendors libspf2 DNS TXT Record Parsing Buffer Overflow


    File Sharing Applications
    1007608* - Amazon Cloud Drive (ATT&CK T1102.002, T1567.002)
    1007605* - BOX (ATT&CK T1102.002, T1567.002)
    1004707* - Dropbox (ATT&CK T1102.002, T1567.002)
    1002472* - FTP Client (ATT&CK T1048.003, T1071.002)
    1007463* - Microsoft OneDrive (ATT&CK T1102.002, T1567.002)


    Instant Messenger Applications
    1002103* - AOL Instant Messenger (ATT&CK T1102.002)
    1004663* - IP Messenger (ATT&CK T1102.002)
    1002507* - Jabber (ATT&CK T1102.002)
    1003067* - MSN Instant Message URL Blocker (ATT&CK T1102.002)
    1002162* - MSN Messenger (ATT&CK T1102.002)
    1002462* - MSN Messenger File Transfers (ATT&CK T1102.002)
    1004941* - QQ Messenger (ATT&CK T1102.002)


    Mail Client Applications
    1001112* - SMTP Client (ATT&CK T1071.003)


    Remote Login Applications
    1002508* - RDP (ATT&CK T1021.001)


    SSL Client
    1006561* - Identified Usage Of TLS/SSL EXPORT Cipher Suite In Response (ATT&CK T1573.002)


    SSL/TLS Server
    1006293* - Detected SSLv3 Request (ATT&CK T1573.002)
    1006297* - Identified CBC Based Cipher Suite In SSLv3 Response (ATT&CK T1573.002)
    1006311* - Identified Too Many SSL Alert Messages In SSLv3 Traffic (ATT&CK T1573.002)


    Suspicious Client Application Activity
    1001162* - Detected HTTP Client Traffic (ATT&CK T1071.001)
    1005324* - Detected SSLv2 Response (ATT&CK T1573.002)
    1005401* - Identified Suspicious HTTP Traffic (ATT&CK T1071.001)


    Suspicious Server Application Activity
    1003594* - Detected SSL/TLS Server Traffic (ATT&CK T1573.002)
    1005321* - Detected SSLv2 Request (ATT&CK T1573.002)
    1002378* - Detected Virtual Network Computing (VNC) Server Traffic (ATT&CK T1021.005)


    Trend Micro OfficeScan
    1011057 - Trend Micro Multiple Products Arbitrary File Upload Vulnerability (CVE-2021-36741)


    Web Application Common
    1011047* - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
    1011056* - WordPress 'SP Project & Document Manager' Plugin Remote Code Execution Vulnerability (CVE-2021-24347)
    1011038* - Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability (CVE-2021-20081)


    Web Application PHP Based
    1011045 - WordPress 'Modern Events Calendar Lite' Plugin Improper Access Control Vulnerability (CVE-2021-24146)


    Web Client Common
    1011032* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)
    1009407* - Detected Suspicious DLL Side Loading Attempt Over WebDAV (ATT&CK T1574.002)
    1006442* - Identified Suspicious Obfuscated JavaScript - 2 (ATT&CK T1203, T1001)
    1011054* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
    1011065 - Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability (CVE-2021-33742)
    1004302* - Microsoft Windows Shortcut Remote Code Execution


    Web Server Common
    1007213* - Disallow Upload Of A Class File (ATT&CK T1190)
    1007212* - Disallow Upload Of An Archive File (ATT&CK T1190)


    Web Server HTTPS
    1006741* - Identified SSL/TLS Diffie-Hellman Key Exchange Using Weak Parameters Server (ATT&CK T1573.002)
    1011050* - Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2021-34523)
    1011072 - Microsoft Exchange Server Security Feature Bypass Vulnerability (CVE-2021-31207)
    1011046 - rConfig 'vendor.crud.php' Arbitrary File Upload Vulnerability


    Web Server SharePoint
    1011051* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34520)


    Zoho ManageEngine
    1011062 - Zoho ManageEngine Applications Manager Cross Site Scripting Vulnerability (CVE-2021-31813)


    Zoho ManageEngine ADSelfService Plus
    1011064 - Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability (CVE-2021-28958)


    Integrity Monitoring Rules:

    1009643* - Linux/Unix - bash command history cleared (ATT&CK T1059.004)


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    DCERPC Services
    1009490* - Block Administrative Share - 1 (ATT&CK T1021.002)
    1010426* - Identified Domain-Level Account Discovery Over SMB (ATT&CK T1087.002)
    1009703* - Identified Domain-Level Permission Groups Discovery Over SMB (ATT&CK T1069.002)
    1010101* - Identified Usage Of PAExec Command Line Tool (ATT&CK T1569.002)
    1006906* - Identified Usage Of PsExec Command Line Tool (ATT&CK T1569.002)
    1005293* - Prevent Windows Administrator User Login Over SMB (ATT&CK T1078.002,T1078.001,T1021.002)


    DCERPC Services - Client
    1004373* - Identified DLL Side Loading Attempt Over Network Share (ATT&CK T1574.002)
    1010106* - Identified Downloading Of PowerShell Scripts Through SMB Share (ATT&CK T1059.001)


    Directory Server LDAP
    1010640* - Identified Remote Account Discovery Over LDAP (ATT&CK T1087.002)
    1010641* - Identified Remote Permission Groups Discovery Over LDAP (ATT&CK 1069.002)


    Remote Desktop Protocol Server
    1009562* - Identified Remote Desktop Protocol (RDP) Brute Force Attempt (ATT&CK T1110)
    1009343* - Identified Too Many SSL Alert Messages In SSLv3 Over RDP (ATT&CK T1021.001)


    Suspicious Client Application Activity
    1008946* - Heuristic Detection Of Suspicious Digital Certificate (ATT&CK T1587.003)
    1010327* - Identified Potential Malicious Client Traffic (ATT&CK T1071.001)
    1005299* - Identified Potentially Malicious RAT Traffic - III (ATT&CK T1571, T1219)
    1010307* - Identified Reverse Shell Communication Over HTTPS (ATT&CK T1071.001)
    1010306* - Identified Reverse Shell Communication Over HTTPS - 1 (ATT&CK T1071.001)
    1010364* - Identified Reverse Shell Communication Over HTTPS - 2 (ATT&CK T1071.001)
    1010365* - Identified Reverse Shell Communication Over HTTPS - 3 (ATT&CK T1071.001)
    1010370* - Identified Reverse Shell Communication Over HTTPS - 4 (ATT&CK T1071.001)
    1009952* - Identified WhatsApp Communication Attempt (ATT&CK T1102.002)


    Suspicious Server Application Activity
    1003593* - Detected SSH Server Traffic (ATT&CK T1021.004)
    1009549* - Detected Terminal Services (RDP) Server Traffic - 1 (ATT&CK T1021.001)
    1010328* - Identified Potential Malicious Server Traffic (ATT&CK T1071.001)


    Unix SSH
    1008313* - Identified Many SSH Client Key Exchange Requests (ATT&CK T1499.002, T1110)
    1005748* - Multiple SSH Connections Detected (ATT&CK T1499.002, T1110)


    Web Application Common
    1011047* - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
    1011056 - WordPress 'SP Project & Document Manager' Plugin Remote Code Execution Vulnerability (CVE-2021-24347)
    1011043* - WordPress 'XCloner' Plugin Remote Code Execution Vulnerability (CVE-2020-35948)
    1011038 - Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability (CVE-2021-20081)


    Web Client Common
    1011032* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)
    1011054 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-31206)
    1010956 - Microsoft Raw Image Extension Remote Code Execution Vulnerability (ZDI-21-506)


    Web Client SharePoint
    1011052 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34468)


    Web Media Applications
    1009913* - Identified Pastebin Communication (ATT&CK T1102.002)


    Web Server Common
    1010336* - Disallow Upload Of Linux Executable File (ATT&CK T1608.001)


    Web Server HTTPS
    1011050 - Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2021-34523)
    1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)


    Web Server Miscellaneous
    1011035* - Jenkins 'Generic Webhook Trigger' Plugin External Entity Injection Vulnerability (CVE-2021-21669)


    Web Server Nagios
    1011022* - Nagios XI Account Email Address Stored Cross-Site Scripting Vulnerability


    Web Server SharePoint
    1011051 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34520)
    1010738* - Restrict Attempt To Enumerate Microsoft SharePoint For User Accounts (ATT&CK T1087.003, T1087.002)


    Windows Remote Management
    1009894* - Powershell Remote Command Execution Via WinRM - HTTP (Request) (ATT&CK T1021.006, T1059.001)
    1010048* - WinRM Service Detected & Powershell RCE Over HTTP (ATT&CK T1021.006, T1059.001)


    Windows Remote Management Client
    1010073* - WinRM Service Detected & Powershell RCE Over HTTP - Client (ATT&CK T1021.006, T1059.001)


    Windows SMB Server
    1007065* - Executable File Uploaded On Network Share (ATT&CK T1570)
    1011058 - Identified DCERPC EfsRpcOpenFileRaw Call Over SMB Protocol


    Windows Services RPC Server DCERPC
    1009892* - Identified Domain-Level Credentials Dumping Over DCERPC (ATT&CK T1003.006)
    1009480* - Identified WMI Query Over DCE/RPC Protocol (ATT&CK T1047)


    Integrity Monitoring Rules:

    1003587* - Linux/Unix - Directory attributes of /bin modified (ATT&CK T1222.002)
    1002766* - Linux/Unix - Directory attributes of /sbin modified (ATT&CK T1222.002)
    1003573* - Linux/Unix - File attributes in the /bin directory modified
    1003513* - Linux/Unix - File attributes in the /etc directory modified
    1003514* - Linux/Unix - File attributes in the /lib directory modified
    1003574* - Linux/Unix - File attributes in the /sbin directory modified
    1002770* - Linux/Unix - File attributes in the /usr/bin and /usr/sbin directories modified
    1008464* - Linux/Unix - File attributes in the /usr/etc, /usr/lib, /usr/lib64, /usr/libexec And /usr/local directories modified
    1005193* - Linux/Unix - File attributes modified (ATT&CK T1070.002, T1222.002)
    1002771* - Linux/Unix - File permissions in the /var/log directory modified (ATT&CK T1222.002)
    1010389* - Linux/Unix - Process running from the /tmp and /var/tmp directories detected (ATT&CK T1543)


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    Pulsar Binary Protocol
    1010998* - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over Pulsar (CVE-2021-22160)


    Web Application Common
    1011047 - WordPress 'Modern Events Calendar' Plugin Remote Code Execution Vulnerability (CVE-2021-24145)
    1011043 - WordPress 'XCloner' Plugin Remote Code Execution Vulnerability (CVE-2020-35948)


    Web Client Common
    1011048 - Google Chrome Heap Corruption Vulnerability (CVE-2021-21166)
    1011049 - Google Chrome V8 Type Confusion Vulnerability (CVE-2021-30551)


    Web Client Internet Explorer/Edge
    1010133* - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2020-0674)


    Web Server HTTPS
    1011041* - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473)


    Web Server Miscellaneous
    1011035 - Jenkins 'Generic Webhook Trigger' Plugin External Entity Injection Vulnerability (CVE-2021-21669)
    1011028* - Jenkins 'Scriptler' Plugin Stored Cross-Site Scripting Vulnerability (CVE-2021-21667)


    Web Server Nagios
    1011023* - Nagios XI 'Custom-includes' Module Directory Traversal Vulnerability (CVE-2021-3277)
    1011022 - Nagios XI Account Email Address Stored Cross-Site Scripting Vulnerability


    Web Server SharePoint
    1011030* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34467)


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    Oracle E-Business Suite Web Interface
    1011019* - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2190)


    Pulsar Binary Protocol
    1010998 - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over Pulsar (CVE-2021-22160)


    Web Client Common
    1011032 - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-51)


    Web Client Internet Explorer/Edge
    1011040 - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2021-34448)


    Web Server Common
    1009705* - Atlassian Confluence Server Remote Code Execution Vulnerability (CVE-2019-3396)


    Web Server HTTPS
    1011041 - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-34473)


    Web Server Miscellaneous
    1011028 - Jenkins 'Scriptler' Plugin Stored Cross-Site Scripting Vulnerability (CVE-2021-21667)


    Web Server Nagios
    1011023 - Nagios XI 'Custom-includes' Module Directory Traversal Vulnerability (CVE-2021-3277)


    Web Server SharePoint
    1011030 - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-34467)


    Windows Server DCERPC
    1011016* - Identified DCERPC AddPrinterDriverEx Call Over TCP Protocol


    Zoho ManageEngine
    1011020* - Zoho ManageEngine Applications Manager Stored Cross-Site Scripting Vulnerability


    Integrity Monitoring Rules:

    1002875* - Linux/Unix - Software installed, updated or removed
    1010373* - Linux/Unix - Systemd service modified (ATT&CK T1543.002)
    1010791 - Linux/Unix - Task scheduler entries modified (ATT&CK T1053)
    1009643* - Linux/Unix - bash command history cleared (ATT&CK T1059.004)
    1009622* - Linux/Unix - bash non-root user configuration files modified (ATT&CK T1546.004)
    1011021 - Linux/Unix - bash root user configuration files modified (ATT&CK T1546.004)


    Log Inspection Rules:

    1011042 - SolarWinds Serv-U SSH EXCEPTION (CVE-2021-35211)
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    Directory Server LDAP
    1011008* - OpenLDAP Integer Underflow Vulnerability (CVE-2020-36221)


    Oracle E-Business Suite Web Interface
    1010999* - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2189)
    1011019 - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2190)


    Port Mapper Windows
    1001033* - Windows Port Mapper Decoder


    Web Application Common
    1005934* - Identified Suspicious Command Injection Attack


    Web Application PHP Based
    1010982* - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)


    Web Server Apache
    1010997* - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over HTTP (CVE-2021-22160)


    Web Server HTTPS
    1011015* - WordPress 'Poll, Survey, Questionnaire and Voting system' Plugin Blind SQL Injection Vulnerability


    Windows SMB Server
    1011018* - Identified DCERPC AddPrinterDriverEx Call Over SMB Protocol


    Windows Services RPC Server DCERPC
    1011016* - Identified DCERPC AddPrinterDriverEx Call Over TCP Protocol


    Zoho ManageEngine
    1011020 - Zoho ManageEngine Applications Manager Stored Cross-Site Scripting Vulnerability
    1011012* - Zoho ManageEngine Applications Manager URL Monitor SQL Injection Vulnerability


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    Port Mapper Windows
    1001033* - Windows Port Mapper Decoder


    Windows SMB Server
    1011018 - Identified DCERPC AddPrinterDriverEx Call Over SMB Protocol


    Windows Services RPC Server DCERPC
    1011016 - Identified DCERPC AddPrinterDriverEx Call Over TCP Protocol


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    1011017 - Microsoft Windows - Print Spooler Failed Loading Plugin Module (PrintNightmare)
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    DNS Server
    1010986* - ISC BIND TSIG Integer Overflow Vulnerability (CVE-2021-25216)


    Directory Server LDAP
    1011008 - OpenLDAP Integer Underflow Vulnerability (CVE-2020-36221)


    Oracle E-Business Suite Web Interface
    1010999 - Oracle E-Business Suite Denial Of Service Vulnerability (CVE-2021-2189)


    Web Application PHP Based
    1011013 - WordPress 'Stop Spammers' Plugin Cross-Site Scripting Vulnerability (CVE-2021-24245)
    1010982* - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)


    Web Client Common
    1010711* - Google Chrome Buffer Overflow Vulnerability (CVE-2019-5782)
    1011007 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-695)
    1011006 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-697)
    1011005 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-699)
    1011004 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-701)
    1011002 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-703)
    1011001 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-704)
    1011000 - Microsoft 3D Builder Remote Code Execution Vulnerability (ZDI-21-705)
    1011003 - Microsoft 3D Viewer Remote Code Execution Vulnerability (ZDI-21-702)
    1011011 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-696)
    1011010 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-698)
    1011009 - Microsoft Print 3D Remote Code Execution Vulnerability (ZDI-21-700)


    Web Server Apache
    1010997 - Apache Pulsar JSON Web Token Authentication Bypass Vulnerability Over HTTP (CVE-2021-22160)


    Web Server Common
    1010980* - Apache Airflow Remote Code Execution Vulnerability (CVE-2020-11978)
    1010985* - Subrion CMS Remote Code Execution Vulnerability (CVE-2018-19422)


    Web Server HTTPS
    1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)
    1011015 - WordPress 'Poll, Survey, Questionnaire and Voting system' Plugin Blind SQL Injection Vulnerability


    Zoho ManageEngine
    1011012 - Zoho ManageEngine Applications Manager URL Monitor SQL Injection Vulnerability


    Integrity Monitoring Rules:

    1010843 - Linux/Unix - Boot files modified (ATT&CK T1542)
    1010845 - Linux/Unix - Default firewall rules modified (ATT&CK T1562.004)
    1010846 - Linux/Unix - Disk configuration files modified (ATT&CK T1561.002)
    1010847 - Linux/Unix - SSL configuration files modified (ATT&CK T1587.003)
    1010793 - Linux/Unix - Shared object files modified
    1010856 - Linux/Unix - Static boot loader files modified (ATT&CK T1542)
    1010848 - Linux/Unix - User access control files modified (ATT&CK T1068)
    1010844 - Linux/Unix - modeprobe configuration files modified (ATT&CK T1547.006)


    Log Inspection Rules:

    1010139* - Microsoft Windows - Remote Desktop Services (ATT&CK T1021.001)
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    DNS Server
    1010986 - ISC BIND TSIG Integer Overflow Vulnerability (CVE-2021-25216)


    Microsoft Office
    1010991 - Microsoft Excel Remote Code Execution Vulnerability (CVE-2021-31939)
    1010992 - Microsoft Office Graphics Remote Code Execution Vulnerability (CVE-2021-31941)


    Web Application PHP Based
    1010993 - WordPress 'Directories Pro' Plugin Cross-Site Scripting Vulnerability (CVE-2020-29304)
    1010982* - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)


    Web Client Common
    1010974* - Adobe Acrobat And Reader Multiple Security Vulnerabilities (APSB21-37)
    1010978* - Microsoft Exchange Server Spoofing Vulnerability (CVE-2021-31209)
    1010995 - Microsoft Paint 3D Remote Code Execution Vulnerability (CVE-2021-31945)
    1010994 - Microsoft Paint 3D Remote Code Execution Vulnerability (CVE-2021-31946)
    1010996 - Microsoft Paint 3D Remote Code Execution Vulnerability (CVE-2021-31983)
    1010987 - Microsoft Visual Studio Remote Code Execution Vulnerability (CVE-2021-27068)


    Web Server Common
    1010985 - Subrion CMS Remote Code Execution Vulnerability (CVE-2018-19422)


    Web Server HTTPS
    1010983* - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)


    Web Server Miscellaneous
    1010976* - SolarWinds NPM 'FromJson' Remote Code Execution Vulnerability (CVE-2021-31474)


    Web Server Oracle
    1005128* - Oracle Business Transaction Management Server 'FlashTunnelService' WriteToFile Message Remote Code Execution


    Web Server SharePoint
    1010947* - Microsoft SharePoint Server Remote Code Execution Vulnerability (CVE-2021-31181)


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    DCERPC Services
    1010900* - Microsoft Windows SMB Information Disclosure Vulnerability (CVE-2021-28325)


    SolarWinds Orion NPM
    1010975 - SolarWinds Orion Job Scheduler Remote Code Execution Vulnerability (CVE-2021-31475)


    Web Application PHP Based
    1010982 - WordPress 'wpDiscuz' Plugin Remote Code Execution Vulnerability (CVE-2020-24186)


    Web Client Common
    1010978 - Microsoft Exchange Server Spoofing Vulnerability (CVE-2021-31209)
    1010984 - Microsoft Windows DWM Core Library Elevation of Privilege Vulnerability (CVE-2021-33739)
    1010207* - Microsoft Windows Multiple Type1 Font Parsing Remote Code Execution Vulnerabilities (CVE-2020-1020 and CVE-2020-0938)


    Web Server Common
    1010980 - Apache Airflow Remote Code Execution Vulnerability (CVE-2020-11978)


    Web Server HTTPS
    1010983 - VMware vCenter Server Remote Code Execution Vulnerability (CVE-2021-21985)


    Web Server Miscellaneous
    1010976 - SolarWinds NPM 'FromJson' Remote Code Execution Vulnerability (CVE-2021-31474)


    Integrity Monitoring Rules:

    1010821 - Linux/Unix - Alternative commands modified (ATT&CK T1036)
    1010842 - Linux/Unix - Boot loader configuration files modified (ATT&CK T1542)
    1010838 - Linux/Unix - Core system configuration files modified
    1010979 - Linux/Unix - FTP client process initiated (ATT&CK T1048)
    1010840 - Linux/Unix - Host access control files modified (ATT&CK T1584.004)
    1010964 - Linux/Unix - Internet routing information file modified
    1010963 - Linux/Unix - Kernel configuration files modified (ATT&CK T1547.006)
    1010809 - Linux/Unix - List of valid login shells modified (ATT&CK T1059.004)
    1010798 - Linux/Unix - Local user and group files modified (ATT&CK T1136.001, T1531)
    1010839 - Linux/Unix - Name of the local system modified (ATT&CK T1082)
    1010812 - Linux/Unix - Name resolver configuration files modified (ATT&CK T1071.004, T1583.002)
    1010962 - Linux/Unix - Network services configuration files modified
    1010813 - Linux/Unix - PAM configuration files modified (ATT&CK T1068)
    1010853 - Linux/Unix - Process initialization scripts and configuration files modified (ATT&CK 1037)
    1010817 - Linux/Unix - Run control (rc) scripts modified (ATT&CK T1037.004)
    1010815 - Linux/Unix - Samba configuration files modified (ATT&CK T1135)
    1010824 - Linux/Unix - Software repository modified (ATT&CK T1195.002)
    1010807 - Linux/Unix - System wide environment variables and startup scripts modified (ATT&CK T1546.004)
    1010825 - Linux/Unix - adduser, useradd and deluser configuration files modified (ATT&CK T1136.001, T1531)
    1010808 - Linux/Unix - bash configuration files modified (ATT&CK T1059.004, T1546.004)
    1010827 - Linux/Unix - csh/tcsh configuration files modified (ATT&CK T1059.004, T1546.004)
    1010826 - Linux/Unix - dhclient configuration files modified
    1010841 - Linux/Unix - ftpd configuration files modified (ATT&CK T1048, T1071.002)
    1010805 - Linux/Unix - runtime linker configuration files modified
    1010950 - Linux/Unix - sudo files modified (ATT&CK T1548.003)
    1010819 - Linux/Unix - xinetd configuration files modified
    1010828 - Linux/Unix - zsh configuration files modified (ATT&CK T1059.004, T1546.004)


    Log Inspection Rules:

    There are no new or updated Log Inspection Rules in this Security Update.
  • * indicates a new version of an existing rule

    Deep Packet Inspection Rules:

    Alibaba Nacos
    1010971* - Alibaba Nacos AuthFilter Authentication Bypass Vulnerability (CVE-2021-29441)


    Directory Server LDAP
    1010970* - OpenLDAP Slapd Search Parsing Denial Of Service Vulnerability (CVE-2021-27212)


    Mail Server Exim
    1010973* - Exim Mail Server Integer Overflow Vulnerability (CVE-2020-28020)


    Microsoft Office
    1010977 - Microsoft Office Remote Code Execution Vulnerability (CVE-2021-31176)


    Web Client Common
    1010974 - Adobe Acrobat And Reader Out-Of-Bounds Read Vulnerability (CVE-2021-28554)


    Web Client Internet Explorer/Edge
    1010981 - Microsoft Internet Explorer Remote Code Execution Vulnerability (CVE-2021-31959)


    Web Server Miscellaneous
    1010670* - Apache Struts2 Remote Code Execution Vulnerability (CVE-2020-17530)


    Integrity Monitoring Rules:

    There are no new or updated Integrity Monitoring Rules in this Security Update.


    Log Inspection Rules:

    1002795* - Microsoft Windows Events